···354354Please note that contributors with commit rights unactive for more than three months will have their commit rights revoked.
355355-->
356356357357-Please see the discussion in [GitHub nixpkgs issue #50105](https://github.com/NixOS/nixpkgs/issues/50105) for information on how to proceed to be granted this level of access.
357357+Please see the discussion in [GitHub nixpkgs issue #321665](https://github.com/NixOS/nixpkgs/issues/321665) for information on how to proceed to be granted this level of access.
358358359359In a case a contributor definitively leaves the Nix community, they should create an issue or post on [Discourse](https://discourse.nixos.org) with references of packages and modules they maintain so the maintainership can be taken over by other contributors.
360360
···4848 };
4949 };
50505151+ # The original argument name `websocketPingFrequency` is a misnomer, as the frequency is the inverse of the interval.
5252+ websocketPingInterval = lib.mkOption {
5353+ description = "Frequency at which the client will send websocket ping to the server.";
5454+ type = lib.types.nullOr lib.types.ints.unsigned;
5555+ default = null;
5656+ };
5757+5158 loggingLevel = lib.mkOption {
5259 description = ''
5360 Passed to --log-lvl
···232239 default = true;
233240 };
234241235235- # The original argument name `websocketPingFrequency` is a misnomer, as the frequency is the inverse of the interval.
236236- websocketPingInterval = lib.mkOption {
237237- description = "Frequency at which the client will send websocket ping to the server.";
238238- type = lib.types.nullOr lib.types.ints.unsigned;
239239- default = null;
240240- };
241241-242242 upgradeCredentials = lib.mkOption {
243243 description = ''
244244 Use these credentials to authenticate during the HTTP upgrade request
···321321 tls-certificate =
322322 if useACMEHost != null then "${certConfig.directory}/fullchain.pem" else "${tlsCertificate}";
323323 tls-private-key = if useACMEHost != null then "${certConfig.directory}/key.pem" else "${tlsKey}";
324324+ websocket-ping-frequency-sec = websocketPingInterval;
324325 } extraArgs
325326 )
326327 } \
+28-21
nixos/modules/services/web-apps/gancio.nix
···5454 };
5555 baseurl = mkOption {
5656 type = types.str;
5757- default = "";
5858- example = "/gancio";
5959- description = "The URL path under which the server is reachable.";
5757+ default = "http${
5858+ lib.optionalString config.services.nginx.virtualHosts."${cfg.settings.hostname}".enableACME "s"
5959+ }://${cfg.settings.hostname}";
6060+ defaultText = lib.literalExpression ''"https://''${cfg.settings.hostname}"'';
6161+ example = "https://demo.gancio.org/gancio";
6262+ description = "The full URL under which the server is reachable.";
6063 };
6164 server = {
6262- host = mkOption {
6363- type = types.str;
6464- default = "localhost";
6565- example = "::";
6565+ socket = mkOption {
6666+ type = types.path;
6767+ readOnly = true;
6868+ default = "/run/gancio/socket";
6669 description = ''
6767- The address (IPv4, IPv6 or DNS) for the gancio server to listen on.
6868- '';
6969- };
7070- port = mkOption {
7171- type = types.port;
7272- default = 13120;
7373- description = ''
7474- Port number of the gancio server to listen on.
7070+ The unix socket for the gancio server to listen on.
7571 '';
7672 };
7773 };
···157153 };
158154159155 nginx = mkOption {
160160- type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
156156+ type = types.submodule (
157157+ lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
158158+ # enable encryption by default,
159159+ # as sensitive login credentials should not be transmitted in clear text.
160160+ options.forceSSL.default = true;
161161+ options.enableACME.default = true;
162162+ }
163163+ );
161164 default = { };
162165 example = {
163163- enableACME = true;
164164- forceSSL = true;
166166+ enableACME = false;
167167+ forceSSL = false;
165168 };
166169 description = "Extra configuration for the nginx virtual host of gancio.";
167170 };
···224227225228 serviceConfig = {
226229 ExecStart = "${getExe cfg.package} start ${configFile}";
230230+ # set umask so that nginx can write to the server socket
231231+ # FIXME: upstream socket permission configuration in Nuxt
232232+ UMask = "0002";
233233+ RuntimeDirectory = "gancio";
227234 StateDirectory = "gancio";
228235 WorkingDirectory = "/var/lib/gancio";
229236 LogsDirectory = "gancio";
···260267 virtualHosts."${cfg.settings.hostname}" = mkMerge [
261268 cfg.nginx
262269 {
263263- enableACME = mkDefault true;
264264- forceSSL = mkDefault true;
265270 locations = {
266271 "/" = {
267272 index = "index.html";
···269274 };
270275 "@proxy" = {
271276 proxyWebsockets = true;
272272- proxyPass = "http://${cfg.settings.server.host}:${toString cfg.settings.server.port}";
277277+ proxyPass = "http://unix:${cfg.settings.server.socket}";
273278 recommendedProxySettings = true;
274279 };
275280 };
276281 }
277282 ];
278283 };
284284+ # for nginx to access gancio socket
285285+ users.users."${config.services.nginx.user}".extraGroups = [ config.users.users.${cfg.user}.group ];
279286 };
280287}
+5-1
nixos/modules/virtualisation/podman/default.nix
···2121 {
2222 outputs = [ "out" "man" ];
2323 inherit (podmanPackage) meta;
2424+ preferLocalBuild = true;
2425 } ''
2526 mkdir -p $out/bin
2627 ln -s ${podmanPackage}/bin/podman $out/bin/docker
···235236 systemd.tmpfiles.packages = [
236237 # The /run/podman rule interferes with our podman group, so we remove
237238 # it and let the systemd socket logic take care of it.
238238- (pkgs.runCommand "podman-tmpfiles-nixos" { package = cfg.package; } ''
239239+ (pkgs.runCommand "podman-tmpfiles-nixos" {
240240+ package = cfg.package;
241241+ preferLocalBuild = true;
242242+ } ''
239243 mkdir -p $out/lib/tmpfiles.d/
240244 grep -v 'D! /run/podman 0700 root root' \
241245 <$package/lib/tmpfiles.d/podman.conf \
+1-1
nixos/tests/gancio.nix
···7171 server.wait_for_unit("postgresql")
7272 server.wait_for_unit("gancio")
7373 server.wait_for_unit("nginx")
7474- server.wait_for_open_port(13120)
7474+ server.wait_for_file("/run/gancio/socket")
7575 server.wait_for_open_port(80)
76767777 # Check can create user via cli