nixos: Apply changes from nixpkgs module #186
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,9 @@ | ||
| { | ||
| lib, | ||
| pkgs, | ||
| config, | ||
| ... | ||
| }: | ||
|
|
||
| let | ||
| inherit (lib) types; | ||
|
|
@@ -11,16 +16,19 @@ let | |
|
|
||
| format = pkgs.formats.toml { }; | ||
|
|
||
| checkedConfigFile = | ||
| pkgs.runCommand "checked-attic-server.toml" | ||
| { | ||
| configFile = cfg.configFile; | ||
| } | ||
| '' | ||
| cat $configFile | ||
|
|
||
| export ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="dGVzdCBzZWNyZXQ=" | ||
| export ATTIC_SERVER_DATABASE_URL="sqlite://:memory:" | ||
| ${lib.getExe cfg.package} --mode check-config -f $configFile | ||
| cat <$configFile >$out | ||
| ''; | ||
|
|
||
| atticadmShim = pkgs.writeShellScript "atticadm" '' | ||
| if [ -n "$ATTICADM_PWD" ]; then | ||
|
|
@@ -42,7 +50,7 @@ let | |
| --wait \ | ||
| --collect \ | ||
| --service-type=exec \ | ||
| --property=EnvironmentFile=${cfg.environmentFile} \ | ||
| --property=DynamicUser=yes \ | ||
| --property=User=${cfg.user} \ | ||
| --property=Environment=ATTICADM_PWD=$(pwd) \ | ||
|
|
@@ -51,30 +59,30 @@ let | |
| ${atticadmShim} "$@" | ||
| ''; | ||
|
|
||
| hasLocalPostgresDB = | ||
| let | ||
| url = cfg.settings.database.url or ""; | ||
| localStrings = [ | ||
| "localhost" | ||
| "127.0.0.1" | ||
| "/run/postgresql" | ||
| ]; | ||
| hasLocalStrings = lib.any (lib.flip lib.hasInfix url) localStrings; | ||
| in | ||
| config.services.postgresql.enable && lib.hasPrefix "postgresql://" url && hasLocalStrings; | ||
| in | ||
| { | ||
| imports = [ | ||
| (lib.mkRenamedOptionModule [ "services" "atticd" "credentialsFile" ] [ "services" "atticd" "environmentFile" ]) | ||
| ]; | ||
|
|
||
| options = { | ||
| services.atticd = { | ||
| enable = lib.mkEnableOption "the atticd, the Nix Binary Cache server"; | ||
|
|
||
| package = lib.mkPackageOption pkgs "attic-server" { }; | ||
|
|
||
| environmentFile = lib.mkOption { | ||
| description = '' | ||
| Path to an EnvironmentFile containing required environment | ||
| variables: | ||
|
|
@@ -85,27 +93,31 @@ in | |
| type = types.nullOr types.path; | ||
| default = null; | ||
| }; | ||
|
|
||
| user = lib.mkOption { | ||
| description = '' | ||
| The group under which attic runs. | ||
| ''; | ||
| type = types.str; | ||
| default = "atticd"; | ||
| }; | ||
|
|
||
| group = lib.mkOption { | ||
| description = '' | ||
| The user under which attic runs. | ||
| ''; | ||
| type = types.str; | ||
| default = "atticd"; | ||
| }; | ||
|
|
||
| settings = lib.mkOption { | ||
| description = '' | ||
| Structured configurations of atticd. | ||
| ''; | ||
| type = format.type; | ||
| default = { }; # setting defaults here does not compose well | ||
| }; | ||
|
|
||
| configFile = lib.mkOption { | ||
| description = '' | ||
| Path to an existing atticd configuration file. | ||
|
|
@@ -131,7 +143,11 @@ in | |
|
|
||
| There are several other supported modes that perform one-off operations, but these are the only ones that make sense to run via the NixOS module. | ||
| ''; | ||
| type = lib.types.enum [ | ||
| "monolithic" | ||
| "api-server" | ||
| "garbage-collector" | ||
| ]; | ||
| default = "monolithic"; | ||
| }; | ||
|
|
||
|
|
@@ -146,77 +162,108 @@ in | |
| }; | ||
| }; | ||
| }; | ||
|
|
||
| config = lib.mkIf cfg.enable { | ||
| assertions = [ | ||
| { | ||
| assertion = cfg.environmentFile != null; | ||
| message = '' | ||
| <option>services.atticd.environmentFile</option> is not set. | ||
|
|
||
| Run `openssl genrsa -traditional -out private_key.pem 4096 | base64 -w0` and create a file with the following contents: | ||
|
|
||
| ATTIC_SERVER_TOKEN_RS256_SECRET="output from command" | ||
|
|
||
| Then, set `services.atticd.environmentFile` to the quoted absolute path of the file. | ||
| ''; | ||
| } | ||
| { | ||
| assertion = !lib.isStorePath cfg.environmentFile; | ||
| message = '' | ||
| <option>services.atticd.environmentFile</option> points to a path in the Nix store. The Nix store is globally readable. | ||
|
|
||
| You should use a quoted absolute path to prevent leaking secrets in the Nix store. | ||
| ''; | ||
| } | ||
| ]; | ||
|
|
||
| services.atticd.settings = { | ||
| database.url = lib.mkDefault "sqlite:///var/lib/atticd/server.db?mode=rwc"; | ||
|
|
||
| # "storage" is internally tagged | ||
| # if the user sets something the whole thing must be replaced | ||
| storage = lib.mkDefault { | ||
| type = "local"; | ||
| path = "/var/lib/atticd/storage"; | ||
| }; | ||
| }; | ||
|
|
||
| systemd.services.atticd = { | ||
| wantedBy = [ "multi-user.target" ]; | ||
| after = [ "network-online.target" ] ++ lib.optionals hasLocalPostgresDB [ "postgresql.service" ]; | ||
| requires = lib.optionals hasLocalPostgresDB [ "postgresql.service" ]; | ||
|
There was a problem hiding this comment. It was pointed out to me that the after generates an eval warning. You'll want this too NixOS/nixpkgs#349083 |
||
| wants = [ "network-online.target" ]; | ||
|
|
||
| serviceConfig = { | ||
| ExecStart = "${lib.getExe cfg.package} -f ${checkedConfigFile} --mode ${cfg.mode}"; | ||
| EnvironmentFile = cfg.environmentFile; | ||
| StateDirectory = "atticd"; # for usage with local storage and sqlite | ||
| DynamicUser = true; | ||
| User = cfg.user; | ||
| Group = cfg.group; | ||
| Restart = "on-failure"; | ||
| RestartSec = 10; | ||
|
|
||
| CapabilityBoundingSet = [ "" ]; | ||
| DeviceAllow = ""; | ||
| DevicePolicy = "closed"; | ||
| LockPersonality = true; | ||
| MemoryDenyWriteExecute = true; | ||
| NoNewPrivileges = true; | ||
| PrivateDevices = true; | ||
| PrivateTmp = true; | ||
| PrivateUsers = true; | ||
| ProcSubset = "pid"; | ||
| ProtectClock = true; | ||
| ProtectControlGroups = true; | ||
| ProtectHome = true; | ||
| ProtectHostname = true; | ||
| ProtectKernelLogs = true; | ||
| ProtectKernelModules = true; | ||
| ProtectKernelTunables = true; | ||
| ProtectProc = "invisible"; | ||
| ProtectSystem = "strict"; | ||
| ReadWritePaths = | ||
| let | ||
| path = cfg.settings.storage.path; | ||
| isDefaultStateDirectory = path == "/var/lib/atticd" || lib.hasPrefix "/var/lib/atticd/" path; | ||
| in | ||
| lib.optionals (cfg.settings.storage.type or "" == "local" && !isDefaultStateDirectory) [ path ]; | ||
| RemoveIPC = true; | ||
| RestrictAddressFamilies = [ | ||
| "AF_INET" | ||
| "AF_INET6" | ||
| "AF_UNIX" | ||
| ]; | ||
| RestrictNamespaces = true; | ||
| RestrictRealtime = true; | ||
| RestrictSUIDSGID = true; | ||
| SystemCallArchitectures = "native"; | ||
| SystemCallFilter = [ | ||
| "@system-service" | ||
| "~@resources" | ||
| "~@privileged" | ||
| ]; | ||
| UMask = "0077"; | ||
| }; | ||
| }; | ||
|
|
||
| environment.systemPackages = [ | ||
| atticadmWrapper | ||
| ]; | ||
|
|
||
| nixpkgs.overlays = lib.mkIf cfg.useFlakeCompatOverlay [ | ||
| overlay | ||
| ]; | ||
| }; | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think using
getExemakes sense here or inserviceConfig.This breaks using the
attic(orattic-nixpkgs) package for the service, because that package hasatticset asmainProgram, which is the wrong binary to use here. So settingservices.attic.package = pkgs.atticwas working fine before this change, but is broken with it.Since this package includes both server and client, it should be usable here IMO.
I've been using that package to avoid having to build attic twice, for server and client binaries.