Unverified Commit a0cde252 authored by Paul Meyer's avatar Paul Meyer Committed by GitHub
Browse files

nixos/gonic: fix writeability of paths from config (#463848)

parents d038b8ee 68daa1c7

nixos/modules/services/audio/gonic.nix

+3 −2
Original line number Diff line number Diff line
@@ -21,6 +21,8 @@ in 


      enable = lib.mkEnableOption "Gonic music server";



      package = lib.mkPackageOption pkgs "gonic" { };



      settings = lib.mkOption rec {

        type = settingsFormat.type;

        apply = lib.recursiveUpdate default;
@@ -62,8 +64,7 @@ in 
              n: v: !((n == "tls-cert" || n == "tls-key") && v == null)

            ) cfg.settings;

          in

          "${pkgs.gonic}/bin/gonic -config-path ${settingsFormat.generate "gonic" filteredSettings}";

        DynamicUser = true;

          "${lib.getExe cfg.package} -config-path ${settingsFormat.generate "gonic" filteredSettings}";

        StateDirectory = "gonic";

        CacheDirectory = "gonic";

        WorkingDirectory = "/var/lib/gonic";

nixos/tests/gonic.nix

+44 −4
Original line number Diff line number Diff line 
{ pkgs, ... }:

{ lib, pkgs, ... }:

{

  name = "gonic";

  meta.maintainers = pkgs.gonic.meta.maintainers;



  nodes.machine =

  nodes.default_cache_dir =

    { config, ... }:

    {

      systemd.tmpfiles.settings = {

        "10-gonic" = {

          "/tmp/music"."d" = { };

          "/tmp/podcast"."d" = { };

          "/tmp/playlists"."d" = { };

          "/tmp/secrets"."d" = { };

        };

      };

      services.gonic = {

        enable = true;

        # Wrap gonic to check that the required paths are writable.

        # This isn't necessarily checked by successful service startup.

        package = pkgs.writeShellApplication {

          name = "gonic-test-wrapper";

          runtimeInputs = [ pkgs.gonic ];

          text = ''

            touch ${config.services.gonic.settings.cache-path}/foo && echo "cache dir writeable" >&2

            touch /tmp/podcast/foo && echo "podcast dir writeable" >&2

            touch /tmp/playlists/foo && echo "playlists dir writeable" >&2

            touch /tmp/secrets/foo && echo "shouldn't be able to write /tmp/secrets" >&2 && exit 1

            exec ${lib.getExe pkgs.gonic} "$@"

          '';

        };

        settings = {

          music-path = [ "/tmp/music" ];

          podcast-path = "/tmp/podcast";

          playlists-path = "/tmp/playlists";

        };

      };

    };



  nodes.custom_cache_dir =

    { ... }:

    {

      systemd.tmpfiles.settings = {
@@ -10,6 +45,7 @@ 
          "/tmp/music"."d" = { };

          "/tmp/podcast"."d" = { };

          "/tmp/playlists"."d" = { };

          "/tmp/cache"."d" = { };

        };

      };

      services.gonic = {
@@ -18,12 +54,16 @@ 
          music-path = [ "/tmp/music" ];

          podcast-path = "/tmp/podcast";

          playlists-path = "/tmp/playlists";

          cache-path = "/tmp/cache";

        };

      };

    };



  testScript = ''

    machine.wait_for_unit("gonic")

    machine.wait_for_open_port(4747)

    default_cache_dir.wait_for_unit("gonic")

    default_cache_dir.wait_for_open_port(4747)



    custom_cache_dir.wait_for_unit("gonic")

    custom_cache_dir.wait_for_open_port(4747)

  '';

}