From 9dfac9818ebfa023ab4d9b35f4bc80879e79742c Mon Sep 17 00:00:00 2001
From: stuebinm <stuebinm@disroot.org>
Date: Mon, 15 Mar 2021 15:08:45 +0100
Subject: [PATCH] init keytracker on hainich.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a first attempt to package octycs' keytracker [1] application.

It's more a quick-and-dirty approach, so there are a couple things to note:
 - the config file is just generated by Nix as whatever the module got in
   its config option stuffed into a toml file. There are no default values,
   so all values must be set by hand – or rather, we just write the default
   values in the config.
 - I couldn't figure out how to actually make this thing work. It looks like
   it /should/ work, but gets hung up every time on loading key information
   via the web interface. Then again, it appears our current config on
   libocedrus also doesn't conform to what the readme says, so perhaps I just
   missed something that's as-yet undocumented.
 - The module just calls python instead of an actual server as backend. This
   is recommended just for development/testing, not actual deploys [2], but
   since the project is missing a setup.py which afaik are required to package
   these things more sensibly [3], that's it for now.
 - keys and corresponding tokens are currently baked into the nix store. This
   seems a bad idea, and I'll fix it as soon as I find the time.

[1] https://gitlab.infra4future.de/octycs/keytracker
[2] https://gitlab.infra4future.de/octycs/keytracker/-/blob/master/server/Readme.md
[3] https://flask.palletsprojects.com/en/1.1.x/tutorial/deploy/
---
 hosts/parsons/configuration.nix |  1 +
 modules/default.nix             |  1 +
 modules/keytracker.nix          | 64 +++++++++++++++++++++++++++++++++
 pkgs/default.nix                |  3 ++
 pkgs/keytracker/frontend.nix    | 26 ++++++++++++++
 pkgs/keytracker/server.nix      | 28 +++++++++++++++
 services/keytracker.nix         | 31 ++++++++++++++++
 7 files changed, 154 insertions(+)
 create mode 100644 modules/keytracker.nix
 create mode 100644 pkgs/keytracker/frontend.nix
 create mode 100644 pkgs/keytracker/server.nix
 create mode 100644 services/keytracker.nix

diff --git a/hosts/parsons/configuration.nix b/hosts/parsons/configuration.nix
index c41dfa0..71f4bdc 100644
--- a/hosts/parsons/configuration.nix
+++ b/hosts/parsons/configuration.nix
@@ -21,6 +21,7 @@
     ../../services/gitlab-runner.nix
     ../../services/unifi.nix
     ../../services/lantifa.nix
+    ../../services/keytracker.nix
 
     ./lxc.nix
   ];
diff --git a/modules/default.nix b/modules/default.nix
index a6b276e..b004d2e 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -5,5 +5,6 @@ in {
   imports = [
     ./nftnat
     ./decklink.nix
+    ./keytracker.nix
   ];
 }
diff --git a/modules/keytracker.nix b/modules/keytracker.nix
new file mode 100644
index 0000000..dc1735a
--- /dev/null
+++ b/modules/keytracker.nix
@@ -0,0 +1,64 @@
+{pkgs, lib, config, ...}:
+
+with lib;
+let format = pkgs.formats.toml {};
+in
+ {
+  options.services.keytracker = {
+    enable = mkOption {
+      default = false;
+      type = types.bool;
+    };
+    domain = mkOption {
+      default = "example.org";
+      type = types.str;
+    };
+    frontendPackage = mkOption {
+      default = pkgs.keytracker-frontend;
+      type = types.package;
+    };
+    serverPackage = mkOption {
+      default = pkgs.keytracker-server;
+      type = types.package;
+    };
+    stateDir = mkOption {
+      default = "/var/lib/keytracker";
+      type = types.str;
+    };
+    config = mkOption {
+      default = {};
+      type = format.type;
+    };
+    nginx = mkOption {
+      default = {};
+      type = types.attrs;
+    };
+  };
+
+  config =
+    let cfg = config.services.keytracker;
+        configfile = format.generate "config" cfg.config;
+    in {
+    services.nginx = mkIf cfg.enable {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        root = cfg.frontendPackage.outPath;
+      } // cfg.nginx;
+    };
+
+    systemd.services = mkIf cfg.enable {
+      "keytracker" = {
+        enable = true;
+        description = "Keytracker backend server";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.Type = "simple";
+        script = ''
+          mkdir -p ${cfg.stateDir}
+          cd ${cfg.stateDir}
+          ln -sf ${configfile} config
+          ${cfg.serverPackage}/wrapped
+        '';
+      };
+    };
+  };
+}
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 703ea98..74d1c8f 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -57,6 +57,9 @@ let
       '';
     };
 
+    keytracker-frontend = callPackage ./keytracker/frontend.nix {};
+    keytracker-server = callPackage ./keytracker/server.nix {};
+
     inherit (unstable) bottom;
   };
 
diff --git a/pkgs/keytracker/frontend.nix b/pkgs/keytracker/frontend.nix
new file mode 100644
index 0000000..3566874
--- /dev/null
+++ b/pkgs/keytracker/frontend.nix
@@ -0,0 +1,26 @@
+{ stdenv
+, fetchgit
+, ...}:
+
+stdenv.mkDerivation rec {
+  pname = "keytracker-frontend";
+  version = "0.0.1";
+
+  src = (fetchgit {
+    url = "https://gitlab.infra4future.de/octycs/keytracker";
+    rev = "0a124c3e7bc5c0e840d45399ad5e69485bb3e49c";
+    sha256 = "1l3djg3qfisrvv9shi2p44h026n58pimwbvr2idjnaill688s1qf";
+  }).outPath + "/frontend";
+
+  apiUrl = "https://localhost:5000";
+
+  buildPhase = ''
+    substituteInPlace assets/main.js --replace "http://localhost:5000" $apiUrl
+    rm Readme.md
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r * $out
+  '';
+}
diff --git a/pkgs/keytracker/server.nix b/pkgs/keytracker/server.nix
new file mode 100644
index 0000000..087787a
--- /dev/null
+++ b/pkgs/keytracker/server.nix
@@ -0,0 +1,28 @@
+{ stdenv
+, python38
+, lib
+, fetchgit
+, ...}:
+
+stdenv.mkDerivation rec {
+  pname = "keytracker";
+  version = "0.0.1";
+
+  src = (fetchgit {
+    url = "https://gitlab.infra4future.de/octycs/keytracker";
+    rev = "0a124c3e7bc5c0e840d45399ad5e69485bb3e49c";
+    sha256 = "1l3djg3qfisrvv9shi2p44h026n58pimwbvr2idjnaill688s1qf";
+  }).outPath + "/server";
+
+  buildPhase = ''
+    echo "${python38.withPackages(ps: with ps; [ flask ])}/bin/python $out/server.py" > wrapped
+    chmod +x wrapped
+  '';
+
+  python = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r * $out
+  '';
+}
diff --git a/services/keytracker.nix b/services/keytracker.nix
new file mode 100644
index 0000000..43dc488
--- /dev/null
+++ b/services/keytracker.nix
@@ -0,0 +1,31 @@
+{pkgs, config, ...}:
+
+{
+
+  services.keytracker = {
+    enable = true;
+    domain = "keytracker.infra4future.de";
+    stateDir = "/var/lib/keytracker";
+
+    # we have to overwrite this package, since the api url is backed into its code
+    frontendPackage = pkgs.keytracker-frontend.overrideAttrs (old: { apiUrl = "https://keytracker.infra4future.de:5000"; });
+
+    config.Default = {
+      Port = 5000;
+      DbPath = "history.db";
+      CorsOrigin = "off";
+    };
+    config.Keys = {
+      "8174875f7d85" = "Chris Büro;49c5dbda74fe86eae0dd1ce6;247f16f579033a6a947b3be301407319cd9bfe14f11554d71ea3190e04f7cb91";
+      "7fc944c9e632" = "Test=2;74fffaf6e463950fc6da3fd3;95313e37ff448b1a19b133fd8067c160f9f1c6d417f5d8dbec6f4f931097d389";
+      "7a05c8441f3a" = "testkey;694403310905ed4ac26e56f8;13852ec7855fc51b012874ea5786c215c37c3ed592685a04d1ad56152eccccc5";
+    };
+
+    nginx = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 5000 ];
+}