+1 -1

README.md

reviewed

··· 76 76 77 77 ### Run: Nix 78 78 79 79 - For Nix users, a [`flake.nix`](./flake.nix) is included in this repository that provides a package and a NixOS module. Please note that this is maintained on a best-effort basis for now and may be upstreamed by another contributor later. 79 79 + To run Porxie with Nix, you can use the [package](https://search.nixos.org/packages?channel=unstable&query=porxie) or [NixOS module](https://search.nixos.org/options?channel=unstable&query=porxie) provided directly in nixpkgs. 80 80 81 81 ## Policy Service 82 82

+4 -4

flake.lock

reviewed

··· 2 2 "nodes": { 3 3 "nixpkgs": { 4 4 "locked": { 5 5 - "lastModified": 1775823930, 6 6 - "narHash": "sha256-ALT447J7FcxP/97J01A/gp/hgdO5lXRsm+zLMt+gIjc=", 5 5 + "lastModified": 1776255774, 6 6 + "narHash": "sha256-psVTpH6PK3q1htMJpmdz1hLF5pQgEshu7gQWgKO6t6Y=", 7 7 "owner": "nixos", 8 8 "repo": "nixpkgs", 9 9 - "rev": "8c11f88bb9573a10a7d6bf87161ef08455ac70b9", 9 9 + "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a", 10 10 "type": "github" 11 11 }, 12 12 "original": { ··· 24 24 }, 25 25 "root": "root", 26 26 "version": 7 27 27 - } 27 27 + }

+6 -438

flake.nix

reviewed

··· 1 1 { 2 2 - description = "Nix flake for Porxie: an atproto blob proxy"; 2 2 + description = "Porxie, an ATProto blob proxy for secure content delivery"; 3 3 4 4 inputs = { 5 5 nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable"; ··· 11 11 forAllSystems = 12 12 function: 13 13 nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed ( 14 14 - system: (function system nixpkgs.legacyPackages.${system}) 14 14 + system: function system nixpkgs.legacyPackages.${system} 15 15 ); 16 16 in 17 17 { ··· 23 23 cargo 24 24 rustfmt 25 25 clippy 26 26 - bashInteractive 27 26 ]; 28 27 }; 29 28 } ··· 31 30 32 31 packages = forAllSystems ( 33 32 system: pkgs: { 34 34 - porxie = pkgs.callPackage ( 35 35 - { lib, rustPlatform }: 36 36 - let 37 37 - toml = (lib.importTOML ./Cargo.toml).package; 38 38 - in 39 39 - rustPlatform.buildRustPackage { 40 40 - pname = "porxie"; 41 41 - inherit (toml) version; 42 42 - 43 43 - src = lib.fileset.toSource { 44 44 - root = ./.; 45 45 - fileset = lib.fileset.intersection (lib.fileset.fromSource (lib.sources.cleanSource ./.)) ( 46 46 - lib.fileset.unions [ 47 47 - ./Cargo.toml 48 48 - ./Cargo.lock 49 49 - ./src 50 50 - ] 51 51 - ); 52 52 - }; 53 53 - 54 54 - cargoLock.lockFile = ./Cargo.lock; 55 55 - 56 56 - meta = { 57 57 - inherit (toml) homepage description; 58 58 - mainProgram = "porxie"; 59 59 - license = lib.licenses.agpl3Only; 60 60 - maintainers = with lib.maintainers; [ "Blooym" ]; 61 61 - }; 62 62 - } 63 63 - ) { }; 64 64 - 65 65 - default = self.packages.${system}.porxie; 33 33 + porxie = pkgs.lib.warn "using the porxie flake directly is deprecated; use porxie from nixpkgs instead" pkgs.porxie; 34 34 + default = pkgs.lib.warn "using the porxie flake directly is deprecated; use porxie from nixpkgs instead" pkgs.porxie; 66 35 } 67 36 ); 68 37 69 38 nixosModules = { 70 70 - porxie = ( 71 71 - { 72 72 - config, 73 73 - lib, 74 74 - pkgs, 75 75 - ... 76 76 - }: 77 77 - let 78 78 - inherit (lib) types mkOption; 79 79 - cfg = config.services.porxie; 80 80 - in 81 81 - { 82 82 - _class = "nixos"; 83 83 - 84 84 - options.services.porxie = { 85 85 - enable = lib.mkEnableOption "Porxie"; 86 86 - 87 87 - package = mkOption { 88 88 - type = types.package; 89 89 - default = self.packages.${pkgs.stdenv.hostPlatform.system}.porxie; 90 90 - defaultText = lib.literalExpression "self.packages.\${pkgs.stdenv.hostPlatform.system}.porxie"; 91 91 - description = "The Porxie package to use."; 92 92 - }; 93 93 - 94 94 - user = mkOption { 95 95 - type = types.str; 96 96 - default = "porxie"; 97 97 - description = "User that Porxie runs under."; 98 98 - }; 99 99 - 100 100 - group = mkOption { 101 101 - type = types.str; 102 102 - default = "porxie"; 103 103 - description = "Group that Porxie runs under."; 104 104 - }; 105 105 - 106 106 - environmentFiles = mkOption { 107 107 - type = types.listOf types.path; 108 108 - default = [ ]; 109 109 - description = '' 110 110 - Files to load environment variables from. Use for secrets such as 111 111 - {env}`PORXIE_SERVER_AUTH_TOKEN` and {env}`PORXIE_POLICY_REQUEST_HEADERS`. 112 112 - ''; 113 113 - }; 114 114 - 115 115 - settings = mkOption { 116 116 - type = types.submodule { 117 117 - freeformType = types.attrsOf types.str; 118 118 - 119 119 - options = { 120 120 - server = { 121 121 - address = mkOption { 122 122 - type = types.str; 123 123 - default = "ip:127.0.0.1:6314"; 124 124 - description = '' 125 125 - Address to bind the server to. 126 126 - 127 127 - Use the 'ip:' prefix for an IP address (e.g. 'ip:127.0.0.1:6314'), or on 128 128 - UNIX systems, the 'unix:' prefix for a UNIX socket path 129 129 - (e.g. 'unix:/run/porxie.sock'). 130 130 - ''; 131 131 - }; 132 132 - 133 133 - authToken = mkOption { 134 134 - type = types.nullOr types.str; 135 135 - default = null; 136 136 - description = '' 137 137 - Bearer token for authenticating admin requests. 138 138 - 139 139 - When unset, all authenticated endpoints will reject requests with HTTP 401. 140 140 - Should be set via {option}`environmentFiles` rather than directly. 141 141 - ''; 142 142 - }; 143 143 - }; 144 144 - 145 145 - blob = { 146 146 - allowedMimetypes = mkOption { 147 147 - type = types.listOf types.str; 148 148 - default = [ "image/*" ]; 149 149 - description = '' 150 150 - Blob mimetypes that can be served. 151 151 - 152 152 - Validation is done loosely via content inference. Further validation can be 153 153 - done by a layer above this proxy, such as an image transformation service. 154 154 - When inference fails, the blob's type falls back to 155 155 - `application/octet-stream`. When that type is allowed, blobs failing 156 156 - inference can still be served. 157 157 - ''; 158 158 - }; 159 159 - 160 160 - maxSize = mkOption { 161 161 - type = types.str; 162 162 - default = "50mb"; 163 163 - description = '' 164 164 - Maximum blob size that can be fetched and served. 165 165 - 166 166 - Blobs that exceed this limit will return HTTP 413. Setting this too high can 167 167 - exhaust process or system memory. The minimum value is 512kb. 168 168 - ''; 169 169 - }; 170 170 - 171 171 - cacheHeader = mkOption { 172 172 - type = types.str; 173 173 - default = "public, max-age=604800, must-revalidate, immutable"; 174 174 - description = '' 175 175 - The Cache-Control header value to send alongside blob responses. 176 176 - 177 177 - This does not affect internal cache lifetimes, only how downstream clients 178 178 - such as CDNs and browsers are instructed to cache responses. Intermediary 179 179 - caches may need to be cleared manually for changes to take effect quickly. 180 180 - ''; 181 181 - }; 182 182 - 183 183 - processingTimeout = mkOption { 184 184 - type = types.str; 185 185 - default = "1m"; 186 186 - description = '' 187 187 - Maximum duration a blob can be processed by this server before aborting. 188 188 - ''; 189 189 - }; 190 190 - 191 191 - httpTimeout = mkOption { 192 192 - type = types.str; 193 193 - default = "30s"; 194 194 - description = '' 195 195 - Maximum duration before blob fetch requests are timed out. 196 196 - ''; 197 197 - }; 198 198 - 199 199 - httpConnectTimeout = mkOption { 200 200 - type = types.str; 201 201 - default = "10s"; 202 202 - description = '' 203 203 - Maximum duration before an attempted connection to a blob upstream is aborted. 204 204 - 205 205 - This value should be lower than {option}`settings.blob.httpTimeout`. 206 206 - ''; 207 207 - }; 208 208 - }; 209 209 - 210 210 - identity = { 211 211 - plcUrl = mkOption { 212 212 - type = types.str; 213 213 - default = "https://plc.directory"; 214 214 - description = '' 215 215 - URL of the PLC instance used for `did:plc` lookups. 216 216 - 217 217 - Can typically be left as default unless using a custom or local development 218 218 - setup. 219 219 - ''; 220 220 - }; 221 221 - 222 222 - httpTimeout = mkOption { 223 223 - type = types.str; 224 224 - default = "10s"; 225 225 - description = '' 226 226 - Maximum duration before identity resolution requests are timed out. 227 227 - ''; 228 228 - }; 229 229 - 230 230 - httpConnectTimeout = mkOption { 231 231 - type = types.str; 232 232 - default = "8s"; 233 233 - description = '' 234 234 - Maximum duration before a connection attempt to an identity upstream is aborted. 235 235 - 236 236 - This value should be lower than {option}`settings.identity.httpTimeout`. 237 237 - ''; 238 238 - }; 239 239 - }; 240 240 - 241 241 - cache = { 242 242 - allocation = mkOption { 243 243 - type = types.str; 244 244 - default = "512mb"; 245 245 - description = '' 246 246 - Total memory allocation for the internal cache. 247 247 - 248 248 - Blobs are cached using an LFU policy. The most frequently requested blobs 249 249 - are kept longest when the cache approaches its limit. 250 250 - 251 251 - For production deployments, a CDN or caching layer in front of this server 252 252 - is recommended for lower latency and better global availability. 253 253 - 254 254 - Setting this too high can exhaust process or system memory. The minimum 255 255 - value is 8mb. 256 256 - ''; 257 257 - }; 258 258 - 259 259 - blobTti = mkOption { 260 260 - type = types.str; 261 261 - default = "7days"; 262 262 - description = '' 263 263 - How long blobs can be idle in the cache before expiring. 264 264 - ''; 265 265 - }; 266 266 - 267 267 - ownershipTtl = mkOption { 268 268 - type = types.str; 269 269 - default = "1day"; 270 270 - description = '' 271 271 - How long blob ownership can be cached before expiring. 272 272 - ''; 273 273 - }; 274 274 - 275 275 - policyTtl = mkOption { 276 276 - type = types.str; 277 277 - default = "1h"; 278 278 - description = '' 279 279 - How long policy decisions can be cached before expiring. 280 280 - ''; 281 281 - }; 282 282 - 283 283 - identityTtl = mkOption { 284 284 - type = types.str; 285 285 - default = "1h"; 286 286 - description = '' 287 287 - How long identity lookups (DID resolution, etc) can be cached before expiring. 288 288 - ''; 289 289 - }; 290 290 - }; 291 291 - 292 292 - policy = { 293 293 - url = mkOption { 294 294 - type = types.nullOr types.str; 295 295 - default = null; 296 296 - description = '' 297 297 - Policy service URL that DID+CID pairs will be checked against. 298 298 - 299 299 - Requests are sent as HTTP GET <url>/<did>/<cid>. 300 300 - 301 301 - The service is expected to return HTTP 200 (OK) if permitted or HTTP 410 302 302 - (GONE) if restricted. 303 303 - ''; 304 304 - }; 305 305 - 306 306 - requestHeaders = mkOption { 307 307 - type = types.listOf types.str; 308 308 - default = [ ]; 309 309 - description = '' 310 310 - Headers sent alongside all requests to the policy service. 311 311 - 312 312 - Each header must be in the format "Name: value". When setting via 313 313 - environment variable, headers are pipe-separated (|). 314 314 - 315 315 - Should be set via {option}`environmentFiles` for sensitive values such as 316 316 - API keys. 317 317 - ''; 318 318 - }; 319 319 - 320 320 - failOpen = mkOption { 321 321 - type = types.bool; 322 322 - default = false; 323 323 - description = '' 324 324 - Allow requests to proceed if the policy service is unavailable or returns 325 325 - an unexpected status code. 326 326 - 327 327 - Warning: enabling this means restricted blobs may be served when the 328 328 - policy service is unreachable. 329 329 - ''; 330 330 - }; 331 331 - 332 332 - httpTimeout = mkOption { 333 333 - type = types.str; 334 334 - default = "30s"; 335 335 - description = '' 336 336 - Maximum duration before policy service requests are timed out. 337 337 - ''; 338 338 - }; 339 339 - 340 340 - httpConnectTimeout = mkOption { 341 341 - type = types.str; 342 342 - default = "10s"; 343 343 - description = '' 344 344 - Maximum duration before an attempted connection to the policy service is aborted. 345 345 - 346 346 - This value should be lower than {option}`settings.policy.httpTimeout`. 347 347 - ''; 348 348 - }; 349 349 - }; 350 350 - }; 351 351 - }; 352 352 - 353 353 - default = { }; 354 354 - description = '' 355 355 - Configuration for Porxie. Refer to 356 356 - <https://codeberg.org/Blooym/porxie/src/branch/main/README.md#configuration> 357 357 - for further guidance. 358 358 - 359 359 - Secrets such as {option}`settings.server.authToken` should be set via 360 360 - {option}`environmentFiles`. 361 361 - ''; 362 362 - }; 363 363 - }; 364 364 - 365 365 - config = lib.mkIf cfg.enable { 366 366 - users = { 367 367 - users.${cfg.user} = { 368 368 - isSystemUser = true; 369 369 - inherit (cfg) group; 370 370 - }; 371 371 - groups.${cfg.group} = { }; 372 372 - }; 373 373 - 374 374 - systemd.services.porxie = 375 375 - let 376 376 - knownKeys = [ 377 377 - "server" 378 378 - "blob" 379 379 - "identity" 380 380 - "cache" 381 381 - "policy" 382 382 - ]; 383 383 - env = 384 384 - (lib.filterAttrs (k: _: !(builtins.elem k knownKeys)) cfg.settings) 385 385 - // lib.filterAttrs (_: v: v != null) { 386 386 - PORXIE_SERVER_ADDRESS = cfg.settings.server.address; 387 387 - PORXIE_SERVER_AUTH_TOKEN = cfg.settings.server.authToken; 388 388 - PORXIE_BLOB_ALLOWED_MIMETYPES = 389 389 - if cfg.settings.blob.allowedMimetypes != [ ] then 390 390 - lib.concatStringsSep "," cfg.settings.blob.allowedMimetypes 391 391 - else 392 392 - null; 393 393 - PORXIE_BLOB_MAX_SIZE = cfg.settings.blob.maxSize; 394 394 - PORXIE_BLOB_CACHE_HEADER = cfg.settings.blob.cacheHeader; 395 395 - PORXIE_BLOB_PROCESSING_TIMEOUT = cfg.settings.blob.processingTimeout; 396 396 - PORXIE_BLOB_HTTP_TIMEOUT = cfg.settings.blob.httpTimeout; 397 397 - PORXIE_BLOB_HTTP_CONNECT_TIMEOUT = cfg.settings.blob.httpConnectTimeout; 398 398 - PORXIE_IDENTITY_PLC_URL = cfg.settings.identity.plcUrl; 399 399 - PORXIE_IDENTITY_HTTP_TIMEOUT = cfg.settings.identity.httpTimeout; 400 400 - PORXIE_IDENTITY_HTTP_CONNECT_TIMEOUT = cfg.settings.identity.httpConnectTimeout; 401 401 - PORXIE_CACHE_ALLOCATION = cfg.settings.cache.allocation; 402 402 - PORXIE_CACHE_BLOB_TTI = cfg.settings.cache.blobTti; 403 403 - PORXIE_CACHE_OWNERSHIP_TTL = cfg.settings.cache.ownershipTtl; 404 404 - PORXIE_CACHE_POLICY_TTL = cfg.settings.cache.policyTtl; 405 405 - PORXIE_CACHE_IDENTITY_TTL = cfg.settings.cache.identityTtl; 406 406 - PORXIE_POLICY_URL = cfg.settings.policy.url; 407 407 - PORXIE_POLICY_REQUEST_HEADERS = 408 408 - if cfg.settings.policy.requestHeaders != [ ] then 409 409 - lib.concatStringsSep "|" cfg.settings.policy.requestHeaders 410 410 - else 411 411 - null; 412 412 - PORXIE_POLICY_FAIL_OPEN = if cfg.settings.policy.failOpen then "true" else null; 413 413 - PORXIE_POLICY_HTTP_TIMEOUT = cfg.settings.policy.httpTimeout; 414 414 - PORXIE_POLICY_HTTP_CONNECT_TIMEOUT = cfg.settings.policy.httpConnectTimeout; 415 415 - }; 416 416 - in 417 417 - { 418 418 - description = "Porxie atproto blob proxy"; 419 419 - after = [ "network-online.target" ]; 420 420 - wants = [ "network-online.target" ]; 421 421 - wantedBy = [ "multi-user.target" ]; 422 422 - 423 423 - serviceConfig = { 424 424 - User = cfg.user; 425 425 - Group = cfg.group; 426 426 - ExecStart = lib.getExe cfg.package; 427 427 - Environment = lib.mapAttrsToList (k: v: "${k}=${v}") env; 428 428 - EnvironmentFile = cfg.environmentFiles; 429 429 - Restart = "on-failure"; 430 430 - RestartSec = 5; 431 431 - 432 432 - RuntimeDirectory = "porxie"; 433 433 - RuntimeDirectoryMode = "0750"; 434 434 - 435 435 - CapabilityBoundingSet = ""; 436 436 - AmbientCapabilities = ""; 437 437 - NoNewPrivileges = true; 438 438 - ReadOnlyRootFilesystem = true; 439 439 - ProtectSystem = "strict"; 440 440 - ProtectHome = true; 441 441 - PrivateTmp = true; 442 442 - PrivateDevices = true; 443 443 - ProtectKernelTunables = true; 444 444 - ProtectKernelModules = true; 445 445 - ProtectKernelLogs = true; 446 446 - ProtectControlGroups = true; 447 447 - ProtectClock = true; 448 448 - ProtectHostname = true; 449 449 - RestrictSUIDSGID = true; 450 450 - RestrictRealtime = true; 451 451 - RestrictNamespaces = true; 452 452 - RestrictAddressFamilies = [ 453 453 - "AF_INET" 454 454 - "AF_INET6" 455 455 - "AF_UNIX" 456 456 - ]; 457 457 - LockPersonality = true; 458 458 - MemoryDenyWriteExecute = true; 459 459 - RemoveIPC = true; 460 460 - SystemCallArchitectures = "native"; 461 461 - SystemCallFilter = [ 462 462 - "@system-service" 463 463 - "~@privileged" 464 464 - "~@resources" 465 465 - ]; 466 466 - }; 467 467 - }; 468 468 - }; 469 469 - } 470 470 - ); 471 471 - 472 472 - default = self.nixosModules.porxie; 39 39 + porxie = nixpkgs.lib.warn "using the porxie flake directly is deprecated; use porxie from nixpkgs instead" nixpkgs.nixosModules.porxie; 40 40 + default = nixpkgs.lib.warn "using the porxie flake directly is deprecated; use porxie from nixpkgs instead" nixpkgs.nixosModules.porxie; 473 41 }; 474 42 }; 475 43 }