kiara/Fediversity
1
0
Fork 0
forked from Fediversity/Fediversity
Code Pull requests Activity

fix resource mapping for the shell application

Browse source
This commit is contained in:
Valentin Gagarin 2025-07-25 12:46:37 +02:00
parent 8c571c2dbe
commit 37fd4d6642
2 changed files with 34 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
deployment/data-model-test.nix
View file

@ -43,11 +43,9 @@ in
extra-config = mkOption { extra-config = mkOption {
description = "Any options from NixOS"; description = "Any options from NixOS";
}; };
apply = mkOption {
type = with types; functionTo raw;
default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
};
}; };
config.resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
config.apply = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
}; };
}; };
resources.login-shell = { resources.login-shell = {
@ -83,17 +81,21 @@ in
default = false; default = false;
}; };
}; };
config.resource-type = types.any; # TODO: splice out the user type from NixOS config.resource-type = types.raw; # TODO: splice out the user type from NixOS
config.apply = config.apply =
requests: requests:
let let
# Filter out requests that need wheel if policy doesn't allow it # Filter out requests that need wheel if policy doesn't allow it
validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests; validRequests = lib.filterAttrs (
_name: req: !req.login-shell.wheel || config.wheel
) requests.resources;
in in
lib.optionalAttrs (validRequests != { }) { lib.optionalAttrs (validRequests != { }) {
${config.username} = { ${config.username} = {
isNormalUser = true; isNormalUser = true;
packages = with lib; concatMapAttrs (_name: request: attrValues request.packages) validRequests; packages =
with lib;
attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
extraGroups = lib.optional config.wheel "wheel"; extraGroups = lib.optional config.wheel "wheel";
}; };
}; };
@ -118,7 +120,7 @@ in
environments.single-nixos-vm = environments.single-nixos-vm =
{ config, ... }: { config, ... }:
{ {
resources.shell.login-shell.username = "operator"; resources.operator-environment.login-shell.username = "operator";
implementation = requests: { implementation = requests: {
input = requests; input = requests;
output = output =
@ -168,7 +170,21 @@ in
hello-package-exists = hello-package-exists =
(fediversity.applications.hello.resources example-configuration.applications.hello) (fediversity.applications.hello.resources example-configuration.applications.hello)
.resources.hello.login-shell.packages ? hello; .resources.hello.login-shell.packages ? hello;
inherit (fediversity) example-deployment; wheel-required =
(fediversity.applications.hello.resources example-configuration.applications.hello)
.resources.hello.login-shell.wheel;
wheel-allowed =
fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell.wheel;
operator-shell =
let
resources = fediversity.applications.hello.resources example-configuration.applications.hello;
users = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell.apply resources;
in
{
inherit (users.operator) isNormalUser;
packages = with lib; map (p: "${p.pname}") users.operator.packages;
extraGroups = users.operator.extraGroups;
};
}; };
expected = { expected = {
number-of-resources = 2; number-of-resources = 2;
@ -177,7 +193,13 @@ in
applications.hello.enable = true; applications.hello.enable = true;
}; };
hello-package-exists = true; hello-package-exists = true;
example-deployment = { }; wheel-required = false;
wheel-allowed = false;
operator-shell = {
isNormalUser = true;
packages = [ "hello" ];
extraGroups = [ ];
};
}; };
}; };
} }

3
deployment/data-model.nix
View file

@ -74,6 +74,7 @@ in
description = "The type of resource this policy configures"; description = "The type of resource this policy configures";
type = types.optionType; type = types.optionType;
}; };
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
options.apply = mkOption { options.apply = mkOption {
description = "Apply the policy to a request"; description = "Apply the policy to a request";
type = with types; functionTo policy.config.resource-type; type = with types; functionTo policy.config.resource-type;
@ -153,7 +154,7 @@ in
readOnly = true; readOnly = true;
default = { default = {
input-type = application-resources; input-type = application-resources;
output-type = nixops4Deployment; output-type = types.raw;
}; };
}; };
deployment = mkOption { deployment = mkOption {