From d3f1c04e724906705a0c6863c4a21ce34a7b2347 Mon Sep 17 00:00:00 2001
From: Trolli Schmittlauch <t.schmittlauch@orlives.de>
Date: Sat, 30 Jan 2021 23:09:53 +0100
Subject: [PATCH 1/2] generate gunicorn.conf.py

---
 mod-seafile-server.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/mod-seafile-server.nix b/mod-seafile-server.nix
index 5eb9dea..a1aa4a9 100644
--- a/mod-seafile-server.nix
+++ b/mod-seafile-server.nix
@@ -6,6 +6,20 @@ let
     (generators.toINI {} cfg.seafileSettings);
   ccnetConfigFile = pkgs.writeText "ccnet.conf"
     (generators.toINI {} cfg.ccnetSettings);
+  gunicornConfigFile = pkgs.writeText "gunicorn.conf.py"
+    ''
+      import os
+      daemon = True
+      workers = 5
+      # default localhost:8000
+      bind = "127.0.0.1:8000"
+      # Pid
+      pids_dir = '${cfg.storagePath}/pids'
+      pidfile = os.path.join(pids_dir, 'seahub.pid')
+      # for file upload, we need a longer timeout value (default is only 30s, too short)
+      timeout = 1200
+      limit_request_line = 8190
+    '';
   # fix permissions at start
 in
   {
@@ -249,7 +263,7 @@ in
           tmpfiles.rules = [
             "d ${cfg.storagePath} 0750 ${cfg.user} ${cfg.group} -"
             "d ${cfg.storagePath}/conf 0700 ${cfg.user} ${cfg.group} -"
-            "d ${cfg.storagePath}/home 0710 ${cfg.user} ${cfg.group} -"
+            "d ${cfg.storagePath}/pids 0710 ${cfg.user} ${cfg.group} -"
           ];
           services.seafile-server = {
 
@@ -272,7 +286,9 @@ in
                 # move config templates from nix store
                 cp ${ccnetConfigFile} ./conf/ccnet.conf
                 cp ${seafileConfigFile} ./conf/seafile.conf
+                cp ${gunicornConfigFile} ./conf/gunicorn.conf.py
                 # replace placeholder secrets with real secret read from file
+                #TODO: unset -x to prevent DBPASS from being leaked in journal
                 ${if !(isNull cfg.db.passwordFile) then ''
                   DBPASS="$(head -n1 ${toString cfg.db.passwordFile})"
                   sed -e "s,#dbpass#,$DBPASS,g" -i ./conf/seafile.conf ./conf/ccnet.conf

From cb441565197d703ac4825b2b4f06fd57f93ecb46 Mon Sep 17 00:00:00 2001
From: Trolli Schmittlauch <t.schmittlauch@orlives.de>
Date: Sun, 31 Jan 2021 00:43:23 +0100
Subject: [PATCH 2/2] generate seafile_settings.py

---
 mod-seafile-server.nix | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/mod-seafile-server.nix b/mod-seafile-server.nix
index a1aa4a9..1f97b94 100644
--- a/mod-seafile-server.nix
+++ b/mod-seafile-server.nix
@@ -20,6 +20,22 @@ let
       timeout = 1200
       limit_request_line = 8190
     '';
+  seahubConfigFile = pkgs.writeText "seahub_settings.py"
+    ''
+      SECRET_KEY = #seckey#
+
+      DATABASES = {
+          'default': {
+              'ENGINE': 'django.db.backends.${if cfg.db.type == "mysql" then
+                "mysql" else abort "invalid db type"}',
+              'NAME': '${cfg.db.dbnameSeahub}',
+              'USER': '${cfg.db.user}',
+              'PASSWORD': '#dbpass#',
+              'HOST': '${cfg.db.host}',
+              'PORT': '${toString cfg.db.port}'
+          }
+      }
+    '';
   # fix permissions at start
 in
   {
@@ -287,21 +303,26 @@ in
                 cp ${ccnetConfigFile} ./conf/ccnet.conf
                 cp ${seafileConfigFile} ./conf/seafile.conf
                 cp ${gunicornConfigFile} ./conf/gunicorn.conf.py
+                cp ${seahubConfigFile} ./conf/seahub_settings.py
+
+                # seahub secret key
+                if [ ! -e .seahubSecret ]; then
+                    ${pkgs.seafile-server.pythonEnv}/bin/python ${pkgs.seafile-server}/seahub/tools/secret_key_generator.py > .seahubSecret
+                    chmod 400 .seahubSecret
+                fi
+                SEAHUB_SECRET="$(head -n1 .seahubSecret)"
+                # TODO: check for special characters needing to be escaped
+                sed -e "s,#seckey#,$SEAHUB_SECRET,g" -i ./conf/seahub_settings.py
+
                 # replace placeholder secrets with real secret read from file
                 #TODO: unset -x to prevent DBPASS from being leaked in journal
                 ${if !(isNull cfg.db.passwordFile) then ''
                   DBPASS="$(head -n1 ${toString cfg.db.passwordFile})"
-                  sed -e "s,#dbpass#,$DBPASS,g" -i ./conf/seafile.conf ./conf/ccnet.conf
+                  sed -e "s,#dbpass#,$DBPASS,g" -i ./conf/seafile.conf ./conf/ccnet.conf ./conf/seahub_settings.py
                   ''
                   else ""
                 }
 
-                # seahub secret key
-                if [ -e .seahubSecret ]; then
-                    ${pkgs.seafile-server.pythonEnv} ${pkgs.seafile-server}/seahub/tools/secret_key_generator.py > .seahubSecret
-                    chmod 400 .seahubSecret
-                fi
-
                 
                 # initialise db and other things needed at first run
                 if [ -e .initialised ]; then