nixos/corteza: init, nixosTests.corteza: init (#420428)

- Docker now defaults to 28.x, because version 27.x stopped receiving security updates and bug fixes after [May 2, 2025](https://github.com/moby/moby/pull/49910).

- [Corteza](https://cortezaproject.org/), a low-code platform. Available as [services.corteza](#opt-services.corteza.enable).

- [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).

- [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).

  ./services/development/athens.nix

  ./services/development/blackfire.nix

  ./services/development/bloop.nix

  ./services/development/corteza.nix

  ./services/development/distccd.nix

  ./services/development/gemstash.nix

  ./services/development/hoogle.nix

{

  config,

  lib,

  pkgs,

  ...

}:

let

  cfg = config.services.corteza;

in

{

  options.services.corteza = {

    enable = lib.mkEnableOption "Corteza, a low-code platform";

    package = lib.mkPackageOption pkgs "corteza" { };

    address = lib.mkOption {

      type = lib.types.str;

      default = "0.0.0.0";

      description = ''

        IP for the HTTP server.

      '';

    };

    port = lib.mkOption {

      type = lib.types.port;

      default = 80;

      description = ''

        Port for the HTTP server.

      '';

    };

    openFirewall = lib.mkOption {

      type = lib.types.bool;

      default = false;

      example = true;

      description = "Whether to open ports in the firewall.";

    };

    user = lib.mkOption {

      type = lib.types.str;

      default = "corteza";

      description = "The user to run Corteza under.";

    };

    group = lib.mkOption {

      type = lib.types.str;

      default = "corteza";

      description = "The group to run Corteza under.";

    };

    settings = lib.mkOption {

      type = lib.types.submodule {

        freeformType = lib.types.attrsOf lib.types.str;

        options = {

          HTTP_WEBAPP_ENABLED = lib.mkEnableOption "webapps" // {

            default = true;

            apply = toString;

          };

        };

      };

      default = { };

      description = ''

        Configuration for Corteza, will be passed as environment variables.

        See <https://docs.cortezaproject.org/corteza-docs/2024.9/devops-guide/references/configuration/server.html>.

      '';

    };

  };

  config = lib.mkIf cfg.enable {

    assertions = [

      {

        assertion = !cfg.settings ? HTTP_ADDR;

        message = "Use `services.corteza.address` and `services.corteza.port` instead.";

      }

    ];

    warnings = lib.optional (!cfg.settings ? DB_DSN) ''

      A database connection string is not set.

      Corteza will create a temporary SQLite database in memory, but it will not persist data.

      For production use, set `services.corteza.settings.DB_DSN`.

    '';

    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];

    systemd.services.corteza = {

      description = "Corteza";

      documentation = [ "https://docs.cortezaproject.org/" ];

      after = [ "network-online.target" ];

      wants = [ "network-online.target" ];

      wantedBy = [ "multi-user.target" ];

      environment = {

        HTTP_WEBAPP_BASE_DIR = "./webapp";

        HTTP_ADDR = "${cfg.address}:${toString cfg.port}";

      } // cfg.settings;

      path = [ pkgs.dart-sass ];

      serviceConfig = {

        WorkingDirectory = cfg.package;

        User = cfg.user;

        Group = cfg.group;

        ExecStart = "${lib.getExe cfg.package} serve-api";

      };

    };

    users = {

      groups.${cfg.group} = { };

      users.${cfg.user} = {

        inherit (cfg) group;

        isSystemUser = true;

      };

    };

  };

  meta.maintainers = with lib.maintainers; [

    prince213

  ];

}

  containers-unified-hierarchy = runTest ./containers-unified-hierarchy.nix;

  convos = runTest ./convos.nix;

  corerad = handleTest ./corerad.nix { };

  corteza = runTest ./corteza.nix;

  cosmic = runTest {

    imports = [ ./cosmic.nix ];

    _module.args.testName = "cosmic";

{ lib, ... }:

let

  port = 8080;

in

{

  name = "corteza";

  meta.maintainers = [ lib.teams.ngi.members ];

  nodes.machine = {

    services.corteza = {

      enable = true;

      inherit port;

    };

  };

  testScript = ''

    machine.start()

    machine.wait_for_unit("default.target")

    machine.wait_until_succeeds("curl http://localhost:${toString port}/auth/login | grep button-login")

  '';

}