Merge pull request #269460 from tie/pghero

pghero: init at 3.4.1

nixos/modules/module-list.nix

@@ -779,6 +779,7 @@
   ./services/misc/paperless.nix
   ./services/misc/parsoid.nix
   ./services/misc/persistent-evdev.nix
+  ./services/misc/pghero.nix
   ./services/misc/pinnwand.nix
   ./services/misc/plex.nix
   ./services/misc/plikd.nix

nixos/modules/services/misc/pghero.nix

@@ -0,0 +1,142 @@
+{ config, pkgs, lib, utils, ... }:
+let
+  cfg = config.services.pghero;
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "pghero.yaml" cfg.settings;
+in
+{
+  options.services.pghero = {
+    enable = lib.mkEnableOption "PgHero service";
+    package = lib.mkPackageOption pkgs "pghero" { };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      example = "[::1]:3000";
+      description = ''
+        `hostname:port` to listen for HTTP traffic.
+
+        This is bound using the systemd socket activation.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Additional command-line arguments for the systemd service.
+
+        Refer to the [Puma web server documentation] for available arguments.
+
+        [Puma web server documentation]: https://puma.io/puma#configuration
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      example = {
+        databases = {
+          primary = {
+            url = "<%= ENV['PRIMARY_DATABASE_URL'] %>";
+          };
+        };
+      };
+      description = ''
+        PgHero configuration. Refer to the [PgHero documentation] for more
+        details.
+
+        [PgHero documentation]: https://github.com/ankane/pghero/blob/master/guides/Linux.md#multiple-databases
+      '';
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+      '';
+    };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        File to load environment variables from. Loaded variables override
+        values set in {option}`environment`.
+      '';
+    };
+
+    extraGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "tlskeys" ];
+      description = ''
+        Additional groups for the systemd service.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.pghero = {
+      unitConfig.Description = "PgHero HTTP socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ cfg.listenAddress ];
+    };
+
+    systemd.services.pghero = {
+      description = "PgHero performance dashboard for PostgreSQL";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "pghero.socket" ];
+      after = [ "pghero.socket" "network.target" ];
+
+      environment = {
+        RAILS_ENV = "production";
+        PGHERO_CONFIG_PATH = settingsFile;
+      } // cfg.environment;
+
+      serviceConfig = {
+        Type = "notify";
+        WatchdogSec = "10";
+
+        ExecStart = utils.escapeSystemdExecArgs ([
+          (lib.getExe cfg.package)
+          "--bind-to-activated-sockets"
+          "only"
+        ] ++ cfg.extraArgs);
+        Restart = "always";
+
+        WorkingDirectory = "${cfg.package}/share/pghero";
+
+        EnvironmentFile = cfg.environmentFiles;
+        SupplementaryGroups = cfg.extraGroups;
+
+        DynamicUser = true;
+        UMask = "0077";
+
+        ProtectHome = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        CapabilityBoundingSet = [ "" ];
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -721,6 +721,7 @@ in {
   pg_anonymizer = handleTest ./pg_anonymizer.nix {};
   pgadmin4 = handleTest ./pgadmin4.nix {};
   pgbouncer = handleTest ./pgbouncer.nix {};
+  pghero = runTest ./pghero.nix;
   pgjwt = handleTest ./pgjwt.nix {};
   pgmanage = handleTest ./pgmanage.nix {};
   pgvecto-rs = handleTest ./pgvecto-rs.nix {};

nixos/tests/pghero.nix

@@ -0,0 +1,63 @@
+let
+  pgheroPort = 1337;
+  pgheroUser = "pghero";
+  pgheroPass = "pghero";
+in
+{ lib, ... }: {
+  name = "pghero";
+  meta.maintainers = [ lib.maintainers.tie ];
+
+  nodes.machine = { config, ... }: {
+    services.postgresql = {
+      enable = true;
+      # This test uses default peer authentication (socket and its directory is
+      # world-readably by default), so we essentially test that we can connect
+      # with DynamicUser= set.
+      ensureUsers = [{
+        name = "pghero";
+        ensureClauses.superuser = true;
+      }];
+    };
+    services.pghero = {
+      enable = true;
+      listenAddress = "[::]:${toString pgheroPort}";
+      settings = {
+        databases = {
+          postgres.url = "<%= ENV['POSTGRES_DATABASE_URL'] %>";
+          nulldb.url = "nulldb:///";
+        };
+      };
+      environment = {
+        PGHERO_USERNAME = pgheroUser;
+        PGHERO_PASSWORD = pgheroPass;
+        POSTGRES_DATABASE_URL = "postgresql:///postgres?host=/run/postgresql";
+      };
+    };
+  };
+
+  testScript = ''
+    pgheroPort = ${toString pgheroPort}
+    pgheroUser = "${pgheroUser}"
+    pgheroPass = "${pgheroPass}"
+
+    pgheroUnauthorizedURL = f"http://localhost:{pgheroPort}"
+    pgheroBaseURL = f"http://{pgheroUser}:{pgheroPass}@localhost:{pgheroPort}"
+
+    def expect_http_code(node, code, url):
+        http_code = node.succeed(f"curl -s -o /dev/null -w '%{{http_code}}' '{url}'")
+        assert http_code.split("\n")[-1].strip() == code, \
+          f"expected HTTP status code {code} but got {http_code}"
+
+    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("pghero.service")
+
+    with subtest("requires HTTP Basic Auth credentials"):
+      expect_http_code(machine, "401", pgheroUnauthorizedURL)
+
+    with subtest("works with some databases being unavailable"):
+      expect_http_code(machine, "500", pgheroBaseURL + "/nulldb")
+
+    with subtest("connects to the PostgreSQL database"):
+      expect_http_code(machine, "200", pgheroBaseURL + "/postgres")
+  '';
+}

pkgs/by-name/pg/pghero/Gemfile

@@ -0,0 +1,14 @@
+source "https://rubygems.org"
+
+gem "rails", "~> 7.0.0"
+gem "propshaft"
+gem "puma"
+gem "pg"
+gem "activerecord-nulldb-adapter", require: false
+
+# See also https://github.com/ankane/pghero/blob/v3.3.4/guides/Rails.md
+gem "pghero"
+gem "pg_query"
+gem "aws-sdk-cloudwatch"
+gem "google-apis-monitoring_v3"
+gem "azure_mgmt_monitor"

pkgs/by-name/pg/pghero/Gemfile.lock

@@ -0,0 +1,280 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+    actionmailbox (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      activejob (= 7.0.8.3)
+      activerecord (= 7.0.8.3)
+      activestorage (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      mail (>= 2.7.1)
+      net-imap
+      net-pop
+      net-smtp
+    actionmailer (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      actionview (= 7.0.8.3)
+      activejob (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      mail (~> 2.5, >= 2.5.4)
+      net-imap
+      net-pop
+      net-smtp
+      rails-dom-testing (~> 2.0)
+    actionpack (7.0.8.3)
+      actionview (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      rack (~> 2.0, >= 2.2.4)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
+    actiontext (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      activerecord (= 7.0.8.3)
+      activestorage (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
+    actionview (7.0.8.3)
+      activesupport (= 7.0.8.3)
+      builder (~> 3.1)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    activejob (7.0.8.3)
+      activesupport (= 7.0.8.3)
+      globalid (>= 0.3.6)
+    activemodel (7.0.8.3)
+      activesupport (= 7.0.8.3)
+    activerecord (7.0.8.3)
+      activemodel (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+    activerecord-nulldb-adapter (1.0.1)
+      activerecord (>= 5.2.0, < 7.2)
+    activestorage (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      activejob (= 7.0.8.3)
+      activerecord (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      marcel (~> 1.0)
+      mini_mime (>= 1.1.0)
+    activesupport (7.0.8.3)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+    addressable (2.8.6)
+      public_suffix (>= 2.0.2, < 6.0)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.935.0)
+    aws-sdk-cloudwatch (1.91.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-core (3.196.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.651.0)
+      aws-sigv4 (~> 1.8)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sigv4 (1.8.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    azure_mgmt_monitor (0.19.0)
+      ms_rest_azure (~> 0.12.0)
+    base64 (0.2.0)
+    bigdecimal (3.1.8)
+    builder (3.2.4)
+    concurrent-ruby (1.2.3)
+    crass (1.0.6)
+    date (3.3.4)
+    declarative (0.0.20)
+    domain_name (0.6.20240107)
+    erubi (1.12.0)
+    faraday (1.10.3)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.7)
+      faraday (>= 0.8.0)
+      http-cookie (~> 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.0)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.4)
+      multipart-post (~> 2)
+    faraday-net_http (1.0.1)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    globalid (1.2.1)
+      activesupport (>= 6.1)
+    google-apis-core (0.15.0)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 1.9)
+      httpclient (>= 2.8.1, < 3.a)
+      mini_mime (~> 1.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+      rexml
+    google-apis-monitoring_v3 (0.62.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-env (2.1.1)
+      faraday (>= 1.0, < 3.a)
+    google-protobuf (4.27.0)
+      bigdecimal
+      rake (>= 13)
+    googleauth (1.11.0)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.1)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    http-cookie (1.0.5)
+      domain_name (~> 0.5)
+    httpclient (2.8.3)
+    i18n (1.14.5)
+      concurrent-ruby (~> 1.0)
+    jmespath (1.6.2)
+    jwt (2.8.1)
+      base64
+    loofah (2.22.0)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    mail (2.8.1)
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.0.4)
+    method_source (1.1.0)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.6)
+    minitest (5.23.1)
+    ms_rest (0.7.6)
+      concurrent-ruby (~> 1.0)
+      faraday (>= 0.9, < 2.0.0)
+      timeliness (~> 0.3.10)
+    ms_rest_azure (0.12.0)
+      concurrent-ruby (~> 1.0)
+      faraday (>= 0.9, < 2.0.0)
+      faraday-cookie_jar (~> 0.0.6)
+      ms_rest (~> 0.7.6)
+    multi_json (1.15.0)
+    multipart-post (2.4.1)
+    net-imap (0.4.11)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-smtp (0.5.0)
+      net-protocol
+    nio4r (2.7.3)
+    nokogiri (1.16.5)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    os (1.1.4)
+    pg (1.5.6)
+    pg_query (5.1.0)
+      google-protobuf (>= 3.22.3)
+    pghero (3.5.0)
+      activerecord (>= 6)
+    propshaft (0.9.0)
+      actionpack (>= 7.0.0)
+      activesupport (>= 7.0.0)
+      rack
+      railties (>= 7.0.0)
+    public_suffix (5.0.5)
+    puma (6.4.2)
+      nio4r (~> 2.0)
+    racc (1.8.0)
+    rack (2.2.9)
+    rack-test (2.1.0)
+      rack (>= 1.3)
+    rails (7.0.8.3)
+      actioncable (= 7.0.8.3)
+      actionmailbox (= 7.0.8.3)
+      actionmailer (= 7.0.8.3)
+      actionpack (= 7.0.8.3)
+      actiontext (= 7.0.8.3)
+      actionview (= 7.0.8.3)
+      activejob (= 7.0.8.3)
+      activemodel (= 7.0.8.3)
+      activerecord (= 7.0.8.3)
+      activestorage (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      bundler (>= 1.15.0)
+      railties (= 7.0.8.3)
+    rails-dom-testing (2.2.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.6.0)
+      loofah (~> 2.21)
+      nokogiri (~> 1.14)
+    railties (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+      method_source
+      rake (>= 12.2)
+      thor (~> 1.0)
+      zeitwerk (~> 2.5)
+    rake (13.2.1)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.1.2)
+    rexml (3.2.8)
+      strscan (>= 3.0.9)
+    ruby2_keywords (0.0.5)
+    signet (0.19.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    strscan (3.1.0)
+    thor (1.3.1)
+    timeliness (0.3.10)
+    timeout (0.4.1)
+    trailblazer-option (0.1.2)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uber (0.1.0)
+    websocket-driver (0.7.6)
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    zeitwerk (2.6.15)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-nulldb-adapter
+  aws-sdk-cloudwatch
+  azure_mgmt_monitor
+  google-apis-monitoring_v3
+  pg
+  pg_query
+  pghero
+  propshaft
+  puma
+  rails (~> 7.0.0)
+
+BUNDLED WITH
+   2.5.9

pkgs/by-name/pg/pghero/package.nix

@@ -0,0 +1,74 @@
+{ lib
+, stdenv
+, ruby
+, bundlerEnv
+, buildPackages
+, fetchFromGitHub
+, makeBinaryWrapper
+, nixosTests
+, callPackage
+}:
+stdenv.mkDerivation (finalAttrs:
+let
+  # Use bundlerEnvArgs from passthru to allow overriding bundlerEnv arguments.
+  rubyEnv = bundlerEnv finalAttrs.passthru.bundlerEnvArgs;
+  # We also need a separate nativeRubyEnv to precompile assets on the build
+  # host. If possible, reuse existing rubyEnv derivation.
+  nativeRubyEnv =
+    if stdenv.buildPlatform.canExecute stdenv.hostPlatform then rubyEnv
+    else buildPackages.bundlerEnv finalAttrs.passthru.bundlerEnvArgs;
+
+  bundlerEnvArgs = {
+    name = "${finalAttrs.pname}-${finalAttrs.version}-gems";
+    gemdir = ./.;
+  };
+in
+{
+  pname = "pghero";
+  version = "3.5.0";
+
+  src = fetchFromGitHub {
+    owner = "pghero";
+    repo = "pghero";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6JShYn3QfxPdAVcrJ7/kxzxa4dBEzSkUiLguIH+VCRQ=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ nativeRubyEnv makeBinaryWrapper ];
+
+  inherit rubyEnv;
+
+  buildPhase = ''
+    runHook preBuild
+    DATABASE_URL=nulldb:/// RAILS_ENV=production rake assets:precompile
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p -- "$out"/{share,bin}
+    cp -a -- . "$out"/share/pghero
+    makeWrapper "$rubyEnv"/bin/puma "$out"/bin/pghero \
+      --add-flags -C \
+      --add-flags config/puma.rb \
+      --chdir "$out"/share/pghero
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit bundlerEnvArgs;
+    updateScript = callPackage ./update.nix { };
+    tests = {
+      inherit (nixosTests) pghero;
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/ankane/pghero";
+    description = "Performance dashboard for Postgres";
+    mainProgram = "pghero";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.tie ];
+  };
+})

pkgs/by-name/pg/pghero/update.nix

@@ -0,0 +1,59 @@
+{ lib
+, writeShellScript
+, git
+, nix
+, bundler
+, bundix
+, coreutils
+, common-updater-scripts
+}:
+writeShellScript "update-script" ''
+  set -eu
+  PATH=${lib.makeBinPath [
+    git
+    nix
+    bundler
+    bundix
+    coreutils
+    common-updater-scripts
+  ]}
+  nix() {
+    command nix --extra-experimental-features nix-command "$@"
+  }
+  bundle() {
+    BUNDLE_FORCE_RUBY_PLATFORM=1 command bundle "$@"
+  }
+
+  attrPath=''${UPDATE_NIX_ATTR_PATH:-pghero}
+
+  toplevel=$(git rev-parse --show-toplevel)
+  position=$(nix eval --file "$toplevel" --raw "$attrPath.meta.position")
+  gemdir=$(dirname "$position")
+
+  cd "$gemdir"
+
+  tempdir=$(mktemp -d)
+  cleanup() {
+    rc=$?
+    rm -r -- "$tempdir" || true
+    exit $rc
+  }
+  trap cleanup EXIT
+
+  cp gemset.nix "$tempdir"
+
+  bundle lock --update --lockfile="$tempdir"/Gemfile.lock
+  bundix --lockfile="$tempdir"/Gemfile.lock --gemset="$tempdir"/gemset.nix
+
+  oldVersion=''${UPDATE_NIX_OLD_VERSION-}
+  newVersion=$(nix eval --file "$tempdir"/gemset.nix --raw pghero.version)
+
+  if [ "$oldVersion" = "$newVersion" ]; then
+    exit
+  fi
+
+  cp "$tempdir"/{Gemfile.lock,gemset.nix} .
+
+  cd "$toplevel"
+  update-source-version "$attrPath" "$newVersion" --file="$gemdir"/package.nix --ignore-same-hash
+''