blob: 59e8bc94c541dbbc09b2d9563f70ef94e6fa6eb3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
{
config,
lib,
pkgs,
...
}:
let
inherit (lib)
mkEnableOption
mkIf
mkOption
mkPackageOption
mkRemovedOptionModule
types
;
cfg = config.services.plantuml-server;
in
{
imports = [
(mkRemovedOptionModule [
"services"
"plantuml-server"
"allowPlantumlInclude"
] "This option has been removed from PlantUML.")
];
options = {
services.plantuml-server = {
enable = mkEnableOption "PlantUML server";
package = mkPackageOption pkgs "plantuml-server" { };
packages = {
jdk = mkPackageOption pkgs "jdk" { };
jetty = mkPackageOption pkgs "jetty" {
default = [ "jetty_12" ];
};
};
user = mkOption {
type = types.str;
default = "plantuml";
description = "User which runs PlantUML server.";
};
group = mkOption {
type = types.str;
default = "plantuml";
description = "Group which runs PlantUML server.";
};
home = mkOption {
type = types.path;
default = "/var/lib/plantuml";
description = "Home directory of the PlantUML server instance.";
};
listenHost = mkOption {
type = types.str;
default = "127.0.0.1";
description = "Host to listen on.";
};
listenPort = mkOption {
type = types.port;
default = 8080;
description = "Port to listen on.";
};
plantumlLimitSize = mkOption {
type = types.int;
default = 4096;
description = "Limits image width and height.";
};
graphvizPackage = mkPackageOption pkgs "graphviz" { };
plantumlStats = mkOption {
type = types.bool;
default = false;
description = "Set it to on to enable statistics report (https://plantuml.com/statistics-report).";
};
httpAuthorization = mkOption {
type = types.nullOr types.str;
default = null;
description = "When calling the proxy endpoint, the value of HTTP_AUTHORIZATION will be used to set the HTTP Authorization header.";
};
};
};
config = mkIf cfg.enable {
systemd.services.plantuml-server = {
description = "PlantUML server";
wantedBy = [ "multi-user.target" ];
environment = {
PLANTUML_LIMIT_SIZE = toString cfg.plantumlLimitSize;
GRAPHVIZ_DOT = "${cfg.graphvizPackage}/bin/dot";
PLANTUML_STATS = if cfg.plantumlStats then "on" else "off";
HTTP_AUTHORIZATION = cfg.httpAuthorization;
};
script = ''
${cfg.packages.jdk}/bin/java \
-jar ${cfg.packages.jetty}/start.jar \
--module=http,ee11-deploy,ee11-jsp \
-Djetty.home=${cfg.packages.jetty} \
-Djetty.base=${cfg.package} \
-Djetty.http.host=${cfg.listenHost} \
-Djetty.http.port=${toString cfg.listenPort}
'';
serviceConfig = {
User = cfg.user;
Group = cfg.group;
StateDirectory = mkIf (cfg.home == "/var/lib/plantuml") "plantuml";
StateDirectoryMode = mkIf (cfg.home == "/var/lib/plantuml") "0750";
# Hardening
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DynamicUser = true;
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateNetwork = false;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" ];
};
};
};
meta.maintainers = with lib.maintainers; [
truh
anthonyroussel
];
}
|
