This repository has no description
4.6 kB
156 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8let
9 uploadPage = pkgs.writeText "paste-upload.html" ''
10 <!doctype html>
11 <title>p.krebsco.de</title>
12 <form action="/form" method="post" enctype="multipart/form-data">
13 <input type="file" name="file" required>
14 <button>upload</button>
15 </form>
16 <p>or with curl:</p>
17 <pre>
18 curl --data-binary @file https://p.krebsco.de
19 some-command | curl --data-binary @- https://p.krebsco.de
20 </pre>
21 '';
22
23 pasteCgi = pkgs.writers.writePython3 "paste-cgi" { } (
24 lib.replaceStrings
25 [ "@file@" "@exiv2@" ]
26 [ (lib.getExe pkgs.file) (lib.getExe' pkgs.exiv2 "exiv2") ]
27 (builtins.readFile ./paste.py)
28 );
29
30 # item directories of the former htgen handlers, kept for their contents
31 # and the backup paths
32 items = {
33 paste = "/var/lib/htgen-paste/items";
34 imgur = "/var/lib/htgen-imgur/items";
35 cyberlocker = "/var/lib/htgen-cyberlocker/items";
36 };
37
38 # systemd chowns them to paste if they still belong to the htgen users
39 stateDirectories = {
40 StateDirectory = map (dir: lib.removePrefix "/var/lib/" (dirOf dir)) (lib.attrValues items);
41 StateDirectoryMode = "0700";
42 };
43
44 cgi = app: itemsDir: ''
45 include ${config.services.nginx.package}/conf/fastcgi_params;
46 fastcgi_param SCRIPT_FILENAME ${pasteCgi};
47 fastcgi_param PASTE_APP ${app};
48 fastcgi_param PASTE_ITEMS ${itemsDir};
49 fastcgi_pass unix:${config.services.fcgiwrap.instances.paste.socket.address};
50 '';
51in
52{
53 # back up the state dirs of all items
54 lass.backup.state.paste.folders = map dirOf (lib.attrValues items);
55
56 services.nginx.virtualHosts.cyberlocker = {
57 serverAliases = [ "c.r" ];
58 locations."/".extraConfig = ''
59 client_max_body_size 4G;
60 ${cgi "cyberlocker" items.cyberlocker}
61 '';
62 extraConfig = ''
63 add_header Access-Control-Allow-Origin * always;
64 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
65 '';
66 };
67 services.nginx.virtualHosts.paste = {
68 serverAliases = [ "p.r" ];
69 locations."/".extraConfig = ''
70 client_max_body_size 4G;
71 ${cgi "paste" items.paste}
72 '';
73 locations."/image".extraConfig = ''
74 client_max_body_size 40M;
75 ${cgi "imgur" items.imgur}
76 '';
77 extraConfig = ''
78 add_header 'Access-Control-Allow-Origin' '*';
79 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
80 '';
81 };
82 services.nginx.virtualHosts."c.krebsco.de" = {
83 enableACME = true;
84 addSSL = true;
85 serverAliases = [ "c.krebsco.de" ];
86 locations."/".extraConfig = ''
87 if ($request_method != GET) {
88 return 403;
89 }
90 ${cgi "cyberlocker" items.cyberlocker}
91 '';
92 extraConfig = ''
93 add_header Access-Control-Allow-Origin * always;
94 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
95 '';
96 };
97 services.nginx.virtualHosts."p.krebsco.de" = {
98 enableACME = true;
99 addSSL = true;
100 serverAliases = [ "p.krebsco.de" ];
101 locations."/".extraConfig = ''
102 if ($request_method = 'OPTIONS') {
103 return 204;
104 }
105 if ($request_method ~ ^(GET|HEAD)$) {
106 rewrite ^/$ /_upload last;
107 }
108 client_max_body_size 4G;
109 ${cgi "paste" items.paste}
110 '';
111 locations."= /_upload".extraConfig = ''
112 internal;
113 default_type text/html;
114 alias ${uploadPage};
115 '';
116 locations."/form".extraConfig = ''
117 client_max_body_size 4G;
118 ${cgi "form" items.paste}
119 '';
120 locations."/image".extraConfig = ''
121 ${cgi "imgur" items.imgur}
122 '';
123 extraConfig = ''
124 add_header Access-Control-Allow-Headers Authorization always;
125 add_header Access-Control-Allow-Origin * always;
126 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
127 '';
128 };
129
130 services.fcgiwrap.instances.paste = {
131 # requests at a time; uploads and downloads hold a process each
132 process.prefork = 8;
133 process.user = "paste";
134 process.group = "paste";
135 socket.user = config.services.nginx.user;
136 socket.group = config.services.nginx.group;
137 };
138 systemd.services.fcgiwrap-paste.serviceConfig = stateDirectories;
139 users.users.paste = {
140 isSystemUser = true;
141 group = "paste";
142 };
143 users.groups.paste = { };
144
145 systemd.services.paste-gc = {
146 startAt = "daily";
147 serviceConfig = stateDirectories // {
148 ExecStart = ''
149 ${pkgs.findutils}/bin/find ${items.paste} -type f -mtime '+30' -exec rm {} \;
150 '';
151 User = "paste";
152 };
153 };
154
155 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 80 ];
156}