nixos/actual: init at 24.10.1 (#347825)

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
+- [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable).
+
 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
 
 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).

nixos/modules/module-list.nix

···
   ./services/video/wivrn.nix
   ./services/wayland/cage.nix
   ./services/wayland/hypridle.nix
+  ./services/web-apps/actual.nix
   ./services/web-apps/akkoma.nix
   ./services/web-apps/agorakit.nix
   ./services/web-apps/alps.nix

nixos/modules/services/web-apps/actual.nix

···
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.actual;
+  configFile = formatType.generate "config.json" cfg.settings;
+  dataDir = "/var/lib/actual";
+
+  formatType = pkgs.formats.json { };
+in
+{
+  options.services.actual = {
+    enable = mkEnableOption "actual, a privacy focused app for managing your finances";
+    package = mkPackageOption pkgs "actual-server" { };
+
+    openFirewall = mkOption {
+      default = false;
+      type = types.bool;
+      description = "Whether to open the firewall for the specified port.";
+    };
+
+    settings = mkOption {
+      default = { };
+      description = "Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.";
+      type = types.submodule {
+        freeformType = formatType.type;
+
+        options = {
+          hostname = mkOption {
+            type = types.str;
+            description = "The address to listen on";
+            default = "::";
+          };
+
+          port = mkOption {
+            type = types.port;
+            description = "The port to listen on";
+            default = 3000;
+          };
+        };
+
+        config = {
+          serverFiles = mkDefault "${dataDir}/server-files";
+          userFiles = mkDefault "${dataDir}/user-files";
+          dataDir = mkDefault dataDir;
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.port ];
+
+    systemd.services.actual = {
+      description = "Actual server, a local-first personal finance app";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.ACTUAL_CONFIG_PATH = configFile;
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        DynamicUser = true;
+        User = "actual";
+        Group = "actual";
+        StateDirectory = "actual";
+        WorkingDirectory = dataDir;
+        LimitNOFILE = "1048576";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        StateDirectoryMode = "0700";
+        Restart = "always";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        #MemoryDenyWriteExecute = true; # Leads to coredump because V8 does JIT
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@pkey"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = [
+    lib.maintainers.oddlama
+    lib.maintainers.patrickdag
+  ];
+}

nixos/tests/actual.nix

···
+import ./make-test-python.nix (
+  { lib, ... }:
+  {
+    name = "actual";
+    meta.maintainers = [ lib.maintainers.oddlama ];
+
+    nodes.machine =
+      { ... }:
+      {
+        services.actual.enable = true;
+      };
+
+    testScript = ''
+      machine.wait_for_open_port(3000)
+      machine.succeed("curl -fvvv -Ls http://localhost:3000/ | grep 'Actual'")
+    '';
+  }
+)

nixos/tests/all-tests.nix

···
   aaaaxy = runTest ./aaaaxy.nix;
   acme = runTest ./acme.nix;
   acme-dns = handleTest ./acme-dns.nix {};
+  actual = handleTest ./actual.nix {};
   adguardhome = runTest ./adguardhome.nix;
   aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix;
   agate = runTest ./web-servers/agate.nix;

pkgs/by-name/ac/actual-server/package.nix

···
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  fetchFromGitHub,
+  makeWrapper,
+  cacert,
+  gitMinimal,
+  nodejs_20,
+  yarn,
+  nixosTests,
+  nix-update-script,
+}:
+let
+  version = "24.12.0";
+  src = fetchFromGitHub {
+    owner = "actualbudget";
+    repo = "actual-server";
+    tag = "v${version}";
+    hash = "sha256-qCATfpYjDlR2LaalkF0/b5tD4HDE4aNDrLvTC4g0ctY=";
+  };
+
+  yarn_20 = yarn.override { nodejs = nodejs_20; };
+
+  # We cannot use fetchYarnDeps because that doesn't support yarn2/berry
+  # lockfiles (see https://github.com/NixOS/nixpkgs/issues/254369)
+  offlineCache = stdenvNoCC.mkDerivation {
+    name = "actual-server-${version}-offline-cache";
+    inherit src;
+
+    nativeBuildInputs = [
+      cacert # needed for git
+      gitMinimal # needed to download git dependencies
+      yarn_20
+    ];
+
+    SUPPORTED_ARCHITECTURES = builtins.toJSON {
+      os = [
+        "darwin"
+        "linux"
+      ];
+      cpu = [
+        "arm"
+        "arm64"
+        "ia32"
+        "x64"
+      ];
+      libc = [
+        "glibc"
+        "musl"
+      ];
+    };
+
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME=$(mktemp -d)
+      yarn config set enableTelemetry 0
+      yarn config set cacheFolder $out
+      yarn config set --json supportedArchitectures "$SUPPORTED_ARCHITECTURES"
+      yarn
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r ./node_modules $out/node_modules
+
+      runHook postInstall
+    '';
+    dontFixup = true;
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash =
+      {
+        x86_64-linux = "sha256-Rz+iKw4JDWtZOrCjs9sbHVw/bErAEY4TfoG+QfGKY94=";
+        aarch64-linux = "sha256-JGpRoIQrEI6crczHD62ZQO08GshBbzJC0dONYD69K/I=";
+        aarch64-darwin = "sha256-v2qzKmtqBdU6igyHat+NyL/XTzWgq/CKlNpai/iFHyQ=";
+        x86_64-darwin = "sha256-0ksWLlF/a58KY/8NgOQ5aPOLoXzqDqO3lhkmFvT17Bk=";
+      }
+      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  };
+in
+stdenv.mkDerivation {
+  pname = "actual-server";
+  inherit version src;
+
+  nativeBuildInputs = [
+    makeWrapper
+    yarn_20
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib,lib/actual}
+    cp -r ${offlineCache}/node_modules/ $out/lib/actual
+    cp -r ./ $out/lib/actual
+
+    makeWrapper ${lib.getExe nodejs_20} "$out/bin/actual-server" \
+      --add-flags "$out/lib/actual/app.js" \
+      --set NODE_PATH "$out/node_modules"
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit offlineCache;
+    tests = nixosTests.actual;
+    passthru.updateScript = nix-update-script { };
+  };
+
+  meta = {
+    changelog = "https://actualbudget.org/docs/releases";
+    description = "Super fast privacy-focused app for managing your finances";
+    homepage = "https://actualbudget.org/";
+    mainProgram = "actual-server";
+    license = lib.licenses.mit;
+    maintainers = [
+      lib.maintainers.oddlama
+      lib.maintainers.patrickdag
+    ];
+  };
+}