-
-
Notifications
You must be signed in to change notification settings - Fork 13.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
300 changed files
with
8,785 additions
and
2,605 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6700,6 +6700,16 @@ | |
| githubId = 9959940; | ||
| name = "Andreas Fehn"; | ||
| }; | ||
| felbinger = { | ||
| name = "Nico Felbinger"; | ||
| email = "[email protected]"; | ||
| matrix = "@nico:felbinger.eu"; | ||
| github = "felbinger"; | ||
| githubId = 26925347; | ||
| keys = [{ | ||
| fingerprint = "0797 D238 9769 CA1E 57B7 2ED9 2BA7 8116 87C9 0DE4"; | ||
| }]; | ||
| }; | ||
| felipeqq2 = { | ||
| name = "Felipe Silva"; | ||
| email = "[email protected]"; | ||
|
|
@@ -12893,6 +12903,12 @@ | |
| githubId = 427866; | ||
| name = "Matthias Beyer"; | ||
| }; | ||
| matthiasq = { | ||
| email = "[email protected]"; | ||
| github = "matthias-Q"; | ||
| githubId = 35303817; | ||
| name = "Matthias Queitsch"; | ||
| }; | ||
| MatthieuBarthel = { | ||
| email = "[email protected]"; | ||
| name = "Matthieu Barthel"; | ||
|
|
@@ -12926,6 +12942,16 @@ | |
| githubId = 11810057; | ||
| name = "Matt Snider"; | ||
| }; | ||
| MattSturgeon = { | ||
| email = "[email protected]"; | ||
| github = "MattSturgeon"; | ||
| githubId = 5046562; | ||
| matrix = "@mattsturg:matrix.org"; | ||
| name = "Matt Sturgeon"; | ||
| keys = [{ | ||
| fingerprint = "7082 22EA 1808 E39A 83AC 8B18 4F91 844C ED1A 8299"; | ||
| }]; | ||
| }; | ||
| matusf = { | ||
| email = "[email protected]"; | ||
| github = "matusf"; | ||
|
|
@@ -16937,6 +16963,12 @@ | |
| githubId = 22085373; | ||
| name = "Luis Hebendanz"; | ||
| }; | ||
| qubitnano = { | ||
| name = "qubitnano"; | ||
| email = "[email protected]"; | ||
| github = "qubitnano"; | ||
| githubId = 146656568; | ||
| }; | ||
| queezle = { | ||
| email = "[email protected]"; | ||
| github = "queezle42"; | ||
|
|
@@ -16976,6 +17008,12 @@ | |
| githubId = 2141853; | ||
| name = "Bang Lee"; | ||
| }; | ||
| qwqawawow = { | ||
| email = "[email protected]"; | ||
| github = "qwqawawow"; | ||
| githubId = 40905037; | ||
| name = "qwqawawow"; | ||
| }; | ||
| qyliss = { | ||
| email = "[email protected]"; | ||
| github = "alyssais"; | ||
|
|
@@ -22755,6 +22793,11 @@ | |
| githubId = 40352765; | ||
| name = "Yoctocell"; | ||
| }; | ||
| yomaq = { | ||
| name = "yomaq"; | ||
| github = "yomaq"; | ||
| githubId = 112864332; | ||
| }; | ||
| yorickvp = { | ||
| email = "[email protected]"; | ||
| matrix = "@yorickvp:matrix.org"; | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,142 @@ | ||
| { config, pkgs, lib, utils, ... }: | ||
| let | ||
| cfg = config.services.pghero; | ||
| settingsFormat = pkgs.formats.yaml { }; | ||
| settingsFile = settingsFormat.generate "pghero.yaml" cfg.settings; | ||
| in | ||
| { | ||
| options.services.pghero = { | ||
| enable = lib.mkEnableOption "PgHero service"; | ||
| package = lib.mkPackageOption pkgs "pghero" { }; | ||
|
|
||
| listenAddress = lib.mkOption { | ||
| type = lib.types.str; | ||
| example = "[::1]:3000"; | ||
| description = '' | ||
| `hostname:port` to listen for HTTP traffic. | ||
| This is bound using the systemd socket activation. | ||
| ''; | ||
| }; | ||
|
|
||
| extraArgs = lib.mkOption { | ||
| type = lib.types.listOf lib.types.str; | ||
| default = [ ]; | ||
| description = '' | ||
| Additional command-line arguments for the systemd service. | ||
| Refer to the [Puma web server documentation] for available arguments. | ||
| [Puma web server documentation]: https://puma.io/puma#configuration | ||
| ''; | ||
| }; | ||
|
|
||
| settings = lib.mkOption { | ||
| type = settingsFormat.type; | ||
| default = { }; | ||
| example = { | ||
| databases = { | ||
| primary = { | ||
| url = "<%= ENV['PRIMARY_DATABASE_URL'] %>"; | ||
| }; | ||
| }; | ||
| }; | ||
| description = '' | ||
| PgHero configuration. Refer to the [PgHero documentation] for more | ||
| details. | ||
| [PgHero documentation]: https://github.com/ankane/pghero/blob/master/guides/Linux.md#multiple-databases | ||
| ''; | ||
| }; | ||
|
|
||
| environment = lib.mkOption { | ||
| type = lib.types.attrsOf lib.types.str; | ||
| default = { }; | ||
| description = '' | ||
| Environment variables to set for the service. Secrets should be | ||
| specified using {option}`environmentFile`. | ||
| ''; | ||
| }; | ||
|
|
||
| environmentFiles = lib.mkOption { | ||
| type = lib.types.listOf lib.types.path; | ||
| default = [ ]; | ||
| description = '' | ||
| File to load environment variables from. Loaded variables override | ||
| values set in {option}`environment`. | ||
| ''; | ||
| }; | ||
|
|
||
| extraGroups = lib.mkOption { | ||
| type = lib.types.listOf lib.types.str; | ||
| default = [ ]; | ||
| example = [ "tlskeys" ]; | ||
| description = '' | ||
| Additional groups for the systemd service. | ||
| ''; | ||
| }; | ||
| }; | ||
|
|
||
| config = lib.mkIf cfg.enable { | ||
| systemd.sockets.pghero = { | ||
| unitConfig.Description = "PgHero HTTP socket"; | ||
| wantedBy = [ "sockets.target" ]; | ||
| listenStreams = [ cfg.listenAddress ]; | ||
| }; | ||
|
|
||
| systemd.services.pghero = { | ||
| description = "PgHero performance dashboard for PostgreSQL"; | ||
| wantedBy = [ "multi-user.target" ]; | ||
| requires = [ "pghero.socket" ]; | ||
| after = [ "pghero.socket" "network.target" ]; | ||
|
|
||
| environment = { | ||
| RAILS_ENV = "production"; | ||
| PGHERO_CONFIG_PATH = settingsFile; | ||
| } // cfg.environment; | ||
|
|
||
| serviceConfig = { | ||
| Type = "notify"; | ||
| WatchdogSec = "10"; | ||
|
|
||
| ExecStart = utils.escapeSystemdExecArgs ([ | ||
| (lib.getExe cfg.package) | ||
| "--bind-to-activated-sockets" | ||
| "only" | ||
| ] ++ cfg.extraArgs); | ||
| Restart = "always"; | ||
|
|
||
| WorkingDirectory = "${cfg.package}/share/pghero"; | ||
|
|
||
| EnvironmentFile = cfg.environmentFiles; | ||
| SupplementaryGroups = cfg.extraGroups; | ||
|
|
||
| DynamicUser = true; | ||
| UMask = "0077"; | ||
|
|
||
| ProtectHome = true; | ||
| ProtectProc = "invisible"; | ||
| ProcSubset = "pid"; | ||
| ProtectClock = true; | ||
| ProtectHostname = true; | ||
| ProtectControlGroups = true; | ||
| ProtectKernelLogs = true; | ||
| ProtectKernelModules = true; | ||
| ProtectKernelTunables = true; | ||
| PrivateUsers = true; | ||
| PrivateDevices = true; | ||
| RestrictRealtime = true; | ||
| RestrictNamespaces = true; | ||
| RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; | ||
| DeviceAllow = [ "" ]; | ||
| DevicePolicy = "closed"; | ||
| CapabilityBoundingSet = [ "" ]; | ||
| MemoryDenyWriteExecute = true; | ||
| LockPersonality = true; | ||
| SystemCallArchitectures = "native"; | ||
| SystemCallErrorNumber = "EPERM"; | ||
| SystemCallFilter = [ "@system-service" ]; | ||
| }; | ||
| }; | ||
| }; | ||
| } |
Oops, something went wrong.