reformat with nixfmt
This commit is contained in:
parent
ab6c39c77e
commit
4e182bec1d
|
|
@ -1,14 +1,14 @@
|
|||
{
|
||||
perSystem =
|
||||
{ inputs'
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
}:
|
||||
{ inputs', pkgs, ... }:
|
||||
let
|
||||
convert2Tofu = provider: provider.override (prev: {
|
||||
homepage = builtins.replaceStrings [ "registry.terraform.io/providers" ] [ "registry.opentofu.org" ] prev.homepage;
|
||||
});
|
||||
convert2Tofu =
|
||||
provider:
|
||||
provider.override (prev: {
|
||||
homepage = builtins.replaceStrings [ "registry.terraform.io/providers" ] [
|
||||
"registry.opentofu.org"
|
||||
] prev.homepage;
|
||||
});
|
||||
in
|
||||
{
|
||||
devShells.default = pkgs.mkShellNoCC {
|
||||
|
|
@ -18,17 +18,18 @@
|
|||
|
||||
inputs'.clan-core.packages.clan-cli
|
||||
|
||||
(pkgs.opentofu.withPlugins (p: builtins.map convert2Tofu [
|
||||
p.hetznerdns
|
||||
p.hcloud
|
||||
p.null
|
||||
p.external
|
||||
p.local
|
||||
]))
|
||||
];
|
||||
inputsFrom = [
|
||||
inputs'.clan-core.devShells.default
|
||||
(pkgs.opentofu.withPlugins (
|
||||
p:
|
||||
builtins.map convert2Tofu [
|
||||
p.hetznerdns
|
||||
p.hcloud
|
||||
p.null
|
||||
p.external
|
||||
p.local
|
||||
]
|
||||
))
|
||||
];
|
||||
inputsFrom = [ inputs'.clan-core.devShells.default ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
86
flake.nix
86
flake.nix
|
|
@ -37,39 +37,55 @@
|
|||
buildbot-nix.inputs.treefmt-nix.follows = "treefmt-nix";
|
||||
};
|
||||
|
||||
outputs = inputs@{ flake-parts, ... }:
|
||||
flake-parts.lib.mkFlake { inherit inputs; } ({ self, ... }: {
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
];
|
||||
imports = [
|
||||
inputs.treefmt-nix.flakeModule
|
||||
./devShells/flake-module.nix
|
||||
./targets/flake-module.nix
|
||||
./modules/flake-module.nix
|
||||
./pkgs/flake-module.nix
|
||||
];
|
||||
perSystem = ({ lib, self', system, ... }: {
|
||||
treefmt = {
|
||||
projectRootFile = ".git/config";
|
||||
programs.hclfmt.enable = true;
|
||||
programs.nixpkgs-fmt.enable = true;
|
||||
settings.formatter.nixpkgs-fmt.excludes = [
|
||||
# generated files
|
||||
"node-env.nix"
|
||||
"node-packages.nix"
|
||||
"composition.nix"
|
||||
];
|
||||
};
|
||||
checks =
|
||||
let
|
||||
nixosMachines = lib.mapAttrs' (name: config: lib.nameValuePair "nixos-${name}" config.config.system.build.toplevel) ((lib.filterAttrs (_: config: config.pkgs.system == system)) self.nixosConfigurations);
|
||||
packages = lib.mapAttrs' (n: lib.nameValuePair "package-${n}") self'.packages;
|
||||
devShells = lib.mapAttrs' (n: lib.nameValuePair "devShell-${n}") self'.devShells;
|
||||
homeConfigurations = lib.mapAttrs' (name: config: lib.nameValuePair "home-manager-${name}" config.activation-script) (self'.legacyPackages.homeConfigurations or { });
|
||||
in
|
||||
nixosMachines // packages // devShells // homeConfigurations;
|
||||
});
|
||||
});
|
||||
outputs =
|
||||
inputs@{ flake-parts, ... }:
|
||||
flake-parts.lib.mkFlake { inherit inputs; } (
|
||||
{ self, ... }:
|
||||
{
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
];
|
||||
imports = [
|
||||
inputs.treefmt-nix.flakeModule
|
||||
./devShells/flake-module.nix
|
||||
./targets/flake-module.nix
|
||||
./modules/flake-module.nix
|
||||
./pkgs/flake-module.nix
|
||||
];
|
||||
perSystem = (
|
||||
{
|
||||
lib,
|
||||
self',
|
||||
system,
|
||||
...
|
||||
}:
|
||||
{
|
||||
treefmt = {
|
||||
projectRootFile = ".git/config";
|
||||
programs.hclfmt.enable = true;
|
||||
programs.nixfmt-rfc-style.enable = true;
|
||||
settings.formatter.nixfmt-rfc-style.excludes = [
|
||||
# generated files
|
||||
"node-env.nix"
|
||||
"node-packages.nix"
|
||||
"composition.nix"
|
||||
];
|
||||
};
|
||||
checks =
|
||||
let
|
||||
nixosMachines = lib.mapAttrs' (
|
||||
name: config: lib.nameValuePair "nixos-${name}" config.config.system.build.toplevel
|
||||
) ((lib.filterAttrs (_: config: config.pkgs.system == system)) self.nixosConfigurations);
|
||||
packages = lib.mapAttrs' (n: lib.nameValuePair "package-${n}") self'.packages;
|
||||
devShells = lib.mapAttrs' (n: lib.nameValuePair "devShell-${n}") self'.devShells;
|
||||
homeConfigurations = lib.mapAttrs' (
|
||||
name: config: lib.nameValuePair "home-manager-${name}" config.activation-script
|
||||
) (self'.legacyPackages.homeConfigurations or { });
|
||||
in
|
||||
nixosMachines // packages // devShells // homeConfigurations;
|
||||
}
|
||||
);
|
||||
}
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -41,7 +41,10 @@ in
|
|||
extraGroups = [ "wheel" ];
|
||||
shell = "/run/current-system/sw/bin/zsh";
|
||||
uid = 1004;
|
||||
openssh.authorizedKeys.keys = [ admins.kenji admins.kenji-remote ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
admins.kenji
|
||||
admins.kenji-remote
|
||||
];
|
||||
};
|
||||
johannes = {
|
||||
isNormalUser = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{ self, inputs, ... }: {
|
||||
{ self, inputs, ... }:
|
||||
{
|
||||
flake.nixosModules = {
|
||||
server.imports = [
|
||||
inputs.srvos.nixosModules.server
|
||||
|
|
|
|||
|
|
@ -1,31 +1,22 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
}:
|
||||
with lib; let
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.clan.networking;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
clan.networking.ipv4.address = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
clan.networking.ipv4.address = lib.mkOption { type = lib.types.str; };
|
||||
|
||||
clan.networking.ipv4.cidr = mkOption {
|
||||
type = types.str;
|
||||
clan.networking.ipv4.cidr = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "26";
|
||||
};
|
||||
|
||||
clan.networking.ipv4.gateway = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
clan.networking.ipv4.gateway = lib.mkOption { type = lib.types.str; };
|
||||
|
||||
clan.networking.ipv6.address = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
clan.networking.ipv6.address = lib.mkOption { type = lib.types.str; };
|
||||
|
||||
clan.networking.ipv6.cidr = mkOption {
|
||||
type = types.str;
|
||||
clan.networking.ipv6.cidr = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "64";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,9 +1,8 @@
|
|||
{ config, ... }: {
|
||||
{ config, ... }:
|
||||
{
|
||||
# 100GB storagebox is under the nix-community hetzner account
|
||||
|
||||
systemd.services.borgbackup-job-clan-lol.serviceConfig.ReadWritePaths = [
|
||||
"/var/log/telegraf"
|
||||
];
|
||||
systemd.services.borgbackup-job-clan-lol.serviceConfig.ReadWritePaths = [ "/var/log/telegraf" ];
|
||||
|
||||
# Run this from the hetzner network:
|
||||
# ssh-keyscan -p 23 u359378.your-storagebox.de
|
||||
|
|
|
|||
|
|
@ -1,10 +1,18 @@
|
|||
{ config, self, pkgs, ... }: {
|
||||
{
|
||||
config,
|
||||
self,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
# service to for automatic merge bot
|
||||
systemd.services.clan-merge = {
|
||||
description = "Merge clan.lol PRs automatically";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
environment = { GITEA_TOKEN_FILE = "%d/GITEA_TOKEN_FILE"; };
|
||||
environment = {
|
||||
GITEA_TOKEN_FILE = "%d/GITEA_TOKEN_FILE";
|
||||
};
|
||||
serviceConfig = {
|
||||
LoadCredential = [ "GITEA_TOKEN_FILE:${config.sops.secrets.merge-bot-gitea-token.path}" ];
|
||||
Restart = "on-failure";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{ self, ... }: {
|
||||
{ self, ... }:
|
||||
{
|
||||
imports = [
|
||||
./borgbackup.nix
|
||||
./clan-merge.nix
|
||||
|
|
|
|||
|
|
@ -1,8 +1,26 @@
|
|||
{ config, self, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
self,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
storeDeps = pkgs.runCommand "store-deps" { } ''
|
||||
mkdir -p $out/bin
|
||||
for dir in ${toString [ pkgs.coreutils pkgs.findutils pkgs.gnugrep pkgs.gawk pkgs.git pkgs.nix pkgs.bash pkgs.jq pkgs.nodejs ]}; do
|
||||
for dir in ${
|
||||
toString [
|
||||
pkgs.coreutils
|
||||
pkgs.findutils
|
||||
pkgs.gnugrep
|
||||
pkgs.gawk
|
||||
pkgs.git
|
||||
pkgs.nix
|
||||
pkgs.bash
|
||||
pkgs.jq
|
||||
pkgs.nodejs
|
||||
]
|
||||
}; do
|
||||
for bin in "$dir"/bin/*; do
|
||||
ln -s "$bin" "$out/bin/$(basename "$bin")"
|
||||
done
|
||||
|
|
@ -14,87 +32,95 @@ let
|
|||
'';
|
||||
numInstances = 2;
|
||||
in
|
||||
lib.mkMerge [{
|
||||
# everything here has no dependencies on the store
|
||||
systemd.services.gitea-runner-nix-image = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "podman.service" ];
|
||||
requires = [ "podman.service" ];
|
||||
path = [ config.virtualisation.podman.package pkgs.gnutar pkgs.shadow pkgs.getent ];
|
||||
# we also include etc here because the cleanup job also wants the nixuser to be present
|
||||
script = ''
|
||||
set -eux -o pipefail
|
||||
mkdir -p etc/nix
|
||||
|
||||
# Create an unpriveleged user that we can use also without the run-as-user.sh script
|
||||
touch etc/passwd etc/group
|
||||
groupid=$(cut -d: -f3 < <(getent group nixuser))
|
||||
userid=$(cut -d: -f3 < <(getent passwd nixuser))
|
||||
groupadd --prefix $(pwd) --gid "$groupid" nixuser
|
||||
emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
|
||||
useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nixuser nixuser
|
||||
|
||||
cat <<NIX_CONFIG > etc/nix/nix.conf
|
||||
accept-flake-config = true
|
||||
experimental-features = nix-command flakes
|
||||
NIX_CONFIG
|
||||
|
||||
cat <<NSSWITCH > etc/nsswitch.conf
|
||||
passwd: files mymachines systemd
|
||||
group: files mymachines systemd
|
||||
shadow: files
|
||||
|
||||
hosts: files mymachines dns myhostname
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
NSSWITCH
|
||||
|
||||
# list the content as it will be imported into the container
|
||||
tar -cv . | tar -tvf -
|
||||
tar -cv . | podman import - gitea-runner-nix
|
||||
'';
|
||||
serviceConfig = {
|
||||
RuntimeDirectory = "gitea-runner-nix-image";
|
||||
WorkingDirectory = "/run/gitea-runner-nix-image";
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
};
|
||||
|
||||
users.users.nixuser = {
|
||||
group = "nixuser";
|
||||
description = "Used for running nix ci jobs";
|
||||
home = "/var/empty";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.nixuser = { };
|
||||
}
|
||||
lib.mkMerge [
|
||||
{
|
||||
systemd.services = lib.genAttrs (builtins.genList (n: "gitea-runner-nix${builtins.toString n}-token") numInstances) (name: {
|
||||
# everything here has no dependencies on the store
|
||||
systemd.services.gitea-runner-nix-image = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "gitea.service" ];
|
||||
environment = {
|
||||
GITEA_CUSTOM = "/var/lib/gitea/custom";
|
||||
GITEA_WORK_DIR = "/var/lib/gitea";
|
||||
};
|
||||
after = [ "podman.service" ];
|
||||
requires = [ "podman.service" ];
|
||||
path = [
|
||||
config.virtualisation.podman.package
|
||||
pkgs.gnutar
|
||||
pkgs.shadow
|
||||
pkgs.getent
|
||||
];
|
||||
# we also include etc here because the cleanup job also wants the nixuser to be present
|
||||
script = ''
|
||||
set -euo pipefail
|
||||
token=$(${lib.getExe self.packages.${pkgs.hostPlatform.system}.gitea} actions generate-runner-token)
|
||||
echo "TOKEN=$token" > /var/lib/gitea-registration/${name}
|
||||
set -eux -o pipefail
|
||||
mkdir -p etc/nix
|
||||
|
||||
# Create an unpriveleged user that we can use also without the run-as-user.sh script
|
||||
touch etc/passwd etc/group
|
||||
groupid=$(cut -d: -f3 < <(getent group nixuser))
|
||||
userid=$(cut -d: -f3 < <(getent passwd nixuser))
|
||||
groupadd --prefix $(pwd) --gid "$groupid" nixuser
|
||||
emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
|
||||
useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nixuser nixuser
|
||||
|
||||
cat <<NIX_CONFIG > etc/nix/nix.conf
|
||||
accept-flake-config = true
|
||||
experimental-features = nix-command flakes
|
||||
NIX_CONFIG
|
||||
|
||||
cat <<NSSWITCH > etc/nsswitch.conf
|
||||
passwd: files mymachines systemd
|
||||
group: files mymachines systemd
|
||||
shadow: files
|
||||
|
||||
hosts: files mymachines dns myhostname
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
NSSWITCH
|
||||
|
||||
# list the content as it will be imported into the container
|
||||
tar -cv . | tar -tvf -
|
||||
tar -cv . | podman import - gitea-runner-nix
|
||||
'';
|
||||
unitConfig.ConditionPathExists = [ "!/var/lib/gitea-registration/${name}" ];
|
||||
serviceConfig = {
|
||||
User = "gitea";
|
||||
Group = "gitea";
|
||||
StateDirectory = "gitea-registration";
|
||||
RuntimeDirectory = "gitea-runner-nix-image";
|
||||
WorkingDirectory = "/run/gitea-runner-nix-image";
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
users.users.nixuser = {
|
||||
group = "nixuser";
|
||||
description = "Used for running nix ci jobs";
|
||||
home = "/var/empty";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.nixuser = { };
|
||||
}
|
||||
{
|
||||
systemd.services =
|
||||
lib.genAttrs (builtins.genList (n: "gitea-runner-nix${builtins.toString n}-token") numInstances)
|
||||
(name: {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "gitea.service" ];
|
||||
environment = {
|
||||
GITEA_CUSTOM = "/var/lib/gitea/custom";
|
||||
GITEA_WORK_DIR = "/var/lib/gitea";
|
||||
};
|
||||
script = ''
|
||||
set -euo pipefail
|
||||
token=$(${lib.getExe self.packages.${pkgs.hostPlatform.system}.gitea} actions generate-runner-token)
|
||||
echo "TOKEN=$token" > /var/lib/gitea-registration/${name}
|
||||
'';
|
||||
unitConfig.ConditionPathExists = [ "!/var/lib/gitea-registration/${name}" ];
|
||||
serviceConfig = {
|
||||
User = "gitea";
|
||||
Group = "gitea";
|
||||
StateDirectory = "gitea-registration";
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
});
|
||||
|
||||
# Format of the token file:
|
||||
virtualisation = {
|
||||
|
|
@ -111,106 +137,119 @@ lib.mkMerge [{
|
|||
|
||||
virtualisation.containers.containersConf.settings = {
|
||||
# podman seems to not work with systemd-resolved
|
||||
containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
|
||||
containers.dns_servers = [
|
||||
"8.8.8.8"
|
||||
"8.8.4.4"
|
||||
];
|
||||
};
|
||||
}
|
||||
{
|
||||
systemd.services = lib.genAttrs (builtins.genList (n: "gitea-runner-nix${builtins.toString n}") numInstances) (name: {
|
||||
after = [
|
||||
"${name}-token.service"
|
||||
"gitea-runner-nix-image.service"
|
||||
];
|
||||
requires = [
|
||||
"${name}-token.service"
|
||||
"gitea-runner-nix-image.service"
|
||||
];
|
||||
systemd.services =
|
||||
lib.genAttrs (builtins.genList (n: "gitea-runner-nix${builtins.toString n}") numInstances)
|
||||
(name: {
|
||||
after = [
|
||||
"${name}-token.service"
|
||||
"gitea-runner-nix-image.service"
|
||||
];
|
||||
requires = [
|
||||
"${name}-token.service"
|
||||
"gitea-runner-nix-image.service"
|
||||
];
|
||||
|
||||
# TODO: systemd confinment
|
||||
serviceConfig = {
|
||||
# Hardening (may overlap with DynamicUser=)
|
||||
# The following options are only for optimizing output of systemd-analyze
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
# ProtectClock= adds DeviceAllow=char-rtc r
|
||||
DeviceAllow = "";
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
UMask = "0066";
|
||||
ProtectProc = "invisible";
|
||||
SystemCallFilter = [
|
||||
"~@clock"
|
||||
"~@cpu-emulation"
|
||||
"~@module"
|
||||
"~@mount"
|
||||
"~@obsolete"
|
||||
"~@raw-io"
|
||||
"~@reboot"
|
||||
"~@swap"
|
||||
# needed by go?
|
||||
#"~@resources"
|
||||
"~@privileged"
|
||||
"~capset"
|
||||
"~setdomainname"
|
||||
"~sethostname"
|
||||
];
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
|
||||
# TODO: systemd confinment
|
||||
serviceConfig = {
|
||||
# Hardening (may overlap with DynamicUser=)
|
||||
# The following options are only for optimizing output of systemd-analyze
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
# ProtectClock= adds DeviceAllow=char-rtc r
|
||||
DeviceAllow = "";
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
UMask = "0066";
|
||||
ProtectProc = "invisible";
|
||||
SystemCallFilter = [
|
||||
"~@clock"
|
||||
"~@cpu-emulation"
|
||||
"~@module"
|
||||
"~@mount"
|
||||
"~@obsolete"
|
||||
"~@raw-io"
|
||||
"~@reboot"
|
||||
"~@swap"
|
||||
# needed by go?
|
||||
#"~@resources"
|
||||
"~@privileged"
|
||||
"~capset"
|
||||
"~setdomainname"
|
||||
"~sethostname"
|
||||
];
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
"AF_NETLINK"
|
||||
];
|
||||
|
||||
# Needs network access
|
||||
PrivateNetwork = false;
|
||||
# Cannot be true due to Node
|
||||
MemoryDenyWriteExecute = false;
|
||||
# Needs network access
|
||||
PrivateNetwork = false;
|
||||
# Cannot be true due to Node
|
||||
MemoryDenyWriteExecute = false;
|
||||
|
||||
# The more restrictive "pid" option makes `nix` commands in CI emit
|
||||
# "GC Warning: Couldn't read /proc/stat"
|
||||
# You may want to set this to "pid" if not using `nix` commands
|
||||
ProcSubset = "all";
|
||||
# Coverage programs for compiled code such as `cargo-tarpaulin` disable
|
||||
# ASLR (address space layout randomization) which requires the
|
||||
# `personality` syscall
|
||||
# You may want to set this to `true` if not using coverage tooling on
|
||||
# compiled code
|
||||
LockPersonality = false;
|
||||
# The more restrictive "pid" option makes `nix` commands in CI emit
|
||||
# "GC Warning: Couldn't read /proc/stat"
|
||||
# You may want to set this to "pid" if not using `nix` commands
|
||||
ProcSubset = "all";
|
||||
# Coverage programs for compiled code such as `cargo-tarpaulin` disable
|
||||
# ASLR (address space layout randomization) which requires the
|
||||
# `personality` syscall
|
||||
# You may want to set this to `true` if not using coverage tooling on
|
||||
# compiled code
|
||||
LockPersonality = false;
|
||||
|
||||
# Note that this has some interactions with the User setting; so you may
|
||||
# want to consult the systemd docs if using both.
|
||||
DynamicUser = true;
|
||||
};
|
||||
});
|
||||
# Note that this has some interactions with the User setting; so you may
|
||||
# want to consult the systemd docs if using both.
|
||||
DynamicUser = true;
|
||||
};
|
||||
});
|
||||
|
||||
services.gitea-actions-runner.instances = lib.genAttrs (builtins.genList (n: "nix${builtins.toString n}") numInstances) (name: {
|
||||
enable = true;
|
||||
name = "nix-runner";
|
||||
# take the git root url from the gitea config
|
||||
# only possible if you've also configured your gitea though the same nix config
|
||||
# otherwise you need to set it manually
|
||||
url = config.services.gitea.settings.server.ROOT_URL;
|
||||
# use your favourite nix secret manager to get a path for this
|
||||
tokenFile = "/var/lib/gitea-registration/gitea-runner-${name}-token";
|
||||
labels = [ "nix:docker://gitea-runner-nix" ];
|
||||
settings = {
|
||||
container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
|
||||
# the default network that also respects our dns server settings
|
||||
container.network = "host";
|
||||
container.valid_volumes = [
|
||||
"/nix"
|
||||
"${storeDeps}/bin"
|
||||
"${storeDeps}/etc/ssl"
|
||||
];
|
||||
};
|
||||
});
|
||||
}]
|
||||
services.gitea-actions-runner.instances =
|
||||
lib.genAttrs (builtins.genList (n: "nix${builtins.toString n}") numInstances)
|
||||
(name: {
|
||||
enable = true;
|
||||
name = "nix-runner";
|
||||
# take the git root url from the gitea config
|
||||
# only possible if you've also configured your gitea though the same nix config
|
||||
# otherwise you need to set it manually
|
||||
url = config.services.gitea.settings.server.ROOT_URL;
|
||||
# use your favourite nix secret manager to get a path for this
|
||||
tokenFile = "/var/lib/gitea-registration/gitea-runner-${name}-token";
|
||||
labels = [ "nix:docker://gitea-runner-nix" ];
|
||||
settings = {
|
||||
container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
|
||||
# the default network that also respects our dns server settings
|
||||
container.network = "host";
|
||||
container.valid_volumes = [
|
||||
"/nix"
|
||||
"${storeDeps}/bin"
|
||||
"${storeDeps}/etc/ssl"
|
||||
];
|
||||
};
|
||||
});
|
||||
}
|
||||
]
|
||||
|
|
|
|||
|
|
@ -1,12 +1,22 @@
|
|||
{ config, pkgs, lib, self, ... }:
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
self,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
# make the logs for this host "public" so that they show up in e.g. metrics
|
||||
publog = vhost: lib.attrsets.unionOfDisjoint vhost {
|
||||
extraConfig = (vhost.extraConfig or "") + ''
|
||||
access_log /var/log/nginx/public.log vcombined;
|
||||
'';
|
||||
};
|
||||
publog =
|
||||
vhost:
|
||||
lib.attrsets.unionOfDisjoint vhost {
|
||||
extraConfig =
|
||||
(vhost.extraConfig or "")
|
||||
+ ''
|
||||
access_log /var/log/nginx/public.log vcombined;
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{ pkgs, ... }: {
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
services.postgresql.enable = true;
|
||||
services.postgresql.package = pkgs.postgresql_14;
|
||||
services.postgresql.settings = {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ stdenv, lib, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "metrics.clan.lol";
|
||||
|
|
@ -38,14 +38,13 @@ in
|
|||
"d ${pub_goaccess} 0755 goaccess nginx -"
|
||||
];
|
||||
|
||||
|
||||
# --browsers-file=/etc/goaccess/browsers.list
|
||||
# https://raw.githubusercontent.com/allinurl/goaccess/master/config/browsers.list
|
||||
systemd.services.goaccess = {
|
||||
description = "GoAccess server monitoring";
|
||||
preStart = ''
|
||||
rm -f ${pub_goaccess}/index.html
|
||||
'';
|
||||
rm -f ${pub_goaccess}/index.html
|
||||
'';
|
||||
serviceConfig = {
|
||||
User = "goaccess";
|
||||
Group = "nginx";
|
||||
|
|
@ -83,7 +82,11 @@ in
|
|||
ProtectSystem = "strict";
|
||||
SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @reboot @resources @setuid @swap @raw-io";
|
||||
ReadOnlyPaths = "/";
|
||||
ReadWritePaths = [ "/proc/self" "${pub_goaccess}" "${priv_goaccess}" ];
|
||||
ReadWritePaths = [
|
||||
"/proc/self"
|
||||
"${pub_goaccess}"
|
||||
"${priv_goaccess}"
|
||||
];
|
||||
PrivateDevices = "yes";
|
||||
ProtectKernelModules = "yes";
|
||||
ProtectKernelTunables = "yes";
|
||||
|
|
@ -92,7 +95,6 @@ in
|
|||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
|
||||
services.nginx.virtualHosts."${domain}" = {
|
||||
addSSL = true;
|
||||
enableACME = true;
|
||||
|
|
|
|||
|
|
@ -1,17 +1,18 @@
|
|||
{ config, pkgs, ... }: {
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
services.harmonia.enable = true;
|
||||
# $ nix-store --generate-binary-cache-key cache.yourdomain.tld-1 harmonia.secret harmonia.pub
|
||||
services.harmonia.signKeyPath = config.sops.secrets.harmonia-secret.path;
|
||||
|
||||
services.nginx = {
|
||||
package = pkgs.nginxStable.override {
|
||||
modules = [ pkgs.nginxModules.zstd ];
|
||||
};
|
||||
package = pkgs.nginxStable.override { modules = [ pkgs.nginxModules.zstd ]; };
|
||||
};
|
||||
|
||||
# trust our own cache
|
||||
nix.settings.trusted-substituters = [ "https://cache.clan.lol" ];
|
||||
nix.settings.trusted-public-keys = [ "cache.clan.lol-1:3KztgSAB5R1M+Dz7vzkBGzXdodizbgLXGXKXlcQLA28=" ];
|
||||
nix.settings.trusted-public-keys = [
|
||||
"cache.clan.lol-1:3KztgSAB5R1M+Dz7vzkBGzXdodizbgLXGXKXlcQLA28="
|
||||
];
|
||||
|
||||
services.nginx.virtualHosts."cache.clan.lol" = {
|
||||
forceSSL = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, self, ... }:
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
security.acme.defaults.email = "admins@clan.lol";
|
||||
|
|
@ -6,13 +6,11 @@
|
|||
|
||||
# www user to push website artifacts via ssh
|
||||
users.users.www = {
|
||||
openssh.authorizedKeys.keys =
|
||||
config.users.users.root.openssh.authorizedKeys.keys
|
||||
++ [
|
||||
# ssh-homepage-key
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxZ3Av30M6Sh6NU1mnCskB16bYtNP8vskc/+ud0AU1C ssh-homepage-key"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuYyfSuETSrwqCsWHeeClqjcsFlMEmiJN6Rr8/DwrU0 gitea-ci"
|
||||
];
|
||||
openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys ++ [
|
||||
# ssh-homepage-key
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxZ3Av30M6Sh6NU1mnCskB16bYtNP8vskc/+ud0AU1C ssh-homepage-key"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuYyfSuETSrwqCsWHeeClqjcsFlMEmiJN6Rr8/DwrU0 gitea-ci"
|
||||
];
|
||||
isSystemUser = true;
|
||||
shell = "/run/current-system/sw/bin/bash";
|
||||
group = "www";
|
||||
|
|
@ -20,9 +18,7 @@
|
|||
users.groups.www = { };
|
||||
|
||||
# ensure /var/www can be accessed by nginx and www user
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/www 0755 www nginx"
|
||||
];
|
||||
systemd.tmpfiles.rules = [ "d /var/www 0755 www nginx" ];
|
||||
|
||||
services.nginx = {
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,10 @@
|
|||
{ config, self, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
self,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
configForJob = name: {
|
||||
systemd.timers.${name} = {
|
||||
|
|
@ -46,9 +52,11 @@ let
|
|||
};
|
||||
in
|
||||
{
|
||||
config = lib.mkMerge (map configForJob [
|
||||
"job-flake-update-clan-core"
|
||||
"job-flake-update-clan-homepage"
|
||||
"job-flake-update-clan-infra"
|
||||
]);
|
||||
config = lib.mkMerge (
|
||||
map configForJob [
|
||||
"job-flake-update-clan-core"
|
||||
"job-flake-update-clan-homepage"
|
||||
"job-flake-update-clan-infra"
|
||||
]
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{ self, ... }:
|
||||
let
|
||||
mirrorBoot = idx: {
|
||||
type = "disk";
|
||||
|
|
@ -41,8 +40,14 @@ in
|
|||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
mirroredBoots = [
|
||||
{ path = "/boot0"; devices = [ "nodev" ]; }
|
||||
{ path = "/boot1"; devices = [ "nodev" ]; }
|
||||
{
|
||||
path = "/boot0";
|
||||
devices = [ "nodev" ];
|
||||
}
|
||||
{
|
||||
path = "/boot1";
|
||||
devices = [ "nodev" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,19 @@
|
|||
{ bash
|
||||
, coreutils
|
||||
, git
|
||||
, tea
|
||||
, openssh
|
||||
, writePureShellScriptBin
|
||||
{
|
||||
bash,
|
||||
coreutils,
|
||||
git,
|
||||
tea,
|
||||
openssh,
|
||||
writePureShellScriptBin,
|
||||
}:
|
||||
writePureShellScriptBin "action-create-pr" [ bash coreutils git tea openssh ] ''
|
||||
bash ${./script.sh} "$@"
|
||||
''
|
||||
writePureShellScriptBin "action-create-pr"
|
||||
[
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
tea
|
||||
openssh
|
||||
]
|
||||
''
|
||||
bash ${./script.sh} "$@"
|
||||
''
|
||||
|
|
|
|||
|
|
@ -1,8 +1,15 @@
|
|||
{ bash
|
||||
, coreutils
|
||||
, tea
|
||||
, writePureShellScriptBin
|
||||
{
|
||||
bash,
|
||||
coreutils,
|
||||
tea,
|
||||
writePureShellScriptBin,
|
||||
}:
|
||||
writePureShellScriptBin "action-ensure-tea-login" [ bash coreutils tea ] ''
|
||||
bash ${./script.sh}
|
||||
''
|
||||
writePureShellScriptBin "action-ensure-tea-login"
|
||||
[
|
||||
bash
|
||||
coreutils
|
||||
tea
|
||||
]
|
||||
''
|
||||
bash ${./script.sh}
|
||||
''
|
||||
|
|
|
|||
|
|
@ -1,20 +1,23 @@
|
|||
{ bash
|
||||
, coreutils
|
||||
, git
|
||||
, openssh
|
||||
, action-ensure-tea-login
|
||||
, action-create-pr
|
||||
, action-flake-update
|
||||
, writePureShellScriptBin
|
||||
{
|
||||
bash,
|
||||
coreutils,
|
||||
git,
|
||||
openssh,
|
||||
action-ensure-tea-login,
|
||||
action-create-pr,
|
||||
action-flake-update,
|
||||
writePureShellScriptBin,
|
||||
}:
|
||||
writePureShellScriptBin "action-flake-update-pr-clan" [
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
openssh
|
||||
action-ensure-tea-login
|
||||
action-create-pr
|
||||
action-flake-update
|
||||
] ''
|
||||
bash ${./script.sh}
|
||||
''
|
||||
writePureShellScriptBin "action-flake-update-pr-clan"
|
||||
[
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
openssh
|
||||
action-ensure-tea-login
|
||||
action-create-pr
|
||||
action-flake-update
|
||||
]
|
||||
''
|
||||
bash ${./script.sh}
|
||||
''
|
||||
|
|
|
|||
|
|
@ -1,9 +1,17 @@
|
|||
{ bash
|
||||
, coreutils
|
||||
, git
|
||||
, nix
|
||||
, writePureShellScriptBin
|
||||
{
|
||||
bash,
|
||||
coreutils,
|
||||
git,
|
||||
nix,
|
||||
writePureShellScriptBin,
|
||||
}:
|
||||
writePureShellScriptBin "action-flake-update" [ bash coreutils git nix ] ''
|
||||
bash ${./script.sh}
|
||||
''
|
||||
writePureShellScriptBin "action-flake-update"
|
||||
[
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
nix
|
||||
]
|
||||
''
|
||||
bash ${./script.sh}
|
||||
''
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
import argparse
|
||||
import json
|
||||
import urllib.request
|
||||
import urllib.error
|
||||
import urllib.request
|
||||
from os import environ
|
||||
from typing import Optional
|
||||
|
||||
|
|
@ -38,6 +38,7 @@ def is_ci_green(pr: dict) -> bool:
|
|||
return False
|
||||
return True
|
||||
|
||||
|
||||
def is_org_member(user: str, token: str) -> bool:
|
||||
url = "https://git.clan.lol/api/v1/orgs/clan/members/" + user + f"?token={token}"
|
||||
try:
|
||||
|
|
@ -50,7 +51,6 @@ def is_org_member(user: str, token: str) -> bool:
|
|||
raise
|
||||
|
||||
|
||||
|
||||
def merge_allowed(pr: dict, bot_name: str, token: str) -> bool:
|
||||
assignees = pr["assignees"] if pr["assignees"] else []
|
||||
if (
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
{ pkgs ? import <nixpkgs> { }
|
||||
, lib ? pkgs.lib
|
||||
, python3 ? pkgs.python3
|
||||
, ruff ? pkgs.ruff
|
||||
, runCommand ? pkgs.runCommand
|
||||
,
|
||||
{
|
||||
pkgs ? import <nixpkgs> { },
|
||||
lib ? pkgs.lib,
|
||||
python3 ? pkgs.python3,
|
||||
ruff ? pkgs.ruff,
|
||||
runCommand ? pkgs.runCommand,
|
||||
}:
|
||||
let
|
||||
pyproject = builtins.fromTOML (builtins.readFile ./pyproject.toml);
|
||||
|
|
@ -32,13 +32,11 @@ let
|
|||
package = python3.pkgs.buildPythonPackage {
|
||||
inherit name src;
|
||||
format = "pyproject";
|
||||
nativeBuildInputs = [
|
||||
python3.pkgs.setuptools
|
||||
];
|
||||
propagatedBuildInputs =
|
||||
dependencies
|
||||
++ [ ];
|
||||
passthru.tests = { inherit check; };
|
||||
nativeBuildInputs = [ python3.pkgs.setuptools ];
|
||||
propagatedBuildInputs = dependencies ++ [ ];
|
||||
passthru.tests = {
|
||||
inherit check;
|
||||
};
|
||||
passthru.devDependencies = devDependencies;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
{
|
||||
perSystem = { pkgs, ... }:
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
package = pkgs.callPackage ./default.nix { inherit pkgs; };
|
||||
in
|
||||
|
|
|
|||
|
|
@ -1,16 +1,11 @@
|
|||
{ pkgs ? import <nixpkgs> { } }:
|
||||
{
|
||||
pkgs ? import <nixpkgs> { },
|
||||
}:
|
||||
let
|
||||
inherit (pkgs) lib python3;
|
||||
package = import ./default.nix {
|
||||
inherit lib pkgs python3;
|
||||
};
|
||||
package = import ./default.nix { inherit lib pkgs python3; };
|
||||
pythonWithDeps = python3.withPackages (
|
||||
ps:
|
||||
package.propagatedBuildInputs
|
||||
++ package.devDependencies
|
||||
++ [
|
||||
ps.pip
|
||||
]
|
||||
ps: package.propagatedBuildInputs ++ package.devDependencies ++ [ ps.pip ]
|
||||
);
|
||||
checkScript = pkgs.writeScriptBin "check" ''
|
||||
nix build -f . tests -L "$@"
|
||||
|
|
|
|||
|
|
@ -112,4 +112,6 @@ def test_list_prs_to_merge(monkeypatch: pytest.MonkeyPatch) -> None:
|
|||
assignees=[dict(login=bot_name)],
|
||||
),
|
||||
]
|
||||
assert clan_merge.list_prs_to_merge(prs, bot_name=bot_name, gitea_token="test") == [prs[0]]
|
||||
assert clan_merge.list_prs_to_merge(prs, bot_name=bot_name, gitea_token="test") == [
|
||||
prs[0]
|
||||
]
|
||||
|
|
|
|||
|
|
@ -1,33 +1,38 @@
|
|||
{
|
||||
imports = [
|
||||
./clan-merge/flake-module.nix
|
||||
];
|
||||
perSystem = { pkgs, config, ... }: {
|
||||
packages =
|
||||
let
|
||||
writers = pkgs.callPackage ./writers.nix { };
|
||||
in
|
||||
{
|
||||
inherit (pkgs.callPackage ./renovate { }) renovate;
|
||||
gitea = pkgs.callPackage ./gitea { };
|
||||
imports = [ ./clan-merge/flake-module.nix ];
|
||||
perSystem =
|
||||
{ pkgs, config, ... }:
|
||||
{
|
||||
packages =
|
||||
let
|
||||
writers = pkgs.callPackage ./writers.nix { };
|
||||
in
|
||||
{
|
||||
inherit (pkgs.callPackage ./renovate { }) renovate;
|
||||
gitea = pkgs.callPackage ./gitea { };
|
||||
|
||||
action-create-pr = pkgs.callPackage ./action-create-pr {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
action-create-pr = pkgs.callPackage ./action-create-pr {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
};
|
||||
action-ensure-tea-login = pkgs.callPackage ./action-ensure-tea-login {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
};
|
||||
action-flake-update = pkgs.callPackage ./action-flake-update {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
};
|
||||
action-flake-update-pr-clan = pkgs.callPackage ./action-flake-update-pr-clan {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
inherit (config.packages) action-ensure-tea-login action-create-pr action-flake-update;
|
||||
};
|
||||
inherit
|
||||
(pkgs.callPackages ./job-flake-updates {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
inherit (config.packages) action-flake-update-pr-clan;
|
||||
})
|
||||
job-flake-update-clan-core
|
||||
job-flake-update-clan-homepage
|
||||
job-flake-update-clan-infra
|
||||
;
|
||||
};
|
||||
action-ensure-tea-login = pkgs.callPackage ./action-ensure-tea-login {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
};
|
||||
action-flake-update = pkgs.callPackage ./action-flake-update {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
};
|
||||
action-flake-update-pr-clan = pkgs.callPackage ./action-flake-update-pr-clan {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
inherit (config.packages) action-ensure-tea-login action-create-pr action-flake-update;
|
||||
};
|
||||
inherit (pkgs.callPackages ./job-flake-updates {
|
||||
inherit (writers) writePureShellScriptBin;
|
||||
inherit (config.packages) action-flake-update-pr-clan;
|
||||
}) job-flake-update-clan-core job-flake-update-clan-homepage job-flake-update-clan-infra;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
{ action-flake-update-pr-clan
|
||||
, writePureShellScriptBin
|
||||
}:
|
||||
{ action-flake-update-pr-clan, writePureShellScriptBin }:
|
||||
let
|
||||
job-flake-update = repo: writePureShellScriptBin "job-flake-update-${repo}" [ action-flake-update-pr-clan ] ''
|
||||
export REPO="gitea@git.clan.lol:clan/${repo}.git"
|
||||
export KEEP_VARS="REPO''${KEEP_VARS:+ $KEEP_VARS}"
|
||||
job-flake-update =
|
||||
repo:
|
||||
writePureShellScriptBin "job-flake-update-${repo}" [ action-flake-update-pr-clan ] ''
|
||||
export REPO="gitea@git.clan.lol:clan/${repo}.git"
|
||||
export KEEP_VARS="REPO''${KEEP_VARS:+ $KEEP_VARS}"
|
||||
|
||||
action-flake-update-pr-clan
|
||||
'';
|
||||
action-flake-update-pr-clan
|
||||
'';
|
||||
in
|
||||
{
|
||||
job-flake-update-clan-core = job-flake-update "clan-core";
|
||||
|
|
|
|||
|
|
@ -1,17 +1,32 @@
|
|||
# This file has been generated by node2nix 1.11.1. Do not edit!
|
||||
|
||||
{pkgs ? import <nixpkgs> {
|
||||
inherit system;
|
||||
}, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}:
|
||||
{
|
||||
pkgs ? import <nixpkgs> { inherit system; },
|
||||
system ? builtins.currentSystem,
|
||||
nodejs ? pkgs."nodejs_18",
|
||||
}:
|
||||
|
||||
let
|
||||
nodeEnv = import ./node-env.nix {
|
||||
inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
|
||||
inherit (pkgs)
|
||||
stdenv
|
||||
lib
|
||||
python2
|
||||
runCommand
|
||||
writeTextFile
|
||||
writeShellScript
|
||||
;
|
||||
inherit pkgs nodejs;
|
||||
libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
|
||||
};
|
||||
in
|
||||
import ./node-packages.nix {
|
||||
inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
|
||||
inherit (pkgs)
|
||||
fetchurl
|
||||
nix-gitignore
|
||||
stdenv
|
||||
lib
|
||||
fetchgit
|
||||
;
|
||||
inherit nodeEnv;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ pkgs, system, nodejs-18_x, makeWrapper }:
|
||||
{
|
||||
pkgs,
|
||||
system,
|
||||
nodejs-18_x,
|
||||
makeWrapper,
|
||||
}:
|
||||
let
|
||||
nodePackages = import ./composition.nix {
|
||||
inherit pkgs system;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,16 @@
|
|||
# This file originates from node2nix
|
||||
|
||||
{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
nodejs,
|
||||
python2,
|
||||
pkgs,
|
||||
libtool,
|
||||
runCommand,
|
||||
writeTextFile,
|
||||
writeShellScript,
|
||||
}:
|
||||
|
||||
let
|
||||
# Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
|
||||
|
|
@ -9,7 +19,7 @@ let
|
|||
python = if nodejs ? python then nodejs.python else python2;
|
||||
|
||||
# Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
|
||||
tarWrapper = runCommand "tarWrapper" {} ''
|
||||
tarWrapper = runCommand "tarWrapper" { } ''
|
||||
mkdir -p $out/bin
|
||||
|
||||
cat > $out/bin/tar <<EOF
|
||||
|
|
@ -22,7 +32,12 @@ let
|
|||
|
||||
# Function that generates a TGZ file from a NPM project
|
||||
buildNodeSourceDist =
|
||||
{ name, version, src, ... }:
|
||||
{
|
||||
name,
|
||||
version,
|
||||
src,
|
||||
...
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation {
|
||||
name = "node-tarball-${name}-${version}";
|
||||
|
|
@ -90,26 +105,31 @@ let
|
|||
# Bundle the dependencies of the package
|
||||
#
|
||||
# Only include dependencies if they don't exist. They may also be bundled in the package.
|
||||
includeDependencies = {dependencies}:
|
||||
lib.optionalString (dependencies != []) (
|
||||
includeDependencies =
|
||||
{ dependencies }:
|
||||
lib.optionalString (dependencies != [ ]) (
|
||||
''
|
||||
mkdir -p node_modules
|
||||
cd node_modules
|
||||
''
|
||||
+ (lib.concatMapStrings (dependency:
|
||||
''
|
||||
if [ ! -e "${dependency.packageName}" ]; then
|
||||
${composePackage dependency}
|
||||
fi
|
||||
''
|
||||
) dependencies)
|
||||
+ (lib.concatMapStrings (dependency: ''
|
||||
if [ ! -e "${dependency.packageName}" ]; then
|
||||
${composePackage dependency}
|
||||
fi
|
||||
'') dependencies)
|
||||
+ ''
|
||||
cd ..
|
||||
''
|
||||
);
|
||||
|
||||
# Recursively composes the dependencies of a package
|
||||
composePackage = { name, packageName, src, dependencies ? [], ... }@args:
|
||||
composePackage =
|
||||
{
|
||||
packageName,
|
||||
src,
|
||||
dependencies ? [ ],
|
||||
...
|
||||
}:
|
||||
builtins.addErrorContext "while evaluating node package '${packageName}'" ''
|
||||
installPackage "${packageName}" "${src}"
|
||||
${includeDependencies { inherit dependencies; }}
|
||||
|
|
@ -117,7 +137,8 @@ let
|
|||
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
|
||||
'';
|
||||
|
||||
pinpointDependencies = {dependencies, production}:
|
||||
pinpointDependencies =
|
||||
{ dependencies, production }:
|
||||
let
|
||||
pinpointDependenciesFromPackageJSON = writeTextFile {
|
||||
name = "pinpointDependencies.js";
|
||||
|
|
@ -179,22 +200,27 @@ let
|
|||
''
|
||||
node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
|
||||
|
||||
${lib.optionalString (dependencies != [])
|
||||
''
|
||||
if [ -d node_modules ]
|
||||
then
|
||||
cd node_modules
|
||||
${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
|
||||
cd ..
|
||||
fi
|
||||
''}
|
||||
${lib.optionalString (dependencies != [ ]) ''
|
||||
if [ -d node_modules ]
|
||||
then
|
||||
cd node_modules
|
||||
${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
|
||||
cd ..
|
||||
fi
|
||||
''}
|
||||
'';
|
||||
|
||||
# Recursively traverses all dependencies of a package and pinpoints all
|
||||
# dependencies in the package.json file to the versions that are actually
|
||||
# being used.
|
||||
|
||||
pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
|
||||
pinpointDependenciesOfPackage =
|
||||
{
|
||||
packageName,
|
||||
dependencies ? [ ],
|
||||
production ? true,
|
||||
...
|
||||
}:
|
||||
''
|
||||
if [ -d "${packageName}" ]
|
||||
then
|
||||
|
|
@ -207,7 +233,7 @@ let
|
|||
|
||||
# Extract the Node.js source code which is used to compile packages with
|
||||
# native bindings
|
||||
nodeSources = runCommand "node-sources" {} ''
|
||||
nodeSources = runCommand "node-sources" { } ''
|
||||
tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
|
||||
mv node-* $out
|
||||
'';
|
||||
|
|
@ -414,186 +440,236 @@ let
|
|||
'';
|
||||
};
|
||||
|
||||
prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
|
||||
prepareAndInvokeNPM =
|
||||
{
|
||||
packageName,
|
||||
bypassCache,
|
||||
reconstructLock,
|
||||
npmFlags,
|
||||
production,
|
||||
}:
|
||||
let
|
||||
forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
|
||||
in
|
||||
''
|
||||
# Pinpoint the versions of all dependencies to the ones that are actually being used
|
||||
echo "pinpointing versions of dependencies..."
|
||||
source $pinpointDependenciesScriptPath
|
||||
# Pinpoint the versions of all dependencies to the ones that are actually being used
|
||||
echo "pinpointing versions of dependencies..."
|
||||
source $pinpointDependenciesScriptPath
|
||||
|
||||
# Patch the shebangs of the bundled modules to prevent them from
|
||||
# calling executables outside the Nix store as much as possible
|
||||
patchShebangs .
|
||||
# Patch the shebangs of the bundled modules to prevent them from
|
||||
# calling executables outside the Nix store as much as possible
|
||||
patchShebangs .
|
||||
|
||||
# Deploy the Node.js package by running npm install. Since the
|
||||
# dependencies have been provided already by ourselves, it should not
|
||||
# attempt to install them again, which is good, because we want to make
|
||||
# it Nix's responsibility. If it needs to install any dependencies
|
||||
# anyway (e.g. because the dependency parameters are
|
||||
# incomplete/incorrect), it fails.
|
||||
#
|
||||
# The other responsibilities of NPM are kept -- version checks, build
|
||||
# steps, postprocessing etc.
|
||||
# Deploy the Node.js package by running npm install. Since the
|
||||
# dependencies have been provided already by ourselves, it should not
|
||||
# attempt to install them again, which is good, because we want to make
|
||||
# it Nix's responsibility. If it needs to install any dependencies
|
||||
# anyway (e.g. because the dependency parameters are
|
||||
# incomplete/incorrect), it fails.
|
||||
#
|
||||
# The other responsibilities of NPM are kept -- version checks, build
|
||||
# steps, postprocessing etc.
|
||||
|
||||
export HOME=$TMPDIR
|
||||
cd "${packageName}"
|
||||
runHook preRebuild
|
||||
export HOME=$TMPDIR
|
||||
cd "${packageName}"
|
||||
runHook preRebuild
|
||||
|
||||
${lib.optionalString bypassCache ''
|
||||
${lib.optionalString reconstructLock ''
|
||||
if [ -f package-lock.json ]
|
||||
then
|
||||
echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
|
||||
echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
|
||||
rm package-lock.json
|
||||
else
|
||||
echo "No package-lock.json file found, reconstructing..."
|
||||
fi
|
||||
${lib.optionalString bypassCache ''
|
||||
${lib.optionalString reconstructLock ''
|
||||
if [ -f package-lock.json ]
|
||||
then
|
||||
echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
|
||||
echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
|
||||
rm package-lock.json
|
||||
else
|
||||
echo "No package-lock.json file found, reconstructing..."
|
||||
fi
|
||||
|
||||
node ${reconstructPackageLock}
|
||||
''}
|
||||
|
||||
node ${addIntegrityFieldsScript}
|
||||
node ${reconstructPackageLock}
|
||||
''}
|
||||
|
||||
npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
|
||||
node ${addIntegrityFieldsScript}
|
||||
''}
|
||||
|
||||
runHook postRebuild
|
||||
npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
|
||||
|
||||
if [ "''${dontNpmInstall-}" != "1" ]
|
||||
then
|
||||
# NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
|
||||
rm -f npm-shrinkwrap.json
|
||||
runHook postRebuild
|
||||
|
||||
npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install
|
||||
fi
|
||||
if [ "''${dontNpmInstall-}" != "1" ]
|
||||
then
|
||||
# NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
|
||||
rm -f npm-shrinkwrap.json
|
||||
|
||||
# Link executables defined in package.json
|
||||
node ${linkBinsScript}
|
||||
npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install
|
||||
fi
|
||||
|
||||
# Link executables defined in package.json
|
||||
node ${linkBinsScript}
|
||||
'';
|
||||
|
||||
# Builds and composes an NPM package including all its dependencies
|
||||
buildNodePackage =
|
||||
{ name
|
||||
, packageName
|
||||
, version ? null
|
||||
, dependencies ? []
|
||||
, buildInputs ? []
|
||||
, production ? true
|
||||
, npmFlags ? ""
|
||||
, dontNpmInstall ? false
|
||||
, bypassCache ? false
|
||||
, reconstructLock ? false
|
||||
, preRebuild ? ""
|
||||
, dontStrip ? true
|
||||
, unpackPhase ? "true"
|
||||
, buildPhase ? "true"
|
||||
, meta ? {}
|
||||
, ... }@args:
|
||||
{
|
||||
name,
|
||||
packageName,
|
||||
version ? null,
|
||||
buildInputs ? [ ],
|
||||
production ? true,
|
||||
npmFlags ? "",
|
||||
dontNpmInstall ? false,
|
||||
bypassCache ? false,
|
||||
reconstructLock ? false,
|
||||
preRebuild ? "",
|
||||
dontStrip ? true,
|
||||
unpackPhase ? "true",
|
||||
buildPhase ? "true",
|
||||
meta ? { },
|
||||
...
|
||||
}@args:
|
||||
|
||||
let
|
||||
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
|
||||
extraArgs = removeAttrs args [
|
||||
"name"
|
||||
"dependencies"
|
||||
"buildInputs"
|
||||
"dontStrip"
|
||||
"dontNpmInstall"
|
||||
"preRebuild"
|
||||
"unpackPhase"
|
||||
"buildPhase"
|
||||
"meta"
|
||||
];
|
||||
in
|
||||
stdenv.mkDerivation ({
|
||||
name = "${name}${if version == null then "" else "-${version}"}";
|
||||
buildInputs = [ tarWrapper python nodejs ]
|
||||
++ lib.optional (stdenv.isLinux) utillinux
|
||||
++ lib.optional (stdenv.isDarwin) libtool
|
||||
++ buildInputs;
|
||||
stdenv.mkDerivation (
|
||||
{
|
||||
name = "${name}${if version == null then "" else "-${version}"}";
|
||||
buildInputs =
|
||||
[
|
||||
tarWrapper
|
||||
python
|
||||
nodejs
|
||||
]
|
||||
++ lib.optional (stdenv.isLinux) utillinux ++ lib.optional (stdenv.isDarwin) libtool ++ buildInputs;
|
||||
|
||||
inherit nodejs;
|
||||
inherit nodejs;
|
||||
|
||||
inherit dontStrip; # Stripping may fail a build for some package deployments
|
||||
inherit dontNpmInstall preRebuild unpackPhase buildPhase;
|
||||
inherit dontStrip; # Stripping may fail a build for some package deployments
|
||||
inherit
|
||||
dontNpmInstall
|
||||
preRebuild
|
||||
unpackPhase
|
||||
buildPhase
|
||||
;
|
||||
|
||||
compositionScript = composePackage args;
|
||||
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
|
||||
compositionScript = composePackage args;
|
||||
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
|
||||
|
||||
passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
|
||||
passAsFile = [
|
||||
"compositionScript"
|
||||
"pinpointDependenciesScript"
|
||||
];
|
||||
|
||||
installPhase = ''
|
||||
source ${installPackage}
|
||||
installPhase = ''
|
||||
source ${installPackage}
|
||||
|
||||
# Create and enter a root node_modules/ folder
|
||||
mkdir -p $out/lib/node_modules
|
||||
cd $out/lib/node_modules
|
||||
# Create and enter a root node_modules/ folder
|
||||
mkdir -p $out/lib/node_modules
|
||||
cd $out/lib/node_modules
|
||||
|
||||
# Compose the package and all its dependencies
|
||||
source $compositionScriptPath
|
||||
# Compose the package and all its dependencies
|
||||
source $compositionScriptPath
|
||||
|
||||
${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
|
||||
${prepareAndInvokeNPM {
|
||||
inherit
|
||||
packageName
|
||||
bypassCache
|
||||
reconstructLock
|
||||
npmFlags
|
||||
production
|
||||
;
|
||||
}}
|
||||
|
||||
# Create symlink to the deployed executable folder, if applicable
|
||||
if [ -d "$out/lib/node_modules/.bin" ]
|
||||
then
|
||||
ln -s $out/lib/node_modules/.bin $out/bin
|
||||
# Create symlink to the deployed executable folder, if applicable
|
||||
if [ -d "$out/lib/node_modules/.bin" ]
|
||||
then
|
||||
ln -s $out/lib/node_modules/.bin $out/bin
|
||||
|
||||
# Fixup all executables
|
||||
ls $out/bin/* | while read i
|
||||
do
|
||||
file="$(readlink -f "$i")"
|
||||
chmod u+rwx "$file"
|
||||
if isScript "$file"
|
||||
then
|
||||
sed -i 's/\r$//' "$file" # convert crlf to lf
|
||||
fi
|
||||
done
|
||||
fi
|
||||
# Fixup all executables
|
||||
ls $out/bin/* | while read i
|
||||
do
|
||||
file="$(readlink -f "$i")"
|
||||
chmod u+rwx "$file"
|
||||
if isScript "$file"
|
||||
then
|
||||
sed -i 's/\r$//' "$file" # convert crlf to lf
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Create symlinks to the deployed manual page folders, if applicable
|
||||
if [ -d "$out/lib/node_modules/${packageName}/man" ]
|
||||
then
|
||||
mkdir -p $out/share
|
||||
for dir in "$out/lib/node_modules/${packageName}/man/"*
|
||||
do
|
||||
mkdir -p $out/share/man/$(basename "$dir")
|
||||
for page in "$dir"/*
|
||||
do
|
||||
ln -s $page $out/share/man/$(basename "$dir")
|
||||
done
|
||||
done
|
||||
fi
|
||||
# Create symlinks to the deployed manual page folders, if applicable
|
||||
if [ -d "$out/lib/node_modules/${packageName}/man" ]
|
||||
then
|
||||
mkdir -p $out/share
|
||||
for dir in "$out/lib/node_modules/${packageName}/man/"*
|
||||
do
|
||||
mkdir -p $out/share/man/$(basename "$dir")
|
||||
for page in "$dir"/*
|
||||
do
|
||||
ln -s $page $out/share/man/$(basename "$dir")
|
||||
done
|
||||
done
|
||||
fi
|
||||
|
||||
# Run post install hook, if provided
|
||||
runHook postInstall
|
||||
'';
|
||||
# Run post install hook, if provided
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = {
|
||||
# default to Node.js' platforms
|
||||
platforms = nodejs.meta.platforms;
|
||||
} // meta;
|
||||
} // extraArgs);
|
||||
meta = {
|
||||
# default to Node.js' platforms
|
||||
platforms = nodejs.meta.platforms;
|
||||
} // meta;
|
||||
}
|
||||
// extraArgs
|
||||
);
|
||||
|
||||
# Builds a node environment (a node_modules folder and a set of binaries)
|
||||
buildNodeDependencies =
|
||||
{ name
|
||||
, packageName
|
||||
, version ? null
|
||||
, src
|
||||
, dependencies ? []
|
||||
, buildInputs ? []
|
||||
, production ? true
|
||||
, npmFlags ? ""
|
||||
, dontNpmInstall ? false
|
||||
, bypassCache ? false
|
||||
, reconstructLock ? false
|
||||
, dontStrip ? true
|
||||
, unpackPhase ? "true"
|
||||
, buildPhase ? "true"
|
||||
, ... }@args:
|
||||
{
|
||||
name,
|
||||
packageName,
|
||||
version ? null,
|
||||
src,
|
||||
dependencies ? [ ],
|
||||
buildInputs ? [ ],
|
||||
production ? true,
|
||||
npmFlags ? "",
|
||||
dontNpmInstall ? false,
|
||||
bypassCache ? false,
|
||||
reconstructLock ? false,
|
||||
dontStrip ? true,
|
||||
unpackPhase ? "true",
|
||||
buildPhase ? "true",
|
||||
...
|
||||
}@args:
|
||||
|
||||
let
|
||||
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
|
||||
extraArgs = removeAttrs args [
|
||||
"name"
|
||||
"dependencies"
|
||||
"buildInputs"
|
||||
];
|
||||
in
|
||||
stdenv.mkDerivation ({
|
||||
stdenv.mkDerivation (
|
||||
{
|
||||
name = "node-dependencies-${name}${if version == null then "" else "-${version}"}";
|
||||
|
||||
buildInputs = [ tarWrapper python nodejs ]
|
||||
++ lib.optional (stdenv.isLinux) utillinux
|
||||
++ lib.optional (stdenv.isDarwin) libtool
|
||||
++ buildInputs;
|
||||
buildInputs =
|
||||
[
|
||||
tarWrapper
|
||||
python
|
||||
nodejs
|
||||
]
|
||||
++ lib.optional (stdenv.isLinux) utillinux ++ lib.optional (stdenv.isDarwin) libtool ++ buildInputs;
|
||||
|
||||
inherit dontStrip; # Stripping may fail a build for some package deployments
|
||||
inherit dontNpmInstall unpackPhase buildPhase;
|
||||
|
|
@ -601,7 +677,10 @@ let
|
|||
includeScript = includeDependencies { inherit dependencies; };
|
||||
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
|
||||
|
||||
passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
|
||||
passAsFile = [
|
||||
"includeScript"
|
||||
"pinpointDependenciesScript"
|
||||
];
|
||||
|
||||
installPhase = ''
|
||||
source ${installPackage}
|
||||
|
|
@ -626,7 +705,15 @@ let
|
|||
cd ..
|
||||
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
|
||||
|
||||
${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
|
||||
${prepareAndInvokeNPM {
|
||||
inherit
|
||||
packageName
|
||||
bypassCache
|
||||
reconstructLock
|
||||
npmFlags
|
||||
production
|
||||
;
|
||||
}}
|
||||
|
||||
# Expose the executables that were installed
|
||||
cd ..
|
||||
|
|
@ -635,51 +722,59 @@ let
|
|||
mv ${packageName} lib
|
||||
ln -s $out/lib/node_modules/.bin $out/bin
|
||||
'';
|
||||
} // extraArgs);
|
||||
}
|
||||
// extraArgs
|
||||
);
|
||||
|
||||
# Builds a development shell
|
||||
buildNodeShell =
|
||||
{ name
|
||||
, packageName
|
||||
, version ? null
|
||||
, src
|
||||
, dependencies ? []
|
||||
, buildInputs ? []
|
||||
, production ? true
|
||||
, npmFlags ? ""
|
||||
, dontNpmInstall ? false
|
||||
, bypassCache ? false
|
||||
, reconstructLock ? false
|
||||
, dontStrip ? true
|
||||
, unpackPhase ? "true"
|
||||
, buildPhase ? "true"
|
||||
, ... }@args:
|
||||
{
|
||||
name,
|
||||
version ? null,
|
||||
dependencies ? [ ],
|
||||
buildInputs ? [ ],
|
||||
...
|
||||
}@args:
|
||||
|
||||
let
|
||||
nodeDependencies = buildNodeDependencies args;
|
||||
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ];
|
||||
extraArgs = removeAttrs args [
|
||||
"name"
|
||||
"dependencies"
|
||||
"buildInputs"
|
||||
"dontStrip"
|
||||
"dontNpmInstall"
|
||||
"unpackPhase"
|
||||
"buildPhase"
|
||||
];
|
||||
in
|
||||
stdenv.mkDerivation ({
|
||||
name = "node-shell-${name}${if version == null then "" else "-${version}"}";
|
||||
stdenv.mkDerivation (
|
||||
{
|
||||
name = "node-shell-${name}${if version == null then "" else "-${version}"}";
|
||||
|
||||
buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
|
||||
buildCommand = ''
|
||||
mkdir -p $out/bin
|
||||
cat > $out/bin/shell <<EOF
|
||||
#! ${stdenv.shell} -e
|
||||
$shellHook
|
||||
exec ${stdenv.shell}
|
||||
EOF
|
||||
chmod +x $out/bin/shell
|
||||
'';
|
||||
buildInputs = [
|
||||
python
|
||||
nodejs
|
||||
] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
|
||||
buildCommand = ''
|
||||
mkdir -p $out/bin
|
||||
cat > $out/bin/shell <<EOF
|
||||
#! ${stdenv.shell} -e
|
||||
$shellHook
|
||||
exec ${stdenv.shell}
|
||||
EOF
|
||||
chmod +x $out/bin/shell
|
||||
'';
|
||||
|
||||
# Provide the dependencies in a development shell through the NODE_PATH environment variable
|
||||
inherit nodeDependencies;
|
||||
shellHook = lib.optionalString (dependencies != []) ''
|
||||
export NODE_PATH=${nodeDependencies}/lib/node_modules
|
||||
export PATH="${nodeDependencies}/bin:$PATH"
|
||||
'';
|
||||
} // extraArgs);
|
||||
# Provide the dependencies in a development shell through the NODE_PATH environment variable
|
||||
inherit nodeDependencies;
|
||||
shellHook = lib.optionalString (dependencies != [ ]) ''
|
||||
export NODE_PATH=${nodeDependencies}/lib/node_modules
|
||||
export PATH="${nodeDependencies}/bin:$PATH"
|
||||
'';
|
||||
}
|
||||
// extraArgs
|
||||
);
|
||||
in
|
||||
{
|
||||
buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,12 +1,13 @@
|
|||
{ lib
|
||||
, bash
|
||||
, coreutils
|
||||
, gawk
|
||||
, path
|
||||
, # nixpkgs path
|
||||
writeScript
|
||||
, writeScriptBin
|
||||
, ...
|
||||
{
|
||||
lib,
|
||||
bash,
|
||||
coreutils,
|
||||
gawk,
|
||||
path,
|
||||
# nixpkgs path
|
||||
writeScript,
|
||||
writeScriptBin,
|
||||
...
|
||||
}:
|
||||
let
|
||||
# Create a script that runs in a `pure` environment, in the sense that:
|
||||
|
|
@ -18,12 +19,12 @@ let
|
|||
# - all environment variables are unset, except:
|
||||
# - the ones listed in `keepVars` defined in ./default.nix
|
||||
# - the ones listed via the `KEEP_VARS` variable
|
||||
writePureShellScript = PATH: script:
|
||||
writeScript "script.sh" (mkScript PATH script);
|
||||
writePureShellScript = PATH: script: writeScript "script.sh" (mkScript PATH script);
|
||||
|
||||
# Creates a script in a `bin/` directory in the output; suitable for use with `lib.makeBinPath`, etc.
|
||||
# See {option}`writers.writePureShellScript`
|
||||
writePureShellScriptBin = binName: PATH: script:
|
||||
writePureShellScriptBin =
|
||||
binName: PATH: script:
|
||||
writeScriptBin binName (mkScript PATH script);
|
||||
|
||||
mkScript = PATH: scriptText: ''
|
||||
|
|
@ -91,8 +92,5 @@ let
|
|||
'';
|
||||
in
|
||||
{
|
||||
inherit
|
||||
writePureShellScript
|
||||
writePureShellScriptBin
|
||||
;
|
||||
inherit writePureShellScript writePureShellScriptBin;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,13 +4,11 @@
|
|||
meta.name = "infra";
|
||||
directory = self;
|
||||
# Make flake available in modules
|
||||
specialArgs = {
|
||||
self = {
|
||||
inherit (self) inputs nixosModules packages;
|
||||
};
|
||||
specialArgs.self = {
|
||||
inherit (self) inputs nixosModules packages;
|
||||
};
|
||||
machines = {
|
||||
web01 = { modulesPath, ... }: {
|
||||
web01 = {
|
||||
imports = [ (./web01/configuration.nix) ];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user