Compare commits

..

6 commits

Author SHA1 Message Date
bf488f89e1 readability 2025-07-22 12:43:32 +02:00
7066b2cb69 use mapAttrs right, again 2025-07-22 12:42:08 +02:00
243ef4425b WIP: more type-safe policy application 2025-07-22 12:38:50 +02:00
0f7da57392 use submodule to turn module into type for functionTo 2025-07-22 10:57:32 +02:00
bb93d2d0de use mapAttrs right
`mapAttrs'` takes two args rather than a set, whereas if only the val
changes `mapAttrs (_: v: ...)` should do
2025-07-22 10:54:43 +02:00
b25ddac298 fix typos, lint, format 2025-07-22 10:54:27 +02:00
2 changed files with 44 additions and 40 deletions

View file

@ -40,7 +40,7 @@ in
_class = "fediversity-resource-policy";
options = {
extra-config = mkOptions {
extra-config = mkOption {
description = "Any options from NixOS";
};
apply = mkOption {
@ -82,23 +82,21 @@ in
type = types.bool;
default = false;
};
apply = mkOption {
type = with types; functionTo raw; # TODO: splice out the user type from NixOS
default =
requests:
let
# Filter out requests that need wheel if policy doesn't allow it
validRequests = lib.filterAttrs (name: req: !req.wheel || config.wheel) requests;
in
lib.optionalAttrs (validRequests != { }) {
${config.username} = {
isNormalUser = true;
packages = with lib; concatMapAttrs (name: request: attrValues request.packages) validRequests;
extraGroups = lib.optional config.wheel "wheel";
};
};
};
};
config.resource-type = types.any; # TODO: splice out the user type from NixOS
config.apply =
requests:
let
# Filter out requests that need wheel if policy doesn't allow it
validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
in
lib.optionalAttrs (validRequests != { }) {
${config.username} = {
isNormalUser = true;
packages = with lib; concatMapAttrs (_name: request: attrValues request.packages) validRequests;
extraGroups = lib.optional config.wheel "wheel";
};
};
};
};
applications.hello =
@ -113,7 +111,9 @@ in
implementation =
cfg:
lib.optionalAttrs cfg.enable {
dummy.login-shell.packages.hello = pkgs.hello;
hello.login-shell.packages = {
inherit (pkgs) hello;
};
};
};
environments.single-nixos-vm =
@ -133,10 +133,10 @@ in
inputs.nixops4-nixos.modules.nixops4Resource.nixos
];
nixos.module =
{ pkgs, ... }:
{ ... }:
{
users.users = config.resources.shell.login-shell.apply (
lib.filterAttrs (name: value: value ? login-shell) requests
lib.filterAttrs (_name: value: value ? login-shell) requests
);
};
};
@ -164,8 +164,7 @@ in
{
inherit (fediversity) example-deployment;
};
expected =
{
};
expected = {
};
};
}

View file

@ -21,11 +21,7 @@ let
options.resources = mkOption {
# TODO: maybe transpose, and group the resources by type instead
type = attrsOf (
attrTag (
lib.mapAttrs' (name: resource: {
${name} = mkOption { type = resource.request; };
}) config.resources
)
attrTag (lib.mapAttrs (_name: resource: mkOption { type = resource.request; }) config.resources)
);
};
};
@ -37,7 +33,7 @@ in
description = "Collection of deployment resources that can be required by applications and policed by hosting providers";
type = attrsOf (
submodule (
{ config, ... }:
{ ... }:
{
_class = "fediversity-resource";
options = {
@ -53,12 +49,23 @@ in
description = "Options for configuring the resource policy for the hosting provider, a description of how the resource is made available";
type = deferredModuleWith {
staticModules = [
{
(policy: {
_class = "fediversity-resource-policy";
options.apply = mkOption {
desciption = "Apply the policy to a request";
# TODO(@fricklerhandwerk): not sure it can be made
# sensible syntactically, but essentially we want to
# ensure that `apply` is defined, but since its output
# depends on the specific policy we also need to
# determine that somehow.
# hopefully this also helps with correct composition down the line.
options.resource-type = mkOption {
description = "The type of resource this policy configures";
type = types.optionType;
};
}
options.apply = mkOption {
description = "Apply the policy to a request";
type = with types; functionTo policy.config.resource-type;
};
})
];
};
};
@ -119,9 +126,7 @@ in
# TODO: maybe transpose, and group the resources by type instead
type = attrsOf (
attrTag (
lib.mapAttrs' (name: resource: {
${name} = mkOption { type = resource.policy; };
}) config.resources
lib.mapAttrs (_name: resource: mkOption { type = submodule resource.policy; }) config.resources
)
);
};
@ -140,7 +145,7 @@ in
};
deployment = mkOption {
description = "Generate a deployment from a configuration";
type = functionTo environment.config.resource-mapping.output-type;
type = functionTo (submodule environment.config.resource-mapping.output-type);
readOnly = true;
default =
cfg:
@ -161,13 +166,13 @@ in
description = "Configuration type declaring options to be set by operators";
type = optionType;
readOnly = true;
default = submodule (configuration: {
default = submodule {
options = {
enable = lib.mkEnableOption {
description = "your Fediversity configuration";
};
applications = lib.mapAttrs (
name: application:
_name: application:
mkOption {
description = application.description;
type = submodule application.module;
@ -175,7 +180,7 @@ in
}
) config.applications;
};
});
};
};
};
}