Merge pull request #266702 from nh2/plausible-listen-address-no-distributed-erlang

- Package `pash` was removed due to being archived upstream. Use `powershell` as an alternative.

- The option `services.plausible.releaseCookiePath` has been removed: Plausible does not use any distributed Erlang features, and does not plan to (see [discussion](https://github.com/NixOS/nixpkgs/pull/130297#issuecomment-1805851333)), so NixOS now disables them, and the Erlang cookie becomes unnecessary. You may delete the file that `releaseCookiePath` was set to.

- `security.sudo.extraRules` now includes `root`'s default rule, with ordering

  priority 400. This is functionally identical for users not specifying rule

  order, or relying on `mkBefore` and `mkAfter`, but may impact users calling

    package = mkPackageOptionMD pkgs "plausible" { };

    releaseCookiePath = mkOption {

      type = with types; either str path;

      description = lib.mdDoc ''

        The path to the file with release cookie. (used for remote connection to the running node).

      '';

    };

    adminUser = {

      name = mkOption {

        default = "admin";

          framework docs](https://hexdocs.pm/phoenix/Mix.Tasks.Phx.Gen.Secret.html#content).

        '';

      };

      listenAddress = mkOption {

        default = "127.0.0.1";

        type = types.str;

        description = lib.mdDoc ''

          The IP address on which the server is listening.

        '';

      };

      port = mkOption {

        default = 8000;

        type = types.port;

    };

  };

  imports = [

    (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ] "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed")

  ];

  config = mkIf cfg.enable {

    assertions = [

      { assertion = cfg.adminUser.activate -> cfg.database.postgres.setup;

      enable = true;

    };

    services.epmd.enable = true;

    environment.systemPackages = [ cfg.package ];

    systemd.services = mkMerge [

            # Configuration options from

            # https://plausible.io/docs/self-hosting-configuration

            PORT = toString cfg.server.port;

            LISTEN_IP = cfg.server.listenAddress;

            # Note [plausible-needs-no-erlang-distributed-features]:

            # Plausible does not use, and does not plan to use, any of

            # Erlang's distributed features, see:

            #     https://github.com/plausible/analytics/pull/1190#issuecomment-1018820934

            # Thus, disable distribution for improved simplicity and security:

            #

            # When distribution is enabled,

            # Elixir spwans the Erlang VM, which will listen by default on all

            # interfaces for messages between Erlang nodes (capable of

            # remote code execution); it can be protected by a cookie; see

            # https://erlang.org/doc/reference_manual/distributed.html#security).

            #

            # It would be possible to restrict the interface to one of our choice

            # (e.g. localhost or a VPN IP) similar to how we do it with `listenAddress`

            # for the Plausible web server; if distribution is ever needed in the future,

            # https://github.com/NixOS/nixpkgs/pull/130297 shows how to do it.

            #

            # But since Plausible does not use this feature in any way,

            # we just disable it.

            RELEASE_DISTRIBUTION = "none";

            # Additional safeguard, in case `RELEASE_DISTRIBUTION=none` ever

            # stops disabling the start of EPMD.

            ERL_EPMD_ADDRESS = "127.0.0.1";

            DISABLE_REGISTRATION = if isBool cfg.server.disableRegistration then boolToString cfg.server.disableRegistration else cfg.server.disableRegistration;

            RELEASE_TMP = "/var/lib/plausible/tmp";

          path = [ cfg.package ]

            ++ optional cfg.database.postgres.setup config.services.postgresql.package;

          script = ''

            export RELEASE_COOKIE="$(< $CREDENTIALS_DIRECTORY/RELEASE_COOKIE )"

            # Elixir does not start up if `RELEASE_COOKIE` is not set,

            # even though we set `RELEASE_DISTRIBUTION=none` so the cookie should be unused.

            # Thus, make a random one, which should then be ignored.

            export RELEASE_COOKIE=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 20)

            export ADMIN_USER_PWD="$(< $CREDENTIALS_DIRECTORY/ADMIN_USER_PWD )"

            export SECRET_KEY_BASE="$(< $CREDENTIALS_DIRECTORY/SECRET_KEY_BASE )"

            LoadCredential = [

              "ADMIN_USER_PWD:${cfg.adminUser.passwordFile}"

              "SECRET_KEY_BASE:${cfg.server.secretKeybaseFile}"

              "RELEASE_COOKIE:${cfg.releaseCookiePath}"

            ] ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [ "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"];

          };

        };

    virtualisation.memorySize = 4096;

    services.plausible = {

      enable = true;

      releaseCookiePath = "${pkgs.runCommand "cookie" { } ''

        ${pkgs.openssl}/bin/openssl rand -base64 64 >"$out"

      ''}";

      adminUser = {

        email = "admin@example.org";

        passwordFile = "${pkgs.writeText "pwd" "foobar"}";

    machine.wait_for_unit("plausible.service")

    machine.wait_for_open_port(8000)

    # Ensure that the software does not make not make the machine

    # listen on any public interfaces by default.

    machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")

    machine.succeed("curl -f localhost:8000 >&2")

    machine.succeed("curl -f localhost:8000/js/script.js >&2")