2 files changed, 24 insertions, 12 deletions

diff --git a/modules/apps/jenkins/default.nix b/modules/apps/jenkins/default.nix
index 63dbe00..0e5fa6b 100644
--- a/modules/apps/jenkins/default.nix
+++ b/modules/apps/jenkins/default.nix
@@ -40,12 +40,13 @@ let
   mkService = name: cfg:
     let
 
+      inherit (cfg.jre) properties;
+
       mkOpt = n: v: if isBool v then (if v then "--${n}" else "")
            else if isString v then "--${n}='${v}'"
            else "--${n}=${toString v}";
 
       path = ".war.path";
-      tmpdir = "${cfg.home}/tmp";
 
       start = pkgs.writeBashScriptBin "jenkins-${name}" ''
         set -euo pipefail
@@ -98,14 +99,17 @@ let
           echo '${cfg.war}' > ${path}
         fi
 
-        rm -rf -- '${tmpdir}'
-        mkdir -p -- '${tmpdir}'
-        exec ${cfg.jre}/bin/java \
+        rm   -rf -- '${cfg.jre.properties.java.io.tmpdir}'
+        mkdir -p -- '${cfg.jre.properties.java.io.tmpdir}'
+
+        # TODO: generalize properties, maybe put in a file:
+        exec ${cfg.jre.package}/bin/java \
           -DJENKINS_HOME='${cfg.home}' \
-          -Djava.io.tmpdir='${tmpdir}' \
+          ${optionalString (properties.hudson.model.DirectoryBrowserSupport.CSP != null)
+            ''-Dhudson.model.DirectoryBrowserSupport.CSP="${properties.hudson.model.DirectoryBrowserSupport.CSP}"''} \
+          -Djava.io.tmpdir='${properties.java.io.tmpdir}' \
           -jar '${cfg.war}' \
-          ${concatStringsSep " \\\n  " (
-            mapAttrsToList mkOpt (explicit cfg.options))}
+          ${concatStringsSep " \\\n  " (mapAttrsToList mkOpt (explicit cfg.options))}
       '';
 
     in {
diff --git a/modules/apps/jenkins/instance.nix b/modules/apps/jenkins/instance.nix
index 692b066..6735ab8 100644
--- a/modules/apps/jenkins/instance.nix
+++ b/modules/apps/jenkins/instance.nix
@@ -1,5 +1,5 @@
 pkgs:
-{ lib, name, ... }:
+{ lib, name, config, ... }:
 
 let
 
@@ -13,14 +13,22 @@ let
 
   default = d: t: mkOption { type = t; default = d; };
   optional = t: mkOption { type = nullOr t; default = null; };
+  readonly = d: t: mkOption { type = nullOr t; default = d; readOnly = true; };
 
 in {
   options = {
 
-    jre = mkOption {
-      description = "Java runtime package";
-      default = pkgs.jre8;
-      type = package;
+    jre = {
+      package = mkOption {
+        description = "Java runtime package";
+        default = pkgs.jre8;
+        type = package;
+      };
+
+      properties = {
+        hudson.model.DirectoryBrowserSupport.CSP = optional str;
+        java.io.tmpdir = readonly "${config.home}/tmp" path;
+      };
     };
 
     war = mkOption {