depot/nixos/modules/services/misc/bepasty.nix

{ config, lib, pkgs, ... }:
let
  gunicorn = pkgs.python3Packages.gunicorn;
  bepasty = pkgs.bepasty;
  gevent = pkgs.python3Packages.gevent;
  python = pkgs.python3Packages.python;
  cfg = config.services.bepasty;
  user = "bepasty";
  group = "bepasty";
  default_home = "/var/lib/bepasty";
in
{
  options.services.bepasty = {
    enable = lib.mkEnableOption "bepasty, a binary pastebin server";

    servers = lib.mkOption {
      default = {};
      description = ''
        configure a number of bepasty servers which will be started with
        gunicorn.
        '';
      type = with lib.types ; attrsOf (submodule ({ config, ... } : {

        options = {

          bind = lib.mkOption {
            type = lib.types.str;
            description = ''
              Bind address to be used for this server.
              '';
            example = "0.0.0.0:8000";
            default = "127.0.0.1:8000";
          };

          dataDir = lib.mkOption {
            type = lib.types.str;
            description = ''
              Path to the directory where the pastes will be saved to
              '';
            default = default_home+"/data";
          };

          defaultPermissions = lib.mkOption {
            type = lib.types.str;
            description = ''
              default permissions for all unauthenticated accesses.
              '';
            example = "read,create,delete";
            default = "read";
          };

          extraConfig = lib.mkOption {
            type = lib.types.lines;
            description = ''
              Extra configuration for bepasty server to be appended on the
              configuration.
              see https://bepasty-server.readthedocs.org/en/latest/quickstart.html#configuring-bepasty
              for all options.
              '';
            default = "";
            example = ''
              PERMISSIONS = {
                'myadminsecret': 'admin,list,create,read,delete',
              }
              MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000
              '';
          };

          secretKey = lib.mkOption {
            type = lib.types.str;
            description = ''
              server secret for safe session cookies, must be set.

              Warning: this secret is stored in the WORLD-READABLE Nix store!

              It's recommended to use {option}`secretKeyFile`
              which takes precedence over {option}`secretKey`.
              '';
            default = "";
          };

          secretKeyFile = lib.mkOption {
            type = lib.types.nullOr lib.types.str;
            default = null;
            description = ''
              A file that contains the server secret for safe session cookies, must be set.

              {option}`secretKeyFile` takes precedence over {option}`secretKey`.

              Warning: when {option}`secretKey` is non-empty {option}`secretKeyFile`
              defaults to a file in the WORLD-READABLE Nix store containing that secret.
              '';
          };

          workDir = lib.mkOption {
            type = lib.types.str;
            description = ''
              Path to the working directory (used for config and pidfile).
              Defaults to the users home directory.
              '';
            default = default_home;
          };

        };
        config = {
          secretKeyFile = lib.mkDefault (
            if config.secretKey != ""
            then toString (pkgs.writeTextFile {
              name = "bepasty-secret-key";
              text = config.secretKey;
            })
            else null
          );
        };
      }));
    };
  };

  config = lib.mkIf cfg.enable {

    environment.systemPackages = [ bepasty ];

    # creates gunicorn systemd service for each configured server
    systemd.services = lib.mapAttrs' (name: server:
      lib.nameValuePair ("bepasty-server-${name}-gunicorn")
        ({
          description = "Bepasty Server ${name}";
          wantedBy = [ "multi-user.target" ];
          after = [ "network.target" ];
          restartIfChanged = true;

          environment = let
            penv = python.buildEnv.override {
              extraLibs = [ bepasty gevent ];
            };
          in {
            BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
            PYTHONPATH= "${penv}/${python.sitePackages}/";
          };

          serviceConfig = {
            Type = "simple";
            PrivateTmp = true;
            ExecStartPre = assert server.secretKeyFile != null; pkgs.writeScript "bepasty-server.${name}-init" ''
              #!/bin/sh
              mkdir -p "${server.workDir}"
              mkdir -p "${server.dataDir}"
              chown ${user}:${group} "${server.workDir}" "${server.dataDir}"
              cat > ${server.workDir}/bepasty-${name}.conf <<EOF
              SITENAME="${name}"
              STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
              SECRET_KEY="$(cat "${server.secretKeyFile}")"
              DEFAULT_PERMISSIONS="${server.defaultPermissions}"
              ${server.extraConfig}
              EOF
            '';
            ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
              -u ${user} \
              -g ${group} \
              --workers 3 --log-level=info \
              --bind=${server.bind} \
              --pid ${server.workDir}/gunicorn-${name}.pid \
              -k gevent
            '';
          };
        })
    ) cfg.servers;

    users.users.${user} =
      { uid = config.ids.uids.bepasty;
        group = group;
        home = default_home;
      };

    users.groups.${group}.gid = config.ids.gids.bepasty;
  };
}