Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/opendkim: Deprecate configFile in favor of settings option #82379

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

infinisil
Copy link
Member

Motivation for this change

Because #75584 still takes some work and I saw #78126, I decided to implement the settings concept from NixOS/rfcs#42 for opendkim. This makes everything much nicer, especially for third-party code like nixos-mailserver (for which I will submit a PR to make it compatible with the changes here).

Unfortunately I found no backwards compatible way to keep configFile working, so I just removed it, which also simplifies the module a lot, and in addition allows other modules to read values from settings (which wouldn't always be possible with a configFile option).

I have yet to test this properly.

Removes the need for #78126 and closes #27260

Ping @aanderse @qknight @abbradar @brprice @Valodim

Things done
  • Tested it

@@ -91,6 +104,22 @@ in {

config = mkIf cfg.enable {

services.opendkim.settings = {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we set a default UMask of 002 here? That way the socket created by the daemon will be accessible by its group (which we also set by default). See #27260

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good, did that

@infinisil
Copy link
Member Author

Now tested this successfully, would like to merge soon.

@aanderse What do you think about having configFile options in addition to settings options? Because if both of them exist, there's the problems:

  • Assigning to settings doesn't guarantee that it ends up in the configFile (if the user overrides the generated one)
  • Modules can't read settings reliably at evaluation time, because if configFile is specified, all the settings ones won't apply.

Previously I argued that it makes sense to allow configFile because sometimes you just want to set this directly, or to an impure path. But now I'm thinking this would better be done by overriding ExecStart or so directly (with a mkForce, indicating that something (above things) break).

@infinisil
Copy link
Member Author

Also opened a PR for nixos-mailserver to support the changes in this PR: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/162

@aanderse
Copy link
Member

You raise some valid points. Currently some modules already have a configFile (or equivalent) option and they document that using that option will nullify certain other options. I don't see any material difference between a configFile nullifying module options or settings values - it just needs to be documented. I worry removing the configFile mostly just makes the escape hatch harder.

Just a quick idea off the top of my head, but for bonus points modules could add assertions if users have set the configFile option as well as setting options which are ignored in that case.

assertions = [
  { assertion = cfg.settings != defaultSettings -> cfg.configFile == configFile;
    message = ''
      You specified both a custom config so `settings` will be ignored.
    '';
  }
];

Or something like that. Maybe that is overboard, though.

@infinisil
Copy link
Member Author

infinisil commented Mar 26, 2020

@aanderse The problem with that is: If settings or configFile are set by third-party modules (which the user can't control directly), then this assertion prevents the user from using configFile or settings respectively.

Okay how about this: There is a configFile option, but the default is specified as configFile = generatedConfigFile, without mkDefault, meaning for users to change it, they have to mkForce it (which I'm again taking to mean that one is leaving intended territory, and things may not work because of it). The description could point this out, saying

If you override this option, settings won't apply and can contain incorrect values, which third-party modules may rely on. This is outside of supported territory, prefer using the settings option.

@aanderse
Copy link
Member

That sounds like a good idea 👍

@infinisil
Copy link
Member Author

@aanderse Though in this case I'd still like to remove the previous configFile option, because it won't have the same meaning as after this change: Previously part of the settings were passed in via command line arguments, meaning you wouldn't have to specify them in the config file. But after this change, all settings are passed via the config file. Meaning if you previously set configFile, you wouldn't pass the command line settings after this change.

@stale
Copy link

stale bot commented Sep 26, 2020

Hello, I'm a bot and I thank you in the name of the community for your contributions.

Nixpkgs is a busy repository, and unfortunately sometimes PRs get left behind for too long. Nevertheless, we'd like to help committers reach the PRs that are still important. This PR has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human.

If this is still important to you and you'd like to remove the stale label, we ask that you leave a comment. Your comment can be as simple as "still important to me". But there's a bit more you can do:

If you received an approval by an unprivileged maintainer and you are just waiting for a merge, you can @ mention someone with merge permissions and ask them to help. You might be able to find someone relevant by using Git blame on the relevant files, or via GitHub's web interface. You can see if someone's a member of the nixpkgs-committers team, by hovering with the mouse over their username on the web interface, or by searching them directly on the list.

If your PR wasn't reviewed at all, it might help to find someone who's perhaps a user of the package or module you are changing, or alternatively, ask once more for a review by the maintainer of the package/module this is about. If you don't know any, you can use Git blame on the relevant files, or GitHub's web interface to find someone who touched the relevant files in the past.

If your PR has had reviews and nevertheless got stale, make sure you've responded to all of the reviewer's requests / questions. Usually when PR authors show responsibility and dedication, reviewers (privileged or not) show dedication as well. If you've pushed a change, it's possible the reviewer wasn't notified about your push via email, so you can always officially request them for a review, or just @ mention them and say you've addressed their comments.

Lastly, you can always ask for help at our Discourse Forum, or more specifically, at this thread or at #nixos' IRC channel.

@stale stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Sep 26, 2020
@stale stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Oct 3, 2020
@stale
Copy link

stale bot commented Jun 7, 2021

I marked this as stale due to inactivity. → More info

@stale stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 7, 2021
@wegank wegank marked this pull request as draft March 20, 2024 15:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

opendkim: unix domain sockets
4 participants