orthanc: init at 1.12.6, nixos/orthanc: init (#385329)

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - [Limine](https://github.com/limine-bootloader/limine) a modern, advanced, portable, multiprotocol bootloader and boot manager. Available as [boot.loader.limine](#opt-boot.loader.limine.enable)
 
+- [Orthanc](https://orthanc.uclouvain.be/) a lightweight, RESTful DICOM server for healthcare and medical research. Available as [services.orthanc](#opt-services.orthanc.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}

nixos/modules/module-list.nix

···
   ./services/misc/ombi.nix
   ./services/misc/omnom.nix
   ./services/misc/open-webui.nix
+  ./services/misc/orthanc.nix
   ./services/misc/osrm.nix
   ./services/misc/owncast.nix
   ./services/misc/packagekit.nix

nixos/modules/services/misc/orthanc.nix

···
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+
+  cfg = config.services.orthanc;
+  opt = options.services.orthanc;
+
+  settingsFormat = pkgs.formats.json { };
+in
+{
+  options = {
+    services.orthanc = {
+      enable = lib.mkEnableOption "Orthanc server";
+      package = lib.mkPackageOption pkgs "orthanc" { };
+
+      stateDir = lib.mkOption {
+        type = types.path;
+        default = "/var/lib/orthanc";
+        example = "/home/foo";
+        description = "State directory of Orthanc.";
+      };
+
+      environment = lib.mkOption {
+        type = types.attrsOf types.str;
+        default = {
+        };
+        example = ''
+          {
+            ORTHANC_NAME = "Orthanc server";
+          }
+        '';
+        description = ''
+          Extra environment variables
+          For more details see <https://orthanc.uclouvain.be/book/users/configuration.html>
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        description = ''
+          Environment file to be passed to the systemd service.
+          Useful for passing secrets to the service to prevent them from being
+          world-readable in the Nix store.
+        '';
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/var/lib/secrets/orthancSecrets";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = {
+          HttpPort = lib.mkDefault 8042;
+          IndexDirectory = lib.mkDefault "/var/lib/orthanc/";
+          StorageDirectory = lib.mkDefault "/var/lib/orthanc/";
+        };
+        example = {
+          Name = "My Orthanc Server";
+          HttpPort = 12345;
+        };
+        description = ''
+          Configuration written to a json file that is read by orthanc.
+          See <https://orthanc.uclouvain.be/book/index.html> for more.
+        '';
+      };
+
+      openFirewall = lib.mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for Orthanc.
+          This adds `services.orthanc.settings.HttpPort` to `networking.firewall.allowedTCPPorts`.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.orthanc.settings = options.services.orthanc.settings.default;
+
+    systemd.services.orthanc = {
+      description = "Orthanc is a lightweight, RESTful DICOM server for healthcare and medical research";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      environment = cfg.environment;
+
+      serviceConfig =
+        let
+          config-json = settingsFormat.generate "orthanc-config.json" (cfg.settings);
+        in
+        {
+          ExecStart = "${lib.getExe cfg.package} ${config-json}";
+          EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+          WorkingDirectory = cfg.stateDir;
+          BindReadOnlyPaths = [
+            "-/etc/localtime"
+          ];
+          StateDirectory = "orthanc";
+          RuntimeDirectory = "orthanc";
+          RuntimeDirectoryMode = "0755";
+          PrivateTmp = true;
+          DynamicUser = true;
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          PrivateUsers = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          SystemCallArchitectures = "native";
+          UMask = "0077";
+        };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.HttpPort ]; };
+
+    # Orthanc requires /etc/localtime to be present
+    time.timeZone = lib.mkDefault "UTC";
+  };
+
+  meta.maintainers = with lib.maintainers; [ drupol ];
+}

nixos/tests/all-tests.nix

···
   opentelemetry-collector = handleTest ./opentelemetry-collector.nix {};
   open-web-calendar = handleTest ./web-apps/open-web-calendar.nix {};
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix {};
+  orthanc = runTest ./orthanc.nix;
   owncast = handleTest ./owncast.nix {};
   outline = handleTest ./outline.nix {};
   image-contents = handleTest ./image-contents.nix {};

nixos/tests/orthanc.nix

···
+{ lib, ... }:
+
+{
+  name = "orthanc";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.orthanc = {
+          enable = true;
+          settings = {
+            HttpPort = 12345;
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("orthanc.service")
+    machine.wait_for_open_port(12345)
+    machine.wait_for_open_port(4242)
+  '';
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+}

pkgs/by-name/or/orthanc/add-missing-include.patch

···
+diff -r cba3e8ca3a87 OrthancServer/Sources/OrthancInitialization.cpp
+--- a/Sources/OrthancInitialization.cpp   Tue Mar 11 10:46:15 2025 +0100
++++ b/Sources/OrthancInitialization.cpp   Thu Mar 13 18:20:00 2025 +0100
+@@ -59,6 +59,7 @@
+ #    undef __FILE__
+ #    define __FILE__ __ORTHANC_FILE__
+ #  endif
++#  include <google/protobuf/stubs/common.h>
+ #  include <google/protobuf/any.h>
+ #endif

pkgs/by-name/or/orthanc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchhg,
+  boost,
+  charls,
+  civetweb,
+  cmake,
+  curl,
+  dcmtk,
+  gtest,
+  jsoncpp,
+  libjpeg,
+  libpng,
+  libuuid,
+  log4cplus,
+  lua,
+  openssl,
+  protobuf,
+  pugixml,
+  python3,
+  sqlite,
+  unzip,
+  versionCheckHook,
+  nixosTests,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "orthanc";
+  version = "1.12.6";
+
+  src = fetchhg {
+    url = "https://orthanc.uclouvain.be/hg/orthanc/";
+    rev = "Orthanc-${finalAttrs.version}";
+    hash = "sha256-1ztA95PiCGL1oD6zVfsEhwrwGNID13/NcyZDD3eHYv0=";
+  };
+
+  patches = [
+    # Without this patch, the build fails to find `GOOGLE_PROTOBUF_VERIFY_VERSION`
+    # The patch has been included upstream, it need to be removed in the next release.
+    ./add-missing-include.patch
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/OrthancServer";
+
+  nativeBuildInputs = [
+    cmake
+    protobuf
+    python3
+    unzip
+  ];
+
+  buildInputs = [
+    protobuf
+    boost
+    charls
+    civetweb
+    curl
+    dcmtk
+    gtest
+    jsoncpp
+    libjpeg
+    libpng
+    libuuid
+    log4cplus
+    lua
+    openssl
+    pugixml
+    sqlite
+  ];
+
+  strictDeps = true;
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeFeature "DCMTK_DICTIONARY_DIR_AUTO" "${dcmtk}/share/dcmtk-${dcmtk.version}")
+    (lib.cmakeFeature "DCMTK_LIBRARIES" "dcmjpls;oflog;ofstd")
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+
+    (lib.cmakeBool "BUILD_CONNECTIVITY_CHECKS" false)
+    (lib.cmakeBool "UNIT_TESTS_WITH_HTTP_CONNEXIONS" false)
+    (lib.cmakeBool "STANDALONE_BUILD" true)
+    (lib.cmakeBool "USE_SYSTEM_BOOST" true)
+    (lib.cmakeBool "USE_SYSTEM_CIVETWEB" true)
+    (lib.cmakeBool "USE_SYSTEM_DCMTK" true)
+    (lib.cmakeBool "USE_SYSTEM_GOOGLE_TEST" true)
+    (lib.cmakeBool "USE_SYSTEM_JSONCPP" true)
+    (lib.cmakeBool "USE_SYSTEM_LIBICONV" true)
+    (lib.cmakeBool "USE_SYSTEM_LIBJPEG" true)
+    (lib.cmakeBool "USE_SYSTEM_LIBPNG" true)
+    (lib.cmakeBool "USE_SYSTEM_LUA" true)
+    (lib.cmakeBool "USE_SYSTEM_OPENSSL" true)
+    (lib.cmakeBool "USE_SYSTEM_PROTOBUF" true)
+    (lib.cmakeBool "USE_SYSTEM_PUGIXML" true)
+    (lib.cmakeBool "USE_SYSTEM_SQLITE" true)
+    (lib.cmakeBool "USE_SYSTEM_UUID" true)
+    (lib.cmakeBool "USE_SYSTEM_ZLIB" true)
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.tests = {
+    inherit (nixosTests) orthanc;
+  };
+
+  meta = {
+    description = "Orthanc is a lightweight, RESTful DICOM server for healthcare and medical research";
+    homepage = "https://www.orthanc-server.com/";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "Orthanc";
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.linux;
+  };
+})