blob: 1fa69814c6c9fa9d7ecca94fa805faea4a231631 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
|
{ config, lib, pkgs, ... }:
let
inherit (lib)
literalExpression
mdDoc
mkEnableOption
mkIf
mkOption
mkPackageOptionMD
mkRemovedOptionModule
types
;
cfg = config.services.plantuml-server;
in
{
imports = [
(mkRemovedOptionModule [ "services" "plantuml-server" "allowPlantumlInclude" ] "This option has been removed from PlantUML.")
];
options = {
services.plantuml-server = {
enable = mkEnableOption (mdDoc "PlantUML server");
package = mkPackageOptionMD pkgs "plantuml-server" { };
packages = {
jdk = mkPackageOptionMD pkgs "jdk" { };
jetty = mkPackageOptionMD pkgs "jetty" {
default = "jetty_11";
extraDescription = ''
At the time of writing (v1.2023.12), PlantUML Server does not support
Jetty versions higher than 12.x.
Jetty 12.x has introduced major breaking changes, see
<https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.0> and
<https://eclipse.dev/jetty/documentation/jetty-12/programming-guide/index.html#pg-migration-11-to-12>
'';
};
};
user = mkOption {
type = types.str;
default = "plantuml";
description = mdDoc "User which runs PlantUML server.";
};
group = mkOption {
type = types.str;
default = "plantuml";
description = mdDoc "Group which runs PlantUML server.";
};
home = mkOption {
type = types.path;
default = "/var/lib/plantuml";
description = mdDoc "Home directory of the PlantUML server instance.";
};
listenHost = mkOption {
type = types.str;
default = "127.0.0.1";
description = mdDoc "Host to listen on.";
};
listenPort = mkOption {
type = types.int;
default = 8080;
description = mdDoc "Port to listen on.";
};
plantumlLimitSize = mkOption {
type = types.int;
default = 4096;
description = mdDoc "Limits image width and height.";
};
graphvizPackage = mkPackageOptionMD pkgs "graphviz" { };
plantumlStats = mkOption {
type = types.bool;
default = false;
description = mdDoc "Set it to on to enable statistics report (https://plantuml.com/statistics-report).";
};
httpAuthorization = mkOption {
type = types.nullOr types.str;
default = null;
description = mdDoc "When calling the proxy endpoint, the value of HTTP_AUTHORIZATION will be used to set the HTTP Authorization header.";
};
};
};
config = mkIf cfg.enable {
systemd.services.plantuml-server = {
description = "PlantUML server";
wantedBy = [ "multi-user.target" ];
path = [ cfg.home ];
environment = {
PLANTUML_LIMIT_SIZE = builtins.toString cfg.plantumlLimitSize;
GRAPHVIZ_DOT = "${cfg.graphvizPackage}/bin/dot";
PLANTUML_STATS = if cfg.plantumlStats then "on" else "off";
HTTP_AUTHORIZATION = cfg.httpAuthorization;
};
script = ''
${cfg.packages.jdk}/bin/java \
-jar ${cfg.packages.jetty}/start.jar \
--module=deploy,http,jsp \
jetty.home=${cfg.packages.jetty} \
jetty.base=${cfg.package} \
jetty.http.host=${cfg.listenHost} \
jetty.http.port=${builtins.toString cfg.listenPort}
'';
serviceConfig = {
User = cfg.user;
Group = cfg.group;
StateDirectory = mkIf (cfg.home == "/var/lib/plantuml") "plantuml";
StateDirectoryMode = mkIf (cfg.home == "/var/lib/plantuml") "0750";
# Hardening
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DynamicUser = true;
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateNetwork = false;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" ];
};
};
};
meta.maintainers = with lib.maintainers; [ truh anthonyroussel ];
}
|