2024-11-22 12:52:18 +00:00
|
|
|
import ./make-test-python.nix (
|
|
|
|
{ lib, ... }:
|
|
|
|
{
|
2021-05-21 21:15:23 +00:00
|
|
|
name = "plausible";
|
2024-11-22 12:52:18 +00:00
|
|
|
meta = {
|
|
|
|
maintainers = lib.teams.cyberus.members;
|
2021-05-21 21:15:23 +00:00
|
|
|
};
|
|
|
|
|
2022-03-20 23:15:30 +00:00
|
|
|
nodes.machine =
|
|
|
|
{ pkgs, ... }:
|
|
|
|
{
|
2021-05-21 21:15:23 +00:00
|
|
|
virtualisation.memorySize = 4096;
|
|
|
|
services.plausible = {
|
|
|
|
enable = true;
|
|
|
|
server = {
|
|
|
|
baseUrl = "http://localhost:8000";
|
|
|
|
secretKeybaseFile = "${pkgs.writeText "dont-try-this-at-home" "nannannannannannannannannannannannannannannannannannannan_batman!"}";
|
2024-12-10 19:26:33 +00:00
|
|
|
};
|
|
|
|
};
|
2021-05-21 21:15:23 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
testScript = ''
|
|
|
|
start_all()
|
|
|
|
machine.wait_for_unit("plausible.service")
|
|
|
|
machine.wait_for_open_port(8000)
|
|
|
|
|
plausible, nixos/plausible: Add `listenAddress` option.
This changes
* the plausible HTTP web server
to be listening on localhost only, explicitly.
This makes Plausible have an explicit safe default configuration,
like all other networked services in NixOS.
For background discussion, see: https://github.com/NixOS/nixpkgs/issues/130244
As per my upstream Plausible contribution
(https://github.com/plausible/analytics/pull/1190)
Plausible >= 1.5 also defaults to listening to localhost only;
nevertheless, this default should be stated explicitly in nixpkgs
for easier review and independence from upstream changes, and
a NixOS user must be able to configure the
`listenAddress`, as there are valid use cases for that.
Also, disable
* the Erlang Beam VM inter-node RPC port
* the Erlang EPMD port
because Plausible does not use them (see added comment).
This is done by setting `RELEASE_DISTRIBUTION=none`.
Thus, this commit also removes the NixOS setting `releaseCookiePath`,
because it now has no effect.
2022-01-13 03:21:32 +00:00
|
|
|
# Ensure that the software does not make not make the machine
|
|
|
|
# listen on any public interfaces by default.
|
|
|
|
machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
|
|
|
|
|
2021-05-21 21:15:23 +00:00
|
|
|
machine.succeed("curl -f localhost:8000 >&2")
|
|
|
|
|
2023-09-20 01:42:16 +00:00
|
|
|
machine.succeed("curl -f localhost:8000/js/script.js >&2")
|
2021-05-21 21:15:23 +00:00
|
|
|
'';
|
|
|
|
}
|
|
|
|
)
|