public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #121299 from Ma27/gitea-umask

Browse Source 
nixos/gitea: set umask for secret creation
This commit is contained in:
Maximilian Bosch 2021-05-02 00:06:20 +02:00 committed by GitHub
commit 040f0acccd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 37 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
nixos/modules/services/misc/gitea.nix
View File

@ -477,47 +477,49 @@ in
in '' in ''
# copy custom configuration and generate a random secret key if needed # copy custom configuration and generate a random secret key if needed
${optionalString (cfg.useWizard == false) '' ${optionalString (cfg.useWizard == false) ''
cp -f ${configFile} ${runConfig} function gitea_setup {
cp -f ${configFile} ${runConfig}
if [ ! -e ${secretKey} ]; then if [ ! -e ${secretKey} ]; then
${gitea}/bin/gitea generate secret SECRET_KEY > ${secretKey} ${gitea}/bin/gitea generate secret SECRET_KEY > ${secretKey}
fi fi
# Migrate LFS_JWT_SECRET filename # Migrate LFS_JWT_SECRET filename
if [[ -e ${oldLfsJwtSecret} && ! -e ${lfsJwtSecret} ]]; then if [[ -e ${oldLfsJwtSecret} && ! -e ${lfsJwtSecret} ]]; then
mv ${oldLfsJwtSecret} ${lfsJwtSecret} mv ${oldLfsJwtSecret} ${lfsJwtSecret}
fi fi
if [ ! -e ${oauth2JwtSecret} ]; then if [ ! -e ${oauth2JwtSecret} ]; then
${gitea}/bin/gitea generate secret JWT_SECRET > ${oauth2JwtSecret} ${gitea}/bin/gitea generate secret JWT_SECRET > ${oauth2JwtSecret}
fi fi
if [ ! -e ${lfsJwtSecret} ]; then if [ ! -e ${lfsJwtSecret} ]; then
${gitea}/bin/gitea generate secret LFS_JWT_SECRET > ${lfsJwtSecret} ${gitea}/bin/gitea generate secret LFS_JWT_SECRET > ${lfsJwtSecret}
fi fi
if [ ! -e ${internalToken} ]; then if [ ! -e ${internalToken} ]; then
${gitea}/bin/gitea generate secret INTERNAL_TOKEN > ${internalToken} ${gitea}/bin/gitea generate secret INTERNAL_TOKEN > ${internalToken}
fi fi
SECRETKEY="$(head -n1 ${secretKey})" SECRETKEY="$(head -n1 ${secretKey})"
DBPASS="$(head -n1 ${cfg.database.passwordFile})" DBPASS="$(head -n1 ${cfg.database.passwordFile})"
OAUTH2JWTSECRET="$(head -n1 ${oauth2JwtSecret})" OAUTH2JWTSECRET="$(head -n1 ${oauth2JwtSecret})"
LFSJWTSECRET="$(head -n1 ${lfsJwtSecret})" LFSJWTSECRET="$(head -n1 ${lfsJwtSecret})"
INTERNALTOKEN="$(head -n1 ${internalToken})" INTERNALTOKEN="$(head -n1 ${internalToken})"
${if (cfg.mailerPasswordFile == null) then '' ${if (cfg.mailerPasswordFile == null) then ''
MAILERPASSWORD="#mailerpass#" MAILERPASSWORD="#mailerpass#"
'' else '' '' else ''
MAILERPASSWORD="$(head -n1 ${cfg.mailerPasswordFile} || :)" MAILERPASSWORD="$(head -n1 ${cfg.mailerPasswordFile} || :)"
''} ''}
sed -e "s,#secretkey#,$SECRETKEY,g" \ sed -e "s,#secretkey#,$SECRETKEY,g" \
-e "s,#dbpass#,$DBPASS,g" \ -e "s,#dbpass#,$DBPASS,g" \
-e "s,#oauth2jwtsecret#,$OAUTH2JWTSECRET,g" \ -e "s,#oauth2jwtsecret#,$OAUTH2JWTSECRET,g" \
-e "s,#lfsjwtsecret#,$LFSJWTSECRET,g" \ -e "s,#lfsjwtsecret#,$LFSJWTSECRET,g" \
-e "s,#internaltoken#,$INTERNALTOKEN,g" \ -e "s,#internaltoken#,$INTERNALTOKEN,g" \
-e "s,#mailerpass#,$MAILERPASSWORD,g" \ -e "s,#mailerpass#,$MAILERPASSWORD,g" \
-i ${runConfig} -i ${runConfig}
chmod 640 ${runConfig} ${secretKey} ${oauth2JwtSecret} ${lfsJwtSecret} ${internalToken} }
(umask 027; gitea_setup)
''} ''}
# update all hooks' binary paths # update all hooks' binary paths