deployment/data-model-test.nix

@@ -23,19 +23,98 @@ in
           { config, ... }:
           {
             config = {
-              resources.nixos = {
+              resources.login-shell = {
-                # TODO: consumer = ?
+                description = "The operator needs to be able to log into the shell";
-                # TODO: provider = ?
+                request =
-              };
+                  { ... }:
-              applications.hello = {
+                  {
-                description = ''Command-line tool that will print "Hello, world!" on the terminal'';
+                    _class = "fediversity-resource-request";
-                # TODO: module = ?
+                    options = {
-                # TODO: config=mapping = ?
+                      wheel = mkOption {
-              };
+                        description = "Whether the login user needs root permissions";
-              environments.single-nixos-vm = {
+                        type = types.bool;
-                # TODO: resources = ?
+                        default = false;
-                # TODO: resource-mapping = ?
+                      };
+                      packages = mkOption {
+                        description = "Packages that need to be available in the user environment";
+                        type = with types; attrsOf package;
+                      };
+                    };
+                  };
+                policy =
+                  { config, ... }:
+                  {
+                    _class = "fediversity-resource-policy";
+                    options = {
+                      username = mkOption {
+                        description = "Username for the operator";
+                        type = types.str; # TODO: use the proper constraints from NixOS
+                      };
+                      wheel = mkOption {
+                        description = "Whether to allow login with root permissions";
+                        type = types.bool;
+                        default = false;
+                      };
+                      apply = mkOption {
+                        type = with types; functionTo raw; # TODO: splice out the user type from NixOS
+                        default =
+                          requests:
+                          let
+                            # Filter out requests that need wheel if policy doesn't allow it
+                            validRequests = lib.filterAttrs (name: req: !req.wheel || config.wheel) requests;
+                          in
+                          lib.optionalAttrs (validRequests != { }) {
+                            ${config.username} = {
+                              isNormalUser = true;
+                              packages = with lib; concatMapAttrs (name: request: attrValues request.packages) validRequests;
+                              extraGroups = lib.optional config.wheel "wheel";
+                            };
+                          };
+                      };
+                    };
+                  };
               };
+              applications.hello =
+                { ... }:
+                {
+                  description = ''Command-line tool that will print "Hello, world!" on the terminal'';
+                  module =
+                    { ... }:
+                    {
+                      enable = lib.mkEnableOption "Hello in the shell";
+                    };
+                  implementation =
+                    cfg:
+                    lib.optionalAttrs cfg.enable {
+                      dummy.login-shell.packages.hello = pkgs.hello;
+                    };
+                };
+              environments.single-nixos-vm =
+                { config, ... }:
+                {
+                  resources.shell.login-shell.username = "operator";
+                  implementation =
+                    requests:
+                    { providers, ... }:
+                    {
+                      providers = {
+                        inherit (inputs.nixops4.modules.nixops4Provider) local;
+                      };
+                      resources.the-machine = {
+                        type = providers.local.exec;
+                        imports = [
+                          inputs.nixops4-nixos.modules.nixops4Resource.nixos
+                        ];
+                        nixos.module =
+                          { pkgs, ... }:
+                          {
+                            users.users = config.resources.shell.login-shell.apply (
+                              lib.filterAttrs (name: value: value ? login-shell) requests
+                            );
+                          };
+                      };
+                    };
+                };
             };
             options = {
               example-configuration = mkOption {
@@ -47,7 +126,7 @@ in
                 };
               };
               example-deployment = mkOption {
-                type = nixops4Deployment;
+                type = types.submodule nixops4Deployment;
                 readOnly = true;
                 default = config.environments.single-nixos-vm.deployment config.example-configuration;
               };
@@ -56,10 +135,9 @@ in
         );
       in
       {
-
+        inherit (fediversity) example-deployment;
-      };
-    expected =
-      {
       };
+    expected = {
+    };
   };
 }

deployment/data-model.nix

@@ -19,10 +19,11 @@ let
   functionType = import ./function.nix;
   application-resources = {
     options.resources = mkOption {
+      # TODO: maybe transpose, and group the resources by type instead
       type = attrsOf (
         attrTag (
           lib.mapAttrs' (name: resource: {
-            ${name} = mkOption { type = resource.consumer; };
+            ${name} = mkOption { type = resource.request; };
           }) config.resources
         )
       );
@@ -33,20 +34,33 @@ in
 {
   options = {
     resources = mkOption {
-      description = "Collection of deployment resources that can be configured by hosting providers and required by applications";
+      description = "Collection of deployment resources that can be required by applications and policed by hosting providers";
       type = attrsOf (
         submodule (
           { config, ... }:
           {
             _class = "fediversity-resource";
             options = {
-              consumer = mkOption {
+              description = mkOption {
-                description = "Options for declaring resource requirements by an application, a description of how the resource is consumed";
+                description = "Description of the resource to help application module authors and hosting providers to work with it";
-                type = deferredModuleWith { staticModules = [ { _class = "fediversity-resource-consumer"; } ]; };
+                type = types.str;
               };
-              provider = mkOption {
+              request = mkOption {
-                description = "Options for configuring the resource for the hosting provider, a description of how the resource is made available";
+                description = "Options for declaring resource requirements by an application, a description of how the resource is consumed or accessed";
-                type = deferredModuleWith { staticModules = [ { _class = "fediversity-resource-provider"; } ]; };
+                type = deferredModuleWith { staticModules = [ { _class = "fediversity-resource-request"; } ]; };
+              };
+              policy = mkOption {
+                description = "Options for configuring the resource policy for the hosting provider, a description of how the resource is made available";
+                type = deferredModuleWith {
+                  staticModules = [
+                    {
+                      _class = "fediversity-resource-policy";
+                      options.apply = mkOption {
+                        desciption = "Apply the policy to a request";
+                      };
+                    }
+                  ];
+                };
               };
             };
           }
@@ -97,11 +111,16 @@ in
           _class = "fediversity-environment";
           options = {
             resources = mkOption {
-              description = "Resources made available by the hosting provider";
+              description = ''
+                Resources made available by the hosting provider, and their policies.
+
+                Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
+              '';
+              # TODO: maybe transpose, and group the resources by type instead
               type = attrsOf (
                 attrTag (
                   lib.mapAttrs' (name: resource: {
-                    ${name} = mkOption { type = resource.provider; };
+                    ${name} = mkOption { type = resource.policy; };
                   }) config.resources
                 )
               );
@@ -144,10 +163,8 @@ in
       readOnly = true;
       default = submodule (configuration: {
         options = {
-          enable = mkOption {
+          enable = lib.mkEnableOption {
-            description = "Whether to enable the configuration";
+            description = "your Fediversity configuration";
-            type = types.bool;
-            default = false;
           };
           applications = lib.mapAttrs (
             name: application:

deployment/function.nix

@@ -1,7 +1,16 @@
 /**
   Modular function type
 */
-{ config, ... }:
+{ config, lib, ... }:
+let
+  inherit (lib) mkOption types;
+  inherit (types)
+    deferredModule
+    submodule
+    functionTo
+    optionType
+    ;
+in
 {
   options = {
     input-type = mkOption {