[WIP] staytus, staytus-module: init at 2017-11-08 #31475
Conversation
|
Currently, the systemd unit file that is generated looks ok. But when it runs, it says:
procodile is supposed to start two jobs: web, and worker Running the worker: /nix/store/vs983zxrjb8xwfdx4z2s6lrq6n18ll9c-staytus-rake/bin/staytus-jobs but running the web job: /nix/store/vs983zxrjb8xwfdx4z2s6lrq6n18ll9c-staytus-rake/bin/staytus-puma
Still trying to figure this out, but not getting very far. |
|
I finally have it working, with themes! Config value services.staytus.stateDir allows the user to chose a state dir. This keeps the logs around, and also tracks database state. There are two systemd services that are started. staytusjobs runs the job worker, and staytus the puma web server. Nginx handles static file accesses and passes off to puma when necessary. Setting a theme is a matter of setting |
|
Should I squash my commits into one? |
| # type = types.str; | ||
| # default = "postgresql"; | ||
| # description = "Type of database"; | ||
| #}; |
| rm -rf /run/staytus | ||
| mkdir -p /run/staytus/pids | ||
|
|
||
| cp -Rv ${package}/share/staytus/* /run/staytus |
There was a problem hiding this comment.
How much data is stored here? /run is a tmpfs with a limited size, /var/lib might be a better choice.
There was a problem hiding this comment.
Was not aware of that, will change.
| config.services.mysql.package | ||
| ]; | ||
| preStart = '' | ||
| export HOME=$TMP |
There was a problem hiding this comment.
This might be dangerous if the application creates files in /tmp naively (without using mktemp or similar). Other users might trick this service into to different locations by creating symlinks. A dedicated home is recommend.
There was a problem hiding this comment.
Ok, makes sense. Maybe it is not needed anyway. I'll see if it can simply be removed.
| stateDir = mkOption { | ||
| type = types.str; | ||
| default = "/var/staytus"; | ||
| description = "The state directory, logs and plugins are stored here"; |
There was a problem hiding this comment.
Is there an important use-case for making this configurable? If we advertise this as an API it is harder to change the location in future without breaking compatibility. What does upstream proposes here as an directory? I would use /var/lib/staytus otherwise.
There was a problem hiding this comment.
I think that the users should be able to decide where their logs go. I'll set the default to /var/lib/staytus.
| themes = mkOption { | ||
| type = types.attrsOf types.path; | ||
| default = {}; | ||
| description = "Set of themes"; |
There was a problem hiding this comment.
Can you provide an example value here.
| cd $out | ||
| unpackFile ${source} | ||
| ''; | ||
| }); |
There was a problem hiding this comment.
Are staytus themes always zip archives? The following api might be more general:
services.staytus.themes = [
(fetchzip {
url = "https://host/theme.zip";
sha256 = "...";
})
(fetchgit {
url = "https://host/theme.git"
rev = "some-release";
sha256 = "...";
})
];
There was a problem hiding this comment.
That would be much better, yes. Could you share an example of how to handle that at the receiving end? I just use unpackFile at the moment.
There was a problem hiding this comment.
@Mic92 actually in this api, would it be possible to use local files as well as remote ones? Is there a local version of fetchzip, or is it compatible with relative paths?
Reason is, I am using this in nixops, and have my company theme in the same dir as the server nixops config, so I just use ./theme.zip.
| type = types.str; | ||
| default = ""; | ||
| description = "SMTP user password"; | ||
| }; |
There was a problem hiding this comment.
smtpPassword and secretKeyBase will end world-readable up in the nix store. This might be not desired depending on the deployment. Until NixOS/nix#8 is solved we add the option to store secrets in a dedicated file, that is copied/loaded at runtime by the service. As the configuration is created at build time, substitution with sed can be used to replace a password place holder with a concrete value.
There was a problem hiding this comment.
How does one handle the password file with NixOps?
There was a problem hiding this comment.
I think it might be possible to use unix socket authentication to reset the password to something random every time the service is started.
So the staytus user would connect to mysql via unix socket (along the lines of this: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/databases/mysql.nix#L368), then add an identification using a password that is auto generated, which is then set in an env var, and picked up by rails.
On the face of it, it seems possible, so I'll have a closer look next week.
|
@ravloony you can squash the last two commits into a |
|
@Mic92 Thanks for the input. I should have fixed the issues tomorrow. |
ravloony
force-pushed
the
staytus
branch
6 times, most recently
from
3df4ff7
to
9586f5d
Compare
ravloony
force-pushed
the
staytus
branch
2 times, most recently
from
4d86719
to
a51e40a
Compare
|
@ravloony regarding declarative mysql users & databases part: I'd consider to use |
ravloony
force-pushed
the
staytus
branch
2 times, most recently
from
74173b8
to
db9b284
Compare
ravloony
force-pushed
the
staytus
branch
3 times, most recently
from
bc75d66
to
7064bd1
Compare
ravloony
force-pushed
the
staytus
branch
2 times, most recently
from
c4898c8
to
26f7159
Compare
ravloony
requested review from
edwtjo,
Ericson2314,
FRidh,
LnL7,
nbp,
orivej,
peti,
rycee,
ttuegel and
zimbatm
as code owners
|
Closing due to inactivity. |
Motivation for this change
Add Staytus (staytus.co) package and service.
Things done
build-use-sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)At the moment, this builds and sets up the database, but does not start the service. I have not yet managed to figure out all the environment stuff needed to get procodile, puma, bundler, rake and rails to work together happily. Any help would be much appreciated!