Merge pull request #127767 from Mic92/go-neb

nixos/modules/services/networking/go-neb.nix

@@ -5,7 +5,8 @@ with lib;
 let
   cfg = config.services.go-neb;
 
-  configFile = pkgs.writeText "config.yml" (builtins.toJSON cfg.config);
+  settingsFormat = pkgs.formats.yaml {};
+  configFile = settingsFormat.generate "config.yaml" cfg.config;
 in {
   options.services.go-neb = {
     enable = mkEnableOption "Extensible matrix bot written in Go";
@@ -16,13 +17,26 @@ in {
       default = ":4050";
     };
 
+    secretFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/keys/go-neb.env";
+      description = ''
+        Environment variables from this file will be interpolated into the
+        final config file using envsubst with this syntax: <literal>$ENVIRONMENT</literal>
+        or <literal>''${VARIABLE}</literal>.
+        The file should contain lines formatted as <literal>SECRET_VAR=SECRET_VALUE</literal>.
+        This is useful to avoid putting secrets into the nix store.
+      '';
+    };
+
     baseUrl = mkOption {
       type = types.str;
       description = "Public-facing endpoint that can receive webhooks.";
     };
 
     config = mkOption {
-      type = types.uniq types.attrs;
+      inherit (settingsFormat) type;
       description = ''
         Your <filename>config.yaml</filename> as a Nix attribute set.
         See <link xlink:href="https://github.com/matrix-org/go-neb/blob/master/config.sample.yaml">config.sample.yaml</link>
@@ -32,18 +46,30 @@ in {
   };
 
   config = mkIf cfg.enable {
-    systemd.services.go-neb = {
+    systemd.services.go-neb = let
+      finalConfigFile = if cfg.secretFile == null then configFile else "/var/run/go-neb/config.yaml";
+    in {
       description = "Extensible matrix bot written in Go";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       environment = {
         BASE_URL = cfg.baseUrl;
         BIND_ADDRESS = cfg.bindAddress;
-        CONFIG_FILE = configFile;
+        CONFIG_FILE = finalConfigFile;
       };
 
       serviceConfig = {
+        ExecStartPre = lib.optional (cfg.secretFile != null)
+          (pkgs.writeShellScript "pre-start" ''
+            umask 077
+            export $(xargs < ${cfg.secretFile})
+            ${pkgs.envsubst}/bin/envsubst -i "${configFile}" > ${finalConfigFile}
+            chown go-neb ${finalConfigFile}
+          '');
+        PermissionsStartOnly = true;
+        RuntimeDirectory = "go-neb";
         ExecStart = "${pkgs.go-neb}/bin/go-neb";
+        User = "go-neb";
         DynamicUser = true;
       };
     };

nixos/tests/go-neb.nix

@@ -10,10 +10,11 @@ import ./make-test-python.nix ({ pkgs, ... }:
       services.go-neb = {
         enable = true;
         baseUrl = "http://localhost";
+        secretFile = pkgs.writeText "secrets" "ACCESS_TOKEN=changeme";
         config = {
           clients = [ {
             UserId = "@test:localhost";
-            AccessToken = "changeme";
+            AccessToken = "$ACCESS_TOKEN";
             HomeServerUrl = "http://localhost";
             Sync = false;
             AutoJoinRooms = false;
@@ -33,11 +34,10 @@ import ./make-test-python.nix ({ pkgs, ... }:
   testScript = ''
     start_all()
     server.wait_for_unit("go-neb.service")
-    server.wait_until_succeeds(
-        "curl -fL http://localhost:4050/services/hooks/d2lraXBlZGlhX3NlcnZpY2U"
-    )
-    server.wait_until_succeeds(
-        "journalctl -eu go-neb -o cat | grep -q service_id=wikipedia_service"
+    server.wait_until_succeeds("curl -fL http://localhost:4050/services/hooks/d2lraXBlZGlhX3NlcnZpY2U")
+    server.succeed(
+        "journalctl -eu go-neb -o cat | grep -q service_id=wikipedia_service",
+        "grep -q changeme /var/run/go-neb/config.yaml",
     )
   '';
 

pkgs/applications/networking/instant-messengers/go-neb/default.nix

@@ -1,20 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests, olm }:
 
 buildGoModule {
   pname = "go-neb";
-  version = "unstable-2020-04-09";
+  version = "unstable-2021-03-24";
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "go-neb";
-    rev = "1e297c50ad2938e511a3c86f4b190fd3fc3559d6";
-    sha256 = "1azwy4s4kmypps1fjbz76flpi1b7sjzjj4qwx94cry0hn3qfnrc6";
+    rev = "b6edd50d6e33de3bcdb35055fa6c5f0157f45321";
+    sha256 = "sha256-wFqkN4C0rWzWxa6+/LiHMMS8i/g3Q57f5z4cG2XZQzs=";
   };
 
   subPackages = [ "." ];
 
-  patches = [ ./go-mod.patch ];
+  buildInputs = [ olm ];
 
-  vendorSha256 = "1k3980yf6zl00dkd1djwhm2f9nnffzrsbs3kq3alpw2gm0aln739";
+  vendorSha256 = "sha256-sWrLWjODf25Z8QqCDg4KyVWmTc3PRiYpRL88yxK0j/M";
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/go-neb/go-mod.patch

@@ -1,50 +0,0 @@
-diff --git a/go.mod b/go.mod
-index 8ed4e68..83526e7 100644
---- a/go.mod
-+++ b/go.mod
-@@ -4,24 +4,15 @@ go 1.14
- 
- require (
- 	github.com/PuerkitoBio/goquery v1.5.1 // indirect
--	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
--	github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4 // indirect
- 	github.com/andygrunwald/go-jira v1.11.0
- 	github.com/beorn7/perks v1.0.1 // indirect
--	github.com/cespare/xxhash/v2 v2.1.1 // indirect
- 	github.com/dghubble/oauth1 v0.6.0
- 	github.com/die-net/lrucache v0.0.0-20190707192454-883874fe3947
--	github.com/go-kit/kit v0.9.0 // indirect
--	github.com/go-logfmt/logfmt v0.4.0 // indirect
--	github.com/go-stack/stack v1.8.0 // indirect
--	github.com/gogo/protobuf v1.1.1 // indirect
- 	github.com/golang/protobuf v1.3.2 // indirect
- 	github.com/google/go-cmp v0.4.0 // indirect
- 	github.com/google/go-github v2.0.1-0.20160719063544-b5e5babef39c+incompatible
- 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
- 	github.com/jaytaylor/html2text v0.0.0-20200220170450-61d9dc4d7195
--	github.com/json-iterator/go v1.1.9 // indirect
--	github.com/julienschmidt/httprouter v1.2.0 // indirect
- 	github.com/kr/pretty v0.1.0 // indirect
- 	github.com/lib/pq v1.3.0
- 	github.com/matrix-org/dugong v0.0.0-20180820122854-51a565b5666b
-@@ -32,9 +23,6 @@ require (
- 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
- 	github.com/mmcdole/gofeed v1.0.0-beta2
- 	github.com/mmcdole/goxpp v0.0.0-20181012175147-0068e33feabf // indirect
--	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
--	github.com/modern-go/reflect2 v1.0.1 // indirect
--	github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223 // indirect
- 	github.com/olekukonko/tablewriter v0.0.4 // indirect
- 	github.com/pkg/errors v0.8.1 // indirect
- 	github.com/prometheus/client_golang v0.8.1-0.20160916180340-5636dc67ae77
-@@ -47,10 +35,7 @@ require (
- 	github.com/stretchr/testify v1.4.0 // indirect
- 	golang.org/x/net v0.0.0-20200301022130-244492dfa37a
- 	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
--	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e // indirect
- 	golang.org/x/sys v0.0.0-20200122134326-e047566fdf82 // indirect
--	golang.org/x/tools v0.0.0-20200311090712-aafaee8bce8c // indirect
--	gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
- 	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
- 	gopkg.in/yaml.v2 v2.2.8
- )