499 lines
16 KiB
Nix
499 lines
16 KiB
Nix
{ config, lib, pkgs, modulesPath, ... }:
|
|
|
|
let
|
|
inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption types
|
|
boolToString callPackageWith optional optionals optionalString recursiveUpdate;
|
|
|
|
cfg = config.services.snipe-it;
|
|
|
|
phpPackage = cfg.phpPackage.withExtensions ({ enabled, all }:
|
|
enabled ++ (with all; [
|
|
json
|
|
openssl
|
|
pdo
|
|
mbstring
|
|
tokenizer
|
|
curl
|
|
ldap
|
|
zip
|
|
fileinfo
|
|
bcmath
|
|
gd
|
|
] ++ optionals useMysql [
|
|
pdo_mysql
|
|
])
|
|
);
|
|
|
|
nginxPackage = config.services.nginx.package;
|
|
|
|
user = cfg.user;
|
|
group = cfg.group;
|
|
|
|
db = cfg.database;
|
|
useMysql = db.type == "mysql";
|
|
useSqlite = db.type == "sqlite";
|
|
|
|
mail = cfg.mail;
|
|
|
|
useSSL = with cfg.nginx; (addSSL || forceSSL || onlySSL || enableACME);
|
|
|
|
snipe-it = cfg.package.override { inherit (cfg) cacheDir dataDir; };
|
|
|
|
artisan = pkgs.writeShellScriptBin "snipe-it" ''
|
|
cd ${snipe-it}
|
|
sudo=exec
|
|
if [[ "$USER" != ${user} ]]; then
|
|
sudo='exec /run/wrappers/bin/sudo -u ${user}'
|
|
fi
|
|
$sudo ${phpPackage}/bin/php artisan $*
|
|
'';
|
|
|
|
in {
|
|
|
|
options.services.snipe-it = {
|
|
enable = mkEnableOption "Snipe-IT free open source IT asset management";
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = callPackageWith pkgs ../../pkgs/snipe-it { };
|
|
description = "Snipe-IT derivation to use.";
|
|
};
|
|
|
|
phpPackage = mkOption {
|
|
type = types.package;
|
|
default = pkgs.php74;
|
|
description = "PHP package to use.";
|
|
};
|
|
|
|
user = mkOption {
|
|
type = types.str;
|
|
default = "snipe-it";
|
|
description = "User Snipe-IT runs as.";
|
|
};
|
|
|
|
group = mkOption {
|
|
type = types.str;
|
|
default = "snipe-it";
|
|
description = "Group Snipe-IT runs as.";
|
|
};
|
|
|
|
hostName = mkOption {
|
|
type = types.str;
|
|
example = "assets.example.com";
|
|
description = "FQDN for the Snipe-IT instance.";
|
|
};
|
|
|
|
maxResults = mkOption {
|
|
type = types.int;
|
|
default = 500;
|
|
description = ''
|
|
The result limit. This value determines the maximum number of results to return,
|
|
even if a higher limit is passed in an API request. This is done to prevent
|
|
timeouts when custom scripts are requesting large numbers of assets at a time.
|
|
'';
|
|
};
|
|
|
|
# Basic app settings
|
|
appKeyFile = mkOption {
|
|
type = types.path;
|
|
example = "/run/keys/snipe-it-appkey";
|
|
description = ''
|
|
A file containing the app key. Used for encryption where needed.
|
|
Can be generated with <code>head -c32 /dev/urandom | base64</code>.
|
|
'';
|
|
};
|
|
|
|
dataDir = mkOption {
|
|
type = types.path;
|
|
default = "/var/lib/snipe-it";
|
|
description = "Snipe-IT's data directory.";
|
|
};
|
|
|
|
cacheDir = mkOption {
|
|
type = types.path;
|
|
default = "/var/cache/snipe-it";
|
|
description = "Snipe-IT's cache directory";
|
|
};
|
|
|
|
database = {
|
|
type = mkOption {
|
|
type = types.enum [ "mysql" "sqlite" ];
|
|
default = "mysql";
|
|
description = "Database engine to use.";
|
|
};
|
|
host = mkOption {
|
|
type = types.str;
|
|
default = "localhost";
|
|
description = "Database host address.";
|
|
};
|
|
port = mkOption {
|
|
type = types.port;
|
|
default = if useMysql then 3306 else 5432;
|
|
description = ''
|
|
Database host port. This currently only has
|
|
an effect when using MySQL.
|
|
'';
|
|
};
|
|
name = mkOption {
|
|
type = types.str;
|
|
default = "snipe-it";
|
|
description = "Name of the MySQL database.";
|
|
};
|
|
username = mkOption {
|
|
type = types.str;
|
|
default = user;
|
|
description = "Username to use to connect to database.";
|
|
};
|
|
passwordFile = mkOption {
|
|
type = types.nullOr types.path;
|
|
example = "/run/keys/snipe-it-dbpass";
|
|
description = ''
|
|
File containing the password corresponding to
|
|
<option>database.username</option>.
|
|
'';
|
|
};
|
|
};
|
|
|
|
mail = {
|
|
host = mkOption {
|
|
type = types.str;
|
|
default = "localhost";
|
|
description = "Mail server host address.";
|
|
};
|
|
port = mkOption {
|
|
type = types.port;
|
|
default = 25;
|
|
description = "Mail server host port.";
|
|
};
|
|
encryption = mkOption {
|
|
type = types.nullOr (types.enum [ "ssl" "tls" ]);
|
|
default = null;
|
|
example = "tls";
|
|
description = ''
|
|
Type of transport encryption to use.
|
|
'';
|
|
};
|
|
username = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = "User to use to connect to mail server.";
|
|
};
|
|
passwordFile = mkOption {
|
|
type = types.path;
|
|
example = "/run/keys/snipe-it-mailpass";
|
|
description = ''
|
|
File containing the password corresponding to
|
|
<option>mail.username</option>.
|
|
'';
|
|
};
|
|
fromAddress = mkOption {
|
|
type = types.str;
|
|
description = ''Global "From" address.'';
|
|
};
|
|
fromName = mkOption {
|
|
type = types.str;
|
|
default = "Snipe-IT";
|
|
description = ''Global "From" name.'';
|
|
};
|
|
replytoAddress = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
Global "Reply-To" address. If null (the default),
|
|
"Reply-To" won't be set.
|
|
'';
|
|
};
|
|
replytoName = mkOption {
|
|
type = types.str;
|
|
default = "Snipe-IT";
|
|
description = ''
|
|
Global "Reply-To" name. <option>mail.replytoAddress</option>
|
|
also has to be set for this to have any effect.
|
|
'';
|
|
};
|
|
autoEmbed = {
|
|
enable = mkEnableOption "Embed images into mails instead of hyperlinking them.";
|
|
|
|
method = mkOption {
|
|
type = types.enum [ "attachment" "base64" ];
|
|
default = "attachment";
|
|
description = "Embedding method to use.";
|
|
};
|
|
};
|
|
};
|
|
|
|
memcached = {
|
|
enable = mkEnableOption "memcached as caching backend";
|
|
host = mkOption {
|
|
type = types.str;
|
|
default = "localhost";
|
|
description = "Memcached host address.";
|
|
};
|
|
|
|
port = mkOption {
|
|
type = types.port;
|
|
default = 11211;
|
|
description = "Memcached host port.";
|
|
};
|
|
};
|
|
|
|
session = {
|
|
lifeTime = mkOption {
|
|
type = types.int;
|
|
default = 12000;
|
|
description = "Session lifetime in minutes.";
|
|
};
|
|
expireOnClose = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Expire sessions when closing browser window.";
|
|
};
|
|
encrypt = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Encrypt stored session data.";
|
|
};
|
|
};
|
|
|
|
maxUploadSize = mkOption {
|
|
type = types.str;
|
|
default = "16M";
|
|
example = "1G";
|
|
description = "The maximum size for uploads (e.g. images).";
|
|
};
|
|
|
|
poolConfig = mkOption {
|
|
type = with types; attrsOf (oneOf [ str int bool ]);
|
|
default = {
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = 32;
|
|
"pm.start_servers" = 2;
|
|
"pm.min_spare_servers" = 2;
|
|
"pm.max_spare_servers" = 4;
|
|
"pm.max_requests" = 500;
|
|
};
|
|
description = ''
|
|
Options for the Snipe-IT PHP pool. See the documentation on
|
|
<literal>php-fpm.conf</literal> for details on configuration directives.
|
|
'';
|
|
};
|
|
|
|
nginx = mkOption {
|
|
type = types.submodule (
|
|
recursiveUpdate
|
|
(import
|
|
(modulesPath + "/services/web-servers/nginx/vhost-options.nix")
|
|
{ inherit config lib; })
|
|
{}
|
|
);
|
|
default = {};
|
|
example = {
|
|
serverAliases = [
|
|
"snipe-it.\${config.networking.domain}"
|
|
];
|
|
# To enable encryption and let letsencrypt take care of certificate
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
};
|
|
description = ''
|
|
With this option, you can customize the nginz virtualHost settings.
|
|
'';
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.nullOr types.lines;
|
|
default = null;
|
|
example = ''
|
|
LOGIN_MAX_ATTEMPTS=3
|
|
LOGIN_LOCKOUT_DURATION=300
|
|
'';
|
|
};
|
|
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
warnings =
|
|
optional (!useMysql) ''
|
|
Please note: Using another database than MySQL isn't officially supported.
|
|
'';
|
|
|
|
environment.systemPackages = [ artisan ];
|
|
|
|
services.mysql = mkIf (useMysql && db.host == "localhost") {
|
|
enable = mkDefault true;
|
|
package = mkDefault pkgs.mariadb;
|
|
ensureDatabases = [ db.name ];
|
|
ensureUsers = [{
|
|
name = db.username;
|
|
ensurePermissions = { "${db.name}.*" = "ALL PRIVILEGES"; };
|
|
}];
|
|
};
|
|
|
|
services.phpfpm.pools.snipe-it = {
|
|
inherit user group;
|
|
phpOptions = ''
|
|
log_errors = on
|
|
post_max_size = ${cfg.maxUploadSize}
|
|
upload_max_filesize = ${cfg.maxUploadSize}
|
|
'';
|
|
settings = {
|
|
"listen.mode" = "0660";
|
|
"listen.owner" = user;
|
|
"listen.group" = group;
|
|
} // cfg.poolConfig;
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = mkDefault true;
|
|
virtualHosts."${cfg.hostName}" = mkMerge [ cfg.nginx {
|
|
root = mkForce "${snipe-it}/public";
|
|
extraConfig = ''
|
|
index index.php index.html index.htm;
|
|
${optionalString useSSL "fastcgi_param HTTPS on;"}
|
|
'';
|
|
locations = {
|
|
"/" = {
|
|
extraConfig = ''try_files $uri $uri/ /index.php$is_args$args;'';
|
|
};
|
|
"~ \.php$" = {
|
|
extraConfig = ''
|
|
try_files $uri $uri/ =404;
|
|
include ${nginxPackage}/conf/fastcgi_params;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
fastcgi_pass unix:${config.services.phpfpm.pools."snipe-it".socket};
|
|
${optionalString useSSL "fastcgi_param HTTPS on;"}
|
|
'';
|
|
};
|
|
};
|
|
}];
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d ${cfg.cacheDir} 0700 ${user} ${group} - -"
|
|
"d ${cfg.cacheDir}/bootstrap 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir} 0710 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/accessories 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/assets 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/avatars 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/barcodes 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/categories 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/companies 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/components 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/consumables 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/departments 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/locations 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/manufacturers 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/models 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/uploads/suppliers 0750 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/app 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/app/backups 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/app/backups/env-backups 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/debugbar 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/framework 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/cache 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/sessions 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/views 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/logs 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/assetmodels 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/assets 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/audits 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/imports 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/licenses 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/signatures 0700 ${user} ${group} - -"
|
|
"d ${cfg.dataDir}/storage/private_uploads/users 0700 ${user} ${group} - -"
|
|
] ++ optionals useSqlite [
|
|
"f ${cfg.dataDir}/database.sqlite 0600 ${user} ${group} -"
|
|
];
|
|
|
|
|
|
systemd.services.snipe-it-setup = {
|
|
description = "Preparation tasks for Snipe-IT";
|
|
before = [ "phpfpm-snipe-it.service" ];
|
|
after = optional useMysql "mysql.service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = user;
|
|
WorkingDirectory = "${snipe-it}";
|
|
};
|
|
script = ''
|
|
# create .env file
|
|
cat > ${cfg.dataDir}/.env << EOF
|
|
APP_KEY="base64:$(head -n1 ${cfg.appKeyFile})"
|
|
APP_URL="http${optionalString useSSL "s"}://${cfg.hostName}"
|
|
APP_LOG=syslog
|
|
MAX_RESULTS=${toString cfg.maxResults}
|
|
|
|
'' + optionalString useSSL ''
|
|
ENABLE_HSTS=true
|
|
SECURE_COOKIES=true
|
|
|
|
'' + ''
|
|
SESSION_DRIVER=file
|
|
SESSION_LIFETIME=${toString cfg.session.lifeTime}
|
|
EXPIRE_ON_CLOSE=${boolToString cfg.session.expireOnClose}
|
|
ENCRYPT=${boolToString cfg.session.encrypt}
|
|
|
|
DB_CONNECTION=${db.type}
|
|
'' + optionalString (db.type != "sqlite") ''
|
|
DB_HOST=${db.host}
|
|
DB_PORT=${toString db.port}
|
|
DB_PASSWORD="$(head -n1 ${db.passwordFile})"
|
|
DB_USERNAME=${db.username}
|
|
DB_DATABASE=${db.name}
|
|
'' + ''
|
|
|
|
MAIL_DRIVER=smtp
|
|
MAIL_HOST=${mail.host}
|
|
MAIL_PORT=${toString mail.port}
|
|
${optionalString (mail.encryption != null) "MAIL_ENCRYPTION=${mail.encryption}"}
|
|
MAIL_FROM_ADDR=${mail.fromAddress}
|
|
MAIL_FROM_NAME=${mail.fromName}
|
|
MAIL_AUTO_EMBED=${boolToString mail.autoEmbed.enable}
|
|
MAIL_AUTO_EMBED_METHOD=${mail.autoEmbed.method}
|
|
'' + optionalString (mail.username != null) ''
|
|
MAIL_USERNAME=${mail.username}
|
|
MAIL_PASSWORD="$(head -n1 ${mail.passwordFile})"
|
|
'' + optionalString (mail.replytoAddress != null) ''
|
|
MAIL_REPLYTO_ADDR=${mail.replytoAddress}
|
|
MAIL_REPLYTO_NAME=${mail.replytoName}
|
|
'' + optionalString cfg.memcached.enable ''
|
|
|
|
CACHE_DRIVER=memcached
|
|
MEMCACHED_HOST=${cfg.memcached.host}
|
|
MEMCACHED_PORT=${toString cfg.memcached.port}
|
|
'' + ''
|
|
|
|
${optionalString (cfg.extraConfig != null) cfg.extraConfig}
|
|
EOF
|
|
chmod 600 ${cfg.dataDir}/.env
|
|
|
|
# re-evaluate configuration
|
|
${phpPackage}/bin/php artisan config:clear
|
|
${phpPackage}/bin/php artisan config:cache
|
|
|
|
# migrate db
|
|
${phpPackage}/bin/php artisan migrate --force
|
|
|
|
# create caches
|
|
${phpPackage}/bin/php artisan event:cache
|
|
${phpPackage}/bin/php artisan view:cache
|
|
'';
|
|
};
|
|
|
|
users = {
|
|
users."${user}" = {
|
|
isSystemUser = true;
|
|
home = cfg.dataDir;
|
|
group = group;
|
|
};
|
|
groups."${group}" = {};
|
|
users."${config.services.nginx.user}".extraGroups = [ group ];
|
|
};
|
|
};
|
|
}
|