hockeypuck

OpenPGP keyserver

Declared in: projects/hockeypuck/default.nix

1. Install Nix
   Debian

   Bash

   $ apt install --yes curl git jq nix

   Ubuntu

   Bash

   $ apt install --yes curl git jq nix

   Arch

   Bash

   $ pacman --sync --refresh --noconfirm curl git jq nix

2. Download a configuration file

   # default.nix
   {
     ngipkgs ? import (fetchTarball "https://github.com/ngi-nix/ngipkgs/tarball/main") { },
   }:
   ngipkgs.demo-vm (
     {
       pkgs,
       ...
     }:
     let
       servicePort = 11371;
     in
     {
       services.hockeypuck = {
         enable = true;
         port = servicePort;
       };
   
       services.postgresql = {
         enable = true;
         ensureDatabases = [ "hockeypuck" ];
         ensureUsers = [
           {
             name = "hockeypuck";
             ensureDBOwnership = true;
           }
         ];
       };
   
       environment.systemPackages = with pkgs; [
         gnupg
       ];
   
       # example gpg key
       environment.etc.gpg-key-foo.text = ''
         %echo Generating a basic OpenPGP key
         %no-protection
         Key-Type: DSA
         Key-Length: 1024
         Subkey-Type: ELG-E
         Subkey-Length: 1024
         Name-Real: Foo Example
         Name-Email: foo@example.org
         Expire-Date: 0
         # Do a commit here, so that we can later print "done"
         %commit
         %echo done
       '';
   
       networking.firewall.allowedTCPPorts = [ servicePort ];
     }
   )
   

   Download
3. Enable binary substituters

   Bash

   $ export NIX_CONFIG='substituters = https://cache.nixos.org/ https://ngi.cachix.org/
   trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= ngi.cachix.org-1:n+CAL72ROC3qQuLxIHpV+Tw5t42WhXmMhprAGkRSrOw='

4. Build and run a virtual machine
   Debian Sid/Trixie

   Bash

   $ nix-build ./default.nix && ./result

   Ubuntu 25.04 and newer

   Bash

   $ nix-build ./default.nix && ./result

   Ubuntu 24.04/24.10

   Bash

   $ rev=$(nix-instantiate --eval --attr sources.nixpkgs.rev https://github.com/ngi-nix/ngipkgs/archive/master.tar.gz | jq --raw-output)

   $ nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz --packages nix --run "nix-build ./default.nix && ./result"

   Arch

   Bash

   $ nix-build ./default.nix && ./result

5. Usage Instructions

   1. Generate GPG keyring from basic key:

      $ gpg --batch --generate-key /etc/gpg-key-foo
      $ KEY_ID=$(gpg --list-keys | grep dsa1024 --after-context=1 | grep -v dsa1024)
      

   2. Send the key to the local hockeypuck keyserver:

      $ gpg --keyserver hkp://127.0.0.1:11371 --send-keys "$KEY_ID"
      

   3. Receive the key from the local keyserver to a separate directory:

      $ GNUPGHOME=$(mktemp -d) gpg --keyserver hkp://127.0.0.1:11371 --recv-keys "$KEY_ID"
      

   4. Visit http://127.0.0.1:11371 in your browser

{
  ...
}:
let
  servicePort = 11371;
in
{
  services.hockeypuck = {
    enable = true;
    port = servicePort;
  };

  services.postgresql = {
    enable = true;
    ensureDatabases = [ "hockeypuck" ];
    ensureUsers = [
      {
        name = "hockeypuck";
        ensureDBOwnership = true;
      }
    ];
  };

  networking.firewall.allowedTCPPorts = [ servicePort ];
}

This project is funded by NLnet through these subgrants:

Core

Hockeypuck

Related links:

• Title
• Homepage
• Source repository