services.bonfire: init

[ju1m]

This PR introduces services.bonfire with a relevant example and test.

State

It works, but it can still be improved. See inlined comments.

$ nom build .#checks.x86_64-linux.projects/Bonfire/nixos/tests/basic
[…]
vm-test-run-Bonfire> machine # [*] Waiting user creation page
vm-test-run-Bonfire> machine: (finished: must succeed: PYTHONUNBUFFERED=1 selenium-test, in 10.04 seconds)
vm-test-run-Bonfire> (finished: run the VM test script, in 55.29 seconds)
vm-test-run-Bonfire> test script finished in 55.33s
vm-test-run-Bonfire> cleanup
vm-test-run-Bonfire> kill machine (pid 11)
vm-test-run-Bonfire> qemu-system-x86_64: terminating on signal 15 from pid 8 (/nix/store/cfapjd2rvqrpry4grb0kljnp8bvnvfxz-python3-3.13.8/bin/python3.13)
vm-test-run-Bonfire> kill vlan (pid 9)
vm-test-run-Bonfire> (finished: cleanup, in 0.00 seconds)
┏━ Dependency Graph:
┃ ✔ vm-test-run-Bonfire ⏱ 55s
┣━━━ Builds
┗━ ∑ ⏵ 0 │ ✔ 1 │ ⏸ 0 │ Finished at 05:45:34 after 58s

RoadMap

• Using a Unix socket for the reverse proxy is not working well. See inline comments.
  Related but not blocking: security/confidentiality: pinned ranch is too old to support Unix socket permissions bonfire-networks/bonfire-app#1667
• Hardening, at least a basic one.
• Test with meilisearch
• Test with postfix

Related

• Closes Implement project metadata for Bonfire #1765
• Includes pkgs(bonfire): init at 1.0.1-beta.11 #1812 for pkgs.bonfire.
  Relevant commits will be synced with that PR, or dropped whenever it's merged.
• Closes bonfire: Implement a NixOS module for service #1858
• Closes bonfire: Implement NixOS VM test for example #1859

Pings

• @Chickensoupwithrice, who has written NGI Project: Bonfire projects#7 (comment)
• @ivanminutillo, who has written upstream's flake.nix
• @fishinthecalculator, who has written bonfire-nix and bonfire-guix
• @happysalada who has written Add initial deployment process for nix bonfire-networks/bonfire-app#97

[fishinthecalculator]

awesome stuff! I have only a small suggestion but in general this looks quite good, thank you!

[imincik]

Notes from review meeting:

• Make PostgreSQL unix sockets working

[ju1m]

Changes

• Add more selenium tests up to after creating the admin user.
• Fixed some bugs upstream to supported Unix socket, but one is still pending for a fix, see Reverse-proxying with a Unix socket raises exception: (Protocol.UndefinedError) protocol String.Chars not implemented for type Tuple. bonfire-networks/bonfire-app#1698 (comment)
• Init profiles/nixos/nginx/reverse-proxy.nix for modules to import:

  imports = [
    (lib.modules.importApply ../../../../profiles/nixos/nginx/reverse-proxy.nix {
      inherit service;
      proxyPass = "http://localhost:${toString cfg.settings.SERVER_PORT}";
      proxyWebsockets = true;
    })
  ];

State

• nixos.tests.basic passes, it defaults to bonfire.social.

$ nom build -f. hydrated-projects.Bonfire.nixos.tests.basic