erwin/nixos-config
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Wiki Activity Actions

Set up Bluesky PDS

Browse source
This commit is contained in:
Erwin Boskma 2024-12-03 20:02:13 +01:00
parent 1979bee384
commit c2a0e7e8bb
Signed by: erwin
SSH key fingerprint: SHA256:9LmFDe1C6jSrEyqxxvX8NtJBmcbB105XoqyUZF092bg
15 changed files with 6131 additions and 74 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
.sops.yaml
View file

@ -2,7 +2,7 @@ keys:
- &erwin age1h7ddyj66gcqt5vnzphjfn6y5tul79q0glcdl0et9w44z2evl999qe02wht
- &erwin_horus age1435gxhlpu55pp86r8pullhc6wg43nv6qm5l3g2vl5000xhn8apdqtlf8cg
- &loki age1m93jeyexus2uqvrk99r7hh0xp7qxk55tgmju4h422dfkf92jce2sxpntu5
- &ci age1tmlx45s4f6qp929839yd5y5vxkj2z4z8wmhqsnne9j8j5uwx6p8qssun8l
- &bsky age14d9tqammm9c6az868lnqcsk2e64rt95krpve6nxl9yyenqtgye0qz9y0pr
- &factorio age1vvxx738y8aq6sgvagz4rrjgnzuekdl20vltmp026qfnax7mdldrs3j4nrf
- &frigate age1gtzlyyxdnt23xzyq6lq5ye645egxl7up25agxw23nuhjl6ax0dmqrlqvpf
- &gitea age1mh39yv2j3ltl50tjnqqgjctxth3nxa74ggwn29dpvcv08qd0psnssajsmd
@ -24,12 +24,12 @@ creation_rules:
- *erwin
- *erwin_horus
- *loki
- path_regex: machines/ci/[^/]+\.yaml$
- path_regex: machines/bsky/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *ci
- *bsky
- path_regex: machines/factorio/[^/]+\.yaml$
key_groups:
- age:
@ -66,24 +66,12 @@ creation_rules:
- *erwin
- *erwin_horus
- *mimir
- path_regex: machines/meili/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *meili
- path_regex: machines/minio/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *minio
- path_regex: machines/neo/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *neo
- path_regex: machines/nix-cache/[^/]+\.yaml$
key_groups:
- age:

16
flake.lock
View file

@ -22,6 +22,21 @@
"type": "github"
}
},
"caddy-nix": {
"locked": {
"lastModified": 1732948222,
"narHash": "sha256-kUWyjeqkU+RHTHVXT61QF19eW2vnWgah5OcPrUlU8oU=",
"owner": "vincentbernat",
"repo": "caddy-nix",
"rev": "9d13eb684b4ba1b2eb92e76f7ea1f517eccc4fe1",
"type": "github"
},
"original": {
"owner": "vincentbernat",
"repo": "caddy-nix",
"type": "github"
}
},
"caddy-with-plugins": {
"inputs": {
"flake-parts": [
@ -624,6 +639,7 @@
"root": {
"inputs": {
"anyrun": "anyrun",
"caddy-nix": "caddy-nix",
"caddy-with-plugins": "caddy-with-plugins",
"colmena": "colmena",
"comin": "comin",

7
flake.nix
View file

@ -98,6 +98,10 @@
inputs.nixpkgs.follows = "nixpkgs";
};
caddy-nix = {
url = "github:vincentbernat/caddy-nix";
};
caddy-with-plugins = {
url = "github:eboskma/caddy-with-plugins";
inputs = {
@ -254,6 +258,8 @@
git-repo-go = pkgs.git-repo-go;
hassbridge = pkgs.callPackage ./pkgs/hassbridge { };
mapshot = pkgs.mapshot;
pds = pkgs.pds;
pdsadmin = pkgs.pdsadmin;
peakperf = pkgs.callPackage ./pkgs/peakperf { };
tinyows = pkgs.callPackage ./pkgs/tinyows { };
tsui = pkgs.callPackage ./pkgs/tsui { };
@ -289,6 +295,7 @@
openssl
pciutils
pkgs.sops
python3Packages.websocket-client
ssh-to-age
taplo
# vscode-langservers-extracted

1
lib/default.nix
View file

@ -26,6 +26,7 @@ rec {
inputs.emacs-overlay.overlay
inputs.eww.overlays.default
inputs.nil.overlays.default
inputs.caddy-nix.overlays.default
inputs.ha-now-playing.overlays.${system}
inputs.pamedia.overlays.default
]

104
machines/bsky/configuration.nix Normal file
View file

@ -0,0 +1,104 @@
{ self, ... }:
{
modulesPath,
pkgs,
config,
...
}:
{
imports = [
(modulesPath + "/virtualisation/lxc-container.nix")
../../users/root
../../users/erwin
];
eboskma = {
users.erwin = {
enable = true;
server = true;
};
nix-common = {
enable = true;
remote-builders = true;
};
rust-motd.enable = true;
tailscale.enable = true;
};
boot = {
isContainer = true;
};
time.timeZone = "Europe/Amsterdam";
system.configurationRevision = self.inputs.nixpkgs.lib.mkIf (self ? rev) self.rev;
networking = {
hostName = "bsky";
useDHCP = false;
useHostResolvConf = false;
networkmanager.enable = false;
useNetworkd = true;
nftables.enable = true;
firewall.trustedInterfaces = [ "tailscale0" ];
};
systemd = {
services.logrotate-checkconf.enable = false;
network = {
enable = true;
wait-online.anyInterface = true;
networks = {
"40-eth0" = {
matchConfig = {
Name = "eth0";
};
networkConfig = {
Address = "10.0.0.213/24";
Gateway = "10.0.0.1";
DNS = "10.0.0.206";
DHCP = "no";
};
};
};
};
};
services = {
pds = {
enable = true;
environmentFiles = [
config.sops.secrets.pds-env.path
];
settings = {
PDS_HOSTNAME = "boskma.frl";
PDS_ADMIN_EMAIL = "erwin@datarift.nl";
PDS_EMAIL_FROM_ADDRESS = "admin@boskma.frl";
};
};
};
security = {
sudo-rs = {
enable = true;
execWheelOnly = true;
wheelNeedsPassword = false;
};
sudo.enable = false;
};
sops.defaultSopsFile = ./secrets.yaml;
sops.secrets = {
pds-env = { };
};
system.stateVersion = "25.05";
}

39
machines/bsky/secrets.yaml Normal file
View file

@ -0,0 +1,39 @@
pds-env: ENC[AES256_GCM,data:7igflP/eh4Mvz15Xh1B3R4WcZ51LTCcjBNYiBCu92ZaQvOTalquJqGdLRpaBx425NZjPGGAt6xibMLnbaXOrXpouVW3A+xPj0TzTO+K2ZObFAZgaFfLCDIUPgkc1PUGvvwg/jfU8xMaUvLRlaAQDo1SDfNbmszQrxZRTAJYL4doPHFGnUAKgAW36RQ3PmQKcDGC3Rdaf3Bzi5rU7PIgYmJKaQWDSsDBgD9z5oPd1w/1k1RgoTblHM4u7lk0d0itUeS0TYMkVL4w5+soye6R00wwQBXyIkwQ8fikJUa3GnbhPx67RSzPkwKg3tRIxAZyRfBHC9Cb52RhhhFmZG5AWdG3FLXGpelPO/fMhEZGhCbkDo3dJtDz+Ce567R/ud5cQCpwvTuHQoH1n7/IcROxAy5sf60bgV7eyhA==,iv:8b/U6vv/MHnr/U03vMxN8sr9csgPbpBBALrcehPop/A=,tag:bejYU4f4IA+TVcEfyFhkMA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1h7ddyj66gcqt5vnzphjfn6y5tul79q0glcdl0et9w44z2evl999qe02wht
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOd3dEK2g0dEZMOE1xK00y
Qk9nS3Y0US8zdXJMWUU1bXVWZEhHMVBPT0VRCkxrdk5pMGJ3RFF5dWZpQVpkNE5H
TzJ5RUVNUkZ2T00rSnV0bFZwSVFVNG8KLS0tIGdXdHNSWWVJRStDZm9sZENZeXBC
NnBoUzdKK0hxRkR4UTBQdVFzVlcvU28KaLapjIR+97b6TRLg3eny6YIeiuuXokTX
lAo7h78zeV6yGzHsl2NaGkdeaERjbidLn2yji7d9iFxMnj9nG0cxEA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1435gxhlpu55pp86r8pullhc6wg43nv6qm5l3g2vl5000xhn8apdqtlf8cg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGU3hPTVVKcTJrNHFIWDRk
NVVZYzM5NlZnUnFCWGVQMDVwVmdPTzBDc1RzCjA3RzIrQWNHREJoV1VRUjNmQzhQ
Zzhwa1ZqQytzN0pwN0t3bFpndDlvb2MKLS0tIGdjL3ptZUtMSXB5WnIraDZWc2gy
T2UyVmNuUUVqT2ErazdudzBBVFh5RVEKDotw/CBdnptaty84NXlVwrD3vFYBz8jN
t7yI3ZCz7VXceklGLpSyQe5rbJIbcmogfYSH/qm9y1Wv/+FoO5YWcg==
-----END AGE ENCRYPTED FILE-----
- recipient: age14d9tqammm9c6az868lnqcsk2e64rt95krpve6nxl9yyenqtgye0qz9y0pr
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VzV5VkNMUlMySy9saUdE
LzNrQnloR243bTlNNVgzbWhyT1p5c05KeWlvCnh5UzlBNzlxdVYyeC9zQ3hxSXJU
a2YyVXlFeVhQSDhRcmNhbEpKbGxFMm8KLS0tIGRuaXVFMWlmdFZQRG9CWWpXSUVl
TFRvdGkyb1czc21weVMyRHJGUlR3WEkKQPEoBJPPLijNmpGo8jngBfWUrkZZJwcg
zdi6Wukj6tTS/rKyK0cCC8noyBVc0lLnpUMAemX9xs1dWkFrUBVQiw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-12-03T21:01:23Z"
mac: ENC[AES256_GCM,data:rjymp5a273Wx2K5WE8yVMRiJDyzz7y3UDLliJvAtUJLg72nx3KXbWFvHjio8BaEQxbobRxnLuPYyAXrGVwIdA14JJVBGFSc4jiJWFsVoX7Kh/7Iui4xkPO/3veoIVkvIzBYyRkPjB249ZwKbLaVR+NlraK7uHvL+Z9wFR+AY67E=,iv:hs6OUurXAApby6s7P0jr1Txplu8TC6DejvWT/87yrMA=,tag:L8+ZVgcwJZc67zd4NitXtQ==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.1

27
machines/default.nix
View file

@ -1,14 +1,12 @@
inputs: {
ci = {
config = import ./ci/configuration.nix inputs;
# deploy = {
# # host = "10.0.0.202";
# host = "ci.barn-beaver.ts.net";
# targetUser = "erwin";
# buildOn = "local";
# substituteOnTarget = true;
# tags = [ "container" ];
# };
bsky = {
config = import ./bsky/configuration.nix inputs;
deploy = {
# host = "10.0.0.213";
host = "bsky.barn-beaver.ts.net";
targetUser = "erwin";
tags = [ "container" ];
};
};
factorio = {
config = import ./factorio/configuration.nix inputs;
@ -67,15 +65,6 @@ inputs: {
loki = {
config = import ./loki/configuration.nix inputs;
};
meili = {
config = import ./meili/configuration.nix inputs;
deploy = {
# host = "10.0.0.214";
host = "meili.barn-beaver.ts.net";
targetUser = "erwin";
tags = [ "container" ];
};
};
mimir = {
config = import ./mimir/configuration.nix inputs;
};

18
machines/heimdall/caddy/default.nix
View file

@ -41,9 +41,21 @@
"boskma.frl" = {
extraConfig = ''
respond 404 {
body "Nothing to see here."
close
reverse_proxy bsky.barn-beaver.ts.net:3000
tls {
dns cloudflare {env.CF_API_TOKEN}
resolvers 1.1.1.1
}
'';
};
"*.boskma.frl" = {
extraConfig = ''
reverse_proxy bsky.barn-beaver.ts.net:3000
tls {
dns cloudflare {env.CF_API_TOKEN}
resolvers 1.1.1.1
}
'';
};

19
machines/heimdall/configuration.nix
View file

@ -1,6 +1,7 @@
{ self, ... }:
{
pkgs,
config,
modulesPath,
lib,
...
@ -42,7 +43,8 @@
firewall.trustedInterfaces = [ "tailscale0" ];
};
systemd.network = {
systemd = {
network = {
enable = true;
networks = {
@ -80,6 +82,9 @@
};
};
services.caddy.serviceConfig.EnvironmentFile = [ config.sops.secrets.caddy-env.path ];
};
### Hetzner stuff
boot = {
tmp.cleanOnBoot = true;
@ -124,6 +129,11 @@
};
caddy = {
package = pkgs.caddy.withPlugins {
plugins = [ "github.com/caddy-dns/cloudflare@89f16b99c18ef49c8bb470a82f895bce01cbaece" ];
hash = "sha256-Aqu2st8blQr/Ekia2KrH1AP/2BVZIN4jOJpdLc1Rr4g=";
};
virtualHosts = {
"garfield.datarift.nl" =
let
@ -136,13 +146,6 @@
file_server
'';
};
"boskma.frl" = {
extraConfig = ''
root * /var/www/boskma.frl
file_server
'';
};
};
};
};

223
modules/pds/default.nix Normal file
View file

@ -0,0 +1,223 @@
{
lib,
pkgs,
config,
...
}:
let
cfg = config.services.pds;
inherit (lib)
getExe
mkEnableOption
mkIf
mkOption
mkPackageOption
escapeShellArgs
concatMapStringsSep
types
literalExpression
;
pdsadminWrapper =
let
cfgSystemd = config.systemd.services.pds.serviceConfig;
in
pkgs.writeShellScriptBin "pdsadmin" ''
DUMMY_PDS_ENV_FILE="$(mktemp)"
trap 'rm -f "$DUMMY_PDS_ENV_FILE"' EXIT
env "PDS_ENV_FILE=$DUMMY_PDS_ENV_FILE" \
${escapeShellArgs cfgSystemd.Environment} \
${concatMapStringsSep " " (envFile: "$(cat ${envFile})") cfgSystemd.EnvironmentFile} \
${getExe pkgs.pdsadmin} "$@"
'';
in
# All defaults are from https://github.com/bluesky-social/pds/blob/8b9fc24cec5f30066b0d0b86d2b0ba3d66c2b532/installer.sh
{
options.services.pds = {
enable = mkEnableOption "pds";
package = mkPackageOption pkgs "pds" { };
settings = mkOption {
type = types.submodule {
freeformType = types.attrsOf (types.nullOr types.str);
options = {
PDS_PORT = mkOption {
type = types.str;
default = "3000";
description = "Port to listen on";
};
PDS_HOSTNAME = mkOption {
type = types.str;
example = "pds.example.com";
description = "Instance hostname (base domain name)";
};
PDS_BLOB_UPLOAD_LIMIT = mkOption {
type = types.str;
default = "52428800";
description = "Size limit of uploaded blobs";
};
PDS_DID_PLC_URL = mkOption {
type = types.str;
default = "https://plc.directory";
description = "URL of DID PLC directory";
};
PDS_BSKY_APP_VIEW_URL = mkOption {
type = types.str;
default = "https://api.bsky.app";
description = "URL of bsky frontend";
};
PDS_BSKY_APP_VIEW_DID = mkOption {
type = types.str;
default = "did:web:api.bsky.app";
description = "DID of bsky frontend";
};
PDS_REPORT_SERVICE_URL = mkOption {
type = types.str;
default = "https://mod.bsky.app";
description = "URL of mod service";
};
PDS_REPORT_SERVICE_DID = mkOption {
type = types.str;
default = "did:plc:ar7c4by46qjdydhdevvrndac";
description = "DID of mod service";
};
PDS_CRAWLERS = mkOption {
type = types.str;
default = "https://bsky.network";
description = "URL of crawlers";
};
PDS_DATA_DIRECTORY = mkOption {
type = types.str;
default = "/var/lib/pds";
description = "Directory to store state";
};
PDS_BLOBSTORE_DISK_LOCATION = mkOption {
type = types.nullOr types.str;
default = "/var/lib/pds/blocks";
description = "Store blobs at this location, set to null to use e.g. S3";
};
LOG_ENABLED = mkOption {
type = types.nullOr types.str;
default = "true";
description = "Enable logging";
};
};
};
description = ''
Environment variables to set for the service. Secrets should be
specified using {option}`environmentFile`.
Refer to <https://github.com/bluesky-social/atproto/blob/92cd7a84ad207278c241afce8c8491e73b0a24e0/packages/pds/src/config/env.ts> for available environment variables.
'';
};
environmentFiles = mkOption {
type = types.listOf types.path;
default = [ ];
description = ''
File to load environment variables from. Loaded variables override
values set in {option}`environment`.
Use it to set values of `PDS_JWT_SECRET`, `PDS_ADMIN_PASSWORD`,
and `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` secrets.
You can generate initial values with
```
nix-build -A pds.passthru.generateSecrets
./result/bin/generate-pds-secrets > secrets.env
```
'';
};
pdsadmin = {
enable = mkOption {
type = types.bool;
default = cfg.enable;
defaultText = literalExpression "services.pds.enable";
description = "Add pdsadmin script to PATH";
};
useServiceEnvironment = mkOption {
type = types.bool;
default = true;
description = "Inherit environment variables of pds systemd unit";
};
};
};
config = mkIf cfg.enable {
environment = mkIf cfg.pdsadmin.enable {
systemPackages = [
(if cfg.pdsadmin.useServiceEnvironment then pdsadminWrapper else pkgs.pdsadmin)
];
};
systemd.services.pds = {
description = "pds";
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = getExe cfg.package;
Environment = lib.mapAttrsToList (k: v: "${k}=${v}") (
lib.filterAttrs (_: v: v != null) cfg.settings
);
EnvironmentFile = cfg.environmentFiles;
User = "pds";
Group = "pds";
StateDirectory = "pds";
StateDirectoryMode = "0755";
Restart = "always";
# Hardening
DynamicUser = true;
RemoveIPC = true;
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
ProtectKernelModules = true;
PrivateMounts = true;
SystemCallArchitectures = [ "native" ];
MemoryDenyWriteExecute = false; # V8 JIT
RestrictNamespaces = true;
RestrictSUIDSGID = true;
ProtectHostname = true;
LockPersonality = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
];
RestrictRealtime = true;
DeviceAllow = [ "" ];
ProtectSystem = "strict";
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectHome = true;
PrivateUsers = true;
PrivateTmp = true;
UMask = "0077";
};
};
};
meta.maintainers = with lib.maintainers; [ t4ccer ];
}

3
overlays/default.nix
View file

@ -26,4 +26,7 @@ _final: prev: {
mapshot = prev.pkgs.callPackage ../pkgs/mapshot { };
factorio = prev.factorio.override { versionsJson = ./factorio.json; };
pds = prev.pkgs.callPackage ../pkgs/pds { };
pdsadmin = prev.pkgs.callPackage ../pkgs/pdsadmin { };
}

98
pkgs/pds/default.nix Normal file
View file

@ -0,0 +1,98 @@
{
fetchFromGitHub,
nodejs,
buildNpmPackage,
vips,
pkg-config,
writeShellApplication,
xxd,
openssl,
nixosTests,
lib,
}:
let
generateSecrets = writeShellApplication {
name = "generate-pds-secrets";
runtimeInputs = [
xxd
openssl
];
# Commands from https://github.com/bluesky-social/pds/blob/8b9fc24cec5f30066b0d0b86d2b0ba3d66c2b532/installer.sh
text = ''
echo "PDS_JWT_SECRET=$(openssl rand --hex 16)"
echo "PDS_ADMIN_PASSWORD=$(openssl rand --hex 16)"
echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)"
'';
};
in
# NOTE: Package comes with `pnpm-lock.yaml` but we cannot use `pnpm.fetchDeps` here because it
# does not work with `sharp` NPM dependency that needs `vips` and `pkg-config`
# Regenerate `package-lock.json` with `npm i --package-lock-only`
# Next release should have bumped `sharp` with pre-built binaries
buildNpmPackage rec {
pname = "pds";
version = "0.4.67";
src = fetchFromGitHub {
owner = "bluesky-social";
repo = "pds";
rev = "v${version}";
hash = "sha256-dEB5u++Zx+F4TH5q44AF/tuwAhLEyYT+U5/18viT4sw=";
};
sourceRoot = "${src.name}/service";
npmDepsHash = "sha256-uQKhODaVHLj+JEq6LYiJ/zXuu7kDCLmpxOs/VCc0GqQ=";
postPatch = ''
cp ${./package-lock.json} package-lock.json
'';
# Required for `sharp` NPM dependency
nativeBuildInputs = [ pkg-config ];
buildInputs = [ vips ];
buildPhase = ''
runHook preBuild
makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
--add-flags --enable-source-maps \
--add-flags "$out/lib/pds/index.js" \
--set-default NODE_ENV production
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p $out/{bin,lib/pds}
mv node_modules $out/lib/pds
mv index.js $out/lib/pds
runHook postInstall
'';
passthru = {
inherit generateSecrets;
tests = {
inherit (nixosTests) pds;
};
};
meta = {
description = "Bluesky Personal Data Server (PDS)";
homepage = "https://bsky.social";
license = with lib.licenses; [
mit
asl20
];
maintainers = with lib.maintainers; [ t4ccer ];
platforms = lib.platforms.unix;
mainProgram = "pds";
};
}

5490
pkgs/pds/package-lock.json generated Normal file
View file

File diff suppressed because it is too large Load diff

60
pkgs/pdsadmin/default.nix Normal file
View file

@ -0,0 +1,60 @@
{
stdenvNoCC,
bash,
pds,
makeBinaryWrapper,
jq,
curl,
openssl,
lib,
}:
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "pdsadmin";
inherit (pds) version src;
patches = [ ./pdsadmin-offline.patch ];
buildInputs = [
bash
];
nativeBuildInputs = [
makeBinaryWrapper
];
buildPhase = ''
runHook preBuild
substituteInPlace pdsadmin.sh \
--replace-fail NIXPKGS_PDSADMIN_ROOT $out
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p $out/lib/pds
install -Dm755 pdsadmin.sh $out/lib/pds/
install -Dm755 pdsadmin/*.sh $out/lib/pds/
makeBinaryWrapper "$out/lib/pds/pdsadmin.sh" "$out/bin/pdsadmin" \
--prefix PATH : "${
lib.makeBinPath [
jq
curl
openssl
]
}"
runHook postInstall
'';
meta = {
description = "Admin scripts for Bluesky Personal Data Server (PDS)";
inherit (pds.meta) homepage license;
maintainers = with lib.maintainers; [ t4ccer ];
platforms = lib.platforms.unix;
mainProgram = "pdsadmin";
};
})

24
pkgs/pdsadmin/pdsadmin-offline.patch Normal file
View file

@ -0,0 +1,24 @@
diff --git a/pdsadmin.sh b/pdsadmin.sh
index 913d2b4..b09c20c 100644
--- a/pdsadmin.sh
+++ b/pdsadmin.sh
@@ -15,16 +15,11 @@ if [[ "${EUID}" -ne 0 ]]; then
exit 1
fi
-# Download the script, if it exists.
-SCRIPT_URL="${PDSADMIN_BASE_URL}/${COMMAND}.sh"
-SCRIPT_FILE="$(mktemp /tmp/pdsadmin.${COMMAND}.XXXXXX)"
+SCRIPT_FILE="NIXPKGS_PDSADMIN_ROOT/lib/pds/${COMMAND}.sh"
-if ! curl --fail --silent --show-error --location --output "${SCRIPT_FILE}" "${SCRIPT_URL}"; then
+if ! [ -f "${SCRIPT_FILE}" ]; then
echo "ERROR: ${COMMAND} not found"
exit 2
fi
-chmod +x "${SCRIPT_FILE}"
-if "${SCRIPT_FILE}" "$@"; then
- rm --force "${SCRIPT_FILE}"
-fi
+"${SCRIPT_FILE}" "$@"