forked from fediversity/fediversity
Compare commits
2 commits
37fd4d6642
...
0599a33916
Author | SHA1 | Date | |
---|---|---|---|
0599a33916 | |||
312ca7a48b |
2 changed files with 52 additions and 15 deletions
|
@ -14,6 +14,7 @@ let
|
||||||
];
|
];
|
||||||
}).config;
|
}).config;
|
||||||
nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
|
nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
|
||||||
|
inherit (inputs.nixops4.lib) mkDeployment;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
test-eval = {
|
test-eval = {
|
||||||
|
@ -43,11 +44,9 @@ in
|
||||||
extra-config = mkOption {
|
extra-config = mkOption {
|
||||||
description = "Any options from NixOS";
|
description = "Any options from NixOS";
|
||||||
};
|
};
|
||||||
apply = mkOption {
|
|
||||||
type = with types; functionTo raw;
|
|
||||||
default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
config.resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
|
||||||
|
config.apply = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
resources.login-shell = {
|
resources.login-shell = {
|
||||||
|
@ -83,17 +82,21 @@ in
|
||||||
default = false;
|
default = false;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
config.resource-type = types.any; # TODO: splice out the user type from NixOS
|
config.resource-type = types.raw; # TODO: splice out the user type from NixOS
|
||||||
config.apply =
|
config.apply =
|
||||||
requests:
|
requests:
|
||||||
let
|
let
|
||||||
# Filter out requests that need wheel if policy doesn't allow it
|
# Filter out requests that need wheel if policy doesn't allow it
|
||||||
validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
|
validRequests = lib.filterAttrs (
|
||||||
|
_name: req: !req.login-shell.wheel || config.wheel
|
||||||
|
) requests.resources;
|
||||||
in
|
in
|
||||||
lib.optionalAttrs (validRequests != { }) {
|
lib.optionalAttrs (validRequests != { }) {
|
||||||
${config.username} = {
|
${config.username} = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
packages = with lib; concatMapAttrs (_name: request: attrValues request.packages) validRequests;
|
packages =
|
||||||
|
with lib;
|
||||||
|
attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
|
||||||
extraGroups = lib.optional config.wheel "wheel";
|
extraGroups = lib.optional config.wheel "wheel";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -118,7 +121,7 @@ in
|
||||||
environments.single-nixos-vm =
|
environments.single-nixos-vm =
|
||||||
{ config, ... }:
|
{ config, ... }:
|
||||||
{
|
{
|
||||||
resources.shell.login-shell.username = "operator";
|
resources.operator-environment.login-shell.username = "operator";
|
||||||
implementation = requests: {
|
implementation = requests: {
|
||||||
input = requests;
|
input = requests;
|
||||||
output =
|
output =
|
||||||
|
@ -161,14 +164,37 @@ in
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
|
resources = fediversity.applications.hello.resources fediversity.example-configuration.applications.hello;
|
||||||
|
hello-shell = (resources).resources.hello.login-shell;
|
||||||
|
environment = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell;
|
||||||
|
result = mkDeployment {
|
||||||
|
modules = [
|
||||||
|
(fediversity.environments.single-nixos-vm.deployment fediversity.example-configuration)
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
in
|
in
|
||||||
rec {
|
rec {
|
||||||
number-of-resources = with lib; length (attrNames fediversity.resources);
|
number-of-resources = with lib; length (attrNames fediversity.resources);
|
||||||
inherit (fediversity) example-configuration;
|
inherit (fediversity) example-configuration;
|
||||||
hello-package-exists =
|
hello-package-exists = hello-shell.packages ? hello;
|
||||||
(fediversity.applications.hello.resources example-configuration.applications.hello)
|
wheel-required = hello-shell.wheel;
|
||||||
.resources.hello.login-shell.packages ? hello;
|
wheel-allowed = environment.wheel;
|
||||||
inherit (fediversity) example-deployment;
|
operator-shell =
|
||||||
|
let
|
||||||
|
operator = (environment.apply resources).operator;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
inherit (operator) isNormalUser;
|
||||||
|
packages = with lib; map (p: "${p.pname}") operator.packages;
|
||||||
|
extraGroups = operator.extraGroups;
|
||||||
|
};
|
||||||
|
deployment = {
|
||||||
|
inherit (result) _type;
|
||||||
|
deploymentFunction = lib.isFunction result.deploymentFunction;
|
||||||
|
# XXX(@fricklerhandwerk): evaluating the derivation takes a bit, we may want to stop at `isFunction` here
|
||||||
|
getProviders = lib.isDerivation (result.getProviders { system = builtins.currentSystem; });
|
||||||
|
};
|
||||||
};
|
};
|
||||||
expected = {
|
expected = {
|
||||||
number-of-resources = 2;
|
number-of-resources = 2;
|
||||||
|
@ -177,7 +203,18 @@ in
|
||||||
applications.hello.enable = true;
|
applications.hello.enable = true;
|
||||||
};
|
};
|
||||||
hello-package-exists = true;
|
hello-package-exists = true;
|
||||||
example-deployment = { };
|
wheel-required = false;
|
||||||
|
wheel-allowed = false;
|
||||||
|
operator-shell = {
|
||||||
|
isNormalUser = true;
|
||||||
|
packages = [ "hello" ];
|
||||||
|
extraGroups = [ ];
|
||||||
|
};
|
||||||
|
deployment = {
|
||||||
|
_type = "nixops4Deployment";
|
||||||
|
deploymentFunction = true;
|
||||||
|
getProviders = true;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -10,7 +10,6 @@ let
|
||||||
attrsOf
|
attrsOf
|
||||||
attrTag
|
attrTag
|
||||||
deferredModuleWith
|
deferredModuleWith
|
||||||
submoduleWith
|
|
||||||
submodule
|
submodule
|
||||||
optionType
|
optionType
|
||||||
functionTo
|
functionTo
|
||||||
|
@ -74,6 +73,7 @@ in
|
||||||
description = "The type of resource this policy configures";
|
description = "The type of resource this policy configures";
|
||||||
type = types.optionType;
|
type = types.optionType;
|
||||||
};
|
};
|
||||||
|
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
|
||||||
options.apply = mkOption {
|
options.apply = mkOption {
|
||||||
description = "Apply the policy to a request";
|
description = "Apply the policy to a request";
|
||||||
type = with types; functionTo policy.config.resource-type;
|
type = with types; functionTo policy.config.resource-type;
|
||||||
|
@ -158,7 +158,7 @@ in
|
||||||
};
|
};
|
||||||
deployment = mkOption {
|
deployment = mkOption {
|
||||||
description = "Generate a deployment from a configuration";
|
description = "Generate a deployment from a configuration";
|
||||||
type = functionTo (submodule environment.config.resource-mapping.output-type);
|
type = functionTo (environment.config.resource-mapping.output-type);
|
||||||
readOnly = true;
|
readOnly = true;
|
||||||
default =
|
default =
|
||||||
cfg:
|
cfg:
|
||||||
|
|
Loading…
Add table
Reference in a new issue