= {\n mapSpecialJunk = \"Spam\";\n };\n}\n```\n\n### List Local Folders {#services-mailserver-debug-local-folders}\n\nCheck the local folders to make sure the mapping is correct\nand all folders are correctly downloaded.\nFor example, if the mapping above is wrong, you will see both a\n`Junk` and `Spam` folder while if it is correct,\nyou will only see the `Junk` folder.\n\n```\n$ sudo doveadm mailbox list -u $USER\nJunk\nTrash\nDrafts\nSent\nINBOX\nMyCustomFolder\n```\n\nThe following command shows the number of messages in a folder:\n\n```\n$ sudo doveadm mailbox status -u $USER messages INBOX\nINBOX messages=13591\n```\n\nIf any folder is not appearing or has 0 message but should have some,\nit could mean dovecot is not setup correctly and assumes an incorrect folder layout.\nIf that is the case, check the user config with:\n\n```\n$ sudo doveadm user $USER\nfield value\nuid 5000\ngid 5000\nhome /var/vmail/fastmail/$USER\nmail maildir:~/mail:LAYOUT=fs\nvirtualMail\n```\n\n### Test Auth {#services-mailserver-debug-auth}\n\nTo test authentication to your dovecot instance, run:\n\n```\n$ nix run nixpkgs#openssl -- s_client -connect $SUBDOMAIN.$DOMAIN:993 -crlf -quiet\n. LOGIN $USER $PASSWORD\n```\n\nYou must here also enter the second line verbatim,\nreplacing your user and password with the real one.\n\nOn success, you will see:\n\n```\n. OK [CAPABILITY IMAP4rev1 ...] Logged in\n```\n\nOtherwise, either if the password is wrong or,\nwhen using LDAP if the user is not part of the LDAP group, you will see:\n\n```\n. NO [AUTHENTICATIONFAILED] Authentication failed.\n```\n\nTo test the postfix instance, run:\n\n```\n$ swaks \\\n --server $SUBDOMAIN.$DOMAIN \\\n --port 465 \\\n --tls-on-connect \\\n --auth LOGIN \\\n --auth-user $USER \\\n --auth-password '$PASSWORD' \\\n --from $USER \\\n --to $USER\n```\n\nTry once with a wrong password and once with a correct one.\nThe former should log:\n\n```\n<~* 535 5.7.8 Error: authentication failed: (reason unavailable)\n```\n\n## Mobile Apps {#services-mailserver-mobile}\n\nThis module was tested with:\n- the iOS mail mobile app,\n- Thunderbird on NixOS.\n\nThe iOS mail app is pretty finicky.\nIf downloading emails does not work,\nmake sure the certificate used includes the whole chain:\n\n```bash\n$ openssl s_client -connect $SUBDOMAIN.$DOMAIN:993 -showcerts\n```\n\nNormally, the other options are setup correctly but if it fails for you,\nfeel free to open an issue.\n\n## Options Reference {#services-mailserver-options}\n\n```{=include=} options\nid-prefix: services-mailserver-options-\nlist-id: selfhostblocks-service-mailserver-options\nsource: @OPTIONS_JSON@\n```\n"
},
{
"path": "modules/services/mailserver.nix",
"content": "{\n config,\n lib,\n shb,\n pkgs,\n ...\n}:\nlet\n cfg = config.shb.mailserver;\nin\n{\n imports = [\n (\n builtins.fetchGit {\n url = \"https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git\";\n ref = \"master\";\n rev = \"7d433bf89882f61621f95082e90a4ab91eb0bdd3\";\n }\n + \"/default.nix\"\n )\n ../blocks/lldap.nix\n ];\n\n options.shb.mailserver = {\n enable = lib.mkEnableOption \"SHB's nixos-mailserver module\";\n\n subdomain = lib.mkOption {\n type = lib.types.str;\n description = \"Subdomain under which imap and smtp functions will be served.\";\n default = \"imap\";\n };\n\n domain = lib.mkOption {\n type = lib.types.str;\n description = \"domain under which imap and smtp functions will be served.\";\n example = \"mydomain.com\";\n };\n\n ssl = lib.mkOption {\n description = \"Path to SSL files\";\n type = lib.types.nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n adminUsername = lib.mkOption {\n type = lib.types.nullOr lib.types.str;\n default = null;\n description = ''\n Admin username.\n\n postmaster will be made an alias of this user.\n '';\n example = \"admin\";\n };\n\n adminPassword = lib.mkOption {\n description = \"Admin user password.\";\n default = null;\n type = lib.types.nullOr (\n lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = config.services.postfix.user;\n ownerText = \"services.postfix.user\";\n restartUnits = [ \"dovecot.service\" ];\n };\n }\n );\n };\n\n imapSync = lib.mkOption {\n description = ''\n Synchronize one or more email providers through IMAP\n to your dovecot instance.\n\n This allows you to backup that email provider\n and centralize your accounts in this dovecot instance.\n '';\n default = null;\n type = lib.types.nullOr (\n lib.types.submodule {\n options = {\n syncTimer = lib.mkOption {\n type = lib.types.str;\n default = \"5m\";\n description = ''\n Systemd timer for when imap sync job should happen.\n\n This timer is not scheduling the job at regular intervals.\n After a job finishes, the given amount of time is waited then the next job is started.\n\n The default is set deliberatily slow to not spam you when setting up your mailserver.\n When everything works, you will want to reduce it to 10s or something like that.\n '';\n example = \"10s\";\n };\n\n debug = lib.mkOption {\n type = lib.types.bool;\n default = false;\n description = \"Enable verbose mbsync logging.\";\n };\n\n accounts = lib.mkOption {\n description = ''\n Accounts to sync emails from using IMAP.\n\n Emails will be stored under `''${config.mailserver.mailDirectory}/''${name}/''${username}`\n '';\n type = lib.types.attrsOf (\n lib.types.submodule {\n options = {\n host = lib.mkOption {\n type = lib.types.str;\n description = \"Hostname of the email's provider IMAP server.\";\n example = \"imap.fastmail.com\";\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = \"Port of the email's provider IMAP server.\";\n default = 993;\n };\n\n username = lib.mkOption {\n type = lib.types.str;\n description = \"Username used to login to the email's provider IMAP server.\";\n example = \"userA@fastmail.com\";\n };\n\n password = lib.mkOption {\n description = ''\n Password used to login to the email's provider IMAP server.\n\n The password could be an \"app password\" like for [Fastmail](https://www.fastmail.help/hc/en-us/articles/360058752854-App-passwords)\n '';\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = config.mailserver.vmailUserName;\n restartUnits = [ \"mbsync.service\" ];\n };\n };\n };\n\n sslType = lib.mkOption {\n description = \"Connection security method.\";\n type = lib.types.enum [\n \"IMAPS\"\n \"STARTTLS\"\n ];\n default = \"IMAPS\";\n };\n\n timeout = lib.mkOption {\n description = \"Connect and data timeout.\";\n type = lib.types.int;\n default = 120;\n };\n\n mapSpecialDrafts = lib.mkOption {\n type = lib.types.str;\n default = \"Drafts\";\n description = ''\n Drafts special folder name on far side.\n\n You only need to change this if mbsync logs the following error:\n\n Error: ... far side box Drafts cannot be opened\n '';\n };\n mapSpecialSent = lib.mkOption {\n type = lib.types.str;\n default = \"Sent\";\n description = ''\n Sent special folder name on far side.\n\n You only need to change this if mbsync logs the following error:\n\n Error: ... far side box Sent cannot be opened\n '';\n };\n mapSpecialTrash = lib.mkOption {\n type = lib.types.str;\n default = \"Trash\";\n description = ''\n Trash special folder name on far side.\n\n You only need to change this if mbsync logs the following error:\n\n Error: ... far side box Trash cannot be opened\n '';\n };\n mapSpecialJunk = lib.mkOption {\n type = lib.types.str;\n default = \"Junk\";\n description = ''\n Junk special folder name on far side.\n\n You only need to change this if mbsync logs the following error:\n\n Error: ... far side box Junk cannot be opened\n '';\n example = \"Spam\";\n };\n };\n }\n );\n };\n };\n }\n );\n };\n\n smtpRelay = lib.mkOption {\n description = ''\n Proxy outgoing emails through an email provider.\n\n In short, this can help you avoid having your outgoing emails marked as spam.\n See the manual for a lengthier explanation.\n '';\n default = null;\n type = lib.types.nullOr (\n lib.types.submodule {\n options = {\n host = lib.mkOption {\n type = lib.types.str;\n description = \"Hostname of the email's provider SMTP server.\";\n example = \"smtp.fastmail.com\";\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = \"Port of the email's provider SMTP server.\";\n default = 587;\n };\n\n username = lib.mkOption {\n description = \"Username used to login to the email's provider SMTP server.\";\n type = lib.types.str;\n };\n\n password = lib.mkOption {\n description = ''\n Password used to login to the email's provider IMAP server.\n\n The password could be an \"app password\" like for [Fastmail](https://www.fastmail.help/hc/en-us/articles/360058752854-App-passwords)\n '';\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = config.services.postfix.user;\n ownerText = \"services.postfix.user\";\n restartUnits = [ \"postfix.service\" ];\n };\n };\n };\n };\n }\n );\n };\n\n ldap = lib.mkOption {\n description = ''\n LDAP Integration.\n\n Enabling this app will create a new LDAP configuration or update one that exists with\n the given host.\n '';\n default = { };\n type = lib.types.nullOr (\n lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"LDAP app.\";\n\n host = lib.mkOption {\n type = lib.types.str;\n description = ''\n Host serving the LDAP server.\n '';\n default = \"127.0.0.1\";\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = ''\n Port of the service serving the LDAP server.\n '';\n default = 389;\n };\n\n dcdomain = lib.mkOption {\n type = lib.types.str;\n description = \"dc domain for ldap.\";\n example = \"dc=mydomain,dc=com\";\n };\n\n account = lib.mkOption {\n type = lib.types.str;\n description = ''\n Select one account from those defined in `shb.mailserver.imapSync.accounts`\n to login with.\n\n Using LDAP, you can only connect to one account.\n This limitation could maybe be lifted, feel free to post an issue if you need this.\n '';\n };\n\n adminName = lib.mkOption {\n type = lib.types.str;\n description = \"Admin user of the LDAP server.\";\n default = \"admin\";\n };\n\n adminPassword = lib.mkOption {\n description = \"LDAP server admin password.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"nextcloud\";\n restartUnits = [ \"dovecot.service\" ];\n };\n };\n };\n\n userGroup = lib.mkOption {\n type = lib.types.str;\n description = \"Group users must belong to to be able to use mails.\";\n default = \"mail_user\";\n };\n };\n }\n );\n };\n\n backup = lib.mkOption {\n description = ''\n Backup emails, index and sieve.\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.backup.mkRequester {\n user = config.mailserver.vmailUserName;\n sourceDirectories = builtins.filter (x: x != null) [\n config.mailserver.indexDir\n config.mailserver.mailDirectory\n config.mailserver.sieveDirectory\n ];\n sourceDirectoriesText = ''\n [\n config.mailserver.indexDir\n config.mailserver.mailDirectory\n config.mailserver.sieveDirectory\n ]\n '';\n };\n };\n };\n\n backupDKIM = lib.mkOption {\n description = ''\n Backup dkim directory.\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.backup.mkRequester {\n user = config.services.rspamd.user;\n userText = \"services.rspamd.user\";\n sourceDirectories = builtins.filter (x: x != null) [\n config.mailserver.dkimKeyDirectory\n ];\n sourceDirectoriesText = ''\n [\n config.mailserver.dkimKeyDirectory\n ]\n '';\n };\n };\n };\n\n impermanence = lib.mkOption {\n description = ''\n Path to save when using impermanence setup.\n '';\n type = lib.types.attrsOf lib.types.str;\n default = {\n index = config.mailserver.indexDir;\n mail = config.mailserver.mailDirectory;\n sieve = config.mailserver.sieveDirectory;\n dkim = config.mailserver.dkimKeyDirectory;\n };\n defaultText = lib.literalExpression ''\n {\n index = config.mailserver.indexDir;\n mail = config.mailserver.mailDirectory;\n sieve = config.mailserver.sieveDirectory;\n dkim = config.mailserver.dkimKeyDirectory;\n }\n '';\n };\n\n dashboard = lib.mkOption {\n description = ''\n Dashboard contract consumer\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.dashboard.mkRequester {\n externalUrl = \"https://${cfg.subdomain}.${cfg.domain}\";\n externalUrlText = \"https://\\${config.shb.mailserver.subdomain}.\\${config.shb.mailserver.domain}\";\n };\n };\n };\n };\n\n config = lib.mkMerge [\n (lib.mkIf cfg.enable {\n mailserver = {\n enable = true;\n stateVersion = 3;\n fqdn = \"${cfg.subdomain}.${cfg.domain}\";\n domains = [ cfg.domain ];\n\n localDnsResolver = false;\n\n enableImapSsl = true;\n enableSubmissionSsl = true;\n x509 = {\n certificateFile = cfg.ssl.paths.cert;\n privateKeyFile = cfg.ssl.paths.key;\n };\n\n # Using / is needed for iOS mail.\n # Both following options are used to organize subfolders in subdirectories.\n hierarchySeparator = \"/\";\n useFsLayout = true;\n };\n\n services.postfix.config = {\n smtpd_tls_security_level = lib.mkForce \"encrypt\";\n };\n\n # Is probably needed for iOS mail.\n services.dovecot2.extraConfig = ''\n ssl_min_protocol = TLSv1.2\n ssl_cipher_list = HIGH:!aNULL:!MD5\n '';\n\n services.nginx = {\n enable = true;\n\n virtualHosts.\"${cfg.domain}\" =\n let\n announce = pkgs.writeTextDir \"config-v1.1.xml\" ''\n \n \n \n ${cfg.domain}\n ${cfg.domain} Mailserver\n\n \n \n ${cfg.subdomain}.${cfg.domain}\n 993\n SSL\n password-cleartext\n %EMAILADDRESS%\n \n\n \n \n ${cfg.subdomain}.${cfg.domain}\n 465\n SSL\n password-cleartext\n %EMAILADDRESS%\n \n\n \n \n '';\n in\n {\n forceSSL = true; # Redirect HTTP → HTTPS\n root = \"/var/www\"; # Dummy root\n locations.\"/.well-known/autoconfig/mail/\" = {\n alias = \"${announce}/\";\n extraConfig = ''\n default_type application/xml;\n '';\n };\n };\n virtualHosts.\"${cfg.subdomain}.${cfg.domain}\" =\n let\n landingPage = pkgs.writeTextDir \"index.html\" ''\n \n Configuration of the mailserver is done automatically thanks to\n ${cfg.domain}/.well-known/autoconfig/mail/config-v1.1.xml.
\n \n '';\n in\n {\n forceSSL = true; # Redirect HTTP → HTTPS\n root = \"/var/www\"; # Dummy root\n locations.\"/\" = {\n alias = \"${landingPage}/\";\n extraConfig = ''\n default_type application/html;\n '';\n };\n };\n };\n })\n (lib.mkIf (cfg.enable && cfg.adminUsername != null) {\n assertions = [\n {\n assertion = cfg.adminPassword != null;\n message = \"`shb.mailserver.adminPassword` must be not null if `shb.mailserver.adminUsername` is not null.\";\n }\n ];\n\n mailserver = {\n # To create the password hashes, use:\n # nix run nixpkgs#mkpasswd -- --run 'mkpasswd -s'\n loginAccounts = {\n \"${cfg.adminUsername}@${cfg.domain}\" = {\n hashedPasswordFile = cfg.adminPassword.result.path;\n aliases = [ \"postmaster@${cfg.domain}\" ];\n };\n };\n };\n })\n (lib.mkIf (cfg.enable && cfg.ldap != null) {\n assertions = [\n {\n assertion = cfg.adminUsername == null;\n message = \"`shb.mailserver.adminUsername` must be null `shb.mailserver.ldap` integration is set.\";\n }\n ];\n\n shb.lldap.ensureGroups = {\n ${cfg.ldap.userGroup} = { };\n };\n\n mailserver = {\n ldap = {\n enable = true;\n uris = [\n \"ldap://${cfg.ldap.host}:${toString cfg.ldap.port}\"\n ];\n searchBase = \"ou=people,${cfg.ldap.dcdomain}\";\n searchScope = \"sub\";\n bind = {\n dn = \"uid=${cfg.ldap.adminName},ou=people,${cfg.ldap.dcdomain}\";\n passwordFile = cfg.ldap.adminPassword.result.path;\n };\n # Note that nixos simple mailserver sets auth_bind=yes\n # which means authentication binds are used.\n # https://doc.dovecot.org/2.3/configuration_manual/authentication/ldap_bind/#authentication-ldap-bind\n dovecot =\n let\n filter = \"(&(objectClass=inetOrgPerson)(mail=%{user})(memberOf=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain}))\";\n in\n {\n passAttrs = \"user=user\";\n passFilter = filter;\n userAttrs = lib.concatStringsSep \",\" [\n \"=home=${config.mailserver.mailDirectory}/${cfg.ldap.account}/%u\"\n # \"mail=maildir:${config.mailserver.mailDirectory}/${cfg.ldap.account}/%u/mail\"\n \"uid=${config.mailserver.vmailUserName}\"\n \"gid=${config.mailserver.vmailGroupName}\"\n ];\n userFilter = filter;\n };\n postfix = {\n filter = \"(&(objectClass=inetOrgPerson)(mail=%s)(memberOf=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain}))\";\n mailAttribute = \"mail\";\n uidAttribute = \"mail\";\n };\n };\n };\n })\n (lib.mkIf (cfg.enable && cfg.imapSync != null) {\n systemd.services.mbsync =\n let\n configFile =\n let\n mkAccount = name: acct: ''\n # ${name} account\n\n IMAPAccount ${name}\n Host ${acct.host}\n Port ${toString acct.port}\n User ${acct.username}\n PassCmd \"cat ${acct.password.result.path}\"\n TLSType ${acct.sslType}\n AuthMechs LOGIN\n Timeout ${toString acct.timeout}\n\n IMAPStore ${name}-remote\n Account ${name}\n\n MaildirStore ${name}-local\n INBOX ${config.mailserver.mailDirectory}/${name}/${acct.username}/mail/\n # Maps subfolders on far side to actual subfolders on disk.\n # The other option is Maildir++ but then the mailserver.hierarchySeparator must be set to a dot '.'\n SubFolders Verbatim\n Path ${config.mailserver.mailDirectory}/${name}/${acct.username}/mail/\n\n Channel ${name}-main\n Far :${name}-remote:\n Near :${name}-local:\n Patterns * !Drafts !Sent !Trash !Junk !${acct.mapSpecialDrafts} !${acct.mapSpecialSent} !${acct.mapSpecialTrash} !${acct.mapSpecialJunk}\n Create Both\n Expunge Both\n SyncState *\n Sync All\n CopyArrivalDate yes # Preserve date from incoming message.\n\n Channel ${name}-drafts\n Far :${name}-remote:\"${acct.mapSpecialDrafts}\"\n Near :${name}-local:\"Drafts\"\n Create Both\n Expunge Both\n SyncState *\n Sync All\n CopyArrivalDate yes # Preserve date from incoming message.\n\n Channel ${name}-sent\n Far :${name}-remote:\"${acct.mapSpecialSent}\"\n Near :${name}-local:\"Sent\"\n Create Both\n Expunge Both\n SyncState *\n Sync All\n CopyArrivalDate yes # Preserve date from incoming message.\n\n Channel ${name}-trash\n Far :${name}-remote:\"${acct.mapSpecialTrash}\"\n Near :${name}-local:\"Trash\"\n Create Both\n Expunge Both\n SyncState *\n Sync All\n CopyArrivalDate yes # Preserve date from incoming message.\n\n Channel ${name}-junk\n Far :${name}-remote:\"${acct.mapSpecialJunk}\"\n Near :${name}-local:\"Junk\"\n Create Both\n Expunge Both\n SyncState *\n Sync All\n CopyArrivalDate yes # Preserve date from incoming message.\n\n Group ${name}\n Channel ${name}-main\n Channel ${name}-drafts\n Channel ${name}-sent\n Channel ${name}-trash\n Channel ${name}-junk\n\n # END ${name} account\n '';\n\n in\n pkgs.writeText \"mbsync.conf\" (\n lib.concatStringsSep \"\\n\" (lib.mapAttrsToList mkAccount cfg.imapSync.accounts)\n );\n in\n {\n description = \"Sync mailbox\";\n serviceConfig = {\n Type = \"oneshot\";\n User = config.mailserver.vmailUserName;\n };\n script =\n let\n debug = if cfg.imapSync.debug then \"-V\" else \"\";\n in\n ''\n ${pkgs.isync}/bin/mbsync --all ${debug} --config ${configFile}\n '';\n };\n\n systemd.tmpfiles.rules =\n let\n mkAccount =\n name: acct:\n # The equal sign makes sure parent directories have the corret user and group too.\n [\n \"d '${config.mailserver.mailDirectory}/${name}' 0750 ${config.mailserver.vmailUserName} ${config.mailserver.vmailGroupName} - -\"\n \"d '${config.mailserver.mailDirectory}/${name}/${acct.username}' 0750 ${config.mailserver.vmailUserName} ${config.mailserver.vmailGroupName} - -\"\n ];\n in\n lib.flatten (lib.mapAttrsToList mkAccount cfg.imapSync.accounts);\n\n systemd.timers.mbsync = {\n wantedBy = [ \"timers.target\" ];\n timerConfig = {\n OnBootSec = cfg.imapSync.syncTimer;\n OnUnitActiveSec = cfg.imapSync.syncTimer;\n };\n };\n })\n (lib.mkIf (cfg.enable && cfg.smtpRelay != null) (\n let\n url = \"[${cfg.smtpRelay.host}]:${toString cfg.smtpRelay.port}\";\n in\n {\n assertions = [\n {\n assertion = lib.hasAttr cfg.adminPassword != null;\n message = \"`shb.mailserver.adminPassword` must be not null if `shb.mailserver.adminUsername` is not null.\";\n }\n ];\n\n # Inspiration from https://www.brull.me/postfix/debian/fastmail/2016/08/16/fastmail-smtp.html\n services.postfix = {\n settings.main = {\n relayhost = [ url ];\n smtp_sasl_auth_enable = \"yes\";\n smtp_sasl_password_maps = \"texthash:/run/secrets/postfix/postfix-smtp-relay-password\";\n smtp_sasl_security_options = \"noanonymous\";\n smtp_use_tls = \"yes\";\n };\n };\n\n systemd.services.postfix-pre = {\n script = shb.replaceSecrets {\n userConfig = {\n inherit url;\n inherit (cfg.smtpRelay) username;\n password.source = cfg.smtpRelay.password.result.path;\n };\n generator =\n name:\n {\n url,\n username,\n password,\n }:\n pkgs.writeText \"postfix-smtp-relay-password\" ''\n ${url} ${username}:${password}\n '';\n resultPath = \"/run/secrets/postfix/postfix-smtp-relay-password\";\n user = config.services.postfix.user;\n };\n serviceConfig.Type = \"oneshot\";\n wantedBy = [ \"multi-user.target\" ];\n before = [ \"postfix.service\" ];\n requiredBy = [ \"postfix.service\" ];\n };\n }\n ))\n ];\n}\n"
},
{
"path": "modules/services/nextcloud-server/dashboard/Nextcloud.json",
"content": "{\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"grafana\",\n \"uid\": \"-- Grafana --\"\n },\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"type\": \"dashboard\"\n }\n ]\n },\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 0,\n \"id\": 13,\n \"links\": [],\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {},\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 0,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 19,\n \"options\": {\n \"dedupStrategy\": \"none\",\n \"enableLogDetails\": true,\n \"prettifyLogMessage\": false,\n \"showCommonLabels\": false,\n \"showLabels\": false,\n \"showTime\": false,\n \"sortOrder\": \"Descending\",\n \"wrapLogMessage\": false\n },\n \"pluginVersion\": \"11.3.0+security-01\",\n \"repeat\": \"other_service\",\n \"repeatDirection\": \"h\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{unit=\\\"$other_service.service\\\"} | json | line_format \\\"{{.message}}\\\" | json | drop message | line_format \\\"[{{.app}} - {{.url}}] {{.Message}}: {{.exception_details}}{{.Previous_Message}}\\\"\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Panel Title\",\n \"type\": \"logs\"\n },\n {\n \"collapsed\": false,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 12,\n \"panels\": [],\n \"title\": \"General\",\n \"type\": \"row\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"description\": \"Some stall time means that 100% of the CPU is used. It's not an issue if this happens occasionally but can mean the CPU is underpowered for the current use case if this happens most of the time.\\nTo fix this, the \\\"nice\\\" property of processes can be adjusted.\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"decimals\": 2,\n \"fieldMinMax\": false,\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"transparent\",\n \"value\": 0.05\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byFrameRefID\",\n \"options\": \"B\"\n },\n \"properties\": [\n {\n \"id\": \"custom.axisPlacement\",\n \"value\": \"right\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"ms\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [\n 0,\n 10\n ],\n \"fill\": \"dot\"\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 2\n },\n {\n \"id\": \"custom.fillOpacity\",\n \"value\": 34\n },\n {\n \"id\": \"min\",\n \"value\": -40\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 1\n },\n \"id\": 8,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"max\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"width\": 300\n },\n \"tooltip\": {\n \"maxHeight\": 600,\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"netdata_system_cpu_some_pressure_stall_time_ms_average{hostname=~\\\"$hostname\\\"} * -1\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"some stall time\",\n \"range\": true,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"disableTextWrap\": false,\n \"editorMode\": \"code\",\n \"expr\": \"sum by(dimension, service_name) (netdata_systemd_service_cpu_utilization_percentage_average{hostname=~\\\"$hostname\\\", service_name=~\\\".*$service.*\\\"})\",\n \"fullMetaSearch\": false,\n \"hide\": false,\n \"includeNullMetadata\": true,\n \"legendFormat\": \"{{service_name}} / {{dimension}}\",\n \"range\": true,\n \"refId\": \"used\",\n \"useBackend\": false\n }\n ],\n \"title\": \"CPU\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"axisSoftMin\": -100,\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"decimals\": 2,\n \"fieldMinMax\": false,\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"transparent\",\n \"value\": 0.05\n }\n ]\n },\n \"unit\": \"mbytes\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byFrameRefID\",\n \"options\": \"A\"\n },\n \"properties\": [\n {\n \"id\": \"custom.axisPlacement\",\n \"value\": \"right\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"ms\"\n },\n {\n \"id\": \"decimals\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"dark-red\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [\n 10,\n 10\n ],\n \"fill\": \"dash\"\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 2\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byFrameRefID\",\n \"options\": \"B\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [\n 0,\n 10\n ],\n \"fill\": \"dot\"\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 2\n },\n {\n \"id\": \"custom.fillOpacity\",\n \"value\": 10\n },\n {\n \"id\": \"custom.axisPlacement\",\n \"value\": \"auto\"\n },\n {\n \"id\": \"custom.stacking\",\n \"value\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 1\n },\n \"id\": 7,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"max\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"width\": 300\n },\n \"tooltip\": {\n \"maxHeight\": 600,\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"netdata_system_memory_full_pressure_stall_time_ms_average{hostname=~\\\"$hostname\\\"} * -1\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"full stall time\",\n \"range\": true,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(netdata_mem_available_MiB_average{hostname=~\\\"$hostname\\\"})\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"total available\",\n \"range\": true,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"disableTextWrap\": false,\n \"editorMode\": \"code\",\n \"expr\": \"sum by(dimension, service_name) (netdata_systemd_service_memory_usage_MiB_average{hostname=~\\\"$hostname\\\", service_name=~\\\".*$service.*\\\", dimension=\\\"ram\\\"})\",\n \"fullMetaSearch\": false,\n \"hide\": false,\n \"includeNullMetadata\": true,\n \"legendFormat\": \"{{service_name}}\",\n \"range\": true,\n \"refId\": \"used\",\n \"useBackend\": false\n }\n ],\n \"title\": \"Memory\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"decimals\": 2,\n \"fieldMinMax\": false,\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"transparent\",\n \"value\": 0.05\n }\n ]\n },\n \"unit\": \"KBs\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byFrameRefID\",\n \"options\": \"B\"\n },\n \"properties\": [\n {\n \"id\": \"custom.axisPlacement\",\n \"value\": \"right\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"ms\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [\n 0,\n 10\n ],\n \"fill\": \"dot\"\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 2\n },\n {\n \"id\": \"custom.fillOpacity\",\n \"value\": 34\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 9\n },\n \"id\": 4,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"max\",\n \"mean\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"width\": 300\n },\n \"tooltip\": {\n \"maxHeight\": 600,\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"disableTextWrap\": false,\n \"editorMode\": \"code\",\n \"expr\": \"sum by(dimension) (netdata_system_net_kilobits_persec_average{hostname=~\\\"$hostname\\\"})\",\n \"fullMetaSearch\": false,\n \"hide\": false,\n \"includeNullMetadata\": true,\n \"legendFormat\": \"{{dimension}}\",\n \"range\": true,\n \"refId\": \"used\",\n \"useBackend\": false\n }\n ],\n \"title\": \"Network I/O\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"decimals\": 2,\n \"fieldMinMax\": false,\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"transparent\",\n \"value\": 0.05\n }\n ]\n },\n \"unit\": \"Kibits\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byFrameRefID\",\n \"options\": \"A\"\n },\n \"properties\": [\n {\n \"id\": \"custom.axisPlacement\",\n \"value\": \"right\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"ms\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [\n 0,\n 10\n ],\n \"fill\": \"dot\"\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 2\n },\n {\n \"id\": \"custom.fillOpacity\",\n \"value\": 12\n },\n {\n \"id\": \"custom.stacking\",\n \"value\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n }\n },\n {\n \"id\": \"min\",\n \"value\": -200\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byFrameRefID\",\n \"options\": \"B\"\n },\n \"properties\": [\n {\n \"id\": \"custom.axisPlacement\",\n \"value\": \"right\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"ms\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [\n 0,\n 10\n ],\n \"fill\": \"dot\"\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 2\n },\n {\n \"id\": \"custom.fillOpacity\",\n \"value\": 17\n },\n {\n \"id\": \"custom.stacking\",\n \"value\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n }\n },\n {\n \"id\": \"min\",\n \"value\": -200\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 9\n },\n \"id\": 6,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"max\",\n \"sum\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"width\": 300\n },\n \"tooltip\": {\n \"maxHeight\": 600,\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"netdata_system_io_full_pressure_stall_time_ms_average{hostname=~\\\"$hostname\\\"} * -1\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"full stall time\",\n \"range\": true,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"netdata_system_io_some_pressure_stall_time_ms_average{hostname=~\\\"$hostname\\\"} * -1\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"some stall time\",\n \"range\": true,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"disableTextWrap\": false,\n \"editorMode\": \"code\",\n \"expr\": \"sum by(dimension, service_name) (netdata_systemd_service_disk_io_KiB_persec_average{hostname=~\\\"$hostname\\\", service_name=~\\\".*$service.*\\\", dimension=\\\"read\\\"})\",\n \"fullMetaSearch\": false,\n \"hide\": false,\n \"includeNullMetadata\": true,\n \"legendFormat\": \"{{service_name}} / {{dimension}}\",\n \"range\": true,\n \"refId\": \"read\",\n \"useBackend\": false\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum by(dimension, service_name) (netdata_systemd_service_disk_io_KiB_persec_average{hostname=~\\\"$hostname\\\", service_name=~\\\".*$service.*\\\", dimension=\\\"write\\\"}) * -1\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"{{service_name}} / {{dimension}}\",\n \"range\": true,\n \"refId\": \"write\"\n }\n ],\n \"title\": \"Disk I/O\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"area\"\n }\n },\n \"fieldMinMax\": false,\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"percentage\",\n \"steps\": [\n {\n \"color\": \"transparent\",\n \"value\": null\n },\n {\n \"color\": \"orange\",\n \"value\": 80\n },\n {\n \"color\": \"red\",\n \"value\": 90\n },\n {\n \"color\": \"transparent\",\n \"value\": 100\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"total\"\n },\n \"properties\": [\n {\n \"id\": \"custom.hideFrom\",\n \"value\": {\n \"legend\": true,\n \"tooltip\": false,\n \"viz\": false\n }\n },\n {\n \"id\": \"custom.lineWidth\",\n \"value\": 0\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 17\n },\n \"id\": 22,\n \"options\": {\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"editorMode\": \"code\",\n \"expr\": \"sum (phpfpm_active_processes{hostname=~\\\"$hostname\\\",pool=\\\"nextcloud\\\"})\",\n \"hide\": false,\n \"legendFormat\": \"active\",\n \"range\": true,\n \"refId\": \"active\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum (phpfpm_total_processes{hostname=~\\\"$hostname\\\",pool=\\\"nextcloud\\\"})\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"total\",\n \"range\": true,\n \"refId\": \"total\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum (phpfpm_max_active_processes{hostname=~\\\"$hostname\\\",pool=\\\"nextcloud\\\"})\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"max active\",\n \"range\": true,\n \"refId\": \"max active\"\n }\n ],\n \"title\": \"PHP-FPM Processes\",\n \"transformations\": [\n {\n \"disabled\": true,\n \"id\": \"calculateField\",\n \"options\": {\n \"binary\": {\n \"left\": {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"total\"\n }\n },\n \"operator\": \"*\",\n \"right\": {\n \"fixed\": \"0.8\"\n }\n },\n \"mode\": \"binary\",\n \"reduce\": {\n \"reducer\": \"sum\"\n }\n }\n }\n ],\n \"type\": \"timeseries\"\n },\n {\n \"collapsed\": false,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 25\n },\n \"id\": 14,\n \"panels\": [],\n \"title\": \"Network\",\n \"type\": \"row\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"description\": \"If requests occasionally take longer than the threshold time, that's fine. If instead most of the queries take longer than the threshold, performance issue should be investigated.\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"fixedColor\": \"purple\",\n \"mode\": \"fixed\",\n \"seriesBy\": \"max\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"dashed+area\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"transparent\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 700000\n }\n ]\n },\n \"unit\": \"µs\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 26\n },\n \"id\": 23,\n \"options\": {\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": false\n },\n \"tooltip\": {\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"disableTextWrap\": false,\n \"editorMode\": \"code\",\n \"expr\": \"max by (hostname,child) (phpfpm_process_request_duration and (abs(phpfpm_process_request_duration - phpfpm_process_request_duration offset $__interval) > 1))\",\n \"fullMetaSearch\": false,\n \"hide\": false,\n \"includeNullMetadata\": true,\n \"legendFormat\": \"__auto\",\n \"range\": true,\n \"refId\": \"A\",\n \"useBackend\": false\n }\n ],\n \"title\": \"PHP-FPM Request Duration\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n }\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 26\n },\n \"id\": 24,\n \"options\": {\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"rate(phpfpm_max_listen_queue[2m])\",\n \"hide\": false,\n \"instant\": false,\n \"legendFormat\": \"{{hostname}} - max queue\",\n \"range\": true,\n \"refId\": \"B\"\n },\n {\n \"editorMode\": \"code\",\n \"expr\": \"phpfpm_listen_queue\",\n \"legendFormat\": \"{{hostname}} - queue\",\n \"range\": true,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"PHP-FPM Requests Queue Length\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"points\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"ms\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 24,\n \"x\": 0,\n \"y\": 34\n },\n \"id\": 9,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"max\",\n \"mean\",\n \"variance\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"maxHeight\": 600,\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{hostname=~\\\"$hostname\\\",unit=\\\"nginx.service\\\"} | pattern \\\"<_> <_> \\\" | line_format \\\"{{.line}}\\\" | json | __error__ != \\\"JSONParserErr\\\" | server_name =~ \\\"^$subdomain.*\\\"\",\n \"legendFormat\": \"\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Requests\",\n \"transformations\": [\n {\n \"id\": \"extractFields\",\n \"options\": {\n \"keepTime\": true,\n \"replace\": true,\n \"source\": \"labels\"\n }\n },\n {\n \"id\": \"organize\",\n \"options\": {\n \"excludeByName\": {\n \"body_bytes_sent\": true,\n \"bytes_sent\": true,\n \"gzip_ration\": true,\n \"job\": true,\n \"line\": true,\n \"post\": true,\n \"referrer\": true,\n \"remote_addr\": false,\n \"remote_user\": true,\n \"request\": true,\n \"request_length\": true,\n \"status\": true,\n \"time_local\": true,\n \"unit\": true,\n \"upstream_addr\": true,\n \"upstream_connect_time\": true,\n \"upstream_header_time\": true,\n \"upstream_response_time\": true,\n \"upstream_status\": false,\n \"user_agent\": true\n },\n \"includeByName\": {},\n \"indexByName\": {},\n \"renameByName\": {}\n }\n },\n {\n \"id\": \"convertFieldType\",\n \"options\": {\n \"conversions\": [\n {\n \"dateFormat\": \"\",\n \"destinationType\": \"number\",\n \"targetField\": \"request_time\"\n }\n ],\n \"fields\": {}\n }\n },\n {\n \"id\": \"partitionByValues\",\n \"options\": {\n \"fields\": [\n \"server_name\",\n \"remote_addr\"\n ],\n \"keepFields\": false\n }\n },\n {\n \"id\": \"renameByRegex\",\n \"options\": {\n \"regex\": \"request_time (.*)\",\n \"renamePattern\": \"$1\"\n }\n }\n ],\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"status\"\n },\n \"properties\": [\n {\n \"id\": \"custom.width\",\n \"value\": 70\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 24,\n \"x\": 0,\n \"y\": 42\n },\n \"id\": 3,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": [\n {\n \"desc\": true,\n \"displayName\": \"Time\"\n }\n ]\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{hostname=~\\\"$hostname\\\",unit=\\\"nginx.service\\\"} | pattern \\\"<_> <_> \\\" | line_format \\\"{{.line}}\\\" | json | __error__ != \\\"JSONParserErr\\\" | upstream_addr =~ \\\"$upstream_addr\\\"\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Requests Details\",\n \"transformations\": [\n {\n \"id\": \"extractFields\",\n \"options\": {\n \"source\": \"Line\"\n }\n },\n {\n \"id\": \"organize\",\n \"options\": {\n \"excludeByName\": {\n \"Line\": true,\n \"id\": true,\n \"labels\": true,\n \"server_name\": true,\n \"time_local\": true,\n \"tsNs\": true,\n \"upstream_addr\": true\n },\n \"includeByName\": {},\n \"indexByName\": {\n \"Line\": 2,\n \"Time\": 1,\n \"body_bytes_sent\": 13,\n \"bytes_sent\": 12,\n \"gzip_ration\": 16,\n \"id\": 4,\n \"labels\": 0,\n \"post\": 17,\n \"referrer\": 14,\n \"remote_addr\": 7,\n \"remote_user\": 8,\n \"request\": 6,\n \"request_length\": 10,\n \"request_time\": 20,\n \"server_name\": 11,\n \"status\": 5,\n \"time_local\": 9,\n \"tsNs\": 3,\n \"upstream_addr\": 18,\n \"upstream_connect_time\": 22,\n \"upstream_header_time\": 23,\n \"upstream_response_time\": 21,\n \"upstream_status\": 19,\n \"user_agent\": 15\n },\n \"renameByName\": {}\n }\n }\n ],\n \"type\": \"table\"\n },\n {\n \"datasource\": {\n \"default\": false,\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"status\"\n },\n \"properties\": [\n {\n \"id\": \"custom.width\",\n \"value\": 70\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 24,\n \"x\": 0,\n \"y\": 50\n },\n \"id\": 11,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": []\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{hostname=~\\\"$hostname\\\",unit=\\\"nginx.service\\\"} | pattern \\\"<_> <_> \\\" | line_format \\\"{{.line}}\\\" | json | __error__ != \\\"JSONParserErr\\\" | upstream_addr = \\\"$upstream_addr\\\" | status =~\\\"5..\\\"\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"5XX Requests Details\",\n \"transformations\": [\n {\n \"id\": \"extractFields\",\n \"options\": {\n \"source\": \"Line\"\n }\n },\n {\n \"id\": \"organize\",\n \"options\": {\n \"excludeByName\": {\n \"Line\": true,\n \"id\": true,\n \"labels\": true,\n \"server_name\": true,\n \"time_local\": true,\n \"tsNs\": true,\n \"upstream_addr\": true\n },\n \"includeByName\": {},\n \"indexByName\": {\n \"Line\": 2,\n \"Time\": 1,\n \"body_bytes_sent\": 13,\n \"bytes_sent\": 12,\n \"gzip_ration\": 16,\n \"id\": 4,\n \"labels\": 0,\n \"post\": 17,\n \"referrer\": 14,\n \"remote_addr\": 7,\n \"remote_user\": 8,\n \"request\": 6,\n \"request_length\": 10,\n \"request_time\": 20,\n \"server_name\": 11,\n \"status\": 5,\n \"time_local\": 9,\n \"tsNs\": 3,\n \"upstream_addr\": 18,\n \"upstream_connect_time\": 22,\n \"upstream_header_time\": 23,\n \"upstream_response_time\": 21,\n \"upstream_status\": 19,\n \"user_agent\": 15\n },\n \"renameByName\": {}\n }\n }\n ],\n \"type\": \"table\"\n },\n {\n \"collapsed\": false,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 58\n },\n \"id\": 18,\n \"panels\": [],\n \"title\": \"Logs\",\n \"type\": \"row\"\n },\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {},\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 24,\n \"x\": 0,\n \"y\": 59\n },\n \"id\": 20,\n \"maxPerRow\": 2,\n \"options\": {\n \"dedupStrategy\": \"none\",\n \"enableLogDetails\": true,\n \"prettifyLogMessage\": false,\n \"showCommonLabels\": false,\n \"showLabels\": false,\n \"showTime\": true,\n \"sortOrder\": \"Descending\",\n \"wrapLogMessage\": false\n },\n \"pluginVersion\": \"11.4.0\",\n \"repeat\": \"other_service\",\n \"repeatDirection\": \"h\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{hostname=~\\\"$hostname\\\",unit=\\\"$other_service.service\\\"} | line_format \\\"{{ if hasPrefix \\\\\\\"{\\\\\\\" __line__ }}{{ with $parsed := fromJson __line__ }}[{{.app}} - {{.url}}] {{ if hasPrefix \\\\\\\"{\\\\\\\" .message }}{{ with $mParsed := fromJson .message }}{{ $mParsed.Message }} @ {{ $mParsed.File }}:{{ $mParsed.Line }}{{ end }}{{ else }}{{ .message }}{{ end }}{{ end }}{{ else }}{{ __line__ }}{{ end }}\\\"\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Log: $other_service\",\n \"type\": \"logs\"\n },\n {\n \"collapsed\": false,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 89\n },\n \"id\": 15,\n \"panels\": [],\n \"title\": \"Backup\",\n \"type\": \"row\"\n },\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {},\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 24,\n \"x\": 0,\n \"y\": 90\n },\n \"id\": 16,\n \"maxPerRow\": 2,\n \"options\": {\n \"dedupStrategy\": \"none\",\n \"enableLogDetails\": true,\n \"prettifyLogMessage\": false,\n \"showCommonLabels\": false,\n \"showLabels\": false,\n \"showTime\": true,\n \"sortOrder\": \"Descending\",\n \"wrapLogMessage\": false\n },\n \"pluginVersion\": \"11.4.0\",\n \"repeat\": \"service_backup\",\n \"repeatDirection\": \"h\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{hostname=~\\\"$hostname\\\",unit=\\\"$service_backup.service\\\"}\",\n \"legendFormat\": \"\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Log: $service_backup\",\n \"transformations\": [\n {\n \"disabled\": true,\n \"id\": \"extractFields\",\n \"options\": {\n \"source\": \"Line\"\n }\n },\n {\n \"disabled\": true,\n \"id\": \"organize\",\n \"options\": {\n \"excludeByName\": {\n \"Line\": true,\n \"id\": true,\n \"labels\": true,\n \"tsNs\": true\n },\n \"includeByName\": {},\n \"indexByName\": {},\n \"renameByName\": {}\n }\n }\n ],\n \"type\": \"logs\"\n },\n {\n \"collapsed\": false,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 100\n },\n \"id\": 13,\n \"panels\": [],\n \"title\": \"Supporting Services\",\n \"type\": \"row\"\n },\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"duration_ms\"\n },\n \"properties\": [\n {\n \"id\": \"custom.width\",\n \"value\": 100\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"unit\"\n },\n \"properties\": [\n {\n \"id\": \"custom.width\",\n \"value\": 150\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"statement\"\n },\n \"properties\": [\n {\n \"id\": \"custom.width\",\n \"value\": 505\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 24,\n \"x\": 0,\n \"y\": 101\n },\n \"id\": 10,\n \"links\": [\n {\n \"title\": \"explore\",\n \"url\": \"https://grafana.tiserbox.com/explore?panes=%7B%22HWt%22:%7B%22datasource%22:%22cd6cc53e-840c-484d-85f7-96fede324006%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22expr%22:%22%7Bunit%3D%5C%22nginx.service%5C%22%7D%20%7C%20pattern%20%5C%22%3C_%3E%20%3C_%3E%20%3Cline%3E%5C%22%20%7C%20line_format%20%5C%22%7B%7B.line%7D%7D%5C%22%20%7C%20json%20%7C%20status%20%21~%20%5C%222..%5C%22%20%7C%20__error__%20%21%3D%20%5C%22JSONParserErr%5C%22%22,%22queryType%22:%22range%22,%22datasource%22:%7B%22type%22:%22loki%22,%22uid%22:%22cd6cc53e-840c-484d-85f7-96fede324006%22%7D,%22editorMode%22:%22code%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D%7D&schemaVersion=1&orgId=1\"\n }\n ],\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": [\n {\n \"desc\": true,\n \"displayName\": \"Time\"\n }\n ]\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{hostname=~\\\"$hostname\\\",unit=\\\"postgresql.service\\\"} | regexp \\\".*duration: (?P[0-9.]+) ms (?P.*)\\\" | duration_ms > 1000\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Slow PostgreSQL Queries\",\n \"transformations\": [\n {\n \"id\": \"extractFields\",\n \"options\": {\n \"keepTime\": false,\n \"replace\": false,\n \"source\": \"labels\"\n }\n },\n {\n \"id\": \"organize\",\n \"options\": {\n \"excludeByName\": {\n \"Line\": true,\n \"Time\": false,\n \"id\": true,\n \"job\": true,\n \"labels\": true,\n \"tsNs\": true,\n \"unit\": true\n },\n \"includeByName\": {},\n \"indexByName\": {\n \"Line\": 6,\n \"Time\": 0,\n \"duration_ms\": 1,\n \"id\": 8,\n \"job\": 2,\n \"labels\": 5,\n \"statement\": 4,\n \"tsNs\": 7,\n \"unit\": 3\n },\n \"renameByName\": {}\n }\n }\n ],\n \"type\": \"table\"\n },\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"fieldConfig\": {\n \"defaults\": {},\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 109\n },\n \"id\": 2,\n \"options\": {\n \"dedupStrategy\": \"none\",\n \"enableLogDetails\": false,\n \"prettifyLogMessage\": false,\n \"showCommonLabels\": false,\n \"showLabels\": false,\n \"showTime\": true,\n \"sortOrder\": \"Descending\",\n \"wrapLogMessage\": false\n },\n \"pluginVersion\": \"11.4.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"loki\",\n \"uid\": \"cd6cc53e-840c-484d-85f7-96fede324006\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"{unit=\\\"redis-$service.service\\\"} |= ``\",\n \"queryType\": \"range\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Redis\",\n \"type\": \"logs\"\n }\n ],\n \"preload\": false,\n \"schemaVersion\": 40,\n \"tags\": [],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"text\": [\n \"baryum\"\n ],\n \"value\": [\n \"baryum\"\n ]\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"definition\": \"label_values(up,hostname)\",\n \"includeAll\": false,\n \"multi\": true,\n \"name\": \"hostname\",\n \"options\": [],\n \"query\": {\n \"qryType\": 1,\n \"query\": \"label_values(up,hostname)\",\n \"refId\": \"PrometheusVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"current\": {\n \"text\": \"nextcloud\",\n \"value\": \"nextcloud\"\n },\n \"description\": \"\",\n \"hide\": 2,\n \"name\": \"service\",\n \"query\": \"nextcloud\",\n \"skipUrlSync\": true,\n \"type\": \"constant\"\n },\n {\n \"current\": {\n \"text\": \"n\",\n \"value\": \"n\"\n },\n \"hide\": 2,\n \"name\": \"subdomain\",\n \"query\": \"n\",\n \"skipUrlSync\": true,\n \"type\": \"constant\"\n },\n {\n \"current\": {\n \"text\": \"unix:/run/phpfpm/nextcloud.sock\",\n \"value\": \"unix:/run/phpfpm/nextcloud.sock\"\n },\n \"hide\": 2,\n \"name\": \"upstream_addr\",\n \"query\": \"unix:/run/phpfpm/nextcloud.sock\",\n \"skipUrlSync\": true,\n \"type\": \"constant\"\n },\n {\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"df80f9f5-97d7-4112-91d8-72f523a02b09\"\n },\n \"definition\": \"label_values({unit_name=~\\\".*$service.*\\\", unit_name=~\\\".*backups.*\\\", unit_name!~\\\".*restore_gen\\\"},unit_name)\",\n \"description\": \"\",\n \"hide\": 2,\n \"includeAll\": true,\n \"name\": \"service_backup\",\n \"options\": [],\n \"query\": {\n \"qryType\": 1,\n \"query\": \"label_values({unit_name=~\\\".*$service.*\\\", unit_name=~\\\".*backups.*\\\", unit_name!~\\\".*restore_gen\\\"},unit_name)\",\n \"refId\": \"PrometheusVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"sort\": 1,\n \"type\": \"query\"\n },\n {\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"definition\": \"label_values(netdata_systemd_service_unit_state_state_average{unit_name=~\\\".*nextcloud.*\\\", unit_name!~\\\".*backup.*\\\", unit_name!~\\\".*redis.*\\\"},unit_name)\",\n \"hide\": 2,\n \"includeAll\": true,\n \"name\": \"other_service\",\n \"options\": [],\n \"query\": {\n \"qryType\": 1,\n \"query\": \"label_values(netdata_systemd_service_unit_state_state_average{unit_name=~\\\".*nextcloud.*\\\", unit_name!~\\\".*backup.*\\\", unit_name!~\\\".*redis.*\\\"},unit_name)\",\n \"refId\": \"PrometheusVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-2d\",\n \"to\": \"now\"\n },\n \"timepicker\": {},\n \"timezone\": \"browser\",\n \"title\": \"Nextcloud\",\n \"uid\": \"cdsszybv2gow0d\",\n \"version\": 49,\n \"weekStart\": \"\"\n}\n"
},
{
"path": "modules/services/nextcloud-server/docs/default.md",
"content": "# Nextcloud Server Service {#services-nextcloudserver}\n\nDefined in [`/modules/services/nextcloud-server.nix`](@REPO@/modules/services/nextcloud-server.nix).\n\nThis NixOS module is a service that sets up a [Nextcloud Server](https://nextcloud.com/).\nIt is based on the nixpkgs Nextcloud server and provides opinionated defaults.\n\n## Features {#services-nextcloudserver-features}\n\n- Declarative [Apps](#services-nextcloudserver-options-shb.nextcloud.apps) Configuration - no need\n to configure those with the UI.\n - [LDAP](#services-nextcloudserver-usage-ldap) app:\n enables app and sets up integration with an existing LDAP server, in this case LLDAP.\n Note that the LDAP app cannot distinguish between normal users and admin users.\n - [SSO](#services-nextcloudserver-usage-oidc) app:\n enables app and sets up integration with an existing SSO server, in this case Authelia.\n The SSO app can distinguish between normal users and admin users.\n - [Preview Generator](#services-nextcloudserver-usage-previewgenerator) app:\n enables app and sets up required cron job.\n - [External Storage](#services-nextcloudserver-usage-externalstorage) app:\n enables app and optionally configures one local mount.\n This enables having data living on separate hard drives.\n - [Only Office](#services-nextcloudserver-usage-onlyoffice) app:\n enables app and sets up Only Office service.\n - [Memories](#services-nextcloudserver-usage-memories) app:\n enables app and sets up all required dependencies and optional hardware acceleration with VAAPI.\n - [Recognize](#services-nextcloudserver-usage-recognize) app:\n enables app and sets up all required dependencies and optional hardware acceleration with VAAPI.\n - Any other app through the\n [shb.nextcloud.extraApps](#services-nextcloudserver-options-shb.nextcloud.extraApps) option.\n- Access through subdomain using reverse proxy.\n- Forces Nginx as the reverse proxy. (This is hardcoded in the upstream nixpkgs module).\n- Sets good defaults for trusted proxies settings, chunk size, opcache php options.\n- Access through HTTPS using reverse proxy.\n- Forces PostgreSQL as the database.\n- Forces Redis as the cache and sets good defaults.\n- Backup of the [`shb.nextcloud.dataDir`][dataDir] through the [backup block](./blocks-backup.html).\n- [Monitoring Dashboard](#services-nextcloudserver-dashboard) for monitoring of reverse proxy, PHP-FPM, and database backups through the [monitoring block](./blocks-monitoring.html).\n- Integration with the [dashboard contract](contracts-dashboard.html) for displaying user facing application in a dashboard.\n- [Integration Tests](@REPO@/test/services/nextcloud.nix)\n - Tests system cron job is setup correctly.\n - Tests initial admin user and password are setup correctly.\n - Tests admin user can create and retrieve a file through WebDAV.\n- Enables easy setup of xdebug for PHP debugging if needed.\n- Easily add other apps declaratively through [extraApps][]\n- By default automatically disables maintenance mode on start.\n- By default automatically launches repair mode with expensive migrations on start.\n- Access to advanced options not exposed here thanks to how NixOS modules work.\n- Has a [demo](#services-nextcloudserver-demo).\n\n[dataDir]: ./services-nextcloud.html#services-nextcloudserver-options-shb.nextcloud.dataDir\n\n## Usage {#services-nextcloudserver-usage}\n\n### Nextcloud through HTTP {#services-nextcloudserver-usage-basic}\n\n[HTTP]: #services-nextcloudserver-usage-basic\n\n:::: {.note}\nThis section corresponds to the `basic` section of the [Nextcloud\ndemo](demo-nextcloud-server.html#demo-nextcloud-deploy-basic).\n::::\n\nConfiguring Nextcloud to be accessible through Nginx reverse proxy\nat the address `http://n.example.com`,\nwith PostgreSQL and Redis configured,\nis done like so:\n\n```nix\nshb.nextcloud = {\n enable = true;\n domain = \"example.com\";\n subdomain = \"n\";\n defaultPhoneRegion = \"US\";\n initialAdminUsername = \"root\";\n adminPass.result = config.shb.sops.secret.\"nextcloud/adminpass\".result;\n};\n\nshb.sops.secret.\"nextcloud/adminpass\".request = config.shb.nextcloud.adminPass.request;\n```\n\nThis assumes secrets are setup with SOPS as mentioned in [the secrets setup section](usage.html#usage-secrets) of the manual.\nSecrets can be randomly generated with `nix run nixpkgs#openssl -- rand -hex 64`.\n\nNote though that Nextcloud will not be very happy to be accessed through HTTP,\nit much prefers - rightfully - to be accessed through HTTPS.\nWe will set that up in the next section.\n\nYou can now login as the admin user using the username `root`\nand the password defined in `sops.secrets.\"nextcloud/adminpass\"`.\n\n### Nextcloud through HTTPS {#services-nextcloudserver-usage-https}\n\n[HTTPS]: #services-nextcloudserver-usage-https\n\nTo setup HTTPS, we will get our certificates from Let's Encrypt using the HTTP method.\nThis is the easiest way to get started and does not require you to programmatically \nconfigure a DNS provider.\n\nUnder the hood, we use the Self Host Block [SSL contract](./contracts-ssl.html).\nIt allows the end user to choose how to generate the certificates.\nIf you want other options to generate the certificate, follow the SSL contract link.\n\nBuilding upon the [Basic Configuration](#services-nextcloudserver-usage-basic) above, we add:\n\n```nix\nshb.certs.certs.letsencrypt.\"example.com\" = {\n domain = \"example.com\";\n group = \"nginx\";\n reloadServices = [ \"nginx.service\" ];\n adminEmail = \"myemail@mydomain.com\";\n};\n\nshb.certs.certs.letsencrypt.\"example.com\".extraDomains = [ \"n.example.com\" ];\n\nshb.nextcloud = {\n ssl = config.shb.certs.certs.letsencrypt.\"example.com\";\n};\n```\n\n### Choose Nextcloud Version {#services-nextcloudserver-usage-version}\n\nSelf Host Blocks is conservative in the version of Nextcloud it's using.\nTo choose the version and upgrade at the time of your liking,\njust use the [version](#services-nextcloudserver-options-shb.nextcloud.version) option:\n\n```nix\nshb.nextcloud.version = 29;\n```\n\n### Mount Point {#services-nextcloudserver-usage-mount-point}\n\nIf the `dataDir` exists in a mount point,\nit is highly recommended to make the various Nextcloud services wait on the mount point before starting.\nDoing that is just a matter of setting the `mountPointServices` option.\n\nAssuming a mount point on `/var`, the configuration would look like so:\n\n```nix\nfileSystems.\"/var\".device = \"...\";\nshb.nextcloud.mountPointServices = [ \"var.mount\" ];\n```\n\n### With LDAP Support {#services-nextcloudserver-usage-ldap}\n\n[LDAP]: #services-nextcloudserver-usage-ldap\n\n:::: {.note}\nThis section corresponds to the `ldap` section of the [Nextcloud\ndemo](demo-nextcloud-server.html#demo-nextcloud-deploy-ldap).\n::::\n\nWe will build upon the [HTTP][] and [HTTPS][] sections,\nso please read those first.\n\nWe will use the [LLDAP block][] provided by Self Host Blocks.\nAssuming it [has been set already][LLDAP block setup], add the following configuration:\n\n[LLDAP block]: blocks-lldap.html\n[LLDAP block setup]: blocks-lldap.html#blocks-lldap-global-setup\n\n```nix\nshb.nextcloud.apps.ldap = {\n enable = true;\n host = \"127.0.0.1\";\n port = config.shb.lldap.ldapPort;\n dcdomain = config.shb.lldap.dcdomain;\n adminName = \"admin\";\n adminPassword.result = config.shb.sops.secret.\"nextcloud/ldap/adminPassword\".result\n userGroup = \"nextcloud_user\";\n};\n\nshb.sops.secret.\"nextcloud/ldap/adminPassword\" = {\n request = config.shb.nextcloud.apps.ldap.adminPassword.request;\n settings.key = \"ldap/userPassword\";\n};\n```\n\nThe LDAP admin password must be shared between `shb.lldap` and `shb.nextcloud`,\nto do that with SOPS we use the `key` option so that both\n`sops.secrets.\"ldap/userPassword\"`\nand `sops.secrets.\"nextcloud/ldapUserPassword\"`\nsecrets have the same content.\n\nThe LDAP [user group](#services-nextcloudserver-options-shb.nextcloud.apps.ldap.userGroup) is created automatically.\nAdd your user to it by going to `http://ldap.example.com`,\ncreate a user if needed and add it to the group.\nWhen that's done, go back to the Nextcloud server at\n`https://nextcloud.example.com` and login with that user.\n\nNote that we cannot create an admin user from the LDAP server,\nso you need to create a normal user like above,\nlogin with it once so it is known to Nextcloud, then logout,\nlogin with the admin Nextcloud user and promote that new user to admin level.\nThis limitation does not exist with the [SSO integration](#services-nextcloudserver-usage-oidc).\n\n### With SSO Support {#services-nextcloudserver-usage-oidc}\n\n:::: {.note}\nThis section corresponds to the `sso` section of the [Nextcloud\ndemo](demo-nextcloud-server.html#demo-nextcloud-deploy-sso).\n::::\n\nWe will build upon the [HTTP][], [HTTPS][] and [LDAP][] sections,\nso please read those first.\n\nWe will use the [SSO block][] provided by Self Host Blocks.\nAssuming it [has been set already][SSO block setup], add the following configuration:\n\n[SSO block]: blocks-sso.html\n[SSO block setup]: blocks-sso.html#blocks-sso-global-setup\n\n```nix\nshb.nextcloud.apps.sso = {\n enable = true;\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n clientID = \"nextcloud\";\n fallbackDefaultAuth = false;\n\n secret.result = config.shb.sops.secret.\"nextcloud/sso/secret\".result;\n secretForAuthelia.result = config.shb.sops.secret.\"nextcloud/sso/secretForAuthelia\".result;\n};\n\nshb.sops.secret.\"nextcloud/sso/secret\".request = config.shb.nextcloud.apps.sso.secret.request;\nshb.sops.secret.\"nextcloud/sso/secretForAuthelia\" = {\n request = config.shb.nextcloud.apps.sso.secretForAuthelia.request;\n settings.key = \"nextcloud/sso/secret\";\n};\n```\n\nThe SSO secret must be shared between `shb.authelia` and `shb.nextcloud`,\nto do that with SOPS we use the `key` option so that both\n`sops.secrets.\"nextcloud/sso/secret\"`\nand `sops.secrets.\"nextcloud/sso/secretForAuthelia\"`\nsecrets have the same content.\n\nThe LDAP [user group](#services-nextcloudserver-options-shb.nextcloud.apps.ldap.userGroup) and [admin group](#services-nextcloudserver-options-shb.nextcloud.apps.sso.adminGroup) are created automatically.\nAdd your user to one or both by going to `http://ldap.example.com`,\ncreate a user if needed and add it to the groups.\nWhen that's done, go back to the Nextcloud server at\n`https://nextcloud.example.com` and login with that user.\n\nSetting the `fallbackDefaultAuth` to `false` means the only way to login is through Authelia.\nIf this does not work for any reason, you can let users login through Nextcloud directly by setting this option to `true`.\n\n### Tweak PHPFpm Config {#services-nextcloudserver-usage-phpfpm}\n\nFor instances with more users, or if you feel the pages are loading slowly,\nyou can tweak the `php-fpm` pool settings.\n\n```nix\nshb.nextcloud.phpFpmPoolSettings = {\n \"pm\" = \"static\"; # Can be dynamic\n \"pm.max_children\" = 150;\n # \"pm.start_servers\" = 300;\n # \"pm.min_spare_servers\" = 300;\n # \"pm.max_spare_servers\" = 500;\n # \"pm.max_spawn_rate\" = 50;\n # \"pm.max_requests\" = 50;\n # \"pm.process_idle_timeout\" = \"20s\";\n};\n```\n\nI don't have a good heuristic for what are good values here but what I found\nis that you don't want too high of a `max_children` value\nto avoid I/O strain on the hard drives, especially if you use spinning drives.\n\nTo see the effect of your settings,\ngo to the provided [Grafana dashboard](#services-nextcloudserver-dashboard).\n\n### Tweak PostgreSQL Settings {#services-nextcloudserver-usage-postgres}\n\nThese settings will impact all databases since the NixOS Postgres module\nconfigures only one Postgres instance.\n\nTo know what values to put here, use [https://pgtune.leopard.in.ua/](https://pgtune.leopard.in.ua/).\nRemember the server hosting PostgreSQL is shared at least with the Nextcloud service and probably others.\nSo to avoid PostgreSQL hogging all the resources, reduce the values you give on that website\nfor CPU, available memory, etc.\nFor example, I put 12 GB of memory and 4 CPUs while I had more:\n\n- `DB Version`: 14\n- `OS Type`: linux\n- `DB Type`: dw\n- `Total Memory (RAM)`: 12 GB\n- `CPUs num`: 4\n- `Data Storage`: ssd\n\nAnd got the following values:\n\n```nix\nshb.nextcloud.postgresSettings = {\n max_connections = \"400\";\n shared_buffers = \"3GB\";\n effective_cache_size = \"9GB\";\n maintenance_work_mem = \"768MB\";\n checkpoint_completion_target = \"0.9\";\n wal_buffers = \"16MB\";\n default_statistics_target = \"100\";\n random_page_cost = \"1.1\";\n effective_io_concurrency = \"200\";\n work_mem = \"7864kB\";\n huge_pages = \"off\";\n min_wal_size = \"1GB\";\n max_wal_size = \"4GB\";\n max_worker_processes = \"4\";\n max_parallel_workers_per_gather = \"2\";\n max_parallel_workers = \"4\";\n max_parallel_maintenance_workers = \"2\";\n};\n```\n\nTo see the effect of your settings,\ngo to the provided [Grafana dashboard](#services-nextcloudserver-dashboard).\n\n### Backup {#services-nextcloudserver-usage-backup}\n\nBacking up Nextcloud data files using the [Restic block](blocks-restic.html) is done like so:\n\n```nix\nshb.restic.instances.\"nextcloud\" = {\n request = config.shb.nextcloud.backup;\n settings = {\n enable = true;\n };\n};\n```\n\nThe name `\"nextcloud\"` in the `instances` can be anything.\nThe `config.shb.nextcloud.backup` option provides what directories to backup.\nYou can define any number of Restic instances to backup Nextcloud multiple times.\n\nFor backing up the Nextcloud database using the same Restic block, do like so:\n\n```nix\nshb.restic.instances.\"postgres\" = {\n request = config.shb.postgresql.databasebackup;\n settings = {\n enable = true;\n };\n};\n```\n\nNote that this will backup the whole PostgreSQL instance,\nnot just the Nextcloud database.\nThis limitation will be lifted in the future.\n\n### Application Dashboard {#services-nextcloudserver-usage-applicationdashboard}\n\nIntegration with the [dashboard contract](contracts-dashboard.html) is provided\nby the [dashboard option](#services-nextcloudserver-options-shb.nextcloud.dashboard).\n\nFor example using the [Homepage](services-homepage.html) service:\n\n```nix\n{\n shb.homepage.servicesGroups.Documents.services.Nextcloud = {\n sortOrder = 1;\n dashboard.request = config.shb.nextcloud.dashboard.request;\n };\n}\n```\n\n### Enable Preview Generator App {#services-nextcloudserver-usage-previewgenerator}\n\nThe following snippet installs and enables the [Preview\nGenerator](https://apps.nextcloud.com/apps/previewgenerator) application as well as creates the\nrequired cron job that generates previews every 10 minutes.\n\n```nix\nshb.nextcloud.apps.previewgenerator.enable = true;\n```\n\nNote that you still need to generate the previews for any pre-existing files with:\n\n```bash\nnextcloud-occ -vvv preview:generate-all\n```\n\nThe default settings generates all possible sizes which is a waste since most are not used. SHB will\nchange the generation settings to optimize disk space and CPU usage as outlined in [this\narticle](http://web.archive.org/web/20200513043150/https://ownyourbits.com/2019/06/29/understanding-and-improving-nextcloud-previews/).\nYou can opt-out with:\n\n```nix\nshb.nextcloud.apps.previewgenerator.recommendedSettings = false;\n```\n\n### Enable External Storage App {#services-nextcloudserver-usage-externalstorage}\n\nThe following snippet installs and enables the [External\nStorage](https://docs.nextcloud.com/server/28/go.php?to=admin-external-storage) application.\n\n```nix\nshb.nextcloud.apps.externalStorage.enable = true;\n```\n\nAdding external storage can then be done through the UI.\nFor the special case of mounting a local folder as an external storage,\nSelf Host Blocks provides options.\nThe following snippet will mount the `/srv/nextcloud/$user` local file\nin each user's `/home` Nextcloud directory.\n\n```nix\nshb.nextcloud.apps.externalStorage.userLocalMount = {\n rootDirectory = \"/srv/nextcloud/$user\";\n mountName = \"home\";\n};\n```\n\nYou can even make the external storage mount in the root `/` Nextcloud directory with:\n\n```nix\nshb.nextcloud.apps.externalStorage.userLocalMount = {\n mountName = \"/\";\n};\n```\n\nRecommended use of this app is to have the Nextcloud's `dataDir` on a SSD\nand the `userLocalMount` on a HDD.\nIndeed, a SSD is much quicker than a spinning hard drive,\nwhich is well suited for randomly accessing small files like thumbnails.\nOn the other side, a spinning hard drive can store more data\nwhich is well suited for storing user data.\n\nThis Nextcloud module includes a patch that allows the external storage\nto actually create the local path. Normally, when login in for the first time,\nthe user will be greeted with an error saying the external storage path does\nnot exist. One must then create it manually. With this patch, Nextcloud\ncreates the path.\n\n### Enable OnlyOffice App {#services-nextcloudserver-usage-onlyoffice}\n\nThe following snippet installs and enables the [Only\nOffice](https://apps.nextcloud.com/apps/onlyoffice) application as well as sets up an Only Office\ninstance listening at `onlyoffice.example.com` that only listens on the local network.\n\n```nix\nshb.nextcloud.apps.onlyoffice = {\n enable = true;\n subdomain = \"onlyoffice\";\n localNextworkIPRange = \"192.168.1.1/24\";\n};\n```\n\nAlso, you will need to explicitly allow the package `corefonts`:\n\n```nix\nnixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (pkgs.lib.getName pkg) [\n \"corefonts\"\n];\n```\n\n### Enable Memories App {#services-nextcloudserver-usage-memories}\n\nThe following snippet installs and enables the\n[Memories](https://apps.nextcloud.com/apps/memories) application.\n\n```nix\nshb.nextcloud.apps.memories = {\n enable = true;\n vaapi = true; # If hardware acceleration is supported.\n photosPath = \"/Photos\"; # This is the default.\n};\n```\n\nAll the following dependencies are installed correctly\nand fully declaratively, the config page is \"all green\":\n\n- Exiftool with the correct version\n- Indexing path is set to `/Photos` by default.\n- Images, HEIC, videos preview generation.\n- Performance is all green with database triggers.\n- Recommended apps are\n - Albums: this is installed by default.\n - Recognize can be installed [here](#services-nextcloudserver-usage-recognize)\n - Preview Generator can be installed [here](#services-nextcloudserver-usage-previewgenerator)\n- Reverse Geocoding must be triggered manually with `nextcloud-occ memories:places-setup `.\n- Video streaming is setup by installed ffmpeg headless.\n- Transcoder is setup natively (not with slow WASM) wit `go-vod` binary.\n- Hardware Acceleration is optionally setup by setting `vaapi` to `true`.\n\nIt is not required but you can for the first indexing with `nextcloud-occ memories:index`.\n\nNote that the app is not configurable through the UI since the config file is read-only.\n\n### Enable Recognize App {#services-nextcloudserver-usage-recognize}\n\nThe following snippet installs and enables the\n[Recognize](https://apps.nextcloud.com/apps/recognize) application.\n\n```nix\nshb.nextcloud.apps.recognize = {\n enable = true;\n};\n```\n\nThe required dependencies are installed: `nodejs` and `nice`.\n\n### Enable Monitoring {#services-nextcloudserver-server-usage-monitoring}\n\nEnable the [monitoring block](./blocks-monitoring.html).\nA [Grafana dashboard][] for overall server performance will be created\nand the Nextcloud metrics will automatically appear there.\n\n[Grafana dashboard]: ./blocks-monitoring.html#blocks-monitoring-performance-dashboard\n\n### Enable Tracing {#services-nextcloudserver-server-usage-tracing}\n\nYou can enable tracing with:\n\n```nix\nshb.nextcloud.debug = true;\n```\n\nTraces will be located at `/var/log/xdebug`.\nSee [my blog post][] for how to look at the traces.\nI want to make the traces available in Grafana directly\nbut that's not the case yet.\n\n[my blog post]: http://blog.tiserbox.com/posts/2023-08-12-what%27s-up-with-nextcloud-webdav-slowness.html\n\n### Appdata Location {#services-nextcloudserver-server-usage-appdata}\n\nThe appdata folder is a special folder located under the `shb.nextcloud.dataDir` directory.\nIt is named `appdata_` with the Nextcloud's instance ID as a suffix.\nYou can find your current instance ID with `nextcloud-occ config:system:get instanceid`.\nIn there, you will find one subfolder for every installed app that needs to store files.\n\nFor performance reasons, it is recommended to store this folder on a fast drive\nthat is optimized for randomized read and write access.\nThe best would be either an SSD or an NVMe drive.\n\nThe best way to solve this is to use the [External Storage app](#services-nextcloudserver-usage-externalstorage).\n\nIf you have an existing installation and put Nextcloud's `shb.nextcloud.dataDir` folder on a HDD with spinning disks,\nthen the appdata folder is also located on spinning drives.\nOne way to solve this is to bind mount a folder from an SSD over the appdata folder.\nSHB does not provide a declarative way to setup this\nas the external storage app is the preferred way\nbut this command should be enough:\n\n```bash\nmount /dev/sdd /srv/sdd\nmkdir -p /srv/sdd/appdata_nextcloud\nmount --bind /srv/sdd/appdata_nextcloud /var/lib/nextcloud/data/appdata_ocxvky2f5ix7\n```\n\nNote that you can re-generate a new appdata folder\nby issuing the command `nextcloud-occ config:system:delete instanceid`.\n\n## Demo {#services-nextcloudserver-demo}\n\nHead over to the [Nextcloud demo](demo-nextcloud-server.html) for a demo that installs Nextcloud with or\nwithout LDAP integration on a VM with minimal manual steps.\n\n## Monitoring Dashboard {#services-nextcloudserver-dashboard}\n\nThe dashboard is added to Grafana automatically under \"Self Host Blocks > Nextcloud\"\nas long as the Nextcloud service is [enabled][]\nas well as the [monitoring block][].\n\n[enabled]: #services-nextcloudserver-options-shb.nextcloud.enable\n[monitoring block]: ./blocks-monitoring.html#blocks-monitoring-options-shb.monitoring.enable\n\n- The *General* section shows Nextcloud related services.\n This includes cronjobs, Redis and backup jobs.\n- *CPU* shows stall time which means CPU is maxed out.\n This graph is inverted so having a small area at the top means the stall time is low.\n- *Memory* shows stall time which means some job is waiting on memory to be allocated.\n This graph is inverted so having a small area at the top means the stall time is low.\n Some stall time will always be present. Under 10% is fine\n but having constantly over 50% usually means available memory is low and SWAP is being used.\n *Memory* also shows available memory which is the remaining allocatable memory.\n- Caveat: *Network I/O* shows the network input and output for\n all services running, not only those related to Nextcloud.\n- *Disk I/O* shows \"some\" stall time which means some jobs were waiting on disk I/O.\n Disk is usually the slowest bottleneck so having \"some\" stall time is not surprising.\n Fixing this can be done by using disks allowing higher speeds or switching to SSDs.\n If the \"full\" stall time is shown, this means _all_ jobs were waiting on disk i/o which\n can be more worrying. This could indicate a failing disk if \"full\" stall time appeared recently.\n These graphs are inverted so having a small area at the top means the stall time is low.\n *Memory* also shows available memory which is the remaining allocatable memory.\n\n- *PHP-FPM Processes* shows how many processes are used by PHP-FPM.\n The orange area goes from 80% to 90% of the maximum allowed processes.\n The read area goes from 90% to 100% of the maximum allowed processes.\n If the number of active processes reaches those areas once in a while, that's fine\n but if it happens most of the time, the maximum allowed processes should be increased.\n- *PHP-FPM Request Duration* shows one dot per request and how long it took.\n Request time is fine if it is under 400ms.\n If most requests take longer than that, some [tracing](#services-nextcloudserver-server-usage-tracing)\n is required to understand which subsystem is taking some time.\n That being said, maybe another graph in this dashboard will show \n why the requests are slow - like disk\n or other processes hoarding some resources running at the same time.\n- *PHP-FPM Requests Queue Length* shows how many requests are waiting\n to be picked up by a PHP-FPM process. Usually, this graph won't show\n anything as long as the *PHP-FPM Processes* graph is not in the red area.\n Fixing this requires also increasing the maximum allowed processes.\n\n- *Requests Details* shows all requests to the Nextcloud service and the related headers.\n- *5XX Requests Details* shows only the requests having a 500 to 599 http status.\n Having any requests appearing here should be investigated as soon as possible.\n\n- *Log: \\* shows all logs from related systemd `.service` job.\n Having no line here most often means the job ran\n at a time not currently included in the time range of the dashboard.\n\n\n- A lot of care has been taken to parse error messages correctly.\n Nextcloud mixes json and non-json messages so extracting errors\n from json messages was not that easy.\n Also, the stacktrace is reduced.\n The result though is IMO pretty nice as can be seen by the following screenshot.\n The top line is the original json message and the bottom one is the parsed error.\n\n- *Backup logs* show the output of the backup jobs.\n Here, there are two backup jobs, one for the core files of Nextcloud\n stored on an SSD which includes the appdata folder.\n The other backup job is for the external data stored on HDDs which contain all user files.\n\n- *Slow PostgreSQL queries* shows all database queries taking longer than 1s to run.\n- *Redis* shows all Redis log output.\n\n\n## Debug {#services-nextcloudserver-debug}\n\nOn the command line, the `occ` tool is called `nextcloud-occ`.\n\nIn case of an issue, check the logs for any systemd service mentioned in this section.\n\nOn startup, the oneshot systemd service `nextcloud-setup.service` starts. After it finishes, the\n`phpfpm-nextcloud.service` starts to serve Nextcloud. The `nginx.service` is used as the reverse\nproxy. `postgresql.service` run the database.\n\nNextcloud' configuration is found at `${shb.nextcloud.dataDir}/config/config.php`. Nginx'\nconfiguration can be found with `systemctl cat nginx | grep -om 1 -e \"[^ ]\\+conf\"`.\n\nEnable verbose logging by setting the `shb.nextcloud.debug` boolean to `true`.\n\nAccess the database with `sudo -u nextcloud psql`.\n\nAccess Redis with `sudo -u nextcloud redis-cli -s /run/redis-nextcloud/redis.sock`.\n\n## Options Reference {#services-nextcloudserver-options}\n\n```{=include=} options\nid-prefix: services-nextcloudserver-options-\nlist-id: selfhostblocks-service-nextcloud-options\nsource: @OPTIONS_JSON@\n```\n"
},
{
"path": "modules/services/nextcloud-server.nix",
"content": "{\n config,\n pkgs,\n lib,\n shb,\n ...\n}:\n\nlet\n cfg = config.shb.nextcloud;\n\n fqdn = \"${cfg.subdomain}.${cfg.domain}\";\n fqdnWithPort = if isNull cfg.port then fqdn else \"${fqdn}:${toString cfg.port}\";\n protocol = if !(isNull cfg.ssl) then \"https\" else \"http\";\n\n ssoFqdnWithPort =\n if isNull cfg.apps.sso.port then\n cfg.apps.sso.endpoint\n else\n \"${cfg.apps.sso.endpoint}:${toString cfg.apps.sso.port}\";\n\n nextcloudPkg = builtins.getAttr (\"nextcloud\" + builtins.toString cfg.version) pkgs;\n nextcloudApps =\n (builtins.getAttr (\"nextcloud\" + builtins.toString cfg.version + \"Packages\") pkgs).apps;\n\n occ = \"${config.services.nextcloud.occ}/bin/nextcloud-occ\";\nin\n{\n imports = [\n ../../lib/module.nix\n ../blocks/authelia.nix\n ../blocks/monitoring.nix\n\n (lib.mkRenamedOptionModule\n [ \"shb\" \"nextcloud\" \"adminUser\" ]\n [ \"shb\" \"nextcloud\" \"initialAdminUsername\" ]\n )\n ];\n\n options.shb.nextcloud = {\n enable = lib.mkEnableOption \"the SHB Nextcloud service\";\n\n enableDashboard = lib.mkEnableOption \"the Nextcloud SHB dashboard\" // {\n default = true;\n };\n\n subdomain = lib.mkOption {\n type = lib.types.str;\n description = ''\n Subdomain under which Nextcloud will be served.\n\n ```\n .[:]\n ```\n '';\n example = \"nextcloud\";\n };\n\n domain = lib.mkOption {\n description = ''\n Domain under which Nextcloud is served.\n\n ```\n .[:]\n ```\n '';\n type = lib.types.str;\n example = \"domain.com\";\n };\n\n port = lib.mkOption {\n description = ''\n Port under which Nextcloud will be served. If null is given, then the port is omitted.\n\n ```\n .[:]\n ```\n '';\n type = lib.types.nullOr lib.types.port;\n default = null;\n };\n\n ssl = lib.mkOption {\n description = \"Path to SSL files\";\n type = lib.types.nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n externalFqdn = lib.mkOption {\n description = \"External fqdn used to access Nextcloud. Defaults to .. This should only be set if you include the port when accessing Nextcloud.\";\n type = lib.types.nullOr lib.types.str;\n example = \"nextcloud.domain.com:8080\";\n default = null;\n };\n\n version = lib.mkOption {\n description = \"Nextcloud version to choose from.\";\n type = lib.types.enum [\n 32\n 33\n ];\n default = 32;\n };\n\n dataDir = lib.mkOption {\n description = \"Folder where Nextcloud will store all its data.\";\n type = lib.types.str;\n default = \"/var/lib/nextcloud\";\n };\n\n mountPointServices = lib.mkOption {\n description = \"If given, all the systemd services and timers will depend on the specified mount point systemd services.\";\n type = lib.types.listOf lib.types.str;\n default = [ ];\n example = lib.literalExpression ''[\"var.mount\"]'';\n };\n\n initialAdminUsername = lib.mkOption {\n type = lib.types.str;\n description = \"Initial username of the admin user. Once it is set, it cannot be changed!\";\n default = \"root\";\n };\n\n adminPass = lib.mkOption {\n description = \"Nextcloud admin password.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"nextcloud\";\n restartUnits = [ \"phpfpm-nextcloud.service\" ];\n };\n };\n };\n\n maxUploadSize = lib.mkOption {\n default = \"4G\";\n type = lib.types.str;\n description = ''\n The upload limit for files. This changes the relevant options\n in php.ini and nginx if enabled.\n '';\n };\n\n defaultPhoneRegion = lib.mkOption {\n type = lib.types.str;\n description = ''\n Two letters region defining default region.\n '';\n example = \"US\";\n };\n\n postgresSettings = lib.mkOption {\n type = lib.types.nullOr (lib.types.attrsOf lib.types.str);\n default = null;\n description = ''\n Settings for the PostgreSQL database.\n\n Go to https://pgtune.leopard.in.ua/ and copy the generated configuration here.\n '';\n example = lib.literalExpression ''\n {\n # From https://pgtune.leopard.in.ua/ with:\n\n # DB Version: 14\n # OS Type: linux\n # DB Type: dw\n # Total Memory (RAM): 7 GB\n # CPUs num: 4\n # Connections num: 100\n # Data Storage: ssd\n\n max_connections = \"100\";\n shared_buffers = \"1792MB\";\n effective_cache_size = \"5376MB\";\n maintenance_work_mem = \"896MB\";\n checkpoint_completion_target = \"0.9\";\n wal_buffers = \"16MB\";\n default_statistics_target = \"500\";\n random_page_cost = \"1.1\";\n effective_io_concurrency = \"200\";\n work_mem = \"4587kB\";\n huge_pages = \"off\";\n min_wal_size = \"4GB\";\n max_wal_size = \"16GB\";\n max_worker_processes = \"4\";\n max_parallel_workers_per_gather = \"2\";\n max_parallel_workers = \"4\";\n max_parallel_maintenance_workers = \"2\";\n }\n '';\n };\n\n phpFpmPoolSettings = lib.mkOption {\n type = lib.types.nullOr (lib.types.attrsOf lib.types.anything);\n description = \"Settings for PHPFPM.\";\n default = {\n \"pm\" = \"static\";\n \"pm.max_children\" = 5;\n \"pm.start_servers\" = 5;\n };\n example = lib.literalExpression ''\n {\n \"pm\" = \"dynamic\";\n \"pm.max_children\" = 50;\n \"pm.start_servers\" = 25;\n \"pm.min_spare_servers\" = 10;\n \"pm.max_spare_servers\" = 20;\n \"pm.max_spawn_rate\" = 50;\n \"pm.max_requests\" = 50;\n \"pm.process_idle_timeout\" = \"20s\";\n }\n '';\n };\n\n phpFpmPrometheusExporter = lib.mkOption {\n description = \"Settings for exporting\";\n default = { };\n\n type = lib.types.submodule {\n options = {\n enable = lib.mkOption {\n description = \"Enable export of php-fpm metrics to Prometheus.\";\n type = lib.types.bool;\n default = true;\n };\n\n port = lib.mkOption {\n description = \"Port on which the exporter will listen.\";\n type = lib.types.port;\n default = 8300;\n };\n };\n };\n };\n\n apps = lib.mkOption {\n description = ''\n Applications to enable in Nextcloud. Enabling an application here will also configure\n various services needed for this application.\n\n Enabled apps will automatically be installed, enabled and configured, so no need to do that\n through the UI. You can still make changes but they will be overridden on next deploy. You\n can still install and configure other apps through the UI.\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n onlyoffice = lib.mkOption {\n description = ''\n Only Office App. [Nextcloud App Store](https://apps.nextcloud.com/apps/onlyoffice)\n\n Enabling this app will also start an OnlyOffice instance accessible at the given\n subdomain from the given network range.\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"Nextcloud OnlyOffice App\";\n\n subdomain = lib.mkOption {\n type = lib.types.str;\n description = \"Subdomain under which Only Office will be served.\";\n default = \"oo\";\n };\n\n ssl = lib.mkOption {\n description = \"Path to SSL files\";\n type = lib.types.nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n localNetworkIPRange = lib.mkOption {\n type = lib.types.str;\n description = \"Local network range, to restrict access to Open Office to only those IPs.\";\n default = \"192.168.1.1/24\";\n };\n\n jwtSecretFile = lib.mkOption {\n type = lib.types.nullOr lib.types.path;\n description = ''\n File containing the JWT secret. This option is required.\n\n Must be readable by the nextcloud system user.\n '';\n default = null;\n };\n };\n };\n };\n\n previewgenerator = lib.mkOption {\n description = ''\n Preview Generator App. [Nextcloud App Store](https://apps.nextcloud.com/apps/previewgenerator)\n\n Enabling this app will create a cron job running every minute to generate thumbnails\n for new and updated files.\n\n To generate thumbnails for already existing files, run:\n\n ```\n nextcloud-occ -vvv preview:generate-all\n ```\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"Nextcloud Preview Generator App\";\n\n recommendedSettings = lib.mkOption {\n type = lib.types.bool;\n description = ''\n Better defaults than the defaults. Taken from [this article](http://web.archive.org/web/20200513043150/https://ownyourbits.com/2019/06/29/understanding-and-improving-nextcloud-previews/).\n\n Sets the following options:\n\n ```\n nextcloud-occ config:app:set previewgenerator squareSizes --value=\"32 256\"\n nextcloud-occ config:app:set previewgenerator widthSizes --value=\"256 384\"\n nextcloud-occ config:app:set previewgenerator heightSizes --value=\"256\"\n nextcloud-occ config:system:set preview_max_x --type integer --value 2048\n nextcloud-occ config:system:set preview_max_y --type integer --value 2048\n nextcloud-occ config:system:set jpeg_quality --value 60\n nextcloud-occ config:app:set preview jpeg_quality --value=60\n ```\n '';\n default = true;\n example = false;\n };\n\n debug = lib.mkOption {\n type = lib.types.bool;\n description = \"Enable more verbose logging.\";\n default = false;\n example = true;\n };\n };\n };\n };\n\n externalStorage = lib.mkOption {\n # TODO: would be nice to have quota include external storage but it's not supported for root:\n # https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_configuration.html#setting-storage-quotas\n description = ''\n External Storage App. [Manual](https://docs.nextcloud.com/server/28/go.php?to=admin-external-storage)\n\n Set `userLocalMount` to automatically add a local directory as an external storage.\n Use this option if you want to store user data in another folder or another hard drive\n altogether.\n\n In the `directory` option, you can use either `$user` and/or `$home` which will be\n replaced by the user's name and home directory.\n\n Recommended use of this option is to have the Nextcloud's `dataDir` on a SSD and the\n `userLocalRooDirectory` on a HDD. Indeed, a SSD is much quicker than a spinning hard\n drive, which is well suited for randomly accessing small files like thumbnails. On the\n other side, a spinning hard drive can store more data which is well suited for storing\n user data.\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"Nextcloud External Storage App\";\n userLocalMount = lib.mkOption {\n default = null;\n description = \"If set, adds a local mount as external storage.\";\n type = lib.types.nullOr (\n lib.types.submodule {\n options = {\n directory = lib.mkOption {\n type = lib.types.str;\n description = ''\n Local directory on the filesystem to mount. Use `$user` and/or `$home`\n which will be replaced by the user's name and home directory.\n '';\n example = \"/srv/nextcloud/$user\";\n };\n\n mountName = lib.mkOption {\n type = lib.types.str;\n description = ''\n Path of the mount in Nextcloud. Use `/` to mount as the root.\n '';\n default = \"\";\n example = [\n \"home\"\n \"/\"\n ];\n };\n };\n }\n );\n };\n };\n };\n };\n\n ldap = lib.mkOption {\n description = ''\n LDAP Integration App. [Manual](https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html)\n\n Enabling this app will create a new LDAP configuration or update one that exists with\n the given host.\n '';\n default = { };\n type = lib.types.nullOr (\n lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"LDAP app.\";\n\n host = lib.mkOption {\n type = lib.types.str;\n description = ''\n Host serving the LDAP server.\n '';\n default = \"127.0.0.1\";\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = ''\n Port of the service serving the LDAP server.\n '';\n default = 389;\n };\n\n dcdomain = lib.mkOption {\n type = lib.types.str;\n description = \"dc domain for ldap.\";\n example = \"dc=mydomain,dc=com\";\n };\n\n adminName = lib.mkOption {\n type = lib.types.str;\n description = \"Admin user of the LDAP server.\";\n default = \"admin\";\n };\n\n adminPassword = lib.mkOption {\n description = \"LDAP server admin password.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"nextcloud\";\n restartUnits = [ \"phpfpm-nextcloud.service\" ];\n };\n };\n };\n\n userGroup = lib.mkOption {\n type = lib.types.str;\n description = \"Group users must belong to to be able to login to Nextcloud.\";\n default = \"nextcloud_user\";\n };\n\n configID = lib.mkOption {\n type = lib.types.int;\n description = ''\n Multiple LDAP configs can co-exist with only one active at a time.\n This option sets the config ID used by Self Host Blocks.\n '';\n default = 50;\n };\n };\n }\n );\n };\n\n sso = lib.mkOption {\n description = ''\n SSO Integration App. [Manual](https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/oidc_auth.html)\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"SSO app.\";\n\n endpoint = lib.mkOption {\n type = lib.types.str;\n description = \"OIDC endpoint for SSO.\";\n example = \"https://authelia.example.com\";\n };\n\n port = lib.mkOption {\n description = \"If given, adds a port to the endpoint.\";\n type = lib.types.nullOr lib.types.port;\n default = null;\n };\n\n provider = lib.mkOption {\n type = lib.types.enum [ \"Authelia\" ];\n description = \"OIDC provider name, used for display.\";\n default = \"Authelia\";\n };\n\n clientID = lib.mkOption {\n type = lib.types.str;\n description = \"Client ID for the OIDC endpoint.\";\n default = \"nextcloud\";\n };\n\n authorization_policy = lib.mkOption {\n type = lib.types.enum [\n \"one_factor\"\n \"two_factor\"\n ];\n description = \"Require one factor (password) or two factor (device) authentication.\";\n default = \"one_factor\";\n };\n\n adminGroup = lib.mkOption {\n type = lib.types.str;\n description = ''\n Group admins must belong to to be able to login to Nextcloud.\n\n This option is purposely not inside the LDAP app because only SSO allows\n distinguising between users and admins.\n '';\n default = \"nextcloud_admin\";\n };\n\n secret = lib.mkOption {\n description = \"OIDC shared secret.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"nextcloud\";\n restartUnits = [ \"phpfpm-nextcloud.service\" ];\n };\n };\n };\n\n secretForAuthelia = lib.mkOption {\n description = \"OIDC shared secret. Content must be the same as `secretFile` option.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"authelia\";\n };\n };\n };\n\n fallbackDefaultAuth = lib.mkOption {\n type = lib.types.bool;\n description = ''\n Fallback to normal Nextcloud auth if something goes wrong with the SSO app.\n Usually, you want to enable this to transfer existing users to LDAP and then you\n can disabled it.\n '';\n default = false;\n };\n };\n };\n };\n\n memories = lib.mkOption {\n description = ''\n Memories App. [Nextcloud App Store](https://apps.nextcloud.com/apps/memories)\n\n Enabling this app will set up the Memories app and configure all its dependencies.\n\n On first install, you can either let the cron job index all images or you can run it manually with:\n\n ```nix\n nextcloud-occ memories:index\n ```\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"Memories app.\";\n\n vaapi = lib.mkOption {\n type = lib.types.bool;\n description = ''\n Enable VAAPI transcoding.\n\n Will make `nextcloud` user part of the `render` group to be able to access\n `/dev/dri/renderD128`.\n '';\n default = false;\n };\n\n photosPath = lib.mkOption {\n type = lib.types.str;\n description = ''\n Path where photos are stored in Nextcloud.\n '';\n default = \"/Photos\";\n };\n };\n };\n };\n\n recognize = lib.mkOption {\n description = ''\n Recognize App. [Nextcloud App Store](https://apps.nextcloud.com/apps/recognize)\n\n Enabling this app will set up the Recognize app and configure all its dependencies.\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"Recognize app.\";\n };\n };\n };\n };\n };\n };\n\n extraApps = lib.mkOption {\n type = lib.types.raw;\n description = ''\n Extra apps to install.\n\n Should be a function returning an `attrSet` of `appid` as keys to `packages` as values,\n like generated by `fetchNextcloudApp`.\n The appid must be identical to the `id` value in the apps'\n `appinfo/info.xml`.\n Search in [nixpkgs](https://github.com/NixOS/nixpkgs/tree/master/pkgs/servers/nextcloud/packages) for the `NN.json` files for existing apps.\n\n You can still install apps through the appstore.\n '';\n default = null;\n example = lib.literalExpression ''\n apps: {\n inherit (apps) mail calendar contact;\n phonetrack = pkgs.fetchNextcloudApp {\n name = \"phonetrack\";\n sha256 = \"0qf366vbahyl27p9mshfma1as4nvql6w75zy2zk5xwwbp343vsbc\";\n url = \"https://gitlab.com/eneiluj/phonetrack-oc/-/wikis/uploads/931aaaf8dca24bf31a7e169a83c17235/phonetrack-0.6.9.tar.gz\";\n version = \"0.6.9\";\n };\n }\n '';\n };\n\n backup = lib.mkOption {\n description = ''\n Backup configuration.\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.backup.mkRequester {\n user = \"nextcloud\";\n sourceDirectories = [\n cfg.dataDir\n ];\n excludePatterns = [ \".rnd\" ];\n };\n };\n };\n\n debug = lib.mkOption {\n type = lib.types.bool;\n description = \"Enable more verbose logging.\";\n default = false;\n example = true;\n };\n\n tracing = lib.mkOption {\n type = lib.types.nullOr lib.types.str;\n description = ''\n Enable xdebug tracing.\n\n To trigger writing a trace to `/var/log/xdebug`, add a the following header:\n\n ```\n XDEBUG_TRACE \n ```\n\n The response will contain the following header:\n\n ```\n x-xdebug-profile-filename /var/log/xdebug/cachegrind.out.63484\n ```\n '';\n default = null;\n example = \"debug_me\";\n };\n\n autoDisableMaintenanceModeOnStart = lib.mkOption {\n type = lib.types.bool;\n default = true;\n description = ''\n Upon starting the service, disable maintenance mode if set.\n\n This is useful if a deploy failed and you try to redeploy.\n\n Note that even if the disabling of maintenance mode fails,\n SHB will still allow the startup to continue\n because there are valid reasons for maintenance mode\n to not be able to be lifted, like for example this is a brand new installation.\n '';\n };\n\n alwaysApplyExpensiveMigrations = lib.mkOption {\n type = lib.types.bool;\n default = true;\n description = ''\n Run `occ maintenance:repair --include-expensive` on service start.\n\n Larger instances should disable this and run the command at a convenient time\n but SHB assumes that it will not be the case for most users.\n\n Note that SHB will still allow the startup\n even if the repair failed.\n '';\n };\n\n dashboard = lib.mkOption {\n description = ''\n Dashboard contract consumer\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.dashboard.mkRequester {\n externalUrl = \"https://${fqdn}\";\n externalUrlText = \"https://\\${config.shb.nextcloud.subdomain}.\\${config.shb.nextcloud.domain}\";\n internalUrl = \"https://${fqdn}\";\n internalUrlText = \"https://\\${config.shb.nextcloud.subdomain}.\\${config.shb.nextcloud.domain}\";\n };\n };\n };\n };\n\n config = lib.mkMerge [\n (lib.mkIf cfg.enable {\n users.users = {\n nextcloud = {\n name = \"nextcloud\";\n group = \"nextcloud\";\n isSystemUser = true;\n };\n };\n\n # LDAP is manually configured through\n # https://github.com/lldap/lldap/blob/main/example_configs/nextcloud.md, see also\n # https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html\n #\n # Verify setup with:\n # - On admin page\n # - https://scan.nextcloud.com/\n # - https://www.ssllabs.com/ssltest/\n # As of writing this, we got no warning on admin page and A+ on both tests.\n #\n # Content-Security-Policy is hard. I spent so much trying to fix lingering issues with .js files\n # not loading to realize those scripts are inserted by extensions. Doh.\n services.nextcloud = {\n enable = true;\n package = nextcloudPkg.overrideAttrs (old: {\n patches = [\n ../../patches/nextcloudexternalstorage.patch\n ];\n });\n\n datadir = cfg.dataDir;\n\n hostName = fqdn;\n nginx.hstsMaxAge = 31536000; # Needs > 1 year for https://hstspreload.org to be happy\n\n inherit (cfg) maxUploadSize;\n\n config = {\n dbtype = \"pgsql\";\n adminuser = cfg.initialAdminUsername;\n adminpassFile = cfg.adminPass.result.path;\n };\n database.createLocally = true;\n\n # Enable caching using redis https://nixos.wiki/wiki/Nextcloud#Caching.\n configureRedis = true;\n caching.apcu = false;\n # https://docs.nextcloud.com/server/26/admin_manual/configuration_server/caching_configuration.html\n caching.redis = true;\n\n # Adds appropriate nginx rewrite rules.\n webfinger = true;\n\n # Very important for a bunch of scripts to load correctly. Otherwise you get Content-Security-Policy errors. See https://docs.nextcloud.com/server/13/admin_manual/configuration_server/harden_server.html#enable-http-strict-transport-security\n https = !(isNull cfg.ssl);\n\n extraApps = if isNull cfg.extraApps then { } else cfg.extraApps nextcloudApps;\n extraAppsEnable = true;\n appstoreEnable = true;\n\n settings =\n let\n protocol = if !(isNull cfg.ssl) then \"https\" else \"http\";\n in\n {\n \"default_phone_region\" = cfg.defaultPhoneRegion;\n\n \"overwrite.cli.url\" = \"${protocol}://${fqdn}\";\n \"overwritehost\" = fqdnWithPort;\n # 'trusted_domains' needed otherwise we get this issue https://help.nextcloud.com/t/the-polling-url-does-not-start-with-https-despite-the-login-url-started-with-https/137576/2\n # TODO: could instead set extraTrustedDomains\n \"trusted_domains\" = [ fqdn ];\n \"trusted_proxies\" = [ \"127.0.0.1\" ];\n # TODO: could instead set overwriteProtocol\n \"overwriteprotocol\" = protocol; # Needed if behind a reverse_proxy\n \"overwritecondaddr\" = \"\"; # We need to set it to empty otherwise overwriteprotocol does not work.\n \"debug\" = cfg.debug;\n \"loglevel\" = if !cfg.debug then 2 else 0;\n \"filelocking.debug\" = cfg.debug;\n\n # Use persistent SQL connections.\n \"dbpersistent\" = \"true\";\n\n # https://help.nextcloud.com/t/very-slow-sync-for-small-files/11064/13\n \"chunkSize\" = \"5120MB\";\n };\n\n phpOptions = {\n # The OPcache interned strings buffer is nearly full with 8, bump to 16.\n catch_workers_output = \"yes\";\n display_errors = \"stderr\";\n error_reporting = \"E_ALL & ~E_DEPRECATED & ~E_STRICT\";\n expose_php = \"Off\";\n \"opcache.enable_cli\" = \"1\";\n \"opcache.fast_shutdown\" = \"1\";\n \"opcache.interned_strings_buffer\" = \"16\";\n \"opcache.max_accelerated_files\" = \"10000\";\n \"opcache.memory_consumption\" = \"128\";\n \"opcache.revalidate_freq\" = \"1\";\n short_open_tag = \"Off\";\n\n # https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/big_file_upload_configuration.html#configuring-php\n # > Output Buffering must be turned off [...] or PHP will return memory-related errors.\n output_buffering = \"Off\";\n\n # Needed to avoid corruption per https://docs.nextcloud.com/server/21/admin_manual/configuration_server/caching_configuration.html#id2\n \"redis.session.locking_enabled\" = \"1\";\n \"redis.session.lock_retries\" = \"-1\";\n \"redis.session.lock_wait_time\" = \"10000\";\n }\n // lib.optionalAttrs (!(isNull cfg.tracing)) {\n # \"xdebug.remote_enable\" = \"on\";\n # \"xdebug.remote_host\" = \"127.0.0.1\";\n # \"xdebug.remote_port\" = \"9000\";\n # \"xdebug.remote_handler\" = \"dbgp\";\n \"xdebug.trigger_value\" = cfg.tracing;\n\n \"xdebug.mode\" = \"profile,trace\";\n \"xdebug.output_dir\" = \"/var/log/xdebug\";\n \"xdebug.start_with_request\" = \"trigger\";\n };\n\n poolSettings = lib.mkIf (!(isNull cfg.phpFpmPoolSettings)) cfg.phpFpmPoolSettings;\n\n phpExtraExtensions = all: [ all.xdebug ];\n };\n\n services.nginx.virtualHosts.${fqdn} = {\n # listen = [ { addr = \"0.0.0.0\"; port = 443; } ];\n forceSSL = !(isNull cfg.ssl);\n sslCertificate = lib.mkIf (!(isNull cfg.ssl)) cfg.ssl.paths.cert;\n sslCertificateKey = lib.mkIf (!(isNull cfg.ssl)) cfg.ssl.paths.key;\n\n # From [1] this should fix downloading of big files. [2] seems to indicate that buffering\n # happens at multiple places anyway, so disabling one place should be okay.\n # [1]: https://help.nextcloud.com/t/download-aborts-after-time-or-large-file/25044/6\n # [2]: https://stackoverflow.com/a/50891625/1013628\n extraConfig = ''\n proxy_buffering off;\n '';\n };\n\n environment.systemPackages = [\n # Needed for a few apps. Would be nice to avoid having to put that in the environment and instead override https://github.com/NixOS/nixpkgs/blob/261abe8a44a7e8392598d038d2e01f7b33cf26d0/nixos/modules/services/web-apps/nextcloud.nix#L1035\n pkgs.ffmpeg-headless\n ];\n\n services.postgresql.settings = lib.mkIf (!(isNull cfg.postgresSettings)) cfg.postgresSettings;\n\n systemd.services.phpfpm-nextcloud.preStart = ''\n mkdir -p /var/log/xdebug; chown -R nextcloud: /var/log/xdebug\n '';\n systemd.services.phpfpm-nextcloud.requires = cfg.mountPointServices;\n systemd.services.phpfpm-nextcloud.after = cfg.mountPointServices;\n\n systemd.timers.nextcloud-cron.requires = cfg.mountPointServices;\n systemd.timers.nextcloud-cron.after = cfg.mountPointServices;\n # This is needed to be able to run the cron job before opening the app for the first time.\n # Otherwise the cron job fails while searching for this directory.\n systemd.services.nextcloud-setup.script = ''\n mkdir -p ${cfg.dataDir}/data/appdata_$(${occ} config:system:get instanceid)/theming/global\n '';\n\n systemd.services.nextcloud-setup.requires = cfg.mountPointServices;\n systemd.services.nextcloud-setup.after = cfg.mountPointServices;\n })\n\n (lib.mkIf (cfg.enable && cfg.phpFpmPrometheusExporter.enable) {\n services.prometheus.exporters.php-fpm = {\n enable = true;\n user = \"nginx\";\n port = cfg.phpFpmPrometheusExporter.port;\n listenAddress = \"127.0.0.1\";\n extraFlags = [\n \"--phpfpm.scrape-uri=tcp://127.0.0.1:${\n toString (cfg.phpFpmPrometheusExporter.port - 1)\n }/status?full\"\n ];\n };\n\n services.nextcloud = {\n poolSettings = {\n \"pm.status_path\" = \"/status\";\n # Need to use TCP connection to get status.\n # I couldn't get PHP-FPM exporter to work with a unix socket.\n #\n # I also tried to server the status page at /status.php\n # but fcgi doesn't like the returned headers.\n \"pm.status_listen\" = \"127.0.0.1:${toString (cfg.phpFpmPrometheusExporter.port - 1)}\";\n };\n };\n\n services.prometheus.scrapeConfigs = [\n {\n job_name = \"phpfpm-nextcloud\";\n static_configs = [\n {\n targets = [ \"127.0.0.1:${toString cfg.phpFpmPrometheusExporter.port}\" ];\n labels = {\n \"hostname\" = config.networking.hostName;\n \"domain\" = cfg.domain;\n };\n }\n ];\n }\n ];\n })\n\n (lib.mkIf (cfg.enable && cfg.apps.onlyoffice.enable) {\n assertions = [\n {\n assertion = !(isNull cfg.apps.onlyoffice.jwtSecretFile);\n message = \"Must set shb.nextcloud.apps.onlyoffice.jwtSecretFile.\";\n }\n ];\n\n services.nextcloud.extraApps = {\n inherit (nextcloudApps) onlyoffice;\n };\n\n services.onlyoffice = {\n enable = true;\n hostname = \"${cfg.apps.onlyoffice.subdomain}.${cfg.domain}\";\n port = 13444;\n\n postgresHost = \"/run/postgresql\";\n\n jwtSecretFile = cfg.apps.onlyoffice.jwtSecretFile;\n };\n\n services.nginx.virtualHosts.\"${cfg.apps.onlyoffice.subdomain}.${cfg.domain}\" = {\n forceSSL = !(isNull cfg.ssl);\n sslCertificate = lib.mkIf (!(isNull cfg.ssl)) cfg.ssl.paths.cert;\n sslCertificateKey = lib.mkIf (!(isNull cfg.ssl)) cfg.ssl.paths.key;\n\n locations.\"/\" = {\n extraConfig = ''\n allow ${cfg.apps.onlyoffice.localNetworkIPRange};\n '';\n };\n };\n })\n\n (lib.mkIf (cfg.enable && cfg.apps.previewgenerator.enable) {\n services.nextcloud.extraApps = {\n inherit (nextcloudApps) previewgenerator;\n };\n\n services.nextcloud.settings = {\n # List obtained from the admin panel of Memories app.\n enabledPreviewProviders = [\n \"OC\\\\Preview\\\\BMP\"\n \"OC\\\\Preview\\\\GIF\"\n \"OC\\\\Preview\\\\HEIC\"\n \"OC\\\\Preview\\\\Image\"\n \"OC\\\\Preview\\\\JPEG\"\n \"OC\\\\Preview\\\\Krita\"\n \"OC\\\\Preview\\\\MarkDown\"\n \"OC\\\\Preview\\\\Movie\"\n \"OC\\\\Preview\\\\MP3\"\n \"OC\\\\Preview\\\\OpenDocument\"\n \"OC\\\\Preview\\\\PNG\"\n \"OC\\\\Preview\\\\TXT\"\n \"OC\\\\Preview\\\\XBitmap\"\n ];\n\n };\n\n # Values taken from\n # http://web.archive.org/web/20200513043150/https://ownyourbits.com/2019/06/29/understanding-and-improving-nextcloud-previews/\n systemd.services.nextcloud-setup.script = lib.mkIf cfg.apps.previewgenerator.recommendedSettings ''\n ${occ} config:app:set previewgenerator squareSizes --value=\"32 256\"\n ${occ} config:app:set previewgenerator widthSizes --value=\"256 384\"\n ${occ} config:app:set previewgenerator heightSizes --value=\"256\"\n ${occ} config:system:set preview_max_x --type integer --value 2048\n ${occ} config:system:set preview_max_y --type integer --value 2048\n ${occ} config:system:set jpeg_quality --value 60\n ${occ} config:app:set preview jpeg_quality --value=60\n '';\n\n # Configured as defined in https://github.com/nextcloud/previewgenerator\n systemd.timers.nextcloud-cron-previewgenerator = {\n wantedBy = [ \"timers.target\" ];\n requires = cfg.mountPointServices;\n after = [ \"nextcloud-setup.service\" ] ++ cfg.mountPointServices;\n timerConfig.OnBootSec = \"10m\";\n timerConfig.OnUnitActiveSec = \"10m\";\n timerConfig.Unit = \"nextcloud-cron-previewgenerator.service\";\n };\n\n systemd.services.nextcloud-cron-previewgenerator = {\n environment.NEXTCLOUD_CONFIG_DIR = \"${config.services.nextcloud.datadir}/config\";\n serviceConfig.Type = \"oneshot\";\n serviceConfig.ExecStart =\n let\n debug = if cfg.debug or cfg.apps.previewgenerator.debug then \"-vvv\" else \"\";\n in\n \"${occ} ${debug} preview:pre-generate\";\n };\n })\n\n (lib.mkIf (cfg.enable && cfg.apps.externalStorage.enable) {\n systemd.services.nextcloud-setup.script = ''\n ${occ} app:install files_external || :\n ${occ} app:enable files_external\n ''\n + lib.optionalString (cfg.apps.externalStorage.userLocalMount != null) (\n let\n cfg' = cfg.apps.externalStorage.userLocalMount;\n jq = \"${pkgs.jq}/bin/jq\";\n in\n # sh\n ''\n exists=$(${occ} files_external:list --output=json | ${jq} 'any(.[]; .mount_point == \"${cfg'.mountName}\" and .configuration.datadir == \"${cfg'.directory}\")')\n if [[ \"$exists\" == \"false\" ]]; then\n ${occ} files_external:create \\\n '${cfg'.mountName}' \\\n local \\\n null::null \\\n --config datadir='${cfg'.directory}'\n fi\n ''\n );\n })\n\n (lib.mkIf (cfg.enable && cfg.apps.ldap.enable) {\n systemd.services.nextcloud-setup.path = [ pkgs.jq ];\n systemd.services.nextcloud-setup.script =\n let\n cfg' = cfg.apps.ldap;\n cID = \"s\" + toString cfg'.configID;\n in\n ''\n ${occ} app:install user_ldap || :\n ${occ} app:enable user_ldap\n\n ${occ} config:app:set user_ldap ${cID}ldap_configuration_active --value=0\n ${occ} config:app:set user_ldap configuration_prefixes --value '[\"${cID}\"]'\n\n # The following CLI commands follow\n # https://github.com/lldap/lldap/blob/main/example_configs/nextcloud.md#nextcloud-config--the-cli-way\n\n ${occ} ldap:set-config \"${cID}\" 'ldapHost' \\\n '${cfg'.host}'\n ${occ} ldap:set-config \"${cID}\" 'ldapPort' \\\n '${toString cfg'.port}'\n ${occ} ldap:set-config \"${cID}\" 'ldapAgentName' \\\n 'uid=${cfg'.adminName},ou=people,${cfg'.dcdomain}'\n ${occ} ldap:set-config \"${cID}\" 'ldapAgentPassword' \\\n \"$(cat ${cfg'.adminPassword.result.path})\"\n ${occ} ldap:set-config \"${cID}\" 'ldapBase' \\\n '${cfg'.dcdomain}'\n ${occ} ldap:set-config \"${cID}\" 'ldapBaseGroups' \\\n '${cfg'.dcdomain}'\n ${occ} ldap:set-config \"${cID}\" 'ldapBaseUsers' \\\n '${cfg'.dcdomain}'\n ${occ} ldap:set-config \"${cID}\" 'ldapEmailAttribute' \\\n 'mail'\n ${occ} ldap:set-config \"${cID}\" 'ldapGroupFilter' \\\n '(&(|(objectclass=groupOfUniqueNames))(|(cn=${cfg'.userGroup})))'\n ${occ} ldap:set-config \"${cID}\" 'ldapGroupFilterGroups' \\\n '${cfg'.userGroup}'\n ${occ} ldap:set-config \"${cID}\" 'ldapGroupFilterObjectclass' \\\n 'groupOfUniqueNames'\n ${occ} ldap:set-config \"${cID}\" 'ldapGroupMemberAssocAttr' \\\n 'uniqueMember'\n ${occ} ldap:set-config \"${cID}\" 'ldapLoginFilter' \\\n '(&(&(objectclass=person)(memberOf=cn=${cfg'.userGroup},ou=groups,${cfg'.dcdomain}))(|(uid=%uid)(|(mail=%uid)(objectclass=%uid))))'\n ${occ} ldap:set-config \"${cID}\" 'ldapLoginFilterAttributes' \\\n 'mail;objectclass'\n ${occ} ldap:set-config \"${cID}\" 'ldapUserDisplayName' \\\n 'givenname'\n ${occ} ldap:set-config \"${cID}\" 'ldapUserFilter' \\\n '(&(objectclass=person)(memberOf=cn=${cfg'.userGroup},ou=groups,${cfg'.dcdomain}))'\n ${occ} ldap:set-config \"${cID}\" 'ldapUserFilterMode' \\\n '1'\n ${occ} ldap:set-config \"${cID}\" 'ldapUserFilterObjectclass' \\\n 'person'\n # Makes the user_id used when creating a user through LDAP which means the ID used in\n # Nextcloud is compatible with the one returned by a (possibly added in the future) SSO\n # provider.\n ${occ} ldap:set-config \"${cID}\" 'ldapExpertUsernameAttr' \\\n 'uid'\n\n ${occ} ldap:test-config -- \"${cID}\"\n\n # Only one active at the same time\n\n ALL_CONFIG=\"$(${occ} ldap:show-config --output=json)\"\n for configid in $(echo \"$ALL_CONFIG\" | jq --raw-output \"keys[]\"); do\n echo \"Deactivating $configid\"\n ${occ} ldap:set-config \"$configid\" 'ldapConfigurationActive' \\\n '0'\n done\n\n ${occ} ldap:set-config \"${cID}\" 'ldapConfigurationActive' \\\n '1'\n '';\n })\n\n (\n let\n scopes = [\n \"openid\"\n \"profile\"\n \"email\"\n \"groups\"\n \"nextcloud_userinfo\"\n ];\n in\n lib.mkIf (cfg.enable && cfg.apps.sso.enable) {\n assertions = [\n {\n assertion = cfg.ssl != null;\n message = \"To integrate SSO, SSL must be enabled, set the shb.nextcloud.ssl option.\";\n }\n ];\n\n services.nextcloud.extraApps = {\n inherit (nextcloudApps) oidc_login;\n };\n\n systemd.services.nextcloud-setup-pre = {\n wantedBy = [ \"multi-user.target\" ];\n before = [ \"nextcloud-setup.service\" ];\n serviceConfig.Type = \"oneshot\";\n serviceConfig.User = \"nextcloud\";\n script = ''\n mkdir -p ${cfg.dataDir}/config\n cat < \"${cfg.dataDir}/config/secretFile\"\n {\n \"oidc_login_client_secret\": \"$(cat ${cfg.apps.sso.secret.result.path})\"\n }\n EOF\n '';\n };\n\n services.nextcloud = {\n secretFile = \"${cfg.dataDir}/config/secretFile\";\n\n # See all options at https://github.com/pulsejet/nextcloud-oidc-login\n # Other important url/links are:\n # ${fqdn}/.well-known/openid-configuration\n # https://www.authelia.com/reference/guides/attributes/#custom-attributes\n # https://github.com/lldap/lldap/blob/main/example_configs/nextcloud_oidc_authelia.md\n # https://www.authelia.com/integration/openid-connect/nextcloud/#authelia\n # https://www.openidconnect.net/\n settings = {\n allow_user_to_change_display_name = false;\n lost_password_link = \"disabled\";\n oidc_login_provider_url = ssoFqdnWithPort;\n oidc_login_client_id = cfg.apps.sso.clientID;\n\n # Automatically redirect the login page to the provider.\n oidc_login_auto_redirect = !cfg.apps.sso.fallbackDefaultAuth;\n # Authelia at least does not support this.\n oidc_login_end_session_redirect = false;\n # Redirect to this page after logging out the user\n oidc_login_logout_url = ssoFqdnWithPort;\n oidc_login_button_text = \"Log in with ${cfg.apps.sso.provider}\";\n oidc_login_hide_password_form = false;\n # Now, Authelia provides the info using the UserInfo request.\n oidc_login_use_id_token = false;\n oidc_login_attributes = {\n id = \"preferred_username\";\n name = \"name\";\n mail = \"email\";\n groups = \"groups\";\n is_admin = \"is_nextcloud_admin\";\n };\n oidc_login_allowed_groups = [\n cfg.apps.ldap.userGroup\n cfg.apps.sso.adminGroup\n ];\n oidc_login_default_group = \"oidc\";\n oidc_login_use_external_storage = false;\n oidc_login_scope = lib.concatStringsSep \" \" scopes;\n oidc_login_proxy_ldap = false;\n # Enable creation of users new to Nextcloud from OIDC login. A user may be known to the\n # IdP but not (yet) known to Nextcloud. This setting controls what to do in this case.\n # * 'true' (default): if the user authenticates to the IdP but is not known to Nextcloud,\n # then they will be returned to the login screen and not allowed entry;\n # * 'false': if the user authenticates but is not yet known to Nextcloud, then the user\n # will be automatically created; note that with this setting, you will be allowing (or\n # relying on) a third-party (the IdP) to create new users\n oidc_login_disable_registration = false;\n oidc_login_redir_fallback = cfg.apps.sso.fallbackDefaultAuth;\n # oidc_login_alt_login_page = \"assets/login.php\";\n oidc_login_tls_verify = true;\n # If you get your groups from the oidc_login_attributes, you might want to create them if\n # they are not already existing, Default is `false`. This creates groups for all groups\n # the user is associated with in LDAP. It's too much.\n oidc_create_groups = false;\n oidc_login_webdav_enabled = false;\n oidc_login_password_authentication = false;\n oidc_login_public_key_caching_time = 86400;\n oidc_login_min_time_between_jwks_requests = 10;\n oidc_login_well_known_caching_time = 86400;\n # If true, nextcloud will download user avatars on login. This may lead to security issues\n # as the server does not control which URLs will be requested. Use with care.\n oidc_login_update_avatar = false;\n oidc_login_code_challenge_method = \"S256\";\n };\n };\n\n shb.authelia.extraDefinitions = {\n user_attributes.\"is_nextcloud_admin\".expression =\n ''type(groups) == list && \"${cfg.apps.sso.adminGroup}\" in groups'';\n };\n shb.authelia.extraOidcClaimsPolicies.\"nextcloud_userinfo\" = {\n custom_claims = {\n is_nextcloud_admin = { };\n };\n };\n shb.authelia.extraOidcScopes.\"nextcloud_userinfo\" = {\n claims = [ \"is_nextcloud_admin\" ];\n };\n\n shb.authelia.oidcClients = lib.mkIf (cfg.apps.sso.provider == \"Authelia\") [\n {\n client_id = cfg.apps.sso.clientID;\n client_name = \"Nextcloud\";\n client_secret.source = cfg.apps.sso.secretForAuthelia.result.path;\n claims_policy = \"nextcloud_userinfo\";\n public = false;\n authorization_policy = cfg.apps.sso.authorization_policy;\n require_pkce = \"true\";\n pkce_challenge_method = \"S256\";\n redirect_uris = [ \"${protocol}://${fqdnWithPort}/apps/oidc_login/oidc\" ];\n inherit scopes;\n response_types = [ \"code\" ];\n grant_types = [ \"authorization_code\" ];\n access_token_signed_response_alg = \"none\";\n userinfo_signed_response_alg = \"none\";\n token_endpoint_auth_method = \"client_secret_basic\";\n }\n ];\n }\n )\n\n (lib.mkIf (cfg.enable && cfg.autoDisableMaintenanceModeOnStart) {\n systemd.services.nextcloud-setup.preStart = lib.mkBefore ''\n if [[ -e /var/lib/nextcloud/config/config.php ]]; then\n ${occ} maintenance:mode --no-interaction --quiet --off || true\n fi\n '';\n })\n\n (lib.mkIf (cfg.enable && cfg.alwaysApplyExpensiveMigrations) {\n systemd.services.nextcloud-setup.script = ''\n if [[ -e /var/lib/nextcloud/config/config.php ]]; then\n ${occ} maintenance:repair --include-expensive || true\n fi\n '';\n })\n\n # Great source of inspiration:\n # https://github.com/Shawn8901/nix-configuration/blob/538c18d9ecbf7c7e649b1540c0d40881bada6690/modules/nixos/private/nextcloud/memories.nix#L226\n (lib.mkIf cfg.apps.memories.enable (\n let\n cfg' = cfg.apps.memories;\n\n exiftool = pkgs.exiftool.overrideAttrs (\n f: p: {\n version = \"12.70\";\n src = pkgs.fetchurl {\n url = \"https://exiftool.org/Image-ExifTool-12.70.tar.gz\";\n hash = \"sha256-TLJSJEXMPj870TkExq6uraX8Wl4kmNerrSlX3LQsr/4=\";\n };\n }\n );\n in\n {\n assertions = [\n {\n assertion = true;\n message = \"Memories app has an issue for now, see https://github.com/ibizaman/selfhostblocks/issues/476.\";\n }\n ];\n\n services.nextcloud.extraApps = {\n inherit (nextcloudApps) memories;\n };\n\n systemd.services.nextcloud-cron = {\n # required for memories\n # see https://github.com/pulsejet/memories/blob/master/docs/troubleshooting.md#issues-with-nixos\n path = [ pkgs.perl ];\n };\n\n services.nextcloud = {\n # See all options at https://memories.gallery/system-config/\n settings = {\n \"memories.exiftool\" = \"${exiftool}/bin/exiftool\";\n \"memories.exiftool_no_local\" = false;\n \"memories.index.mode\" = \"3\";\n \"memories.index.path\" = cfg'.photosPath;\n \"memories.timeline.default_path\" = cfg'.photosPath;\n\n \"memories.vod.disable\" = !cfg'.vaapi;\n \"memories.vod.vaapi\" = cfg'.vaapi;\n \"memories.vod.ffmpeg\" = \"${pkgs.ffmpeg-headless}/bin/ffmpeg\";\n \"memories.vod.ffprobe\" = \"${pkgs.ffmpeg-headless}/bin/ffprobe\";\n \"memories.vod.use_transpose\" = true;\n \"memories.vod.use_transpose.force_sw\" = cfg'.vaapi; # AMD and old Intel can't use hardware here.\n\n \"memories.db.triggers.fcu\" = true;\n \"memories.readonly\" = true;\n \"preview_ffmpeg_path\" = \"${pkgs.ffmpeg-headless}/bin/ffmpeg\";\n };\n };\n\n systemd.services.phpfpm-nextcloud.serviceConfig = lib.mkIf cfg'.vaapi {\n DeviceAllow = [ \"/dev/dri/renderD128 rwm\" ];\n PrivateDevices = lib.mkForce false;\n };\n }\n ))\n\n (lib.mkIf cfg.apps.recognize.enable (\n let\n cfg' = cfg.apps.recognize;\n in\n {\n services.nextcloud.extraApps = {\n inherit (nextcloudApps) recognize;\n };\n\n systemd.services.nextcloud-setup.script = ''\n ${occ} config:app:set recognize nice_binary --value ${pkgs.coreutils}/bin/nice\n ${occ} config:app:set recognize node_binary --value ${pkgs.nodejs}/bin/node\n ${occ} config:app:set recognize faces.enabled --value true\n ${occ} config:app:set recognize faces.batchSize --value 50\n ${occ} config:app:set recognize imagenet.enabled --value true\n ${occ} config:app:set recognize imagenet.batchSize --value 100\n ${occ} config:app:set recognize landmarks.batchSize --value 100\n ${occ} config:app:set recognize landmarks.enabled --value true\n ${occ} config:app:set recognize tensorflow.cores --value 1\n ${occ} config:app:set recognize tensorflow.gpu --value false\n ${occ} config:app:set recognize tensorflow.purejs --value false\n ${occ} config:app:set recognize musicnn.enabled --value true\n ${occ} config:app:set recognize musicnn.batchSize --value 100\n '';\n }\n ))\n\n (lib.mkIf (cfg.enable && cfg.enableDashboard) {\n shb.monitoring.dashboards = [\n ./nextcloud-server/dashboard/Nextcloud.json\n ];\n })\n ];\n}\n"
},
{
"path": "modules/services/open-webui/docs/default.md",
"content": "# Open-WebUI Service {#services-open-webui}\n\nDefined in [`/modules/blocks/open-webui.nix`](@REPO@/modules/blocks/open-webui.nix),\nfound in the `selfhostblocks.nixosModules.open-webui` module.\nSee [the manual](usage.html#usage-flake) for how to import the module in your code.\n\nThis service sets up [Open WebUI][] which provides a frontend to various LLMs.\n\n[Open WebUI]: https://docs.openwebui.com/\n\n## Features {#services-open-webui-features}\n\n- Telemetry disabled.\n- Skip onboarding through custom patch.\n- Declarative [LDAP](#services-open-webui-options-shb.open-webui.ldap) Configuration.\n - Needed LDAP groups are created automatically.\n- Declarative [SSO](#services-open-webui-options-shb.open-webui.sso) Configuration.\n - When SSO is enabled, login with user and password is disabled.\n - Registration is enabled through SSO.\n - Correct error message for unauthorized user through custom patch.\n- Access through [subdomain](#services-open-webui-options-shb.open-webui.subdomain) using reverse proxy.\n- Access through [HTTPS](#services-open-webui-options-shb.open-webui.ssl) using reverse proxy.\n- [Backup](#services-open-webui-options-shb.open-webui.sso) through the [backup block](./blocks-backup.html).\n- Integration with the [dashboard contract](contracts-dashboard.html) for displaying user facing application in a dashboard. [Manual](#services-open-webui-usage-applicationdashboard)\n\n## Usage {#services-open-webui-usage}\n\n### Initial Configuration {#services-open-webui-usage-configuration}\n\nThe following snippet assumes a few blocks have been setup already:\n\n- the [secrets block](usage.html#usage-secrets) with SOPS,\n- the [`shb.ssl` block](blocks-ssl.html#usage),\n- the [`shb.lldap` block](blocks-lldap.html#blocks-lldap-global-setup).\n- the [`shb.authelia` block](blocks-authelia.html#blocks-sso-global-setup).\n\n```nix\n{\n shb.open-webui = {\n enable = true;\n domain = \"example.com\";\n subdomain = \"open-webui\";\n\n ssl = config.shb.certs.certs.letsencrypt.${domain};\n\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n\n sharedSecret.result = config.shb.sops.secret.oidcSecret.result;\n sharedSecretForAuthelia.result = config.shb.sops.secret.oidcAutheliaSecret.result;\n };\n };\n\n shb.sops.secret.\"open-webui/oidcSecret\".request = config.shb.open-webui.sso.sharedSecret.request;\n shb.sops.secret.\"open-webui/oidcAutheliaSecret\" = {\n request = config.shb.open-webui.sso.sharedSecretForAuthelia.request;\n settings.key = \"open-webui/oidcSecret\";\n };\n}\n```\n\nSecrets can be randomly generated with `nix run nixpkgs#openssl -- rand -hex 64`.\n\nThe [user](#services-open-webui-options-shb.open-webui.ldap.userGroup)\nand [admin](#services-open-webui-options-shb.open-webui.ldap.adminGroup)\nLDAP groups are created automatically.\n\n### Application Dashboard {#services-open-webui-usage-applicationdashboard}\n\nIntegration with the [dashboard contract](contracts-dashboard.html) is provided\nby the [dashboard option](#services-open-webui-options-shb.open-webui.dashboard).\n\nFor example using the [Homepage](services-homepage.html) service:\n\n```nix\n{\n shb.homepage.servicesGroups.Documents.services.OpenWebUI = {\n sortOrder = 1;\n dashboard.request = config.shb.home-assistant.dashboard.request;\n settings.icon = \"sh-open-webui\";\n };\n}\n```\n\nThe icon needs to be set manually otherwise it is not displayed correctly.\n\n## Integration with OLLAMA {#services-open-webui-ollama}\n\nAssuming ollama is enabled, it will be available on port `config.services.ollama.port`.\nThe following snippet sets up acceleration using an AMD (i)GPU and loads some models.\n\n```nix\n{\n services.ollama = {\n enable = true;\n\n # https://wiki.nixos.org/wiki/Ollama#AMD_GPU_with_open_source_driver\n acceleration = \"rocm\";\n\n # https://ollama.com/library\n loadModels = [\n \"deepseek-r1:1.5b\"\n \"llama3.2:3b\"\n \"llava:7b\"\n \"mxbai-embed-large:335m\"\n \"nomic-embed-text:v1.5\"\n ];\n };\n}\n```\n\nIntegrating with the ollama service is done with:\n\n```nix\n{\n shb.open-webui = {\n environment.OLLAMA_BASE_URL = \"http://127.0.0.1:${toString config.services.ollama.port}\";\n };\n}\n```\n\n## Backup {#services-open-webui-usage-backup}\n\nBacking up Open-Webui using the [Restic block](blocks-restic.html) is done like so:\n\n```nix\nshb.restic.instances.\"open-webui\" = {\n request = config.shb.open-webui.backup;\n settings = {\n enable = true;\n };\n};\n```\n\nThe name `\"open-webui\"` in the `instances` can be anything.\nThe `config.shb.open-webui.backup` option provides what directories to backup.\nYou can define any number of Restic instances to backup Open WebUI multiple times.\n\n## Options Reference {#services-open-webui-options}\n\n```{=include=} options\nid-prefix: services-open-webui-options-\nlist-id: selfhostblocks-services-open-webui-options\nsource: @OPTIONS_JSON@\n```\n"
},
{
"path": "modules/services/open-webui.nix",
"content": "{\n config,\n lib,\n pkgs,\n shb,\n ...\n}:\nlet\n cfg = config.shb.open-webui;\n\n roleClaim = \"openwebui_groups\";\n oauthScopes = [\n \"openid\"\n \"email\"\n \"profile\"\n \"groups\"\n \"${roleClaim}\"\n ];\nin\n{\n imports = [\n ../../lib/module.nix\n ../blocks/nginx.nix\n ];\n\n options.shb.open-webui = {\n enable = lib.mkEnableOption \"the Open-WebUI service\";\n\n subdomain = lib.mkOption {\n type = lib.types.str;\n description = \"Subdomain under which Open-WebUI will be served.\";\n default = \"open-webui\";\n };\n\n domain = lib.mkOption {\n type = lib.types.str;\n description = \"domain under which Open-WebUI will be served.\";\n example = \"mydomain.com\";\n };\n\n ssl = lib.mkOption {\n description = \"Path to SSL files\";\n type = lib.types.nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = \"Port Open-WebUI listens to incoming requests.\";\n default = 12444;\n };\n\n environment = lib.mkOption {\n type = lib.types.attrsOf lib.types.str;\n description = \"Extra environment variables. See https://docs.openwebui.com/getting-started/env-configuration\";\n default = { };\n example = ''\n {\n WEBUI_NAME = \"SelfHostBlocks\";\n\n OLLAMA_BASE_URL = \"http://127.0.0.1:''${toString config.services.ollama.port}\";\n RAG_EMBEDDING_MODEL = \"nomic-embed-text:v1.5\";\n\n ENABLE_OPENAI_API = \"True\";\n OPENAI_API_BASE_URL = \"http://127.0.0.1:''${toString config.services.llama-cpp.port}\";\n ENABLE_WEB_SEARCH = \"True\";\n RAG_EMBEDDING_ENGINE = \"openai\";\n }\n '';\n };\n\n ldap = lib.mkOption {\n description = ''\n Setup LDAP integration.\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n userGroup = lib.mkOption {\n type = lib.types.str;\n description = \"Group users must belong to to be able to login.\";\n default = \"open-webui_user\";\n };\n\n adminGroup = lib.mkOption {\n type = lib.types.str;\n description = \"Group users must belong to to have administrator privileges.\";\n default = \"open-webui_admin\";\n };\n };\n };\n };\n\n sso = lib.mkOption {\n description = ''\n Setup SSO integration.\n '';\n default = { };\n type = lib.types.submodule {\n options = {\n enable = lib.mkEnableOption \"SSO integration.\";\n\n authEndpoint = lib.mkOption {\n type = lib.types.str;\n description = \"Endpoint to the SSO provider.\";\n example = \"https://authelia.example.com\";\n };\n\n clientID = lib.mkOption {\n type = lib.types.str;\n description = \"Client ID for the OIDC endpoint.\";\n default = \"open-webui\";\n };\n\n authorization_policy = lib.mkOption {\n type = lib.types.enum [\n \"one_factor\"\n \"two_factor\"\n ];\n description = \"Require one factor (password) or two factor (device) authentication.\";\n default = \"one_factor\";\n };\n\n sharedSecret = lib.mkOption {\n description = \"OIDC shared secret for Open-WebUI.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n owner = \"open-webui\";\n restartUnits = [ \"open-webui.service\" ];\n };\n };\n };\n\n sharedSecretForAuthelia = lib.mkOption {\n description = \"OIDC shared secret for Authelia. Must be the same as `sharedSecret`\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n ownerText = \"config.shb.authelia.autheliaUser\";\n owner = config.shb.authelia.autheliaUser;\n };\n };\n };\n };\n };\n };\n\n backup = lib.mkOption {\n description = ''\n Backup state directory.\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.backup.mkRequester {\n user = \"open-webui\";\n sourceDirectories = [\n config.services.open-webui.stateDir\n ];\n sourceDirectoriesText = \"[ config.services.open-webui.stateDir ]\";\n };\n };\n };\n\n dashboard = lib.mkOption {\n description = ''\n Dashboard contract consumer\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.dashboard.mkRequester {\n externalUrl = \"https://${cfg.subdomain}.${cfg.domain}\";\n externalUrlText = \"https://\\${config.shb.open-webui.subdomain}.\\${config.shb.open-webui.domain}\";\n internalUrl = \"http://127.0.0.1:${toString cfg.port}\";\n };\n };\n };\n };\n\n config = (\n lib.mkMerge [\n (lib.mkIf cfg.enable {\n users.users.open-webui = {\n isSystemUser = true;\n group = \"open-webui\";\n };\n users.groups.open-webui = { };\n\n services.open-webui = {\n enable = true;\n\n host = \"127.0.0.1\";\n inherit (cfg) port;\n\n environment = {\n WEBUI_URL = \"https://${cfg.subdomain}.${cfg.domain}\";\n\n ENABLE_PERSISTENT_CONFIG = \"False\";\n\n ANONYMIZED_TELEMETRY = \"False\";\n DO_NOT_TRACK = \"True\";\n SCARF_NO_ANALYTICS = \"True\";\n\n ENABLE_VERSION_UPDATE_CHECK = \"False\";\n }\n // cfg.environment;\n };\n\n systemd.services.open-webui.path = [\n pkgs.ffmpeg-headless\n ];\n\n shb.nginx.vhosts = [\n {\n inherit (cfg) subdomain domain ssl;\n upstream = \"http://127.0.0.1:${toString cfg.port}/\";\n extraConfig = ''\n proxy_read_timeout 300s;\n proxy_send_timeout 300s;\n '';\n }\n ];\n })\n (lib.mkIf (cfg.enable && cfg.sso.enable) {\n shb.lldap.ensureGroups = {\n ${cfg.ldap.userGroup} = { };\n ${cfg.ldap.adminGroup} = { };\n };\n\n services.open-webui = {\n package = pkgs.open-webui.overrideAttrs (finalAttrs: {\n patches = [\n ../../patches/0001-selfhostblocks-never-onboard.patch\n ];\n });\n environment = {\n ENABLE_SIGNUP = \"False\";\n WEBUI_AUTH = \"True\";\n ENABLE_FORWARD_USER_INFO_HEADERS = \"True\";\n ENABLE_OAUTH_SIGNUP = \"True\";\n OAUTH_UPDATE_PICTURE_ON_LOGIN = \"True\";\n OAUTH_CLIENT_ID = cfg.sso.clientID;\n OPENID_PROVIDER_URL = \"${cfg.sso.authEndpoint}/.well-known/openid-configuration\";\n OAUTH_PROVIDER_NAME = \"Single Sign-On\";\n OAUTH_USERNAME_CLAIM = \"preferred_username\";\n ENABLE_OAUTH_ROLE_MANAGEMENT = \"True\";\n OAUTH_ALLOWED_ROLES = \"user,admin\";\n OAUTH_ADMIN_ROLES = \"admin\";\n OAUTH_ROLES_CLAIM = roleClaim;\n OAUTH_SCOPES = lib.concatStringsSep \" \" oauthScopes;\n };\n };\n\n shb.authelia.extraDefinitions = {\n user_attributes.${roleClaim}.expression =\n ''\"${cfg.ldap.adminGroup}\" in groups ? [\"admin\"] : (\"${cfg.ldap.userGroup}\" in groups ? [\"user\"] : [\"\"])'';\n };\n shb.authelia.extraOidcClaimsPolicies.${roleClaim} = {\n custom_claims = {\n \"${roleClaim}\" = { };\n };\n };\n shb.authelia.extraOidcScopes.\"${roleClaim}\" = {\n claims = [ \"${roleClaim}\" ];\n };\n\n shb.authelia.oidcClients = [\n {\n client_id = cfg.sso.clientID;\n client_name = \"Open WebUI\";\n client_secret.source = cfg.sso.sharedSecretForAuthelia.result.path;\n claims_policy = \"${roleClaim}\";\n public = false;\n authorization_policy = cfg.sso.authorization_policy;\n redirect_uris = [\n \"https://${cfg.subdomain}.${cfg.domain}/oauth/oidc/callback\"\n ];\n scopes = oauthScopes;\n }\n ];\n\n systemd.services.open-webui.serviceConfig.EnvironmentFile = \"/run/open-webui/secrets.env\";\n systemd.tmpfiles.rules = [\n \"d '/run/open-webui' 0750 root root - -\"\n ];\n systemd.services.open-webui-pre = {\n script = shb.replaceSecrets {\n userConfig = {\n OAUTH_CLIENT_SECRET.source = cfg.sso.sharedSecret.result.path;\n };\n resultPath = \"/run/open-webui/secrets.env\";\n generator = shb.toEnvVar;\n };\n serviceConfig.Type = \"oneshot\";\n wantedBy = [ \"multi-user.target\" ];\n before = [ \"open-webui.service\" ];\n requiredBy = [ \"open-webui.service\" ];\n };\n })\n ]\n );\n}\n"
},
{
"path": "modules/services/paperless.nix",
"content": "{\n config,\n pkgs,\n lib,\n shb,\n ...\n}:\n\nlet\n cfg = config.shb.paperless;\n dataFolder = cfg.dataDir;\n fqdn = \"${cfg.subdomain}.${cfg.domain}\";\n protocol = if !(isNull cfg.ssl) then \"https\" else \"http\";\n ssoFqdnWithPort =\n if isNull cfg.sso.port then cfg.sso.endpoint else \"${cfg.sso.endpoint}:${toString cfg.sso.port}\";\n\n ssoClientSettings = {\n openid_connect = {\n SCOPE = [\n \"openid\"\n \"profile\"\n \"email\"\n \"groups\"\n ];\n OAUTH_PKCE_ENABLED = true;\n APPS = [\n {\n provider_id = \"${cfg.sso.provider}\";\n name = \"${cfg.sso.provider}\";\n client_id = \"${cfg.sso.clientID}\";\n secret = \"%SECRET_CLIENT_SECRET_PLACEHOLDER%\";\n settings = {\n server_url = ssoFqdnWithPort;\n token_auth_method = \"client_secret_basic\";\n };\n }\n ];\n };\n };\n ssoClientSettingsFile = pkgs.writeText \"paperless-sso-client.env\" ''\n PAPERLESS_SOCIALACCOUNT_PROVIDERS=${builtins.toJSON ssoClientSettings}\n '';\n replacements = [\n {\n # Note: replaceSecretsScript prepends '%SECRET_' and appends '%'\n # when doing the replacement\n name = [ \"CLIENT_SECRET_PLACEHOLDER\" ];\n source = cfg.sso.sharedSecret.result.path;\n }\n ];\n replaceSecretsScript = shb.replaceSecretsScript {\n file = ssoClientSettingsFile;\n resultPath = \"/run/paperless/paperless-sso-client.env\";\n inherit replacements;\n user = \"paperless\";\n };\n inherit (lib)\n mkEnableOption\n mkIf\n lists\n mkOption\n ;\n inherit (lib.types)\n attrsOf\n bool\n enum\n listOf\n nullOr\n port\n submodule\n str\n path\n ;\n\nin\n{\n imports = [\n ../../lib/module.nix\n ../blocks/nginx.nix\n ];\n\n options.shb.paperless = {\n enable = mkEnableOption \"selfhostblocks.paperless\";\n\n subdomain = mkOption {\n type = str;\n description = ''\n Subdomain under which paperless will be served.\n\n ```\n .\n ```\n '';\n example = \"photos\";\n };\n\n domain = mkOption {\n description = ''\n Domain under which paperless is served.\n\n ```\n .\n ```\n '';\n type = str;\n example = \"example.com\";\n };\n\n port = mkOption {\n description = ''\n Port under which paperless will listen.\n '';\n type = port;\n default = 28981;\n };\n\n ssl = mkOption {\n description = \"Path to SSL files\";\n type = nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n dataDir = mkOption {\n description = \"Directory where paperless will store data files.\";\n type = str;\n default = \"/var/lib/paperless\";\n };\n\n mediaDir = mkOption {\n description = \"Directory where paperless will store documents.\";\n type = str;\n defaultText = lib.literalExpression ''\"''${dataDir}/media\"'';\n default = \"${cfg.dataDir}/media\";\n };\n\n consumptionDir = mkOption {\n description = \"Directory from which new documents are imported.\";\n type = str;\n defaultText = lib.literalExpression ''\"''${dataDir}/consume\"'';\n default = \"${cfg.dataDir}/consume\";\n };\n\n configureTika = lib.mkOption {\n type = lib.types.bool;\n default = false;\n description = ''\n Whether to configure Tika and Gotenberg to process Office and e-mail files with OCR.\n '';\n };\n\n adminPassword = mkOption {\n description = \"Secret containing the superuser (admin) password.\";\n type = submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"paperless\";\n group = \"paperless\";\n restartUnits = [ \"paperless-server.service\" ];\n };\n };\n };\n\n settings = lib.mkOption {\n type = lib.types.submodule {\n freeformType =\n with lib.types;\n attrsOf (\n let\n typeList = [\n bool\n float\n int\n str\n path\n package\n ];\n in\n oneOf (\n typeList\n ++ [\n (listOf (oneOf typeList))\n (attrsOf (oneOf typeList))\n ]\n )\n );\n };\n default = { };\n description = ''\n Extra paperless config options.\n\n See [the documentation](https://docs.paperless-ngx.com/configuration/) for available options.\n\n Note that some settings such as `PAPERLESS_CONSUMER_IGNORE_PATTERN` expect JSON values.\n Settings declared as lists or attrsets will automatically be serialised into JSON strings for your convenience.\n '';\n example = {\n PAPERLESS_OCR_LANGUAGE = \"deu+eng\";\n PAPERLESS_CONSUMER_IGNORE_PATTERN = [\n \".DS_STORE/*\"\n \"desktop.ini\"\n ];\n PAPERLESS_OCR_USER_ARGS = {\n optimize = 1;\n pdfa_image_compression = \"lossless\";\n };\n };\n };\n\n mount = mkOption {\n type = shb.contracts.mount;\n description = ''\n Mount configuration. This is an output option.\n\n Use it to initialize a block implementing the \"mount\" contract.\n For example, with a zfs dataset:\n\n ```\n shb.zfs.datasets.\"paperless\" = {\n poolName = \"root\";\n } // config.shb.paperless.mount;\n ```\n '';\n readOnly = true;\n default = {\n path = dataFolder;\n };\n };\n\n backup = mkOption {\n description = ''\n Backup configuration for paperless media files and database.\n '';\n default = { };\n type = submodule {\n options = shb.contracts.backup.mkRequester {\n user = \"paperless\";\n sourceDirectories = [\n dataFolder\n ];\n excludePatterns = [\n ];\n };\n };\n };\n\n sso = mkOption {\n description = ''\n Setup SSO integration.\n '';\n default = { };\n type = submodule {\n options = {\n enable = mkEnableOption \"SSO integration.\";\n\n provider = mkOption {\n type = enum [\n \"Authelia\"\n \"Keycloak\"\n \"Generic\"\n ];\n description = \"OIDC provider name, used for display.\";\n default = \"Authelia\";\n };\n\n endpoint = mkOption {\n type = str;\n description = \"OIDC endpoint for SSO.\";\n example = \"https://authelia.example.com\";\n };\n\n clientID = mkOption {\n type = str;\n description = \"Client ID for the OIDC endpoint.\";\n default = \"paperless\";\n };\n\n adminUserGroup = lib.mkOption {\n type = lib.types.str;\n description = \"OIDC admin group\";\n default = \"paperless_admin\";\n };\n\n userGroup = lib.mkOption {\n type = lib.types.str;\n description = \"OIDC user group\";\n default = \"paperless_user\";\n };\n\n port = mkOption {\n description = \"If given, adds a port to the endpoint.\";\n type = nullOr port;\n default = null;\n };\n\n autoRegister = mkOption {\n type = bool;\n description = \"Automatically register new users from SSO provider.\";\n default = true;\n };\n\n autoLaunch = mkOption {\n type = bool;\n description = \"Automatically redirect to SSO provider.\";\n default = true;\n };\n\n passwordLogin = mkOption {\n type = bool;\n description = \"Enable password login.\";\n default = true;\n };\n\n sharedSecret = mkOption {\n description = \"OIDC shared secret for paperless.\";\n type = submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"paperless\";\n group = \"paperless\";\n restartUnits = [ \"paperless-server.service\" ];\n };\n };\n };\n\n sharedSecretForAuthelia = mkOption {\n description = \"OIDC shared secret for Authelia. Content must be the same as `sharedSecret` option.\";\n type = submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"authelia\";\n };\n };\n default = null;\n };\n\n authorization_policy = mkOption {\n type = enum [\n \"one_factor\"\n \"two_factor\"\n ];\n description = \"Require one factor (password) or two factor (device) authentication.\";\n default = \"one_factor\";\n };\n };\n };\n };\n\n dashboard = lib.mkOption {\n description = ''\n Dashboard contract consumer\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.dashboard.mkRequester {\n externalUrl = \"https://${cfg.subdomain}.${cfg.domain}\";\n externalUrlText = \"https://\\${config.shb.paperless.subdomain}.\\${config.shb.paperless.domain}\";\n internalUrl = \"http://127.0.0.1:${toString cfg.port}\";\n };\n };\n };\n };\n\n config = mkIf cfg.enable {\n assertions = [\n {\n assertion = !(isNull cfg.ssl) -> !(isNull cfg.ssl.paths.cert) && !(isNull cfg.ssl.paths.key);\n message = \"SSL is enabled for paperless but no cert or key is provided.\";\n }\n {\n assertion = cfg.sso.enable -> cfg.ssl != null;\n message = \"To integrate SSO, SSL must be enabled, set the shb.paperless.ssl option.\";\n }\n ];\n\n # Configure paperless service\n services.paperless = {\n enable = true;\n address = \"127.0.0.1\";\n port = cfg.port;\n consumptionDirIsPublic = true;\n dataDir = cfg.dataDir;\n mediaDir = cfg.mediaDir;\n consumptionDir = cfg.consumptionDir;\n configureTika = cfg.configureTika;\n settings = {\n PAPERLESS_URL = \"${protocol}://${fqdn}\";\n }\n // cfg.settings\n // lib.optionalAttrs (cfg.sso.enable) {\n PAPERLESS_APPS = \"allauth.socialaccount.providers.openid_connect\";\n PAPERLESS_SOCIAL_AUTO_SIGNUP = cfg.sso.autoRegister;\n PAPERLESS_SOCIAL_ACCOUNT_SYNC_GROUPS = true;\n PAPERLESS_DISABLE_REGULAR_LOGIN = !cfg.sso.passwordLogin;\n };\n }\n // lib.optionalAttrs (cfg.sso.enable) {\n environmentFile = \"/run/paperless/paperless-sso-client.env\";\n };\n\n # Database defaults to local sqlite\n\n systemd.tmpfiles.rules = [\n \"d ${cfg.dataDir} 0700 paperless paperless\"\n \"d ${cfg.consumptionDir} 0700 paperless paperless\"\n \"d ${cfg.mediaDir} 0700 paperless paperless\"\n ]\n ++ lib.optionals cfg.sso.enable [ \"d '/run/paperless' 0750 root root - -\" ];\n\n systemd.services.paperless-pre = lib.mkIf cfg.sso.enable {\n script = replaceSecretsScript;\n serviceConfig.Type = \"oneshot\";\n wantedBy = [ \"multi-user.target\" ];\n before = [ \"paperless-scheduler.service\" ];\n requiredBy = [ \"paperless-scheduler.service\" ];\n };\n\n shb.nginx.vhosts = [\n {\n inherit (cfg) subdomain domain ssl;\n upstream = \"http://127.0.0.1:${toString cfg.port}\";\n autheliaRules = lib.mkIf (cfg.sso.enable) [\n {\n domain = fqdn;\n policy = cfg.sso.authorization_policy;\n subject = [\n \"group:paperless_user\"\n \"group:paperless_admin\"\n ];\n }\n ];\n authEndpoint = lib.mkIf (cfg.sso.enable) cfg.sso.endpoint;\n extraConfig = ''\n # See https://github.com/paperless-ngx/paperless-ngx/wiki/Using-a-Reverse-Proxy-with-Paperless-ngx#nginx\n proxy_redirect off;\n proxy_set_header X-Forwarded-Host $server_name;\n add_header Referrer-Policy \"strict-origin-when-cross-origin\";\n '';\n }\n ];\n\n # Allow large uploads\n services.nginx.virtualHosts.\"${fqdn}\".extraConfig = ''\n client_max_body_size 500M;\n '';\n\n shb.authelia.oidcClients = lists.optionals (cfg.sso.enable && cfg.sso.provider == \"Authelia\") [\n {\n client_id = cfg.sso.clientID;\n client_name = \"paperless\";\n client_secret.source = cfg.sso.sharedSecretForAuthelia.result.path;\n public = false;\n authorization_policy = cfg.sso.authorization_policy;\n token_endpoint_auth_method = \"client_secret_basic\";\n redirect_uris = [\n \"${protocol}://${fqdn}/accounts/oidc/${cfg.sso.provider}/login/callback/\"\n ];\n }\n ];\n };\n}\n"
},
{
"path": "modules/services/pinchflat/docs/default.md",
"content": "# Pinchflat Service {#services-pinchflat}\n\nDefined in [`/modules/services/pinchflat.nix`](@REPO@/modules/services/pinchflat.nix).\n\nThis NixOS module is a service that sets up a [Pinchflat](https://github.com/kieraneglin/pinchflat) instance.\n\nCompared to the stock module from nixpkgs,\nthis one sets up, in a fully declarative manner,\nLDAP and SSO integration\nand has a nicer option for secrets.\n\n## Features {#services-pinchflat-features}\n\n- Integration with the [dashboard contract](contracts-dashboard.html) for displaying user facing application in a dashboard. [Manual](#services-pinchflat-usage-applicationdashboard)\n\n## Usage {#services-pinchflat-usage}\n\n### Initial Configuration {#services-pinchflat-usage-configuration}\n\nThe following snippet assumes a few blocks have been setup already:\n\n- the [secrets block](usage.html#usage-secrets) with SOPS,\n- the [`shb.ssl` block](blocks-ssl.html#usage),\n- the [`shb.lldap` block](blocks-lldap.html#blocks-lldap-global-setup).\n- the [`shb.authelia` block](blocks-authelia.html#blocks-sso-global-setup).\n\n```nix\nshb.pinchflat = {\n enable = true;\n\n secretKeyBase.result = config.shb.sops.secret.\"pinchflat/secretKeyBase\".result;\n timeZone = \"Europe/Brussels\";\n mediaDir = \"/srv/pinchflat\";\n\n domain = \"example.com\";\n subdomain = \"pinchflat\";\n ssl = config.shb.certs.certs.letsencrypt.${domain};\n\n ldap = {\n enable = true;\n };\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n};\nshb.sops.secret.\"pinchflat/secretKeyBase\".request = config.shb.pinchflat.secretKeyBase.request;\n```\n\nSecrets can be randomly generated with `nix run nixpkgs#openssl -- rand -hex 64`.\n\nThe [user](#services-pinchflat-options-shb.pinchflat.ldap.userGroup)\nLDAP group is created automatically.\n\n### Backup {#services-pinchflat-usage-backup}\n\nBacking up Pinchflat using the [Restic block](blocks-restic.html) is done like so:\n\n```nix\nshb.restic.instances.\"pinchflat\" = {\n request = config.shb.pinchflat.backup;\n settings = {\n enable = true;\n };\n};\n```\n\nThe name `\"pinchflat\"` in the `instances` can be anything.\nThe `config.shb.pinchflat.backup` option provides what directories to backup.\nYou can define any number of Restic instances to backup Pinchflat multiple times.\n\n### Application Dashboard {#services-pinchflat-usage-applicationdashboard}\n\nIntegration with the [dashboard contract](contracts-dashboard.html) is provided\nby the [dashboard option](#services-pinchflat-options-shb.pinchflat.dashboard).\n\nFor example using the [Homepage](services-homepage.html) service:\n\n```nix\n{\n shb.homepage.servicesGroups.Media.services.Pinchflat = {\n sortOrder = 2;\n dashboard.request = config.shb.pinchflat.dashboard.request;\n };\n}\n```\n\n## Options Reference {#services-pinchflat-options}\n\n```{=include=} options\nid-prefix: services-pinchflat-options-\nlist-id: selfhostblocks-service-pinchflat-options\nsource: @OPTIONS_JSON@\n```\n"
},
{
"path": "modules/services/pinchflat.nix",
"content": "{\n config,\n lib,\n shb,\n ...\n}:\nlet\n cfg = config.shb.pinchflat;\n\n inherit (lib) types;\nin\n{\n imports = [\n ../../lib/module.nix\n ../blocks/nginx.nix\n ];\n\n options.shb.pinchflat = {\n enable = lib.mkEnableOption \"the Pinchflat service.\";\n\n subdomain = lib.mkOption {\n type = lib.types.str;\n description = \"Subdomain under which Pinchflat will be served.\";\n default = \"pinchflat\";\n };\n\n domain = lib.mkOption {\n type = lib.types.str;\n description = \"domain under which Pinchflat will be served.\";\n example = \"mydomain.com\";\n };\n\n ssl = lib.mkOption {\n description = \"Path to SSL files\";\n type = lib.types.nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = \"Port Pinchflat listens to incoming requests.\";\n default = 8945;\n };\n\n secretKeyBase = lib.mkOption {\n description = ''\n Used to sign/encrypt cookies and other secrets.\n\n Make sure the secret is at least 64 characters long.\n '';\n type = types.submodule {\n options = shb.contracts.secret.mkRequester {\n restartUnits = [ \"pinchflat.service\" ];\n };\n };\n };\n\n mediaDir = lib.mkOption {\n description = \"Path where videos are stored.\";\n type = lib.types.str;\n };\n\n timeZone = lib.mkOption {\n type = lib.types.oneOf [\n lib.types.str\n shb.secretFileType\n ];\n description = \"Timezone of this instance.\";\n example = \"America/Los_Angeles\";\n };\n\n ldap = lib.mkOption {\n description = ''\n Setup LDAP integration.\n '';\n default = { };\n type = types.submodule {\n options = {\n enable = lib.mkEnableOption \"LDAP integration.\" // {\n default = cfg.sso.enable;\n };\n\n userGroup = lib.mkOption {\n type = types.str;\n description = \"Group users must belong to be able to login.\";\n default = \"pinchflat_user\";\n };\n };\n };\n };\n\n sso = lib.mkOption {\n description = ''\n Setup SSO integration.\n '';\n default = { };\n type = types.submodule {\n options = {\n enable = lib.mkEnableOption \"SSO integration.\";\n\n authEndpoint = lib.mkOption {\n type = lib.types.str;\n description = \"Endpoint to the SSO provider.\";\n example = \"https://authelia.example.com\";\n };\n\n authorization_policy = lib.mkOption {\n type = types.enum [\n \"one_factor\"\n \"two_factor\"\n ];\n description = \"Require one factor (password) or two factor (device) authentication.\";\n default = \"one_factor\";\n };\n };\n };\n };\n\n backup = lib.mkOption {\n description = ''\n Backup media directory `shb.mediaDir`.\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.backup.mkRequester {\n user = \"pinchflat\";\n sourceDirectories = [\n cfg.mediaDir\n ];\n sourceDirectoriesText = \"[ config.shb.pinchflat.mediaDir ]\";\n };\n };\n };\n\n dashboard = lib.mkOption {\n description = ''\n Dashboard contract consumer\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.dashboard.mkRequester {\n externalUrl = \"https://${cfg.subdomain}.${cfg.domain}\";\n externalUrlText = \"https://\\${config.shb.pinchflat.subdomain}.\\${config.shb.pinchflat.domain}\";\n internalUrl = \"http://127.0.0.1:${toString cfg.port}\";\n };\n };\n };\n };\n\n config = lib.mkIf cfg.enable {\n systemd.tmpfiles.rules = [\n \"d '/run/pinchflat' 0750 root root - -\"\n ];\n\n # Pinchflat relies on the global value so for now this is the only way to pass the option in.\n time.timeZone = lib.mkDefault cfg.timeZone;\n services.pinchflat = {\n inherit (cfg) enable port mediaDir;\n secretsFile = \"/run/pinchflat/secrets.env\";\n extraConfig = {\n ENABLE_PROMETHEUS = true;\n # TZ = \"as\"; # I consider where you live to be sensible so it should be passed as a secret.\n };\n };\n\n # This should be using a contract instead of setting the option directly.\n shb.lldap = lib.mkIf config.shb.lldap.enable {\n ensureGroups = {\n ${cfg.ldap.userGroup} = { };\n };\n };\n\n systemd.services.pinchflat-pre = {\n script = shb.replaceSecrets {\n userConfig = {\n SECRET_KEY_BASE.source = cfg.secretKeyBase.result.path;\n # TZ = cfg.secretKeyBase.result.path; # Uncomment when PR is merged.\n };\n resultPath = \"/run/pinchflat/secrets.env\";\n generator = shb.toEnvVar;\n };\n serviceConfig.Type = \"oneshot\";\n wantedBy = [ \"multi-user.target\" ];\n before = [ \"pinchflat.service\" ];\n requiredBy = [ \"pinchflat.service\" ];\n };\n\n shb.nginx.vhosts = [\n (\n {\n inherit (cfg) subdomain domain ssl;\n\n upstream = \"http://127.0.0.1:${toString cfg.port}\";\n autheliaRules = lib.optionals (cfg.sso.enable) [\n {\n domain = \"${cfg.subdomain}.${cfg.domain}\";\n policy = cfg.sso.authorization_policy;\n subject = [ \"group:${cfg.ldap.userGroup}\" ];\n }\n ];\n }\n // lib.optionalAttrs cfg.sso.enable {\n inherit (cfg.sso) authEndpoint;\n }\n )\n ];\n\n services.prometheus.scrapeConfigs = [\n {\n job_name = \"pinchflat\";\n static_configs = [\n {\n targets = [ \"127.0.0.1:${toString cfg.port}\" ];\n labels = {\n \"hostname\" = config.networking.hostName;\n \"domain\" = cfg.domain;\n };\n }\n ];\n }\n ];\n };\n}\n"
},
{
"path": "modules/services/vaultwarden/docs/default.md",
"content": "# Vaultwarden Service {#services-vaultwarden}\n\nDefined in [`/modules/services/vaultwarden.nix`](@REPO@/modules/services/vaultwarden.nix).\n\nThis NixOS module is a service that sets up a [Vaultwarden Server](https://github.com/dani-garcia/vaultwarden).\n\n## Features {#services-vaultwarden-features}\n\n- Access through subdomain using reverse proxy.\n- Access through HTTPS using reverse proxy.\n- Automatic setup of Redis database for caching.\n- Backup of the data directory through the [backup contract](./contracts-backup.html).\n- [Integration Tests](@REPO@/test/services/vaultwarden.nix)\n - Tests /admin can only be accessed when authenticated with SSO.\n- Integration with the [dashboard contract](contracts-dashboard.html) for displaying user facing application in a dashboard.\n\n## Usage {#services-vaultwarden-usage}\n\n### Initial Configuration {#services-vaultwarden-usage-configuration}\n\nThe following snippet enables Vaultwarden and makes it available under the `vaultwarden.example.com` endpoint.\n\n```nix\nshb.vaultwarden = {\n enable = true;\n domain = \"example.com\";\n subdomain = \"vaultwarden\";\n\n port = 8222;\n\n databasePassword.result = config.shb.sops.secret.\"vaultwarden/db\".result;\n\n smtp = {\n host = \"smtp.eu.mailgun.org\";\n port = 587;\n username = \"postmaster@mg.${domain}\";\n from_address = \"authelia@${domain}\";\n passwordFile = config.sops.secrets.\"vaultwarden/smtp\".path;\n };\n};\n\nshb.sops.secret.\"vaultwarden/db\".request = config.shb.vaultwarden.databasePassword.request;\nshb.sops.secret.\"vaultwarden/smtp\".request = config.shb.vaultwarden.smtp.password.request;\n```\n\nThis assumes secrets are setup with SOPS\nas mentioned in [the secrets setup section](usage.html#usage-secrets) of the manual.\nSecrets can be randomly generated with `nix run nixpkgs#openssl -- rand -hex 64`.\n\nThe SMTP configuration is needed to invite users to Vaultwarden.\n\n### HTTPS {#services-vaultwarden-usage-https}\n\nIf the `shb.ssl` block is used (see [manual](blocks-ssl.html#usage) on how to set it up),\nthe instance will be reachable at `https://vaultwarden.example.com`.\n\nHere is an example with Let's Encrypt certificates, validated using the HTTP method:\n\n```nix\nshb.certs.certs.letsencrypt.\"example.com\" = {\n domain = \"example.com\";\n group = \"nginx\";\n reloadServices = [ \"nginx.service\" ];\n adminEmail = \"myemail@mydomain.com\";\n};\n```\n\nThen you can tell Vaultwarden to use those certificates.\n\n```nix\nshb.certs.certs.letsencrypt.\"example.com\".extraDomains = [ \"vaultwarden.example.com\" ];\n\nshb.forgejo = {\n ssl = config.shb.certs.certs.letsencrypt.\"example.com\";\n};\n```\n\n### SSO {#services-vaultwarden-usage-sso}\n\nTo protect the `/admin` endpoint and avoid needing a secret passphrase for it, we can use SSO.\n\nWe will use the [SSO block][] provided by Self Host Blocks.\nAssuming it [has been set already][SSO block setup], add the following configuration:\n\n[SSO block]: blocks-sso.html\n[SSO block setup]: blocks-sso.html#blocks-sso-global-setup\n\n```nix\nshb.vaultwarden.authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n```\n\nNow, go to the LDAP server at `https://ldap.example.com`,\ncreate the `vaultwarden_admin` group and add a user to that group.\nWhen that's done, go back to the Vaultwarden server at\n`https://vaultwarden.example.com/admin` and login with that user.\n\n### ZFS {#services-vaultwarden-zfs}\n\nIntegration with the ZFS block allows to automatically create the relevant datasets.\n\n```nix\nshb.zfs.datasets.\"vaultwarden\" = config.shb.vaultwarden.mount;\nshb.zfs.datasets.\"postgresql\".path = \"/var/lib/postgresql\";\n```\n\n### Backup {#services-vaultwarden-backup}\n\nBacking up Vaultwarden using the [Restic block](blocks-restic.html) is done like so:\n\n```nix\nshb.restic.instances.\"vaultwarden\" = {\n request = config.shb.vaultwarden.backup;\n settings = {\n enable = true;\n };\n};\n```\n\nThe name `\"vaultwarden\"` in the `instances` can be anything.\nThe `config.shb.vaultwarden.backup` option provides what directories to backup.\nYou can define any number of Restic instances to backup Vaultwarden multiple times.\n\n### Application Dashboard {#services-vaultwarden-usage-applicationdashboard}\n\nIntegration with the [dashboard contract](contracts-dashboard.html) is provided\nby the [dashboard option](#services-vaultwarden-options-shb.vaultwarden.dashboard).\n\nFor example using the [Homepage](services-homepage.html) service:\n\n```nix\n{\n shb.homepage.servicesGroups.Documents.services.Vaultwarden = {\n sortOrder = 10;\n dashboard.request = config.shb.vaultwarden.dashboard.request;\n };\n}\n```\n\n## Maintenance {#services-vaultwarden-maintenance}\n\nNo command-line tool is provided to administer Vaultwarden.\n\nInstead, the admin section can be found at the `/admin` endpoint.\n\n## Debug {#services-vaultwarden-debug}\n\nIn case of an issue, check the logs of the `vaultwarden.service` systemd service.\n\nEnable verbose logging by setting the `shb.vaultwarden.debug` boolean to `true`.\n\nAccess the database with `sudo -u vaultwarden psql`.\n\n## Options Reference {#services-vaultwarden-options}\n\n```{=include=} options\nid-prefix: services-vaultwarden-options-\nlist-id: selfhostblocks-vaultwarden-options\nsource: @OPTIONS_JSON@\n```\n"
},
{
"path": "modules/services/vaultwarden.nix",
"content": "{\n config,\n lib,\n shb,\n ...\n}:\n\nlet\n cfg = config.shb.vaultwarden;\n\n fqdn = \"${cfg.subdomain}.${cfg.domain}\";\n\n dataFolder =\n if lib.versionOlder (config.system.stateVersion or \"24.11\") \"24.11\" then\n \"/var/lib/bitwarden_rs\"\n else\n \"/var/lib/vaultwarden\";\nin\n{\n imports = [\n ../../lib/module.nix\n ../blocks/nginx.nix\n ];\n\n options.shb.vaultwarden = {\n enable = lib.mkEnableOption \"selfhostblocks.vaultwarden\";\n\n subdomain = lib.mkOption {\n type = lib.types.str;\n description = \"Subdomain under which Authelia will be served.\";\n example = \"ha\";\n };\n\n domain = lib.mkOption {\n type = lib.types.str;\n description = \"domain under which Authelia will be served.\";\n example = \"mydomain.com\";\n };\n\n ssl = lib.mkOption {\n description = \"Path to SSL files\";\n type = lib.types.nullOr shb.contracts.ssl.certs;\n default = null;\n };\n\n port = lib.mkOption {\n type = lib.types.port;\n description = \"Port on which vaultwarden service listens.\";\n default = 8222;\n };\n\n authEndpoint = lib.mkOption {\n type = lib.types.nullOr lib.types.str;\n description = \"OIDC endpoint for SSO\";\n default = null;\n example = \"https://authelia.example.com\";\n };\n\n databasePassword = lib.mkOption {\n description = \"File containing the Vaultwarden database password.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0440\";\n owner = \"vaultwarden\";\n group = \"postgres\";\n restartUnits = [\n \"vaultwarden.service\"\n \"postgresql.service\"\n ];\n };\n };\n };\n\n smtp = lib.mkOption {\n description = \"SMTP options.\";\n default = null;\n type = lib.types.nullOr (\n lib.types.submodule {\n options = {\n from_address = lib.mkOption {\n type = lib.types.str;\n description = \"SMTP address from which the emails originate.\";\n example = \"vaultwarden@mydomain.com\";\n };\n from_name = lib.mkOption {\n type = lib.types.str;\n description = \"SMTP name from which the emails originate.\";\n default = \"Vaultwarden\";\n };\n host = lib.mkOption {\n type = lib.types.str;\n description = \"SMTP host to send the emails to.\";\n };\n security = lib.mkOption {\n type = lib.types.enum [\n \"starttls\"\n \"force_tls\"\n \"off\"\n ];\n description = \"Security expected by SMTP host.\";\n default = \"starttls\";\n };\n port = lib.mkOption {\n type = lib.types.port;\n description = \"SMTP port to send the emails to.\";\n default = 25;\n };\n username = lib.mkOption {\n type = lib.types.str;\n description = \"Username to connect to the SMTP host.\";\n };\n auth_mechanism = lib.mkOption {\n type = lib.types.enum [ \"Login\" ];\n description = \"Auth mechanism.\";\n default = \"Login\";\n };\n password = lib.mkOption {\n description = \"File containing the password to connect to the SMTP host.\";\n type = lib.types.submodule {\n options = shb.contracts.secret.mkRequester {\n mode = \"0400\";\n owner = \"vaultwarden\";\n restartUnits = [ \"vaultwarden.service\" ];\n };\n };\n };\n };\n }\n );\n };\n\n mount = lib.mkOption {\n type = shb.contracts.mount;\n description = ''\n Mount configuration. This is an output option.\n\n Use it to initialize a block implementing the \"mount\" contract.\n For example, with a zfs dataset:\n\n ```\n shb.zfs.datasets.\"vaultwarden\" = {\n poolName = \"root\";\n } // config.shb.vaultwarden.mount;\n ```\n '';\n readOnly = true;\n default = {\n path = dataFolder;\n };\n };\n\n backup = lib.mkOption {\n description = ''\n Backup configuration.\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.backup.mkRequester {\n user = \"vaultwarden\";\n sourceDirectories = [\n dataFolder\n ];\n };\n };\n };\n\n debug = lib.mkOption {\n type = lib.types.bool;\n description = \"Set to true to enable debug logging.\";\n default = false;\n example = true;\n };\n\n dashboard = lib.mkOption {\n description = ''\n Dashboard contract consumer\n '';\n default = { };\n type = lib.types.submodule {\n options = shb.contracts.dashboard.mkRequester {\n externalUrl = \"https://${cfg.subdomain}.${cfg.domain}\";\n externalUrlText = \"https://\\${config.shb.vaultwarden.subdomain}.\\${config.shb.vaultwarden.domain}\";\n internalUrl = \"http://127.0.0.1:${toString cfg.port}\";\n };\n };\n };\n };\n\n config = lib.mkIf cfg.enable {\n services.vaultwarden = {\n enable = true;\n dbBackend = \"postgresql\";\n config = {\n IP_HEADER = \"X-Real-IP\";\n SIGNUPS_ALLOWED = false;\n # Disabled because the /admin path is protected by SSO\n DISABLE_ADMIN_TOKEN = true;\n INVITATIONS_ALLOWED = true;\n DOMAIN = \"https://${fqdn}\";\n USE_SYSLOG = true;\n EXTENDED_LOGGING = cfg.debug;\n LOG_LEVEL = if cfg.debug then \"trace\" else \"info\";\n ROCKET_LOG = if cfg.debug then \"trace\" else \"info\";\n ROCKET_ADDRESS = \"127.0.0.1\";\n ROCKET_PORT = cfg.port;\n }\n // lib.optionalAttrs (cfg.smtp != null) {\n SMTP_FROM = cfg.smtp.from_address;\n SMTP_FROM_NAME = cfg.smtp.from_name;\n SMTP_HOST = cfg.smtp.host;\n SMTP_SECURITY = cfg.smtp.security;\n SMTP_USERNAME = cfg.smtp.username;\n SMTP_PORT = cfg.smtp.port;\n SMTP_AUTH_MECHANISM = cfg.smtp.auth_mechanism;\n };\n environmentFile = \"${dataFolder}/vaultwarden.env\";\n };\n # We create a blank environment file for the service to start. Then, ExecPreStart kicks in and\n # fills out the environment file for ExecStart to pick it up.\n systemd.tmpfiles.rules = [\n \"d ${dataFolder} 0750 vaultwarden vaultwarden\"\n \"f ${dataFolder}/vaultwarden.env 0640 vaultwarden vaultwarden\"\n ];\n # Needed to be able to write template config.\n systemd.services.vaultwarden.serviceConfig.ProtectHome = lib.mkForce false;\n systemd.services.vaultwarden.preStart = shb.replaceSecrets {\n userConfig = {\n DATABASE_URL.source = cfg.databasePassword.result.path;\n DATABASE_URL.transform = v: \"postgresql://vaultwarden:${v}@127.0.0.1:5432/vaultwarden\";\n }\n // lib.optionalAttrs (cfg.smtp != null) {\n SMTP_PASSWORD.source = cfg.smtp.password.result.path;\n };\n resultPath = \"${dataFolder}/vaultwarden.env\";\n generator = shb.toEnvVar;\n };\n\n shb.nginx.vhosts = [\n {\n inherit (cfg)\n subdomain\n domain\n authEndpoint\n ssl\n ;\n upstream = \"http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}\";\n autheliaRules = lib.mkIf (cfg.authEndpoint != null) [\n {\n domain = \"${fqdn}\";\n policy = \"two_factor\";\n subject = [ \"group:vaultwarden_admin\" ];\n resources = [\n \"^/admin\"\n ];\n }\n # There's no way to protect the webapp using Authelia this way, see\n # https://github.com/dani-garcia/vaultwarden/discussions/3188\n {\n domain = fqdn;\n policy = \"bypass\";\n }\n ];\n }\n ];\n\n shb.postgresql.enableTCPIP = true;\n shb.postgresql.ensures = [\n {\n username = \"vaultwarden\";\n database = \"vaultwarden\";\n passwordFile = cfg.databasePassword.result.path;\n }\n ];\n # TODO: make this work.\n # It does not work because it leads to infinite recursion.\n # ${cfg.mount}.path = dataFolder;\n };\n}\n"
},
{
"path": "patches/0001-nixos-borgbackup-add-option-to-override-state-direct.patch",
"content": "From dda895b551c7cf56476ac8892904e289a4d8b920 Mon Sep 17 00:00:00 2001\nFrom: ibizaman \nDate: Sat, 1 Nov 2025 13:49:20 +0100\nSubject: [PATCH] nixos/borgbackup: add option to override state directory\n\n---\n nixos/modules/services/backup/borgbackup.nix | 23 +++++++++++++++-----\n 1 file changed, 18 insertions(+), 5 deletions(-)\n\ndiff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix\nindex adabb2ce0f8b..82baeb928398 100644\n--- a/nixos/modules/services/backup/borgbackup.nix\n+++ b/nixos/modules/services/backup/borgbackup.nix\n@@ -136,7 +136,7 @@ let\n mkBackupService =\n name: cfg:\n let\n- userHome = config.users.users.${cfg.user}.home;\n+ userHome = if cfg.stateDir != null then cfg.stateDir else config.users.users.${cfg.user}.home;\n backupJobName = \"borgbackup-job-${name}\";\n backupScript = mkBackupScript backupJobName cfg;\n in\n@@ -177,6 +177,7 @@ let\n environment = {\n BORG_REPO = cfg.repo;\n }\n+ // (lib.optionalAttrs (cfg.stateDir != null) { BORG_BASE_DIR = cfg.stateDir; })\n // (mkPassEnv cfg)\n // cfg.environment;\n };\n@@ -223,6 +224,7 @@ let\n set = {\n BORG_REPO = cfg.repo;\n }\n+ // (lib.optionalAttrs (cfg.stateDir != null) { BORG_BASE_DIR = cfg.stateDir; })\n // (mkPassEnv cfg)\n // cfg.environment;\n });\n@@ -232,14 +234,15 @@ let\n name: cfg:\n let\n settings = { inherit (cfg) user group; };\n+ userHome = if cfg.stateDir != null then cfg.stateDir else config.users.users.${cfg.user}.home;\n in\n lib.nameValuePair \"borgbackup-job-${name}\" (\n {\n # Create parent dirs separately, to ensure correct ownership.\n- \"${config.users.users.\"${cfg.user}\".home}/.config\".d = settings;\n- \"${config.users.users.\"${cfg.user}\".home}/.cache\".d = settings;\n- \"${config.users.users.\"${cfg.user}\".home}/.config/borg\".d = settings;\n- \"${config.users.users.\"${cfg.user}\".home}/.cache/borg\".d = settings;\n+ \"${userHome}/.config\".d = settings;\n+ \"${userHome}/.cache\".d = settings;\n+ \"${userHome}/.config/borg\".d = settings;\n+ \"${userHome}/.cache/borg\".d = settings;\n }\n // lib.optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {\n \"${cfg.repo}\".d = settings;\n@@ -487,6 +490,16 @@ in\n default = \"root\";\n };\n \n+ stateDir = lib.mkOption {\n+ type = lib.types.nullOr lib.types.str;\n+ description = ''\n+ Override the directory in which {command}`borg` stores its\n+ configuration and cache. By default it uses the user's\n+ home directory but is some cases this can cause conflicts.\n+ '';\n+ default = null;\n+ };\n+\n wrapper = lib.mkOption {\n type = with lib.types; nullOr str;\n description = ''\n-- \n2.50.1\n\n"
},
{
"path": "patches/0001-selfhostblocks-never-onboard.patch",
"content": "From 6897dd86a41b336c7c03a466990f7e981c5c649c Mon Sep 17 00:00:00 2001\nFrom: ibizaman \nDate: Tue, 23 Sep 2025 11:36:24 +0200\nSubject: [PATCH] selfhostblocks: never onboard\n\n---\n backend/open_webui/main.py | 4 +---\n 1 file changed, 1 insertion(+), 3 deletions(-)\n\ndiff --git a/backend/open_webui/main.py b/backend/open_webui/main.py\nindex 5630a5883..5c7c88a64 100644\n--- a/backend/open_webui/main.py\n+++ b/backend/open_webui/main.py\n@@ -1654,11 +1654,9 @@ async def get_app_config(request: Request):\n user = Users.get_user_by_id(data[\"id\"])\n \n user_count = Users.get_num_users()\n+ # Never onboard\n onboarding = False\n \n- if user is None:\n- onboarding = user_count == 0\n-\n return {\n **({\"onboarding\": True} if onboarding else {}),\n \"status\": True,\n-- \n2.50.1\n\n"
},
{
"path": "patches/lldap.patch",
"content": "From e5a1bf4cb019933621eb059cc6cdd1f8af8df71d Mon Sep 17 00:00:00 2001\nFrom: ibizaman \nDate: Wed, 13 Aug 2025 08:14:38 +0200\nSubject: [PATCH 1/2] lldap-bootstrap: init 0.6.2\n\n---\n pkgs/by-name/ll/lldap-bootstrap/package.nix | 57 +++++++++++++++++++++\n 1 file changed, 57 insertions(+)\n create mode 100644 pkgs/by-name/ll/lldap-bootstrap/package.nix\n\ndiff --git a/pkgs/by-name/ll/lldap-bootstrap/package.nix b/pkgs/by-name/ll/lldap-bootstrap/package.nix\nnew file mode 100644\nindex 00000000000000..8b9a915b18f4d9\n--- /dev/null\n+++ b/pkgs/by-name/ll/lldap-bootstrap/package.nix\n@@ -0,0 +1,57 @@\n+{\n+ curl,\n+ fetchFromGitHub,\n+ jq,\n+ jo,\n+ lib,\n+ lldap,\n+ lldap-bootstrap,\n+ makeWrapper,\n+ stdenv,\n+}:\n+let\n+ version = \"0.6.2\";\n+in\n+stdenv.mkDerivation {\n+ pname = \"lldap-bootstrap\";\n+ inherit version;\n+\n+ src = fetchFromGitHub {\n+ owner = \"lldap\";\n+ repo = \"lldap\";\n+ rev = \"v${version}\";\n+ hash = \"sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=\";\n+ };\n+\n+ dontBuild = true;\n+\n+ nativeBuildInputs = [ makeWrapper ];\n+\n+ installPhase = ''\n+ mkdir -p $out/bin\n+ cp ./scripts/bootstrap.sh $out/bin/lldap-bootstrap\n+\n+ wrapProgram $out/bin/lldap-bootstrap \\\n+ --set LLDAP_SET_PASSWORD_PATH ${lldap}/bin/lldap_set_password \\\n+ --prefix PATH : ${\n+ lib.makeBinPath [\n+ curl\n+ jq\n+ jo\n+ ]\n+ }\n+ '';\n+\n+ meta = {\n+ description = \"Bootstrap script for LLDAP\";\n+ homepage = \"https://github.com/lldap/lldap\";\n+ changelog = \"https://github.com/lldap/lldap/blob/v${lldap-bootstrap.version}/CHANGELOG.md\";\n+ license = lib.licenses.gpl3Only;\n+ platforms = lib.platforms.linux;\n+ maintainers = with lib.maintainers; [\n+ bendlas\n+ ibizaman\n+ ];\n+ mainProgram = \"lldap-bootstrap\";\n+ };\n+}\n\n\nFrom 6666c710b77e53ea274af4c4dddcb9251b0ccf18 Mon Sep 17 00:00:00 2001\nFrom: ibizaman \nDate: Wed, 13 Aug 2025 08:15:12 +0200\nSubject: [PATCH 2/2] lldap: add ensure options\n\n---\n nixos/modules/services/databases/lldap.nix | 372 ++++++++++++++++++++-\n nixos/tests/lldap.nix | 143 +++++++-\n 2 files changed, 498 insertions(+), 17 deletions(-)\n\ndiff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix\nindex fe956c943281..6097f8d06216 100644\n--- a/nixos/modules/services/databases/lldap.nix\n+++ b/nixos/modules/services/databases/lldap.nix\n@@ -12,6 +12,84 @@ let\n dbUser = \"lldap\";\n localPostgresql = cfg.database.createLocally && cfg.database.type == \"postgresql\";\n localMysql = cfg.database.createLocally && cfg.database.type == \"mariadb\";\n+\n+ inherit (lib) mkOption types;\n+\n+ ensureFormat = pkgs.formats.json { };\n+ ensureGenerate =\n+ let\n+ filterNulls = lib.filterAttrsRecursive (n: v: v != null);\n+\n+ filteredSource =\n+ source: if builtins.isList source then map filterNulls source else filterNulls source;\n+ in\n+ name: source: ensureFormat.generate name (filteredSource source);\n+\n+ ensureFieldsOptions = name: {\n+ name = mkOption {\n+ type = types.str;\n+ description = \"Name of the field.\";\n+ default = name;\n+ };\n+\n+ attributeType = mkOption {\n+ type = types.enum [\n+ \"STRING\"\n+ \"INTEGER\"\n+ \"JPEG\"\n+ \"DATE_TIME\"\n+ ];\n+ description = \"Attribute type.\";\n+ };\n+\n+ isEditable = mkOption {\n+ type = types.bool;\n+ description = \"Is field editable.\";\n+ default = true;\n+ };\n+\n+ isList = mkOption {\n+ type = types.bool;\n+ description = \"Is field a list.\";\n+ default = false;\n+ };\n+\n+ isVisible = mkOption {\n+ type = types.bool;\n+ description = \"Is field visible in UI.\";\n+ default = true;\n+ };\n+ };\n+\n+ allUserGroups = lib.flatten (lib.mapAttrsToList (n: u: u.groups) cfg.ensureUsers);\n+ # The three hardcoded groups are always created when the service starts.\n+ allGroups = lib.mapAttrsToList (n: g: g.name) cfg.ensureGroups ++ [\n+ \"lldap_admin\"\n+ \"lldap_password_manager\"\n+ \"lldap_strict_readonly\"\n+ ];\n+ userGroupNotInEnsuredGroup = lib.sortOn lib.id (\n+ lib.unique (lib.subtractLists allGroups allUserGroups)\n+ );\n+ someUsersBelongToNonEnsuredGroup = (lib.lists.length userGroupNotInEnsuredGroup) > 0;\n+\n+ generateEnsureConfigDir =\n+ name: source:\n+ let\n+ genOne =\n+ name: sourceOne:\n+ pkgs.writeTextDir \"configs/${name}.json\" (\n+ builtins.readFile (ensureGenerate \"configs/${name}.json\" sourceOne)\n+ );\n+ in\n+ \"${\n+ pkgs.symlinkJoin {\n+ inherit name;\n+ paths = lib.mapAttrsToList genOne source;\n+ }\n+ }/configs\";\n+\n+ quoteVariable = x: \"\\\"${x}\\\"\";\n in\n {\n options.services.lldap = with lib; {\n@@ -19,6 +97,8 @@ in\n \n package = mkPackageOption pkgs \"lldap\" { };\n \n+ bootstrap-package = mkPackageOption pkgs \"lldap-bootstrap\" { };\n+\n environment = mkOption {\n type = with types; attrsOf str;\n default = { };\n@@ -203,6 +283,198 @@ in\n If that is okay for you and you want to silence the warning, set this option to `true`.\n '';\n };\n+\n+ ensureUsers = mkOption {\n+ description = ''\n+ Create the users defined here on service startup.\n+\n+ If `enforceEnsure` option is `true`, the groups\n+ users belong to must be present in the `ensureGroups` option.\n+\n+ Non-default options must be added to the `ensureGroupFields` option.\n+ '';\n+ default = { };\n+ type = types.attrsOf (\n+ types.submodule (\n+ { name, ... }:\n+ {\n+ freeformType = ensureFormat.type;\n+\n+ options = {\n+ id = mkOption {\n+ type = types.str;\n+ description = \"Username.\";\n+ default = name;\n+ };\n+\n+ email = mkOption {\n+ type = types.str;\n+ description = \"Email.\";\n+ };\n+\n+ password_file = mkOption {\n+ type = types.str;\n+ description = \"File containing the password.\";\n+ };\n+\n+ displayName = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"Display name.\";\n+ };\n+\n+ firstName = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"First name.\";\n+ };\n+\n+ lastName = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"Last name.\";\n+ };\n+\n+ avatar_file = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"Avatar file. Must be a valid path to jpeg file (ignored if avatar_url specified)\";\n+ };\n+\n+ avatar_url = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"Avatar url. must be a valid URL to jpeg file (ignored if gravatar_avatar specified)\";\n+ };\n+\n+ gravatar_avatar = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"Get avatar from Gravatar using the email.\";\n+ };\n+\n+ weser_avatar = mkOption {\n+ type = types.nullOr types.str;\n+ default = null;\n+ description = \"Convert avatar retrieved by gravatar or the URL.\";\n+ };\n+\n+ groups = mkOption {\n+ type = types.listOf types.str;\n+ default = [ ];\n+ description = \"Groups the user would be a member of (all the groups must be specified in group config files).\";\n+ };\n+ };\n+ }\n+ )\n+ );\n+ };\n+\n+ ensureGroups = mkOption {\n+ description = ''\n+ Create the groups defined here on service startup.\n+\n+ Non-default options must be added to the `ensureGroupFields` option.\n+ '';\n+ default = { };\n+ type = types.attrsOf (\n+ types.submodule (\n+ { name, ... }:\n+ {\n+ freeformType = ensureFormat.type;\n+\n+ options = {\n+ name = mkOption {\n+ type = types.str;\n+ description = \"Name of the group.\";\n+ default = name;\n+ };\n+ };\n+ }\n+ )\n+ );\n+ };\n+\n+ ensureUserFields = mkOption {\n+ description = \"Extra fields for users\";\n+ default = { };\n+ type = types.attrsOf (\n+ types.submodule (\n+ { name, ... }:\n+ {\n+ options = ensureFieldsOptions name;\n+ }\n+ )\n+ );\n+ };\n+\n+ ensureGroupFields = mkOption {\n+ description = \"Extra fields for groups\";\n+ default = { };\n+ type = types.attrsOf (\n+ types.submodule (\n+ { name, ... }:\n+ {\n+ options = ensureFieldsOptions name;\n+ }\n+ )\n+ );\n+ };\n+\n+ ensureAdminUsername = mkOption {\n+ type = types.str;\n+ default = \"admin\";\n+ description = ''\n+ Username of the default admin user with which to connect to the LLDAP service.\n+\n+ By default, it is `\"admin\"`.\n+ Extra admin users can be added using the `services.lldap.ensureUsers` option and adding them to the correct groups.\n+ '';\n+ };\n+\n+ ensureAdminPassword = mkOption {\n+ type = types.nullOr types.str;\n+ defaultText = \"config.services.lldap.settings.ldap_user_pass\";\n+ default = cfg.settings.ldap_user_pass or null;\n+ description = ''\n+ Password of an admin user with which to connect to the LLDAP service.\n+\n+ By default, it is the same as the password for the default admin user 'admin'.\n+ If using a password from another user, it must be managed manually.\n+\n+ Unsecure. Use `services.lldap.ensureAdminPasswordFile` option instead.\n+ '';\n+ };\n+\n+ ensureAdminPasswordFile = mkOption {\n+ type = types.nullOr types.str;\n+ defaultText = \"config.services.lldap.settings.ldap_user_pass_file\";\n+ default = cfg.settings.ldap_user_pass_file or null;\n+ description = ''\n+ Path to the file containing the password of an admin user with which to connect to the LLDAP service.\n+\n+ By default, it is the same as the password for the default admin user 'admin'.\n+ If using a password from another user, it must be managed manually.\n+ '';\n+ };\n+\n+ enforceUsers = mkOption {\n+ description = \"Delete users not managed declaratively.\";\n+ type = types.bool;\n+ default = false;\n+ };\n+\n+ enforceUserMemberships = mkOption {\n+ description = \"Remove users from groups they do not belong to declaratively.\";\n+ type = types.bool;\n+ default = false;\n+ };\n+\n+ enforceGroups = mkOption {\n+ description = \"Delete groups not managed declaratively.\";\n+ type = types.bool;\n+ default = false;\n+ };\n };\n \n config = lib.mkIf cfg.enable {\n@@ -219,25 +491,77 @@ in\n (cfg.settings.ldap_user_pass_file or null) == null || (cfg.settings.ldap_user_pass or null) == null;\n message = \"lldap: Both `ldap_user_pass` and `ldap_user_pass_file` settings should not be set at the same time. Set one to `null`.\";\n }\n+ {\n+ assertion =\n+ cfg.ensureUsers != { }\n+ || cfg.ensureGroups != { }\n+ || cfg.ensureUserFields != { }\n+ || cfg.ensureGroupFields != { }\n+ || cfg.enforceUsers\n+ || cfg.enforceUserMemberships\n+ || cfg.enforceGroups\n+ -> cfg.ensureAdminPassword != null || cfg.ensureAdminPasswordFile != null;\n+ message = ''\n+ lldap: Some ensure options are set but no admin user password is set.\n+ Add a default password to the `ldap_user_pass` or `ldap_user_pass_file` setting and set `force_ldap_user_pass_reset` to `true` to manage the admin user declaratively\n+ or create an admin user manually and set its password in `ensureAdminPasswordFile` option.\n+ '';\n+ }\n+ {\n+ assertion = cfg.enforceUserMemberships -> !someUsersBelongToNonEnsuredGroup;\n+ message = ''\n+ lldap: Some users belong to groups not present in the ensureGroups attr,\n+ add the following groups or remove them from the groups a user belong to:\n+ ${lib.concatMapStringsSep quoteVariable \", \" userGroupNotInEnsuredGroup}\n+ '';\n+ }\n+ (\n+ let\n+ getNames = source: lib.flatten (lib.mapAttrsToList (x: v: v.name) source);\n+ allNames = getNames cfg.ensureUserFields ++ getNames cfg.ensureGroupFields;\n+ validFieldName = name: lib.match \"[a-zA-Z0-9-]+\" name != null;\n+ in\n+ {\n+ assertion = lib.all validFieldName allNames;\n+ message = ''\n+ lldap: The following custom user or group fields have invalid names. Valid characters are: a-z, A-Z, 0-9, and dash (-).\n+ The offending fields are: ${\n+ lib.concatMapStringsSep quoteVariable \", \" (lib.filter (x: !(validFieldName x)) allNames)\n+ }\n+ '';\n+ }\n+ )\n ];\n \n warnings =\n- lib.optionals ((cfg.settings.ldap_user_pass or null) != null) [\n+ (lib.optionals (cfg.ensureAdminPassword != null) [\n+ ''\n+ lldap: Unsecure option `ensureAdminPassword` is used. Prefer `ensureAdminPasswordFile` instead.\n+ ''\n+ ])\n+ ++ (lib.optionals ((cfg.settings.ldap_user_pass or null) != null) [\n ''\n lldap: Unsecure `ldap_user_pass` setting is used. Prefer `ldap_user_pass_file` instead.\n ''\n- ]\n- ++\n- lib.optionals\n- (cfg.settings.force_ldap_user_pass_reset == false && cfg.silenceForceUserPassResetWarning == false)\n- [\n- ''\n- lldap: The `force_ldap_user_pass_reset` setting is set to `false` which means\n- the admin password can be changed through the UI and will drift from the one defined in your nix config.\n- It also means changing the setting `ldap_user_pass` or `ldap_user_pass_file` will have no effect on the admin password.\n- Either set `force_ldap_user_pass_reset` to `\"always\"` or silence this warning by setting the option `services.lldap.silenceForceUserPassResetWarning` to `true`.\n- ''\n- ];\n+ ])\n+ ++ (lib.optionals\n+ (cfg.settings.force_ldap_user_pass_reset == false && cfg.silenceForceUserPassResetWarning == false)\n+ [\n+ ''\n+ lldap: The `force_ldap_user_pass_reset` setting is set to `false` which means\n+ the admin password can be changed through the UI and will drift from the one defined in your nix config.\n+ It also means changing the setting `ldap_user_pass` or `ldap_user_pass_file` will have no effect on the admin password.\n+ Either set `force_ldap_user_pass_reset` to `\"always\"` or silence this warning by setting the option `services.lldap.silenceForceUserPassResetWarning` to `true`.\n+ ''\n+ ]\n+ )\n+ ++ (lib.optionals (!cfg.enforceUserMemberships && someUsersBelongToNonEnsuredGroup) [\n+ ''\n+ Some users belong to groups not managed by the configuration here,\n+ make sure the following groups exist or the service will not start properly:\n+ ${lib.concatStringsSep \", \" (map (x: \"\\\"${x}\\\"\") userGroupNotInEnsuredGroup)}\n+ ''\n+ ]);\n \n services.lldap.settings.database_url = lib.mkIf cfg.database.createLocally (\n lib.mkDefault (\n@@ -279,6 +603,28 @@ in\n + ''\n exec ${lib.getExe cfg.package} run --config-file ${format.generate \"lldap_config.toml\" cfg.settings}\n '';\n+ postStart = ''\n+ export LLDAP_URL=http://127.0.0.1:${toString cfg.settings.http_port}\n+ export LLDAP_ADMIN_USERNAME=${cfg.ensureAdminUsername}\n+ export LLDAP_ADMIN_PASSWORD=${\n+ if cfg.ensureAdminPassword != null then cfg.ensureAdminPassword else \"\"\n+ }\n+ export LLDAP_ADMIN_PASSWORD_FILE=${\n+ if cfg.ensureAdminPasswordFile != null then cfg.ensureAdminPasswordFile else \"\"\n+ }\n+ export USER_CONFIGS_DIR=${generateEnsureConfigDir \"users\" cfg.ensureUsers}\n+ export GROUP_CONFIGS_DIR=${generateEnsureConfigDir \"groups\" cfg.ensureGroups}\n+ export USER_SCHEMAS_DIR=${\n+ generateEnsureConfigDir \"userFields\" (lib.mapAttrs (n: v: [ v ]) cfg.ensureUserFields)\n+ }\n+ export GROUP_SCHEMAS_DIR=${\n+ generateEnsureConfigDir \"groupFields\" (lib.mapAttrs (n: v: [ v ]) cfg.ensureGroupFields)\n+ }\n+ export DO_CLEANUP_USERS=${if cfg.enforceUsers then \"true\" else \"false\"}\n+ export DO_CLEANUP_USER_MEMBERSHIPS=${if cfg.enforceUserMemberships then \"true\" else \"false\"}\n+ export DO_CLEANUP_GROUPS=${if cfg.enforceGroups then \"true\" else \"false\"}\n+ ${lib.getExe cfg.bootstrap-package}\n+ '';\n serviceConfig = {\n StateDirectory = \"lldap\";\n StateDirectoryMode = \"0750\";\ndiff --git a/nixos/tests/lldap.nix b/nixos/tests/lldap.nix\nindex 8e38d4bdefa3..47d32c7a2a7b 100644\n--- a/nixos/tests/lldap.nix\n+++ b/nixos/tests/lldap.nix\n@@ -1,6 +1,9 @@\n { ... }:\n let\n adminPassword = \"mySecretPassword\";\n+ alicePassword = \"AlicePassword\";\n+ bobPassword = \"BobPassword\";\n+ charliePassword = \"CharliePassword\";\n in\n {\n name = \"lldap\";\n@@ -26,7 +29,7 @@ in\n {\n services.lldap.settings = {\n ldap_user_pass = lib.mkForce null;\n- ldap_user_pass_file = lib.mkForce (toString (pkgs.writeText \"adminPasswordFile\" adminPassword));\n+ ldap_user_pass_file = toString (pkgs.writeText \"adminPasswordFile\" adminPassword);\n force_ldap_user_pass_reset = \"always\";\n };\n };\n@@ -40,13 +43,110 @@ in\n force_ldap_user_pass_reset = false;\n };\n };\n+\n+ withAlice.configuration =\n+ { ... }:\n+ {\n+ services.lldap = {\n+ enforceUsers = true;\n+ enforceUserMemberships = true;\n+ enforceGroups = true;\n+\n+ # This password was set in the \"differentAdminPassword\" specialisation.\n+ ensureAdminPasswordFile = toString (pkgs.writeText \"adminPasswordFile\" adminPassword);\n+\n+ ensureUsers = {\n+ alice = {\n+ email = \"alice@example.com\";\n+ password_file = toString (pkgs.writeText \"alicePasswordFile\" alicePassword);\n+ groups = [ \"mygroup\" ];\n+ };\n+ };\n+\n+ ensureGroups = {\n+ mygroup = { };\n+ };\n+ };\n+ };\n+\n+ withBob.configuration =\n+ { ... }:\n+ {\n+ services.lldap = {\n+ enforceUsers = true;\n+ enforceUserMemberships = true;\n+ enforceGroups = true;\n+\n+ # This time we check that ensureAdminPasswordFile correctly defaults to `settings.ldap_user_pass_file`\n+ settings = {\n+ ldap_user_pass = lib.mkForce \"password\";\n+ force_ldap_user_pass_reset = \"always\";\n+ };\n+\n+ ensureUsers = {\n+ bob = {\n+ email = \"bob@example.com\";\n+ password_file = toString (pkgs.writeText \"bobPasswordFile\" bobPassword);\n+ groups = [ \"bobgroup\" ];\n+ displayName = \"Bob\";\n+ };\n+ };\n+\n+ ensureGroups = {\n+ bobgroup = { };\n+ };\n+ };\n+ };\n+\n+ withAttributes.configuration =\n+ { ... }:\n+ {\n+ services.lldap = {\n+ enforceUsers = true;\n+ enforceUserMemberships = true;\n+ enforceGroups = true;\n+\n+ settings = {\n+ ldap_user_pass = lib.mkForce adminPassword;\n+ force_ldap_user_pass_reset = \"always\";\n+ };\n+\n+ ensureUsers = {\n+ charlie = {\n+ email = \"charlie@example.com\";\n+ password_file = toString (pkgs.writeText \"charliePasswordFile\" charliePassword);\n+ groups = [ \"othergroup\" ];\n+ displayName = \"Charlie\";\n+ myattribute = 2;\n+ };\n+ };\n+\n+ ensureGroups = {\n+ othergroup = {\n+ mygroupattribute = \"Managed by NixOS\";\n+ };\n+ };\n+\n+ ensureUserFields = {\n+ myattribute = {\n+ attributeType = \"INTEGER\";\n+ };\n+ };\n+\n+ ensureGroupFields = {\n+ mygroupattribute = {\n+ attributeType = \"STRING\";\n+ };\n+ };\n+ };\n+ };\n };\n };\n \n testScript =\n { nodes, ... }:\n let\n- specializations = \"${nodes.machine.system.build.toplevel}/specialisation\";\n+ specialisations = \"${nodes.machine.system.build.toplevel}/specialisation\";\n in\n ''\n machine.wait_for_unit(\"lldap.service\")\n@@ -56,6 +156,9 @@ in\n machine.succeed(\"curl --location --fail http://localhost:17170/\")\n \n adminPassword=\"${adminPassword}\"\n+ alicePassword=\"${alicePassword}\"\n+ bobPassword=\"${bobPassword}\"\n+ charliePassword=\"${charliePassword}\"\n \n def try_login(user, password, expect_success=True):\n cmd = f'ldapsearch -H ldap://localhost:3890 -D uid={user},ou=people,dc=example,dc=com -b \"ou=people,dc=example,dc=com\" -w {password}'\n@@ -70,18 +173,50 @@ in\n raise Exception(\"Expected failure, had success\")\n return response\n \n+ def parse_ldapsearch_output(output):\n+ return {n:v for (n, v) in (x.split(': ', 2) for x in output.splitlines() if x != \"\")}\n+\n with subtest(\"default admin password\"):\n try_login(\"admin\", \"password\", expect_success=True)\n try_login(\"admin\", adminPassword, expect_success=False)\n \n with subtest(\"different admin password\"):\n- machine.succeed('${specializations}/differentAdminPassword/bin/switch-to-configuration test')\n+ machine.succeed('${specialisations}/differentAdminPassword/bin/switch-to-configuration test')\n try_login(\"admin\", \"password\", expect_success=False)\n try_login(\"admin\", adminPassword, expect_success=True)\n \n with subtest(\"change admin password has no effect\"):\n- machine.succeed('${specializations}/differentAdminPassword/bin/switch-to-configuration test')\n+ machine.succeed('${specialisations}/differentAdminPassword/bin/switch-to-configuration test')\n try_login(\"admin\", \"password\", expect_success=False)\n try_login(\"admin\", adminPassword, expect_success=True)\n+\n+ with subtest(\"with alice\"):\n+ machine.succeed('${specialisations}/withAlice/bin/switch-to-configuration test')\n+ try_login(\"alice\", \"password\", expect_success=False)\n+ try_login(\"alice\", alicePassword, expect_success=True)\n+ try_login(\"bob\", \"password\", expect_success=False)\n+ try_login(\"bob\", bobPassword, expect_success=False)\n+\n+ with subtest(\"with bob\"):\n+ machine.succeed('${specialisations}/withBob/bin/switch-to-configuration test')\n+ try_login(\"alice\", \"password\", expect_success=False)\n+ try_login(\"alice\", alicePassword, expect_success=False)\n+ try_login(\"bob\", \"password\", expect_success=False)\n+ try_login(\"bob\", bobPassword, expect_success=True)\n+\n+ with subtest(\"with attributes\"):\n+ machine.succeed('${specialisations}/withAttributes/bin/switch-to-configuration test')\n+\n+ response = machine.succeed(f'ldapsearch -LLL -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b \"dc=example,dc=com\" -w {adminPassword} \"(uid=charlie)\"')\n+ print(response)\n+ charlie = parse_ldapsearch_output(response)\n+ if charlie.get('myattribute') != \"2\":\n+ raise Exception(f'Unexpected value for attribute \"myattribute\": {charlie.get('myattribute')}')\n+\n+ response = machine.succeed(f'ldapsearch -LLL -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b \"dc=example,dc=com\" -w {adminPassword} \"(cn=othergroup)\"')\n+ print(response)\n+ othergroup = parse_ldapsearch_output(response)\n+ if othergroup.get('mygroupattribute') != \"Managed by NixOS\":\n+ raise Exception(f'Unexpected value for attribute \"mygroupattribute\": {othergroup.get('mygroupattribute')}')\n '';\n }\n-- \n"
},
{
"path": "patches/nextcloudexternalstorage.patch",
"content": "diff --git a/lib/private/Files/Storage/Local.php b/lib/private/Files/Storage/Local.php\nindex 260f9218a88..26e5a4172f7 100644\n--- a/lib/private/Files/Storage/Local.php\n+++ b/lib/private/Files/Storage/Local.php\n@@ -66,9 +66,12 @@ class Local extends \\OC\\Files\\Storage\\Common {\n \t\t$this->unlinkOnTruncate = $this->config->getSystemValueBool('localstorage.unlink_on_truncate', false);\n \n \t\tif (isset($parameters['isExternal']) && $parameters['isExternal'] && !$this->stat('')) {\n-\t\t\t// data dir not accessible or available, can happen when using an external storage of type Local\n-\t\t\t// on an unmounted system mount point\n-\t\t\tthrow new StorageNotAvailableException('Local storage path does not exist \"' . $this->getSourcePath('') . '\"');\n+ if (!$this->mkdir('')) {\n+ // data dir not accessible or available, can happen when using an external storage of type Local\n+ // on an unmounted system mount point\n+ throw new StorageNotAvailableException('Local storage path does not exist and could not create it \"' . $this->getSourcePath('') . '\"');\n+ }\n+ Server::get(LoggerInterface::class)->warning('created local storage path ' . $this->getSourcePath(''), ['app' => 'core']);\n \t\t}\n \t}\n \n-- \n2.50.1\n\n"
},
{
"path": "test/blocks/authelia.nix",
"content": "{ pkgs, shb, ... }:\nlet\n pkgs' = pkgs;\n\n ldapAdminPassword = \"ldapAdminPassword\";\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"authelia-basic\";\n\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ../../modules/blocks/authelia.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n\n networking.hosts = {\n \"127.0.0.1\" = [\n \"machine.com\"\n \"client1.machine.com\"\n \"client2.machine.com\"\n \"ldap.machine.com\"\n \"authelia.machine.com\"\n ];\n };\n\n shb.lldap = {\n enable = true;\n dcdomain = \"dc=example,dc=com\";\n subdomain = \"ldap\";\n domain = \"machine.com\";\n ldapUserPassword.result = config.shb.hardcodedsecret.ldapUserPassword.result;\n jwtSecret.result = config.shb.hardcodedsecret.jwtSecret.result;\n };\n\n shb.hardcodedsecret.ldapUserPassword = {\n request = config.shb.lldap.ldapUserPassword.request;\n settings.content = ldapAdminPassword;\n };\n shb.hardcodedsecret.jwtSecret = {\n request = config.shb.lldap.jwtSecret.request;\n settings.content = \"jwtsecret\";\n };\n\n shb.authelia = {\n enable = true;\n subdomain = \"authelia\";\n domain = \"machine.com\";\n ldapHostname = \"${config.shb.lldap.subdomain}.${config.shb.lldap.domain}\";\n ldapPort = config.shb.lldap.ldapPort;\n dcdomain = config.shb.lldap.dcdomain;\n secrets = {\n jwtSecret.result = config.shb.hardcodedsecret.autheliaJwtSecret.result;\n ldapAdminPassword.result = config.shb.hardcodedsecret.ldapAdminPassword.result;\n sessionSecret.result = config.shb.hardcodedsecret.sessionSecret.result;\n storageEncryptionKey.result = config.shb.hardcodedsecret.storageEncryptionKey.result;\n identityProvidersOIDCHMACSecret.result =\n config.shb.hardcodedsecret.identityProvidersOIDCHMACSecret.result;\n identityProvidersOIDCIssuerPrivateKey.result =\n config.shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey.result;\n };\n\n oidcClients = [\n {\n client_id = \"client1\";\n client_name = \"My Client 1\";\n client_secret.source = pkgs.writeText \"secret\" \"$pbkdf2-sha512$310000$LR2wY11djfLrVQixdlLJew$rPByqFt6JfbIIAITxzAXckwh51QgV8E5YZmA8rXOzkMfBUcMq7cnOKEXF6MAFbjZaGf3J/B1OzLWZTCuZtALVw\";\n public = false;\n authorization_policy = \"one_factor\";\n redirect_uris = [ \"http://client1.machine.com/redirect\" ];\n }\n {\n client_id = \"client2\";\n client_name = \"My Client 2\";\n client_secret.source = pkgs.writeText \"secret\" \"$pbkdf2-sha512$310000$76EqVU1N9K.iTOvD4WJ6ww$hqNJU.UHphiCjMChSqk27lUTjDqreuMuyV/u39Esc6HyiRXp5Ecx89ypJ5M0xk3Na97vbgDpwz7il5uwzQ4bfw\";\n public = false;\n authorization_policy = \"one_factor\";\n redirect_uris = [ \"http://client2.machine.com/redirect\" ];\n }\n ];\n };\n\n shb.hardcodedsecret.autheliaJwtSecret = {\n request = config.shb.authelia.secrets.jwtSecret.request;\n settings.content = \"jwtSecret\";\n };\n shb.hardcodedsecret.ldapAdminPassword = {\n request = config.shb.authelia.secrets.ldapAdminPassword.request;\n settings.content = ldapAdminPassword;\n };\n shb.hardcodedsecret.sessionSecret = {\n request = config.shb.authelia.secrets.sessionSecret.request;\n settings.content = \"sessionSecret\";\n };\n shb.hardcodedsecret.storageEncryptionKey = {\n request = config.shb.authelia.secrets.storageEncryptionKey.request;\n settings.content = \"storageEncryptionKey\";\n };\n shb.hardcodedsecret.identityProvidersOIDCHMACSecret = {\n request = config.shb.authelia.secrets.identityProvidersOIDCHMACSecret.request;\n settings.content = \"identityProvidersOIDCHMACSecret\";\n };\n shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey = {\n request = config.shb.authelia.secrets.identityProvidersOIDCIssuerPrivateKey.request;\n settings.source =\n (pkgs.runCommand \"gen-private-key\" { } ''\n mkdir $out\n ${pkgs.openssl}/bin/openssl genrsa -out $out/private.pem 4096\n '')\n + \"/private.pem\";\n };\n\n specialisation = {\n withDebug.configuration = {\n shb.authelia.debug = true;\n };\n };\n };\n\n testScript =\n { nodes, ... }:\n let\n specializations = \"${nodes.machine.system.build.toplevel}/specialisation\";\n in\n ''\n import json\n\n start_all()\n\n def tests():\n machine.wait_for_unit(\"lldap.service\")\n machine.wait_for_unit(\"authelia-authelia.machine.com.target\")\n machine.wait_for_open_port(9091)\n\n endpoints = json.loads(machine.succeed(\"curl -s http://machine.com/.well-known/openid-configuration\"))\n auth_endpoint = endpoints['authorization_endpoint']\n print(f\"auth_endpoint: {auth_endpoint}\")\n if auth_endpoint != \"http://machine.com/api/oidc/authorization\":\n raise Exception(\"Unexpected auth_endpoint\")\n\n resp = machine.succeed(\n \"curl -f -s '\"\n + auth_endpoint\n + \"?client_id=other\"\n + \"&redirect_uri=http://client1.machine.com/redirect\"\n + \"&scope=openid%20profile%20email\"\n + \"&response_type=code\"\n + \"&state=99999999'\"\n )\n print(resp)\n if resp != \"\":\n raise Exception(\"unexpected response\")\n\n resp = machine.succeed(\n \"curl -f -s '\"\n + auth_endpoint\n + \"?client_id=client1\"\n + \"&redirect_uri=http://client1.machine.com/redirect\"\n + \"&scope=openid%20profile%20email\"\n + \"&response_type=code\"\n + \"&state=11111111'\"\n )\n print(resp)\n if \"Found\" not in resp:\n raise Exception(\"unexpected response\")\n\n resp = machine.succeed(\n \"curl -f -s '\"\n + auth_endpoint\n + \"?client_id=client2\"\n + \"&redirect_uri=http://client2.machine.com/redirect\"\n + \"&scope=openid%20profile%20email\"\n + \"&response_type=code\"\n + \"&state=22222222'\"\n )\n print(resp)\n if \"Found\" not in resp:\n raise Exception(\"unexpected response\")\n\n with subtest(\"no debug\"):\n tests()\n\n with subtest(\"with debug\"):\n machine.succeed('${specializations}/withDebug/bin/switch-to-configuration test')\n tests()\n '';\n };\n}\n"
},
{
"path": "test/blocks/borgbackup.nix",
"content": "{ shb, ... }:\nlet\n commonTest =\n user:\n shb.test.runNixOSTest {\n name = \"borgbackup_backupAndRestore_${user}\";\n\n nodes.machine =\n { config, ... }:\n {\n imports = [\n shb.test.baseImports\n\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/blocks/borgbackup.nix\n ];\n\n shb.hardcodedsecret.A = {\n request = {\n owner = \"root\";\n group = \"keys\";\n mode = \"0440\";\n };\n settings.content = \"secretA\";\n };\n shb.hardcodedsecret.B = {\n request = {\n owner = \"root\";\n group = \"keys\";\n mode = \"0440\";\n };\n settings.content = \"secretB\";\n };\n\n shb.hardcodedsecret.passphrase = {\n request = config.shb.borgbackup.instances.\"testinstance\".settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n\n shb.borgbackup.instances.\"testinstance\" = {\n settings = {\n enable = true;\n\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n\n repository = {\n path = \"/opt/repos/A\";\n timerConfig = {\n OnCalendar = \"00:00:00\";\n RandomizedDelaySec = \"5h\";\n };\n # Those are not needed by the repository but are still included\n # so we can test them in the hooks section.\n secrets = {\n A.source = config.shb.hardcodedsecret.A.result.path;\n B.source = config.shb.hardcodedsecret.B.result.path;\n };\n };\n };\n\n request = {\n inherit user;\n\n sourceDirectories = [\n \"/opt/files/A\"\n \"/opt/files/B\"\n ];\n\n hooks.beforeBackup = [\n ''\n echo $RUNTIME_DIRECTORY\n if [ \"$RUNTIME_DIRECTORY\" = /run/borgbackup-backups-testinstance_opt_repos_A ]; then\n if ! [ -f /run/secrets_borgbackup/borgbackup-backups-testinstance_opt_repos_A ]; then\n exit 10\n fi\n if [ -z \"$A\" ] || ! [ \"$A\" = \"secretA\" ]; then\n echo \"A:$A\"\n exit 11\n fi\n if [ -z \"$B\" ] || ! [ \"$B\" = \"secretB\" ]; then\n echo \"B:$B\"\n exit 12\n fi\n fi\n ''\n ];\n };\n };\n };\n\n extraPythonPackages = p: [ p.dictdiffer ];\n skipTypeCheck = true;\n\n testScript =\n { nodes, ... }:\n let\n provider = nodes.machine.shb.borgbackup.instances.\"testinstance\";\n backupService = provider.result.backupService;\n restoreScript = provider.result.restoreScript;\n in\n ''\n from dictdiffer import diff\n\n def list_files(dir):\n files_and_content = {}\n\n files = machine.succeed(f\"\"\"\n find {dir} -type f\n \"\"\").split(\"\\n\")[:-1]\n\n for f in files:\n content = machine.succeed(f\"\"\"\n cat {f}\n \"\"\").strip()\n files_and_content[f] = content\n\n return files_and_content\n\n def assert_files(dir, files):\n result = list(diff(list_files(dir), files))\n if len(result) > 0:\n raise Exception(\"Unexpected files:\", result)\n\n with subtest(\"Create initial content\"):\n machine.succeed(\"\"\"\n mkdir -p /opt/files/A\n mkdir -p /opt/files/B\n\n echo repoA_fileA_1 > /opt/files/A/fileA\n echo repoA_fileB_1 > /opt/files/A/fileB\n echo repoB_fileA_1 > /opt/files/B/fileA\n echo repoB_fileB_1 > /opt/files/B/fileB\n\n chown ${user}: -R /opt/files\n chmod go-rwx -R /opt/files\n \"\"\")\n\n assert_files(\"/opt/files\", {\n '/opt/files/B/fileA': 'repoB_fileA_1',\n '/opt/files/B/fileB': 'repoB_fileB_1',\n '/opt/files/A/fileA': 'repoA_fileA_1',\n '/opt/files/A/fileB': 'repoA_fileB_1',\n })\n\n with subtest(\"First backup in repo A\"):\n machine.succeed(\"systemctl start ${backupService}\")\n\n with subtest(\"New content\"):\n machine.succeed(\"\"\"\n echo repoA_fileA_2 > /opt/files/A/fileA\n echo repoA_fileB_2 > /opt/files/A/fileB\n echo repoB_fileA_2 > /opt/files/B/fileA\n echo repoB_fileB_2 > /opt/files/B/fileB\n \"\"\")\n\n assert_files(\"/opt/files\", {\n '/opt/files/B/fileA': 'repoB_fileA_2',\n '/opt/files/B/fileB': 'repoB_fileB_2',\n '/opt/files/A/fileA': 'repoA_fileA_2',\n '/opt/files/A/fileB': 'repoA_fileB_2',\n })\n\n with subtest(\"Delete content\"):\n machine.succeed(\"\"\"\n rm -r /opt/files/A /opt/files/B\n \"\"\")\n\n assert_files(\"/opt/files\", {})\n\n with subtest(\"Restore initial content from repo A\"):\n machine.succeed(\"\"\"\n ${restoreScript} restore latest\n \"\"\")\n\n assert_files(\"/opt/files\", {\n '/opt/files/B/fileA': 'repoB_fileA_1',\n '/opt/files/B/fileB': 'repoB_fileB_1',\n '/opt/files/A/fileA': 'repoA_fileA_1',\n '/opt/files/A/fileB': 'repoA_fileB_1',\n })\n '';\n\n };\nin\n{\n backupAndRestoreRoot = commonTest \"root\";\n backupAndRestoreUser = commonTest \"nobody\";\n}\n"
},
{
"path": "test/blocks/keypair.pem",
"content": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC2x1rFx98p6djQ\nX0mJ8nUMnS3LU7ih8UU5soW/TVhdcioe+NUevLjq0Qe/RXAz+yjhAxmJoWsFwMuy\nPKQKDbnqLH6Rf2qPiOvg5NB/vINuVpnAo9mQUJlJOrWKe6/pk6FWD0YxGiwETEIX\nbdARazOo/n5emQCZ7XwFy9ULlZkURIt9co/SxhMaD0Q+P1eev0lt01XG5ZLg9wL8\nCHIkasqK5huKFUnHVyq8+ApVrzsANsvjFSLwd985FpIF+DYcVQ+8ZmwVrbZTzFFC\nPjee8CrhO1ZxOAPwVm7qNTtZ4es8xJyMJvijk6grqLGcWSIWTMAwxmN7feOuEvvk\nRlDf9DmpAgMBAAECggEACP51jySrDLAQ/wznTJpRi+u6loYhwFdD26dXGT8kNWHy\nJGjEbPEmrMhZKB5xu18VJ4Bca/c1UdjHNTeybzu2balfl4eEbfhz+fKsd1KmiYIJ\nqg7t/GHY7x9sUjqMoRLmhhp1juI9rv71JBu/WLIUnlDalUtUWh6zYwIhE0M634I8\nGjN4hCxvbVgQEyY4kMBvCcT9sixwm407qL7LfqlsT8KTGB9UU2cC1HD4B/pUKVzw\nx+vN93S6KS2SrjaYhAb1xHgxU6Bl1jT1IH8yAXVlmBBmDL9dNEJtD/kuX8kfbvuC\nyFY5NWVapSgyIhURkaHqJKmziaq51K1xHGCZYBDsYQKBgQDq0ovgTNBzgmwyl/ye\nZgUIWc/5tE2LlyoM8XTok9EB+8CnoBek8JFo9DVfNzTv+UCUXb7DCveuS1Jb0JY0\nXi4gOSczVV297Lszziogxuni4ax/1Nezah/WSffVEowakPuTLK+0dst0QxWC6+Db\nm4OHJY5qjS/mh3rLhFdjXcmAoQKBgQDHQ0BAg8AhlFz9fTxit1pyHuVs1EcEBjqI\nUOS1ClS+BDcjERVBJ8GKiZj2/la37OLlQuguH2AXX//wVC5rZEXP38+ELemW0BZC\nJFKaY5PYufMcGVd6JBDYCoEa/JERJsD87ADBAUj/kIMfvka/it9PID9jgMPaVESE\nLYIsRv40CQKBgQCtdJ0yMEuCJ4L41GAcOUvaYU1JLDBjvmOnb+xlqFqpVmd26sDM\na49dsZaDIOqPoNRdQ+oXdNCEBMtvWuK5CCCWWOFl/9bg5i9aEx33XDeECiM7weMb\nenbN+ZGB6NNpBFNw4X9glKew16TaMpbEYVmEyO8sMeKCLO09zCIpGiwwQQKBgQCF\n++dhOfXf3mXkoOgQrJ8pazLzSY1y3ElRTatrPEYc+rKkZqE3DWdrIvhy5DQlOiia\n5bE/CiPPs+JhlAkedu8mRqS/iSuvF75PvSK540kPioE4nKWgYE3fJrkHD1rwAHH1\n3y7mmFmgVmiE2Kmzs8pR5yoYWwXWcaEci4kjAp19GQKBgQDRpy4ojGUmKdDffcGU\npEpl+dGpC3YuGwEsopDTYJSjANq0p5QGcQo9L140XxBEaFd4k/jwvVh2VRx4KmkC\nwyFODOk4vbq1NKljLC9yRo6UbUZuzWBsyjP62OHPR5MBg5FQgd4RI6/c3EpAhFGX\npM/CH7yZXp7Brhp4RcdbwhQnIA==\n-----END PRIVATE KEY-----\n"
},
{
"path": "test/blocks/lib.nix",
"content": "{\n pkgs,\n lib,\n shb,\n ...\n}:\nlet\n pkgs' = pkgs;\nin\n{\n template =\n let\n aSecret = pkgs.writeText \"a-secret.txt\" \"Secret of A\";\n bSecret = pkgs.writeText \"b-secret.txt\" \"Secret of B\";\n userConfig = {\n a.a.source = aSecret;\n b.source = bSecret;\n b.transform = v: \"prefix-${v}-suffix\";\n c = \"not secret C\";\n d.d = \"not secret D\";\n };\n\n wantedConfig = {\n a.a = \"Secret of A\";\n b = \"prefix-Secret of B-suffix\";\n c = \"not secret C\";\n d.d = \"not secret D\";\n };\n\n configWithTemplates = shb.withReplacements userConfig;\n\n nonSecretConfigFile = pkgs.writeText \"config.yaml.template\" (\n lib.generators.toJSON { } configWithTemplates\n );\n\n replacements = shb.getReplacements userConfig;\n\n replaceInTemplate = shb.replaceSecretsScript {\n file = nonSecretConfigFile;\n resultPath = \"/var/lib/config.yaml\";\n inherit replacements;\n };\n\n replaceInTemplateJSON = shb.replaceSecrets {\n inherit userConfig;\n resultPath = \"/var/lib/config.json\";\n generator = shb.replaceSecretsFormatAdapter (pkgs.formats.json { });\n };\n\n replaceInTemplateJSONGen = shb.replaceSecrets {\n inherit userConfig;\n resultPath = \"/var/lib/config_gen.json\";\n generator = shb.replaceSecretsGeneratorAdapter (lib.generators.toJSON { });\n };\n\n replaceInTemplateXML = shb.replaceSecrets {\n inherit userConfig;\n resultPath = \"/var/lib/config.xml\";\n generator = shb.replaceSecretsFormatAdapter (shb.formatXML { enclosingRoot = \"Root\"; });\n };\n in\n shb.test.runNixOSTest {\n name = \"lib-template\";\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n {\n options = {\n libtest.config = lib.mkOption {\n type = lib.types.attrsOf (\n lib.types.oneOf [\n lib.types.str\n lib.secretFileType\n ]\n );\n };\n };\n }\n ];\n\n system.activationScripts = {\n libtest = replaceInTemplate;\n libtestJSON = replaceInTemplateJSON;\n libtestJSONGen = replaceInTemplateJSONGen;\n libtestXML = replaceInTemplateXML;\n };\n };\n\n testScript =\n { nodes, ... }:\n ''\n import json\n from collections import ChainMap\n from xml.etree import ElementTree\n\n start_all()\n machine.wait_for_file(\"/var/lib/config.yaml\")\n machine.wait_for_file(\"/var/lib/config.json\")\n machine.wait_for_file(\"/var/lib/config_gen.json\")\n machine.wait_for_file(\"/var/lib/config.xml\")\n\n def xml_to_dict_recursive(root):\n all_descendants = list(root)\n if len(all_descendants) == 0:\n return {root.tag: root.text}\n else:\n merged_dict = ChainMap(*map(xml_to_dict_recursive, all_descendants))\n return {root.tag: dict(merged_dict)}\n\n wantedConfig = json.loads('${lib.generators.toJSON { } wantedConfig}')\n\n with subtest(\"config\"):\n print(machine.succeed(\"cat ${pkgs.writeText \"replaceInTemplate\" replaceInTemplate}\"))\n\n gotConfig = machine.succeed(\"cat /var/lib/config.yaml\")\n print(gotConfig)\n gotConfig = json.loads(gotConfig)\n\n if wantedConfig != gotConfig:\n raise Exception(\"\\nwantedConfig: {}\\n!= gotConfig: {}\".format(wantedConfig, gotConfig))\n\n with subtest(\"config JSON Gen\"):\n print(machine.succeed(\"cat ${pkgs.writeText \"replaceInTemplateJSONGen\" replaceInTemplateJSONGen}\"))\n\n gotConfig = machine.succeed(\"cat /var/lib/config_gen.json\")\n print(gotConfig)\n gotConfig = json.loads(gotConfig)\n\n if wantedConfig != gotConfig:\n raise Exception(\"\\nwantedConfig: {}\\n!= gotConfig: {}\".format(wantedConfig, gotConfig))\n\n with subtest(\"config JSON\"):\n print(machine.succeed(\"cat ${pkgs.writeText \"replaceInTemplateJSON\" replaceInTemplateJSON}\"))\n\n gotConfig = machine.succeed(\"cat /var/lib/config.json\")\n print(gotConfig)\n gotConfig = json.loads(gotConfig)\n\n if wantedConfig != gotConfig:\n raise Exception(\"\\nwantedConfig: {}\\n!= gotConfig: {}\".format(wantedConfig, gotConfig))\n\n with subtest(\"config XML\"):\n print(machine.succeed(\"cat ${pkgs.writeText \"replaceInTemplateXML\" replaceInTemplateXML}\"))\n\n gotConfig = machine.succeed(\"cat /var/lib/config.xml\")\n print(gotConfig)\n gotConfig = xml_to_dict_recursive(ElementTree.XML(gotConfig))['Root']\n\n if wantedConfig != gotConfig:\n raise Exception(\"\\nwantedConfig: {}\\n!= gotConfig: {}\".format(wantedConfig, gotConfig))\n '';\n };\n}\n"
},
{
"path": "test/blocks/lldap.nix",
"content": "{\n pkgs,\n lib,\n shb,\n ...\n}:\nlet\n pkgs' = pkgs;\n\n password = \"securepassword\";\n charliePassword = \"CharliePassword\";\nin\n{\n auth = shb.test.runNixOSTest {\n name = \"ldap-auth\";\n\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n {\n options = {\n shb.ssl.enable = lib.mkEnableOption \"ssl\";\n };\n }\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/blocks/lldap.nix\n ];\n\n shb.lldap = {\n enable = true;\n dcdomain = \"dc=example,dc=com\";\n subdomain = \"ldap\";\n domain = \"example.com\";\n ldapUserPassword.result = config.shb.hardcodedsecret.ldapUserPassword.result;\n jwtSecret.result = config.shb.hardcodedsecret.jwtSecret.result;\n\n ensureUsers = {\n \"charlie\" = {\n email = \"charlie@example.com\";\n password.result = config.shb.hardcodedsecret.\"charlie\".result;\n };\n };\n\n ensureGroups = {\n \"family\" = { };\n };\n };\n shb.hardcodedsecret.ldapUserPassword = {\n request = config.shb.lldap.ldapUserPassword.request;\n settings.content = password;\n };\n shb.hardcodedsecret.jwtSecret = {\n request = config.shb.lldap.jwtSecret.request;\n settings.content = \"jwtSecret\";\n };\n shb.hardcodedsecret.\"charlie\" = {\n request = config.shb.lldap.ensureUsers.\"charlie\".password.request;\n settings.content = charliePassword;\n };\n\n networking.firewall.allowedTCPPorts = [ 80 ]; # nginx port\n\n environment.systemPackages = [ pkgs.openldap ];\n\n specialisation = {\n withDebug.configuration = {\n shb.lldap.debug = true;\n };\n };\n };\n\n nodes.client = { };\n\n # Inspired from https://github.com/lldap/lldap/blob/33f50d13a2e2d24a3e6bb05a148246bc98090df0/example_configs/lldap-ha-auth.sh\n testScript =\n { nodes, ... }:\n let\n specializations = \"${nodes.server.system.build.toplevel}/specialisation\";\n in\n ''\n import json\n\n start_all()\n\n def tests():\n server.wait_for_unit(\"lldap.service\")\n server.wait_for_open_port(${toString nodes.server.shb.lldap.webUIListenPort})\n server.wait_for_open_port(${toString nodes.server.shb.lldap.ldapPort})\n\n with subtest(\"fail without authenticating\"):\n client.fail(\n \"curl -f -s -X GET\"\n + \"\"\" -H \"Content-type: application/json\" \"\"\"\n + \"\"\" -H \"Host: ldap.example.com\" \"\"\"\n + \" http://server/api/graphql\"\n )\n\n with subtest(\"fail authenticating with wrong credentials\"):\n resp = client.fail(\n \"curl -f -s -X POST\"\n + \"\"\" -H \"Content-type: application/json\" \"\"\"\n + \"\"\" -H \"Host: ldap.example.com\" \"\"\"\n + \" http://server/auth/simple/login\"\n + \"\"\" -d '{\"username\": \"admin\", \"password\": \"wrong\"}'\"\"\"\n )\n\n print(resp)\n\n with subtest(\"succeed with correct authentication\"):\n token = json.loads(client.succeed(\n \"curl -f -s -X POST \"\n + \"\"\" -H \"Content-type: application/json\" \"\"\"\n + \"\"\" -H \"Host: ldap.example.com\" \"\"\"\n + \" http://server/auth/simple/login \"\n + \"\"\" -d '{\"username\": \"admin\", \"password\": \"${password}\"}' \"\"\"\n ))['token']\n\n data = json.loads(client.succeed(\n \"curl -f -s -X POST \"\n + \"\"\" -H \"Content-type: application/json\" \"\"\"\n + \"\"\" -H \"Host: ldap.example.com\" \"\"\"\n + \"\"\" -H \"Authorization: Bearer {token}\" \"\"\".format(token=token)\n + \" http://server/api/graphql \"\n + \"\"\" -d '{\"variables\": {\"id\": \"admin\"}, \"query\":\"query($id:String!){user(userId:$id){displayName groups{displayName}}}\"}' \"\"\"\n ))['data']\n\n assert data['user']['displayName'] == \"Administrator\"\n assert data['user']['groups'][0]['displayName'] == \"lldap_admin\"\n\n with subtest(\"succeed charlie\"):\n resp = client.succeed(\n \"curl -f -s -X POST \"\n + \"\"\" -H \"Content-type: application/json\" \"\"\"\n + \"\"\" -H \"Host: ldap.example.com\" \"\"\"\n + \" http://server/auth/simple/login \"\n + \"\"\" -d '{\"username\": \"charlie\", \"password\": \"${charliePassword}\"}' \"\"\"\n )\n print(resp)\n\n with subtest(\"ldap user search\"):\n resp = server.succeed('ldapsearch -H ldap://127.0.0.1:${toString nodes.server.shb.lldap.ldapPort} -D uid=admin,ou=people,dc=example,dc=com -b \"ou=people,dc=example,dc=com\" -w ${password}')\n print(resp)\n\n if \"uid=admin\" not in resp:\n raise Exception(\"Expected to find admin\")\n\n if \"uid=charlie\" not in resp:\n raise Exception(\"Expected to find charlie\")\n\n with subtest(\"no debug\"):\n tests()\n\n with subtest(\"with debug\"):\n server.succeed('${specializations}/withDebug/bin/switch-to-configuration test')\n tests()\n '';\n };\n}\n"
},
{
"path": "test/blocks/mitmdump.nix",
"content": "{\n pkgs,\n lib,\n shb,\n ...\n}:\nlet\n serve =\n port: text:\n lib.getExe (\n pkgs.writers.writePython3Bin \"serve\"\n {\n libraries = [ pkgs.python3Packages.systemd-python ];\n }\n (\n let\n content = pkgs.writeText \"content\" text;\n in\n ''\n from http.server import BaseHTTPRequestHandler, HTTPServer\n from systemd.daemon import notify\n\n with open(\"${content}\", \"rb\") as f:\n content = f.read()\n\n\n class HardcodedHandler(BaseHTTPRequestHandler):\n def do_GET(self):\n reponse = content + self.path.encode('utf-8')\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/plain\")\n self.send_header(\"Content-Length\", str(len(reponse)))\n self.end_headers()\n print(\"answering to GET request\")\n self.wfile.write(reponse)\n\n def log_message(self, format, *args):\n pass # optional: suppress logging\n\n\n if __name__ == \"__main__\":\n notify('STATUS=Starting up...')\n server_address = ('127.0.0.1', ${toString port})\n httpd = HTTPServer(server_address, HardcodedHandler)\n print(\"Serving hardcoded page on http://127.0.0.1:${toString port}\")\n notify('READY=1')\n httpd.serve_forever()\n ''\n )\n );\nin\n{\n default = shb.test.runNixOSTest {\n name = \"mitmdump-default\";\n\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n ../../modules/blocks/mitmdump.nix\n ];\n\n systemd.services.test1 = {\n serviceConfig.ExecStart = serve 8000 \"test1\";\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"notify\";\n StandardOutput = \"journal\";\n StandardError = \"journal\";\n };\n };\n\n systemd.services.test2 = {\n serviceConfig.ExecStart = serve 8002 \"test2\";\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"notify\";\n StandardOutput = \"journal\";\n StandardError = \"journal\";\n };\n };\n\n shb.mitmdump.instances.\"test1\" = {\n listenPort = 8001;\n upstreamPort = 8000;\n after = [ \"test1.service\" ];\n };\n\n shb.mitmdump.instances.\"test2\" = {\n listenPort = 8003;\n upstreamPort = 8002;\n after = [ \"test2.service\" ];\n enabledAddons = [ config.shb.mitmdump.addons.logger ];\n extraArgs = [\n \"--set\"\n \"verbose_pattern=/verbose\"\n ];\n };\n };\n\n testScript =\n { nodes, ... }:\n ''\n start_all()\n\n machine.wait_for_unit(\"test1.service\")\n machine.wait_for_unit(\"test2.service\")\n machine.wait_for_unit(\"mitmdump-test1.service\")\n machine.wait_for_unit(\"mitmdump-test2.service\")\n\n resp = machine.succeed(\"curl http://127.0.0.1:8000\")\n print(resp)\n if resp != \"test1/\":\n raise Exception(\"wanted 'test1'\")\n\n resp = machine.succeed(\"curl -v http://127.0.0.1:8001\")\n print(resp)\n if resp != \"test1/\":\n raise Exception(\"wanted 'test1'\")\n\n resp = machine.succeed(\"curl http://127.0.0.1:8002\")\n print(resp)\n if resp != \"test2/\":\n raise Exception(\"wanted 'test2'\")\n\n resp = machine.succeed(\"curl http://127.0.0.1:8003/notverbose\")\n print(resp)\n if resp != \"test2/notverbose\":\n raise Exception(\"wanted 'test2/notverbose'\")\n\n resp = machine.succeed(\"curl http://127.0.0.1:8003/verbose\")\n print(resp)\n if resp != \"test2/verbose\":\n raise Exception(\"wanted 'test2/verbose'\")\n\n dump = machine.succeed(\"journalctl -b -u mitmdump-test1.service\")\n print(dump)\n if \"HTTP/1.0 200 OK\" not in dump:\n raise Exception(\"expected to see HTTP/1.0 200 OK\")\n if \"test1\" not in dump:\n raise Exception(\"expected to see test1\")\n\n dump = machine.succeed(\"journalctl -b -u mitmdump-test2.service\")\n print(dump)\n if \"HTTP/1.0 200 OK\" not in dump:\n raise Exception(\"expected to see HTTP/1.0 200 OK\")\n if \"test2/notverbose\" in dump:\n raise Exception(\"expected not to see test2/notverbose\")\n if \"test2/verbose\" not in dump:\n raise Exception(\"expected to see test2/verbose\")\n '';\n };\n}\n"
},
{
"path": "test/blocks/monitoring.nix",
"content": "{ shb, ... }:\nlet\n password = \"securepw\";\n oidcSecret = \"oidcSecret\";\n\n commonTestScript = shb.test.accessScript {\n hasSSL = { node, ... }: !(isNull node.config.shb.monitoring.ssl);\n waitForServices =\n { ... }:\n [\n \"grafana.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.monitoring.grafanaPort\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/monitoring.nix\n ];\n\n test = {\n subdomain = \"g\";\n };\n\n shb.monitoring = {\n enable = true;\n inherit (config.test) subdomain domain;\n scrutiny.enable = false;\n\n contactPoints = [ \"me@example.com\" ];\n\n grafanaPort = 3000;\n adminPassword.result = config.shb.hardcodedsecret.\"admin_password\".result;\n secretKey.result = config.shb.hardcodedsecret.\"secret_key\".result;\n };\n\n shb.hardcodedsecret.\"admin_password\" = {\n request = config.shb.monitoring.adminPassword.request;\n settings.content = password;\n };\n shb.hardcodedsecret.\"secret_key\" = {\n request = config.shb.monitoring.secretKey.request;\n settings.content = \"secret_key_pw\";\n };\n };\n\n https =\n { config, ... }:\n {\n shb.monitoring = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.monitoring = {\n ldap = {\n userGroup = \"user_group\";\n adminGroup = \"admin_group\";\n };\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"g\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Welcome to Grafana')).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Welcome to Grafana')).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\" # I don't understand why this is not needed. Maybe it keeps somewhere the previous token?\n \"expect(page.get_by_text(re.compile('[Ll]ogin failed'))).to_be_visible(timeout=10000)\"\n ];\n }\n ];\n };\n };\n\n scrutiny =\n { lib, ... }:\n {\n shb.monitoring = {\n scrutiny.enable = lib.mkForce true;\n };\n };\n\n clientScrutinyLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"scrutiny\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n ''\n if page.get_by_role('button', name=re.compile('Accept')).count() > 0:\n page.get_by_role('button', name=re.compile('Accept')).click()\n ''\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Temperature history for each device')).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n ''\n if page.get_by_role('button', name=re.compile('Accept')).count() > 0:\n page.get_by_role('button', name=re.compile('Accept')).click()\n ''\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Temperature history for each device')).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\" # I don't understand why this is not needed. Maybe it keeps somewhere the previous token?\n \"expect(page.get_by_text(re.compile('[Ll]ogin failed'))).to_be_visible(timeout=10000)\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.monitoring = {\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n\n sharedSecret.result = config.shb.hardcodedsecret.oidcSecret.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.oidcAutheliaSecret.result;\n };\n };\n\n shb.hardcodedsecret.oidcSecret = {\n request = config.shb.monitoring.sso.sharedSecret.request;\n settings.content = oidcSecret;\n };\n shb.hardcodedsecret.oidcAutheliaSecret = {\n request = config.shb.monitoring.sso.sharedSecretForAuthelia.request;\n settings.content = oidcSecret;\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"monitoring_basic\";\n\n node.pkgsReadOnly = false;\n\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n https = shb.test.runNixOSTest {\n name = \"monitoring_https\";\n\n node.pkgsReadOnly = false;\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"monitoring_sso\";\n\n node.pkgsReadOnly = false;\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n\n virtualisation.memorySize = 4096;\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n\n # virtualisation.memorySize = 4096;\n };\n\n testScript = commonTestScript;\n };\n\n scrutiny_sso = shb.test.runNixOSTest {\n name = \"monitoring_scrutiny_sso\";\n\n node.pkgsReadOnly = false;\n\n nodes.client = {\n imports = [\n clientScrutinyLoginSso\n ];\n\n virtualisation.memorySize = 4096;\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n scrutiny\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n\n # virtualisation.memorySize = 4096;\n };\n\n testScript = commonTestScript;\n };\n}\n"
},
{
"path": "test/blocks/postgresql.nix",
"content": "{\n pkgs,\n lib,\n shb,\n ...\n}:\nlet\n pkgs' = pkgs;\nin\n{\n peerWithoutUser = shb.test.runNixOSTest {\n name = \"postgresql-peerWithoutUser\";\n\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ../../modules/blocks/postgresql.nix\n ];\n\n shb.postgresql.ensures = [\n {\n username = \"me-with-special-chars\";\n database = \"me-with-special-chars\";\n }\n ];\n };\n\n testScript =\n { nodes, ... }:\n ''\n start_all()\n machine.wait_for_unit(\"postgresql.service\")\n machine.wait_for_open_port(5432)\n\n def peer_cmd(user, database):\n return \"sudo -u me psql -U {user} {db} --command \\\"\\\"\".format(user=user, db=database)\n\n with subtest(\"cannot login because of missing user\"):\n machine.fail(peer_cmd(\"me-with-special-chars\", \"me-with-special-chars\"), timeout=10)\n\n with subtest(\"cannot login with unknown user\"):\n machine.fail(peer_cmd(\"notme\", \"me-with-other-chars\"), timeout=10)\n\n with subtest(\"cannot login to unknown database\"):\n machine.fail(peer_cmd(\"me-with-special-chars\", \"notmine\"), timeout=10)\n '';\n };\n\n peerAuth = shb.test.runNixOSTest {\n name = \"postgresql-peerAuth\";\n\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ../../modules/blocks/postgresql.nix\n ];\n\n users.users.me = {\n isSystemUser = true;\n group = \"me\";\n extraGroups = [ \"sudoers\" ];\n };\n users.groups.me = { };\n\n shb.postgresql.ensures = [\n {\n username = \"me\";\n database = \"me\";\n }\n ];\n };\n\n testScript =\n { nodes, ... }:\n ''\n start_all()\n machine.wait_for_unit(\"postgresql.service\")\n machine.wait_for_open_port(5432)\n\n def peer_cmd(user, database):\n return \"sudo -u me psql -U {user} {db} --command \\\"\\\"\".format(user=user, db=database)\n\n def tcpip_cmd(user, database, port):\n return \"psql -h 127.0.0.1 -p {port} -U {user} {db} --command \\\"\\\"\".format(user=user, db=database, port=port)\n\n with subtest(\"can login with provisioned user and database\"):\n machine.succeed(peer_cmd(\"me\", \"me\"), timeout=10)\n\n with subtest(\"cannot login with unknown user\"):\n machine.fail(peer_cmd(\"notme\", \"me\"), timeout=10)\n\n with subtest(\"cannot login to unknown database\"):\n machine.fail(peer_cmd(\"me\", \"notmine\"), timeout=10)\n\n with subtest(\"cannot login with tcpip\"):\n machine.fail(tcpip_cmd(\"me\", \"me\", \"5432\"), timeout=10)\n '';\n };\n\n tcpIPWithoutPasswordAuth = shb.test.runNixOSTest {\n name = \"postgresql-tcpIpWithoutPasswordAuth\";\n\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ../../modules/blocks/postgresql.nix\n ];\n\n shb.postgresql.enableTCPIP = true;\n shb.postgresql.ensures = [\n {\n username = \"me\";\n database = \"me\";\n }\n ];\n };\n\n testScript =\n { nodes, ... }:\n ''\n start_all()\n machine.wait_for_unit(\"postgresql.service\")\n machine.wait_for_open_port(5432)\n\n def peer_cmd(user, database):\n return \"sudo -u me psql -U {user} {db} --command \\\"\\\"\".format(user=user, db=database)\n\n def tcpip_cmd(user, database, port):\n return \"psql -h 127.0.0.1 -p {port} -U {user} {db} --command \\\"\\\"\".format(user=user, db=database, port=port)\n\n with subtest(\"cannot login without existing user\"):\n machine.fail(peer_cmd(\"me\", \"me\"), timeout=10)\n\n with subtest(\"cannot login with user without password\"):\n machine.fail(tcpip_cmd(\"me\", \"me\", \"5432\"), timeout=10)\n '';\n };\n\n tcpIPPasswordAuth =\n let\n username = \"me-with-special-chars\";\n in\n shb.test.runNixOSTest {\n name = \"postgresql-tcpIPPasswordAuth\";\n\n nodes.machine =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ../../modules/blocks/postgresql.nix\n ];\n\n users.users.${username} = {\n isSystemUser = true;\n group = username;\n extraGroups = [ \"sudoers\" ];\n };\n users.groups.${username} = { };\n\n system.activationScripts.secret = ''\n echo secretpw > /run/dbsecret\n '';\n shb.postgresql.enableTCPIP = true;\n shb.postgresql.ensures = [\n {\n username = username;\n database = username;\n passwordFile = \"/run/dbsecret\";\n }\n ];\n };\n\n testScript =\n { nodes, ... }:\n ''\n start_all()\n machine.wait_for_unit(\"postgresql.service\")\n machine.wait_for_open_port(5432)\n\n def peer_cmd(user, database):\n return \"sudo -u ${username} psql -U {user} {db} --command \\\"\\\"\".format(user=user, db=database)\n\n def tcpip_cmd(user, database, port, password):\n return \"PGPASSWORD={password} psql -h 127.0.0.1 -p {port} -U {user} {db} --command \\\"\\\"\".format(user=user, db=database, port=port, password=password)\n\n with subtest(\"can peer login with provisioned user and database\"):\n machine.succeed(peer_cmd(\"${username}\", \"${username}\"), timeout=10)\n\n with subtest(\"can tcpip login with provisioned user and database\"):\n machine.succeed(tcpip_cmd(\"${username}\", \"${username}\", \"5432\", \"secretpw\"), timeout=10)\n\n with subtest(\"cannot tcpip login with wrong password\"):\n machine.fail(tcpip_cmd(\"${username}\", \"${username}\", \"5432\", \"oops\"), timeout=10)\n '';\n };\n}\n"
},
{
"path": "test/blocks/restic.nix",
"content": "{ lib, shb, ... }:\nlet\n commonTest =\n user:\n shb.test.runNixOSTest {\n name = \"restic_backupAndRestore_${user}\";\n\n nodes.machine =\n { config, ... }:\n {\n imports = [\n shb.test.baseImports\n\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/blocks/restic.nix\n ];\n\n shb.hardcodedsecret.A = {\n request = {\n owner = \"root\";\n group = \"keys\";\n mode = \"0440\";\n };\n settings.content = \"secretA\";\n };\n shb.hardcodedsecret.B = {\n request = {\n owner = \"root\";\n group = \"keys\";\n mode = \"0440\";\n };\n settings.content = \"secretB\";\n };\n\n shb.hardcodedsecret.passphrase = {\n request = config.shb.restic.instances.\"testinstance\".settings.passphrase.request;\n settings.content = \"secretB\";\n };\n\n shb.restic.instances.\"testinstance\" = {\n settings = {\n enable = true;\n\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n\n repository = {\n path = \"/opt/repos/A\";\n timerConfig = {\n OnCalendar = \"00:00:00\";\n RandomizedDelaySec = \"5h\";\n };\n # Those are not needed by the repository but are still included\n # so we can test them in the hooks section.\n secrets = {\n A.source = config.shb.hardcodedsecret.A.result.path;\n B.source = config.shb.hardcodedsecret.B.result.path;\n };\n };\n };\n\n request = {\n inherit user;\n\n sourceDirectories = [\n \"/opt/files/A\"\n \"/opt/files/B\"\n ];\n\n hooks.beforeBackup = [\n ''\n echo $RUNTIME_DIRECTORY\n if [ \"$RUNTIME_DIRECTORY\" = /run/restic-backups-testinstance_opt_repos_A ]; then\n if ! [ -f /run/secrets_restic/restic-backups-testinstance_opt_repos_A ]; then\n exit 10\n fi\n if [ -z \"$A\" ] || ! [ \"$A\" = \"secretA\" ]; then\n echo \"A:$A\"\n exit 11\n fi\n if [ -z \"$B\" ] || ! [ \"$B\" = \"secretB\" ]; then\n echo \"B:$B\"\n exit 12\n fi\n fi\n ''\n ];\n };\n };\n };\n\n extraPythonPackages = p: [ p.dictdiffer ];\n skipTypeCheck = true;\n\n testScript =\n { nodes, ... }:\n let\n provider = nodes.machine.shb.restic.instances.\"testinstance\";\n backupService = provider.result.backupService;\n restoreScript = provider.result.restoreScript;\n in\n ''\n from dictdiffer import diff\n\n def list_files(dir):\n files_and_content = {}\n\n files = machine.succeed(f\"\"\"\n find {dir} -type f\n \"\"\").split(\"\\n\")[:-1]\n\n for f in files:\n content = machine.succeed(f\"\"\"\n cat {f}\n \"\"\").strip()\n files_and_content[f] = content\n\n return files_and_content\n\n def assert_files(dir, files):\n result = list(diff(list_files(dir), files))\n if len(result) > 0:\n raise Exception(\"Unexpected files:\", result)\n\n with subtest(\"Create initial content\"):\n machine.succeed(\"\"\"\n mkdir -p /opt/files/A\n mkdir -p /opt/files/B\n\n echo repoA_fileA_1 > /opt/files/A/fileA\n echo repoA_fileB_1 > /opt/files/A/fileB\n echo repoB_fileA_1 > /opt/files/B/fileA\n echo repoB_fileB_1 > /opt/files/B/fileB\n\n chown ${user}: -R /opt/files\n chmod go-rwx -R /opt/files\n \"\"\")\n\n assert_files(\"/opt/files\", {\n '/opt/files/B/fileA': 'repoB_fileA_1',\n '/opt/files/B/fileB': 'repoB_fileB_1',\n '/opt/files/A/fileA': 'repoA_fileA_1',\n '/opt/files/A/fileB': 'repoA_fileB_1',\n })\n\n with subtest(\"First backup in repo A\"):\n machine.succeed(\"systemctl start ${backupService}\")\n\n with subtest(\"New content\"):\n machine.succeed(\"\"\"\n echo repoA_fileA_2 > /opt/files/A/fileA\n echo repoA_fileB_2 > /opt/files/A/fileB\n echo repoB_fileA_2 > /opt/files/B/fileA\n echo repoB_fileB_2 > /opt/files/B/fileB\n \"\"\")\n\n assert_files(\"/opt/files\", {\n '/opt/files/B/fileA': 'repoB_fileA_2',\n '/opt/files/B/fileB': 'repoB_fileB_2',\n '/opt/files/A/fileA': 'repoA_fileA_2',\n '/opt/files/A/fileB': 'repoA_fileB_2',\n })\n\n with subtest(\"Delete content\"):\n machine.succeed(\"\"\"\n rm -r /opt/files/A /opt/files/B\n \"\"\")\n\n assert_files(\"/opt/files\", {})\n\n with subtest(\"Restore initial content from repo A\"):\n machine.succeed(\"\"\"\n ${restoreScript} restore latest\n \"\"\")\n\n assert_files(\"/opt/files\", {\n '/opt/files/B/fileA': 'repoB_fileA_1',\n '/opt/files/B/fileB': 'repoB_fileB_1',\n '/opt/files/A/fileA': 'repoA_fileA_1',\n '/opt/files/A/fileB': 'repoA_fileB_1',\n })\n '';\n\n };\nin\n{\n backupAndRestoreRoot = commonTest \"root\";\n backupAndRestoreUser = commonTest \"nobody\";\n}\n"
},
{
"path": "test/blocks/ssl.nix",
"content": "{ pkgs, shb, ... }:\nlet\n pkgs' = pkgs;\nin\n{\n test = shb.test.runNixOSTest {\n name = \"ssl-test\";\n\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n (pkgs'.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs'.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ../../modules/blocks/ssl.nix\n ];\n\n users.users = {\n user1 = {\n group = \"group1\";\n isSystemUser = true;\n };\n user2 = {\n group = \"group2\";\n isSystemUser = true;\n };\n };\n users.groups = {\n group1 = { };\n group2 = { };\n };\n\n shb.certs = {\n cas.selfsigned = {\n myca = {\n name = \"My CA\";\n };\n myotherca = {\n name = \"My Other CA\";\n };\n };\n certs.selfsigned = {\n top = {\n ca = config.shb.certs.cas.selfsigned.myca;\n\n domain = \"example.com\";\n group = \"nginx\";\n };\n subdomain = {\n ca = config.shb.certs.cas.selfsigned.myca;\n\n domain = \"subdomain.example.com\";\n group = \"nginx\";\n };\n multi = {\n ca = config.shb.certs.cas.selfsigned.myca;\n\n domain = \"multi1.example.com\";\n extraDomains = [\n \"multi2.example.com\"\n \"multi3.example.com\"\n ];\n group = \"nginx\";\n };\n\n cert1 = {\n ca = config.shb.certs.cas.selfsigned.myca;\n\n domain = \"cert1.example.com\";\n };\n cert2 = {\n ca = config.shb.certs.cas.selfsigned.myca;\n\n domain = \"cert2.example.com\";\n group = \"group2\";\n };\n };\n };\n\n # The configuration below is to create a webserver that uses the server certificate.\n networking.hosts.\"127.0.0.1\" = [\n \"example.com\"\n \"subdomain.example.com\"\n \"wrong.example.com\"\n \"multi1.example.com\"\n \"multi2.example.com\"\n \"multi3.example.com\"\n ];\n\n services.nginx.enable = true;\n services.nginx.virtualHosts =\n let\n mkVirtualHost = response: cert: {\n onlySSL = true;\n sslCertificate = cert.paths.cert;\n sslCertificateKey = cert.paths.key;\n locations.\"/\".extraConfig = ''\n add_header Content-Type text/plain;\n return 200 '${response}';\n '';\n };\n in\n {\n \"example.com\" = mkVirtualHost \"Top domain\" config.shb.certs.certs.selfsigned.top;\n \"subdomain.example.com\" = mkVirtualHost \"Subdomain\" config.shb.certs.certs.selfsigned.subdomain;\n \"multi1.example.com\" = mkVirtualHost \"multi1\" config.shb.certs.certs.selfsigned.multi;\n \"multi2.example.com\" = mkVirtualHost \"multi2\" config.shb.certs.certs.selfsigned.multi;\n \"multi3.example.com\" = mkVirtualHost \"multi3\" config.shb.certs.certs.selfsigned.multi;\n };\n systemd.services.nginx = {\n after = [\n config.shb.certs.certs.selfsigned.top.systemdService\n config.shb.certs.certs.selfsigned.subdomain.systemdService\n config.shb.certs.certs.selfsigned.multi.systemdService\n config.shb.certs.certs.selfsigned.cert1.systemdService\n config.shb.certs.certs.selfsigned.cert2.systemdService\n ];\n requires = [\n config.shb.certs.certs.selfsigned.top.systemdService\n config.shb.certs.certs.selfsigned.subdomain.systemdService\n config.shb.certs.certs.selfsigned.multi.systemdService\n config.shb.certs.certs.selfsigned.cert1.systemdService\n config.shb.certs.certs.selfsigned.cert2.systemdService\n ];\n };\n };\n\n # Taken from https://github.com/NixOS/nixpkgs/blob/7f311dd9226bbd568a43632c977f4992cfb2b5c8/nixos/tests/custom-ca.nix\n testScript =\n { nodes, ... }:\n let\n myca = nodes.server.shb.certs.cas.selfsigned.myca;\n myotherca = nodes.server.shb.certs.cas.selfsigned.myotherca;\n top = nodes.server.shb.certs.certs.selfsigned.top;\n subdomain = nodes.server.shb.certs.certs.selfsigned.subdomain;\n multi = nodes.server.shb.certs.certs.selfsigned.multi;\n cert1 = nodes.server.shb.certs.certs.selfsigned.cert1;\n cert2 = nodes.server.shb.certs.certs.selfsigned.cert2;\n in\n ''\n start_all()\n\n # Make sure certs are generated.\n server.wait_for_file(\"${myca.paths.key}\")\n server.wait_for_file(\"${myca.paths.cert}\")\n server.wait_for_file(\"${myotherca.paths.key}\")\n server.wait_for_file(\"${myotherca.paths.cert}\")\n server.wait_for_file(\"${top.paths.key}\")\n server.wait_for_file(\"${top.paths.cert}\")\n server.wait_for_file(\"${subdomain.paths.key}\")\n server.wait_for_file(\"${subdomain.paths.cert}\")\n server.wait_for_file(\"${multi.paths.key}\")\n server.wait_for_file(\"${multi.paths.cert}\")\n server.wait_for_file(\"${cert1.paths.key}\")\n server.wait_for_file(\"${cert1.paths.cert}\")\n server.wait_for_file(\"${cert2.paths.key}\")\n server.wait_for_file(\"${cert2.paths.cert}\")\n\n server.require_unit_state(\"${nodes.server.shb.certs.systemdService}\", \"inactive\")\n\n server.wait_for_unit(\"nginx\")\n server.wait_for_open_port(443)\n\n def assert_owner(path, user, group):\n owner = server.succeed(\"stat --format '%U:%G' {}\".format(path)).strip();\n want_owner = user + \":\" + group\n if owner != want_owner:\n raise Exception('Unexpected owner for {}: wanted \"{}\", got: \"{}\"'.format(path, want_owner, owner))\n\n def assert_perm(path, want_perm):\n perm = server.succeed(\"stat --format '%a' {}\".format(path)).strip();\n if perm != want_perm:\n raise Exception('Unexpected perm for {}: wanted \"{}\", got: \"{}\"'.format(path, want_perm, perm))\n\n with subtest(\"Certificates content seem correct\"):\n myca_key = server.succeed(\"cat {}\".format(\"${myca.paths.key}\")).strip();\n myca_cert = server.succeed(\"cat {}\".format(\"${myca.paths.cert}\")).strip();\n cert1_key = server.succeed(\"cat {}\".format(\"${cert1.paths.key}\")).strip();\n cert1_cert = server.succeed(\"cat {}\".format(\"${cert1.paths.cert}\")).strip();\n cert2_key = server.succeed(\"cat {}\".format(\"${cert2.paths.key}\")).strip();\n cert2_cert = server.succeed(\"cat {}\".format(\"${cert2.paths.cert}\")).strip();\n ca_bundle = server.succeed(\"cat /etc/ssl/certs/ca-bundle.crt\").strip();\n\n if myca_cert == \"\":\n raise Exception(\"CA cert was empty\")\n if cert1_key == \"\":\n raise Exception(\"Cert1 key was empty\")\n if cert1_cert == \"\":\n raise Exception(\"Cert1 cert was empty\")\n if cert2_key == \"\":\n raise Exception(\"Cert2 key was empty\")\n if cert2_cert == \"\":\n raise Exception(\"Cert2 cert was empty\")\n if cert1_key == cert2_key:\n raise Exception(\"Cert1 key and cert2 key are the same\")\n if cert1_cert == cert2_cert:\n raise Exception(\"Cert1 cert and cert2 cert are the same\")\n if ca_bundle == \"\":\n raise Exception(\"CA bundle was empty\")\n\n with subtest(\"Certificate is trusted in curl\"):\n resp = server.succeed(\"curl --fail-with-body -v https://example.com\")\n if resp != \"Top domain\":\n raise Exception('Unexpected response, got: {}'.format(resp))\n\n resp = server.succeed(\"curl --fail-with-body -v https://subdomain.example.com\")\n if resp != \"Subdomain\":\n raise Exception('Unexpected response, got: {}'.format(resp))\n\n resp = server.succeed(\"curl --fail-with-body -v https://multi1.example.com\")\n if resp != \"multi1\":\n raise Exception('Unexpected response, got: {}'.format(resp))\n\n resp = server.succeed(\"curl --fail-with-body -v https://multi2.example.com\")\n if resp != \"multi2\":\n raise Exception('Unexpected response, got: {}'.format(resp))\n\n resp = server.succeed(\"curl --fail-with-body -v https://multi3.example.com\")\n if resp != \"multi3\":\n raise Exception('Unexpected response, got: {}'.format(resp))\n\n with subtest(\"Certificate has correct permission\"):\n assert_owner(\"${cert1.paths.key}\", \"root\", \"root\")\n assert_owner(\"${cert1.paths.cert}\", \"root\", \"root\")\n assert_perm(\"${cert1.paths.key}\", \"640\")\n assert_perm(\"${cert1.paths.cert}\", \"640\")\n \n assert_owner(\"${cert2.paths.key}\", \"root\", \"group2\")\n assert_owner(\"${cert2.paths.cert}\", \"root\", \"group2\")\n assert_perm(\"${cert2.paths.key}\", \"640\")\n assert_perm(\"${cert2.paths.cert}\", \"640\")\n\n with subtest(\"Certificates content seem correct\"):\n if cert1_key == \"\":\n raise Exception(\"Cert1 key was empty\")\n if cert1_cert == \"\":\n raise Exception(\"Cert1 cert was empty\")\n if cert2_key == \"\":\n raise Exception(\"Cert2 key was empty\")\n if cert2_cert == \"\":\n raise Exception(\"Cert2 cert was empty\")\n if cert1_key == cert2_key:\n raise Exception(\"Cert1 key and cert2 key are the same\")\n if cert1_cert == cert2_cert:\n raise Exception(\"Cert1 cert and cert2 cert are the same\")\n\n with subtest(\"Fail if certificate is not in CA bundle\"):\n server.fail(\"curl --cacert /etc/static/ssl/certs/ca-bundle.crt --fail-with-body -v https://example.com\")\n server.fail(\"curl --cacert /etc/static/ssl/certs/ca-bundle.crt --fail-with-body -v https://subdomain.example.com\")\n server.fail(\"curl --cacert /etc/static/ssl/certs/ca-certificates.crt --fail-with-body -v https://example.com\")\n server.fail(\"curl --cacert /etc/static/ssl/certs/ca-certificates.crt --fail-with-body -v https://subdomain.example.com\")\n\n with subtest(\"Idempotency\"):\n server.succeed(\"systemctl restart shb-certs-ca-myca\")\n server.succeed(\"systemctl restart shb-certs-cert-selfsigned-cert1\")\n server.succeed(\"systemctl restart shb-certs-cert-selfsigned-cert2\")\n\n new_myca_key = server.succeed(\"cat {}\".format(\"${myca.paths.key}\")).strip();\n new_myca_cert = server.succeed(\"cat {}\".format(\"${myca.paths.cert}\")).strip();\n new_cert1_key = server.succeed(\"cat {}\".format(\"${cert1.paths.key}\")).strip();\n new_cert1_cert = server.succeed(\"cat {}\".format(\"${cert1.paths.cert}\")).strip();\n new_cert2_key = server.succeed(\"cat {}\".format(\"${cert2.paths.key}\")).strip();\n new_cert2_cert = server.succeed(\"cat {}\".format(\"${cert2.paths.cert}\")).strip();\n new_ca_bundle = server.succeed(\"cat /etc/ssl/certs/ca-bundle.crt\").strip();\n if new_myca_key != myca_key:\n raise Exception(\"New CA key is different from old one.\")\n if new_myca_cert != myca_cert:\n raise Exception(\"New CA cert is different from old one.\")\n if new_cert1_key != cert1_key:\n raise Exception(\"New Cert1 key is different from old one.\")\n if new_cert1_cert != cert1_cert:\n raise Exception(\"New Cert1 cert is different from old one.\")\n if new_cert2_key != cert2_key:\n raise Exception(\"New Cert2 key is different from old one.\")\n if new_cert2_cert != cert2_cert:\n raise Exception(\"New Cert2 cert is different from old one.\")\n if new_ca_bundle != ca_bundle:\n raise Exception(\"New CA bundle is different from old one.\")\n '';\n };\n}\n"
},
{
"path": "test/common.nix",
"content": "{ pkgs, lib }:\nlet\n inherit (lib) hasAttr mkOption optionalString;\n inherit (lib.types)\n bool\n enum\n listOf\n nullOr\n submodule\n str\n ;\n\n baseImports = {\n imports = [\n (pkgs.path + \"/nixos/modules/profiles/headless.nix\")\n (pkgs.path + \"/nixos/modules/profiles/qemu-guest.nix\")\n ];\n };\n\n accessScript = lib.makeOverridable (\n {\n hasSSL,\n waitForServices ? s: [ ],\n waitForPorts ? p: [ ],\n waitForUnixSocket ? u: [ ],\n waitForUrls ? u: [ ],\n extraScript ? { ... }: \"\",\n redirectSSO ? false,\n }:\n { nodes, ... }:\n let\n cfg = nodes.server.test;\n\n fqdn = \"${cfg.subdomain}.${cfg.domain}\";\n proto_fqdn = if hasSSL args then \"https://${fqdn}\" else \"http://${fqdn}\";\n\n args = {\n node.name = \"server\";\n node.config = nodes.server;\n inherit fqdn proto_fqdn;\n };\n\n autheliaEnabled = (hasAttr \"authelia\" nodes.server.shb) && nodes.server.shb.authelia.enable;\n lldapEnabled = (hasAttr \"lldap\" nodes.server.shb) && nodes.server.shb.lldap.enable;\n in\n ''\n import json\n import os\n import pathlib\n\n start_all()\n\n def curl(target, format, endpoint, data=\"\", extra=\"\"):\n cmd = (\"curl --show-error --location\"\n + \" --cookie-jar cookie.txt\"\n + \" --cookie cookie.txt\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n # Client must be able to resolve talking to auth server\n + \" --connect-to auth.${cfg.domain}:443:server:443\"\n + (f\" --data '{data}'\" if data != \"\" else \"\")\n + (f\" --silent --output /dev/null --write-out '{format}'\" if format != \"\" else \"\")\n + (f\" {extra}\" if extra != \"\" else \"\")\n + f\" {endpoint}\")\n print(cmd)\n _, r = target.execute(cmd)\n print(r)\n try:\n return json.loads(r)\n except:\n return r\n\n def unline_with(j, s):\n return j.join((x.strip() for x in s.split(\"\\n\")))\n ''\n + lib.strings.concatMapStrings (s: ''server.wait_for_unit(\"${s}\")'' + \"\\n\") (\n waitForServices args\n ++ (lib.optionals autheliaEnabled [ \"authelia-auth.${cfg.domain}.service\" ])\n ++ (lib.optionals lldapEnabled [ \"lldap.service\" ])\n )\n + lib.strings.concatMapStrings (p: \"server.wait_for_open_port(${toString p})\" + \"\\n\") (\n waitForPorts args\n # TODO: when the SSO block exists, replace this hardcoded port.\n ++ (lib.optionals autheliaEnabled [\n 9091 # nodes.server.services.authelia.instances.\"auth.${domain}\".settings.server.port\n ])\n )\n + lib.strings.concatMapStrings (u: ''server.wait_for_open_unix_socket(\"${u}\")'' + \"\\n\") (\n waitForUnixSocket args\n )\n + ''\n if ${if hasSSL args then \"True\" else \"False\"}:\n server.copy_from_vm(\"/etc/ssl/certs/ca-certificates.crt\")\n client.succeed(\"rm -r /etc/ssl/certs\")\n client.copy_from_host(str(pathlib.Path(os.environ.get(\"out\", os.getcwd())) / \"ca-certificates.crt\"), \"/etc/ssl/certs/ca-certificates.crt\")\n\n ''\n # Making a curl request to an URL needs to happen after we copied the certificates over,\n # otherwise curl will not be able to verify the \"legitimacy of the server\".\n + lib.strings.concatMapStrings (\n u:\n let\n url = if builtins.isString u then u else u.url;\n status = if builtins.isString u then 200 else u.status;\n in\n ''\n import time\n\n done = False\n count = 15\n while not done and count > 0:\n response = curl(client, \"\"\"{\"code\":%{response_code}}\"\"\", \"${url}\")\n time.sleep(5)\n count -= 1\n if isinstance(response, dict):\n done = response.get('code') == ${toString status}\n if not done:\n raise Exception(f\"Response was never ${toString status}, got last: {response}\")\n ''\n + \"\\n\"\n ) (waitForUrls args)\n + (\n if (!redirectSSO) then\n ''\n with subtest(\"access\"):\n response = curl(client, \"\"\"{\"code\":%{response_code}}\"\"\", \"${proto_fqdn}\")\n\n if response['code'] != 200:\n raise Exception(f\"Code is {response['code']}\")\n ''\n else\n ''\n with subtest(\"unauthenticated access is not granted\"):\n response = curl(client, \"\"\"{\"code\":%{response_code},\"auth_host\":\"%{urle.host}\",\"auth_query\":\"%{urle.query}\",\"all\":%{json}}\"\"\", \"${proto_fqdn}\")\n\n if response['code'] != 200:\n raise Exception(f\"Code is {response['code']}\")\n if response['auth_host'] != \"auth.${cfg.domain}\":\n raise Exception(f\"auth host should be auth.${cfg.domain} but is {response['auth_host']}\")\n if response['auth_query'] != \"rd=${proto_fqdn}/\":\n raise Exception(f\"auth query should be rd=${proto_fqdn}/ but is {response['auth_query']}\")\n ''\n )\n + (\n let\n script = extraScript args;\n in\n lib.optionalString (script != \"\") script\n )\n + (optionalString (hasAttr \"test\" nodes.server && hasAttr \"login\" nodes.server.test) ''\n with subtest(\"Login from server\"):\n code, logs = server.execute(\"login_playwright\")\n print(logs)\n try:\n server.copy_from_vm(\"trace\")\n except:\n print(\"No trace found on server\")\n # if code != 0:\n # raise Exception(\"login_playwright did not succeed\")\n '')\n + (optionalString (hasAttr \"test\" nodes.client && hasAttr \"login\" nodes.client.test) ''\n with subtest(\"Login from client\"):\n code, logs = client.execute(\"login_playwright\")\n print(logs)\n try:\n client.copy_from_vm(\"trace\")\n except:\n print(\"No trace found on client\")\n # if code != 0:\n # raise Exception(\"login_playwright did not succeed\")\n '')\n );\n\n backupScript =\n args:\n (accessScript args).override {\n extraScript =\n { proto_fqdn, ... }:\n ''\n with subtest(\"backup\"):\n server.succeed(\"systemctl start restic-backups-testinstance_opt_repos_A\")\n '';\n };\nin\n{\n inherit baseImports accessScript;\n\n runNixOSTest =\n args:\n pkgs.testers.runNixOSTest (\n {\n interactive.sshBackdoor.enable = true;\n }\n // args\n );\n\n mkScripts = args: {\n access = accessScript args;\n backup = backupScript args;\n };\n\n baseModule =\n { config, ... }:\n {\n options.test = {\n domain = mkOption {\n type = str;\n default = \"example.com\";\n };\n subdomain = mkOption {\n type = str;\n };\n fqdn = mkOption {\n type = str;\n readOnly = true;\n default = \"${config.test.subdomain}.${config.test.domain}\";\n };\n hasSSL = mkOption {\n type = bool;\n default = false;\n };\n proto = mkOption {\n type = str;\n readOnly = true;\n default = if config.test.hasSSL then \"https\" else \"http\";\n };\n proto_fqdn = mkOption {\n type = str;\n readOnly = true;\n default = \"${config.test.proto}://${config.test.fqdn}\";\n };\n };\n imports = [\n baseImports\n ../modules/blocks/hardcodedsecret.nix\n ../modules/blocks/nginx.nix\n ];\n config = {\n # HTTP(s) server port.\n networking.firewall.allowedTCPPorts = [\n 80\n 443\n ];\n shb.nginx.accessLog = true;\n\n networking.hosts = {\n \"192.168.1.2\" = [\n config.test.fqdn\n \"auth.${config.test.domain}\"\n ];\n };\n };\n };\n\n clientLoginModule =\n { config, pkgs, ... }:\n let\n cfg = config.test.login;\n in\n {\n options.test.login = {\n browser = mkOption {\n type = enum [\n \"firefox\"\n \"chromium\"\n \"webkit\"\n ];\n default = \"firefox\";\n };\n usernameFieldLabelRegex = mkOption {\n type = str;\n default = \"[Uu]sername\";\n };\n usernameFieldSelector = mkOption {\n type = str;\n default = \"get_by_label(re.compile('${cfg.usernameFieldLabelRegex}'))\";\n };\n passwordFieldLabelRegex = mkOption {\n type = str;\n default = \"[Pp]assword\";\n };\n passwordFieldSelector = mkOption {\n type = str;\n default = \"get_by_label(re.compile('${cfg.passwordFieldLabelRegex}'))\";\n };\n loginButtonNameRegex = mkOption {\n type = str;\n default = \"[Ll]ogin\";\n };\n loginSpawnsNewPage = mkOption {\n type = bool;\n default = false;\n };\n testLoginWith = mkOption {\n type = listOf (submodule {\n options = {\n username = mkOption {\n type = nullOr str;\n default = null;\n };\n password = mkOption {\n type = nullOr str;\n default = null;\n };\n nextPageExpect = mkOption {\n type = listOf str;\n };\n };\n });\n };\n startUrl = mkOption {\n type = str;\n default = \"http://${config.test.fqdn}\";\n };\n beforeHook = mkOption {\n type = str;\n default = \"\";\n };\n };\n config = {\n networking.hosts = {\n \"192.168.1.2\" = [\n config.test.fqdn\n \"auth.${config.test.domain}\"\n ];\n };\n\n environment.variables = {\n PLAYWRIGHT_BROWSERS_PATH = pkgs.playwright-driver.browsers;\n };\n\n environment.systemPackages = [\n (pkgs.writers.writePython3Bin \"login_playwright\"\n {\n libraries = [ pkgs.python3Packages.playwright ];\n flakeIgnore = [\n \"F401\"\n \"E501\"\n ];\n }\n (\n let\n testCfg = pkgs.writeText \"users.json\" (builtins.toJSON cfg);\n in\n ''\n import json\n import re\n import sys\n from playwright.sync_api import expect\n from playwright.sync_api import sync_playwright\n\n\n browsers = {\n \"chromium\": {'args': [\"--headless\", \"--disable-gpu\"], 'channel': 'chromium'},\n \"firefox\": {'args': [\"--reporter\", \"html\"]},\n \"webkit\": {},\n }\n\n with open(\"${testCfg}\") as f:\n testCfg = json.load(f)\n print(\"Test configuration:\")\n print(json.dumps(testCfg, indent=2))\n\n browser_name = testCfg['browser']\n browser_args = browsers.get(browser_name)\n print(f\"Running test on {browser_name} {' '.join(browser_args)}\")\n\n with sync_playwright() as p:\n browser = getattr(p, browser_name).launch(**browser_args)\n\n for i, u in enumerate(testCfg[\"testLoginWith\"]):\n print(f\"Testing for user {u['username']} and password {u['password']}\")\n\n context = browser.new_context(ignore_https_errors=True)\n context.set_default_navigation_timeout(2 * 60 * 1000)\n context.tracing.start(screenshots=True, snapshots=True, sources=True)\n try:\n page = context.new_page()\n # This is used to debug frame changes.\n # Frame changes or popup are somewhat handled with the expect_page() call later.\n page.on(\"framenavigated\", lambda frame: print(\"NAV:\", frame.url))\n page.on(\"frameattached\", lambda frame: print(\"ATTACHED:\", frame.url))\n page.on(\"framedetached\", lambda frame: print(\"DETACHED:\", frame.url))\n\n print(f\"Going to {testCfg['startUrl']}\")\n page.goto(testCfg['startUrl'])\n\n if testCfg.get(\"beforeHook\") is not None:\n if testCfg['loginSpawnsNewPage']:\n print(\"Login spawns new page\")\n # The with clause handles window.open() or .\n with context.expect_page() as p:\n exec(testCfg.get(\"beforeHook\"))\n page = p.value\n else:\n exec(testCfg.get(\"beforeHook\"))\n\n if u['username'] is not None:\n print(f\"Filling field username with {u['username']}\")\n page.${cfg.usernameFieldSelector}.fill(u['username'])\n if u['password'] is not None:\n print(f\"Filling field password with {u['password']}\")\n page.${cfg.passwordFieldSelector}.fill(u['password'])\n\n # Assumes we don't need to login, so skip this.\n if u['username'] is not None or u['password'] is not None:\n print(f\"Clicking button {testCfg['loginButtonNameRegex']}\")\n page.get_by_role(\"button\", name=re.compile(testCfg['loginButtonNameRegex'])).click()\n\n for line in u['nextPageExpect']:\n print(f\"Running: {line}\")\n print(f\"Page has title: {page.title()}\")\n exec(line)\n finally:\n print(f'Saving trace at trace/{i}.zip')\n context.tracing.stop(path=f\"trace/{i}.zip\")\n\n browser.close()\n ''\n )\n )\n ];\n };\n };\n\n backup =\n backupOption:\n { config, ... }:\n {\n imports = [\n ../modules/blocks/restic.nix\n ];\n shb.restic.instances.\"testinstance\" = {\n request = backupOption.request;\n settings = {\n enable = true;\n passphrase.result = config.shb.hardcodedsecret.backupPassphrase.result;\n repository = {\n path = \"/opt/repos/A\";\n timerConfig = {\n OnCalendar = \"00:00:00\";\n RandomizedDelaySec = \"5h\";\n };\n };\n };\n };\n shb.hardcodedsecret.backupPassphrase = {\n request = config.shb.restic.instances.\"testinstance\".settings.passphrase.request;\n settings.content = \"PassPhrase\";\n };\n };\n\n certs =\n { config, ... }:\n {\n imports = [\n ../modules/blocks/ssl.nix\n ];\n\n shb.certs = {\n cas.selfsigned.myca = {\n name = \"My CA\";\n };\n certs.selfsigned = {\n n = {\n ca = config.shb.certs.cas.selfsigned.myca;\n domain = \"*.${config.test.domain}\";\n group = \"nginx\";\n };\n };\n };\n\n systemd.services.nginx.after = [ config.shb.certs.certs.selfsigned.n.systemdService ];\n systemd.services.nginx.requires = [ config.shb.certs.certs.selfsigned.n.systemdService ];\n };\n\n ldap =\n { config, pkgs, ... }:\n {\n imports = [\n ../modules/blocks/lldap.nix\n ];\n\n networking.hosts = {\n \"127.0.0.1\" = [ \"ldap.${config.test.domain}\" ];\n };\n\n shb.hardcodedsecret.ldapUserPassword = {\n request = config.shb.lldap.ldapUserPassword.request;\n settings.content = \"ldapUserPassword\";\n };\n shb.hardcodedsecret.jwtSecret = {\n request = config.shb.lldap.jwtSecret.request;\n settings.content = \"jwtSecrets\";\n };\n\n shb.lldap = {\n enable = true;\n inherit (config.test) domain;\n subdomain = \"ldap\";\n ldapPort = 3890;\n webUIListenPort = 17170;\n dcdomain = \"dc=example,dc=com\";\n ldapUserPassword.result = config.shb.hardcodedsecret.ldapUserPassword.result;\n jwtSecret.result = config.shb.hardcodedsecret.jwtSecret.result;\n debug = false; # Enable this if needed, but beware it is _very_ verbose.\n\n ensureUsers = {\n alice = {\n email = \"alice@example.com\";\n groups = [ \"user_group\" ];\n password.result.path = pkgs.writeText \"alicePassword\" \"AlicePassword\";\n };\n bob = {\n email = \"bob@example.com\";\n # Purposely not adding bob to the user_group\n # so we can make sure users only part admins\n # can also login normally.\n groups = [ \"admin_group\" ];\n password.result.path = pkgs.writeText \"bobPassword\" \"BobPassword\";\n };\n charlie = {\n email = \"charlie@example.com\";\n groups = [ \"other_group\" ];\n password.result.path = pkgs.writeText \"charliePassword\" \"CharliePassword\";\n };\n };\n\n ensureGroups = {\n user_group = { };\n admin_group = { };\n other_group = { };\n };\n };\n };\n\n sso =\n ssl:\n { config, pkgs, ... }:\n {\n imports = [\n ../modules/blocks/authelia.nix\n ];\n\n networking.hosts = {\n \"127.0.0.1\" = [ \"${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\" ];\n };\n\n shb.authelia = {\n enable = true;\n inherit (config.test) domain;\n subdomain = \"auth\";\n ssl = config.shb.certs.certs.selfsigned.n;\n debug = true;\n\n ldapHostname = \"127.0.0.1\";\n ldapPort = config.shb.lldap.ldapPort;\n dcdomain = config.shb.lldap.dcdomain;\n\n secrets = {\n jwtSecret.result = config.shb.hardcodedsecret.autheliaJwtSecret.result;\n ldapAdminPassword.result = config.shb.hardcodedsecret.ldapAdminPassword.result;\n sessionSecret.result = config.shb.hardcodedsecret.sessionSecret.result;\n storageEncryptionKey.result = config.shb.hardcodedsecret.storageEncryptionKey.result;\n identityProvidersOIDCHMACSecret.result =\n config.shb.hardcodedsecret.identityProvidersOIDCHMACSecret.result;\n identityProvidersOIDCIssuerPrivateKey.result =\n config.shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey.result;\n };\n };\n\n shb.hardcodedsecret.autheliaJwtSecret = {\n request = config.shb.authelia.secrets.jwtSecret.request;\n settings.content = \"jwtSecret\";\n };\n shb.hardcodedsecret.ldapAdminPassword = {\n request = config.shb.authelia.secrets.ldapAdminPassword.request;\n settings.content = \"ldapUserPassword\";\n };\n shb.hardcodedsecret.sessionSecret = {\n request = config.shb.authelia.secrets.sessionSecret.request;\n settings.content = \"sessionSecret\";\n };\n shb.hardcodedsecret.storageEncryptionKey = {\n request = config.shb.authelia.secrets.storageEncryptionKey.request;\n settings.content = \"storageEncryptionKey\";\n };\n shb.hardcodedsecret.identityProvidersOIDCHMACSecret = {\n request = config.shb.authelia.secrets.identityProvidersOIDCHMACSecret.request;\n settings.content = \"identityProvidersOIDCHMACSecret\";\n };\n shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey = {\n request = config.shb.authelia.secrets.identityProvidersOIDCIssuerPrivateKey.request;\n settings.source =\n (pkgs.runCommand \"gen-private-key\" { } ''\n mkdir $out\n ${pkgs.openssl}/bin/openssl genrsa -out $out/private.pem 4096\n '')\n + \"/private.pem\";\n };\n };\n\n}\n"
},
{
"path": "test/contracts/backup.nix",
"content": "{ shb, ... }:\n{\n restic_root = shb.contracts.test.backup {\n name = \"restic_root\";\n username = \"root\";\n providerRoot = [\n \"shb\"\n \"restic\"\n \"instances\"\n \"mytest\"\n ];\n modules = [\n ../../modules/blocks/restic.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n settings =\n { repository, config, ... }:\n {\n enable = true;\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n repository = {\n path = repository;\n timerConfig = {\n OnCalendar = \"00:00:00\";\n };\n };\n };\n extraConfig =\n { username, config, ... }:\n {\n shb.hardcodedsecret.passphrase = {\n request = config.shb.restic.instances.\"mytest\".settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n };\n };\n\n restic_nonroot = shb.contracts.test.backup {\n name = \"restic_nonroot\";\n username = \"me\";\n providerRoot = [\n \"shb\"\n \"restic\"\n \"instances\"\n \"mytest\"\n ];\n modules = [\n ../../modules/blocks/restic.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n settings =\n { repository, config, ... }:\n {\n enable = true;\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n repository = {\n path = repository;\n timerConfig = {\n OnCalendar = \"00:00:00\";\n };\n };\n };\n extraConfig =\n { username, config, ... }:\n {\n shb.hardcodedsecret.passphrase = {\n request = config.shb.restic.instances.\"mytest\".settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n };\n };\n\n borgbackup_root = shb.contracts.test.backup {\n name = \"borgbackup_root\";\n username = \"root\";\n providerRoot = [\n \"shb\"\n \"borgbackup\"\n \"instances\"\n \"mytest\"\n ];\n modules = [\n ../../modules/blocks/borgbackup.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n settings =\n { repository, config, ... }:\n {\n enable = true;\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n repository = {\n path = repository;\n timerConfig = {\n OnCalendar = \"00:00:00\";\n };\n };\n };\n extraConfig =\n { username, config, ... }:\n {\n shb.hardcodedsecret.passphrase = {\n request = config.shb.borgbackup.instances.\"mytest\".settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n };\n };\n\n borgbackup_nonroot = shb.contracts.test.backup {\n name = \"borgbackup_nonroot\";\n username = \"me\";\n providerRoot = [\n \"shb\"\n \"borgbackup\"\n \"instances\"\n \"mytest\"\n ];\n modules = [\n ../../modules/blocks/borgbackup.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n settings =\n { repository, config, ... }:\n {\n enable = true;\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n repository = {\n path = repository;\n timerConfig = {\n OnCalendar = \"00:00:00\";\n };\n };\n };\n extraConfig =\n { username, config, ... }:\n {\n shb.hardcodedsecret.passphrase = {\n request = config.shb.borgbackup.instances.\"mytest\".settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n };\n };\n}\n"
},
{
"path": "test/contracts/databasebackup.nix",
"content": "{ shb, ... }:\n{\n restic_postgres = shb.contracts.test.databasebackup {\n name = \"restic_postgres\";\n requesterRoot = [\n \"shb\"\n \"postgresql\"\n \"databasebackup\"\n ];\n providerRoot = [\n \"shb\"\n \"restic\"\n \"databases\"\n \"postgresql\"\n ];\n modules = [\n ../../modules/blocks/postgresql.nix\n ../../modules/blocks/restic.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n settings =\n { repository, config, ... }:\n {\n enable = true;\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n repository = {\n path = repository;\n timerConfig = {\n OnCalendar = \"00:00:00\";\n };\n };\n };\n extraConfig =\n { config, database, ... }:\n {\n shb.postgresql.ensures = [\n {\n inherit database;\n username = database;\n }\n ];\n shb.hardcodedsecret.passphrase = {\n request = config.shb.restic.databases.postgresql.settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n };\n };\n\n borgbackup_postgres = shb.contracts.test.databasebackup {\n name = \"borgbackup_postgres\";\n requesterRoot = [\n \"shb\"\n \"postgresql\"\n \"databasebackup\"\n ];\n providerRoot = [\n \"shb\"\n \"borgbackup\"\n \"databases\"\n \"postgresql\"\n ];\n modules = [\n ../../modules/blocks/postgresql.nix\n ../../modules/blocks/borgbackup.nix\n ../../modules/blocks/hardcodedsecret.nix\n ];\n settings =\n { repository, config, ... }:\n {\n enable = true;\n stateDir = \"/var/lib/borgbackup_postgres\";\n passphrase.result = config.shb.hardcodedsecret.passphrase.result;\n repository = {\n path = repository;\n timerConfig = {\n OnCalendar = \"00:00:00\";\n };\n };\n };\n extraConfig =\n { config, database, ... }:\n {\n shb.postgresql.ensures = [\n {\n inherit database;\n username = database;\n }\n ];\n shb.hardcodedsecret.passphrase = {\n request = config.shb.borgbackup.databases.postgresql.settings.passphrase.request;\n settings.content = \"passphrase\";\n };\n };\n };\n}\n"
},
{
"path": "test/contracts/secret/sops.yaml",
"content": ""
},
{
"path": "test/contracts/secret.nix",
"content": "{ shb, ... }:\n{\n hardcoded_root_root = shb.contracts.test.secret {\n name = \"hardcoded\";\n modules = [ ../../modules/blocks/hardcodedsecret.nix ];\n configRoot = [\n \"shb\"\n \"hardcodedsecret\"\n ];\n settingsCfg = secret: {\n content = secret;\n };\n };\n\n hardcoded_user_group = shb.contracts.test.secret {\n name = \"hardcoded\";\n modules = [ ../../modules/blocks/hardcodedsecret.nix ];\n configRoot = [\n \"shb\"\n \"hardcodedsecret\"\n ];\n settingsCfg = secret: {\n content = secret;\n };\n owner = \"user\";\n group = \"group\";\n mode = \"640\";\n };\n\n # TODO: how to do this?\n # sops = shb.contracts.test.secret {\n # name = \"sops\";\n # configRoot = cfg: name: cfg.sops.secrets.${name};\n # createContent = content: {\n # sopsFile = ./secret/sops.yaml;\n # };\n # };\n}\n"
},
{
"path": "test/modules/davfs.nix",
"content": "{ pkgs, lib, ... }:\nlet\n anyOpt =\n default:\n lib.mkOption {\n type = lib.types.anything;\n inherit default;\n };\n\n testConfig =\n m:\n let\n cfg =\n (lib.evalModules {\n specialArgs = { inherit pkgs; };\n modules = [\n {\n options = {\n systemd = anyOpt { };\n services = anyOpt { };\n };\n }\n ../../modules/blocks/davfs.nix\n m\n ];\n }).config;\n in\n {\n inherit (cfg) systemd services;\n };\nin\n{\n testDavfsNoOptions = {\n expected = {\n services.davfs2.enable = false;\n systemd.mounts = [ ];\n };\n expr = testConfig { };\n };\n}\n"
},
{
"path": "test/modules/homepage.nix",
"content": "{ shb }:\n{\n testHomepageAsServiceGroup = {\n expected = [\n {\n \"Media\" = [\n {\n \"Jellyfin\" = {\n \"href\" = \"https://example.com/jellyfin\";\n \"icon\" = \"sh-jellyfin\";\n \"siteMonitor\" = \"http://127.0.0.1:8096\";\n };\n }\n ];\n }\n ];\n\n expr = shb.homepage.asServiceGroup {\n Media = {\n services = {\n Jellyfin = {\n dashboard.request = {\n externalUrl = \"https://example.com/jellyfin\";\n internalUrl = \"http://127.0.0.1:8096\";\n };\n apiKey = null;\n };\n };\n };\n };\n };\n\n testHomepageAsServiceGroupApiKey = {\n expected = [\n {\n \"Media\" = [\n {\n \"Jellyfin\" = {\n \"href\" = \"https://example.com/jellyfin\";\n \"icon\" = \"sh-jellyfin\";\n \"siteMonitor\" = \"http://127.0.0.1:8096\";\n \"widget\" = {\n \"key\" = \"{{HOMEPAGE_FILE_Media_Jellyfin}}\";\n \"password\" = \"{{HOMEPAGE_FILE_Media_Jellyfin}}\";\n \"type\" = \"jellyfin\";\n \"url\" = \"http://127.0.0.1:8096\";\n };\n };\n }\n ];\n }\n ];\n\n expr = shb.homepage.asServiceGroup {\n Media = {\n services = {\n Jellyfin = {\n dashboard.request = {\n externalUrl = \"https://example.com/jellyfin\";\n internalUrl = \"http://127.0.0.1:8096\";\n };\n apiKey.result.path = \"path_D\";\n };\n };\n };\n };\n };\n\n testHomepageAsServiceGroupNoServiceMonitor = {\n expected = [\n {\n \"Media\" = [\n {\n \"Jellyfin\" = {\n \"href\" = \"https://example.com/jellyfin\";\n \"icon\" = \"sh-jellyfin\";\n \"siteMonitor\" = null;\n };\n }\n ];\n }\n ];\n\n expr = shb.homepage.asServiceGroup {\n Media = {\n services = {\n Jellyfin = {\n dashboard.request = {\n externalUrl = \"https://example.com/jellyfin\";\n internalUrl = null;\n };\n apiKey = null;\n };\n };\n };\n };\n };\n\n testHomepageAsServiceGroupOverride = {\n expected = [\n {\n \"Media\" = [\n {\n \"Jellyfin\" = {\n \"href\" = \"https://example.com/jellyfin\";\n \"icon\" = \"sh-icon\";\n \"siteMonitor\" = \"http://127.0.0.1:8096\";\n };\n }\n ];\n }\n ];\n\n expr = shb.homepage.asServiceGroup {\n Media = {\n services = {\n Jellyfin = {\n dashboard.request = {\n externalUrl = \"https://example.com/jellyfin\";\n internalUrl = \"http://127.0.0.1:8096\";\n };\n settings = {\n icon = \"sh-icon\";\n };\n apiKey = null;\n };\n };\n };\n };\n };\n\n testHomepageAsServiceGroupSortOrder = {\n expected = [\n { \"C\" = [ ]; }\n { \"A\" = [ ]; }\n { \"B\" = [ ]; }\n ];\n\n expr = shb.homepage.asServiceGroup {\n A = {\n sortOrder = 2;\n services = { };\n };\n B = {\n sortOrder = 3;\n services = { };\n };\n C = {\n sortOrder = 1;\n services = { };\n };\n };\n };\n\n testHomepageAsServiceServicesSortOrder = {\n expected = [\n {\n \"Media\" = [\n {\n \"A\" = {\n \"href\" = \"https://example.com/a\";\n \"icon\" = \"sh-a\";\n \"siteMonitor\" = null;\n };\n }\n {\n \"C\" = {\n \"href\" = \"https://example.com/c\";\n \"icon\" = \"sh-c\";\n \"siteMonitor\" = null;\n };\n }\n {\n \"B\" = {\n \"href\" = \"https://example.com/b\";\n \"icon\" = \"sh-b\";\n \"siteMonitor\" = null;\n };\n }\n ];\n }\n ];\n\n expr = shb.homepage.asServiceGroup {\n Media = {\n sortOrder = null;\n services = {\n A = {\n sortOrder = 1;\n dashboard.request = {\n externalUrl = \"https://example.com/a\";\n internalUrl = null;\n };\n apiKey = null;\n };\n B = {\n sortOrder = 3;\n dashboard.request = {\n externalUrl = \"https://example.com/b\";\n internalUrl = null;\n };\n apiKey = null;\n };\n C = {\n sortOrder = 2;\n dashboard.request = {\n externalUrl = \"https://example.com/c\";\n internalUrl = null;\n };\n apiKey = null;\n };\n };\n };\n };\n };\n\n testHomepageAllKeys = {\n expected = {\n \"A_A\" = \"path_A\";\n \"A_B\" = \"path_B\";\n \"B_D\" = \"path_D\";\n };\n\n expr = shb.homepage.allKeys {\n A = {\n sortOrder = 1;\n services = {\n A = {\n sortOrder = 1;\n dashboard.request = {\n externalUrl = \"https://example.com/a\";\n internalUrl = null;\n };\n apiKey.result.path = \"path_A\";\n };\n B = {\n sortOrder = 2;\n dashboard.request = {\n externalUrl = \"https://example.com/b\";\n internalUrl = null;\n };\n apiKey.result.path = \"path_B\";\n };\n };\n };\n B = {\n sortOrder = 2;\n services = {\n C = {\n sortOrder = 1;\n dashboard.request = {\n externalUrl = \"https://example.com/a\";\n internalUrl = null;\n };\n apiKey = null;\n };\n D = {\n sortOrder = 2;\n dashboard.request = {\n externalUrl = \"https://example.com/b\";\n internalUrl = null;\n };\n apiKey.result.path = \"path_D\";\n };\n };\n };\n };\n };\n}\n"
},
{
"path": "test/modules/lib.nix",
"content": "{ lib, shb, ... }:\nlet\n inherit (lib) nameValuePair;\nin\n{\n # Tests that withReplacements can:\n # - recurse in attrs and lists\n # - .source field is understood\n # - .transform field is understood\n # - if .source field is found, ignores other fields\n testLibWithReplacements = {\n expected =\n let\n item = root: {\n a = \"A\";\n b = \"%SECRET_${root}B%\";\n c = \"%SECRET_${root}C%\";\n };\n in\n (item \"\")\n // {\n nestedAttr = item \"NESTEDATTR_\";\n nestedList = [ (item \"NESTEDLIST_0_\") ];\n doubleNestedList = [ { n = (item \"DOUBLENESTEDLIST_0_N_\"); } ];\n };\n expr =\n let\n item = {\n a = \"A\";\n b.source = \"/path/B\";\n b.transform = null;\n c.source = \"/path/C\";\n c.transform = v: \"prefix-${v}-suffix\";\n c.other = \"other\";\n };\n in\n shb.withReplacements (\n item\n // {\n nestedAttr = item;\n nestedList = [ item ];\n doubleNestedList = [ { n = item; } ];\n }\n );\n };\n\n testLibWithReplacementsRootList = {\n expected =\n let\n item = root: {\n a = \"A\";\n b = \"%SECRET_${root}B%\";\n c = \"%SECRET_${root}C%\";\n };\n in\n [\n (item \"0_\")\n (item \"1_\")\n [ (item \"2_0_\") ]\n [ { n = (item \"3_0_N_\"); } ]\n ];\n expr =\n let\n item = {\n a = \"A\";\n b.source = \"/path/B\";\n b.transform = null;\n c.source = \"/path/C\";\n c.transform = v: \"prefix-${v}-suffix\";\n c.other = \"other\";\n };\n in\n shb.withReplacements [\n item\n item\n [ item ]\n [ { n = item; } ]\n ];\n };\n\n testLibGetReplacements = {\n expected =\n let\n secrets = root: [\n (nameValuePair \"%SECRET_${root}B%\" \"$(cat /path/B)\")\n (nameValuePair \"%SECRET_${root}C%\" \"prefix-$(cat /path/C)-suffix\")\n ];\n in\n (secrets \"\")\n ++ (secrets \"DOUBLENESTEDLIST_0_N_\")\n ++ (secrets \"NESTEDATTR_\")\n ++ (secrets \"NESTEDLIST_0_\");\n expr =\n let\n item = {\n a = \"A\";\n b.source = \"/path/B\";\n b.transform = null;\n c.source = \"/path/C\";\n c.transform = v: \"prefix-${v}-suffix\";\n c.other = \"other\";\n };\n in\n map shb.genReplacement (\n shb.getReplacements (\n item\n // {\n nestedAttr = item;\n nestedList = [ item ];\n doubleNestedList = [ { n = item; } ];\n }\n )\n );\n };\n\n testParseXML = {\n expected = {\n \"a\" = {\n \"b\" = \"1\";\n \"c\" = {\n \"d\" = \"1\";\n };\n };\n };\n\n expr = shb.parseXML ''\n \n 1\n 1\n \n '';\n };\n}\n// import ./homepage.nix { inherit shb; }\n"
},
{
"path": "test/services/arr.nix",
"content": "{\n pkgs,\n lib,\n shb,\n ...\n}:\nlet\n healthUrl = \"/health\";\n loginUrl = \"/UI/Login\";\n\n # TODO: Test login\n commonTestScript =\n appname: cfgPathFn:\n shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.arr.${appname}.ssl);\n waitForServices =\n { ... }:\n [\n \"${appname}.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.arr.${appname}.settings.Port\n ];\n extraScript =\n {\n node,\n fqdn,\n proto_fqdn,\n ...\n }:\n let\n shbapp = node.config.shb.arr.${appname};\n cfgPath = cfgPathFn shbapp;\n apiKey = if (shbapp.settings ? ApiKey) then \"01234567890123456789\" else null;\n in\n ''\n # These curl requests still return a 200 even with sso redirect.\n with subtest(\"health\"):\n response = curl(client, \"\"\"{\"code\":%{response_code}}\"\"\", \"${fqdn}${healthUrl}\")\n print(\"response =\", response)\n\n if response['code'] != 200:\n raise Exception(f\"Code is {response['code']}\")\n\n with subtest(\"login\"):\n response = curl(client, \"\"\"{\"code\":%{response_code}}\"\"\", \"${fqdn}${loginUrl}\")\n\n if response['code'] != 200:\n raise Exception(f\"Code is {response['code']}\")\n ''\n + lib.optionalString (apiKey != null && cfgPath != null) ''\n\n with subtest(\"apikey\"):\n config = server.succeed(\"cat ${cfgPath}\")\n if \"${apiKey}\" not in config:\n raise Exception(f\"Unexpected API Key. Want '${apiKey}', got '{config}'\")\n '';\n };\n\n basic =\n appname:\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/arr.nix\n ];\n\n test = {\n subdomain = appname;\n };\n\n shb.arr.${appname} = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n settings.ApiKey.source = pkgs.writeText \"APIKey\" \"01234567890123456789\"; # Needs to be >=20 characters.\n };\n };\n\n clientLogin =\n appname:\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n\n test = {\n subdomain = appname;\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"[Uu]sername\";\n passwordFieldLabelRegex = \"^ *[Pp]assword\";\n loginButtonNameRegex = \"[Ll]og [Ii]n\";\n testLoginWith = [\n {\n nextPageExpect = [\n \"expect(page).to_have_title(re.compile('${appname}', re.IGNORECASE))\"\n ];\n }\n ];\n };\n };\n\n basicTest =\n appname: cfgPathFn:\n shb.test.runNixOSTest {\n name = \"arr_${appname}_basic\";\n\n nodes.client = {\n imports = [\n (clientLogin appname)\n ];\n };\n nodes.server = {\n imports = [\n (basic appname)\n ];\n };\n\n testScript = (commonTestScript appname cfgPathFn).access;\n };\n\n backupTest =\n appname: cfgPathFn:\n shb.test.runNixOSTest {\n name = \"arr_${appname}_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n (basic appname)\n (shb.test.backup config.shb.arr.${appname}.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = (commonTestScript appname cfgPathFn).backup;\n };\n\n https =\n appname:\n { config, ... }:\n {\n shb.arr.${appname} = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n httpsTest =\n appname: cfgPathFn:\n shb.test.runNixOSTest {\n name = \"arr_${appname}_https\";\n\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n (basic appname)\n shb.test.certs\n (https appname)\n ];\n };\n\n nodes.client = { };\n\n testScript = (commonTestScript appname cfgPathFn).access;\n };\n\n sso =\n appname:\n { config, ... }:\n {\n shb.arr.${appname} = {\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\n\n ssoTest =\n appname: cfgPathFn:\n shb.test.runNixOSTest {\n name = \"arr_${appname}_sso\";\n\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n (basic appname)\n shb.test.certs\n (https appname)\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n (sso appname)\n ];\n };\n\n nodes.client = { };\n\n testScript = (commonTestScript appname cfgPathFn).access.override {\n redirectSSO = true;\n };\n };\n\n radarrCfgFn = cfg: \"${cfg.dataDir}/config.xml\";\n sonarrCfgFn = cfg: \"${cfg.dataDir}/config.xml\";\n bazarrCfgFn = cfg: null;\n readarrCfgFn = cfg: \"${cfg.dataDir}/config.xml\";\n lidarrCfgFn = cfg: \"${cfg.dataDir}/config.xml\";\n jackettCfgFn = cfg: \"${cfg.dataDir}/ServerConfig.json\";\nin\n{\n radarr_basic = basicTest \"radarr\" radarrCfgFn;\n radarr_backup = backupTest \"radarr\" radarrCfgFn;\n radarr_https = httpsTest \"radarr\" radarrCfgFn;\n radarr_sso = ssoTest \"radarr\" radarrCfgFn;\n\n sonarr_basic = basicTest \"sonarr\" sonarrCfgFn;\n sonarr_backup = backupTest \"sonarr\" sonarrCfgFn;\n sonarr_https = httpsTest \"sonarr\" sonarrCfgFn;\n sonarr_sso = ssoTest \"sonarr\" sonarrCfgFn;\n\n bazarr_basic = basicTest \"bazarr\" bazarrCfgFn;\n bazarr_backup = backupTest \"bazarr\" bazarrCfgFn;\n bazarr_https = httpsTest \"bazarr\" bazarrCfgFn;\n bazarr_sso = ssoTest \"bazarr\" bazarrCfgFn;\n\n readarr_basic = basicTest \"readarr\" readarrCfgFn;\n readarr_backup = backupTest \"readarr\" readarrCfgFn;\n readarr_https = httpsTest \"readarr\" readarrCfgFn;\n readarr_sso = ssoTest \"readarr\" readarrCfgFn;\n\n lidarr_basic = basicTest \"lidarr\" lidarrCfgFn;\n lidarr_backup = backupTest \"lidarr\" lidarrCfgFn;\n lidarr_https = httpsTest \"lidarr\" lidarrCfgFn;\n lidarr_sso = ssoTest \"lidarr\" lidarrCfgFn;\n\n jackett_basic = basicTest \"jackett\" jackettCfgFn;\n jackett_backup = backupTest \"jackett\" jackettCfgFn;\n jackett_https = httpsTest \"jackett\" jackettCfgFn;\n jackett_sso = ssoTest \"jackett\" jackettCfgFn;\n}\n"
},
{
"path": "test/services/audiobookshelf.nix",
"content": "{ shb, ... }:\nlet\n commonTestScript = shb.test.accessScript {\n hasSSL = { node, ... }: !(isNull node.config.shb.audiobookshelf.ssl);\n waitForServices =\n { ... }:\n [\n \"audiobookshelf.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.audiobookshelf.webPort\n ];\n # TODO: Test login\n # extraScript = { ... }: ''\n # '';\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/audiobookshelf.nix\n ];\n\n test = {\n subdomain = \"a\";\n };\n shb.audiobookshelf = {\n enable = true;\n inherit (config.test) subdomain domain;\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"a\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"[Uu]sername\";\n passwordFieldLabelRegex = \"[Pp]assword\";\n loginButtonNameRegex = \"[Ll]og [Ii]n\";\n testLoginWith = [\n # Failure is after so we're not throttled too much.\n {\n username = \"root\";\n password = \"rootpw\";\n nextPageExpect = [\n \"expect(page.get_by_text('Wrong username or password')).to_be_visible()\"\n ];\n }\n # { username = adminUser; password = adminPass; nextPageExpect = [\n # \"expect(page.get_by_text('Wrong username or password')).not_to_be_visible()\"\n # \"expect(page.get_by_role('button', name=re.compile('[Ll]og [Ii]n'))).not_to_be_visible()\"\n # \"expect(page).to_have_title(re.compile('Dashboard'))\"\n # ]; }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.audiobookshelf = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.audiobookshelf = {\n sso = {\n enable = true;\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n sharedSecret.result = config.shb.hardcodedsecret.audiobookshelfSSOPassword.result;\n sharedSecretForAuthelia.result =\n config.shb.hardcodedsecret.audiobookshelfSSOPasswordAuthelia.result;\n };\n };\n\n shb.hardcodedsecret.audiobookshelfSSOPassword = {\n request = config.shb.audiobookshelf.sso.sharedSecret.request;\n settings.content = \"ssoPassword\";\n };\n\n shb.hardcodedsecret.audiobookshelfSSOPasswordAuthelia = {\n request = config.shb.audiobookshelf.sso.sharedSecretForAuthelia.request;\n settings.content = \"ssoPassword\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"audiobookshelf-basic\";\n\n nodes.client = {\n imports = [\n # TODO: enable this when declarative user management is possible.\n # clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript;\n };\n\n https = shb.test.runNixOSTest {\n name = \"audiobookshelf-https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"audiobookshelf-sso\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n}\n"
},
{
"path": "test/services/deluge.nix",
"content": "{\n pkgs,\n lib,\n shb,\n ...\n}:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.deluge.ssl);\n waitForServices =\n { ... }:\n [\n \"nginx.service\"\n \"deluged.service\"\n \"delugeweb.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.deluge.daemonPort\n node.config.shb.deluge.webPort\n ];\n extraScript =\n { node, proto_fqdn, ... }:\n ''\n print(${node.name}.succeed('journalctl -n100 -u deluged'))\n print(${node.name}.succeed('systemctl status deluged'))\n print(${node.name}.succeed('systemctl status delugeweb'))\n\n with subtest(\"web connect\"):\n print(server.succeed(\"cat ${node.config.services.deluge.dataDir}/.config/deluge/auth\"))\n\n response = curl(client, \"\", \"${proto_fqdn}/json\", extra = unline_with(\" \", \"\"\"\n -H \"Content-Type: application/json\"\n -H \"Accept: application/json\"\n \"\"\"), data = unline_with(\" \", \"\"\"\n {\"method\": \"auth.login\", \"params\": [\"deluge\"], \"id\": 1}\n \"\"\"))\n print(response)\n if response['error']:\n raise Exception(f\"error is {response['error']}\")\n if not response['result']:\n raise Exception(f\"response is {response}\")\n\n response = curl(client, \"\", \"${proto_fqdn}/json\", extra = unline_with(\" \", \"\"\"\n -H \"Content-Type: application/json\"\n -H \"Accept: application/json\"\n \"\"\"), data = unline_with(\" \", \"\"\"\n {\"method\": \"web.get_hosts\", \"params\": [], \"id\": 1}\n \"\"\"))\n print(response)\n if response['error']:\n raise Exception(f\"error is {response['error']}\")\n\n hostID = response['result'][0][0]\n response = curl(client, \"\", \"${proto_fqdn}/json\", extra = unline_with(\" \", \"\"\"\n -H \"Content-Type: application/json\"\n -H \"Accept: application/json\"\n \"\"\"), data = unline_with(\" \", f\"\"\"\n {{\"method\": \"web.connect\", \"params\": [\"{hostID}\"], \"id\": 1}}\n \"\"\"))\n print(response)\n if response['error']:\n raise Exception(f\"result had an error {response['error']}\")\n '';\n };\n\n prometheusTestScript =\n { nodes, ... }:\n ''\n server.wait_for_open_port(${toString nodes.server.services.prometheus.exporters.deluge.port})\n with subtest(\"prometheus\"):\n response = server.succeed(\n \"curl -sSf \"\n + \" http://localhost:${toString nodes.server.services.prometheus.exporters.deluge.port}/metrics\"\n )\n print(response)\n '';\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/deluge.nix\n ];\n\n test = {\n subdomain = \"d\";\n };\n\n shb.deluge = {\n enable = true;\n inherit (config.test) domain subdomain;\n\n settings = {\n downloadLocation = \"/var/lib/deluge\";\n };\n\n extraUsers = {\n user.password.source = pkgs.writeText \"userpw\" \"userpw\";\n };\n\n localclientPassword.result = config.shb.hardcodedsecret.\"localclientpassword\".result;\n };\n shb.hardcodedsecret.\"localclientpassword\" = {\n request = config.shb.deluge.localclientPassword.request;\n settings.content = \"localpw\";\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"d\";\n };\n\n test.login = {\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"Login\";\n testLoginWith = [\n {\n password = \"deluge\";\n nextPageExpect = [\n \"expect(page.get_by_role('button', name='Login')).not_to_be_visible()\"\n \"expect(page.get_by_text('Login Failed')).not_to_be_visible()\"\n ];\n }\n {\n password = \"other\";\n nextPageExpect = [\n \"expect(page.get_by_role('button', name='Login')).to_be_visible()\"\n \"expect(page.get_by_text('Login Failed')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n prometheus =\n { config, ... }:\n {\n shb.deluge = {\n prometheusScraperPassword.result = config.shb.hardcodedsecret.\"scraper\".result;\n };\n shb.hardcodedsecret.\"scraper\" = {\n request = config.shb.deluge.prometheusScraperPassword.request;\n settings.content = \"scraperpw\";\n };\n };\n\n https =\n { config, ... }:\n {\n shb.deluge = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.deluge = {\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"deluge_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"deluge_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.deluge.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"deluge_https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"deluge_sso\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access.override {\n redirectSSO = true;\n };\n };\n\n prometheus = shb.test.runNixOSTest {\n name = \"deluge_https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n prometheus\n ];\n };\n\n nodes.client = { };\n\n # The inputs attrset must be named out explicitly\n testScript =\n inputs@{ nodes, ... }: (commonTestScript.access inputs) + (prometheusTestScript inputs);\n };\n}\n"
},
{
"path": "test/services/firefly-iii.nix",
"content": "{ pkgs, shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.firefly-iii.ssl);\n waitForServices =\n { ... }:\n [\n \"phpfpm-firefly-iii.service\"\n \"phpfpm-firefly-iii-data-importer.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n # node.config.shb.firefly-iii.port\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/firefly-iii.nix\n ];\n\n test = {\n subdomain = \"f\";\n };\n\n shb.firefly-iii = {\n enable = true;\n debug = true;\n inherit (config.test) subdomain domain;\n siteOwnerEmail = \"mail@example.com\";\n appKey.result = config.shb.hardcodedsecret.appKey.result;\n dbPassword.result = config.shb.hardcodedsecret.dbPassword.result;\n importer.firefly-iii-accessToken.result = config.shb.hardcodedsecret.accessToken.result;\n };\n\n shb.hardcodedsecret.appKey = {\n request = config.shb.firefly-iii.appKey.request;\n # Firefly-iir requires this to be exactly 32 characters.\n settings.content = pkgs.lib.strings.replicate 32 \"Z\";\n };\n shb.hardcodedsecret.dbPassword = {\n request = config.shb.firefly-iii.dbPassword.request;\n settings.content = pkgs.lib.strings.replicate 64 \"Y\";\n };\n shb.hardcodedsecret.accessToken = {\n request = config.shb.firefly-iii.importer.firefly-iii-accessToken.request;\n settings.content = pkgs.lib.strings.replicate 64 \"X\";\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"f\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n # There is no login without SSO integration.\n testLoginWith = [\n {\n username = null;\n password = null;\n nextPageExpect = [\n \"expect(page.get_by_text('Register a new account')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n clientLoginDataImporter =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"f-importer\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n # There is no login without SSO integration.\n testLoginWith = [\n {\n username = null;\n password = null;\n nextPageExpect = [\n # The error to connect is expected since the access token must be created manually in Firefly-iii.\n \"expect(page.get_by_text('The importer could not connect')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.firefly-iii = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.firefly-iii = {\n ldap = {\n userGroup = \"user_group\";\n adminGroup = \"admin_group\";\n };\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"f\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Dashboard')).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Dashboard')).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"expect(page).to_have_url(re.compile('.*/authenticated'))\"\n ];\n }\n ];\n };\n };\n\n clientLoginSsoDataImporter =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"f-importer\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n # Only admins have access\n \"expect(page.get_by_text('Authenticated')).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n # The error to connect is expected since the access token must be created manually in Firefly-iii.\n \"expect(page.get_by_text('The importer could not connect')).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"expect(page).to_have_url(re.compile('.*/authenticated'))\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.firefly-iii = {\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"firefly-iii_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n data-importer_basic = shb.test.runNixOSTest {\n name = \"firefly-iii-data-importer_basic\";\n\n nodes.client = {\n imports = [\n clientLoginDataImporter\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"firefly-iii_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.firefly-iii.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"firefly-iii_https\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"firefly-iii_sso\";\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n testScript = commonTestScript.access.override {\n redirectSSO = true;\n };\n };\n\n data-importer_sso = shb.test.runNixOSTest {\n name = \"firefly-iii-data-importer_sso\";\n\n nodes.client = {\n imports = [\n clientLoginSsoDataImporter\n ];\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/forgejo.nix",
"content": "{ shb, ... }:\nlet\n adminPassword = \"AdminPassword\";\n\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.forgejo.ssl);\n waitForServices =\n { ... }:\n [\n \"forgejo.service\"\n \"nginx.service\"\n ];\n waitForUnixSocket =\n { node, ... }:\n [\n node.config.services.forgejo.settings.server.HTTP_ADDR\n ];\n extraScript =\n { node, ... }:\n ''\n server.wait_for_unit(\"gitea-runner-local.service\", timeout=10)\n server.succeed(\"journalctl -o cat -u gitea-runner-local.service | grep -q 'Runner registered successfully'\")\n '';\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/forgejo.nix\n ];\n\n test = {\n subdomain = \"f\";\n };\n\n shb.forgejo = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n users = {\n \"theadmin\" = {\n isAdmin = true;\n email = \"theadmin@example.com\";\n password.result = config.shb.hardcodedsecret.forgejoAdminPassword.result;\n };\n \"theuser\" = {\n email = \"theuser@example.com\";\n password.result = config.shb.hardcodedsecret.forgejoUserPassword.result;\n };\n };\n databasePassword.result = config.shb.hardcodedsecret.forgejoDatabasePassword.result;\n };\n\n # Needed for gitea-runner-local to be able to ping forgejo.\n networking.hosts = {\n \"127.0.0.1\" = [ \"${config.test.subdomain}.${config.test.domain}\" ];\n };\n\n shb.hardcodedsecret.forgejoAdminPassword = {\n request = config.shb.forgejo.users.\"theadmin\".password.request;\n settings.content = adminPassword;\n };\n\n shb.hardcodedsecret.forgejoUserPassword = {\n request = config.shb.forgejo.users.\"theuser\".password.request;\n settings.content = \"userPassword\";\n };\n\n shb.hardcodedsecret.forgejoDatabasePassword = {\n request = config.shb.forgejo.databasePassword.request;\n settings.content = \"databasePassword\";\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"f\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}/user/login\";\n usernameFieldLabelRegex = \"Username or email address\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"theadmin\";\n password = adminPassword + \"oops\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()\"\n ];\n }\n {\n username = \"theadmin\";\n password = adminPassword;\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n ];\n }\n {\n username = \"theuser\";\n password = \"userPasswordOops\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()\"\n ];\n }\n {\n username = \"theuser\";\n password = \"userPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.forgejo = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.forgejo = {\n ldap = {\n enable = true;\n host = \"127.0.0.1\";\n port = config.shb.lldap.ldapPort;\n dcdomain = config.shb.lldap.dcdomain;\n adminPassword.result = config.shb.hardcodedsecret.forgejoLdapUserPassword.result;\n waitForSystemdServices = [ \"lldap.service\" ];\n\n userGroup = \"user_group\";\n adminGroup = \"admin_group\";\n };\n };\n\n shb.hardcodedsecret.forgejoLdapUserPassword = {\n request = config.shb.forgejo.ldap.adminPassword.request;\n settings.content = \"ldapUserPassword\";\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.forgejo = {\n sso = {\n enable = true;\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n sharedSecret.result = config.shb.hardcodedsecret.forgejoSSOPassword.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.forgejoSSOPasswordAuthelia.result;\n };\n };\n\n shb.hardcodedsecret.forgejoSSOPassword = {\n request = config.shb.forgejo.sso.sharedSecret.request;\n settings.content = \"ssoPassword\";\n };\n\n shb.hardcodedsecret.forgejoSSOPasswordAuthelia = {\n request = config.shb.forgejo.sso.sharedSecretForAuthelia.request;\n settings.content = \"ssoPassword\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"forgejo_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"forgejo_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.forgejo.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"forgejo_https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n ldap = shb.test.runNixOSTest {\n name = \"forgejo_ldap\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.ldap\n ldap\n ];\n };\n\n nodes.client = {\n imports = [\n (\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n\n test = {\n subdomain = \"f\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}/user/login\";\n usernameFieldLabelRegex = \"Username or email address\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()\"\n ];\n }\n ];\n };\n }\n )\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"forgejo_sso\";\n\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n ldap\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/grocy.nix",
"content": "{ shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.grocy.ssl);\n waitForServices =\n { ... }:\n [\n \"phpfpm-grocy.service\"\n \"nginx.service\"\n ];\n waitForUnixSocket =\n { node, ... }:\n [\n node.config.services.phpfpm.pools.grocy.socket\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/grocy.nix\n ];\n\n test = {\n subdomain = \"g\";\n };\n\n shb.grocy = {\n enable = true;\n inherit (config.test) subdomain domain;\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"g\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"OK\";\n testLoginWith = [\n {\n username = \"admin\";\n password = \"admin oops\";\n nextPageExpect = [\n \"expect(page.get_by_text('Invalid credentials, please try again')).to_be_visible()\"\n ];\n }\n {\n username = \"admin\";\n password = \"admin\";\n nextPageExpect = [\n \"expect(page.get_by_text('Invalid credentials, please try again')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('OK'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Grocy'))\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.grocy = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"grocy_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n https = shb.test.runNixOSTest {\n name = \"grocy_https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/hledger.nix",
"content": "{ shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.hledger.ssl);\n waitForServices =\n { ... }:\n [\n \"hledger-web.service\"\n \"nginx.service\"\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/hledger.nix\n ];\n\n test = {\n subdomain = \"h\";\n };\n\n shb.hledger = {\n enable = true;\n inherit (config.test) subdomain domain;\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n\n test = {\n subdomain = \"h\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n testLoginWith = [\n {\n nextPageExpect = [\n \"expect(page).to_have_title('journal - hledger-web')\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.hledger = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.hledger = {\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"hledger_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"hledger_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.hledger.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"hledger_https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"hledger_sso\";\n\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access.override {\n redirectSSO = true;\n };\n };\n}\n"
},
{
"path": "test/services/home-assistant.nix",
"content": "{ pkgs, shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.home-assistant.ssl);\n waitForServices =\n { ... }:\n [\n \"home-assistant.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n 8123\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/home-assistant.nix\n ];\n\n test = {\n subdomain = \"ha\";\n };\n\n shb.home-assistant = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n config = {\n name = \"Tiserbox\";\n country = \"CH\";\n latitude = \"01.0000000000\";\n longitude.source = pkgs.writeText \"longitude\" \"01.0000000000\";\n time_zone = \"Europe/Zurich\";\n unit_system = \"metric\";\n };\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"ha\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n testLoginWith = [\n {\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Create my smart home')).click()\"\n\n \"expect(page.get_by_text('Create user')).to_be_visible()\"\n \"page.get_by_label(re.compile('Name')).fill('Admin')\"\n \"page.get_by_label(re.compile('Username')).fill('admin')\"\n \"page.get_by_label(re.compile('Password')).fill('adminpassword')\"\n \"page.get_by_label(re.compile('Confirm password')).fill('adminpassword')\"\n \"page.get_by_role('button', name=re.compile('Create account')).click()\"\n\n \"expect(page.get_by_text('All set!')).to_be_visible()\"\n \"page.get_by_role('button', name=re.compile('Finish')).click()\"\n\n \"expect(page).to_have_title(re.compile('Overview'), timeout=15000)\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.home-assistant = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.home-assistant = {\n ldap = {\n enable = true;\n host = \"127.0.0.1\";\n port = config.shb.lldap.webUIListenPort;\n userGroup = \"homeassistant_user\";\n };\n };\n };\n\n # Not yet supported\n #\n # sso = { config, ... }: {\n # shb.home-assistant = {\n # sso = {\n # };\n # };\n # };\n\n voice =\n { config, ... }:\n {\n # For now, verifying the packages can build is good enough.\n environment.systemPackages = [\n config.services.wyoming.piper.package\n config.services.wyoming.openwakeword.package\n config.services.wyoming.faster-whisper.package\n ];\n\n # TODO: enable this back. The issue id the services cannot talk to the internet\n # to download the models so they fail to start..\n # shb.home-assistant.voice.text-to-speech = {\n # \"fr\" = {\n # enable = true;\n # voice = \"fr-siwis-medium\";\n # uri = \"tcp://0.0.0.0:10200\";\n # speaker = 0;\n # };\n # \"en\" = {\n # enable = true;\n # voice = \"en_GB-alba-medium\";\n # uri = \"tcp://0.0.0.0:10201\";\n # speaker = 0;\n # };\n # };\n # shb.home-assistant.voice.speech-to-text = {\n # \"tiny-fr\" = {\n # enable = true;\n # model = \"base-int8\";\n # language = \"fr\";\n # uri = \"tcp://0.0.0.0:10300\";\n # device = \"cpu\";\n # };\n # \"tiny-en\" = {\n # enable = true;\n # model = \"base-int8\";\n # language = \"en\";\n # uri = \"tcp://0.0.0.0:10301\";\n # device = \"cpu\";\n # };\n # };\n # shb.home-assistant.voice.wakeword = {\n # enable = true;\n # uri = \"tcp://127.0.0.1:10400\";\n # preloadModels = [\n # \"alexa\"\n # \"hey_jarvis\"\n # \"hey_mycroft\"\n # \"hey_rhasspy\"\n # \"ok_nabu\"\n # ];\n # };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"homeassistant_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"homeassistant_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.home-assistant.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"homeassistant_https\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n ldap = shb.test.runNixOSTest {\n name = \"homeassistant_ldap\";\n\n nodes.server = {\n imports = [\n basic\n shb.test.ldap\n ldap\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n # Not yet supported\n #\n # sso = shb.test.runNixOSTest {\n # name = \"vaultwarden_sso\";\n #\n # nodes.server = lib.mkMerge [\n # basic\n # (shb.certs domain)\n # https\n # ldap\n # (shb.ldap domain pkgs')\n # (shb.test.sso domain pkgs' config.shb.certs.certs.selfsigned.n)\n # sso\n # ];\n #\n # nodes.client = {};\n #\n # testScript = commonTestScript.access;\n # };\n\n voice = shb.test.runNixOSTest {\n name = \"homeassistant_voice\";\n\n nodes.server = {\n imports = [\n basic\n voice\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/homepage.nix",
"content": "{ shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.homepage.ssl);\n waitForServices =\n { ... }:\n [\n \"homepage-dashboard.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.services.homepage-dashboard.listenPort\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/homepage.nix\n ];\n\n test = {\n subdomain = \"h\";\n };\n\n shb.homepage = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n servicesGroups.MyHomeGroup.services.TestService.dashboard = { };\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"h\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n # There is no login without SSO integration.\n testLoginWith = [\n {\n username = null;\n password = null;\n nextPageExpect = [\n \"expect(page.get_by_text('TestService')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.homepage = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.homepage = {\n ldap = {\n userGroup = \"user_group\";\n };\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"h\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('TestService')).to_be_visible(timeout=10000)\"\n ];\n }\n # Bob, with its admin role only, cannot login into Karakeep because admins do not exist in Karakeep.\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"expect(page).to_have_url(re.compile('.*/authenticated'))\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.homepage = {\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"homepage_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n https = shb.test.runNixOSTest {\n name = \"homepage_https\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"homepage_sso\";\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n testScript = commonTestScript.access.override {\n redirectSSO = true;\n };\n };\n}\n"
},
{
"path": "test/services/immich.nix",
"content": "{\n pkgs,\n lib,\n shb,\n}:\nlet\n subdomain = \"i\";\n domain = \"example.com\";\n\n commonTestScript = shb.test.accessScript {\n hasSSL = { node, ... }: !(isNull node.config.shb.immich.ssl);\n waitForServices =\n { ... }:\n [\n \"immich-server.service\"\n \"postgresql.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { ... }:\n [\n 2283\n 80\n ];\n waitForUrls = { proto_fqdn, ... }: [ \"${proto_fqdn}\" ];\n };\n\n base =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/immich.nix\n ];\n\n virtualisation.memorySize = 4096;\n virtualisation.cores = 2;\n\n test = {\n inherit subdomain domain;\n };\n\n shb.immich = {\n enable = true;\n inherit subdomain domain;\n\n debug = true;\n };\n\n # Required for tests\n environment.systemPackages = [ pkgs.curl ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [ base ];\n\n test.hasSSL = false;\n };\n\n https =\n { config, ... }:\n {\n imports = [\n base\n shb.test.certs\n ];\n\n test.hasSSL = true;\n shb.immich.ssl = config.shb.certs.certs.selfsigned.n;\n };\n\n backup =\n { config, ... }:\n {\n imports = [\n https\n (shb.test.backup config.shb.immich.backup)\n ];\n };\n\n sso =\n { config, ... }:\n {\n imports = [\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n ];\n\n shb.immich.sso = {\n enable = true;\n provider = \"Authelia\";\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n clientID = \"immich\";\n autoLaunch = true;\n sharedSecret.result = config.shb.hardcodedsecret.immichSSOSecret.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.immichSSOSecretAuthelia.result;\n };\n\n shb.hardcodedsecret.immichSSOSecret = {\n request = config.shb.immich.sso.sharedSecret.request;\n settings.content = \"immichSSOSecret\";\n };\n\n shb.hardcodedsecret.immichSSOSecretAuthelia = {\n request = config.shb.immich.sso.sharedSecretForAuthelia.request;\n settings.content = \"immichSSOSecret\";\n };\n\n # Configure LDAP groups for group-based access control\n shb.lldap.ensureGroups.immich_user = { };\n\n shb.lldap.ensureUsers.immich_test_user = {\n email = \"immich_user@example.com\";\n groups = [ \"immich_user\" ];\n password.result = config.shb.hardcodedsecret.ldapImmichUserPassword.result;\n };\n\n shb.lldap.ensureUsers.regular_test_user = {\n email = \"regular_user@example.com\";\n groups = [ ];\n password.result = config.shb.hardcodedsecret.ldapRegularUserPassword.result;\n };\n\n shb.hardcodedsecret.ldapImmichUserPassword = {\n request = config.shb.lldap.ensureUsers.immich_test_user.password.request;\n settings.content = \"immich_user_password\";\n };\n\n shb.hardcodedsecret.ldapRegularUserPassword = {\n request = config.shb.lldap.ensureUsers.regular_test_user.password.request;\n settings.content = \"regular_user_password\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"immich-basic\";\n\n nodes.server = basic;\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n https = shb.test.runNixOSTest {\n name = \"immich-https\";\n\n nodes.server = https;\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"immich-backup\";\n\n nodes.server = backup;\n nodes.client = { };\n\n testScript =\n (shb.test.mkScripts {\n hasSSL = args: !(isNull args.node.config.shb.immich.ssl);\n waitForServices = args: [\n \"immich-server.service\"\n \"postgresql.service\"\n \"nginx.service\"\n ];\n waitForPorts = args: [\n 2283\n 80\n ];\n waitForUrls = args: [ \"${args.proto_fqdn}\" ];\n }).backup;\n };\n}\n"
},
{
"path": "test/services/jellyfin.nix",
"content": "{ pkgs, shb, ... }:\nlet\n port = 9096;\n\n adminUser = \"jellyfin2\";\n adminPassword = \"admin\";\n\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.jellyfin.ssl);\n waitForServices =\n { ... }:\n [\n \"jellyfin.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n port\n ];\n waitForUrls =\n { proto_fqdn, ... }:\n [\n \"${proto_fqdn}/System/Info/Public\"\n {\n url = \"${proto_fqdn}/Users/AuthenticateByName\";\n status = 401;\n }\n ];\n extraScript =\n { node, ... }:\n ''\n server.wait_until_succeeds(\"journalctl --since -1m --unit jellyfin --grep 'Startup complete'\")\n headers = unline_with(\" \", \"\"\"\n -H 'Content-Type: application/json'\n -H 'Authorization: MediaBrowser Client=\"Android TV\", Device=\"Nvidia Shield\", DeviceId=\"ZQ9YQHHrUzk24vV\", Version=\"0.15.3\"'\n \"\"\")\n import time\n with subtest(\"api login success\"):\n ok = False\n for i in range(1, 5):\n response = curl(client, \"\"\"{\"code\":%{response_code}}\"\"\", \"${node.config.test.proto_fqdn}/Users/AuthenticateByName\",\n data=\"\"\"{\"Username\": \"${adminUser}\", \"Pw\": \"${adminPassword}\"}\"\"\",\n extra=headers)\n if response['code'] == 200:\n ok = True\n break\n time.sleep(5)\n if not ok:\n raise Exception(f\"Expected success, got: {response['code']}\")\n\n with subtest(\"api login failure\"):\n response = curl(client, \"\"\"{\"code\":%{response_code}}\"\"\", \"${node.config.test.proto_fqdn}/Users/AuthenticateByName\",\n data=\"\"\"{\"Username\": \"${adminUser}\", \"Pw\": \"badpassword\"}\"\"\",\n extra=headers)\n if response['code'] != 401:\n raise Exception(f\"Expected failure, got: {response['code']}\")\n '';\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/jellyfin.nix\n ];\n # Jellyfin checks for minimum 2Gib on startup.\n virtualisation.diskSize = 4096;\n virtualisation.memorySize = 4096;\n test = {\n subdomain = \"j\";\n };\n\n shb.jellyfin = {\n enable = true;\n inherit (config.test) subdomain domain;\n inherit port;\n admin = {\n username = adminUser;\n password.result = config.shb.hardcodedsecret.jellyfinAdminPassword.result;\n };\n debug = true;\n };\n\n shb.hardcodedsecret.jellyfinAdminPassword = {\n request = config.shb.jellyfin.admin.password.request;\n settings.content = adminPassword;\n };\n\n environment.systemPackages = [\n pkgs.sqlite\n ];\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"j\";\n };\n\n test.login = {\n browser = \"firefox\";\n startUrl = \"${config.test.proto}://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"[Uu]ser\";\n loginButtonNameRegex = \"Sign In\";\n testLoginWith = [\n {\n username = adminUser;\n password = \"badpassword\";\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = adminUser;\n password = adminPassword;\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).not_to_be_visible(timeout=10000)\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.jellyfin = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n test = {\n hasSSL = true;\n };\n };\n\n ldap =\n { config, lib, ... }:\n {\n shb.jellyfin = {\n ldap = {\n enable = true;\n host = \"127.0.0.1\";\n port = config.shb.lldap.ldapPort;\n dcdomain = config.shb.lldap.dcdomain;\n userGroup = \"user_group\";\n adminGroup = \"admin_group\";\n adminPassword.result = config.shb.hardcodedsecret.jellyfinLdapUserPassword.result;\n };\n };\n\n # There's something weird happending here\n # where this plugin disappears after a jellyfin restart.\n # I don't know why this is the case.\n # I tried using a real plugin here instead of a mock or just creating a meta.json file.\n # But this didn't help.\n shb.jellyfin.plugins = lib.mkBefore [\n (shb.mkJellyfinPlugin (rec {\n pname = \"jellyfin-plugin-ldapauth\";\n version = \"19\";\n url = \"https://github.com/jellyfin/${pname}/releases/download/v${version}/ldap-authentication_${version}.0.0.0.zip\";\n hash = \"sha256-NunkpdYjsxYT6a4RaDXLkgRn4scRw8GaWvyHGs9IdWo=\";\n }))\n ];\n\n shb.hardcodedsecret.jellyfinLdapUserPassword = {\n request = config.shb.jellyfin.ldap.adminPassword.request;\n settings.content = \"ldapUserPassword\";\n };\n };\n\n clientLoginLdap =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"j\";\n };\n\n test.login = {\n startUrl = \"${config.test.proto}://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"[Uu]ser\";\n loginButtonNameRegex = \"Sign In\";\n testLoginWith = [\n {\n username = adminUser;\n password = \"badpassword\";\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = adminUser;\n password = adminPassword;\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).not_to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n # For a reason I can't explain, redirection needs to happen manually.\n \"page.goto('${config.test.proto}://${config.test.fqdn}/web/')\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).not_to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n # For a reason I can't explain, redirection needs to happen manually.\n \"page.goto('${config.test.proto}://${config.test.fqdn}/web/')\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).not_to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).to_be_visible(timeout=10000)\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.jellyfin = {\n ldap = {\n userGroup = \"user_group\";\n adminGroup = \"admin_group\";\n };\n\n sso = {\n enable = true;\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n sharedSecret.result = config.shb.hardcodedsecret.jellyfinSSOPassword.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.jellyfinSSOPasswordAuthelia.result;\n };\n };\n\n shb.hardcodedsecret.jellyfinSSOPassword = {\n request = config.shb.jellyfin.sso.sharedSecret.request;\n settings.content = \"ssoPassword\";\n };\n\n shb.hardcodedsecret.jellyfinSSOPasswordAuthelia = {\n request = config.shb.jellyfin.sso.sharedSecretForAuthelia.request;\n settings.content = \"ssoPassword\";\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"j\";\n };\n\n test.login = {\n startUrl = \"${config.test.proto}://${config.test.fqdn}\";\n beforeHook = ''\n page.locator('text=Sign in with Authelia').click()\n '';\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[Ss]ign [Ii]n\";\n loginSpawnsNewPage = true;\n testLoginWith = [\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"page.get_by_text(re.compile('[Aa]ccept')).click()\"\n # For a reason I can't explain, redirection needs to happen manually.\n \"page.goto('${config.test.proto}://${config.test.fqdn}/web/')\"\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).not_to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n # For a reason I can't explain, redirection needs to happen manually.\n # So for failing auth, we check we're back on the login page.\n \"page.goto('${config.test.proto}://${config.test.fqdn}/web/')\"\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"page.get_by_text(re.compile('[Aa]ccept')).click()\"\n # For a reason I can't explain, redirection needs to happen manually.\n \"page.goto('${config.test.proto}://${config.test.fqdn}/web/')\"\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_text(re.compile('[Ii]nvalid'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).not_to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n # For a reason I can't explain, redirection needs to happen manually.\n \"page.goto('${config.test.proto}://${config.test.fqdn}/web/')\"\n # \"expect(page).to_have_title(re.compile('Jellyfin'))\"\n \"expect(page.get_by_label(re.compile('^[Uu]ser'))).to_be_visible(timeout=10000)\"\n \"expect(page.get_by_label(re.compile('^[Pp]assword$'))).to_be_visible(timeout=10000)\"\n ];\n }\n ];\n };\n };\n\n jellyfinTest =\n name:\n { nodes, testScript }:\n shb.test.runNixOSTest {\n name = \"jellyfin_${name}\";\n\n interactive.sshBackdoor.enable = true;\n interactive.nodes.server = {\n environment.systemPackages = [\n pkgs.sqlite\n ];\n };\n\n inherit nodes;\n inherit testScript;\n };\nin\n{\n basic = jellyfinTest \"basic\" {\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = jellyfinTest \"backup\" {\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.jellyfin.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = jellyfinTest \"https\" {\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n nodes.client =\n { config, lib, ... }:\n {\n imports = [\n clientLogin\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n ldap = jellyfinTest \"ldap\" {\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n ];\n };\n\n nodes.client = {\n imports = [\n clientLoginLdap\n ];\n };\n\n testScript = commonTestScript.access.override {\n extraScript =\n {\n node,\n ...\n }:\n # I have no idea why the LDAP Authentication_19.0.0.0 plugin disappears.\n ''\n r = server.execute('cat \"${node.config.services.jellyfin.dataDir}/plugins/LDAP Authentication_19.0.0.0/meta.json\"')\n if r[0] != 0:\n print(\"meta.json for plugin LDAP Authentication_19.0.0.0 not found\")\n else:\n c = json.loads(r[1])\n if \"status\" in c and c[\"status\"] != \"Disabled\":\n raise Exception(f'meta.json status: expected Disabled, got: {c[\"status\"]}')\n '';\n };\n };\n\n sso = jellyfinTest \"sso\" {\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/karakeep.nix",
"content": "{ shb, ... }:\nlet\n nextauthSecret = \"nextauthSecret\";\n oidcSecret = \"oidcSecret\";\n\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.karakeep.ssl);\n waitForServices =\n { ... }:\n [\n \"karakeep-init.service\"\n \"karakeep-browser.service\"\n \"karakeep-web.service\"\n \"karakeep-workers.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.karakeep.port\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/karakeep.nix\n ];\n\n test = {\n subdomain = \"k\";\n };\n\n shb.karakeep = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n nextauthSecret.result = config.shb.hardcodedsecret.nextauthSecret.result;\n meilisearchMasterKey.result = config.shb.hardcodedsecret.meilisearchMasterKey.result;\n };\n\n shb.hardcodedsecret.nextauthSecret = {\n request = config.shb.karakeep.nextauthSecret.request;\n settings.content = nextauthSecret;\n };\n shb.hardcodedsecret.meilisearchMasterKey = {\n request = config.shb.karakeep.meilisearchMasterKey.request;\n settings.content = \"meilisearch-master-key\";\n };\n\n networking.hosts = {\n \"127.0.0.1\" = [ \"${config.test.subdomain}.${config.test.domain}\" ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.karakeep = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.karakeep = {\n ldap = {\n userGroup = \"user_group\";\n };\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"k\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n beforeHook = ''\n page.get_by_role(\"button\", name=\"single sign-on\").click()\n '';\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible(timeout=10000)\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('new item')).to_be_visible()\"\n ];\n }\n # Bob, with its admin role only, cannot login into Karakeep because admins do not exist in Karakeep.\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible(timeout=10000)\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n # \"page.get_by_role('button', name=re.compile('Accept')).click()\" # I don't understand why this is not needed. Maybe it keeps somewhere the previous token?\n \"expect(page.get_by_text(re.compile('login failed'))).to_be_visible(timeout=10000)\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.karakeep = {\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n clientID = \"karakeep\";\n\n sharedSecret.result = config.shb.hardcodedsecret.oidcSecret.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.oidcAutheliaSecret.result;\n };\n };\n\n shb.hardcodedsecret.oidcSecret = {\n request = config.shb.karakeep.sso.sharedSecret.request;\n settings.content = oidcSecret;\n };\n shb.hardcodedsecret.oidcAutheliaSecret = {\n request = config.shb.karakeep.sso.sharedSecretForAuthelia.request;\n settings.content = oidcSecret;\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"karakeep_basic\";\n\n nodes.client = { };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"karakeep_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.karakeep.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"karakeep_https\";\n\n nodes.client = { };\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"karakeep_sso\";\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n\n virtualisation.memorySize = 4096;\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n\n virtualisation.memorySize = 4096;\n };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/nextcloud.nix",
"content": "{ lib, shb, ... }:\nlet\n supportedVersion = [\n 32\n 33\n ];\n\n adminUser = \"root\";\n adminPass = \"rootpw\";\n oidcSecret = \"oidcSecret\";\n\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.nextcloud.ssl);\n waitForServices =\n { ... }:\n [\n \"phpfpm-nextcloud.service\"\n \"nginx.service\"\n ];\n waitForUnixSocket =\n { node, ... }:\n [\n node.config.services.phpfpm.pools.nextcloud.socket\n ];\n extraScript =\n {\n node,\n fqdn,\n proto_fqdn,\n ...\n }:\n ''\n with subtest(\"fails with incorrect authentication\"):\n client.fail(\n \"curl -f -s --location -X PROPFIND\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u ${adminUser}:other \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \" ${proto_fqdn}/remote.php/dav/files/${adminUser}/\"\n )\n\n client.fail(\n \"curl -f -s --location -X PROPFIND\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u root:rootpw \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \" ${proto_fqdn}/remote.php/dav/files/other/\"\n )\n\n with subtest(\"fails with incorrect path\"):\n client.fail(\n \"curl -f -s --location -X PROPFIND\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u ${adminUser}:${adminPass} \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \" ${proto_fqdn}/remote.php/dav/files/other/\"\n )\n\n with subtest(\"can access webdav\"):\n client.succeed(\n \"curl -f -s --location -X PROPFIND\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u ${adminUser}:${adminPass} \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \" ${proto_fqdn}/remote.php/dav/files/${adminUser}/\"\n )\n\n with subtest(\"can create and retrieve file\"):\n client.fail(\n \"curl -f -s --location -X GET\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u ${adminUser}:${adminPass} \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \"\"\" -T file \"\"\"\n + \" ${proto_fqdn}/remote.php/dav/files/${adminUser}/file\"\n )\n client.succeed(\"echo 'hello' > file\")\n client.succeed(\n \"curl -f -s --location -X PUT\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u ${adminUser}:${adminPass} \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \"\"\" -T file \"\"\"\n + \" ${proto_fqdn}/remote.php/dav/files/${adminUser}/\"\n )\n content = client.succeed(\n \"curl -f -s --location -X GET\"\n + \"\"\" -H \"Depth: 1\" \"\"\"\n + \"\"\" -u ${adminUser}:${adminPass} \"\"\"\n + \" --connect-to ${fqdn}:443:server:443\"\n + \" --connect-to ${fqdn}:80:server:80\"\n + \"\"\" -T file \"\"\"\n + \" ${proto_fqdn}/remote.php/dav/files/${adminUser}/file\"\n )\n if content != \"hello\\n\":\n raise Exception(\"Got incorrect content for file, expected 'hello\\n' but got:\\n{}\".format(content))\n '';\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/nextcloud-server.nix\n ];\n\n test = {\n subdomain = \"n\";\n };\n\n shb.nextcloud = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n dataDir = \"/var/lib/nextcloud\";\n tracing = null;\n defaultPhoneRegion = \"US\";\n\n # This option is only needed because we do not access Nextcloud at the default port in the VM.\n externalFqdn = \"${config.test.fqdn}:8080\";\n\n adminUser = adminUser;\n adminPass.result = config.shb.hardcodedsecret.adminPass.result;\n debug = false; # Enable this if needed, but beware it is _very_ verbose.\n };\n\n shb.hardcodedsecret.adminPass = {\n request = config.shb.nextcloud.adminPass.request;\n settings.content = adminPass;\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"n\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Account name\";\n passwordFieldLabelRegex = \"^ *[Pp]assword\";\n loginButtonNameRegex = \"^[Ll]og [Ii]n$\";\n testLoginWith = [\n {\n username = adminUser;\n password = adminPass;\n nextPageExpect = [\n \"expect(page.get_by_text('Wrong login or password')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('[Ll]og [Ii]n'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n ];\n }\n # Failure is after so we're not throttled too much.\n {\n username = adminUser;\n password = adminPass + \"oops\";\n nextPageExpect = [\n \"expect(page.get_by_text('Wrong login or password')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n clientLdapLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"n\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Account name\";\n passwordFieldLabelRegex = \"^ *[Pp]assword\";\n loginButtonNameRegex = \"^[Ll]og [Ii]n$\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Wrong login or password')).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('[Ll]og [Ii]n'))).not_to_be_visible()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n ];\n }\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Wrong login or password')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n clientSsoLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n\n test = {\n subdomain = \"n\";\n };\n\n networking.hosts = {\n \"192.168.1.2\" = [ \"auth.example.com\" ];\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n # No need since Nextcloud is auto-redirecting to the SSO sign in page.\n # beforeHook = ''\n # page.get_by_role(\"link\", name=\"Sign in with SHB-Authelia\").click()\n # '';\n usernameFieldLabelRegex = \"Username\";\n passwordFieldSelector = \"get_by_label(\\\"Password *\\\")\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n \"page.goto('https://${config.test.fqdn}/settings/admin')\"\n \"expect(page.get_by_text('Access forbidden')).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Incorrect username or password')).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page).to_have_title(re.compile('Dashboard'))\"\n \"page.goto('https://${config.test.fqdn}/settings/admin')\"\n \"expect(page.get_by_text('Access forbidden')).not_to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Incorrect username or password')).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text('Incorrect username or password')).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text('not member of the allowed groups')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.nextcloud = {\n ssl = config.shb.certs.certs.selfsigned.n;\n\n externalFqdn = lib.mkForce null;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.nextcloud = {\n apps.ldap = {\n enable = true;\n host = \"127.0.0.1\";\n port = config.shb.lldap.ldapPort;\n dcdomain = config.shb.lldap.dcdomain;\n adminName = \"admin\";\n adminPassword.result = config.shb.hardcodedsecret.nextcloudLdapUserPassword.result;\n userGroup = \"user_group\";\n };\n };\n shb.hardcodedsecret.nextcloudLdapUserPassword = {\n request = config.shb.nextcloud.apps.ldap.adminPassword.request;\n settings = config.shb.hardcodedsecret.ldapUserPassword.settings;\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.nextcloud = {\n apps.ldap = {\n userGroup = \"user_group\";\n };\n apps.sso = {\n enable = true;\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n clientID = \"nextcloud\";\n adminGroup = \"admin_group\";\n\n secret.result = config.shb.hardcodedsecret.oidcSecret.result;\n secretForAuthelia.result = config.shb.hardcodedsecret.oidcAutheliaSecret.result;\n\n fallbackDefaultAuth = false;\n };\n };\n # Needed because OIDC somehow does not like self-signed certificates\n # which we do use in tests.\n # See https://github.com/pulsejet/nextcloud-oidc-login/issues/267\n services.nextcloud.settings.oidc_login_tls_verify = lib.mkForce false;\n\n shb.hardcodedsecret.oidcSecret = {\n request = config.shb.nextcloud.apps.sso.secret.request;\n settings.content = oidcSecret;\n };\n shb.hardcodedsecret.oidcAutheliaSecret = {\n request = config.shb.nextcloud.apps.sso.secretForAuthelia.request;\n settings.content = oidcSecret;\n };\n };\n\n previewgenerator =\n { config, ... }:\n {\n systemd.tmpfiles.rules = [\n \"d '/srv/nextcloud' 0750 nextcloud nextcloud - -\"\n ];\n\n shb.nextcloud = {\n apps.previewgenerator.enable = true;\n };\n };\n\n externalstorage = {\n systemd.tmpfiles.rules = [\n \"d '/srv/nextcloud' 0750 nextcloud nextcloud - -\"\n ];\n\n shb.nextcloud = {\n apps.externalStorage = {\n enable = true;\n userLocalMount.directory = \"/srv/nextcloud/$user\";\n userLocalMount.mountName = \"home\";\n };\n };\n };\n\n memories =\n { config, ... }:\n {\n systemd.tmpfiles.rules = [\n \"d '/srv/nextcloud' 0750 nextcloud nextcloud - -\"\n ];\n\n shb.nextcloud = {\n apps.memories.enable = true;\n apps.memories.vaapi = true;\n };\n };\n\n recognize =\n { config, ... }:\n {\n systemd.tmpfiles.rules = [\n \"d '/srv/nextcloud' 0750 nextcloud nextcloud - -\"\n ];\n\n shb.nextcloud = {\n apps.recognize.enable = true;\n };\n };\n\n prometheus =\n { config, ... }:\n {\n shb.nextcloud = {\n phpFpmPrometheusExporter.enable = true;\n };\n };\n\n prometheusTestScript =\n { nodes, ... }:\n ''\n server.wait_for_open_unix_socket(\"${nodes.server.services.phpfpm.pools.nextcloud.socket}\")\n server.wait_for_open_port(${toString nodes.server.services.prometheus.exporters.php-fpm.port})\n with subtest(\"prometheus\"):\n response = server.succeed(\n \"curl -sSf \"\n + \" http://localhost:${toString nodes.server.services.prometheus.exporters.php-fpm.port}/metrics\"\n )\n print(response)\n '';\n\n basicTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_basic_${toString version}\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n cronTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_cron_${toString version}\";\n\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access.override {\n extraScript =\n {\n node,\n fqdn,\n proto_fqdn,\n ...\n }:\n ''\n import time\n\n def find_in_logs(unit, text):\n return server.systemctl(\"status {}\".format(unit))[1].find(text) != -1\n\n with subtest(\"cron job succeeds\"):\n # This call does not block until the service is done.\n server.succeed(\"systemctl start nextcloud-cron.service&\")\n\n # If the service failed, then we're not happy.\n status = \"active\"\n while status == \"active\":\n status = server.get_unit_info(\"nextcloud-cron\")[\"ActiveState\"]\n time.sleep(5)\n if status != \"inactive\":\n raise Exception(\"Cron job did not finish correctly\")\n\n if not find_in_logs(\"nextcloud-cron\", \"nextcloud-cron.service: Deactivated successfully.\"):\n raise Exception(\"Nextcloud cron job did not finish successfully.\")\n '';\n };\n };\n\n backupTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_backup_${toString version}\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n (shb.test.backup config.shb.nextcloud.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n httpsTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_https_${toString version}\";\n\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n ];\n };\n\n nodes.client = { };\n\n # TODO: Test login\n testScript = commonTestScript.access;\n };\n\n previewGeneratorTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_previewGenerator_${toString version}\";\n\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n previewgenerator\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n externalStorageTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_externalStorage_${toString version}\";\n\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n externalstorage\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n # TODO: fix memories app\n # See https://github.com/ibizaman/selfhostblocks/issues/476\n\n memoriesTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_memories_${toString version}\";\n\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n memories\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n recognizeTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_recognize_${toString version}\";\n\n nodes.server = {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n recognize\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n ldapTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_ldap_${toString version}\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n shb.test.ldap\n ldap\n ];\n };\n\n nodes.client = {\n imports = [\n clientLdapLogin\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n ssoTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_sso_${toString version}\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n shb.test.certs\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n (\n { config, ... }:\n {\n networking.hosts = {\n \"127.0.0.1\" = [ config.test.fqdn ];\n };\n }\n )\n ];\n };\n\n nodes.client = {\n imports = [\n clientSsoLogin\n (\n { config, ... }:\n {\n networking.hosts = {\n \"192.168.1.2\" = [ config.test.fqdn ];\n };\n }\n )\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n prometheusTest =\n version:\n shb.test.runNixOSTest {\n name = \"nextcloud_prometheus_${toString version}\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n {\n shb.nextcloud.version = version;\n }\n prometheus\n ];\n };\n\n nodes.client = { };\n\n testScript = prometheusTestScript;\n };\n\n versionedTests =\n v:\n {\n \"basic_${toString v}\" = basicTest v;\n\n \"cron_${toString v}\" = cronTest v;\n\n \"backup_${toString v}\" = backupTest v;\n\n \"https_${toString v}\" = httpsTest v;\n\n \"previewGenerator_${toString v}\" = previewGeneratorTest v;\n\n \"externalStorage_${toString v}\" = externalStorageTest v;\n\n \"ldap_${toString v}\" = ldapTest v;\n\n \"sso_${toString v}\" = ssoTest v;\n\n \"prometheus_${toString v}\" = prometheusTest v;\n }\n // lib.optionalAttrs (v == 32) {\n \"memories_${toString v}\" = memoriesTest v;\n \"recognize_${toString v}\" = recognizeTest v;\n };\nin\nlib.foldl (all: v: lib.mergeAttrs all (versionedTests v)) { } supportedVersion\n"
},
{
"path": "test/services/open-webui.nix",
"content": "{ shb, ... }:\nlet\n oidcSecret = \"oidcSecret\";\n\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.open-webui.ssl);\n waitForServices =\n { ... }:\n [\n \"open-webui.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.open-webui.port\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/open-webui.nix\n ];\n\n test = {\n subdomain = \"o\";\n };\n\n shb.open-webui = {\n enable = true;\n inherit (config.test) subdomain domain;\n };\n # Speeds up tests because models can't be downloaded anyway and that leads to retries.\n services.open-webui.environment.OFFLINE_MODE = \"true\";\n\n networking.hosts = {\n \"127.0.0.1\" = [ \"${config.test.subdomain}.${config.test.domain}\" ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.open-webui = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n\n systemd.services.open-webui.environment = {\n # Needed for open-webui to be able to talk to auth server.\n SSL_CERT_FILE = \"/etc/ssl/certs/ca-certificates.crt\";\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.open-webui = {\n ldap = {\n userGroup = \"user_group\";\n adminGroup = \"admin_group\";\n };\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n virtualisation.memorySize = 4096;\n test = {\n subdomain = \"o\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}/auth\";\n beforeHook = ''\n page.get_by_role(\"button\", name=\"continue\").click()\n '';\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('logged in')).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"NotBobPassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"bob\";\n password = \"BobPassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('logged in')).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"page.get_by_role('button', name=re.compile('Accept')).click()\"\n \"expect(page.get_by_text('unauthorized')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.open-webui = {\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n clientID = \"open-webui\";\n\n sharedSecret.result = config.shb.hardcodedsecret.oidcSecret.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.oidcAutheliaSecret.result;\n };\n };\n\n shb.hardcodedsecret.oidcSecret = {\n request = config.shb.open-webui.sso.sharedSecret.request;\n settings.content = oidcSecret;\n };\n shb.hardcodedsecret.oidcAutheliaSecret = {\n request = config.shb.open-webui.sso.sharedSecretForAuthelia.request;\n settings.content = oidcSecret;\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"open-webui_basic\";\n\n nodes.client = { };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"open-webui_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.open-webui.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"open-webui_https\";\n\n nodes.client = { };\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"open-webui_sso\";\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n testScript = commonTestScript.access;\n };\n}\n"
},
{
"path": "test/services/paperless.nix",
"content": "{\n pkgs,\n lib,\n shb,\n}:\nlet\n subdomain = \"p\";\n domain = \"example.com\";\n\n commonTestScript = shb.test.accessScript {\n hasSSL = { node, ... }: !(isNull node.config.shb.paperless.ssl);\n waitForServices =\n { ... }:\n [\n \"paperless-web.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { ... }:\n [\n 28981\n 80\n ];\n waitForUrls = { proto_fqdn, ... }: [ \"${proto_fqdn}\" ];\n };\n\n base =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/services/paperless.nix\n ];\n\n virtualisation.memorySize = 4096;\n virtualisation.cores = 2;\n\n test = {\n inherit subdomain domain;\n };\n\n shb.paperless = {\n enable = true;\n inherit subdomain domain;\n };\n\n # Required for tests\n environment.systemPackages = [ pkgs.curl ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [ base ];\n\n test.hasSSL = false;\n };\n\n https =\n { config, ... }:\n {\n imports = [\n base\n shb.test.certs\n ];\n\n test.hasSSL = true;\n shb.paperless.ssl = config.shb.certs.certs.selfsigned.n;\n };\n\n backup =\n { config, ... }:\n {\n imports = [\n https\n (shb.test.backup config.shb.paperless.backup)\n ];\n };\n\n sso =\n { config, ... }:\n {\n imports = [\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n ];\n\n shb.paperless.sso = {\n enable = true;\n provider = \"Authelia\";\n endpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n clientID = \"paperless\";\n autoLaunch = true;\n sharedSecret.result = config.shb.hardcodedsecret.paperlessSSOSecret.result;\n sharedSecretForAuthelia.result = config.shb.hardcodedsecret.paperlessSSOSecretAuthelia.result;\n };\n\n shb.hardcodedsecret.paperlessSSOSecret = {\n request = config.shb.paperless.sso.sharedSecret.request;\n settings.content = \"paperlessSSOSecret\";\n };\n\n shb.hardcodedsecret.paperlessSSOSecretAuthelia = {\n request = config.shb.paperless.sso.sharedSecretForAuthelia.request;\n settings.content = \"paperlessSSOSecret\";\n };\n\n # Configure LDAP groups for group-based access control\n shb.lldap.ensureGroups.paperless_user = { };\n\n shb.lldap.ensureUsers.paperless_test_user = {\n email = \"paperless_user@example.com\";\n groups = [ \"paperless_user\" ];\n password.result = config.shb.hardcodedsecret.ldappaperlessUserPassword.result;\n };\n\n shb.lldap.ensureUsers.regular_test_user = {\n email = \"regular_user@example.com\";\n groups = [ ];\n password.result = config.shb.hardcodedsecret.ldapRegularUserPassword.result;\n };\n\n shb.hardcodedsecret.ldappaperlessUserPassword = {\n request = config.shb.lldap.ensureUsers.paperless_test_user.password.request;\n settings.content = \"paperless_user_password\";\n };\n\n shb.hardcodedsecret.ldapRegularUserPassword = {\n request = config.shb.lldap.ensureUsers.regular_test_user.password.request;\n settings.content = \"regular_user_password\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"paperless-basic\";\n\n nodes.server = basic;\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n https = shb.test.runNixOSTest {\n name = \"paperless-https\";\n\n nodes.server = https;\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"paperless-https\";\n\n nodes.server = sso;\n nodes.client = { };\n\n testScript = commonTestScript;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"paperless-backup\";\n\n nodes.server = backup;\n nodes.client = { };\n\n testScript =\n (shb.test.mkScripts {\n hasSSL = args: !(isNull args.node.config.shb.paperless.ssl);\n waitForServices = args: [\n \"paperless-web.service\"\n \"nginx.service\"\n ];\n waitForPorts = args: [\n 28981\n 80\n ];\n waitForUrls = args: [ \"${args.proto_fqdn}\" ];\n }).backup;\n };\n\n}\n"
},
{
"path": "test/services/pinchflat.nix",
"content": "{ pkgs, shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.pinchflat.ssl);\n waitForServices =\n { ... }:\n [\n \"pinchflat.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n node.config.shb.pinchflat.port\n ];\n };\n\n basic =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/pinchflat.nix\n ];\n\n test = {\n subdomain = \"p\";\n };\n\n shb.pinchflat = {\n enable = true;\n inherit (config.test) subdomain domain;\n mediaDir = \"/src/pinchflat\";\n timeZone = \"America/Los_Angeles\";\n secretKeyBase.result = config.shb.hardcodedsecret.secretKeyBase.result;\n };\n\n systemd.tmpfiles.rules = [\n \"d '/src/pinchflat' 0750 pinchflat pinchflat - -\"\n ];\n\n # Needed for gitea-runner-local to be able to ping pinchflat.\n networking.hosts = {\n \"127.0.0.1\" = [ \"${config.test.subdomain}.${config.test.domain}\" ];\n };\n\n shb.hardcodedsecret.secretKeyBase = {\n request = config.shb.pinchflat.secretKeyBase.request;\n settings.content = pkgs.lib.strings.replicate 64 \"Z\";\n };\n };\n\n clientLogin =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"p\";\n };\n\n test.login = {\n startUrl = \"http://${config.test.fqdn}\";\n # There is no login without SSO integration.\n testLoginWith = [\n {\n username = null;\n password = null;\n nextPageExpect = [\n \"expect(page.get_by_text('Create a media profile')).to_be_visible()\"\n ];\n }\n ];\n };\n };\n\n https =\n { config, ... }:\n {\n shb.pinchflat = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n ldap =\n { config, ... }:\n {\n shb.pinchflat = {\n ldap = {\n enable = true;\n\n userGroup = \"user_group\";\n };\n };\n };\n\n clientLoginSso =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n shb.test.clientLoginModule\n ];\n test = {\n subdomain = \"p\";\n };\n\n test.login = {\n startUrl = \"https://${config.test.fqdn}\";\n usernameFieldLabelRegex = \"Username\";\n passwordFieldLabelRegex = \"Password\";\n loginButtonNameRegex = \"[sS]ign [iI]n\";\n testLoginWith = [\n {\n username = \"alice\";\n password = \"NotAlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"alice\";\n password = \"AlicePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).not_to_be_visible()\"\n \"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()\"\n \"expect(page.get_by_text('Create a media profile')).to_be_visible()\"\n ];\n }\n # Bob, with its admin role only, cannot login into Karakeep because admins do not exist in Karakeep.\n {\n username = \"charlie\";\n password = \"NotCharliePassword\";\n nextPageExpect = [\n \"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()\"\n ];\n }\n {\n username = \"charlie\";\n password = \"CharliePassword\";\n nextPageExpect = [\n \"expect(page).to_have_url(re.compile('.*/authenticated'))\"\n ];\n }\n ];\n };\n };\n\n sso =\n { config, ... }:\n {\n shb.pinchflat = {\n sso = {\n enable = true;\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"pinchflat_basic\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n backup = shb.test.runNixOSTest {\n name = \"pinchflat_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n basic\n (shb.test.backup config.shb.pinchflat.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n\n https = shb.test.runNixOSTest {\n name = \"pinchflat_https\";\n\n nodes.client = {\n imports = [\n clientLogin\n ];\n };\n nodes.server = {\n imports = [\n basic\n shb.test.certs\n https\n ];\n };\n\n testScript = commonTestScript.access;\n };\n\n sso = shb.test.runNixOSTest {\n name = \"pinchflat_sso\";\n\n nodes.client = {\n imports = [\n clientLoginSso\n ];\n };\n nodes.server =\n { config, pkgs, ... }:\n {\n imports = [\n basic\n shb.test.certs\n https\n shb.test.ldap\n ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n testScript = commonTestScript.access.override {\n redirectSSO = true;\n };\n };\n}\n"
},
{
"path": "test/services/vaultwarden.nix",
"content": "{ shb, ... }:\nlet\n commonTestScript = shb.test.mkScripts {\n hasSSL = { node, ... }: !(isNull node.config.shb.vaultwarden.ssl);\n waitForServices =\n { ... }:\n [\n \"vaultwarden.service\"\n \"nginx.service\"\n ];\n waitForPorts =\n { node, ... }:\n [\n 8222\n 5432\n ];\n # to get the get token test to succeed we need:\n # 1. add group Vaultwarden_admin to LLDAP\n # 2. add an Authelia user with to that group\n # 3. login in Authelia with that user\n # 4. go to the Vaultwarden /admin endpoint\n # 5. create a Vaultwarden user\n # 6. now login with that new user to Vaultwarden\n extraScript =\n { node, proto_fqdn, ... }:\n ''\n with subtest(\"prelogin\"):\n response = curl(client, \"\", \"${proto_fqdn}/identity/accounts/prelogin\", data=unline_with(\"\", \"\"\"\n {\"email\": \"me@example.com\"}\n \"\"\"))\n print(response)\n if 'kdf' not in response:\n raise Exception(\"Unrecognized response: {}\".format(response))\n\n with subtest(\"get token\"):\n response = curl(client, \"\", \"${proto_fqdn}/identity/connect/token\", data=unline_with(\"\", \"\"\"\n scope=api%20offline_access\n &client_id=web\n &deviceType=10\n &deviceIdentifier=a60323bf-4686-4b4d-96e0-3c241fa5581c\n &deviceName=firefox\n &grant_type=password&username=me\n &password=mypassword\n \"\"\"))\n print(response)\n if response[\"message\"] != \"Username or password is incorrect. Try again\":\n raise Exception(\"Unrecognized response: {}\".format(response))\n '';\n };\n\n basic =\n { config, ... }:\n {\n test = {\n subdomain = \"v\";\n };\n\n shb.vaultwarden = {\n enable = true;\n inherit (config.test) subdomain domain;\n\n port = 8222;\n databasePassword.result = config.shb.hardcodedsecret.passphrase.result;\n };\n shb.hardcodedsecret.passphrase = {\n request = config.shb.vaultwarden.databasePassword.request;\n settings.content = \"PassPhrase\";\n };\n\n # networking.hosts = {\n # \"127.0.0.1\" = [ fqdn ];\n # };\n };\n\n https =\n { config, ... }:\n {\n shb.vaultwarden = {\n ssl = config.shb.certs.certs.selfsigned.n;\n };\n };\n\n # Not yet supported\n # ldap = { config, ... }: {\n # # shb.vaultwarden = {\n # # ldapHostname = \"127.0.0.1\";\n # # ldapPort = config.shb.lldap.webUIListenPort;\n # # };\n # };\n\n sso =\n { config, ... }:\n {\n shb.vaultwarden = {\n authEndpoint = \"https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}\";\n };\n };\nin\n{\n basic = shb.test.runNixOSTest {\n name = \"vaultwarden_basic\";\n\n nodes.server = {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/vaultwarden.nix\n basic\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n https = shb.test.runNixOSTest {\n name = \"vaultwarden_https\";\n\n nodes.server = {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/vaultwarden.nix\n shb.test.certs\n basic\n https\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access;\n };\n\n # Not yet supported\n #\n # ldap = shb.test.runNixOSTest {\n # name = \"vaultwarden_ldap\";\n #\n # nodes.server = lib.mkMerge [\n # shb.test.baseModule\n # ../../modules/blocks/hardcodedsecret.nix\n # ../../modules/services/vaultwarden.nix\n # basic\n # ldap\n # ];\n #\n # nodes.client = {};\n #\n # testScript = commonTestScript.access;\n # };\n\n sso = shb.test.runNixOSTest {\n name = \"vaultwarden_sso\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/vaultwarden.nix\n shb.test.certs\n basic\n https\n shb.test.ldap\n (shb.test.sso config.shb.certs.certs.selfsigned.n)\n sso\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.access.override {\n waitForPorts =\n { node, ... }:\n [\n 8222\n 5432\n 9091\n ];\n extraScript =\n { node, proto_fqdn, ... }:\n ''\n with subtest(\"unauthenticated access is not granted to /admin\"):\n response = curl(client, \"\"\"{\"code\":%{response_code},\"auth_host\":\"%{urle.host}\",\"auth_query\":\"%{urle.query}\",\"all\":%{json}}\"\"\", \"${proto_fqdn}/admin\")\n\n if response['code'] != 200:\n raise Exception(f\"Code is {response['code']}\")\n if response['auth_host'] != \"auth.${node.config.test.domain}\":\n raise Exception(f\"auth host should be auth.${node.config.test.domain} but is {response['auth_host']}\")\n if response['auth_query'] != \"rd=${proto_fqdn}/admin\":\n raise Exception(f\"auth query should be rd=${proto_fqdn}/admin but is {response['auth_query']}\")\n '';\n };\n };\n\n backup = shb.test.runNixOSTest {\n name = \"vaultwarden_backup\";\n\n nodes.server =\n { config, ... }:\n {\n imports = [\n shb.test.baseModule\n ../../modules/blocks/hardcodedsecret.nix\n ../../modules/services/vaultwarden.nix\n basic\n (shb.test.backup config.shb.vaultwarden.backup)\n ];\n };\n\n nodes.client = { };\n\n testScript = commonTestScript.backup;\n };\n}\n"
}
]![\"NlNet](\"https://nlnet.nl/logo/banner.svg\"){kind=logo}
\n![\"NGI](\"https://nlnet.nl/image/logos/NGI0Core_tag.svg\")
\n