{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.hedgedoc;
# 21.03 will not be an official release - it was instead 21.05. This
# versionAtLeast statement remains set to 21.03 for backwards compatibility.
# See https://github.com/NixOS/nixpkgs/pull/108899 and
# https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md.
name = if versionAtLeast config.system.stateVersion "21.03"
then "hedgedoc"
else "codimd";
settingsFormat = pkgs.formats.json {};
prettyJSON = conf:
pkgs.runCommandLocal "hedgedoc-config.json" {
nativeBuildInputs = [ pkgs.jq ];
} ''
jq '{production:del(.[]|nulls)|del(.[][]?|nulls)}' \
< ${settingsFormat.generate "hedgedoc-ugly.json" cfg.settings} \
> $out
'';
in
{
imports = [
(mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ])
(mkRenamedOptionModule
[ "services" "hedgedoc" "configuration" ] [ "services" "hedgedoc" "settings" ])
(mkRenamedOptionModule
[ "services" "hedgedoc" "groups" ] [ "users" "users" name "extraGroups" ])
(mkRemovedOptionModule [ "services" "hedgedoc" "workDir" ] ''
TODO: write paragraph
'')
];
options.services.hedgedoc = {
enable = mkEnableOption (lib.mdDoc "the HedgeDoc Markdown Editor");
enableUnixSocket = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
Sets up a socket at `/run/hedgedoc/hedgedoc.sock`.
This socket will be part of the `hedgedoc` group,
so if you want a webserver like nginx to be able to
communicate with this socket, you will have to add
the user of the webserver (nginx in this case) to
`users.groups.hedgedoc.members`
'';
};
settings = let options = {
# host = mkOption {
# type = types.str;
# default = "localhost";
# description = lib.mdDoc ''
# Address to listen on.
# '';
# };
# port = mkOption {
# type = types.port;
# default = 3000;
# example = 80;
# description = lib.mdDoc ''
# Port to listen on.
# '';
# };
# allowOrigin = mkOption {
# type = types.listOf types.str;
# default = [];
# example = [ "localhost" "hedgedoc.org" ];
# description = lib.mdDoc ''
# List of domains to whitelist.
# '';
# };
# useSSL = mkOption {
# type = types.bool;
# default = false;
# description = lib.mdDoc ''
# Enable to use SSL server. This will also enable
# {option}`protocolUseSSL`.
# '';
# };
# dbURL = mkOption {
# type = types.nullOr types.str;
# default = null;
# example = ''
# postgres://user:pass@host:5432/dbname
# '';
# description = lib.mdDoc ''
# Specify which database to use.
# HedgeDoc supports mysql, postgres, sqlite and mssql.
# See [
# https://sequelize.readthedocs.io/en/v3/](https://sequelize.readthedocs.io/en/v3/) for more information.
# Note: This option overrides {option}`db`.
# '';
# };
# db = mkOption {
# type = types.attrs;
# default = {};
# example = literalExpression ''
# {
# dialect = "sqlite";
# storage = "/var/lib/${name}/db.${name}.sqlite";
# }
# '';
# description = lib.mdDoc ''
# Specify the configuration for sequelize.
# HedgeDoc supports mysql, postgres, sqlite and mssql.
# See [
# https://sequelize.readthedocs.io/en/v3/](https://sequelize.readthedocs.io/en/v3/) for more information.
# Note: This option overrides {option}`db`.
# '';
# };
# sslKeyPath= mkOption {
# type = types.nullOr types.str;
# default = null;
# example = "/var/lib/hedgedoc/hedgedoc.key";
# description = lib.mdDoc ''
# Path to the SSL key. Needed when {option}`useSSL` is enabled.
# '';
# };
# sslCertPath = mkOption {
# type = types.nullOr types.str;
# default = null;
# example = "/var/lib/hedgedoc/hedgedoc.crt";
# description = lib.mdDoc ''
# Path to the SSL cert. Needed when {option}`useSSL` is enabled.
# '';
# };
# sslCAPath = mkOption {
# type = types.listOf types.str;
# default = [];
# example = [ "/var/lib/hedgedoc/ca.crt" ];
# description = lib.mdDoc ''
# SSL ca chain. Needed when {option}`useSSL` is enabled.
# '';
# };
# dhParamPath = mkOption {
# type = types.nullOr types.str;
# default = null;
# example = "/var/lib/hedgedoc/dhparam.pem";
# description = lib.mdDoc ''
# Path to the SSL dh params. Needed when {option}`useSSL` is enabled.
# '';
# };
# tmpPath = mkOption {
# type = types.str;
# default = "/tmp";
# description = lib.mdDoc ''
# Path to the temp directory HedgeDoc should use.
# Note that {option}`serviceConfig.PrivateTmp` is enabled for
# the HedgeDoc systemd service by default.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# defaultNotePath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/default.md";
# defaultText = literalExpression "\"\${cfg.package}/public/default.md\"";
# description = lib.mdDoc ''
# Path to the default Note file.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# docsPath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/docs";
# defaultText = literalExpression "\"\${cfg.package}/public/docs\"";
# description = lib.mdDoc ''
# Path to the docs directory.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# indexPath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/views/index.ejs";
# defaultText = literalExpression "\"\${cfg.package}/public/views/index.ejs\"";
# description = lib.mdDoc ''
# Path to the index template file.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# hackmdPath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/views/hackmd.ejs";
# defaultText = literalExpression "\"\${cfg.package}/public/views/hackmd.ejs\"";
# description = lib.mdDoc ''
# Path to the hackmd template file.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# errorPath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/views/error.ejs";
# defaultText = literalExpression "\"\${cfg.package}/public/views/error.ejs\"";
# description = lib.mdDoc ''
# Path to the error template file.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# prettyPath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/views/pretty.ejs";
# defaultText = literalExpression "\"\${cfg.package}/public/views/pretty.ejs\"";
# description = lib.mdDoc ''
# Path to the pretty template file.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# slidePath = mkOption {
# type = types.nullOr types.str;
# default = "${cfg.package}/public/views/slide.hbs";
# defaultText = literalExpression "\"\${cfg.package}/public/views/slide.hbs\"";
# description = lib.mdDoc ''
# Path to the slide template file.
# (Non-canonical paths are relative to HedgeDoc's base directory)
# '';
# };
# uploadsPath = mkOption {
# type = types.str;
# default = "${cfg.workDir}/uploads";
# defaultText = literalExpression "\"\${cfg.workDir}/uploads\"";
# description = lib.mdDoc ''
# Path under which uploaded files are saved.
# '';
# };
# ldap = mkOption {
# type = types.nullOr (types.submodule {
# options = {
# providerName = mkOption {
# type = types.str;
# default = "";
# description = lib.mdDoc ''
# Optional name to be displayed at login form, indicating the LDAP provider.
# '';
# };
# url = mkOption {
# type = types.str;
# example = "ldap://localhost";
# description = lib.mdDoc ''
# URL of LDAP server.
# '';
# };
# bindDn = mkOption {
# type = types.str;
# description = lib.mdDoc ''
# Bind DN for LDAP access.
# '';
# };
# bindCredentials = mkOption {
# type = types.str;
# description = lib.mdDoc ''
# Bind credentials for LDAP access.
# '';
# };
# searchBase = mkOption {
# type = types.str;
# example = "o=users,dc=example,dc=com";
# description = lib.mdDoc ''
# LDAP directory to begin search from.
# '';
# };
# searchFilter = mkOption {
# type = types.str;
# example = "(uid={{username}})";
# description = lib.mdDoc ''
# LDAP filter to search with.
# '';
# };
# searchAttributes = mkOption {
# type = types.nullOr (types.listOf types.str);
# default = null;
# example = [ "displayName" "mail" ];
# description = lib.mdDoc ''
# LDAP attributes to search with.
# '';
# };
# userNameField = mkOption {
# type = types.str;
# default = "";
# description = lib.mdDoc ''
# LDAP field which is used as the username on HedgeDoc.
# By default {option}`useridField` is used.
# '';
# };
# useridField = mkOption {
# type = types.str;
# example = "uid";
# description = lib.mdDoc ''
# LDAP field which is a unique identifier for users on HedgeDoc.
# '';
# };
# tlsca = mkOption {
# type = types.str;
# default = "/etc/ssl/certs/ca-certificates.crt";
# example = "server-cert.pem,root.pem";
# description = lib.mdDoc ''
# Root CA for LDAP TLS in PEM format.
# '';
# };
# };
# });
# default = null;
# description = lib.mdDoc "Configure the LDAP integration.";
# };
}; in lib.mkOption {
type = lib.types.submodule {
freeformType = settingsFormat.type;
inherit options;
};
description = lib.mdDoc ''
HedgeDoc configuration, see
<https://docs.hedgedoc.org/configuration/>
for documentation.
'';
};
environmentFile = mkOption {
type = with types; nullOr path;
default = null;
example = "/var/lib/hedgedoc/hedgedoc.env";
description = lib.mdDoc ''
Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the world-readable
Nix store, by specifying placeholder variables as the option value in Nix and
setting these variables accordingly in the environment file.
```
# snippet of HedgeDoc-related config
services.hedgedoc.settings.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb";
services.hedgedoc.settings.minio.secretKey = "$MINIO_SECRET_KEY";
```
```
# content of the environment file
DB_PASSWORD=verysecretdbpassword
MINIO_SECRET_KEY=verysecretminiokey
```
Note that this file needs to be available on the host on which
`HedgeDoc` is running.
'';
};
package = mkPackageOption pkgs "hedgedoc" { };
};
config = mkIf cfg.enable {
users.groups."hedgedoc" = { };
users.users.${name} = {
description = "HedgeDoc service user";
group = name;
isSystemUser = true;
};
systemd.services.hedgedoc = {
description = "HedgeDoc Service";
wantedBy = [ "multi-user.target" ];
after = [ "networking.target" ];
preStart = ''
${pkgs.envsubst}/bin/envsubst \
-o /var/lib/${name}/config.json \
-i ${prettyJSON cfg.settings}
'';
serviceConfig = {
RuntimeDirectory = [ name ];
# WorkingDirectory = "/var/lib/${}";
# StateDirectory = [ cfg.workDir cfg.settings.uploadsPath ];
ReadWriteDirectories = mkIf (cfg.settings ? "uploadsPath") [ cfg.settings.uploadsPath ];
StateDirectory = [ name ];
ExecStart = "${cfg.package}/bin/hedgedoc";
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
Environment = [
"CMD_CONFIG_FILE=/var/lib/${name}/config.json"
"NODE_ENV=production"
];
Restart = "always";
# DynamicUser = true;
User = name;
Group = name;
# Hardening
CapabilityBoundingSet = "";
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictSUIDSGID = true;
UMask = "0007";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ] ++ (lib.optional (cfg.settings.path != null) "AF_UNIX");
SystemCallArchitectures = "native";
SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
};
};
};
}