nixos/lasuite-meet: init (#407742)
This commit is contained in:
K900
GitHub
commit
a6900e5833
@ -56,6 +56,8 @@
|
||||
|
||||
- [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).
|
||||
|
||||
- [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).
|
||||
|
||||
## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
|
||||
|
||||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||||
|
||||
@ -1596,6 +1596,7 @@
|
||||
./services/web-apps/komga.nix
|
||||
./services/web-apps/lanraragi.nix
|
||||
./services/web-apps/lasuite-docs.nix
|
||||
./services/web-apps/lasuite-meet.nix
|
||||
./services/web-apps/lemmy.nix
|
||||
./services/web-apps/limesurvey.nix
|
||||
./services/web-apps/mainsail.nix
|
||||
|
||||
449
nixos/modules/services/web-apps/lasuite-meet.nix
Normal file
449
nixos/modules/services/web-apps/lasuite-meet.nix
Normal file
@ -0,0 +1,449 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
utils,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
getExe
|
||||
mapAttrs
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkPackageOption
|
||||
mkOption
|
||||
types
|
||||
optional
|
||||
optionalString
|
||||
;
|
||||
|
||||
cfg = config.services.lasuite-meet;
|
||||
|
||||
pythonEnvironment = mapAttrs (
|
||||
_: value:
|
||||
if value == null then
|
||||
"None"
|
||||
else if value == true then
|
||||
"True"
|
||||
else if value == false then
|
||||
"False"
|
||||
else
|
||||
toString value
|
||||
) cfg.settings;
|
||||
|
||||
commonServiceConfig = {
|
||||
RuntimeDirectory = "lasuite-meet";
|
||||
StateDirectory = "lasuite-meet";
|
||||
WorkingDirectory = "/var/lib/lasuite-meet";
|
||||
|
||||
User = "lasuite-meet";
|
||||
DynamicUser = true;
|
||||
SupplementaryGroups = mkIf cfg.redis.createLocally [
|
||||
config.services.redis.servers.lasuite-meet.group
|
||||
];
|
||||
# hardening
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DevicePolicy = "closed";
|
||||
LockPersonality = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
MemoryDenyWriteExecute = true;
|
||||
EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
|
||||
UMask = "0077";
|
||||
};
|
||||
in
|
||||
{
|
||||
options.services.lasuite-meet = {
|
||||
enable = mkEnableOption "SuiteNumérique Meet";
|
||||
|
||||
backendPackage = mkPackageOption pkgs "lasuite-meet" { };
|
||||
|
||||
frontendPackage = mkPackageOption pkgs "lasuite-meet-frontend" { };
|
||||
|
||||
bind = mkOption {
|
||||
type = types.str;
|
||||
default = "unix:/run/lasuite-meet/gunicorn.sock";
|
||||
example = "127.0.0.1:8000";
|
||||
description = ''
|
||||
The path, host/port or file descriptior to bind the gunicorn socket to.
|
||||
|
||||
See <https://docs.gunicorn.org/en/stable/settings.html#bind> for possible options.
|
||||
'';
|
||||
};
|
||||
|
||||
enableNginx = mkEnableOption "enable and configure Nginx for reverse proxying" // {
|
||||
default = true;
|
||||
};
|
||||
|
||||
secretKeyPath = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
Path to the Django secret key.
|
||||
|
||||
The key can be generated using:
|
||||
```
|
||||
python3 -c 'import secrets; print(secrets.token_hex())'
|
||||
```
|
||||
|
||||
If not set, the secret key will be automatically generated.
|
||||
'';
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
createLocally = mkEnableOption "Configure local PostgreSQL database server for meet";
|
||||
};
|
||||
|
||||
redis = {
|
||||
createLocally = mkEnableOption "Configure local Redis cache server for meet";
|
||||
};
|
||||
|
||||
livekit = {
|
||||
enable = mkEnableOption "Configure local livekit server" // {
|
||||
default = true;
|
||||
};
|
||||
|
||||
openFirewall = mkEnableOption "Open firewall ports for livekit";
|
||||
|
||||
keyFile = mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
LiveKit key file holding one or multiple application secrets.
|
||||
Use `livekit-server generate-keys` to generate a random key name and secret.
|
||||
|
||||
The file should have the YAML format `<keyname>: <secret>`.
|
||||
Example:
|
||||
`lasuite-meet: f6lQGaHtM5HfgZjIcec3cOCRfiDqIine4CpZZnqdT5cE`
|
||||
|
||||
Individual key/secret pairs need to be passed to clients to connect to this instance.
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = types.attrs;
|
||||
default = { };
|
||||
description = ''
|
||||
Settings to pass to the livekit server.
|
||||
|
||||
See `services.livekit.settings` for more details.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
gunicorn = {
|
||||
extraArgs = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [
|
||||
"--name=meet"
|
||||
"--workers=3"
|
||||
];
|
||||
description = ''
|
||||
Extra arguments to pass to the gunicorn process.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
celery = {
|
||||
extraArgs = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = ''
|
||||
Extra arguments to pass to the celery process.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
Domain name of the meet instance.
|
||||
'';
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = types.attrsOf (
|
||||
types.nullOr (
|
||||
types.oneOf [
|
||||
types.str
|
||||
types.bool
|
||||
types.path
|
||||
types.int
|
||||
]
|
||||
)
|
||||
);
|
||||
|
||||
options = {
|
||||
DJANGO_CONFIGURATION = mkOption {
|
||||
type = types.str;
|
||||
internal = true;
|
||||
default = "Production";
|
||||
description = "The configuration that Django will use";
|
||||
};
|
||||
|
||||
DJANGO_SETTINGS_MODULE = mkOption {
|
||||
type = types.str;
|
||||
internal = true;
|
||||
default = "meet.settings";
|
||||
description = "The configuration module that Django will use";
|
||||
};
|
||||
|
||||
DJANGO_SECRET_KEY_FILE = mkOption {
|
||||
type = types.path;
|
||||
default =
|
||||
if cfg.secretKeyPath == null then "/var/lib/lasuite-meet/django_secret_key" else cfg.secretKeyPath;
|
||||
description = "The path to the file containing Django's secret key";
|
||||
};
|
||||
|
||||
DJANGO_DATA_DIR = mkOption {
|
||||
type = types.path;
|
||||
default = "/var/lib/lasuite-meet";
|
||||
description = "Path to the data directory";
|
||||
};
|
||||
|
||||
DJANGO_ALLOWED_HOSTS = mkOption {
|
||||
type = types.str;
|
||||
default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
|
||||
defaultText = lib.literalExpression ''
|
||||
if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
|
||||
'';
|
||||
description = "Comma-separated list of hosts that are able to connect to the server";
|
||||
};
|
||||
|
||||
DB_NAME = mkOption {
|
||||
type = types.str;
|
||||
default = "lasuite-meet";
|
||||
description = "Name of the database";
|
||||
};
|
||||
|
||||
DB_USER = mkOption {
|
||||
type = types.str;
|
||||
default = "lasuite-meet";
|
||||
description = "User of the database";
|
||||
};
|
||||
|
||||
DB_HOST = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = if cfg.postgresql.createLocally then "/run/postgresql" else null;
|
||||
description = "Host of the database";
|
||||
};
|
||||
|
||||
REDIS_URL = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default =
|
||||
if cfg.redis.createLocally then
|
||||
"unix://${config.services.redis.servers.lasuite-meet.unixSocket}?db=0"
|
||||
else
|
||||
null;
|
||||
description = "URL of the redis backend";
|
||||
};
|
||||
|
||||
CELERY_BROKER_URL = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default =
|
||||
if cfg.redis.createLocally then
|
||||
"redis+socket://${config.services.redis.servers.lasuite-meet.unixSocket}?db=1"
|
||||
else
|
||||
null;
|
||||
description = "URL of the redis backend for celery";
|
||||
};
|
||||
|
||||
LIVEKIT_API_URL = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = if cfg.enableNginx && cfg.livekit.enable then "http://${cfg.domain}/livekit" else null;
|
||||
defaultText = lib.literalExpression ''
|
||||
if cfg.enableNginx && cfg.livekit.enable then
|
||||
"http://$${cfg.domain}/livekit"
|
||||
else
|
||||
null
|
||||
'';
|
||||
description = "URL to the livekit server";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
default = { };
|
||||
example = ''
|
||||
{
|
||||
DJANGO_ALLOWED_HOSTS = "*";
|
||||
}
|
||||
'';
|
||||
description = ''
|
||||
Configuration options of meet.
|
||||
See https://github.com/suitenumerique/meet/blob/v${cfg.backendPackage.version}/docs/env.md
|
||||
`REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-meet.redis.createLocally` is true.
|
||||
`DB_NAME` `DB_USER` and `DB_HOST` are set if `services.lasuite-meet.postgresql.createLocally` is true.
|
||||
'';
|
||||
};
|
||||
|
||||
environmentFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
Path to environment file.
|
||||
|
||||
This can be useful to pass secrets to meet via tools like `agenix` or `sops`.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.lasuite-meet = {
|
||||
description = "Meet from SuiteNumérique";
|
||||
after =
|
||||
[ "network.target" ]
|
||||
++ (optional cfg.postgresql.createLocally "postgresql.service")
|
||||
++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
|
||||
|
||||
wants =
|
||||
(optional cfg.postgresql.createLocally "postgresql.service")
|
||||
++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
preStart = ''
|
||||
ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-meet/static
|
||||
|
||||
if [ ! -f .version ]; then
|
||||
touch .version
|
||||
fi
|
||||
|
||||
if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
|
||||
${getExe cfg.backendPackage} migrate
|
||||
echo -n "${cfg.backendPackage.version}" > .version
|
||||
fi
|
||||
${optionalString (cfg.secretKeyPath == null) ''
|
||||
if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
|
||||
(
|
||||
umask 0377
|
||||
tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
|
||||
)
|
||||
fi
|
||||
''}
|
||||
'';
|
||||
|
||||
environment = pythonEnvironment;
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = utils.escapeSystemdExecArgs (
|
||||
[
|
||||
(lib.getExe' cfg.backendPackage "gunicorn")
|
||||
"--bind=${cfg.bind}"
|
||||
]
|
||||
++ cfg.gunicorn.extraArgs
|
||||
++ [ "meet.wsgi:application" ]
|
||||
);
|
||||
} // commonServiceConfig;
|
||||
};
|
||||
|
||||
systemd.services.lasuite-meet-celery = {
|
||||
description = "Meet Celery broker from SuiteNumérique";
|
||||
after =
|
||||
[ "network.target" ]
|
||||
++ (optional cfg.postgresql.createLocally "postgresql.service")
|
||||
++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
|
||||
|
||||
wants =
|
||||
(optional cfg.postgresql.createLocally "postgresql.service")
|
||||
++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
environment = pythonEnvironment;
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = utils.escapeSystemdExecArgs (
|
||||
[ (lib.getExe' cfg.backendPackage "celery") ]
|
||||
++ cfg.celery.extraArgs
|
||||
++ [
|
||||
"--app=meet.celery_app"
|
||||
"worker"
|
||||
]
|
||||
);
|
||||
} // commonServiceConfig;
|
||||
};
|
||||
|
||||
services.postgresql = mkIf cfg.postgresql.createLocally {
|
||||
enable = true;
|
||||
ensureDatabases = [ "lasuite-meet" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "lasuite-meet";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.redis.servers.lasuite-meet = mkIf cfg.redis.createLocally { enable = true; };
|
||||
|
||||
services.livekit = mkIf cfg.livekit.enable {
|
||||
inherit (cfg.livekit)
|
||||
enable
|
||||
settings
|
||||
keyFile
|
||||
openFirewall
|
||||
;
|
||||
};
|
||||
|
||||
services.nginx = mkIf cfg.enableNginx {
|
||||
enable = true;
|
||||
|
||||
virtualHosts.${cfg.domain} = {
|
||||
root = cfg.frontendPackage;
|
||||
|
||||
extraConfig = ''
|
||||
error_page 404 = /index.html;
|
||||
'';
|
||||
|
||||
locations."/api" = {
|
||||
proxyPass = "http://${cfg.bind}";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
|
||||
locations."/admin" = {
|
||||
proxyPass = "http://${cfg.bind}";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
|
||||
locations."/livekit" = mkIf cfg.livekit.enable {
|
||||
proxyPass = "http://localhost:${toString config.services.livekit.settings.port}";
|
||||
recommendedProxySettings = true;
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
rewrite ^/livekit/(.*)$ /$1 break;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
meta = {
|
||||
buildDocsInSandbox = false;
|
||||
maintainers = [ lib.maintainers.soyouzpanda ];
|
||||
};
|
||||
}
|
||||
@ -771,6 +771,7 @@ in
|
||||
_module.args.latestKernel = true;
|
||||
};
|
||||
lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
|
||||
lasuite-meet = runTest ./web-apps/lasuite-meet.nix;
|
||||
lavalink = runTest ./lavalink.nix;
|
||||
leaps = runTest ./leaps.nix;
|
||||
lemmy = runTest ./lemmy.nix;
|
||||
|
||||
141
nixos/tests/web-apps/lasuite-meet.nix
Normal file
141
nixos/tests/web-apps/lasuite-meet.nix
Normal file
@ -0,0 +1,141 @@
|
||||
{ lib, ... }:
|
||||
let
|
||||
domain = "meet.local";
|
||||
oidcDomain = "127.0.0.1:8080";
|
||||
in
|
||||
|
||||
{
|
||||
name = "lasuite-meet";
|
||||
meta.maintainers = with lib.maintainers; [ soyouzpanda ];
|
||||
|
||||
nodes.machine =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
virtualisation.memorySize = 4 * 1024;
|
||||
|
||||
networking.hosts."127.0.0.1" = [ domain ];
|
||||
|
||||
environment.systemPackages = with pkgs; [ jq ];
|
||||
|
||||
services.lasuite-meet = {
|
||||
enable = true;
|
||||
enableNginx = true;
|
||||
livekit = {
|
||||
enable = true;
|
||||
keyFile = pkgs.writeText "lasuite-meet-livekit-keys" ''
|
||||
lasuite-meet: ca50qKzxEXVIu61wHshAyJNzlWw8vlIwUuzxQbUK1rG
|
||||
'';
|
||||
};
|
||||
redis.createLocally = true;
|
||||
postgresql.createLocally = true;
|
||||
|
||||
inherit domain;
|
||||
|
||||
settings = {
|
||||
DJANGO_SECRET_KEY_FILE = pkgs.writeText "django-secret-file" ''
|
||||
8540db59c03943d48c3ed1a0f96ce3b560e0f45274f120f7ee4dace3cc366a6b
|
||||
'';
|
||||
|
||||
OIDC_OP_JWKS_ENDPOINT = "http://${oidcDomain}/dex/keys";
|
||||
OIDC_OP_AUTHORIZATION_ENDPOINT = "http://${oidcDomain}/dex/auth/mock";
|
||||
OIDC_OP_TOKEN_ENDPOINT = "http://${oidcDomain}/dex/token";
|
||||
OIDC_OP_USER_ENDPOINT = "http://${oidcDomain}/dex/userinfo";
|
||||
OIDC_RP_CLIENT_ID = "lasuite-meet";
|
||||
OIDC_RP_SIGN_ALGO = "RS256";
|
||||
OIDC_RP_SCOPES = "openid email";
|
||||
OIDC_RP_CLIENT_SECRET = "lasuitemeetclientsecret";
|
||||
|
||||
LOGIN_REDIRECT_URL = "http://${domain}";
|
||||
LOGIN_REDIRECT_URL_FAILURE = "http://${domain}";
|
||||
LOGOUT_REDIRECT_URL = "http://${domain}";
|
||||
|
||||
LIVEKIT_API_KEY = "lasuite-meet";
|
||||
LIVEKIT_API_SECRET = "ca50qKzxEXVIu61wHshAyJNzlWw8vlIwUuzxQbUK1rG";
|
||||
|
||||
# Disable HTTPS feature in tests because we're running on a HTTP connection
|
||||
DJANGO_SECURE_PROXY_SSL_HEADER = "";
|
||||
DJANGO_SECURE_SSL_REDIRECT = false;
|
||||
DJANGO_CSRF_COOKIE_SECURE = false;
|
||||
DJANGO_SESSION_COOKIE_SECURE = false;
|
||||
DJANGO_CSRF_TRUSTED_ORIGINS = "http://*";
|
||||
};
|
||||
};
|
||||
|
||||
services.dex = {
|
||||
enable = true;
|
||||
settings = {
|
||||
issuer = "http://${oidcDomain}/dex";
|
||||
storage = {
|
||||
type = "postgres";
|
||||
config.host = "/var/run/postgresql";
|
||||
};
|
||||
web.http = "127.0.0.1:8080";
|
||||
oauth2.skipApprovalScreen = true;
|
||||
staticClients = [
|
||||
{
|
||||
id = "lasuite-meet";
|
||||
name = "Meet";
|
||||
redirectURIs = [ "http://${domain}/api/v1.0/callback/" ];
|
||||
secretFile = "/etc/dex/lasuite-meet";
|
||||
}
|
||||
];
|
||||
connectors = [
|
||||
{
|
||||
type = "mockPassword";
|
||||
id = "mock";
|
||||
name = "Example";
|
||||
config = {
|
||||
username = "admin";
|
||||
password = "password";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.etc."dex/lasuite-meet" = {
|
||||
mode = "0400";
|
||||
user = "dex";
|
||||
text = "lasuitemeetclientsecret";
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "dex" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "dex";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
with subtest("Wait for units to start"):
|
||||
machine.wait_for_unit("dex.service")
|
||||
machine.wait_for_unit("lasuite-meet.service")
|
||||
machine.wait_for_unit("lasuite-meet-celery.service")
|
||||
|
||||
with subtest("Wait for web servers to start"):
|
||||
machine.wait_until_succeeds("curl -fs 'http://${domain}/api/v1.0/authenticate/'", timeout=120)
|
||||
machine.wait_until_succeeds("curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-meet&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid'", timeout=120)
|
||||
|
||||
with subtest("Login"):
|
||||
state, nonce = machine.succeed("curl -fs -c cjar 'http://${domain}/api/v1.0/authenticate/' -w '%{redirect_url}' | sed -n 's/.*state=\\(.*\\)&nonce=\\(.*\\)/\\1 \\2/p'").strip().split(' ')
|
||||
|
||||
oidc_state = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-meet&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid+email&state={state}&nonce={nonce}' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
|
||||
|
||||
code = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock/login?back=&state={oidc_state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'").strip()
|
||||
print(f"Got approval code {code}")
|
||||
|
||||
machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/callback/?code={code}&state={state}'")
|
||||
|
||||
with subtest("Create a room"):
|
||||
csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
|
||||
|
||||
room_id = machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/rooms/' -X POST -H 'Content-Type: application/json' -H 'X-CSRFToken: {csrf_token}' -H 'Referer: http://${domain}' -d '{{\"name\": \"aaa-bbbb-ccc\"}}' | jq .id -r").strip()
|
||||
|
||||
print(f"Created room with id {room_id}")
|
||||
'';
|
||||
}
|
||||
51
pkgs/by-name/la/lasuite-meet-frontend/package.nix
Normal file
51
pkgs/by-name/la/lasuite-meet-frontend/package.nix
Normal file
@ -0,0 +1,51 @@
|
||||
{
|
||||
lib,
|
||||
fetchFromGitHub,
|
||||
fetchNpmDeps,
|
||||
buildNpmPackage,
|
||||
}:
|
||||
|
||||
buildNpmPackage rec {
|
||||
pname = "lasuite-meet-frontend";
|
||||
version = "0.1.27";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "suitenumerique";
|
||||
repo = "meet";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
|
||||
};
|
||||
|
||||
sourceRoot = "source/src/frontend";
|
||||
|
||||
npmDeps = fetchNpmDeps {
|
||||
inherit version src;
|
||||
sourceRoot = "source/src/frontend";
|
||||
hash = "sha256-7wXzcn6aGAkRUOCI6MU0AlPGngBWJtdbAfnZZDaMWec=";
|
||||
};
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
|
||||
npm run build
|
||||
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
cp -r dist $out
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "Open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React";
|
||||
homepage = "https://github.com/suitenumerique/meet";
|
||||
changelog = "https://github.com/suitenumerique/meet/blob/${src.tag}/CHANGELOG.md";
|
||||
license = lib.licenses.mit;
|
||||
maintainers = with lib.maintainers; [ soyouzpanda ];
|
||||
platforms = lib.platforms.all;
|
||||
};
|
||||
}
|
||||
113
pkgs/by-name/la/lasuite-meet/package.nix
Normal file
113
pkgs/by-name/la/lasuite-meet/package.nix
Normal file
@ -0,0 +1,113 @@
|
||||
{
|
||||
lib,
|
||||
python3,
|
||||
fetchFromGitHub,
|
||||
nixosTests,
|
||||
}:
|
||||
let
|
||||
python = python3.override {
|
||||
self = python3;
|
||||
packageOverrides = (self: super: { django = super.django_5_2; });
|
||||
};
|
||||
in
|
||||
|
||||
python.pkgs.buildPythonApplication rec {
|
||||
pname = "lasuite-meet";
|
||||
version = "0.1.27";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "suitenumerique";
|
||||
repo = "meet";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
|
||||
};
|
||||
|
||||
sourceRoot = "source/src/backend";
|
||||
|
||||
patches = [
|
||||
# Support configuration throught environment variables for SECURE_*
|
||||
./secure_settings.patch
|
||||
];
|
||||
|
||||
build-system = with python.pkgs; [ setuptools ];
|
||||
|
||||
dependencies = with python.pkgs; [
|
||||
aiohttp
|
||||
boto3
|
||||
brevo-python
|
||||
brotli
|
||||
celery
|
||||
django
|
||||
django-configurations
|
||||
django-cors-headers
|
||||
django-countries
|
||||
django-extensions
|
||||
django-lasuite
|
||||
django-parler
|
||||
django-redis
|
||||
django-storages
|
||||
django-timezone-field
|
||||
djangorestframework
|
||||
dockerflow
|
||||
drf-spectacular
|
||||
drf-spectacular-sidecar
|
||||
easy-thumbnails
|
||||
factory-boy
|
||||
gunicorn
|
||||
jsonschema
|
||||
june-analytics-python
|
||||
livekit-api
|
||||
markdown
|
||||
mozilla-django-oidc
|
||||
nested-multipart-parser
|
||||
psycopg
|
||||
pyjwt
|
||||
pyopenssl
|
||||
python-frontmatter
|
||||
redis
|
||||
requests
|
||||
sentry-sdk
|
||||
whitenoise
|
||||
];
|
||||
|
||||
pythonRelaxDeps = true;
|
||||
|
||||
postBuild = ''
|
||||
export DJANGO_DATA_DIR=$(pwd)/data
|
||||
${python.pythonOnBuildForHost.interpreter} manage.py collectstatic --noinput --clear
|
||||
'';
|
||||
|
||||
postInstall =
|
||||
let
|
||||
pythonPath = python.pkgs.makePythonPath dependencies;
|
||||
in
|
||||
''
|
||||
mkdir -p $out/{bin,share}
|
||||
|
||||
cp ./manage.py $out/bin/.manage.py
|
||||
cp -r data/static $out/share
|
||||
chmod +x $out/bin/.manage.py
|
||||
|
||||
makeWrapper $out/bin/.manage.py $out/bin/meet \
|
||||
--prefix PYTHONPATH : "${pythonPath}"
|
||||
makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
|
||||
--prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
|
||||
makeWrapper ${lib.getExe python.pkgs.gunicorn} $out/bin/gunicorn \
|
||||
--prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
|
||||
'';
|
||||
|
||||
passthru.tests = {
|
||||
login-and-create-room = nixosTests.lasuite-meet;
|
||||
};
|
||||
|
||||
meta = {
|
||||
description = "Open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React";
|
||||
homepage = "https://github.com/suitenumerique/meet";
|
||||
changelog = "https://github.com/suitenumerique/meet/blob/${src.tag}/CHANGELOG.md";
|
||||
license = lib.licenses.mit;
|
||||
maintainers = with lib.maintainers; [ soyouzpanda ];
|
||||
mainProgram = "meet";
|
||||
platforms = lib.platforms.all;
|
||||
};
|
||||
}
|
||||
52
pkgs/by-name/la/lasuite-meet/secure_settings.patch
Normal file
52
pkgs/by-name/la/lasuite-meet/secure_settings.patch
Normal file
@ -0,0 +1,52 @@
|
||||
From d7bbf24df5eecb61caebdf55b0d26da60a9d9609 Mon Sep 17 00:00:00 2001
|
||||
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
|
||||
Date: Fri, 16 May 2025 23:41:12 +0200
|
||||
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=A7(backend)=20allow=20SECURE=20en?=
|
||||
=?UTF-8?q?vironment=20variables=20to=20be=20configured?=
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
---
|
||||
meet/settings.py | 19 ++++++++++++-------
|
||||
1 file changed, 12 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/meet/settings.py b/meet/settings.py
|
||||
index ebb0837..9c67986 100755
|
||||
--- a/meet/settings.py
|
||||
+++ b/meet/settings.py
|
||||
@@ -755,19 +755,24 @@ class Production(Base):
|
||||
# - Your proxy sets the X-Forwarded-Proto header and sends it to Django
|
||||
#
|
||||
# In other cases, you should comment the following line to avoid security issues.
|
||||
- SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
|
||||
- SECURE_HSTS_SECONDS = 60
|
||||
- SECURE_HSTS_PRELOAD = True
|
||||
- SECURE_HSTS_INCLUDE_SUBDOMAINS = True
|
||||
- SECURE_SSL_REDIRECT = True
|
||||
+ SECURE_PROXY_SSL_HEADER = values.TupleValue(("HTTP_X_FORWARDED_PROTO", "https"),
|
||||
+ environ_name="SECURE_PROXY_SSL_HEADER")
|
||||
+ SECURE_HSTS_SECONDS = values.IntegerValue(
|
||||
+ 60, environ_name="SECURE_HSTS_SECONDS")
|
||||
+ SECURE_HSTS_PRELOAD = values.BooleanValue(
|
||||
+ True, environ_name="SECURE_HSTS_PRELOAD")
|
||||
+ SECURE_HSTS_INCLUDE_SUBDOMAINS = values.BooleanValue(
|
||||
+ True, environ_name="SECURE_HSTS_INCLUDE_SUBDOMAINS")
|
||||
+ SECURE_SSL_REDIRECT = values.BooleanValue(
|
||||
+ True, environ_name="SECURE_SSL_REDIRECT")
|
||||
SECURE_REDIRECT_EXEMPT = [
|
||||
"^__lbheartbeat__",
|
||||
"^__heartbeat__",
|
||||
]
|
||||
|
||||
# Modern browsers require to have the `secure` attribute on cookies with `Samesite=none`
|
||||
- CSRF_COOKIE_SECURE = True
|
||||
- SESSION_COOKIE_SECURE = True
|
||||
+ CSRF_COOKIE_SECURE = values.BooleanValue(True, environ_name="CSRF_COOKIE_SECURE")
|
||||
+ SESSION_COOKIE_SECURE = values.BooleanValue(True, environ_name="SESSION_COOKIE_SECURE")
|
||||
|
||||
# Privacy
|
||||
SECURE_REFERRER_POLICY = "same-origin"
|
||||
--
|
||||
2.47.2
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user