git.iko.soy/typeable/nixpkgs
on master help sign in
isso: added NixOS module to configure `isso` in NixOS
commit86296623c6782af4c4f5600d5812faf337c1db61 authorBenjamin Asbach <asbachb@users.noreply.github.com> dateSat 7 Aug 2021, 00:32 (5 years ago) parentc1a7bbc
5 files changed+90−49
compare with master
unifiedsplit
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+7−35 nixos/doc/manual/release-notes/rl-2111.section.md+3−6 nixos/modules/module-list.nix+1 nixos/modules/services/web-apps/isso.nix+69 nixos/tests/isso.nix+10−8
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+7−35
@@ -164,6 +164,13 @@
164164 <link linkend="opt-services.influxdb2.enable">services.influxdb2</link>.
165165 </para>
166166 </listitem>
167+ <listitem>
168+ <para>
169+ <link xlink:href="https://posativ.org/isso/">isso</link>, a
170+ commenting server similar to Disqus. Available as
171+ <link linkend="opt-services.isso.enable">isso</link>
172+ </para>
173+ </listitem>
167174 </itemizedlist>
168175 </section>
169176 <section xml:id="sec-release-21.11-incompatibilities">
@@ -654,32 +661,6 @@
654661 to use wildcards in the <literal>source</literal> argument.
655662 </para>
656663 </listitem>
657− <listitem>
658− <para>
659− The <literal>openrazer</literal> and
660− <literal>openrazer-daemon</literal> packages as well as the
661− <literal>hardware.openrazer</literal> module now require users
662− to be members of the <literal>openrazer</literal> group
663− instead of <literal>plugdev</literal>. With this change, users
664− no longer need be granted the entire set of
665− <literal>plugdev</literal> group permissions, which can
666− include permissions other than those required by
667− <literal>openrazer</literal>. This is desirable from a
668− security point of view. The setting
669− <link xlink:href="options.html#opt-services.hardware.openrazer.users"><literal>harware.openrazer.users</literal></link>
670− can be used to add users to the <literal>openrazer</literal>
671− group.
672− </para>
673− </listitem>
674− <listitem>
675− <para>
676− The <literal>yambar</literal> package has been split into
677− <literal>yambar</literal> and
678− <literal>yambar-wayland</literal>, corresponding to the xorg
679− and wayland backend respectively. Please switch to
680− <literal>yambar-wayland</literal> if you are on wayland.
681− </para>
682− </listitem>
683664 </itemizedlist>
684665 </section>
685666 <section xml:id="sec-release-21.11-notable-changes">
@@ -849,15 +830,6 @@
849830 version of zfs.
850831 </para>
851832 </listitem>
852− <listitem>
853− <para>
854− Nginx will use the value of
855− <literal>sslTrustedCertificate</literal> if provided for a
856− virtual host, even if <literal>enableACME</literal> is set.
857− This is useful for providers not using the same certificate to
858− sign OCSP responses and server certificates.
859− </para>
860− </listitem>
861833 </itemizedlist>
862834 </section>
863835</section>
nixos/doc/manual/release-notes/rl-2111.section.md+3−6
@@ -50,6 +50,9 @@ pt-services.clipcat.enable).
5050
5151- [influxdb2](https://github.com/influxdata/influxdb), a Scalable datastore for metrics, events, and real-time analytics. Available as [services.influxdb2](#opt-services.influxdb2.enable).
5252
53+- [isso](https://posativ.org/isso/), a commenting server similar to Disqus.
54+ Available as [isso](#opt-services.isso.enable)
55+
5356## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
5457
5558- The `staticjinja` package has been upgraded from 1.0.4 to 3.0.1
@@ -166,10 +169,6 @@ pt-services.clipcat.enable).
166169
167170- `programs.neovim.runtime` switched to a `linkFarm` internally, making it impossible to use wildcards in the `source` argument.
168171
169−- The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`harware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.
170−
171−- The `yambar` package has been split into `yambar` and `yambar-wayland`, corresponding to the xorg and wayland backend respectively. Please switch to `yambar-wayland` if you are on wayland.
172−
173172## Other Notable Changes {#sec-release-21.11-notable-changes}
174173
175174- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
@@ -215,5 +214,3 @@ pt-services.clipcat.enable).
215214- The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
216215
217216- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
218−
219−- Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.
nixos/modules/module-list.nix+1
@@ -960,6 +960,7 @@
960960 ./services/web-apps/icingaweb2/icingaweb2.nix
961961 ./services/web-apps/icingaweb2/module-monitoring.nix
962962 ./services/web-apps/ihatemoney
963+ ./services/web-apps/isso.nix
963964 ./services/web-apps/jirafeau.nix
964965 ./services/web-apps/jitsi-meet.nix
965966 ./services/web-apps/keycloak.nix
nixos/modules/services/web-apps/isso.nixnew file+69
@@ -0,0 +1,69 @@
1+{ config, lib, pkgs, ... }:
2+
3+let
4+ inherit (lib) mkEnableOption mkIf mkOption types literalExample;
5+
6+ cfg = config.services.isso;
7+
8+ settingsFormat = pkgs.formats.ini { };
9+ configFile = settingsFormat.generate "isso.conf" cfg.settings;
10+in {
11+
12+ options = {
13+ services.isso = {
14+ enable = mkEnableOption ''
15+ A commenting server similar to Disqus.
16+
17+ Note: The application's author suppose to run isso behind a reverse proxy.
18+ The embedded solution offered by NixOS is also only suitable for small installations
19+ below 20 requests per second.
20+ '';
21+
22+ settings = mkOption {
23+ description = ''
24+ Configuration for <package>isso</package>.
25+
26+ See <link xlink:href="https://posativ.org/isso/docs/configuration/server/">Isso Server Configuration</link>
27+ for supported values.
28+ '';
29+
30+ type = types.submodule {
31+ freeformType = settingsFormat.type;
32+ };
33+
34+ example = literalExample ''
35+ {
36+ general = {
37+ host = "http://localhost";
38+ };
39+ }
40+ '';
41+ };
42+ };
43+ };
44+
45+ config = mkIf cfg.enable {
46+ services.isso.settings.general.dbpath = lib.mkDefault "/var/lib/isso/comments.db";
47+
48+ systemd.services.isso = {
49+ description = "isso, a commenting server similar to Disqus";
50+ wantedBy = [ "multi-user.target" ];
51+
52+ serviceConfig = {
53+ User = "isso";
54+ Group = "isso";
55+
56+ DynamicUser = true;
57+
58+ StateDirectory = "isso";
59+
60+ ExecStart = ''
61+ ${pkgs.isso}/bin/isso -c ${configFile}
62+ '';
63+
64+ Restart = "on-failure";
65+ RestartSec = 1;
66+ };
67+ };
68+ };
69+}
nixos/tests/isso.nix+10−8
@@ -5,20 +5,22 @@ import ./make-test-python.nix ({ pkgs, ... }: {
55 };
66
77 machine = { config, pkgs, ... }: {
8− environment.systemPackages = [ pkgs.isso ];
8+ services.isso = {
9+ enable = true;
10+ settings = {
11+ general = {
12+ dbpath = "/var/lib/isso/comments.db";
13+ host = "http://localhost";
14+ };
15+ };
16+ };
917 };
1018
1119 testScript = let
12− issoConfig = pkgs.writeText "minimal-isso.conf" ''
13− [general]
14− dbpath = /tmp/isso-comments.db
15− host = http://localhost
16− '';
17−
1820 port = 8080;
1921 in
2022 ''
21− machine.succeed("isso -c ${issoConfig} &")
23+ machine.wait_for_unit("isso.service")
2224
2325 machine.wait_for_open_port("${toString port}")
2426