This repository has no description
radicle: secureify radicle-node, marked insecure in nixpkgs
author
lassulus
date
(Sep 28, 2026, 1:39 PM CEST)
commit
6ff102f8
6ff102f809b8bdf56c42ae77d7644e88c4bbe27b
parent
122c9d66
122c9d66fbeb5442e4773925c70bc24edbeb5b0a
+40
-6
+9
-4
2configs/rad.nix
+9
-4
2configs/rad.nix
···
1
1
{
2
+
self,
2
3
config,
3
4
pkgs,
4
5
...
···
25
26
# The node only dials out (no listen address): the laptops sit behind NAT and
26
27
# the public seed neoprism relays for them, so nothing needs a port opened.
27
28
let
29
+
# nixpkgs marks radicle-node insecure: private repos are not encrypted
30
+
# between nodes. Clear the flag on the package we use instead of allowing
31
+
# it globally.
32
+
radicle-node = self.lib.secureify pkgs.radicle-node;
28
33
generator = config.clan.core.vars.generators.rad;
29
34
radHome = "/var/lib/rad";
30
35
···
53
58
configFile =
54
59
pkgs.runCommand "rad-config.json"
55
60
{
56
-
nativeBuildInputs = [ pkgs.buildPackages.radicle-node ];
61
+
nativeBuildInputs = [ (self.lib.secureify pkgs.buildPackages.radicle-node) ];
57
62
json = builtins.toJSON settings;
58
63
passAsFile = [ "json" ];
59
64
preferLocalBuild = true;
···
72
77
pkgs.writeShellScriptBin bin ''
73
78
# ${radHome} is shared with the rad-node service via group rad.
74
79
umask 002
75
-
exec ${pkgs.radicle-node}/bin/${bin} "$@"
80
+
exec ${radicle-node}/bin/${bin} "$@"
76
81
'';
77
82
radicle-shared = pkgs.symlinkJoin {
78
83
name = "radicle-shared";
79
84
paths = [
80
85
(wrap "rad")
81
86
(wrap "git-remote-rad")
82
-
pkgs.radicle-node
87
+
radicle-node
83
88
];
84
89
};
85
90
in
···
145
150
Group = "rad";
146
151
UMask = "0002";
147
152
# --force: reclaim a control socket left behind by an unclean shutdown.
148
-
ExecStart = "${pkgs.radicle-node}/bin/radicle-node --force";
153
+
ExecStart = "${radicle-node}/bin/radicle-node --force";
149
154
Restart = "on-failure";
150
155
RestartSec = 5;
151
156
};
+27
2configs/radicle.lassul.us.nix
+27
2configs/radicle.lassul.us.nix
···
1
1
{
2
+
self,
2
3
config,
4
+
lib,
3
5
pkgs,
4
6
...
5
7
}:
8
+
let
9
+
# nixpkgs marks radicle-node insecure: private repos are not encrypted
10
+
# between nodes. Clear the flag on the package we use instead of allowing
11
+
# it globally.
12
+
radicle-node = self.lib.secureify pkgs.radicle-node;
13
+
in
6
14
{
7
15
# Generate Radicle identity keys using clan vars
8
16
clan.core.vars.generators.radicle = {
···
17
25
18
26
services.radicle = {
19
27
enable = true;
28
+
package = radicle-node;
29
+
# The module's checkConfig runs `rad config` from
30
+
# pkgs.buildPackages.radicle-node, not cfg.package, which trips the
31
+
# insecure check. Same validation, against our package.
32
+
configFile = lib.mkForce (
33
+
pkgs.runCommand "config.json"
34
+
{
35
+
nativeBuildInputs = [ (self.lib.secureify pkgs.buildPackages.radicle-node) ];
36
+
json = builtins.toJSON config.services.radicle.settings;
37
+
passAsFile = [ "json" ];
38
+
preferLocalBuild = true;
39
+
}
40
+
''
41
+
install -D -m 644 "$jsonPath" $out
42
+
ln -s $out config.json
43
+
install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
44
+
RAD_HOME=$PWD rad config >/dev/null
45
+
''
46
+
);
20
47
privateKey = config.clan.core.vars.generators.radicle.files."radicle.key".path;
21
48
publicKey = config.clan.core.vars.generators.radicle.files."radicle.pub".path;
22
49
+2
-1
machines/barnacle/configuration.nix
+2
-1
machines/barnacle/configuration.nix