git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #163673 from lukegb/pomerium

pomerium: 0.15.7 -> 0.17.0

commit8035c513e36fc2db98948a3eeaa2a0fdc1a1e853 authorLuke Granger-Brown <git@lukegb.com> dateSun 13 Mar 2022, 02:20 (5 years ago) parentc01da72c19e76b
6 files changed+86−8
nixos/doc/manual/from_md/release-notes/rl-2205.section.xml+10 nixos/doc/manual/release-notes/rl-2205.section.md+5 nixos/modules/services/web-servers/pomerium.nix+7−3 pkgs/servers/http/pomerium/default.nix+5−5 pkgs/tools/security/pomerium-cli/default.nix+58 pkgs/top-level/all-packages.nix+1
nixos/doc/manual/from_md/release-notes/rl-2205.section.xml+10
@@ -1374,6 +1374,16 @@
13741374 warning.
13751375 </para>
13761376 </listitem>
1377+ <listitem>
1378+ <para>
1379+ The <literal>pomerium-cli</literal> command has been moved out
1380+ of the <literal>pomerium</literal> package into the
1381+ <literal>pomerium-cli</literal> package, following upstream’s
1382+ repository split. If you are using the
1383+ <literal>pomerium-cli</literal> command, you should now
1384+ install the <literal>pomerium-cli</literal> package.
1385+ </para>
1386+ </listitem>
13771387 <listitem>
13781388 <para>
13791389 The option
nixos/doc/manual/release-notes/rl-2205.section.md+5
@@ -503,6 +503,11 @@ In addition to numerous new and upgraded packages, this release has the followin
503503 Reason is that the old name has been deprecated upstream.
504504 Using the old option name will still work, but produce a warning.
505505
506+- The `pomerium-cli` command has been moved out of the `pomerium` package into
507+ the `pomerium-cli` package, following upstream's repository split. If you are
508+ using the `pomerium-cli` command, you should now install the `pomerium-cli`
509+ package.
510+
506511- The option
507512 [services.networking.networkmanager.enableFccUnlock](#opt-networking.networkmanager.enableFccUnlock)
508513 was added to support FCC unlock procedures. Since release 1.18.4, the ModemManager
nixos/modules/services/web-servers/pomerium.nix+7−3
@@ -69,11 +69,16 @@ in
6969 CERTIFICATE_KEY_FILE = "key.pem";
7070 };
7171 startLimitIntervalSec = 60;
72+ script = ''
73+ if [[ -v CREDENTIALS_DIRECTORY ]]; then
74+ cd "$CREDENTIALS_DIRECTORY"
75+ fi
76+ exec "${pkgs.pomerium}/bin/pomerium" -config "${cfgFile}"
77+ '';
7278
7379 serviceConfig = {
7480 DynamicUser = true;
7581 StateDirectory = [ "pomerium" ];
76− ExecStart = "${pkgs.pomerium}/bin/pomerium -config ${cfgFile}";
7782
7883 PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
7984 MemoryDenyWriteExecute = false; # breaks LuaJIT
@@ -99,7 +104,6 @@ in
99104 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
100105 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
101106
102− WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY";
103107 LoadCredential = optionals (cfg.useACMEHost != null) [
104108 "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
105109 "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
@@ -124,7 +128,7 @@ in
124128 Type = "oneshot";
125129 TimeoutSec = 60;
126130 ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service";
127− ExecStart = "/run/current-system/systemd/bin/systemctl restart pomerium.service";
131+ ExecStart = "/run/current-system/systemd/bin/systemctl --no-block restart pomerium.service";
128132 };
129133 };
130134 });
pkgs/servers/http/pomerium/default.nix+5−5
@@ -4,6 +4,7 @@
44, envoy
55, zip
66, nixosTests
7+, pomerium-cli
78}:
89
910let
@@ -11,18 +12,17 @@ let
1112in
1213buildGoModule rec {
1314 pname = "pomerium";
14− version = "0.15.7";
15+ version = "0.17.0";
1516 src = fetchFromGitHub {
1617 owner = "pomerium";
1718 repo = "pomerium";
1819 rev = "v${version}";
19− hash = "sha256:0adlk4ylny1z43x1dw3ny0s1932vhb61hpf5wdz4r65y8k9qyfgr";
20+ hash = "sha256:1hv76i6k9f0kp527nxlxqhklsvkh2cmfnqlszmlk2hxij31qnf8q";
2021 };
2122
22− vendorSha256 = "sha256:1fszfbra84pcs8v1h2kf7iy603vf9v2ysg6il76aqmqrxmb1p7nv";
23+ vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
2324 subPackages = [
2425 "cmd/pomerium"
25− "cmd/pomerium-cli"
2626 ];
2727
2828 ldflags = let
@@ -74,11 +74,11 @@ buildGoModule rec {
7474
7575 installPhase = ''
7676 install -Dm0755 $GOPATH/bin/pomerium $out/bin/pomerium
77− install -Dm0755 $GOPATH/bin/pomerium-cli $out/bin/pomerium-cli
7877 '';
7978
8079 passthru.tests = {
8180 inherit (nixosTests) pomerium;
81+ inherit pomerium-cli;
8282 };
8383
8484 meta = with lib; {
pkgs/tools/security/pomerium-cli/default.nixnew file+58
@@ -0,0 +1,58 @@
1+{ buildGoModule
2+, fetchFromGitHub
3+, lib
4+, pomerium
5+}:
6+
7+let
8+ inherit (lib) concatStringsSep concatMap id mapAttrsToList;
9+in
10+buildGoModule rec {
11+ pname = "pomerium-cli";
12+ version = pomerium.version;
13+ src = fetchFromGitHub {
14+ owner = "pomerium";
15+ repo = "cli";
16+ rev = "v${version}";
17+ hash = "sha256:0230b22xjnpykj8bcdahzzlsvlrd63z2cmg6yb246c5ngjs835q1";
18+ };
19+
20+ vendorSha256 = "sha256:0xx22lmh6wip1d1bjrp4lgab3q9yilw54v4lg24lf3xhbsr5si9b";
21+ subPackages = [
22+ "cmd/pomerium-cli"
23+ ];
24+
25+ ldflags = let
26+ # Set a variety of useful meta variables for stamping the build with.
27+ setVars = {
28+ "github.com/pomerium/cli/version" = {
29+ Version = "v${version}";
30+ BuildMeta = "nixpkgs";
31+ ProjectName = "pomerium-cli";
32+ ProjectURL = "github.com/pomerium/cli";
33+ };
34+ };
35+ concatStringsSpace = list: concatStringsSep " " list;
36+ mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list);
37+ varFlags = concatStringsSpace (
38+ mapAttrsToFlatList (package: packageVars:
39+ mapAttrsToList (variable: value:
40+ "-X ${package}.${variable}=${value}"
41+ ) packageVars
42+ ) setVars);
43+ in [
44+ "${varFlags}"
45+ ];
46+
47+ installPhase = ''
48+ install -Dm0755 $GOPATH/bin/pomerium-cli $out/bin/pomerium-cli
49+ '';
50+
51+ meta = with lib; {
52+ homepage = "https://pomerium.io";
53+ description = "Client-side helper for Pomerium authenticating reverse proxy";
54+ license = licenses.asl20;
55+ maintainers = with maintainers; [ lukegb ];
56+ platforms = platforms.unix;
57+ };
58+}
pkgs/top-level/all-packages.nix+1
@@ -21618,6 +21618,7 @@ with pkgs;
2161821618 pflogsumm = callPackage ../servers/mail/postfix/pflogsumm.nix { };
2161921619
2162021620 pomerium = callPackage ../servers/http/pomerium { };
21621+ pomerium-cli = callPackage ../tools/security/pomerium-cli { };
2162121622
2162221623 postgrey = callPackage ../servers/mail/postgrey { };
2162321624