Passopolis password manager service #25907

disassembler · 2017-05-19T03:09:45Z

Motivation for this change

Adds passopolis password manager service

Things done

Tested using sandboxing
(nix.useSandbox on NixOS,
or option build-use-sandbox in nix.conf
on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- Linux
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

Mic92 · 2017-05-20T06:23:32Z

nixos/modules/services/misc/passopolis.nix

+
+      db_url = mkOption {
+        default = "jdbc:postgresql://localhost:5432/passopolis";
+        description = "Database URL";


Would not
type = types.str;
be applicable here?

Mic92 · 2017-05-20T06:25:50Z

nixos/modules/misc/ids.nix

@@ -294,6 +294,7 @@
      jackett = 276;
      aria2 = 277;
      clickhouse = 278;
+      passopolis = 279;


As it seems to not to persist data to disk, it does not require a fixed uid. If that's the case, just remove this line. The uid will be then allocated dynamically.

Mic92 · 2017-05-20T06:29:01Z

nixos/modules/services/misc/passopolis.nix

+      };
+
+      db_url = mkOption {
+        default = "jdbc:postgresql://localhost:5432/passopolis";


If this url contains database passwords, it would be better if the url can be also stored outside of nix store in a file.

From what I can tell, the app doesn't support authenticated database url's at this time. I'm not a java programmer, so I could be wrong. Where would you persist the credentials if it could potentially contain user/password?

According to that url https://www.petefreitag.com/articles/jdbc_urls/ the underlying library can.
I would then look similar to this example: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gogs.nix#L116

The only way according the the team developing it to set that db_url is as a runtime parameter (there's no app.properties or anything yet to store parameters), so if someone launches the app and has credentials in the db_url, anyone on the system can run a ps and see those credentials. Once a config system is added for the application, I completely agree that keeping the credentials out of the nix store is the better way to go or better yet encrypting in the store if RFC 0005 gets implemented.

Mic92 · 2017-05-20T06:29:54Z

pkgs/servers/passopolis/default.nix

+  meta = {
+    homepage = "https://github.com/WeAreWizards/passopolis-server";
+    description = "A well-designed, well-functioning and secure secret manager.";
+    license = stdenv.lib.licenses.gpl3;


Do you want to maintain this package?

Yes I would. Should I squash the commit and force push so it's only one commit?

I can squash that too when merging. Can you add yourself as maintainer then? https://github.com/nixos-users/wiki/wiki/Get-Involved#becoming-a-nixpkgs-maintainer

Mic92 · 2017-05-20T06:31:39Z

pkgs/servers/passopolis/default.nix

+    url = "https://github.com/WeAreWizards/passopolis-server";
+    sha256 = "0ywmymbjcfsxv1p1j0l0lw9cb7f79h23ic1c4b5w5nb0k9f4zvfq";
+    rev = "${version}";
+    leaveDotGit = true;


Will the build fail, if it cannot use git to obtain its commit? Leaving .git can lead to not-reproducible artifacts.

It won't fail, but it will put garbage in the build.properties file. When running the ant jar command, it generates a build.properties file with the build time, git commit and description.

Mic92 · 2017-05-20T06:35:29Z

pkgs/servers/passopolis/default.nix

+let
+  version = "b827b3a6176e050deb729009676fad7e86e5393a";
+in antBuild {
+  name = "passopolis-${version}";


We usually use passopolis-unstable-<year>-<month>-<day> here as it is more meaningful then a commit hash (where the date is the date of the commit).

jagajaga · 2017-05-22T17:05:22Z

nixos/modules/services/misc/passopolis.nix

+
+    services.passopolis = {
+
+      enable = mkOption {


Please use mkEnableOption

jagajaga · 2017-05-23T14:55:12Z

pkgs/servers/passopolis/default.nix

+{ stdenv, antBuild, fetchgit, git, python }:
+
+let
+  version = "unstable-2016-05-07";


Remove unstable

I have suggested to add ùnstable because of https://nixos.org/nixpkgs/manual/#sec-package-naming

If you have a better idea how things should be named, please also update the coding conventions. Otherwise it gets inconsistent across reviews.

Mic92 · 2017-05-23T20:15:43Z

nixos/modules/services/misc/passopolis.nix

        config.services.postgresql.package
      ];
      preStart = ''
      mkdir -p ${cfg.statePath}
      chown ${cfg.user} ${cfg.statePath}
-      if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
+      ${lib.optionalString cfg.enablePostgreSQLDatabase ''


this makes the intention of the user a little bit more explicit and convenient.

Mic92 · 2017-05-23T20:47:29Z

It still requires a database password with the default settings:

org.postgresql.util.PSQLException: The server requested password-based authentication, but no password was provided.

This has to be provided in the database url: https://jdbc.postgresql.org/documentation/80/connect.html

(does require a password)

disassembler · 2017-09-24T18:06:19Z

I'm going to close this out. Hasn't been updated in 2 years. extension no longer builds for me as well. Going to start making the switch to keepassweb

disassembler mentioned this pull request May 19, 2017

postgresql configuration WeAreWizards/passopolis-server#12

Open

disassembler force-pushed the passopolis-server branch from 5920ef4 to 251a555 Compare May 19, 2017 14:28

Mic92 reviewed May 20, 2017

View reviewed changes

disassembler force-pushed the passopolis-server branch 2 times, most recently from 133c9a5 to 8b65875 Compare May 21, 2017 04:38

jagajaga requested changes May 22, 2017

View reviewed changes

jagajaga reviewed May 23, 2017

View reviewed changes

passopolis: init at b827b3a6176e050deb729009676fad7e86e5393a

24d6871

disassembler force-pushed the passopolis-server branch from 444f50c to 24d6871 Compare May 23, 2017 16:14

typo in mail address

99b33f0

Mic92 reviewed May 23, 2017

View reviewed changes

Mic92 added 2 commits May 31, 2017 16:50

passopolis: add enablePostgresqlDatabase option

bb2ac0a

passopolis: fix python build script shebang

3f2c22a

Mic92 force-pushed the passopolis-server branch from 75c6105 to 82bd392 Compare May 31, 2017 15:51

passopolis: expose databaseUrl as option

f487bf2

(does require a password)

Mic92 force-pushed the passopolis-server branch from 82bd392 to f487bf2 Compare May 31, 2017 21:59

disassembler closed this Sep 24, 2017

Janik-Haag added the 12. first-time contribution label Jun 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Passopolis password manager service #25907

Passopolis password manager service #25907

disassembler commented May 19, 2017 •

edited

Mic92 May 20, 2017

disassembler May 20, 2017

Mic92 May 20, 2017

disassembler May 20, 2017

Mic92 May 20, 2017

disassembler May 20, 2017

Mic92 May 20, 2017

disassembler May 20, 2017

Mic92 May 20, 2017

disassembler May 20, 2017

Mic92 May 20, 2017 •

edited

Mic92 May 20, 2017

disassembler May 20, 2017

Mic92 May 20, 2017

disassembler May 20, 2017

jagajaga May 22, 2017

disassembler May 22, 2017

jagajaga May 23, 2017

Mic92 May 23, 2017

Mic92 May 23, 2017

Mic92 May 23, 2017 •

edited

Mic92 commented May 23, 2017 •

edited

disassembler commented Sep 24, 2017

Passopolis password manager service #25907

Passopolis password manager service #25907

Conversation

disassembler commented May 19, 2017 • edited

Motivation for this change

Things done

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Mic92 May 20, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Mic92 May 23, 2017 • edited

Choose a reason for hiding this comment

Mic92 commented May 23, 2017 • edited

disassembler commented Sep 24, 2017

disassembler commented May 19, 2017 •

edited

Mic92 May 20, 2017 •

edited

Mic92 May 23, 2017 •

edited

Mic92 commented May 23, 2017 •

edited