b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos/miniflux: don't depend on sudo

Browse source 
The miniflux service should work when sudo is not available in the
system.
This commit is contained in:
Matías Lang 2021-01-28 15:09:31 -03:00
parent d5f51d0660
commit dac07be800
2 changed files with 31 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
nixos/modules/services/web-apps/miniflux.nix
View file

@ -14,17 +14,16 @@ let
ADMIN_PASSWORD=password ADMIN_PASSWORD=password
''; '';
pgsu = "${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser}";
pgbin = "${config.services.postgresql.package}/bin"; pgbin = "${config.services.postgresql.package}/bin";
preStart = pkgs.writeScript "miniflux-pre-start" '' preStart = pkgs.writeScript "miniflux-pre-start" ''
#!${pkgs.runtimeShell} #!${pkgs.runtimeShell}
db_exists() { db_exists() {
[ "$(${pgsu} ${pgbin}/psql -Atc "select 1 from pg_database where datname='$1'")" == "1" ] [ "$(${pgbin}/psql -Atc "select 1 from pg_database where datname='$1'")" == "1" ]
} }
if ! db_exists "${dbName}"; then if ! db_exists "${dbName}"; then
${pgsu} ${pgbin}/psql postgres -c "CREATE ROLE ${dbUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${dbPassword}'" ${pgbin}/psql postgres -c "CREATE ROLE ${dbUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${dbPassword}'"
${pgsu} ${pgbin}/createdb --owner "${dbUser}" "${dbName}" ${pgbin}/createdb --owner "${dbUser}" "${dbName}"
${pgsu} ${pgbin}/psql "${dbName}" -c "CREATE EXTENSION IF NOT EXISTS hstore" ${pgbin}/psql "${dbName}" -c "CREATE EXTENSION IF NOT EXISTS hstore"
fi fi
''; '';
in in
@ -73,15 +72,26 @@ in
services.postgresql.enable = true; services.postgresql.enable = true;
systemd.services.miniflux-dbsetup = {
description = "Miniflux database setup";
wantedBy = [ "multi-user.target" ];
requires = [ "postgresql.service" ];
after = [ "network.target" "postgresql.service" ];
serviceConfig = {
Type = "oneshot";
User = config.services.postgresql.superUser;
ExecStart = preStart;
};
};
systemd.services.miniflux = { systemd.services.miniflux = {
description = "Miniflux service"; description = "Miniflux service";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "postgresql.service" ]; requires = [ "postgresql.service" ];
after = [ "network.target" "postgresql.service" ]; after = [ "network.target" "postgresql.service" "miniflux-dbsetup.service" ];
serviceConfig = { serviceConfig = {
ExecStart = "${pkgs.miniflux}/bin/miniflux"; ExecStart = "${pkgs.miniflux}/bin/miniflux";
ExecStartPre = "+${preStart}";
DynamicUser = true; DynamicUser = true;
RuntimeDirectory = "miniflux"; RuntimeDirectory = "miniflux";
RuntimeDirectoryMode = "0700"; RuntimeDirectoryMode = "0700";

14
nixos/tests/miniflux.nix
View file

@ -20,6 +20,13 @@ with lib;
services.miniflux.enable = true; services.miniflux.enable = true;
}; };
withoutSudo =
{ ... }:
{
services.miniflux.enable = true;
security.sudo.enable = false;
};
customized = customized =
{ ... }: { ... }:
{ {
@ -46,6 +53,13 @@ with lib;
"curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep -q '\"is_admin\":true'" "curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep -q '\"is_admin\":true'"
) )
withoutSudo.wait_for_unit("miniflux.service")
withoutSudo.wait_for_open_port(${toString defaultPort})
withoutSudo.succeed("curl --fail 'http://localhost:${toString defaultPort}/healthcheck' | grep -q OK")
withoutSudo.succeed(
"curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep -q '\"is_admin\":true'"
)
customized.wait_for_unit("miniflux.service") customized.wait_for_unit("miniflux.service")
customized.wait_for_open_port(${toString port}) customized.wait_for_open_port(${toString port})
customized.succeed("curl --fail 'http://localhost:${toString port}/healthcheck' | grep -q OK") customized.succeed("curl --fail 'http://localhost:${toString port}/healthcheck' | grep -q OK")