From 7a0d60c17c99be3140350bd3914e867251d2b705 Mon Sep 17 00:00:00 2001 From: Dominik Polakovics Date: Sun, 20 Aug 2023 14:41:04 +0200 Subject: [PATCH] add pkgs and overlays to nb config --- hosts/nb-01.cloonar.com/overlays/packages.nix | 5 + .../overlays/rustdesk-cargo.patch | 48 + hosts/nb-01.cloonar.com/overlays/rustdesk.nix | 17 + .../pkgs/alacritty/default.nix | 115 + hosts/nb-01.cloonar.com/pkgs/bento.nix | 37 + .../nb-01.cloonar.com/pkgs/bento/default.nix | 40 + hosts/nb-01.cloonar.com/pkgs/default.nix | 3 + .../nb-01.cloonar.com/pkgs/howdy/default.nix | 135 + .../pkgs/howdy/howdy-module.nix | 78 + hosts/nb-01.cloonar.com/pkgs/howdy/howdy.nix | 135 + .../nb-01.cloonar.com/pkgs/howdy/howdy.patch | 155 + .../pkgs/howdy/ir-toggle-module.nix | 28 + .../pkgs/howdy/ir-toggle.nix | 17 + .../pkgs/howdy/pam-python.nix | 17 + hosts/nb-01.cloonar.com/pkgs/jxplorer.nix | 47 + .../pkgs/linux-enable-ir-emitter/default.nix | 51 + .../remove-boot-set.patch | 11 + .../pkgs/playactor/default.nix | 17 + .../pkgs/playactor/node-env.nix | 689 +++ .../pkgs/playactor/node-packages.nix | 719 +++ .../pkgs/pyelectroluxconnect.nix | 12 + .../pkgs/room-assistant/default.nix | 17 + .../pkgs/room-assistant/node-env.nix | 686 +++ .../pkgs/room-assistant/node-packages.json | 5 + .../pkgs/room-assistant/node-packages.nix | 5445 +++++++++++++++++ .../pkgs/room-assistant/override.nix | 33 + .../pkgs/self-service-password/default.nix | 95 + .../pkgs/sieve-spam-filter/default.nix | 28 + .../sieve-spam-filter/src/move-to-spam.sieve | 5 + .../sieve-spam-filter/src/report-ham.sieve | 15 + .../sieve-spam-filter/src/report-spam.sieve | 7 + hosts/nb-01.cloonar.com/pkgs/thunderbird.nix | 205 + 32 files changed, 8917 insertions(+) create mode 100644 hosts/nb-01.cloonar.com/overlays/packages.nix create mode 100644 hosts/nb-01.cloonar.com/overlays/rustdesk-cargo.patch create mode 100644 hosts/nb-01.cloonar.com/overlays/rustdesk.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/alacritty/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/bento.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/bento/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/howdy-module.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/howdy.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/howdy.patch create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle-module.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/howdy/pam-python.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/jxplorer.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/remove-boot-set.patch create mode 100644 hosts/nb-01.cloonar.com/pkgs/playactor/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/playactor/node-env.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/playactor/node-packages.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/pyelectroluxconnect.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/room-assistant/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/room-assistant/node-env.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/room-assistant/node-packages.json create mode 100644 hosts/nb-01.cloonar.com/pkgs/room-assistant/node-packages.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/room-assistant/override.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/self-service-password/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/default.nix create mode 100644 hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/move-to-spam.sieve create mode 100644 hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-ham.sieve create mode 100644 hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-spam.sieve create mode 100644 hosts/nb-01.cloonar.com/pkgs/thunderbird.nix diff --git a/hosts/nb-01.cloonar.com/overlays/packages.nix b/hosts/nb-01.cloonar.com/overlays/packages.nix new file mode 100644 index 0000000..249800b --- /dev/null +++ b/hosts/nb-01.cloonar.com/overlays/packages.nix @@ -0,0 +1,5 @@ +self: super: { + bento = (super.callPackage ../pkgs/bento { }); + howdy = (super.callPackage ../pkgs/howdy { }); + linux-enable-ir-emitter = (super.callPackage ../pkgs/linux-enable-ir-emitter { }); +} diff --git a/hosts/nb-01.cloonar.com/overlays/rustdesk-cargo.patch b/hosts/nb-01.cloonar.com/overlays/rustdesk-cargo.patch new file mode 100644 index 0000000..f717ba3 --- /dev/null +++ b/hosts/nb-01.cloonar.com/overlays/rustdesk-cargo.patch @@ -0,0 +1,48 @@ +diff --git a/Cargo.lock b/Cargo.lock +index fb17c7e..ef157e5 100644 +--- a/Cargo.lock ++++ b/Cargo.lock +@@ -2901,10 +2901,10 @@ dependencies = [ + [[package]] + name = "magnum-opus" + version = "0.4.0" +-source = "git+https://github.com/open-trade/magnum-opus#3c3d0b86ae95c84930bebffe4bcb03b3bd83342b" ++source = "git+https://github.com/TheRadioGuy/magnum-opus#171e1d021004626f7444d1e39b98f50bc3cb2604" + dependencies = [ +- "bindgen", +- "target_build_utils", ++ "libc", ++ "opusic-sys", + ] + + [[package]] +@@ -3463,6 +3463,16 @@ version = "0.1.5" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf" + ++[[package]] ++name = "opusic-sys" ++version = "0.3.6" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "5eace752ce07a037241dba8f02c654799f051e431b27028056bcb480e83b54f5" ++dependencies = [ ++ "cmake", ++ "libc", ++] ++ + [[package]] + name = "os_str_bytes" + version = "6.0.0" +diff --git a/Cargo.toml b/Cargo.toml +index 1b715bd..960e8da 100644 +--- a/Cargo.toml ++++ b/Cargo.toml +@@ -47,7 +47,7 @@ libc = "0.2" + parity-tokio-ipc = { git = "https://github.com/open-trade/parity-tokio-ipc" } + flexi_logger = { version = "0.22", features = ["async", "use_chrono_for_offset"] } + runas = "0.2" +-magnum-opus = { git = "https://github.com/open-trade/magnum-opus" } ++magnum-opus = { git = "https://github.com/TheRadioGuy/magnum-opus" } + dasp = { version = "0.11", features = ["signal", "interpolate-linear", "interpolate"], optional = true } + rubato = { version = "0.12", optional = true } + samplerate = { version = "0.2", optional = true } diff --git a/hosts/nb-01.cloonar.com/overlays/rustdesk.nix b/hosts/nb-01.cloonar.com/overlays/rustdesk.nix new file mode 100644 index 0000000..c83131f --- /dev/null +++ b/hosts/nb-01.cloonar.com/overlays/rustdesk.nix @@ -0,0 +1,17 @@ +self: super: + +{ + rustdesk = super.rustdesk.overrideAttrs (old: rec { + pname = "rustdesk"; + version = "nightly"; + src = super.fetchFromGitHub { + owner = "rustdesk"; + repo = "rustdesk"; + rev = "52ce3dd2c299e262a54af0b5350fa60f66215e60"; + sha256 = "01mfzgj3aw0k7sb0d2291inxmicrw09rrgfjl1pn50m2y29v0r40"; + }; + cargoPatches = [ + ./rustdesk-cargo.patch + ]; + }); +} diff --git a/hosts/nb-01.cloonar.com/pkgs/alacritty/default.nix b/hosts/nb-01.cloonar.com/pkgs/alacritty/default.nix new file mode 100644 index 0000000..b2b1614 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/alacritty/default.nix @@ -0,0 +1,115 @@ +{ stdenv +, lib +, fetchFromGitHub +, fetchpatch +, rustPlatform +, nixosTests + +, cmake +, installShellFiles +, makeWrapper +, ncurses +, pkg-config +, python3 + +, expat +, fontconfig +, freetype +, libGL +, xorg +, libxkbcommon +, wayland +, xdg-utils +}: +let + rpathLibs = [ + expat + fontconfig + freetype + libGL + xorg.libX11 + xorg.libXcursor + xorg.libXi + xorg.libXrandr + xorg.libXxf86vm + xorg.libxcb + ] ++ lib.optionals stdenv.isLinux [ + libxkbcommon + wayland + ]; +in +rustPlatform.buildRustPackage rec { + pname = "alacritty"; + version = "0.12.0-2"; + + src = fetchFromGitHub { + owner = "alacritty"; + repo = pname; + rev = "db903503df024a3f5066937fbe0272be88226738"; + hash = "sha256-XZ75sbXFWCsCvebGK8O+7Ulm00/1/yEcT9dOIAk5Vzg="; + }; + + cargoSha256 = "sha256-popq3LbSdw5mML96J4TPGPtWFGdBrYfFqdj1yvWU8Vk="; + + nativeBuildInputs = [ + cmake + installShellFiles + makeWrapper + ncurses + pkg-config + python3 + ]; + + outputs = [ "out" "terminfo" ]; + + postPatch = lib.optionalString (!xdg-utils.meta.broken) '' + substituteInPlace alacritty/src/config/ui_config.rs \ + --replace xdg-open ${xdg-utils}/bin/xdg-open + ''; + + checkFlags = [ "--skip=term::test::mock_term" ]; # broken on aarch64 + + postInstall = ( + '' + install -D extra/linux/Alacritty.desktop -t $out/share/applications/ + install -D extra/linux/org.alacritty.Alacritty.appdata.xml -t $out/share/appdata/ + install -D extra/logo/compat/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg + + # patchelf generates an ELF that binutils' "strip" doesn't like: + # strip: not enough room for program headers, try linking with -N + # As a workaround, strip manually before running patchelf. + $STRIP -S $out/bin/alacritty + + patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/alacritty + '' + ) + '' + + installShellCompletion --zsh extra/completions/_alacritty + installShellCompletion --bash extra/completions/alacritty.bash + installShellCompletion --fish extra/completions/alacritty.fish + + install -dm 755 "$out/share/man/man1" + gzip -c extra/alacritty.man > "$out/share/man/man1/alacritty.1.gz" + gzip -c extra/alacritty-msg.man > "$out/share/man/man1/alacritty-msg.1.gz" + + install -Dm 644 alacritty.yml $out/share/doc/alacritty.yml + + install -dm 755 "$terminfo/share/terminfo/a/" + tic -xe alacritty,alacritty-direct -o "$terminfo/share/terminfo" extra/alacritty.info + mkdir -p $out/nix-support + echo "$terminfo" >> $out/nix-support/propagated-user-env-packages + ''; + + dontPatchELF = true; + + passthru.tests.test = nixosTests.terminal-emulators.alacritty; + + meta = with lib; { + description = "A cross-platform, GPU-accelerated terminal emulator"; + homepage = "https://github.com/alacritty/alacritty"; + license = licenses.asl20; + maintainers = with maintainers; [ Br1ght0ne mic92 ]; + platforms = platforms.unix; + changelog = "https://github.com/alacritty/alacritty/blob/v${version}/CHANGELOG.md"; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/bento.nix b/hosts/nb-01.cloonar.com/pkgs/bento.nix new file mode 100644 index 0000000..5c8683b --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/bento.nix @@ -0,0 +1,37 @@ +{ pkgs, stdenv, fetchgit }: + +stdenv.mkDerivation rec { + + name = "bento"; + + src = fetchgit { + url = "https://github.com/rapenne-s/bento.git"; + rev = "6418bd64ecabbfa720c7a87ec39ee1a8b46a907e"; + sha256 = "69b056298cf570debd3718b2e2cb7e63ad9465919c8190cf38043791ce61d0d6"; + }; + + buildInputs = [ ]; + + patchPhase = '' + substituteInPlace bento --replace 'inotifywait' "${pkgs.inotify-tools}/bin/inotifywait"; + ''; + + installPhase = '' + mkdir -p $out/bin + mkdir -p $out/share + install -Dm555 bento $out/bin/ + install -Dm444 fleet.nix $out/share/ + install -Dm444 config.sh.sample $out/share/ + install -Dm444 LICENSE $out/share/ + install -Dm444 README.md $out/share/ + install -Dm444 utils/bento.nix $out/share/ + ''; + + meta = with stdenv.lib; { + description = "A KISS deployment tool to keep your NixOS fleet (servers & workstations) up to date."; + homepage = "https://github.com/rapenne-s/bento"; + license = licenses.MIT; + platforms = platforms.linux; + }; + +} diff --git a/hosts/nb-01.cloonar.com/pkgs/bento/default.nix b/hosts/nb-01.cloonar.com/pkgs/bento/default.nix new file mode 100644 index 0000000..17757ad --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/bento/default.nix @@ -0,0 +1,40 @@ +{ pkgs, lib, stdenv, fetchgit }: + +stdenv.mkDerivation rec { + + name = "bento"; + + src = fetchgit { + url = "https://github.com/rapenne-s/bento.git"; + rev = "6418bd64ecabbfa720c7a87ec39ee1a8b46a907e"; + sha256 = "sha256-gLWoZh7fMn3cpIYSJFSVOQHA6qUIJikHXmucHX7P2WI="; + }; + + buildInputs = [ ]; + + patchPhase = '' + substituteInPlace bento --replace 'inotifywait' "${pkgs.inotify-tools}/bin/inotifywait"; + ''; + + installPhase = '' + mkdir -p $out/bin + mkdir -p $out/share + install -Dm555 bento $out/bin/ + install -Dm444 fleet.nix $out/share/ + install -Dm444 config.sh.sample $out/share/ + install -Dm444 LICENSE $out/share/ + install -Dm444 README.md $out/share/ + install -Dm444 utils/bento.nix $out/share/ + ''; + + meta = with lib; { + description = "A KISS deployment tool to keep your NixOS fleet (servers & workstations) up to date."; + homepage = "https://github.com/rapenne-s/bento"; + license = licenses.mit; + platforms = platforms.linux; + }; + +} + +## fleet nix is for sftp server with chroot +## just copy to bento server and change configuration diff --git a/hosts/nb-01.cloonar.com/pkgs/default.nix b/hosts/nb-01.cloonar.com/pkgs/default.nix new file mode 100644 index 0000000..3f877a2 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/default.nix @@ -0,0 +1,3 @@ +final: prev: rec { + playactor = final.callPackage ./playactor.nix {}; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/default.nix b/hosts/nb-01.cloonar.com/pkgs/howdy/default.nix new file mode 100644 index 0000000..089ced1 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/default.nix @@ -0,0 +1,135 @@ +{ stdenv +, lib +, bzip2 +, fetchFromGitHub +, fetchurl +, fmt +, gettext +, inih +, installShellFiles +, libevdev +, meson +, ninja +, pam +, pkg-config +, python3 +}: + +let + data = let + baseurl = "https://github.com/davisking/dlib-models/raw/daf943f7819a3dda8aec4276754ef918dc26491f"; + in { + "dlib_face_recognition_resnet_model_v1.dat" = fetchurl { + url = "${baseurl}/dlib_face_recognition_resnet_model_v1.dat.bz2"; + sha256 = "0fjm265l1fz5zdzx5n5yphl0v0vfajyw50ffamc4cd74848gdcdb"; + }; + "mmod_human_face_detector.dat" = fetchurl { + url = "${baseurl}/mmod_human_face_detector.dat.bz2"; + sha256 = "117wv582nsn585am2n9mg5q830qnn8skjr1yxgaiihcjy109x7nv"; + }; + "shape_predictor_5_face_landmarks.dat" = fetchurl { + url = "${baseurl}/shape_predictor_5_face_landmarks.dat.bz2"; + sha256 = "0wm4bbwnja7ik7r28pv00qrl3i1h6811zkgnjfvzv7jwpyz7ny3f"; + }; + }; + + py = python3.withPackages (p: [ + p.face_recognition + (p.opencv4.override { enableGtk3 = true; }) + ]); +in +stdenv.mkDerivation { + pname = "howdy"; + version = "unstable-2023-02-28"; + + src = fetchFromGitHub { + owner = "boltgolt"; + repo = "howdy"; + rev = "e881cc25935c7d39a074e9701a06b1fce96cc185"; + hash = "sha256-BHS1J0SUNbCeAnTXrOQCtBJTaSYa5jtYYtTgfycv7VM="; + }; + + patches = [ + # Change directory with configuration from `/etc` to `/var/lib`, since the service is expected to modify it. + ./howdy.patch + ]; + + postPatch = + let + howdypath = "${placeholder "out"}/lib/security/howdy"; + in + '' + substituteInPlace howdy/src/cli/add.py --replace "@pkgdatadir@" "${howdypath}" + substituteInPlace howdy/src/cli/config.py --replace '/bin/nano' 'nano' + substituteInPlace howdy/src/cli/test.py --replace "@pkgdatadir@" "${howdypath}" + + substituteInPlace howdy/src/pam/main.cc \ + --replace "python3" "${py}/bin/python" \ + --replace "/lib/security/howdy/compare.py" "${howdypath}/compare.py" + + substituteInPlace howdy/src/compare.py \ + --replace "/lib/security/howdy" "${howdypath}" \ + --replace "@pkgdatadir@" "${howdypath}" + ''; + + nativeBuildInputs = [ + bzip2 + installShellFiles + meson + ninja + pkg-config + ]; + + buildInputs = [ + fmt + gettext + inih + libevdev + pam + py + ]; + + # build howdy_pam + preConfigure = '' + cd howdy/src/pam + + # works around hardcoded install_dir: '/lib/security'. + # See https://github.com/boltgolt/howdy/blob/30728a6d3634479c24ffd4e094c34a30bbb43058/howdy/src/pam/meson.build#L22 + export DESTDIR=$out + ''; + + postInstall = + let + libDir = "$out/lib/security/howdy"; + inherit (lib) mapAttrsToList concatStrings; + in + '' + # done with howdy_pam, go back to source root + cd ../../../.. + + mkdir -p $out/share/licenses/howdy + install -Dm644 LICENSE $out/share/licenses/howdy/LICENSE + rm -rf howdy/src/pam + mkdir -p ${libDir} + cp -r howdy/src/* ${libDir} + + rm -rf ${libDir}/pam-config ${libDir}/dlib-data/* + ${concatStrings (mapAttrsToList (n: v: '' + bzip2 -dc ${v} > ${libDir}/dlib-data/${n} + '') data)} + + mkdir -p $out/bin + ln -s ${libDir}/cli.py $out/bin/howdy + + mkdir -p "$out/share/bash-completion/completions" + installShellCompletion --bash howdy/src/autocomplete/howdy + ''; + + meta = { + description = "Windows Hello™ style facial authentication for Linux"; + homepage = "https://github.com/boltgolt/howdy"; + license = lib.licenses.mit; + platforms = lib.platforms.linux; + maintainers = with lib.maintainers; [ fufexan ]; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/howdy-module.nix b/hosts/nb-01.cloonar.com/pkgs/howdy/howdy-module.nix new file mode 100644 index 0000000..a041d3f --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/howdy-module.nix @@ -0,0 +1,78 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.howdy; + howdy = pkgs.callPackage ./howdy.nix { }; + pam_python = pkgs.callPackage ./pam-python.nix { }; + + # `dark_threshold` is required for X1 Carbon 7th to work + configINI = pkgs.runCommand "config.ini" { } '' + cat ${cfg.package}/lib/security/howdy/config.ini > $out + substituteInPlace $out --replace 'device_path = none' 'device_path = ${cfg.device}' + substituteInPlace $out --replace 'dark_threshold = 50' 'dark_threshold = ${ + toString cfg.dark-threshold + }' + substituteInPlace $out --replace 'certainty = 3.5' 'certainty = ${ + toString cfg.certainty + }' + ''; + pam-rule = pkgs.lib.mkDefault (pkgs.lib.mkBefore + "auth sufficient ${pam_python}/lib/security/pam_python.so ${config.services.howdy.package}/lib/security/howdy/pam.py"); +in { + options = { + services.howdy = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable howdy and PAM module for face recognition. + ''; + }; + + package = mkOption { + type = types.package; + default = howdy; + defaultText = "howdy"; + description = '' + Howdy package to use. + ''; + }; + + device = mkOption { + type = types.path; + default = "/dev/video0"; + description = '' + Device file connected to the IR sensor. + ''; + }; + + certainty = mkOption { + type = types.int; + default = 4; + description = '' + The certainty of the detected face belonging to the user of the account. On a scale from 1 to 10, values above 5 are not recommended. + ''; + }; + + dark-threshold = mkOption { + type = types.int; + default = 50; + description = '' + Because of flashing IR emitters, some frames can be completely unlit. Skip the frame if the lowest 1/8 of the histogram is above this percentage of the total. The lower this setting is, the more dark frames are ignored. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; + environment.etc."howdy/config.ini".source = configINI; + security.pam.services = { + sudo.text = pam-rule; # Sudo + login.text = pam-rule; # User login + polkit-1.text = pam-rule; # PolKit + }; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/howdy.nix b/hosts/nb-01.cloonar.com/pkgs/howdy/howdy.nix new file mode 100644 index 0000000..089ced1 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/howdy.nix @@ -0,0 +1,135 @@ +{ stdenv +, lib +, bzip2 +, fetchFromGitHub +, fetchurl +, fmt +, gettext +, inih +, installShellFiles +, libevdev +, meson +, ninja +, pam +, pkg-config +, python3 +}: + +let + data = let + baseurl = "https://github.com/davisking/dlib-models/raw/daf943f7819a3dda8aec4276754ef918dc26491f"; + in { + "dlib_face_recognition_resnet_model_v1.dat" = fetchurl { + url = "${baseurl}/dlib_face_recognition_resnet_model_v1.dat.bz2"; + sha256 = "0fjm265l1fz5zdzx5n5yphl0v0vfajyw50ffamc4cd74848gdcdb"; + }; + "mmod_human_face_detector.dat" = fetchurl { + url = "${baseurl}/mmod_human_face_detector.dat.bz2"; + sha256 = "117wv582nsn585am2n9mg5q830qnn8skjr1yxgaiihcjy109x7nv"; + }; + "shape_predictor_5_face_landmarks.dat" = fetchurl { + url = "${baseurl}/shape_predictor_5_face_landmarks.dat.bz2"; + sha256 = "0wm4bbwnja7ik7r28pv00qrl3i1h6811zkgnjfvzv7jwpyz7ny3f"; + }; + }; + + py = python3.withPackages (p: [ + p.face_recognition + (p.opencv4.override { enableGtk3 = true; }) + ]); +in +stdenv.mkDerivation { + pname = "howdy"; + version = "unstable-2023-02-28"; + + src = fetchFromGitHub { + owner = "boltgolt"; + repo = "howdy"; + rev = "e881cc25935c7d39a074e9701a06b1fce96cc185"; + hash = "sha256-BHS1J0SUNbCeAnTXrOQCtBJTaSYa5jtYYtTgfycv7VM="; + }; + + patches = [ + # Change directory with configuration from `/etc` to `/var/lib`, since the service is expected to modify it. + ./howdy.patch + ]; + + postPatch = + let + howdypath = "${placeholder "out"}/lib/security/howdy"; + in + '' + substituteInPlace howdy/src/cli/add.py --replace "@pkgdatadir@" "${howdypath}" + substituteInPlace howdy/src/cli/config.py --replace '/bin/nano' 'nano' + substituteInPlace howdy/src/cli/test.py --replace "@pkgdatadir@" "${howdypath}" + + substituteInPlace howdy/src/pam/main.cc \ + --replace "python3" "${py}/bin/python" \ + --replace "/lib/security/howdy/compare.py" "${howdypath}/compare.py" + + substituteInPlace howdy/src/compare.py \ + --replace "/lib/security/howdy" "${howdypath}" \ + --replace "@pkgdatadir@" "${howdypath}" + ''; + + nativeBuildInputs = [ + bzip2 + installShellFiles + meson + ninja + pkg-config + ]; + + buildInputs = [ + fmt + gettext + inih + libevdev + pam + py + ]; + + # build howdy_pam + preConfigure = '' + cd howdy/src/pam + + # works around hardcoded install_dir: '/lib/security'. + # See https://github.com/boltgolt/howdy/blob/30728a6d3634479c24ffd4e094c34a30bbb43058/howdy/src/pam/meson.build#L22 + export DESTDIR=$out + ''; + + postInstall = + let + libDir = "$out/lib/security/howdy"; + inherit (lib) mapAttrsToList concatStrings; + in + '' + # done with howdy_pam, go back to source root + cd ../../../.. + + mkdir -p $out/share/licenses/howdy + install -Dm644 LICENSE $out/share/licenses/howdy/LICENSE + rm -rf howdy/src/pam + mkdir -p ${libDir} + cp -r howdy/src/* ${libDir} + + rm -rf ${libDir}/pam-config ${libDir}/dlib-data/* + ${concatStrings (mapAttrsToList (n: v: '' + bzip2 -dc ${v} > ${libDir}/dlib-data/${n} + '') data)} + + mkdir -p $out/bin + ln -s ${libDir}/cli.py $out/bin/howdy + + mkdir -p "$out/share/bash-completion/completions" + installShellCompletion --bash howdy/src/autocomplete/howdy + ''; + + meta = { + description = "Windows Hello™ style facial authentication for Linux"; + homepage = "https://github.com/boltgolt/howdy"; + license = lib.licenses.mit; + platforms = lib.platforms.linux; + maintainers = with lib.maintainers; [ fufexan ]; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/howdy.patch b/hosts/nb-01.cloonar.com/pkgs/howdy/howdy.patch new file mode 100644 index 0000000..dda4317 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/howdy.patch @@ -0,0 +1,155 @@ +diff --git a/howdy/src/cli/add.py b/howdy/src/cli/add.py +index 8951e31..4f793d7 100644 +--- a/howdy/src/cli/add.py ++++ b/howdy/src/cli/add.py +@@ -30,9 +30,9 @@ import cv2 + config_path = "/etc/howdy" + + # Test if at lest 1 of the data files is there and abort if it's not +-if not os.path.isfile(config_path + "/dlib-data/shape_predictor_5_face_landmarks.dat"): ++if not os.path.isfile("@pkgdatadir@/dlib-data/shape_predictor_5_face_landmarks.dat"): + print(_("Data files have not been downloaded, please run the following commands:")) +- print("\n\tcd " + config_path + "/dlib-data") ++ print("\n\tcd " + "@pkgdatadir@/dlib-data") + print("\tsudo ./install.sh\n") + sys.exit(1) + +@@ -42,23 +42,23 @@ config.read(config_path + "/config.ini") + + use_cnn = config.getboolean("core", "use_cnn", fallback=False) + if use_cnn: +- face_detector = dlib.cnn_face_detection_model_v1(config_path + "/dlib-data/mmod_human_face_detector.dat") ++ face_detector = dlib.cnn_face_detection_model_v1("@pkgdatadir@/dlib-data/mmod_human_face_detector.dat") + else: + face_detector = dlib.get_frontal_face_detector() + +-pose_predictor = dlib.shape_predictor(config_path + "/dlib-data/shape_predictor_5_face_landmarks.dat") +-face_encoder = dlib.face_recognition_model_v1(config_path + "/dlib-data/dlib_face_recognition_resnet_model_v1.dat") ++pose_predictor = dlib.shape_predictor("@pkgdatadir@/dlib-data/shape_predictor_5_face_landmarks.dat") ++face_encoder = dlib.face_recognition_model_v1("@pkgdatadir@/dlib-data/dlib_face_recognition_resnet_model_v1.dat") + + user = builtins.howdy_user + # The permanent file to store the encoded model in +-enc_file = config_path + "/models/" + user + ".dat" ++enc_file = "/var/lib/howdy/models/" + user + ".dat" + # Known encodings + encodings = [] + + # Make the ./models folder if it doesn't already exist +-if not os.path.exists(config_path + "/models"): ++if not os.path.exists("/var/lib/howdy/models"): + print(_("No face model folder found, creating one")) +- os.makedirs(config_path + "/models") ++ os.makedirs("/var/lib/howdy/models") + + # To try read a premade encodings file if it exists + try: +diff --git a/howdy/src/cli/clear.py b/howdy/src/cli/clear.py +index 6fa5f3e..fc7676c 100644 +--- a/howdy/src/cli/clear.py ++++ b/howdy/src/cli/clear.py +@@ -8,7 +8,7 @@ import builtins + from i18n import _ + + # Get the full path to this file +-path = "/etc/howdy/models" ++path = "/var/lib/howdy/models" + # Get the passed user + user = builtins.howdy_user + +diff --git a/howdy/src/cli/list.py b/howdy/src/cli/list.py +index 3532e9f..b9e2a31 100644 +--- a/howdy/src/cli/list.py ++++ b/howdy/src/cli/list.py +@@ -10,7 +10,7 @@ import builtins + from i18n import _ + + # Get the absolute path and the username +-path = "/etc/howdy" ++path = "/var/lib/howdy" + user = builtins.howdy_user + + # Check if the models file has been created yet +diff --git a/howdy/src/cli/remove.py b/howdy/src/cli/remove.py +index 6321e0b..7c13d79 100644 +--- a/howdy/src/cli/remove.py ++++ b/howdy/src/cli/remove.py +@@ -9,7 +9,7 @@ import builtins + from i18n import _ + + # Get the absolute path and the username +-path = "/etc/howdy" ++path = "/var/lib/howdy" + user = builtins.howdy_user + + # Check if enough arguments have been passed +diff --git a/howdy/src/cli/test.py b/howdy/src/cli/test.py +index d54929a..fa45500 100644 +--- a/howdy/src/cli/test.py ++++ b/howdy/src/cli/test.py +@@ -59,20 +59,20 @@ use_cnn = config.getboolean('core', 'use_cnn', fallback=False) + + if use_cnn: + face_detector = dlib.cnn_face_detection_model_v1( +- path + "/dlib-data/mmod_human_face_detector.dat" ++ "@pkgdatadir@/dlib-data/mmod_human_face_detector.dat" + ) + else: + face_detector = dlib.get_frontal_face_detector() + +-pose_predictor = dlib.shape_predictor(path + "/dlib-data/shape_predictor_5_face_landmarks.dat") +-face_encoder = dlib.face_recognition_model_v1(path + "/dlib-data/dlib_face_recognition_resnet_model_v1.dat") ++pose_predictor = dlib.shape_predictor("@pkgdatadir@/dlib-data/shape_predictor_5_face_landmarks.dat") ++face_encoder = dlib.face_recognition_model_v1("@pkgdatadir@/dlib-data/dlib_face_recognition_resnet_model_v1.dat") + + encodings = [] + models = None + + try: + user = builtins.howdy_user +- models = json.load(open(path + "/models/" + user + ".dat")) ++ models = json.load(open("/var/lib/howdy/models/" + user + ".dat")) + + for model in models: + encodings += model["data"] +diff --git a/howdy/src/compare.py b/howdy/src/compare.py +index be19464..86a8d8f 100644 +--- a/howdy/src/compare.py ++++ b/howdy/src/compare.py +@@ -48,22 +48,22 @@ def init_detector(lock): + global face_detector, pose_predictor, face_encoder + + # Test if at lest 1 of the data files is there and abort if it's not +- if not os.path.isfile(PATH + "/dlib-data/shape_predictor_5_face_landmarks.dat"): ++ if not os.path.isfile("@pkgdatadir@/dlib-data/shape_predictor_5_face_landmarks.dat"): + print(_("Data files have not been downloaded, please run the following commands:")) +- print("\n\tcd " + PATH + "/dlib-data") ++ print("\n\tcd " + "@pkgdatadir@/dlib-data") + print("\tsudo ./install.sh\n") + lock.release() + exit(1) + + # Use the CNN detector if enabled + if use_cnn: +- face_detector = dlib.cnn_face_detection_model_v1(PATH + "/dlib-data/mmod_human_face_detector.dat") ++ face_detector = dlib.cnn_face_detection_model_v1("@pkgdatadir@/dlib-data/mmod_human_face_detector.dat") + else: + face_detector = dlib.get_frontal_face_detector() + + # Start the others regardless +- pose_predictor = dlib.shape_predictor(PATH + "/dlib-data/shape_predictor_5_face_landmarks.dat") +- face_encoder = dlib.face_recognition_model_v1(PATH + "/dlib-data/dlib_face_recognition_resnet_model_v1.dat") ++ pose_predictor = dlib.shape_predictor("@pkgdatadir@/dlib-data/shape_predictor_5_face_landmarks.dat") ++ face_encoder = dlib.face_recognition_model_v1("@pkgdatadir@/dlib-data/dlib_face_recognition_resnet_model_v1.dat") + + # Note the time it took to initialize detectors + timings["ll"] = time.time() - timings["ll"] +@@ -129,7 +129,7 @@ face_encoder = None + + # Try to load the face model from the models folder + try: +- models = json.load(open(PATH + "/models/" + user + ".dat")) ++ models = json.load(open("/var/lib/howdy/models/" + user + ".dat")) + + for model in models: + encodings += model["data"] diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle-module.nix b/hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle-module.nix new file mode 100644 index 0000000..a689595 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle-module.nix @@ -0,0 +1,28 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.ir-toggle; + ir_toggle = pkgs.callPackage ./ir-toggle.nix { }; +in { + options = { + services.ir-toggle = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable Chicony IR Emitter toggler. + ''; + }; + }; + }; + config = mkIf cfg.enable { + # Udev rules to start it on boot. + environment.systemPackages = [ ir_toggle ]; + # Re-toggle the IR emitter after the sleep so that it could work perfectly + powerManagement.resumeCommands = + "${ir_toggle}/bin/chicony-ir-toggle on"; + services.udev.packages = [ ir_toggle ]; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle.nix b/hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle.nix new file mode 100644 index 0000000..e3254d4 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/ir-toggle.nix @@ -0,0 +1,17 @@ +{ stdenv, fetchFromGitHub, cmake }: + +stdenv.mkDerivation rec { + name = "chicony-ir-toggle"; + + src = fetchFromGitHub { + owner = "PetePriority"; + repo = name; + rev = "5758112ae7f502035d48f24123347ba37cdbdb34"; + sha256 = "1ihxkvhjbryhw5xjnw5a36f5w8nn4lnf07dzmzi6jzrn5ax131hw"; + }; + + nativeBuildInputs = [ cmake ]; + preInstall = '' + substituteInPlace ../CMakeLists.txt --replace /lib $out/lib + ''; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/howdy/pam-python.nix b/hosts/nb-01.cloonar.com/pkgs/howdy/pam-python.nix new file mode 100644 index 0000000..4438f92 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/howdy/pam-python.nix @@ -0,0 +1,17 @@ +{ stdenv, python2, python2Packages, fetchurl, pam }: +let outPath = placeholder "out"; +in stdenv.mkDerivation rec { + pname = "pam-python"; + version = "1.0.7"; + src = fetchurl { + url = + "https://downloads.sourceforge.net/project/pam-python/pam-python-1.0.7-1/pam-python-1.0.7.tar.gz"; + sha256 = "01vylk8vmzsvxf0iwn2nizwkhdzk0vpyqh5m1rybh0sv6pz75kln"; + }; + buildInputs = [ python2 python2Packages.sphinx pam ]; + preBuild = '' + patchShebangs . + substituteInPlace src/Makefile --replace '-Werror' '-O -Werror=cpp' + ''; + makeFlags = [ "PREFIX=${outPath}" "LIBDIR=${outPath}/lib/security" ]; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/jxplorer.nix b/hosts/nb-01.cloonar.com/pkgs/jxplorer.nix new file mode 100644 index 0000000..beda553 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/jxplorer.nix @@ -0,0 +1,47 @@ +{ lib, stdenv, fetchurl, makeDesktopItem, ant, jdk8 }: + +stdenv.mkDerivation rec { + pname = "jxplorer"; + version = "3.3.1.2"; + + src = fetchurl { + url = "https://github.com/pegacat/${pname}/releases/download/v${version}/${pname}-${version}-project.tar.bz2"; + sha256 = "/lWkavH51OqNFSLpgT+4WcQcfW3WvnnOkB03jB7bE/s="; + }; + + jxplorerItem = makeDesktopItem { + name = "JXplorer"; + exec = "jxplorer"; + comment = "A Java Ldap Browser"; + desktopName = "JXplorer"; + genericName = "Java Ldap Browser"; + icon = "jxplorer"; + }; + + configurePhase = '' + cat >"${pname}" << EOF + #!/bin/sh + cd "$out/opt/jxplorer" + export JAVA_HOME="${jdk8}" + sh jxplorer.sh "\$@" + EOF + chmod +x "${pname}" + ''; + + installPhase = '' + install -d "$out/opt/jxplorer" "$out/bin" "$out/share/pixmaps" "$out/share/applications" + cp -r ./. "$out/opt/jxplorer" + install -Dm755 "${pname}" "$out/bin/${pname}" + cp -r "${jxplorerItem}/." "$out" + install -Dm644 images/JX128.png "$out/share/pixmaps/${pname}.png" + ''; + + meta = with lib; { + description = "A Java Ldap Browser"; + homepage = "https://sourceforge.net/projects/jxplorer/"; + license = "CA Open Source Licence Version 1.0"; + maintainers = with maintainers; [ benwbooth ]; + platforms = platforms.linux; + }; +} + diff --git a/hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/default.nix b/hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/default.nix new file mode 100644 index 0000000..baeab57 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/default.nix @@ -0,0 +1,51 @@ +{ stdenv +, lib +, makeWrapper +, fetchFromGitHub +, fetchurl +, meson +, ninja +, pkg-config +, python3 +, opencv +, usbutils +}: +stdenv.mkDerivation rec { + pname = "linux-enable-ir-emitter"; + version = "4.5.0"; + + src = fetchFromGitHub { + owner = "EmixamPP"; + repo = pname; + rev = version; + hash = "sha256-Dv1ukn2TkXfBk1vc+6Uq7tw8WwCAfIcKl13BoOifz+Q="; + }; + + patches = [ + # Prevent `linux-enable-ir-emitter configure` from trying to enable systemd service, NixOS manages those declaratively. + ./remove-boot-set.patch + ]; + + nativeBuildInputs = [ + makeWrapper + meson + ninja + pkg-config + ]; + buildInputs = [ + python3 + opencv + ]; + + postInstall = '' + wrapProgram $out/bin/${pname} --prefix PATH : ${lib.makeBinPath [usbutils]} + ''; + + meta = { + description = "Provides support for infrared cameras that are not directly enabled out-of-the box"; + homepage = "https://github.com/EmixamPP/linux-enable-ir-emitter"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ fufexan ]; + platforms = lib.platforms.linux; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/remove-boot-set.patch b/hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/remove-boot-set.patch new file mode 100644 index 0000000..9cd26f4 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/linux-enable-ir-emitter/remove-boot-set.patch @@ -0,0 +1,11 @@ +diff --git a/sources/command/configure.py b/sources/command/configure.py +index 2cd20d2..84ffb73 100644 +--- a/sources/command/configure.py ++++ b/sources/command/configure.py +@@ -25,6 +25,5 @@ def configure(device: str, emitters: int, neg_answer_limit: int) -> NoReturn: + logging.info("Do not hesitate to visit the GitHub ! https://github.com/EmixamPP/linux-enable-ir-emitter/wiki") + else: + logging.info("The driver has been successfully generated.") +- boot("enable") + + exit(exit_code) diff --git a/hosts/nb-01.cloonar.com/pkgs/playactor/default.nix b/hosts/nb-01.cloonar.com/pkgs/playactor/default.nix new file mode 100644 index 0000000..08f947e --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/playactor/default.nix @@ -0,0 +1,17 @@ +# This file has been generated by node2nix 1.11.1. Do not edit! + +{pkgs ? import { + inherit system; + }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}: + +let + nodeEnv = import ./node-env.nix { + inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript; + inherit pkgs nodejs; + libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null; + }; +in +import ./node-packages.nix { + inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit; + inherit nodeEnv; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/playactor/node-env.nix b/hosts/nb-01.cloonar.com/pkgs/playactor/node-env.nix new file mode 100644 index 0000000..bc1e366 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/playactor/node-env.nix @@ -0,0 +1,689 @@ +# This file originates from node2nix + +{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}: + +let + # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master + utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux; + + python = if nodejs ? python then nodejs.python else python2; + + # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise + tarWrapper = runCommand "tarWrapper" {} '' + mkdir -p $out/bin + + cat > $out/bin/tar <> $out/nix-support/hydra-build-products + ''; + }; + + # Common shell logic + installPackage = writeShellScript "install-package" '' + installPackage() { + local packageName=$1 src=$2 + + local strippedName + + local DIR=$PWD + cd $TMPDIR + + unpackFile $src + + # Make the base dir in which the target dependency resides first + mkdir -p "$(dirname "$DIR/$packageName")" + + if [ -f "$src" ] + then + # Figure out what directory has been unpacked + packageDir="$(find . -maxdepth 1 -type d | tail -1)" + + # Restore write permissions to make building work + find "$packageDir" -type d -exec chmod u+x {} \; + chmod -R u+w "$packageDir" + + # Move the extracted tarball into the output folder + mv "$packageDir" "$DIR/$packageName" + elif [ -d "$src" ] + then + # Get a stripped name (without hash) of the source directory. + # On old nixpkgs it's already set internally. + if [ -z "$strippedName" ] + then + strippedName="$(stripHash $src)" + fi + + # Restore write permissions to make building work + chmod -R u+w "$strippedName" + + # Move the extracted directory into the output folder + mv "$strippedName" "$DIR/$packageName" + fi + + # Change to the package directory to install dependencies + cd "$DIR/$packageName" + } + ''; + + # Bundle the dependencies of the package + # + # Only include dependencies if they don't exist. They may also be bundled in the package. + includeDependencies = {dependencies}: + lib.optionalString (dependencies != []) ( + '' + mkdir -p node_modules + cd node_modules + '' + + (lib.concatMapStrings (dependency: + '' + if [ ! -e "${dependency.packageName}" ]; then + ${composePackage dependency} + fi + '' + ) dependencies) + + '' + cd .. + '' + ); + + # Recursively composes the dependencies of a package + composePackage = { name, packageName, src, dependencies ? [], ... }@args: + builtins.addErrorContext "while evaluating node package '${packageName}'" '' + installPackage "${packageName}" "${src}" + ${includeDependencies { inherit dependencies; }} + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + ''; + + pinpointDependencies = {dependencies, production}: + let + pinpointDependenciesFromPackageJSON = writeTextFile { + name = "pinpointDependencies.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + function resolveDependencyVersion(location, name) { + if(location == process.env['NIX_STORE']) { + return null; + } else { + var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json"); + + if(fs.existsSync(dependencyPackageJSON)) { + var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON)); + + if(dependencyPackageObj.name == name) { + return dependencyPackageObj.version; + } + } else { + return resolveDependencyVersion(path.resolve(location, ".."), name); + } + } + } + + function replaceDependencies(dependencies) { + if(typeof dependencies == "object" && dependencies !== null) { + for(var dependency in dependencies) { + var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency); + + if(resolvedVersion === null) { + process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n"); + } else { + dependencies[dependency] = resolvedVersion; + } + } + } + } + + /* Read the package.json configuration */ + var packageObj = JSON.parse(fs.readFileSync('./package.json')); + + /* Pinpoint all dependencies */ + replaceDependencies(packageObj.dependencies); + if(process.argv[2] == "development") { + replaceDependencies(packageObj.devDependencies); + } + else { + packageObj.devDependencies = {}; + } + replaceDependencies(packageObj.optionalDependencies); + replaceDependencies(packageObj.peerDependencies); + + /* Write the fixed package.json file */ + fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2)); + ''; + }; + in + '' + node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"} + + ${lib.optionalString (dependencies != []) + '' + if [ -d node_modules ] + then + cd node_modules + ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies} + cd .. + fi + ''} + ''; + + # Recursively traverses all dependencies of a package and pinpoints all + # dependencies in the package.json file to the versions that are actually + # being used. + + pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args: + '' + if [ -d "${packageName}" ] + then + cd "${packageName}" + ${pinpointDependencies { inherit dependencies production; }} + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + fi + ''; + + # Extract the Node.js source code which is used to compile packages with + # native bindings + nodeSources = runCommand "node-sources" {} '' + tar --no-same-owner --no-same-permissions -xf ${nodejs.src} + mv node-* $out + ''; + + # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty) + addIntegrityFieldsScript = writeTextFile { + name = "addintegrityfields.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + function augmentDependencies(baseDir, dependencies) { + for(var dependencyName in dependencies) { + var dependency = dependencies[dependencyName]; + + // Open package.json and augment metadata fields + var packageJSONDir = path.join(baseDir, "node_modules", dependencyName); + var packageJSONPath = path.join(packageJSONDir, "package.json"); + + if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored + console.log("Adding metadata fields to: "+packageJSONPath); + var packageObj = JSON.parse(fs.readFileSync(packageJSONPath)); + + if(dependency.integrity) { + packageObj["_integrity"] = dependency.integrity; + } else { + packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads. + } + + if(dependency.resolved) { + packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided + } else { + packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories. + } + + if(dependency.from !== undefined) { // Adopt from property if one has been provided + packageObj["_from"] = dependency.from; + } + + fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2)); + } + + // Augment transitive dependencies + if(dependency.dependencies !== undefined) { + augmentDependencies(packageJSONDir, dependency.dependencies); + } + } + } + + if(fs.existsSync("./package-lock.json")) { + var packageLock = JSON.parse(fs.readFileSync("./package-lock.json")); + + if(![1, 2].includes(packageLock.lockfileVersion)) { + process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n"); + process.exit(1); + } + + if(packageLock.dependencies !== undefined) { + augmentDependencies(".", packageLock.dependencies); + } + } + ''; + }; + + # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes + reconstructPackageLock = writeTextFile { + name = "reconstructpackagelock.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + var packageObj = JSON.parse(fs.readFileSync("package.json")); + + var lockObj = { + name: packageObj.name, + version: packageObj.version, + lockfileVersion: 2, + requires: true, + packages: { + "": { + name: packageObj.name, + version: packageObj.version, + license: packageObj.license, + bin: packageObj.bin, + dependencies: packageObj.dependencies, + engines: packageObj.engines, + optionalDependencies: packageObj.optionalDependencies + } + }, + dependencies: {} + }; + + function augmentPackageJSON(filePath, packages, dependencies) { + var packageJSON = path.join(filePath, "package.json"); + if(fs.existsSync(packageJSON)) { + var packageObj = JSON.parse(fs.readFileSync(packageJSON)); + packages[filePath] = { + version: packageObj.version, + integrity: "sha1-000000000000000000000000000=", + dependencies: packageObj.dependencies, + engines: packageObj.engines, + optionalDependencies: packageObj.optionalDependencies + }; + dependencies[packageObj.name] = { + version: packageObj.version, + integrity: "sha1-000000000000000000000000000=", + dependencies: {} + }; + processDependencies(path.join(filePath, "node_modules"), packages, dependencies[packageObj.name].dependencies); + } + } + + function processDependencies(dir, packages, dependencies) { + if(fs.existsSync(dir)) { + var files = fs.readdirSync(dir); + + files.forEach(function(entry) { + var filePath = path.join(dir, entry); + var stats = fs.statSync(filePath); + + if(stats.isDirectory()) { + if(entry.substr(0, 1) == "@") { + // When we encounter a namespace folder, augment all packages belonging to the scope + var pkgFiles = fs.readdirSync(filePath); + + pkgFiles.forEach(function(entry) { + if(stats.isDirectory()) { + var pkgFilePath = path.join(filePath, entry); + augmentPackageJSON(pkgFilePath, packages, dependencies); + } + }); + } else { + augmentPackageJSON(filePath, packages, dependencies); + } + } + }); + } + } + + processDependencies("node_modules", lockObj.packages, lockObj.dependencies); + + fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2)); + ''; + }; + + # Script that links bins defined in package.json to the node_modules bin directory + # NPM does not do this for top-level packages itself anymore as of v7 + linkBinsScript = writeTextFile { + name = "linkbins.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + var packageObj = JSON.parse(fs.readFileSync("package.json")); + + var nodeModules = Array(packageObj.name.split("/").length).fill("..").join(path.sep); + + if(packageObj.bin !== undefined) { + fs.mkdirSync(path.join(nodeModules, ".bin")) + + if(typeof packageObj.bin == "object") { + Object.keys(packageObj.bin).forEach(function(exe) { + if(fs.existsSync(packageObj.bin[exe])) { + console.log("linking bin '" + exe + "'"); + fs.symlinkSync( + path.join("..", packageObj.name, packageObj.bin[exe]), + path.join(nodeModules, ".bin", exe) + ); + } + else { + console.log("skipping non-existent bin '" + exe + "'"); + } + }) + } + else { + if(fs.existsSync(packageObj.bin)) { + console.log("linking bin '" + packageObj.bin + "'"); + fs.symlinkSync( + path.join("..", packageObj.name, packageObj.bin), + path.join(nodeModules, ".bin", packageObj.name.split("/").pop()) + ); + } + else { + console.log("skipping non-existent bin '" + packageObj.bin + "'"); + } + } + } + else if(packageObj.directories !== undefined && packageObj.directories.bin !== undefined) { + fs.mkdirSync(path.join(nodeModules, ".bin")) + + fs.readdirSync(packageObj.directories.bin).forEach(function(exe) { + if(fs.existsSync(path.join(packageObj.directories.bin, exe))) { + console.log("linking bin '" + exe + "'"); + fs.symlinkSync( + path.join("..", packageObj.name, packageObj.directories.bin, exe), + path.join(nodeModules, ".bin", exe) + ); + } + else { + console.log("skipping non-existent bin '" + exe + "'"); + } + }) + } + ''; + }; + + prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}: + let + forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com"; + in + '' + # Pinpoint the versions of all dependencies to the ones that are actually being used + echo "pinpointing versions of dependencies..." + source $pinpointDependenciesScriptPath + + # Patch the shebangs of the bundled modules to prevent them from + # calling executables outside the Nix store as much as possible + patchShebangs . + + # Deploy the Node.js package by running npm install. Since the + # dependencies have been provided already by ourselves, it should not + # attempt to install them again, which is good, because we want to make + # it Nix's responsibility. If it needs to install any dependencies + # anyway (e.g. because the dependency parameters are + # incomplete/incorrect), it fails. + # + # The other responsibilities of NPM are kept -- version checks, build + # steps, postprocessing etc. + + export HOME=$TMPDIR + cd "${packageName}" + runHook preRebuild + + ${lib.optionalString bypassCache '' + ${lib.optionalString reconstructLock '' + if [ -f package-lock.json ] + then + echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!" + echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!" + rm package-lock.json + else + echo "No package-lock.json file found, reconstructing..." + fi + + node ${reconstructPackageLock} + ''} + + node ${addIntegrityFieldsScript} + ''} + + npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild + + runHook postRebuild + + if [ "''${dontNpmInstall-}" != "1" ] + then + # NPM tries to download packages even when they already exist if npm-shrinkwrap is used. + rm -f npm-shrinkwrap.json + + npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install + fi + + # Link executables defined in package.json + node ${linkBinsScript} + ''; + + # Builds and composes an NPM package including all its dependencies + buildNodePackage = + { name + , packageName + , version ? null + , dependencies ? [] + , buildInputs ? [] + , production ? true + , npmFlags ? "" + , dontNpmInstall ? false + , bypassCache ? false + , reconstructLock ? false + , preRebuild ? "" + , dontStrip ? true + , unpackPhase ? "true" + , buildPhase ? "true" + , meta ? {} + , ... }@args: + + let + extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ]; + in + stdenv.mkDerivation ({ + name = "${name}${if version == null then "" else "-${version}"}"; + buildInputs = [ tarWrapper python nodejs ] + ++ lib.optional (stdenv.isLinux) utillinux + ++ lib.optional (stdenv.isDarwin) libtool + ++ buildInputs; + + inherit nodejs; + + inherit dontStrip; # Stripping may fail a build for some package deployments + inherit dontNpmInstall preRebuild unpackPhase buildPhase; + + compositionScript = composePackage args; + pinpointDependenciesScript = pinpointDependenciesOfPackage args; + + passAsFile = [ "compositionScript" "pinpointDependenciesScript" ]; + + installPhase = '' + source ${installPackage} + + # Create and enter a root node_modules/ folder + mkdir -p $out/lib/node_modules + cd $out/lib/node_modules + + # Compose the package and all its dependencies + source $compositionScriptPath + + ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }} + + # Create symlink to the deployed executable folder, if applicable + if [ -d "$out/lib/node_modules/.bin" ] + then + ln -s $out/lib/node_modules/.bin $out/bin + + # Fixup all executables + ls $out/bin/* | while read i + do + file="$(readlink -f "$i")" + chmod u+rwx "$file" + if isScript "$file" + then + sed -i 's/\r$//' "$file" # convert crlf to lf + fi + done + fi + + # Create symlinks to the deployed manual page folders, if applicable + if [ -d "$out/lib/node_modules/${packageName}/man" ] + then + mkdir -p $out/share + for dir in "$out/lib/node_modules/${packageName}/man/"* + do + mkdir -p $out/share/man/$(basename "$dir") + for page in "$dir"/* + do + ln -s $page $out/share/man/$(basename "$dir") + done + done + fi + + # Run post install hook, if provided + runHook postInstall + ''; + + meta = { + # default to Node.js' platforms + platforms = nodejs.meta.platforms; + } // meta; + } // extraArgs); + + # Builds a node environment (a node_modules folder and a set of binaries) + buildNodeDependencies = + { name + , packageName + , version ? null + , src + , dependencies ? [] + , buildInputs ? [] + , production ? true + , npmFlags ? "" + , dontNpmInstall ? false + , bypassCache ? false + , reconstructLock ? false + , dontStrip ? true + , unpackPhase ? "true" + , buildPhase ? "true" + , ... }@args: + + let + extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ]; + in + stdenv.mkDerivation ({ + name = "node-dependencies-${name}${if version == null then "" else "-${version}"}"; + + buildInputs = [ tarWrapper python nodejs ] + ++ lib.optional (stdenv.isLinux) utillinux + ++ lib.optional (stdenv.isDarwin) libtool + ++ buildInputs; + + inherit dontStrip; # Stripping may fail a build for some package deployments + inherit dontNpmInstall unpackPhase buildPhase; + + includeScript = includeDependencies { inherit dependencies; }; + pinpointDependenciesScript = pinpointDependenciesOfPackage args; + + passAsFile = [ "includeScript" "pinpointDependenciesScript" ]; + + installPhase = '' + source ${installPackage} + + mkdir -p $out/${packageName} + cd $out/${packageName} + + source $includeScriptPath + + # Create fake package.json to make the npm commands work properly + cp ${src}/package.json . + chmod 644 package.json + ${lib.optionalString bypassCache '' + if [ -f ${src}/package-lock.json ] + then + cp ${src}/package-lock.json . + chmod 644 package-lock.json + fi + ''} + + # Go to the parent folder to make sure that all packages are pinpointed + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + + ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }} + + # Expose the executables that were installed + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + + mv ${packageName} lib + ln -s $out/lib/node_modules/.bin $out/bin + ''; + } // extraArgs); + + # Builds a development shell + buildNodeShell = + { name + , packageName + , version ? null + , src + , dependencies ? [] + , buildInputs ? [] + , production ? true + , npmFlags ? "" + , dontNpmInstall ? false + , bypassCache ? false + , reconstructLock ? false + , dontStrip ? true + , unpackPhase ? "true" + , buildPhase ? "true" + , ... }@args: + + let + nodeDependencies = buildNodeDependencies args; + extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ]; + in + stdenv.mkDerivation ({ + name = "node-shell-${name}${if version == null then "" else "-${version}"}"; + + buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs; + buildCommand = '' + mkdir -p $out/bin + cat > $out/bin/shell < { + inherit system; + }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}: + +let + nodeEnv = import ./node-env.nix { + inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript; + inherit pkgs nodejs; + libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null; + }; +in +import ./node-packages.nix { + inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit; + inherit nodeEnv; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/room-assistant/node-env.nix b/hosts/nb-01.cloonar.com/pkgs/room-assistant/node-env.nix new file mode 100644 index 0000000..5dad9ec --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/room-assistant/node-env.nix @@ -0,0 +1,686 @@ +# This file originates from node2nix + +{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}: + +let + # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master + utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux; + + python = if nodejs ? python then nodejs.python else python2; + + # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise + tarWrapper = runCommand "tarWrapper" {} '' + mkdir -p $out/bin + + cat > $out/bin/tar <> $out/nix-support/hydra-build-products + ''; + }; + + # Common shell logic + installPackage = writeShellScript "install-package" '' + installPackage() { + local packageName=$1 src=$2 + + local strippedName + + local DIR=$PWD + cd $TMPDIR + + unpackFile $src + + # Make the base dir in which the target dependency resides first + mkdir -p "$(dirname "$DIR/$packageName")" + + if [ -f "$src" ] + then + # Figure out what directory has been unpacked + packageDir="$(find . -maxdepth 1 -type d | tail -1)" + + # Restore write permissions to make building work + find "$packageDir" -type d -exec chmod u+x {} \; + chmod -R u+w "$packageDir" + + # Move the extracted tarball into the output folder + mv "$packageDir" "$DIR/$packageName" + elif [ -d "$src" ] + then + # Get a stripped name (without hash) of the source directory. + # On old nixpkgs it's already set internally. + if [ -z "$strippedName" ] + then + strippedName="$(stripHash $src)" + fi + + # Restore write permissions to make building work + chmod -R u+w "$strippedName" + + # Move the extracted directory into the output folder + mv "$strippedName" "$DIR/$packageName" + fi + + # Change to the package directory to install dependencies + cd "$DIR/$packageName" + } + ''; + + # Bundle the dependencies of the package + # + # Only include dependencies if they don't exist. They may also be bundled in the package. + includeDependencies = {dependencies}: + lib.optionalString (dependencies != []) ( + '' + mkdir -p node_modules + cd node_modules + '' + + (lib.concatMapStrings (dependency: + '' + if [ ! -e "${dependency.packageName}" ]; then + ${composePackage dependency} + fi + '' + ) dependencies) + + '' + cd .. + '' + ); + + # Recursively composes the dependencies of a package + composePackage = { name, packageName, src, dependencies ? [], ... }@args: + builtins.addErrorContext "while evaluating node package '${packageName}'" '' + installPackage "${packageName}" "${src}" + ${includeDependencies { inherit dependencies; }} + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + ''; + + pinpointDependencies = {dependencies, production}: + let + pinpointDependenciesFromPackageJSON = writeTextFile { + name = "pinpointDependencies.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + function resolveDependencyVersion(location, name) { + if(location == process.env['NIX_STORE']) { + return null; + } else { + var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json"); + + if(fs.existsSync(dependencyPackageJSON)) { + var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON)); + + if(dependencyPackageObj.name == name) { + return dependencyPackageObj.version; + } + } else { + return resolveDependencyVersion(path.resolve(location, ".."), name); + } + } + } + + function replaceDependencies(dependencies) { + if(typeof dependencies == "object" && dependencies !== null) { + for(var dependency in dependencies) { + var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency); + + if(resolvedVersion === null) { + process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n"); + } else { + dependencies[dependency] = resolvedVersion; + } + } + } + } + + /* Read the package.json configuration */ + var packageObj = JSON.parse(fs.readFileSync('./package.json')); + + /* Pinpoint all dependencies */ + replaceDependencies(packageObj.dependencies); + if(process.argv[2] == "development") { + replaceDependencies(packageObj.devDependencies); + } + else { + packageObj.devDependencies = {}; + } + replaceDependencies(packageObj.optionalDependencies); + replaceDependencies(packageObj.peerDependencies); + + /* Write the fixed package.json file */ + fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2)); + ''; + }; + in + '' + node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"} + + ${lib.optionalString (dependencies != []) + '' + if [ -d node_modules ] + then + cd node_modules + ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies} + cd .. + fi + ''} + ''; + + # Recursively traverses all dependencies of a package and pinpoints all + # dependencies in the package.json file to the versions that are actually + # being used. + + pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args: + '' + if [ -d "${packageName}" ] + then + cd "${packageName}" + ${pinpointDependencies { inherit dependencies production; }} + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + fi + ''; + + # Extract the Node.js source code which is used to compile packages with + # native bindings + nodeSources = runCommand "node-sources" {} '' + tar --no-same-owner --no-same-permissions -xf ${nodejs.src} + mv node-* $out + ''; + + # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty) + addIntegrityFieldsScript = writeTextFile { + name = "addintegrityfields.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + function augmentDependencies(baseDir, dependencies) { + for(var dependencyName in dependencies) { + var dependency = dependencies[dependencyName]; + + // Open package.json and augment metadata fields + var packageJSONDir = path.join(baseDir, "node_modules", dependencyName); + var packageJSONPath = path.join(packageJSONDir, "package.json"); + + if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored + console.log("Adding metadata fields to: "+packageJSONPath); + var packageObj = JSON.parse(fs.readFileSync(packageJSONPath)); + + if(dependency.integrity) { + packageObj["_integrity"] = dependency.integrity; + } else { + packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads. + } + + if(dependency.resolved) { + packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided + } else { + packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories. + } + + if(dependency.from !== undefined) { // Adopt from property if one has been provided + packageObj["_from"] = dependency.from; + } + + fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2)); + } + + // Augment transitive dependencies + if(dependency.dependencies !== undefined) { + augmentDependencies(packageJSONDir, dependency.dependencies); + } + } + } + + if(fs.existsSync("./package-lock.json")) { + var packageLock = JSON.parse(fs.readFileSync("./package-lock.json")); + + if(![1, 2].includes(packageLock.lockfileVersion)) { + process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n"); + process.exit(1); + } + + if(packageLock.dependencies !== undefined) { + augmentDependencies(".", packageLock.dependencies); + } + } + ''; + }; + + # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes + reconstructPackageLock = writeTextFile { + name = "reconstructpackagelock.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + var packageObj = JSON.parse(fs.readFileSync("package.json")); + + var lockObj = { + name: packageObj.name, + version: packageObj.version, + lockfileVersion: 2, + requires: true, + packages: { + "": { + name: packageObj.name, + version: packageObj.version, + license: packageObj.license, + bin: packageObj.bin, + dependencies: packageObj.dependencies, + engines: packageObj.engines, + optionalDependencies: packageObj.optionalDependencies + } + }, + dependencies: {} + }; + + function augmentPackageJSON(filePath, packages, dependencies) { + var packageJSON = path.join(filePath, "package.json"); + if(fs.existsSync(packageJSON)) { + var packageObj = JSON.parse(fs.readFileSync(packageJSON)); + packages[filePath] = { + version: packageObj.version, + integrity: "sha1-000000000000000000000000000=", + dependencies: packageObj.dependencies, + engines: packageObj.engines, + optionalDependencies: packageObj.optionalDependencies + }; + dependencies[packageObj.name] = { + version: packageObj.version, + integrity: "sha1-000000000000000000000000000=", + dependencies: {} + }; + processDependencies(path.join(filePath, "node_modules"), packages, dependencies[packageObj.name].dependencies); + } + } + + function processDependencies(dir, packages, dependencies) { + if(fs.existsSync(dir)) { + var files = fs.readdirSync(dir); + + files.forEach(function(entry) { + var filePath = path.join(dir, entry); + var stats = fs.statSync(filePath); + + if(stats.isDirectory()) { + if(entry.substr(0, 1) == "@") { + // When we encounter a namespace folder, augment all packages belonging to the scope + var pkgFiles = fs.readdirSync(filePath); + + pkgFiles.forEach(function(entry) { + if(stats.isDirectory()) { + var pkgFilePath = path.join(filePath, entry); + augmentPackageJSON(pkgFilePath, packages, dependencies); + } + }); + } else { + augmentPackageJSON(filePath, packages, dependencies); + } + } + }); + } + } + + processDependencies("node_modules", lockObj.packages, lockObj.dependencies); + + fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2)); + ''; + }; + + # Script that links bins defined in package.json to the node_modules bin directory + # NPM does not do this for top-level packages itself anymore as of v7 + linkBinsScript = writeTextFile { + name = "linkbins.js"; + text = '' + var fs = require('fs'); + var path = require('path'); + + var packageObj = JSON.parse(fs.readFileSync("package.json")); + + var nodeModules = Array(packageObj.name.split("/").length).fill("..").join(path.sep); + + if(packageObj.bin !== undefined) { + fs.mkdirSync(path.join(nodeModules, ".bin")) + + if(typeof packageObj.bin == "object") { + Object.keys(packageObj.bin).forEach(function(exe) { + if(fs.existsSync(packageObj.bin[exe])) { + console.log("linking bin '" + exe + "'"); + fs.symlinkSync( + path.join("..", packageObj.name, packageObj.bin[exe]), + path.join(nodeModules, ".bin", exe) + ); + } + else { + console.log("skipping non-existent bin '" + exe + "'"); + } + }) + } + else { + if(fs.existsSync(packageObj.bin)) { + console.log("linking bin '" + packageObj.bin + "'"); + fs.symlinkSync( + path.join("..", packageObj.name, packageObj.bin), + path.join(nodeModules, ".bin", packageObj.name.split("/").pop()) + ); + } + else { + console.log("skipping non-existent bin '" + packageObj.bin + "'"); + } + } + } + else if(packageObj.directories !== undefined && packageObj.directories.bin !== undefined) { + fs.mkdirSync(path.join(nodeModules, ".bin")) + + fs.readdirSync(packageObj.directories.bin).forEach(function(exe) { + if(fs.existsSync(path.join(packageObj.directories.bin, exe))) { + console.log("linking bin '" + exe + "'"); + fs.symlinkSync( + path.join("..", packageObj.name, packageObj.directories.bin, exe), + path.join(nodeModules, ".bin", exe) + ); + } + else { + console.log("skipping non-existent bin '" + exe + "'"); + } + }) + } + ''; + }; + + prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}: + let + forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com"; + in + '' + # Pinpoint the versions of all dependencies to the ones that are actually being used + echo "pinpointing versions of dependencies..." + source $pinpointDependenciesScriptPath + + # Patch the shebangs of the bundled modules to prevent them from + # calling executables outside the Nix store as much as possible + patchShebangs . + + # Deploy the Node.js package by running npm install. Since the + # dependencies have been provided already by ourselves, it should not + # attempt to install them again, which is good, because we want to make + # it Nix's responsibility. If it needs to install any dependencies + # anyway (e.g. because the dependency parameters are + # incomplete/incorrect), it fails. + # + # The other responsibilities of NPM are kept -- version checks, build + # steps, postprocessing etc. + + export HOME=$TMPDIR + cd "${packageName}" + runHook preRebuild + + ${lib.optionalString bypassCache '' + ${lib.optionalString reconstructLock '' + if [ -f package-lock.json ] + then + echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!" + echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!" + rm package-lock.json + else + echo "No package-lock.json file found, reconstructing..." + fi + + node ${reconstructPackageLock} + ''} + + node ${addIntegrityFieldsScript} + ''} + + npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild + + runHook postRebuild + + if [ "''${dontNpmInstall-}" != "1" ] + then + # NPM tries to download packages even when they already exist if npm-shrinkwrap is used. + rm -f npm-shrinkwrap.json + + npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install + fi + + # Link executables defined in package.json + node ${linkBinsScript} + ''; + + # Builds and composes an NPM package including all its dependencies + buildNodePackage = + { name + , packageName + , version ? null + , dependencies ? [] + , buildInputs ? [] + , production ? true + , npmFlags ? "" + , dontNpmInstall ? false + , bypassCache ? false + , reconstructLock ? false + , preRebuild ? "" + , dontStrip ? true + , unpackPhase ? "true" + , buildPhase ? "true" + , meta ? {} + , ... }@args: + + let + extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ]; + in + stdenv.mkDerivation ({ + name = "${name}${if version == null then "" else "-${version}"}"; + buildInputs = [ tarWrapper python nodejs ] + ++ lib.optional (stdenv.isLinux) utillinux + ++ lib.optional (stdenv.isDarwin) libtool + ++ buildInputs; + + inherit nodejs; + + inherit dontStrip; # Stripping may fail a build for some package deployments + inherit dontNpmInstall preRebuild unpackPhase buildPhase; + + compositionScript = composePackage args; + pinpointDependenciesScript = pinpointDependenciesOfPackage args; + + passAsFile = [ "compositionScript" "pinpointDependenciesScript" ]; + + installPhase = '' + source ${installPackage} + + # Create and enter a root node_modules/ folder + mkdir -p $out/lib/node_modules + cd $out/lib/node_modules + + # Compose the package and all its dependencies + source $compositionScriptPath + + ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }} + + # Create symlink to the deployed executable folder, if applicable + if [ -d "$out/lib/node_modules/.bin" ] + then + ln -s $out/lib/node_modules/.bin $out/bin + + # Patch the shebang lines of all the executables + ls $out/bin/* | while read i + do + file="$(readlink -f "$i")" + chmod u+rwx "$file" + patchShebangs "$file" + done + fi + + # Create symlinks to the deployed manual page folders, if applicable + if [ -d "$out/lib/node_modules/${packageName}/man" ] + then + mkdir -p $out/share + for dir in "$out/lib/node_modules/${packageName}/man/"* + do + mkdir -p $out/share/man/$(basename "$dir") + for page in "$dir"/* + do + ln -s $page $out/share/man/$(basename "$dir") + done + done + fi + + # Run post install hook, if provided + runHook postInstall + ''; + + meta = { + # default to Node.js' platforms + platforms = nodejs.meta.platforms; + } // meta; + } // extraArgs); + + # Builds a node environment (a node_modules folder and a set of binaries) + buildNodeDependencies = + { name + , packageName + , version ? null + , src + , dependencies ? [] + , buildInputs ? [] + , production ? true + , npmFlags ? "" + , dontNpmInstall ? false + , bypassCache ? false + , reconstructLock ? false + , dontStrip ? true + , unpackPhase ? "true" + , buildPhase ? "true" + , ... }@args: + + let + extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ]; + in + stdenv.mkDerivation ({ + name = "node-dependencies-${name}${if version == null then "" else "-${version}"}"; + + buildInputs = [ tarWrapper python nodejs ] + ++ lib.optional (stdenv.isLinux) utillinux + ++ lib.optional (stdenv.isDarwin) libtool + ++ buildInputs; + + inherit dontStrip; # Stripping may fail a build for some package deployments + inherit dontNpmInstall unpackPhase buildPhase; + + includeScript = includeDependencies { inherit dependencies; }; + pinpointDependenciesScript = pinpointDependenciesOfPackage args; + + passAsFile = [ "includeScript" "pinpointDependenciesScript" ]; + + installPhase = '' + source ${installPackage} + + mkdir -p $out/${packageName} + cd $out/${packageName} + + source $includeScriptPath + + # Create fake package.json to make the npm commands work properly + cp ${src}/package.json . + chmod 644 package.json + ${lib.optionalString bypassCache '' + if [ -f ${src}/package-lock.json ] + then + cp ${src}/package-lock.json . + chmod 644 package-lock.json + fi + ''} + + # Go to the parent folder to make sure that all packages are pinpointed + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + + ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }} + + # Expose the executables that were installed + cd .. + ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."} + + mv ${packageName} lib + ln -s $out/lib/node_modules/.bin $out/bin + ''; + } // extraArgs); + + # Builds a development shell + buildNodeShell = + { name + , packageName + , version ? null + , src + , dependencies ? [] + , buildInputs ? [] + , production ? true + , npmFlags ? "" + , dontNpmInstall ? false + , bypassCache ? false + , reconstructLock ? false + , dontStrip ? true + , unpackPhase ? "true" + , buildPhase ? "true" + , ... }@args: + + let + nodeDependencies = buildNodeDependencies args; + extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ]; + in + stdenv.mkDerivation ({ + name = "node-shell-${name}${if version == null then "" else "-${version}"}"; + + buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs; + buildCommand = '' + mkdir -p $out/bin + cat > $out/bin/shell < { + inherit system; +}, system ? builtins.currentSystem}: + +let + nodePackages = import ./default.nix { + inherit pkgs system; + }; +in +nodePackages // { + "room-assistant-2.20.0" = nodePackages."room-assistant-2.20.0".override { + buildInputs = [ + pkgs.pkgconfig + nodePackages."@nuxt/opencollective-0.3.2" + # nodePackages."canvas-2.11.0" + pkgs.bluez + pkgs.libudev-zero + pkgs.nodePackages.node-pre-gyp + pkgs.nodePackages.node-gyp + # canvas stuff + pkgs.cairo + pkgs.pango + pkgs.libpng + pkgs.libuuid + pkgs.libGL + # pkgs.libjpeg_original + pkgs.libjpeg + pkgs.giflib + # pkgs.librsvg + pkgs.netsurf.libsvgtiny + ]; + }; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/self-service-password/default.nix b/hosts/nb-01.cloonar.com/pkgs/self-service-password/default.nix new file mode 100644 index 0000000..1b2679f --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/self-service-password/default.nix @@ -0,0 +1,95 @@ +{ lib, stdenv, fetchurl }: + +let + generic = { + version, sha256, + eol ? false, extraVulnerabilities ? [] + }: let + major = lib.versions.major version; + in stdenv.mkDerivation rec { + pname = "selfServicePassword"; + inherit version; + + src = fetchurl { + url = "https://github.com/ltb-project/self-service-password/archive/refs/tags/v${version}.tar.gz"; + inherit sha256; + }; + + installPhase = '' + runHook preInstall + mkdir -p $out/ + cp -R . $out/ + runHook postInstall + ''; + + meta = with lib; { + description = "PHP application that allows users to change their password in an LDAP directory."; + homepage = "https://github.com/ltb-project/self-service-password"; + license = licenses.agpl3Plus; + platforms = with platforms; unix; + }; + }; +in { + selfServicePassword = generic { + version = "1.5.2"; + sha256 = "dcef404e6b715f16bda71381647af38052a67deef4d387312856596ef131e030"; + }; + + systemd.services = { + # When upgrading the Nextcloud package, Nextcloud can report errors such as + # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly" + # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround). + phpfpm-selfservicepassword.restartTriggers = [ selfServicePassword ]; + + selfservicepassword-setup = let + c = cfg.config; + writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]"; + + overrideConfig = pkgs.writeText "config.inc.local.php" '' + $out/bin/learn-spam.sh <<'EOF' + #!/bin/sh + exec ${rspamd}/bin/rspamc -h /run/rspamd.sock learn_spam + EOF + cat > $out/bin/learn-ham.sh <<'EOF' + #!/bin/sh + exec ${rspamd}/bin/rspamc -h /run/rspamd.sock learn_ham + EOF + chmod +x $out/bin/*.sh + ''; +} + diff --git a/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/move-to-spam.sieve b/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/move-to-spam.sieve new file mode 100644 index 0000000..4643ffc --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/move-to-spam.sieve @@ -0,0 +1,5 @@ +require ["fileinto"]; + +if header :is "X-Spam" "Yes" { + fileinto "Spam"; +} diff --git a/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-ham.sieve b/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-ham.sieve new file mode 100644 index 0000000..6217a90 --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-ham.sieve @@ -0,0 +1,15 @@ +require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; + +if environment :matches "imap.mailbox" "*" { + set "mailbox" "${1}"; +} + +if string "${mailbox}" "Trash" { + stop; +} + +if environment :matches "imap.user" "*" { + set "username" "${1}"; +} + +pipe :copy "learn-ham.sh" [ "${username}" ]; diff --git a/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-spam.sieve b/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-spam.sieve new file mode 100644 index 0000000..9d4c74b --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/sieve-spam-filter/src/report-spam.sieve @@ -0,0 +1,7 @@ +require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; + +if environment :matches "imap.user" "*" { + set "username" "${1}"; +} + +pipe :copy "learn-spam.sh" [ "${username}" ]; diff --git a/hosts/nb-01.cloonar.com/pkgs/thunderbird.nix b/hosts/nb-01.cloonar.com/pkgs/thunderbird.nix new file mode 100644 index 0000000..61a0e4f --- /dev/null +++ b/hosts/nb-01.cloonar.com/pkgs/thunderbird.nix @@ -0,0 +1,205 @@ +# Update instructions: +# +# To update `thunderbird-bin`'s `release_sources.nix`, run from the nixpkgs root: +# +# nix-shell maintainers/scripts/update.nix --argstr package pkgs.thunderbird-bin-unwrapped +{ lib, stdenv, fetchurl, config, wrapGAppsHook +, alsa-lib +, atk +, cairo +, curl +, cups +, dbus-glib +, dbus +, fontconfig +, freetype +, gdk-pixbuf +, glib +, glibc +, gtk2 +, gtk3 +, libkrb5 +, libX11 +, libXScrnSaver +, libxcb +, libXcomposite +, libXcursor +, libXdamage +, libXext +, libXfixes +, libXi +, libXinerama +, libXrender +, libXrandr +, libXt +, libXtst +, libcanberra +, libnotify +, adwaita-icon-theme +, libGLU, libGL +, nspr +, nss_latest +, pango +, pipewire +, pciutils +, heimdal +, libpulseaudio +, systemd +, writeScript +, writeText +, xidel +, coreutils +, gnused +, gnugrep +, gnupg +, ffmpeg +, runtimeShell +, mesa # thunderbird wants gbm for drm+dmabuf +, systemLocale ? config.i18n.defaultLocale or "en_US" +, generated +}: + +let + mozillaPlatforms = { + i686-linux = "linux-i686"; + x86_64-linux = "linux-x86_64"; + }; + + policies = { DisableAppUpdate = true; } // config.thunderbird.policies or { }; + policiesJson = writeText "thunderbird-policies.json" (builtins.toJSON { inherit policies; }); + + mozLocale = + if systemLocale == "ca_ES@valencia" + then "ca-valencia" + else lib.replaceStrings ["_"] ["-"] systemLocale; + + version = "112.0b7"; +in +with import {}; + +stdenv.mkDerivation { + pname = "thunderbird-bin"; + inherit version; + + src = fetchurl { + url = "https://download-installer.cdn.mozilla.net/pub/thunderbird/releases/${version}/linux-x86_64/en-US/thunderbird-${version}.tar.bz2"; + }; + + libPath = lib.makeLibraryPath + [ stdenv.cc.cc + alsa-lib + atk + cairo + curl + cups + dbus-glib + dbus + fontconfig + freetype + gdk-pixbuf + glib + glibc + gtk2 + gtk3 + libkrb5 + mesa + libX11 + libXScrnSaver + libXcomposite + libXcursor + libxcb + libXdamage + libXext + libXfixes + libXi + libXinerama + libXrender + libXrandr + libXt + libXtst + libcanberra + libnotify + libGLU libGL + nspr + nss_latest + pango + pipewire + pciutils + heimdal + libpulseaudio + systemd + ffmpeg + ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [ + stdenv.cc.cc + ]; + + inherit gtk3; + + nativeBuildInputs = [ wrapGAppsHook ]; + + buildInputs = [ gtk3 adwaita-icon-theme ]; + + # "strip" after "patchelf" may break binaries. + # See: https://github.com/NixOS/patchelf/issues/10 + dontStrip = true; + dontPatchELF = true; + + patchPhase = '' + # Don't download updates from Mozilla directly + echo 'pref("app.update.auto", "false");' >> defaults/pref/channel-prefs.js + ''; + + # See "Note on GPG support" in `../thunderbird/default.nix` for explanations + # on adding `gnupg` and `gpgme` into PATH/LD_LIBRARY_PATH. + installPhase = + '' + mkdir -p "$prefix/usr/lib/thunderbird-bin-${version}" + cp -r * "$prefix/usr/lib/thunderbird-bin-${version}" + + mkdir -p "$out/bin" + ln -s "$prefix/usr/lib/thunderbird-bin-${version}/thunderbird" "$out/bin/" + + for executable in \ + thunderbird thunderbird-bin plugin-container \ + updater crashreporter webapprt-stub + do + if [ -e "$out/usr/lib/thunderbird-bin-${version}/$executable" ]; then + patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \ + "$out/usr/lib/thunderbird-bin-${version}/$executable" + fi + done + + find . -executable -type f -exec \ + patchelf --set-rpath "$libPath" \ + "$out/usr/lib/thunderbird-bin-${version}/{}" \; + + # wrapThunderbird expects "$out/lib" instead of "$out/usr/lib" + ln -s "$out/usr/lib" "$out/lib" + + gappsWrapperArgs+=(--argv0 "$out/bin/.thunderbird-wrapped") + + # See: https://github.com/mozilla/policy-templates/blob/master/README.md + mkdir -p "$out/lib/thunderbird-bin-${version}/distribution"; + ln -s ${policiesJson} "$out/lib/thunderbird-bin-${version}/distribution/policies.json"; + ''; + + passthru.updateScript = import ./../../browsers/firefox-bin/update.nix { + inherit writeScript xidel coreutils gnused gnugrep curl gnupg runtimeShell; + pname = "thunderbird-bin"; + baseName = "thunderbird"; + channel = "release"; + basePath = "pkgs/applications/networking/mailreaders/thunderbird-bin"; + baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/"; + }; + + meta = with lib; { + changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/"; + description = "Mozilla Thunderbird, a full-featured email client (binary package)"; + homepage = "http://www.mozilla.org/thunderbird/"; + sourceProvenance = with sourceTypes; [ binaryNativeCode ]; + license = licenses.mpl20; + maintainers = with lib.maintainers; [ lovesegfault ]; + platforms = builtins.attrNames mozillaPlatforms; + hydraPlatforms = [ ]; + }; +}