diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-04-16 01:44:03 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-04-16 01:44:03 +0200 |
commit | ec2a5ffb986e9b21dff31e16d112aa9052a4bc5c (patch) | |
tree | 0775b4d0338706e069f166836d7797e73bbe9b0f /nixops/modules/websites/tools/diaspora | |
parent | a0c845b436329624ad33432a701658dc1b52cca6 (diff) | |
download | Nix-ec2a5ffb986e9b21dff31e16d112aa9052a4bc5c.tar.gz Nix-ec2a5ffb986e9b21dff31e16d112aa9052a4bc5c.tar.zst Nix-ec2a5ffb986e9b21dff31e16d112aa9052a4bc5c.zip |
Move diaspora and mantisbt passwords to a secure location
Related issue: https://git.immae.eu/mantisbt/view.php?id=122
Diffstat (limited to 'nixops/modules/websites/tools/diaspora')
-rw-r--r-- | nixops/modules/websites/tools/diaspora/default.nix | 16 | ||||
-rw-r--r-- | nixops/modules/websites/tools/diaspora/diaspora.nix | 39 |
2 files changed, 44 insertions, 11 deletions
diff --git a/nixops/modules/websites/tools/diaspora/default.nix b/nixops/modules/websites/tools/diaspora/default.nix index b1cb6f2..5d36ce7 100644 --- a/nixops/modules/websites/tools/diaspora/default.nix +++ b/nixops/modules/websites/tools/diaspora/default.nix | |||
@@ -24,15 +24,27 @@ in { | |||
24 | home = diaspora.varDir; | 24 | home = diaspora.varDir; |
25 | useDefaultShell = true; | 25 | useDefaultShell = true; |
26 | packages = [ diaspora.gems pkgs.nodejs diaspora.gems.ruby ]; | 26 | packages = [ diaspora.gems pkgs.nodejs diaspora.gems.ruby ]; |
27 | extraGroups = [ "keys" ]; | ||
27 | }; | 28 | }; |
28 | 29 | ||
29 | users.groups.diaspora.gid = config.ids.gids.diaspora; | 30 | users.groups.diaspora.gid = config.ids.gids.diaspora; |
30 | 31 | ||
32 | deployment.keys = diaspora.keys; | ||
31 | systemd.services.diaspora = { | 33 | systemd.services.diaspora = { |
32 | description = "Diaspora"; | 34 | description = "Diaspora"; |
33 | wantedBy = [ "multi-user.target" ]; | 35 | wantedBy = [ "multi-user.target" ]; |
34 | after = [ "network.target" "redis.service" "postgresql.service" ]; | 36 | after = [ |
35 | wants = [ "redis.service" "postgresql.service" ]; | 37 | "network.target" "redis.service" "postgresql.service" |
38 | "tools-diaspora-secret_token.service" | ||
39 | "tools-diaspora-config.service" | ||
40 | "tools-diaspora-database_config.service" | ||
41 | ]; | ||
42 | wants = [ | ||
43 | "redis.service" "postgresql.service" | ||
44 | "tools-diaspora-secret_token.service" | ||
45 | "tools-diaspora-config.service" | ||
46 | "tools-diaspora-database_config.service" | ||
47 | ]; | ||
36 | 48 | ||
37 | environment.RAILS_ENV = "production"; | 49 | environment.RAILS_ENV = "production"; |
38 | environment.BUNDLE_PATH = "${diaspora.gems}/${diaspora.gems.ruby.gemPath}"; | 50 | environment.BUNDLE_PATH = "${diaspora.gems}/${diaspora.gems.ruby.gemPath}"; |
diff --git a/nixops/modules/websites/tools/diaspora/diaspora.nix b/nixops/modules/websites/tools/diaspora/diaspora.nix index 82bca8c..074dfb2 100644 --- a/nixops/modules/websites/tools/diaspora/diaspora.nix +++ b/nixops/modules/websites/tools/diaspora/diaspora.nix | |||
@@ -29,10 +29,21 @@ let | |||
29 | }; | 29 | }; |
30 | }; | 30 | }; |
31 | }; | 31 | }; |
32 | secret_token = writeText "secret_token.rb" '' | 32 | keys.tools-diaspora-secret_token = { |
33 | Diaspora::Application.config.secret_key_base = '${env.secret_token}' | 33 | destDir = "/run/keys/webapps"; |
34 | user = "diaspora"; | ||
35 | group = "diaspora"; | ||
36 | permissions = "0700"; | ||
37 | text = '' | ||
38 | Diaspora::Application.config.secret_key_base = '${env.secret_token}' | ||
34 | ''; | 39 | ''; |
35 | config = writeText "diaspora.yml" '' | 40 | }; |
41 | keys.tools-diaspora-config = { | ||
42 | destDir = "/run/keys/webapps"; | ||
43 | user = "diaspora"; | ||
44 | group = "diaspora"; | ||
45 | permissions = "0700"; | ||
46 | text = '' | ||
36 | configuration: | 47 | configuration: |
37 | environment: | 48 | environment: |
38 | url: "https://diaspora.immae.eu/" | 49 | url: "https://diaspora.immae.eu/" |
@@ -105,7 +116,13 @@ let | |||
105 | development: | 116 | development: |
106 | environment: | 117 | environment: |
107 | ''; | 118 | ''; |
108 | database_config = writeText "database.yml" '' | 119 | }; |
120 | keys.tools-diaspora-database_config = { | ||
121 | destDir = "/run/keys/webapps"; | ||
122 | user = "diaspora"; | ||
123 | group = "diaspora"; | ||
124 | permissions = "0700"; | ||
125 | text = '' | ||
109 | postgresql: &postgresql | 126 | postgresql: &postgresql |
110 | adapter: postgresql | 127 | adapter: postgresql |
111 | host: "${env.postgresql.socket}" | 128 | host: "${env.postgresql.socket}" |
@@ -133,23 +150,27 @@ let | |||
133 | <<: *combined | 150 | <<: *combined |
134 | database: diaspora_integration2 | 151 | database: diaspora_integration2 |
135 | ''; | 152 | ''; |
136 | 153 | }; | |
137 | railsRoot = stdenv.mkDerivation { | 154 | railsRoot = stdenv.mkDerivation { |
138 | name = "diaspora_immae"; | 155 | name = "diaspora_immae"; |
139 | inherit diaspora; | 156 | inherit diaspora; |
157 | # FIXME: build machine will contain some passwords in the nix store | ||
140 | builder = writeText "build_diaspora_immae" '' | 158 | builder = writeText "build_diaspora_immae" '' |
141 | source $stdenv/setup | 159 | source $stdenv/setup |
142 | cp -a $diaspora $out | 160 | cp -a $diaspora $out |
143 | cd $out | 161 | cd $out |
144 | chmod -R u+rwX . | 162 | chmod -R u+rwX . |
145 | tar -czf public/source.tar.gz ./{app,db,lib,script,Gemfile,Gemfile.lock,Rakefile,config.ru} | 163 | tar -czf public/source.tar.gz ./{app,db,lib,script,Gemfile,Gemfile.lock,Rakefile,config.ru} |
146 | ln -s ${database_config} config/database.yml | 164 | ln -s ${writeText "database.yml" keys.tools-diaspora-database_config.text} config/database.yml |
147 | ln -s ${config} config/diaspora.yml | 165 | ln -s ${writeText "diaspora.yml" keys.tools-diaspora-config.text} config/diaspora.yml |
148 | ln -s ${secret_token} config/initializers/secret_token.rb | 166 | ln -s ${writeText "secret_token.rb" keys.tools-diaspora-secret_token.text} config/initializers/secret_token.rb |
149 | ln -sf ${varDir}/schedule.yml config/schedule.yml | 167 | ln -sf ${varDir}/schedule.yml config/schedule.yml |
150 | ln -sf ${varDir}/oidc_key.pem config/oidc_key.pem | 168 | ln -sf ${varDir}/oidc_key.pem config/oidc_key.pem |
151 | ln -sf ${varDir}/uploads public/uploads | 169 | ln -sf ${varDir}/uploads public/uploads |
152 | RAILS_ENV=production ${gems}/bin/rake assets:precompile | 170 | RAILS_ENV=production ${gems}/bin/rake assets:precompile |
171 | ln -sf /run/keys/webapps/tools-diaspora-database_config config/database.yml | ||
172 | ln -sf /run/keys/webapps/tools-diaspora-config config/diaspora.yml | ||
173 | ln -sf /run/keys/webapps/tools-diaspora-secret_token config/initializers/secret_token.rb | ||
153 | rm -rf tmp log | 174 | rm -rf tmp log |
154 | ln -sf ${varDir}/tmp tmp | 175 | ln -sf ${varDir}/tmp tmp |
155 | ln -sf ${varDir}/log log | 176 | ln -sf ${varDir}/log log |
@@ -158,6 +179,6 @@ let | |||
158 | }; | 179 | }; |
159 | in | 180 | in |
160 | { | 181 | { |
161 | inherit railsRoot varDir socketsDir gems; | 182 | inherit railsRoot varDir socketsDir gems keys; |
162 | railsSocket = "${socketsDir}/diaspora.sock"; | 183 | railsSocket = "${socketsDir}/diaspora.sock"; |
163 | } | 184 | } |