From ec956c1ca832f044a6be4662d994e6fe881fc64a Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Fri, 3 Jul 2026 15:00:31 +0300 Subject: [PATCH 1/2] test upload limits --- flake.nix | 29 ++++++++++++++++++++++++++- nix/checks/module-eval.nix | 41 ++++++++++++++++++++++++++++++++++++-- nix/upload-limits.nix | 4 ++++ 3 files changed, 71 insertions(+), 3 deletions(-) create mode 100644 nix/upload-limits.nix diff --git a/flake.nix b/flake.nix index ab7aca0..63c2445 100644 --- a/flake.nix +++ b/flake.nix @@ -12,11 +12,13 @@ }: let nixosModule = import ./nix/nixos-module.nix; + uploadLimits = import ./nix/upload-limits.nix; in utils.lib.eachDefaultSystem ( system: let pkgs = nixpkgs.legacyPackages.${system}; + devPhp = pkgs.php; packages = import ./nix/packages { inherit pkgs; }; in { @@ -28,12 +30,37 @@ inherit nixpkgs system; module = nixosModule; }; + dev-php-upload-limits = + pkgs.runCommand "rabbi-gerzi-dev-php-upload-limits" + { + preferLocalBuild = true; + } + '' + actual_upload_max_filesize="$( + ${devPhp}/bin/php -r 'echo ini_get("upload_max_filesize");' + )" + actual_post_max_size="$( + ${devPhp}/bin/php -r 'echo ini_get("post_max_size");' + )" + + if [ "$actual_upload_max_filesize" != "${uploadLimits.phpUploadLimit}" ]; then + echo "upload_max_filesize was $actual_upload_max_filesize" >&2 + exit 1 + fi + + if [ "$actual_post_max_size" != "${uploadLimits.phpUploadLimit}" ]; then + echo "post_max_size was $actual_post_max_size" >&2 + exit 1 + fi + + echo "$actual_upload_max_filesize" > $out + ''; }; devShells.default = pkgs.mkShell { buildInputs = with pkgs; [ onefetch - php + devPhp phpPackages.composer phpPackages.php-codesniffer vscode-langservers-extracted diff --git a/nix/checks/module-eval.nix b/nix/checks/module-eval.nix index 9da8eea..1de9137 100644 --- a/nix/checks/module-eval.nix +++ b/nix/checks/module-eval.nix @@ -7,7 +7,9 @@ }: let - evaluatedHostName = + uploadLimits = import ../upload-limits.nix; + + evaluatedConfig = (nixpkgs.lib.nixosSystem { inherit system; modules = [ @@ -25,13 +27,48 @@ let }; } ]; - }).config.services.rabbi-gerzi.backend.hostName; + }).config; + + evaluatedHostName = evaluatedConfig.services.rabbi-gerzi.backend.hostName; + + backendVirtualHost = evaluatedConfig.services.nginx.virtualHosts.${evaluatedHostName}; + + phpOptions = evaluatedConfig.services.phpfpm.pools.rabbi-gerzi.phpOptions; + + expectedUploadMaxFilesize = "upload_max_filesize = ${uploadLimits.phpUploadLimit}"; + + expectedPostMaxSize = "post_max_size = ${uploadLimits.phpUploadLimit}"; + + expectedNginxClientMaxBodySize = "client_max_body_size ${uploadLimits.nginxClientMaxBodySize};"; + + assertions = [ + { + passed = lib.hasInfix expectedUploadMaxFilesize phpOptions; + message = "php-fpm upload_max_filesize is not 6M"; + } + { + passed = lib.hasInfix expectedPostMaxSize phpOptions; + message = "php-fpm post_max_size is not 6M"; + } + { + passed = lib.hasInfix expectedNginxClientMaxBodySize backendVirtualHost.extraConfig; + message = "nginx client_max_body_size is not 6m"; + } + ]; + + failedAssertions = lib.filter (assertion: !assertion.passed) assertions; in pkgs.runCommand "rabbi-gerzi-module-eval" { + failures = lib.concatMapStringsSep "\n" (assertion: assertion.message) failedAssertions; value = evaluatedHostName; preferLocalBuild = true; } '' + if [ -n "$failures" ]; then + printf '%s\n' "$failures" >&2 + exit 1 + fi + echo "$value" > $out '' diff --git a/nix/upload-limits.nix b/nix/upload-limits.nix new file mode 100644 index 0000000..513945a --- /dev/null +++ b/nix/upload-limits.nix @@ -0,0 +1,4 @@ +{ + nginxClientMaxBodySize = "6m"; + phpUploadLimit = "6M"; +} From 757be61f596dd10e458027d77643c85381947dfa Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Fri, 3 Jul 2026 15:04:07 +0300 Subject: [PATCH 2/2] set upload limits --- .gitignore | 2 ++ flake.nix | 8 ++++++-- nix/nixos-module.nix | 5 +++++ nix/packages/backend.nix | 17 ++++++++++------- nix/packages/default.nix | 9 +++++++-- nix/upload-limits.nix | 4 ++++ 6 files changed, 34 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index 6d81922..c52bee4 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,5 @@ /.reference/ /backend/.phpunit.cache/ /.postgres/ +/result +/result-* diff --git a/flake.nix b/flake.nix index 63c2445..866671b 100644 --- a/flake.nix +++ b/flake.nix @@ -18,8 +18,12 @@ system: let pkgs = nixpkgs.legacyPackages.${system}; - devPhp = pkgs.php; - packages = import ./nix/packages { inherit pkgs; }; + devPhp = pkgs.php.buildEnv { + extraConfig = uploadLimits.phpOptions; + }; + packages = import ./nix/packages { + inherit pkgs uploadLimits; + }; in { inherit packages; diff --git a/nix/nixos-module.nix b/nix/nixos-module.nix index e7c3995..8bfb03a 100644 --- a/nix/nixos-module.nix +++ b/nix/nixos-module.nix @@ -13,6 +13,7 @@ let appDir = "${backendPackage}/share/php/rabbi-gerzi-backend"; phpPackage = backendPackage.passthru.php; poolName = "rabbi-gerzi"; + uploadLimits = import ./upload-limits.nix; storagePath = "${cfg.stateDir}/storage"; cachePath = "${cfg.cacheDir}/bootstrap-cache"; setupService = "rabbi-gerzi-setup"; @@ -239,6 +240,7 @@ in services.phpfpm.pools.${poolName} = { inherit (cfg) user group; inherit phpPackage; + phpOptions = uploadLimits.phpOptions; settings = { "catch_workers_output" = true; "clear_env" = "no"; @@ -316,6 +318,9 @@ in cfg.backend.nginx { root = "${appDir}/public"; + extraConfig = '' + client_max_body_size ${uploadLimits.nginxClientMaxBodySize}; + ''; locations = { "/" = { index = "index.php"; diff --git a/nix/packages/backend.nix b/nix/packages/backend.nix index e9eac6f..02e732b 100644 --- a/nix/packages/backend.nix +++ b/nix/packages/backend.nix @@ -2,16 +2,19 @@ lib, makeWrapper, php, + uploadLimits ? import ../upload-limits.nix, }: let - phpPackage = php.withExtensions ( - { enabled, all }: - enabled - ++ [ - all.pdo_pgsql - ] - ); + phpPackage = php.buildEnv { + extensions = + { enabled, all }: + enabled + ++ [ + all.pdo_pgsql + ]; + extraConfig = uploadLimits.phpOptions; + }; in phpPackage.buildComposerProject2 (finalAttrs: { pname = "rabbi-gerzi-backend"; diff --git a/nix/packages/default.nix b/nix/packages/default.nix index 45b1d04..bbd3482 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -1,7 +1,12 @@ -{ pkgs }: +{ + pkgs, + uploadLimits ? import ../upload-limits.nix, +}: rec { - backend = pkgs.callPackage ./backend.nix { }; + backend = pkgs.callPackage ./backend.nix { + inherit uploadLimits; + }; frontend = pkgs.callPackage ./frontend.nix { }; default = frontend; } diff --git a/nix/upload-limits.nix b/nix/upload-limits.nix index 513945a..6699d3b 100644 --- a/nix/upload-limits.nix +++ b/nix/upload-limits.nix @@ -1,4 +1,8 @@ { nginxClientMaxBodySize = "6m"; phpUploadLimit = "6M"; + phpOptions = '' + upload_max_filesize = 6M + post_max_size = 6M + ''; }