Set up Bluesky PDS

.sops.yaml

@@ -2,7 +2,7 @@ keys:
   - &erwin age1h7ddyj66gcqt5vnzphjfn6y5tul79q0glcdl0et9w44z2evl999qe02wht
   - &erwin_horus age1435gxhlpu55pp86r8pullhc6wg43nv6qm5l3g2vl5000xhn8apdqtlf8cg
   - &loki age1m93jeyexus2uqvrk99r7hh0xp7qxk55tgmju4h422dfkf92jce2sxpntu5
-  - &ci age1tmlx45s4f6qp929839yd5y5vxkj2z4z8wmhqsnne9j8j5uwx6p8qssun8l
+  - &bsky age14d9tqammm9c6az868lnqcsk2e64rt95krpve6nxl9yyenqtgye0qz9y0pr
   - &factorio age1vvxx738y8aq6sgvagz4rrjgnzuekdl20vltmp026qfnax7mdldrs3j4nrf
   - &frigate age1gtzlyyxdnt23xzyq6lq5ye645egxl7up25agxw23nuhjl6ax0dmqrlqvpf
   - &gitea age1mh39yv2j3ltl50tjnqqgjctxth3nxa74ggwn29dpvcv08qd0psnssajsmd
@@ -24,12 +24,12 @@ creation_rules:
         - *erwin
         - *erwin_horus
         - *loki
-  - path_regex: machines/ci/[^/]+\.yaml$
+  - path_regex: machines/bsky/[^/]+\.yaml$
     key_groups:
       - age:
         - *erwin
         - *erwin_horus
-        - *ci
+        - *bsky
   - path_regex: machines/factorio/[^/]+\.yaml$
     key_groups:
       - age:
@@ -66,24 +66,12 @@ creation_rules:
         - *erwin
         - *erwin_horus
         - *mimir
-  - path_regex: machines/meili/[^/]+\.yaml$
-    key_groups:
-      - age:
-        - *erwin
-        - *erwin_horus
-        - *meili
   - path_regex: machines/minio/[^/]+\.yaml$
     key_groups:
       - age:
         - *erwin
         - *erwin_horus
         - *minio
-  - path_regex: machines/neo/[^/]+\.yaml$
-    key_groups:
-      - age:
-        - *erwin
-        - *erwin_horus
-        - *neo
   - path_regex: machines/nix-cache/[^/]+\.yaml$
     key_groups:
       - age:

flake.lock

@@ -22,6 +22,21 @@
         "type": "github"
       }
     },
+    "caddy-nix": {
+      "locked": {
+        "lastModified": 1732948222,
+        "narHash": "sha256-kUWyjeqkU+RHTHVXT61QF19eW2vnWgah5OcPrUlU8oU=",
+        "owner": "vincentbernat",
+        "repo": "caddy-nix",
+        "rev": "9d13eb684b4ba1b2eb92e76f7ea1f517eccc4fe1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vincentbernat",
+        "repo": "caddy-nix",
+        "type": "github"
+      }
+    },
     "caddy-with-plugins": {
       "inputs": {
         "flake-parts": [
@@ -624,6 +639,7 @@
     "root": {
       "inputs": {
         "anyrun": "anyrun",
+        "caddy-nix": "caddy-nix",
         "caddy-with-plugins": "caddy-with-plugins",
         "colmena": "colmena",
         "comin": "comin",

flake.nix

@@ -98,6 +98,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    caddy-nix = {
+      url = "github:vincentbernat/caddy-nix";
+    };
+
     caddy-with-plugins = {
       url = "github:eboskma/caddy-with-plugins";
       inputs = {
@@ -254,6 +258,8 @@
             git-repo-go = pkgs.git-repo-go;
             hassbridge = pkgs.callPackage ./pkgs/hassbridge { };
             mapshot = pkgs.mapshot;
+            pds = pkgs.pds;
+            pdsadmin = pkgs.pdsadmin;
             peakperf = pkgs.callPackage ./pkgs/peakperf { };
             tinyows = pkgs.callPackage ./pkgs/tinyows { };
             tsui = pkgs.callPackage ./pkgs/tsui { };
@@ -289,6 +295,7 @@
                 openssl
                 pciutils
                 pkgs.sops
+                python3Packages.websocket-client
                 ssh-to-age
                 taplo
                 # vscode-langservers-extracted

lib/default.nix

@@ -26,6 +26,7 @@ rec {
               inputs.emacs-overlay.overlay
               inputs.eww.overlays.default
               inputs.nil.overlays.default
+              inputs.caddy-nix.overlays.default
               inputs.ha-now-playing.overlays.${system}
               inputs.pamedia.overlays.default
             ]

machines/bsky/configuration.nix

@@ -0,0 +1,104 @@
+{ self, ... }:
+{
+  modulesPath,
+  pkgs,
+  config,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/virtualisation/lxc-container.nix")
+
+    ../../users/root
+    ../../users/erwin
+
+  ];
+
+  eboskma = {
+    users.erwin = {
+      enable = true;
+      server = true;
+    };
+
+    nix-common = {
+      enable = true;
+      remote-builders = true;
+    };
+
+    rust-motd.enable = true;
+    tailscale.enable = true;
+  };
+
+  boot = {
+    isContainer = true;
+  };
+
+  time.timeZone = "Europe/Amsterdam";
+
+  system.configurationRevision = self.inputs.nixpkgs.lib.mkIf (self ? rev) self.rev;
+
+  networking = {
+    hostName = "bsky";
+    useDHCP = false;
+    useHostResolvConf = false;
+    networkmanager.enable = false;
+    useNetworkd = true;
+    nftables.enable = true;
+    firewall.trustedInterfaces = [ "tailscale0" ];
+  };
+
+  systemd = {
+    services.logrotate-checkconf.enable = false;
+
+    network = {
+      enable = true;
+
+      wait-online.anyInterface = true;
+
+      networks = {
+        "40-eth0" = {
+          matchConfig = {
+            Name = "eth0";
+          };
+
+          networkConfig = {
+            Address = "10.0.0.213/24";
+            Gateway = "10.0.0.1";
+            DNS = "10.0.0.206";
+            DHCP = "no";
+          };
+        };
+      };
+    };
+  };
+
+  services = {
+    pds = {
+      enable = true;
+      environmentFiles = [
+        config.sops.secrets.pds-env.path
+      ];
+      settings = {
+        PDS_HOSTNAME = "boskma.frl";
+        PDS_ADMIN_EMAIL = "erwin@datarift.nl";
+        PDS_EMAIL_FROM_ADDRESS = "admin@boskma.frl";
+      };
+    };
+  };
+
+  security = {
+    sudo-rs = {
+      enable = true;
+      execWheelOnly = true;
+      wheelNeedsPassword = false;
+    };
+    sudo.enable = false;
+  };
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets = {
+    pds-env = { };
+  };
+
+  system.stateVersion = "25.05";
+}

machines/bsky/secrets.yaml

@@ -0,0 +1,39 @@
+pds-env: ENC[AES256_GCM,data:7igflP/eh4Mvz15Xh1B3R4WcZ51LTCcjBNYiBCu92ZaQvOTalquJqGdLRpaBx425NZjPGGAt6xibMLnbaXOrXpouVW3A+xPj0TzTO+K2ZObFAZgaFfLCDIUPgkc1PUGvvwg/jfU8xMaUvLRlaAQDo1SDfNbmszQrxZRTAJYL4doPHFGnUAKgAW36RQ3PmQKcDGC3Rdaf3Bzi5rU7PIgYmJKaQWDSsDBgD9z5oPd1w/1k1RgoTblHM4u7lk0d0itUeS0TYMkVL4w5+soye6R00wwQBXyIkwQ8fikJUa3GnbhPx67RSzPkwKg3tRIxAZyRfBHC9Cb52RhhhFmZG5AWdG3FLXGpelPO/fMhEZGhCbkDo3dJtDz+Ce567R/ud5cQCpwvTuHQoH1n7/IcROxAy5sf60bgV7eyhA==,iv:8b/U6vv/MHnr/U03vMxN8sr9csgPbpBBALrcehPop/A=,tag:bejYU4f4IA+TVcEfyFhkMA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1h7ddyj66gcqt5vnzphjfn6y5tul79q0glcdl0et9w44z2evl999qe02wht
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOd3dEK2g0dEZMOE1xK00y
+            Qk9nS3Y0US8zdXJMWUU1bXVWZEhHMVBPT0VRCkxrdk5pMGJ3RFF5dWZpQVpkNE5H
+            TzJ5RUVNUkZ2T00rSnV0bFZwSVFVNG8KLS0tIGdXdHNSWWVJRStDZm9sZENZeXBC
+            NnBoUzdKK0hxRkR4UTBQdVFzVlcvU28KaLapjIR+97b6TRLg3eny6YIeiuuXokTX
+            lAo7h78zeV6yGzHsl2NaGkdeaERjbidLn2yji7d9iFxMnj9nG0cxEA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1435gxhlpu55pp86r8pullhc6wg43nv6qm5l3g2vl5000xhn8apdqtlf8cg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGU3hPTVVKcTJrNHFIWDRk
+            NVVZYzM5NlZnUnFCWGVQMDVwVmdPTzBDc1RzCjA3RzIrQWNHREJoV1VRUjNmQzhQ
+            Zzhwa1ZqQytzN0pwN0t3bFpndDlvb2MKLS0tIGdjL3ptZUtMSXB5WnIraDZWc2gy
+            T2UyVmNuUUVqT2ErazdudzBBVFh5RVEKDotw/CBdnptaty84NXlVwrD3vFYBz8jN
+            t7yI3ZCz7VXceklGLpSyQe5rbJIbcmogfYSH/qm9y1Wv/+FoO5YWcg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age14d9tqammm9c6az868lnqcsk2e64rt95krpve6nxl9yyenqtgye0qz9y0pr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VzV5VkNMUlMySy9saUdE
+            LzNrQnloR243bTlNNVgzbWhyT1p5c05KeWlvCnh5UzlBNzlxdVYyeC9zQ3hxSXJU
+            a2YyVXlFeVhQSDhRcmNhbEpKbGxFMm8KLS0tIGRuaXVFMWlmdFZQRG9CWWpXSUVl
+            TFRvdGkyb1czc21weVMyRHJGUlR3WEkKQPEoBJPPLijNmpGo8jngBfWUrkZZJwcg
+            zdi6Wukj6tTS/rKyK0cCC8noyBVc0lLnpUMAemX9xs1dWkFrUBVQiw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-03T21:01:23Z"
+    mac: ENC[AES256_GCM,data:rjymp5a273Wx2K5WE8yVMRiJDyzz7y3UDLliJvAtUJLg72nx3KXbWFvHjio8BaEQxbobRxnLuPYyAXrGVwIdA14JJVBGFSc4jiJWFsVoX7Kh/7Iui4xkPO/3veoIVkvIzBYyRkPjB249ZwKbLaVR+NlraK7uHvL+Z9wFR+AY67E=,iv:hs6OUurXAApby6s7P0jr1Txplu8TC6DejvWT/87yrMA=,tag:L8+ZVgcwJZc67zd4NitXtQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

machines/default.nix

@@ -1,14 +1,12 @@
 inputs: {
-  ci = {
+  bsky = {
-    config = import ./ci/configuration.nix inputs;
+    config = import ./bsky/configuration.nix inputs;
-    # deploy = {
+    deploy = {
-    #   # host = "10.0.0.202";
+      # host = "10.0.0.213";
-    #   host = "ci.barn-beaver.ts.net";
+      host = "bsky.barn-beaver.ts.net";
-    #   targetUser = "erwin";
+      targetUser = "erwin";
-    #   buildOn = "local";
+      tags = [ "container" ];
-    #   substituteOnTarget = true;
+    };
-    #   tags = [ "container" ];
-    # };
   };
   factorio = {
     config = import ./factorio/configuration.nix inputs;
@@ -67,15 +65,6 @@ inputs: {
   loki = {
     config = import ./loki/configuration.nix inputs;
   };
-  meili = {
-    config = import ./meili/configuration.nix inputs;
-    deploy = {
-      # host = "10.0.0.214";
-      host = "meili.barn-beaver.ts.net";
-      targetUser = "erwin";
-      tags = [ "container" ];
-    };
-  };
   mimir = {
     config = import ./mimir/configuration.nix inputs;
   };

machines/heimdall/caddy/default.nix

@@ -41,9 +41,21 @@
 
       "boskma.frl" = {
         extraConfig = ''
-          respond 404 {
+          reverse_proxy bsky.barn-beaver.ts.net:3000
-            body "Nothing to see here."
+
-            close
+          tls {
+            dns cloudflare {env.CF_API_TOKEN}
+            resolvers 1.1.1.1
+          }
+        '';
+      };
+
+      "*.boskma.frl" = {
+        extraConfig = ''
+          reverse_proxy bsky.barn-beaver.ts.net:3000
+          tls {
+            dns cloudflare {env.CF_API_TOKEN}
+            resolvers 1.1.1.1
           }
         '';
       };

machines/heimdall/configuration.nix

@@ -1,6 +1,7 @@
 { self, ... }:
 {
   pkgs,
+  config,
   modulesPath,
   lib,
   ...
@@ -42,42 +43,46 @@
     firewall.trustedInterfaces = [ "tailscale0" ];
   };
 
-  systemd.network = {
+  systemd = {
-    enable = true;
+    network = {
+      enable = true;
 
-    networks = {
+      networks = {
-      "40-eth0" = {
+        "40-eth0" = {
-        matchConfig = {
+          matchConfig = {
-          Name = "eth0";
+            Name = "eth0";
-        };
+          };
 
-        networkConfig = {
+          networkConfig = {
-          Address = [
+            Address = [
-            "159.69.211.175/32"
+              "159.69.211.175/32"
-            "2a01:4f8:1c1e:5fb2::1/64"
+              "2a01:4f8:1c1e:5fb2::1/64"
-            "fe80::9400:2ff:fe12:a2eb/64"
+              "fe80::9400:2ff:fe12:a2eb/64"
-          ];
+            ];
-          DHCP = "no";
+            DHCP = "no";
-          Gateway = [
+            Gateway = [
-            "172.31.1.1"
+              "172.31.1.1"
-            "fe80::1"
+              "fe80::1"
+            ];
+          };
+
+          routes = [
+            {
+              Destination = "172.31.1.1/32";
+              Scope = "link";
+              Protocol = "static";
+            }
+            {
+              Destination = "fe80::1/128";
+              Scope = "link";
+              Protocol = "static";
+            }
           ];
         };
-
-        routes = [
-          {
-            Destination = "172.31.1.1/32";
-            Scope = "link";
-            Protocol = "static";
-          }
-          {
-            Destination = "fe80::1/128";
-            Scope = "link";
-            Protocol = "static";
-          }
-        ];
       };
     };
+
+    services.caddy.serviceConfig.EnvironmentFile = [ config.sops.secrets.caddy-env.path ];
   };
 
   ### Hetzner stuff
@@ -124,6 +129,11 @@
     };
 
     caddy = {
+      package = pkgs.caddy.withPlugins {
+        plugins = [ "github.com/caddy-dns/cloudflare@89f16b99c18ef49c8bb470a82f895bce01cbaece" ];
+        hash = "sha256-Aqu2st8blQr/Ekia2KrH1AP/2BVZIN4jOJpdLc1Rr4g=";
+      };
+
       virtualHosts = {
         "garfield.datarift.nl" =
           let
@@ -136,13 +146,6 @@
               file_server
             '';
           };
-
-        "boskma.frl" = {
-          extraConfig = ''
-            root * /var/www/boskma.frl
-            file_server
-          '';
-        };
       };
     };
   };

modules/pds/default.nix

@@ -0,0 +1,223 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.pds;
+
+  inherit (lib)
+    getExe
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    escapeShellArgs
+    concatMapStringsSep
+    types
+    literalExpression
+    ;
+
+  pdsadminWrapper =
+    let
+      cfgSystemd = config.systemd.services.pds.serviceConfig;
+    in
+    pkgs.writeShellScriptBin "pdsadmin" ''
+      DUMMY_PDS_ENV_FILE="$(mktemp)"
+      trap 'rm -f "$DUMMY_PDS_ENV_FILE"' EXIT
+      env "PDS_ENV_FILE=$DUMMY_PDS_ENV_FILE"                                                   \
+          ${escapeShellArgs cfgSystemd.Environment}                                            \
+          ${concatMapStringsSep " " (envFile: "$(cat ${envFile})") cfgSystemd.EnvironmentFile} \
+          ${getExe pkgs.pdsadmin} "$@"
+    '';
+in
+# All defaults are from https://github.com/bluesky-social/pds/blob/8b9fc24cec5f30066b0d0b86d2b0ba3d66c2b532/installer.sh
+{
+  options.services.pds = {
+    enable = mkEnableOption "pds";
+
+    package = mkPackageOption pkgs "pds" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (types.nullOr types.str);
+        options = {
+          PDS_PORT = mkOption {
+            type = types.str;
+            default = "3000";
+            description = "Port to listen on";
+          };
+
+          PDS_HOSTNAME = mkOption {
+            type = types.str;
+            example = "pds.example.com";
+            description = "Instance hostname (base domain name)";
+          };
+
+          PDS_BLOB_UPLOAD_LIMIT = mkOption {
+            type = types.str;
+            default = "52428800";
+            description = "Size limit of uploaded blobs";
+          };
+
+          PDS_DID_PLC_URL = mkOption {
+            type = types.str;
+            default = "https://plc.directory";
+            description = "URL of DID PLC directory";
+          };
+
+          PDS_BSKY_APP_VIEW_URL = mkOption {
+            type = types.str;
+            default = "https://api.bsky.app";
+            description = "URL of bsky frontend";
+          };
+
+          PDS_BSKY_APP_VIEW_DID = mkOption {
+            type = types.str;
+            default = "did:web:api.bsky.app";
+            description = "DID of bsky frontend";
+          };
+
+          PDS_REPORT_SERVICE_URL = mkOption {
+            type = types.str;
+            default = "https://mod.bsky.app";
+            description = "URL of mod service";
+          };
+
+          PDS_REPORT_SERVICE_DID = mkOption {
+            type = types.str;
+            default = "did:plc:ar7c4by46qjdydhdevvrndac";
+            description = "DID of mod service";
+          };
+
+          PDS_CRAWLERS = mkOption {
+            type = types.str;
+            default = "https://bsky.network";
+            description = "URL of crawlers";
+          };
+
+          PDS_DATA_DIRECTORY = mkOption {
+            type = types.str;
+            default = "/var/lib/pds";
+            description = "Directory to store state";
+          };
+
+          PDS_BLOBSTORE_DISK_LOCATION = mkOption {
+            type = types.nullOr types.str;
+            default = "/var/lib/pds/blocks";
+            description = "Store blobs at this location, set to null to use e.g. S3";
+          };
+
+          LOG_ENABLED = mkOption {
+            type = types.nullOr types.str;
+            default = "true";
+            description = "Enable logging";
+          };
+        };
+      };
+
+      description = ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+
+        Refer to <https://github.com/bluesky-social/atproto/blob/92cd7a84ad207278c241afce8c8491e73b0a24e0/packages/pds/src/config/env.ts> for available environment variables.
+      '';
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [ ];
+      description = ''
+        File to load environment variables from. Loaded variables override
+        values set in {option}`environment`.
+
+        Use it to set values of `PDS_JWT_SECRET`, `PDS_ADMIN_PASSWORD`,
+        and `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` secrets.
+        You can generate initial values with
+        ```
+        nix-build -A pds.passthru.generateSecrets
+        ./result/bin/generate-pds-secrets > secrets.env
+        ```
+      '';
+    };
+
+    pdsadmin = {
+      enable = mkOption {
+        type = types.bool;
+        default = cfg.enable;
+        defaultText = literalExpression "services.pds.enable";
+        description = "Add pdsadmin script to PATH";
+      };
+
+      useServiceEnvironment = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Inherit environment variables of pds systemd unit";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = mkIf cfg.pdsadmin.enable {
+      systemPackages = [
+        (if cfg.pdsadmin.useServiceEnvironment then pdsadminWrapper else pkgs.pdsadmin)
+      ];
+    };
+
+    systemd.services.pds = {
+      description = "pds";
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        Environment = lib.mapAttrsToList (k: v: "${k}=${v}") (
+          lib.filterAttrs (_: v: v != null) cfg.settings
+        );
+
+        EnvironmentFile = cfg.environmentFiles;
+        User = "pds";
+        Group = "pds";
+        StateDirectory = "pds";
+        StateDirectoryMode = "0755";
+        Restart = "always";
+
+        # Hardening
+        DynamicUser = true;
+        RemoveIPC = true;
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        PrivateMounts = true;
+        SystemCallArchitectures = [ "native" ];
+        MemoryDenyWriteExecute = false; # V8 JIT
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictRealtime = true;
+        DeviceAllow = [ "" ];
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectHome = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ t4ccer ];
+}

overlays/default.nix

@@ -26,4 +26,7 @@ _final: prev: {
   mapshot = prev.pkgs.callPackage ../pkgs/mapshot { };
 
   factorio = prev.factorio.override { versionsJson = ./factorio.json; };
+
+  pds = prev.pkgs.callPackage ../pkgs/pds { };
+  pdsadmin = prev.pkgs.callPackage ../pkgs/pdsadmin { };
 }

pkgs/pds/default.nix

@@ -0,0 +1,98 @@
+{
+  fetchFromGitHub,
+  nodejs,
+  buildNpmPackage,
+  vips,
+  pkg-config,
+  writeShellApplication,
+  xxd,
+  openssl,
+  nixosTests,
+  lib,
+}:
+
+let
+  generateSecrets = writeShellApplication {
+    name = "generate-pds-secrets";
+
+    runtimeInputs = [
+      xxd
+      openssl
+    ];
+
+    # Commands from https://github.com/bluesky-social/pds/blob/8b9fc24cec5f30066b0d0b86d2b0ba3d66c2b532/installer.sh
+    text = ''
+      echo "PDS_JWT_SECRET=$(openssl rand --hex 16)"
+      echo "PDS_ADMIN_PASSWORD=$(openssl rand --hex 16)"
+      echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)"
+    '';
+  };
+in
+
+# NOTE: Package comes with `pnpm-lock.yaml` but we cannot use `pnpm.fetchDeps` here because it
+# does not work with `sharp` NPM dependency that needs `vips` and `pkg-config`
+# Regenerate `package-lock.json` with `npm i --package-lock-only`
+# Next release should have bumped `sharp` with pre-built binaries
+buildNpmPackage rec {
+  pname = "pds";
+  version = "0.4.67";
+
+  src = fetchFromGitHub {
+    owner = "bluesky-social";
+    repo = "pds";
+    rev = "v${version}";
+    hash = "sha256-dEB5u++Zx+F4TH5q44AF/tuwAhLEyYT+U5/18viT4sw=";
+  };
+
+  sourceRoot = "${src.name}/service";
+
+  npmDepsHash = "sha256-uQKhODaVHLj+JEq6LYiJ/zXuu7kDCLmpxOs/VCc0GqQ=";
+
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+  '';
+
+  # Required for `sharp` NPM dependency
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ vips ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
+      --add-flags --enable-source-maps                \
+      --add-flags "$out/lib/pds/index.js"             \
+      --set-default NODE_ENV production
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib/pds}
+    mv node_modules $out/lib/pds
+    mv index.js $out/lib/pds
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit generateSecrets;
+    tests = {
+      inherit (nixosTests) pds;
+    };
+  };
+
+  meta = {
+    description = "Bluesky Personal Data Server (PDS)";
+    homepage = "https://bsky.social";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ t4ccer ];
+    platforms = lib.platforms.unix;
+    mainProgram = "pds";
+  };
+}

pkgs/pdsadmin/default.nix

@@ -0,0 +1,60 @@
+{
+  stdenvNoCC,
+  bash,
+  pds,
+  makeBinaryWrapper,
+  jq,
+  curl,
+  openssl,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "pdsadmin";
+  inherit (pds) version src;
+
+  patches = [ ./pdsadmin-offline.patch ];
+
+  buildInputs = [
+    bash
+  ];
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    substituteInPlace pdsadmin.sh \
+      --replace-fail NIXPKGS_PDSADMIN_ROOT $out
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/pds
+    install -Dm755 pdsadmin.sh $out/lib/pds/
+    install -Dm755 pdsadmin/*.sh $out/lib/pds/
+    makeBinaryWrapper "$out/lib/pds/pdsadmin.sh" "$out/bin/pdsadmin" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          jq
+          curl
+          openssl
+        ]
+      }"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Admin scripts for Bluesky Personal Data Server (PDS)";
+    inherit (pds.meta) homepage license;
+    maintainers = with lib.maintainers; [ t4ccer ];
+    platforms = lib.platforms.unix;
+    mainProgram = "pdsadmin";
+  };
+})

pkgs/pdsadmin/pdsadmin-offline.patch

@@ -0,0 +1,24 @@
+diff --git a/pdsadmin.sh b/pdsadmin.sh
+index 913d2b4..b09c20c 100644
+--- a/pdsadmin.sh
++++ b/pdsadmin.sh
+@@ -15,16 +15,11 @@ if [[ "${EUID}" -ne 0 ]]; then
+   exit 1
+ fi
+ 
+-# Download the script, if it exists.
+-SCRIPT_URL="${PDSADMIN_BASE_URL}/${COMMAND}.sh"
+-SCRIPT_FILE="$(mktemp /tmp/pdsadmin.${COMMAND}.XXXXXX)"
++SCRIPT_FILE="NIXPKGS_PDSADMIN_ROOT/lib/pds/${COMMAND}.sh"
+ 
+-if ! curl --fail --silent --show-error --location --output "${SCRIPT_FILE}" "${SCRIPT_URL}"; then
++if ! [ -f "${SCRIPT_FILE}" ]; then
+   echo "ERROR: ${COMMAND} not found"
+   exit 2
+ fi
+ 
+-chmod +x "${SCRIPT_FILE}"
+-if "${SCRIPT_FILE}" "$@"; then
+-  rm --force "${SCRIPT_FILE}"
+-fi
++"${SCRIPT_FILE}" "$@"