Compare commits

..

No commits in common. "b9f631fc3bc6c2eb4d05ff848b83133626cc8971" and "aef414ffe84441ab4bc9f513a7e60ed0d7f8588f" have entirely different histories.

13 changed files with 58 additions and 98 deletions

View file

@ -21,29 +21,17 @@ jobs:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- run: nix-shell --run 'nix-unit ./deployment/data-model-test.nix' - run: nix-shell --run 'nix-unit ./deployment/data-model-test.nix'
check-mastodon:
runs-on: native
steps:
- uses: actions/checkout@v4
- run: nix build .#checks.x86_64-linux.test-mastodon-service -L
check-pixelfed:
runs-on: native
steps:
- uses: actions/checkout@v4
- run: nix build .#checks.x86_64-linux.test-pixelfed-garage-service -L
check-peertube: check-peertube:
runs-on: native runs-on: native
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- run: nix build .#checks.x86_64-linux.test-peertube-service -L - run: nix-build services -A tests.peertube
check-panel: check-panel:
runs-on: native runs-on: native
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- run: nix-build -A tests.panel - run: nix-build panel -A tests
check-deployment-basic: check-deployment-basic:
runs-on: native runs-on: native

View file

@ -12,7 +12,6 @@ let
inherit (pkgs) lib; inherit (pkgs) lib;
inherit (import sources.flake-inputs) import-flake; inherit (import sources.flake-inputs) import-flake;
inherit ((import-flake { src = ./.; }).inputs) nixops4; inherit ((import-flake { src = ./.; }).inputs) nixops4;
panel = import ./panel { inherit sources system; };
pre-commit-check = pre-commit-check =
(import "${git-hooks}/nix" { (import "${git-hooks}/nix" {
inherit nixpkgs system; inherit nixpkgs system;
@ -72,7 +71,6 @@ in
tests = { tests = {
inherit pre-commit-check; inherit pre-commit-check;
panel = panel.tests;
}; };
# re-export inputs so they can be overridden granularly # re-export inputs so they can be overridden granularly

View file

@ -17,20 +17,15 @@
./infra/flake-part.nix ./infra/flake-part.nix
./keys/flake-part.nix ./keys/flake-part.nix
./secrets/flake-part.nix ./secrets/flake-part.nix
./services/tests/flake-part.nix
]; ];
perSystem = perSystem =
{ {
pkgs, pkgs,
lib, lib,
system,
... ...
}: }:
{ {
checks = {
panel = (import ./. { inherit sources system; }).tests.panel.basic;
};
formatter = pkgs.nixfmt-rfc-style; formatter = pkgs.nixfmt-rfc-style;
pre-commit.settings.hooks = pre-commit.settings.hooks =

View file

@ -1,13 +1,14 @@
# Infra # Infra
This directory contains the definition of [the VMs](../machines/machines.md) that host our This directory contains the definition of [the VMs](machines.md) that host our
infrastructure. infrastructure.
## Provisioning VMs with an initial configuration ## Provisioning VMs with an initial configuration
> NOTE[Niols]: This is still very manual and clunky. Two things will happen: NOTE[Niols]: This is very manual and clunky. Two things will happen. In the near
> 1. In the near future, I will improve the provisioning script to make this a bit less clunky. future, I will improve the provisioning script to make this a bit less clunky.
> 2. In the far future, NixOps4 will be able to communicate with Proxmox directly and everything will become much cleaner. In the far future, NixOps4 will be able to communicate with Proxmox directly and
everything will become much cleaner.
1. Choose names for your VMs. It is recommended to choose `fediXXX`, with `XXX` 1. Choose names for your VMs. It is recommended to choose `fediXXX`, with `XXX`
above 100. For instance, `fedi117`. above 100. For instance, `fedi117`.
@ -24,7 +25,8 @@ infrastructure.
Those files need to exist during provisioning, but their content matters only Those files need to exist during provisioning, but their content matters only
when updating the machines' configuration. when updating the machines' configuration.
> FIXME: Remove this step by making the provisioning script not fail with the public key does not exist yet. FIXME: Remove this step by making the provisioning script not fail with the
public key does not exist yet.
3. Run the provisioning script: 3. Run the provisioning script:
``` ```
@ -42,7 +44,7 @@ infrastructure.
ssh fedi117.abundos.eu 'sudo cat /etc/ssh/ssh_host_ed25519_key.pub' > keys/systems/fedi117.pub ssh fedi117.abundos.eu 'sudo cat /etc/ssh/ssh_host_ed25519_key.pub' > keys/systems/fedi117.pub
``` ```
> FIXME: Make the provisioning script do that for us. FIXME: Make the provisioning script do that for us.
7. Regenerate the list of machines: 7. Regenerate the list of machines:
``` ```
@ -54,7 +56,7 @@ infrastructure.
just enough for it to boot and be reachable. Go on to the next section to just enough for it to boot and be reachable. Go on to the next section to
update the machine and put an actual configuration. update the machine and put an actual configuration.
> FIXME: Figure out why the full configuration isn't on the machine at this FIXME: Figure out why the full configuration isn't on the machine at this
point and fix it. point and fix it.
## Updating existing VM configurations ## Updating existing VM configurations

View file

@ -1,4 +1,15 @@
{ sources, ... }: let
# pulling this in manually over from module args resolves an infinite recursion.
# FIXME: instead untangle `//infra/flake-part.nix` and make it stop passing wild functions.
# move moving towards a portable-services-like pattern where some things are submodules.
# Right now those wild functions are for parameterising a bunch of things,
# and the modular way to do that would be options --
# obviously you can't use those for `imports`,
# so one way to decouple fixpoints is to isolate them into submodules.
# Therefore one approach would be to try to go down the call graph,
# and see where what's currently a function could be a `submodule` field of something else.
sources = import ../../npins;
in
{ {
_class = "nixos"; _class = "nixos";

View file

@ -27,6 +27,7 @@ let
_module.args = { _module.args = {
inherit inherit
inputs inputs
sources
keys keys
secrets secrets
; ;
@ -36,10 +37,6 @@ let
./common/proxmox-qemu-vm.nix ./common/proxmox-qemu-vm.nix
]; ];
nixos.specialArgs = {
inherit sources;
};
imports = imports =
[ [
./common/resource.nix ./common/resource.nix
@ -69,32 +66,17 @@ let
vmNames: vmNames:
{ providers, ... }: { providers, ... }:
{ {
# XXX: this type merge is for adding `specialArgs` to resource modules providers.local = inputs.nixops4.modules.nixops4Provider.local;
options.resources = mkOption { resources = genAttrs vmNames (vmName: {
type = type = providers.local.exec;
with lib.types; imports = [
lazyAttrsOf (submoduleWith { inputs.nixops4-nixos.modules.nixops4Resource.nixos
class = "nixops4Resource"; (makeResourceModule {
modules = [ ]; inherit vmName;
# TODO(@fricklerhandwerk): we may want to pass through all of `specialArgs` once we're sure it's sane isTestVm = false;
specialArgs = { })
inherit sources; ];
}; });
});
};
config = {
providers.local = inputs.nixops4.modules.nixops4Provider.local;
resources = genAttrs vmNames (vmName: {
type = providers.local.exec;
imports = [
inputs.nixops4-nixos.modules.nixops4Resource.nixos
(makeResourceModule {
inherit vmName;
isTestVm = false;
})
];
});
};
}; };
makeDeployment' = vmName: makeDeployment [ vmName ]; makeDeployment' = vmName: makeDeployment [ vmName ];

View file

@ -1,17 +1,17 @@
{ {
config, config,
sources,
... ...
}: }:
let let
name = "panel"; name = "panel";
sources = import ../../../npins;
in in
{ {
_class = "nixos"; _class = "nixos";
imports = [ imports = [
(../../../panel { }).module (import ../../../panel { }).module
("${sources.home-manager}/nixos") (import "${sources.home-manager}/nixos")
]; ];
security.acme = { security.acme = {

View file

@ -45,7 +45,7 @@ in
''; '';
}; };
module = ./nix/configuration.nix; module = import ./nix/configuration.nix;
tests = pkgs.callPackage ./nix/tests.nix { }; tests = pkgs.callPackage ./nix/tests.nix { };
# re-export inputs so they can be overridden granularly # re-export inputs so they can be overridden granularly

13
services/default.nix Normal file
View file

@ -0,0 +1,13 @@
{
system ? builtins.currentSystem,
sources ? import ../npins,
pkgs ? import sources.nixpkgs { inherit system; },
...
}:
{
tests = {
mastodon = pkgs.nixosTest ./tests/mastodon.nix;
pixelfed-garage = pkgs.nixosTest ./tests/pixelfed-garage.nix;
peertube = pkgs.nixosTest ./tests/peertube.nix;
};
}

View file

@ -49,7 +49,7 @@ in
displayName = mkOption { displayName = mkOption {
type = types.str; type = types.str;
description = "Name of the initial user, for humans"; description = "Name of the initial user, for humans";
default = config.fediversity.temp.initialUser.username; default = config.fediversity.temp.initialUser.name;
}; };
email = mkOption { email = mkOption {
type = types.str; type = types.str;

View file

@ -1,14 +0,0 @@
{ ... }:
{
_class = "flake";
perSystem =
{ pkgs, ... }:
{
checks = {
test-mastodon-service = pkgs.testers.runNixOSTest ./mastodon.nix;
test-pixelfed-garage-service = pkgs.testers.runNixOSTest ./pixelfed-garage.nix;
test-peertube-service = pkgs.testers.runNixOSTest ./peertube.nix;
};
};
}

View file

@ -6,7 +6,7 @@
{ pkgs, ... }: { pkgs, ... }:
let let
inherit (pkgs) lib writeText; lib = pkgs.lib;
## FIXME: this binding was not used, but maybe we want a side-effect or something? ## FIXME: this binding was not used, but maybe we want a side-effect or something?
# rebuildableTest = import ./rebuildableTest.nix pkgs; # rebuildableTest = import ./rebuildableTest.nix pkgs;
@ -69,17 +69,9 @@ in
expect expect
]; ];
environment.variables = { environment.variables = {
AWS_ACCESS_KEY_ID = "$(cat ${config.fediversity.mastodon.s3AccessKeyFile})"; AWS_ACCESS_KEY_ID = config.fediversity.garage.ensureKeys.mastodon.id;
AWS_SECRET_ACCESS_KEY = "$(cat ${config.fediversity.mastodon.s3SecretKeyFile})"; AWS_SECRET_ACCESS_KEY = config.fediversity.garage.ensureKeys.mastodon.secret;
}; };
services.mastodon.extraEnvFiles = [
# generate as: cd ${pkgs.mastodon}; IGNORE_ALREADY_SET_SECRETS=true RAILS_ENV=development ${pkgs.mastodon}/bin/rails db:encryption:init
(writeText "rest" ''
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=naGoEzeyjUmwIlmgZZmGQDWJrlWud5eX
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=A0tE1VJ7S3cjaOQ58mNkhrVFY7o5NKDB
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=tGHhd5Os7hLxa8QTzWwjyVLrvsj5VsCw
'')
];
}; };
}; };

View file

@ -113,7 +113,6 @@ let
${seleniumQuit}''; ${seleniumQuit}'';
dummyFile = pkgs.writeText "dummy" "dummy";
in in
{ {
name = "test-pixelfed-garage"; name = "test-pixelfed-garage";
@ -162,8 +161,8 @@ in
]; ];
environment.variables = { environment.variables = {
POST_MEDIA = ./fediversity.png; POST_MEDIA = ./fediversity.png;
AWS_ACCESS_KEY_ID = "$(cat ${config.fediversity.pixelfed.s3AccessKeyFile})"; AWS_ACCESS_KEY_ID = config.fediversity.garage.ensureKeys.pixelfed.id;
AWS_SECRET_ACCESS_KEY = "$(cat ${config.fediversity.pixelfed.s3SecretKeyFile})"; AWS_SECRET_ACCESS_KEY = config.fediversity.garage.ensureKeys.pixelfed.secret;
## without this we get frivolous errors in the logs ## without this we get frivolous errors in the logs
MC_REGION = "garage"; MC_REGION = "garage";
}; };
@ -171,12 +170,6 @@ in
users.users.selenium = { users.users.selenium = {
isNormalUser = true; isNormalUser = true;
}; };
fediversity.temp.initialUser = {
username = "dummy";
displayName = "dummy";
email = "dummy";
passwordFile = dummyFile;
};
}; };
}; };