fosspay: init at unstable-2020-12-02

[pniedzwiedzinski]

Motivation for this change

#119290

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Testing

{
  imports = [
    /home/pn/code/nixpkgs/nixos/modules/services/web-apps/fosspay.nix
  ];

  services.fosspay.enable = true;
  services.fosspay.config = ''
[dev]
# Change this to the actual location of your site
# You can include a path in the domain if it's a subdirectory
# i.e. domain=drewdevault.com/donate
# omit the trailing slash
protocol=http
domain=localhost:5000
# Change this value to something random and secret
secret-key=hello world

# On the debug server, this lets you choose what to bind to
debug-host=0.0.0.0
debug-port=5000

# Fill out these details with your mail server
smtp-host=mail.example.org
smtp-port=587
smtp-user=you
smtp-password=password
smtp-from=donate@example.org

# Your information
your-name=Joe Bloe
your-email=joe@example.org
# ^ you should have a gravatar that works with this email

# SQL connection string
connection-string=postgresql://postgres@localhost/fosspay

# Stripe API info: https://dashboard.stripe.com/account/apikeys
stripe-secret=
stripe-publish=

# Currency to use
# "usd" for dollar, "eur" for euro
# refer to stripe documentation for details : https://stripe.com/docs/currencies
currency=usd

# Separate with spaces
default-amounts=3 5 10 20
# Which one to pick when they arrive?
default-amount=5

# Pick between "monthly" and "once"
default-type=monthly

# Display monthly donations publicly
public-income=yes

# How much are you hoping to earn monthly, in cents
goal=500

# Optional Patreon integration
# Register a client here: https://www.patreon.com/portal/registration/register-clients
# And put in the "Creator's Access Token" here:
patreon-access-token=
# And the "Creator's Refresh Token" here:
patreon-refresh-token=
# Client ID
patreon-client-id=
# Client secret
patreon-client-secret=
# And the Patreon campaign you want to connect with:
patreon-campaign=

# Optional LiberaPay integration, fill in your username here
liberapay-campaign=

# Optional GitHub sponsors integration
# Generate personal access key at https://github.com/settings/tokens
# Must have "user" access.
github-token=

# Command to reload fosspay (send it a SIGHUP)
reload-command=kill -HUP $(pgrep -xf '/usr/bin/python3.*app.py' | tail -n 1)
  '';

  nixpkgs.config.packageOverrides = pkgs: {
    fosspay = pkgs.callPackage /home/pn/code/nixpkgs/pkgs/servers/fosspay {};
  };

  system.stateVersion = "20.03";
}

[r-rmcgibbo]

Result of nixpkgs-review pr 119750 at b497478b run on x86_64-linux 1

1 package built successfully:

• fosspay

3 suggestions:

• warning: missing-phase-hooks

  installPhase should probably contain runHook preInstall and runHook postInstall.

  Near pkgs/servers/fosspay/default.nix:30:3:

     |
  30 |   installPhase = ''
     |   ^
  

• warning: license-missing

  Package is missing a license.

  Near pkgs/servers/fosspay/default.nix:30:3:

     |
  30 |   installPhase = ''
     |   ^
  

• warning: maintainers-missing

  Package does not have a maintainer. Consider adding yourself?

  Near pkgs/servers/fosspay/default.nix:30:3:

     |
  30 |   installPhase = ''
     |   ^
  

[aanderse]

Thanks for choosing to contribute to nixos! It looks like you have a good start but there are a few things I'd like to mention about your module. I decided it might be helpful to hack on your code a little bit and show you my take on the module, which you can see here.

A few points:

• As you mentioned secrets are an issue with the nix store. We should create a nixos option for every type of secret, for the most part.
• I replaced your configuration file stuff with a settings option to give more flexibility to the sysadmin.
• The user needs to put this behind a reverse proxy like nginx. Did you want to configure that for the user, or leave it up to them?
• You don't run the fosspay cronjob.py script at all.
• I'm not familiar with this software, but you see to diverge from the rough suggestion on how to write the systemd unit. Can you discuss your approach vs using gunicorn?
• You shouldn't muck around with a users services.postgresql.authentication unless you have very good reason to do so. In this case I'm not convinced you do.
• You don't allow external databases, but I have put in some code which allows this (though needs to be finished, I just roughed in the idea).

Please let me know if you have any questions or need help. The code I posted was really a starting point and hasn't been tested, etc... It is just to convey a few ideas.

[dotlambda]

There should be three commits:

• maintainers: add pniedzwiedzinski
• fosspay: init at unstable-2020-12-02
• nixos/fosspay: init

[pniedzwiedzinski]

Update:

• Still struggling with setting up database connection, because psycopg2 complains about empty password. Weird, by default postgres doesn't use trust as it is in docs - this sounds not right but I'm not sure.
• This module will not configure nginx. I set up gunicorn.
• I use connectionString because it is the format that sqlalchemy uses, and it's easier to left it as it is.
• TODO: cronjob.py

[aanderse]

Nice update! A few notes:

• I would guess your postgresql issue is likely resolved by specifying the socket in the connection string
• at some point before we merge this you should take a look at NixOS modules: chmod leaves opportunity to leak secrets #121293

[stale]

I marked this as stale due to inactivity. → More info