all-dressed-programming/st-pierre
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: HMAC-signed cookies for UI sessions, bcrypt hash for admin bootstrap, simplified NixOS module

Browse Source
This commit is contained in:
didier committed 2026-06-16 13:12:51 -04:00
1 parent 56da3bae61
commit 5be2005f70
3 files changed
+51 -57
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

flake.nix
+11 -40
View File
@@ -89,34 +89,16 @@
description = "Embedding model name.";
};
adminPasswordFile = lib.mkOption {
adminPasswordHashFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "Path to a file containing the admin user password for bootstrap.";
description = "Path to a file containing the bcrypt hash of the admin password.";
};
adminPassword = lib.mkOption {
adminPasswordHash = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = "Admin user password directly. Prefer adminPasswordFile for secrets.";
};
adminUsername = lib.mkOption {
type = lib.types.str;
default = "admin";
description = "Admin username for bootstrap.";
};
mcpTokenFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "Path to a file containing the initial MCP session token.";
};
mcpToken = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = "Initial MCP session token directly. Prefer mcpTokenFile for secrets.";
description = "Bcrypt hash of the admin password directly. Prefer adminPasswordHashFile for secrets.";
};
sqlitePath = lib.mkOption {
@@ -124,12 +106,6 @@
default = "/var/lib/st-pierre/st-pierre.sqlite";
description = "Path to the SQLite database file.";
};
hmacKeyFile = lib.mkOption {
type = lib.types.path;
default = "/var/lib/st-pierre/secret";
description = "Path to the HMAC key file for cookie signing. Will be auto-generated if missing.";
};
};
config = lib.mkIf cfg.enable {
@@ -150,6 +126,9 @@
if [ -f "${builtins.toString cfg.sqlitePath}" ]; then
chown st-pierre:st-pierre "${builtins.toString cfg.sqlitePath}"
fi
if [ -f /var/lib/st-pierre/.secret ]; then
chown st-pierre:st-pierre /var/lib/st-pierre/.secret
fi
'';
serviceConfig = {
@@ -160,10 +139,9 @@
StateDirectory = "st-pierre";
ExecStart = "${st-pierre-pkg}/bin/st-pierre";
}
// lib.optionalAttrs (cfg.openaiApiKeyFile != null || cfg.adminPasswordFile != null || cfg.mcpTokenFile != null || cfg.qdrantApiKeyFile != null) {
// lib.optionalAttrs (cfg.openaiApiKeyFile != null || cfg.adminPasswordHashFile != null || cfg.qdrantApiKeyFile != null) {
EnvironmentFile = lib.optional (cfg.openaiApiKeyFile != null) cfg.openaiApiKeyFile
++ lib.optional (cfg.adminPasswordFile != null) cfg.adminPasswordFile
++ lib.optional (cfg.mcpTokenFile != null) cfg.mcpTokenFile
++ lib.optional (cfg.adminPasswordHashFile != null) cfg.adminPasswordHashFile
++ lib.optional (cfg.qdrantApiKeyFile != null) cfg.qdrantApiKeyFile;
};
@@ -176,21 +154,14 @@
EMBEDDING_BASE_URL = cfg.embeddingBaseUrl;
EMBEDDING_MODEL = cfg.embeddingModel;
SQLITE_PATH = builtins.toString cfg.sqlitePath;
HMAC_KEY_FILE = builtins.toString cfg.hmacKeyFile;
GIT_COMMIT = gitHash;
BUILD_DATE = lastUpdated;
}
// lib.optionalAttrs (cfg.openaiApiKey != null) {
OPENAI_API_KEY = cfg.openaiApiKey;
}
// lib.optionalAttrs (cfg.adminPassword != null) {
ADMIN_PASSWORD = cfg.adminPassword;
}
// lib.optionalAttrs (true) {
ADMIN_USERNAME = cfg.adminUsername;
}
// lib.optionalAttrs (cfg.mcpToken != null) {
MCP_TOKEN = cfg.mcpToken;
// lib.optionalAttrs (cfg.adminPasswordHash != null) {
ADMIN_PASSWORD_HASH = cfg.adminPasswordHash;
};
};
};