···55let
66 cfg = config.services.plausible;
7788- # FIXME consider using LoadCredential as soon as it actually works.
99- envSecrets = ''
1010- ADMIN_USER_PWD="$(<${cfg.adminUser.passwordFile})"
1111- export ADMIN_USER_PWD # separate export to make `set -e` work
1212-1313- SECRET_KEY_BASE="$(<${cfg.server.secretKeybaseFile})"
1414- export SECRET_KEY_BASE # separate export to make `set -e` work
1515-1616- ${optionalString (cfg.mail.smtp.passwordFile != null) ''
1717- SMTP_USER_PWD="$(<${cfg.mail.smtp.passwordFile})"
1818- export SMTP_USER_PWD # separate export to make `set -e` work
1919- ''}
2020- '';
218in {
229 options.services.plausible = {
2310 enable = mkEnableOption "plausible";
···184171 enable = true;
185172 };
186173174174+ services.epmd.enable = true;
175175+187176 systemd.services = mkMerge [
188177 {
189178 plausible = {
190179 inherit (pkgs.plausible.meta) description;
191180 documentation = [ "https://plausible.io/docs/self-hosting" ];
192181 wantedBy = [ "multi-user.target" ];
193193- after = optional cfg.database.postgres.setup "plausible-postgres.service";
182182+ after = optionals cfg.database.postgres.setup [ "postgresql.service" "plausible-postgres.service" ];
194183 requires = optional cfg.database.clickhouse.setup "clickhouse.service"
195184 ++ optionals cfg.database.postgres.setup [
196185 "postgresql.service"
···200189 environment = {
201190 # NixOS specific option to avoid that it's trying to write into its store-path.
202191 # See also https://github.com/lau/tzdata#data-directory-and-releases
203203- TZDATA_DIR = "/var/lib/plausible/elixir_tzdata";
192192+ STORAGE_DIR = "/var/lib/plausible/elixir_tzdata";
204193205194 # Configuration options from
206195 # https://plausible.io/docs/self-hosting-configuration
···231220232221 path = [ pkgs.plausible ]
233222 ++ optional cfg.database.postgres.setup config.services.postgresql.package;
223223+ script = ''
224224+ export CONFIG_DIR=$CREDENTIALS_DIRECTORY
225225+226226+ # setup
227227+ ${pkgs.plausible}/createdb.sh
228228+ ${pkgs.plausible}/migrate.sh
229229+ ${optionalString cfg.adminUser.activate ''
230230+ if ! ${pkgs.plausible}/init-admin.sh | grep 'already exists'; then
231231+ psql -d plausible <<< "UPDATE users SET email_verified=true;"
232232+ fi
233233+ ''}
234234+ plausible start
235235+ '';
234236235237 serviceConfig = {
236238 DynamicUser = true;
237239 PrivateTmp = true;
238240 WorkingDirectory = "/var/lib/plausible";
239241 StateDirectory = "plausible";
240240- ExecStartPre = "@${pkgs.writeShellScript "plausible-setup" ''
241241- set -eu -o pipefail
242242- ${envSecrets}
243243- ${pkgs.plausible}/createdb.sh
244244- ${pkgs.plausible}/migrate.sh
245245- ${optionalString cfg.adminUser.activate ''
246246- if ! ${pkgs.plausible}/init-admin.sh | grep 'already exists'; then
247247- psql -d plausible <<< "UPDATE users SET email_verified=true;"
248248- fi
249249- ''}
250250- ''} plausible-setup";
251251- ExecStart = "@${pkgs.writeShellScript "plausible" ''
252252- set -eu -o pipefail
253253- ${envSecrets}
254254- plausible start
255255- ''} plausible";
242242+ LoadCredential = [
243243+ "ADMIN_USER_PWD:${cfg.adminUser.passwordFile}"
244244+ "SECRET_KEY_BASE:${cfg.server.secretKeybaseFile}"
245245+ ] ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [ "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"];
256246 };
257247 };
258248 }
···260250 # `plausible' requires the `citext'-extension.
261251 plausible-postgres = {
262252 after = [ "postgresql.service" ];
263263- bindsTo = [ "postgresql.service" ];
264264- requiredBy = [ "plausible.service" ];
265253 partOf = [ "plausible.service" ];
266266- serviceConfig.Type = "oneshot";
267267- unitConfig.ConditionPathExists = "!/var/lib/plausible/.db-setup";
268268- script = ''
269269- mkdir -p /var/lib/plausible/
254254+ serviceConfig = {
255255+ Type = "oneshot";
256256+ User = config.services.postgresql.superUser;
257257+ RemainAfterExit = true;
258258+ };
259259+ script = with cfg.database.postgres; ''
270260 PSQL() {
271271- /run/wrappers/bin/sudo -Hu postgres ${config.services.postgresql.package}/bin/psql --port=5432 "$@"
261261+ ${config.services.postgresql.package}/bin/psql --port=5432 "$@"
272262 }
273273- PSQL -tAc "CREATE ROLE plausible WITH LOGIN;"
274274- PSQL -tAc "CREATE DATABASE plausible WITH OWNER plausible;"
275275- PSQL -d plausible -tAc "CREATE EXTENSION IF NOT EXISTS citext;"
276276- touch /var/lib/plausible/.db-setup
263263+ # check if the database already exists
264264+ if ! PSQL -lqt | ${pkgs.coreutils}/bin/cut -d \| -f 1 | ${pkgs.gnugrep}/bin/grep -qw ${dbname} ; then
265265+ PSQL -tAc "CREATE ROLE plausible WITH LOGIN;"
266266+ PSQL -tAc "CREATE DATABASE ${dbname} WITH OWNER plausible;"
267267+ PSQL -d ${dbname} -tAc "CREATE EXTENSION IF NOT EXISTS citext;"
268268+ fi
277269 '';
278270 };
279271 })
+8
nixos/tests/doas.nix
···8585 # ../../pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch
8686 with subtest("recursive calls to doas from subprocesses should succeed"):
8787 machine.succeed('doas -u test0 sh -c "doas -u test0 true"')
8888+8989+ with subtest("test0 should inherit TERMINFO_DIRS from the user environment"):
9090+ dirs = machine.succeed(
9191+ "su - test0 -c 'doas -u root $SHELL -c \"echo \$TERMINFO_DIRS\"'"
9292+ )
9393+9494+ if not "test0" in dirs:
9595+ raise Exception(f"user profile TERMINFO_DIRS is not preserved: {dirs}")
8896 '';
8997 }
9098)
···11-diff --git a/config/runtime.exs b/config/runtime.exs
22-index 7c9cc14..8facd05 100644
33---- a/config/runtime.exs
44-+++ b/config/runtime.exs
55-@@ -15,9 +15,7 @@ end
66- base_url = URI.parse(base_url)
77-88- if base_url.scheme not in ["http", "https"] do
99-- raise "BASE_URL must start with `http` or `https`. Currently configured as `#{
1010-- System.get_env("BASE_URL")
1111-- }`"
1212-+ raise "BASE_URL must start with `http` or `https`. Currently configured as `#{System.get_env("BASE_URL")}`"
1313- end
1414-1515- secret_key_base =
1616-@@ -300,3 +298,5 @@ if appsignal_api_key do
1717- env: env,
1818- active: true
1919- end
2020-+
2121-+config :tzdata, :data_dir, System.get_env("TZDATA_DIR", "priv")
+1-6
pkgs/servers/web-apps/plausible/update.sh
···66#
77# * Add correct `name`/`version` field to `package.json`, otherwise `yarn2nix` fails to
88# find required dependencies.
99-# * Keep `tailwindcss` on version 2.0.1-compat (on `yarn` it will be upgraded due to the `^`).
1010-# This is needed to make sure the entire build still works with `postcss-7` (needed
1111-# by plausible).
129# * Adjust `file:`-dependencies a bit for the structure inside a Nix build.
1310# * Update hashes for the tarball & the fixed-output drv with all `mix`-dependencies.
1411# * Generate `yarn.lock` & `yarn.nix` in a temporary directory.
···2926SRC="https://raw.githubusercontent.com/plausible/analytics/${latest}"
30273128package_json="$(curl -qf "$SRC/assets/package.json")"
3232-export fixed_tailwind_version="$(jq '.dependencies.tailwindcss' -r <<< "$package_json" | sed -e 's,^^,,g')"
33293430echo "$package_json" \
3535- | jq '. + {"name":"plausible","version": $ENV.latest} | .dependencies.tailwindcss = $ENV.fixed_tailwind_version' \
3131+ | jq '. + {"name":"plausible","version": $ENV.latest}' \
3632 | sed -e 's,../deps/,../../tmp/deps/,g' \
3733 > $dir/package.json
3834···5854chmod -R u+rwx "$tmp_setup_dir"
59556056pushd $tmp_setup_dir/assets
6161-jq < package.json '.dependencies.tailwindcss = "'"$fixed_tailwind_version"'"' | sponge package.json
6257yarn
6358yarn2nix > "$dir/yarn.nix"
6459cp yarn.lock "$dir/yarn.lock"