Skip to content

Conversation

jackrosenberg
Copy link
Member

@jackrosenberg jackrosenberg commented Jun 12, 2025

Init Pangolin module for NixOS: pangolin

Depends on

Related to:

To test:
must reboot after initial setup on remote server
otherwise Newt will give Ping attempt 1 failed: failed to read ICMP packet: i/o timeout

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • Nixpkgs 25.11 Release Notes (or backporting 24.11 and 25.05 Nixpkgs Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
  • NixOS 25.11 Release Notes (or backporting 24.11 and 25.05 NixOS Release notes)
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

Add a 👍 reaction to pull requests you find important.

@github-actions github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Jun 12, 2025
@jackrosenberg

This comment was marked as outdated.

@jackrosenberg jackrosenberg marked this pull request as ready for review June 12, 2025 13:42
@jackrosenberg jackrosenberg changed the title Nixos/pangolin nixos/pangolin: init at 1.2.0 Jun 12, 2025
@github-actions github-actions bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Jun 12, 2025
@SigmaSquadron SigmaSquadron self-assigned this Jun 12, 2025
Copy link
Contributor

@SigmaSquadron SigmaSquadron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Modules don't have versioning; drop the version information from the module's commit title.

An additional question on upstream support: does pangolin make any distinction between non-breaking and breaking updates? Will all updates be backwards and forward compatible? If the answer to the latter question is no, then we might need to package several Pangolin versions and gate them behind stateVersion in the module.

@h7x4 h7x4 added the 8.has: module (new) This PR adds a module in `nixos/` label Jun 13, 2025
@jackrosenberg jackrosenberg changed the title nixos/pangolin: init at 1.2.0 nixos/pangolin: init Jun 13, 2025
@jackrosenberg jackrosenberg force-pushed the nixos/pangolin branch 5 times, most recently from 203bba6 to d743fb6 Compare June 14, 2025 21:08
Copy link
Contributor

@SigmaSquadron SigmaSquadron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a release note under "new modules" in the NixOS 25.11 release notes.

Like with newt, do a final pass through the option descriptions and examples to ensure everything is properly capitalised, punctuated and the examples make sense.

@jackrosenberg jackrosenberg force-pushed the nixos/pangolin branch 2 times, most recently from 1e86424 to 4c505ef Compare June 15, 2025 17:39
@github-actions github-actions bot added 8.has: changelog This PR adds or changes release notes 8.has: documentation This PR adds or changes documentation labels Jun 15, 2025
@jackrosenberg jackrosenberg force-pushed the nixos/pangolin branch 2 times, most recently from 97e321b to 2c2029d Compare June 17, 2025 16:04
};
experimental.plugins.badger = {
moduleName = "github.com/fosrl/badger";
version = "v1.1.0";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
version = "v1.1.0";
version = "v1.2.0";

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A version in a module? Is there no better way to get this, maybe from one of the packages?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd love it if this could be sourced from the Nix store instead of downloaded by traefik during runtime. I'm not sure how possible that is, though, and it may require changes to the Traefik module.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll look around to see what other modules do.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I’d prefer the plugin to come from the store, my more immediate concern is how this version will be managed.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is this generally done? I cant seem to find other modules that do this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I’d prefer the plugin to come from the store, my more immediate concern is how this version will be managed.

I assumed we'd occasionally update it here and Traefik will update it from https://plugins.traefik.io.

However, that might not be necessary:

Local Mode

Traefik also offers a local mode that can be used for:

  • Using private plugins that are not hosted on GitHub
  • Testing the plugins during their development

To use a plugin in local mode, the Traefik static configuration must define the module name (as is usual for Go packages) and a path to a Go workspace, which can be the local GOPATH or any directory.

The plugins must be placed in ./plugins-local directory, which should be in the working directory of the process running the Traefik binary. The source code of the plugin should be organized as follows:

./plugins-local/
    └── src
        └── github.com
            └── traefik
                └── plugindemo
                    ├── demo.go
                    ├── demo_test.go
                    ├── go.mod
                    ├── go.sum
                    ├── LICENSE
                    ├── Makefile
                    ├── readme.md
                    └── vendor
                        ├── github.com
                        │   └── traefik
                        │       └── genconf
                        │           ├── dynamic
                        │           │   ├── config.go
                        │           │   ├── http_config.go
                        │           │   ├── marshaler.go
                        │           │   ├── middlewares.go
                        │           │   ├── plugins.go
                        │           │   ├── tcp_config.go
                        │           │   ├── tls
                        │           │   │   ├── certificate.go
                        │           │   │   └── tls.go
                        │           │   ├── types
                        │           │   │   ├── domains.go
                        │           │   │   └── tls.go
                        │           │   └── udp_config.go
                        │           └── LICENSE
                        └── modules.txt

@jackrosenberg
Copy link
Member Author

Test WIP, waiting on upstream for a way to make an API key.

@jackrosenberg jackrosenberg force-pushed the nixos/pangolin branch 2 times, most recently from 007a82c to f8c01e4 Compare August 15, 2025 13:08
@jackrosenberg
Copy link
Member Author

jackrosenberg commented Aug 15, 2025

For anyone wondering the apiKey fields in the test are not actually my apiKeys.... anymore :)


dbFilePath = "/var/lib/pangolin/config/db/db.sqlite";
# API key values to be inserted
# prefixed so that order is preserved by the attrNames ordering :)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i can't even rn

Yeah, patching Pangolin it is.


VPS = {
imports = [ ./common/acme/client ];
networking.domain = domain;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inherit?

Comment on lines 186 to 77
# TODO, check if this is correct.
# API is unclear on what's what
environment.etc."nixos/secrets/newt.env".text = ''
NEWT_ID=${newtId}
NEWT_SECRET=${secret}
'';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is correct. Pangolin returns the Newt ID and Secret from the API, so you need to save the results of the curl commands in a file in the VPS node, and then copy that data to the privateHost.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I gave up on using pangctl. Instead i can just insert whatever i want into the db :) This also removes the need for the curling

SigmaSquadron and others added 5 commits August 26, 2025 02:09
This function takes in the provider, owner and plugin name, and outputs
a correctly-formatted derivation with the Traefik plugin, which can be
`symlinkJoin`ed in the `/var/lib/traefik/plugins-local` folder.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Co-authored-by: Ethan Carter Edwards <ethan@ethancedwards.com>
@nixpkgs-ci nixpkgs-ci bot added 6.topic: fetch Fetchers (e.g. fetchgit, fetchsvn, ...) 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-darwin: 1 This PR causes 1 package to rebuild on Darwin. 2.status: merge conflict This PR has merge conflicts with the target branch 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. and removed 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. labels Aug 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.status: merge conflict This PR has merge conflicts with the target branch 6.topic: fetch Fetchers (e.g. fetchgit, fetchsvn, ...) 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: changelog This PR adds or changes release notes 8.has: documentation This PR adds or changes documentation 8.has: module (new) This PR adds a module in `nixos/` 8.has: module (update) This PR changes an existing module in `nixos/` 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-darwin: 1 This PR causes 1 package to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 12.approvals: 2 This PR was reviewed and approved by two persons. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages.
Projects
None yet
Development

Successfully merging this pull request may close these issues.