nixos/whoami: init module (#397396)

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -189,6 +189,8 @@
 
 - [echoip](https://github.com/mpolden/echoip), a simple service for looking up your IP address. Available as [services.echoip](#opt-services.echoip.enable).
 
+- [whoami](https://github.com/traefik/whoami), a tiny Go server that prints OS information and HTTP request to output. Available as [services.whoami](#opt-services.whoami.enable).
+
 - [LiteLLM](https://github.com/BerriAI/litellm), a LLM Gateway to provide model access, fallbacks and spend tracking across 100+ LLMs. All in the OpenAI format. Available as [services.litellm](#opt-services.litellm.enable).
 
 - [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).

nixos/modules/module-list.nix

@@ -1639,6 +1639,7 @@
   ./services/web-apps/wakapi.nix
   ./services/web-apps/weblate.nix
   ./services/web-apps/whitebophir.nix
+  ./services/web-apps/whoami.nix
   ./services/web-apps/wiki-js.nix
   ./services/web-apps/windmill.nix
   ./services/web-apps/wordpress.nix

nixos/modules/services/web-apps/whoami.nix

@@ -0,0 +1,90 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.whoami;
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.whoami = {
+    enable = lib.mkEnableOption "whoami";
+
+    package = lib.mkPackageOption pkgs "whoami" { };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      description = "The port whoami should listen on.";
+      default = 8000;
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Extra command line arguments to pass to whoami. See <https://github.com/traefik/whoami#flags> for details.";
+      default = [ ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.whoami = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "whoami";
+        Group = "whoami";
+        DynamicUser = true;
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "-port"
+            cfg.port
+          ]
+          ++ cfg.extraArgs
+        );
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = "tcp:${toString cfg.port}";
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -1446,6 +1446,7 @@ in
   webhook = runTest ./webhook.nix;
   weblate = handleTest ./web-apps/weblate.nix { };
   whisparr = handleTest ./whisparr.nix { };
+  whoami = runTest ./whoami.nix;
   whoogle-search = handleTest ./whoogle-search.nix { };
   wiki-js = runTest ./wiki-js.nix;
   wine = handleTest ./wine.nix { };

nixos/tests/whoami.nix

@@ -0,0 +1,32 @@
+{ lib, ... }:
+
+{
+  name = "echoip";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.whoami.enable = true;
+  };
+
+  interactive.nodes.machine = {
+    networking.firewall.allowedTCPPorts = [ 8000 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8000;
+        guest.port = 8000;
+      }
+    ];
+  };
+
+  testScript = ''
+    import re
+
+    machine.wait_for_unit("whoami.service")
+    machine.wait_for_open_port(8000)
+
+    response = machine.succeed("curl -H 'X-Test-Header: Hello World!' http://127.0.0.1:8000/test")
+    assert re.search(r"^GET /test", response, re.M)
+    assert re.search(r"^X-Test-Header: Hello World!", response, re.M)
+  '';
+}

pkgs/by-name/wh/whoami/package.nix

@@ -2,16 +2,18 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "whoami";
   version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "traefik";
     repo = "whoami";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-3jzLdCmmts/7S1Oxig9Dg3kRGh/H5l5UD7ztev0yvXY=";
   };
 
@@ -21,14 +23,29 @@ buildGoModule rec {
 
   env.CGO_ENABLED = 0;
 
-  doCheck = false;
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/whoami --help 2> /dev/null
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) whoami; };
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Tiny Go server that prints os information and HTTP request to output";
     mainProgram = "whoami";
     homepage = "https://github.com/traefik/whoami";
-    changelog = "https://github.com/traefik/whoami/releases/tag/v${version}";
+    changelog = "https://github.com/traefik/whoami/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ dvcorreia ];
+    maintainers = with lib.maintainers; [
+      dvcorreia
+      defelo
+    ];
   };
-}
+})