tandoor-recipes: init at 1.4.1

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -194,6 +194,13 @@
           <link linkend="opt-services.komga.enable">services.komga</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://tandoor.dev">Tandoor Recipes</link>,
+          a self-hosted multi-tenant recipe collection. Available as
+          <link xlink:href="options.html#opt-services.tandoor-recipes.enable">services.tandoor-recipes</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://hbase.apache.org/">HBase

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -72,6 +72,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [Komga](https://komga.org/), a free and open source comics/mangas media server. Available as [services.komga](#opt-services.komga.enable).
 
+- [Tandoor Recipes](https://tandoor.dev), a self-hosted multi-tenant recipe collection. Available as [services.tandoor-recipes](options.html#opt-services.tandoor-recipes.enable).
+
 - [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable).
 
 - [Sachet](https://github.com/messagebird/sachet/), an SMS alerting tool for the Prometheus Alertmanager. Available as [services.prometheus.sachet](#opt-services.prometheus.sachet.enable).

nixos/modules/module-list.nix

@@ -653,6 +653,7 @@
   ./services/misc/svnserve.nix
   ./services/misc/synergy.nix
   ./services/misc/sysprof.nix
+  ./services/misc/tandoor-recipes.nix
   ./services/misc/taskserver
   ./services/misc/tiddlywiki.nix
   ./services/misc/tp-auto-kbbl.nix

nixos/modules/services/misc/tandoor-recipes.nix

@@ -0,0 +1,144 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  cfg = config.services.tandoor-recipes;
+  pkg = cfg.package;
+
+  # SECRET_KEY through an env file
+  env = {
+    GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
+    DEBUG = "0";
+    MEDIA_ROOT = "/var/lib/tandoor-recipes";
+  } // optionalAttrs (config.time.timeZone != null) {
+    TIMEZONE = config.time.timeZone;
+  } // (
+    lib.mapAttrs (_: toString) cfg.extraConfig
+  );
+
+  manage =
+    let
+      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
+    in
+    pkgs.writeShellScript "manage" ''
+      ${setupEnv}
+      exec ${pkg}/bin/tandoor-recipes "$@"
+    '';
+in
+{
+  meta.maintainers = with maintainers; [ ambroisie ];
+
+  options.services.tandoor-recipes = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Enable Tandoor Recipes.
+
+        When started, the Tandoor Recipes database is automatically created if
+        it doesn't exist and updated if the package has changed. Both tasks are
+        achieved by running a Django migration.
+
+        A script to manage the instance (by wrapping Django's manage.py) is linked to
+        `/var/lib/tandoor-recipes/tandoor-recipes-manage`.
+      '';
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = lib.mdDoc "Web interface address.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      description = lib.mdDoc "Web interface port.";
+    };
+
+    extraConfig = mkOption {
+      type = types.attrs;
+      default = { };
+      description = lib.mdDoc ''
+        Extra tandoor recipes config options.
+
+        See [the example dot-env file](https://raw.githubusercontent.com/vabene1111/recipes/master/.env.template)
+        for available options.
+      '';
+      example = {
+        ENABLE_SIGNUP = "1";
+      };
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.tandoor-recipes;
+      defaultText = literalExpression "pkgs.tandoor-recipes";
+      description = lib.mdDoc "The Tandoor Recipes package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.tandoor-recipes = {
+      description = "Tandoor Recipes server";
+
+      serviceConfig = {
+        ExecStart = ''
+          ${pkg.python.pkgs.gunicorn}/bin/gunicorn recipes.wsgi
+        '';
+        Restart = "on-failure";
+
+        User = "tandoor_recipes";
+        DynamicUser = true;
+        StateDirectory = "tandoor-recipes";
+        WorkingDirectory = "/var/lib/tandoor-recipes";
+        RuntimeDirectory = "tandoor-recipes";
+
+        BindReadOnlyPaths = [
+          "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+          builtins.storeDir
+          "-/etc/resolv.conf"
+          "-/etc/nsswitch.conf"
+          "-/etc/hosts"
+          "-/etc/localtime"
+          "-/run/postgresql"
+        ];
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        # gunicorn needs setuid
+        SystemCallFilter = [ "@system-service" "~@privileged" "@resources" "@setuid" "@keyring" ];
+        UMask = "0066";
+      } // lib.optionalAttrs (cfg.port < 1024) {
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      };
+
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        ln -sf ${manage} tandoor-recipes-manage
+
+        # Let django migrate the DB as needed
+        ${pkg}/bin/tandoor-recipes migrate
+      '';
+
+      environment = env // {
+        PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/tandoor-recipes";
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -611,6 +611,7 @@ in {
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
+  tandoor-recipes = handleTest ./tandoor-recipes.nix {};
   taskserver = handleTest ./taskserver.nix {};
   teeworlds = handleTest ./teeworlds.nix {};
   telegraf = handleTest ./telegraf.nix {};

nixos/tests/tandoor-recipes.nix

@@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "tandoor-recipes";
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
+
+  nodes.machine = { pkgs, ... }: {
+    # Setup using Postgres
+    services.tandoor-recipes = {
+      enable = true;
+
+      extraConfig = {
+        DB_ENGINE = "django.db.backends.postgresql";
+        POSTGRES_HOST = "/run/postgresql";
+        POSTGRES_USER = "tandoor_recipes";
+        POSTGRES_DB = "tandoor_recipes";
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "tandoor_recipes" ];
+      ensureUsers = [
+        {
+          name = "tandoor_recipes";
+          ensurePermissions."DATABASE tandoor_recipes" = "ALL PRIVILEGES";
+        }
+      ];
+    };
+
+    systemd.services = {
+      tandoor-recipes = {
+        after = [ "postgresql.service" ];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("tandoor-recipes.service")
+
+    with subtest("Web interface gets ready"):
+        # Wait until server accepts connections
+        machine.wait_until_succeeds("curl -fs localhost:8080")
+  '';
+})

pkgs/applications/misc/tandoor-recipes/common.nix

@@ -0,0 +1,19 @@
+{ lib, fetchFromGitHub }:
+rec {
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "TandoorRecipes";
+    repo = "recipes";
+    rev = version;
+    sha256 = "sha256-Q/IwjSByCUXVYxhk3U7oWvlMxrJxyajhpsRyq67PVHY=";
+  };
+
+  yarnSha256 = "sha256-gH0q3pJ2BC5pAU9KSo3C9DDRUnpypoyLOEqKSrkxYrk=";
+
+  meta = with lib; {
+    homepage = "https://tandoor.dev/";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}

pkgs/applications/misc/tandoor-recipes/default.nix

@@ -0,0 +1,140 @@
+{ callPackage
+, nixosTests
+, python3
+}:
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      django = super.django_4;
+
+      # Tests are incompatible with Django 4
+      django-js-reverse = super.django-js-reverse.overridePythonAttrs (_: {
+        doCheck = false;
+      });
+    };
+  };
+
+  common = callPackage ./common.nix { };
+
+  frontend = callPackage ./frontend.nix { };
+in
+python.pkgs.pythonPackages.buildPythonPackage rec {
+  pname = "tandoor-recipes";
+
+  inherit (common) version src;
+
+  format = "other";
+
+  patches = [
+    # Allow setting MEDIA_ROOT through environment variable
+    ./media-root.patch
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    beautifulsoup4
+    bleach
+    bleach-allowlist
+    boto3
+    cryptography
+    django
+    django-allauth
+    django-annoying
+    django-auth-ldap
+    django-autocomplete-light
+    django-cleanup
+    django-cors-headers
+    django-crispy-forms
+    django-hcaptcha
+    django-js-reverse
+    django-oauth-toolkit
+    django-prometheus
+    django-scopes
+    django-storages
+    django-tables2
+    django-webpack-loader
+    django_treebeard
+    djangorestframework
+    drf-writable-nested
+    gunicorn
+    icalendar
+    jinja2
+    lxml
+    markdown
+    microdata
+    pillow
+    psycopg2
+    pyppeteer
+    python-dotenv
+    pytube
+    pyyaml
+    recipe-scrapers
+    requests
+    six
+    uritemplate
+    validators
+    webdavclient3
+    whitenoise
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    ln -sf ${frontend}/ cookbook/static/vue
+    cp ${frontend}/webpack-stats.json vue/
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Avoid dependency on django debug toolbar
+    export DEBUG=0
+
+    # See https://github.com/TandoorRecipes/recipes/issues/2043
+    mkdir cookbook/static/themes/maps/
+    touch cookbook/static/themes/maps/style.min.css.map
+    touch cookbook/static/themes/bootstrap.min.css.map
+    touch cookbook/static/css/bootstrap-vue.min.css.map
+
+    ${python.pythonForBuild.interpreter} manage.py collectstatic_js_reverse
+    ${python.pythonForBuild.interpreter} manage.py collectstatic
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cp -r . $out/lib/tandoor-recipes
+    chmod +x $out/lib/tandoor-recipes/manage.py
+    makeWrapper $out/lib/tandoor-recipes/manage.py $out/bin/tandoor-recipes \
+      --prefix PYTHONPATH : "$PYTHONPATH"
+
+    runHook postInstall
+  '';
+
+  checkInputs = with python.pkgs; [
+    pytestCheckHook
+    pytest-django
+    pytest-factoryboy
+  ];
+
+  passthru = {
+    inherit frontend python;
+
+    updateScript = ./update.sh;
+
+    tests = {
+      inherit (nixosTests) tandoor-recipes;
+    };
+  };
+
+  meta = common.meta // {
+    description = ''
+      Application for managing recipes, planning meals, building shopping lists
+      and much much more!
+    '';
+  };
+}