deployment/check/data-model/deployment.nix

@@ -1,17 +1,11 @@
 {
+  inputs,
+  lib,
   config,
-  system,
-  inputs ? (import ../../../default.nix { }).inputs,
-  sources ? import ../../../npins,
   ...
 }:
 
 let
-  inherit (sources) nixpkgs;
-  pkgs = import nixpkgs { inherit system; };
-  inherit (pkgs) lib;
-  deployment-config = config;
-  inherit (lib) mkOption types;
   eval =
     module:
     (lib.evalModules {
@@ -24,128 +18,34 @@ let
       ];
     }).config;
   fediversity = eval (
-    { config, ... }:
+    { ... }:
     {
       config = {
-        resources.login-shell = {
+        environments.single-nixos-vm =
-          description = "The operator needs to be able to log into the shell";
-          request =
-            { ... }:
-            {
-              _class = "fediversity-resource-request";
-              options = {
-                wheel = mkOption {
-                  description = "Whether the login user needs root permissions";
-                  type = types.bool;
-                  default = false;
-                };
-                packages = mkOption {
-                  description = "Packages that need to be available in the user environment";
-                  type = with types; attrsOf package;
-                };
-              };
-            };
-          policy =
-            { config, ... }:
-            {
-              _class = "fediversity-resource-policy";
-              options = {
-                username = mkOption {
-                  description = "Username for the operator";
-                  type = types.str; # TODO: use the proper constraints from NixOS
-                };
-                wheel = mkOption {
-                  description = "Whether to allow login with root permissions";
-                  type = types.bool;
-                  default = false;
-                };
-              };
-              config = {
-                resource-type = types.raw; # TODO: splice out the user type from NixOS
-                apply =
-                  requests:
-                  let
-                    # Filter out requests that need wheel if policy doesn't allow it
-                    validRequests = lib.filterAttrs (
-                      _name: req: !req.login-shell.wheel || config.wheel
-                    ) requests.resources;
-                  in
-                  lib.optionalAttrs (validRequests != { }) {
-                    ${config.username} = {
-                      isNormalUser = true;
-                      packages =
-                        with lib;
-                        attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
-                      extraGroups = lib.optional config.wheel "wheel";
-                    };
-                  };
-              };
-            };
-        };
-        applications.hello =
           { ... }:
           {
-            description = ''Command-line tool that will print "Hello, world!" on the terminal'';
+            implementation = requests: {
-            module =
+              input = requests;
-              { ... }:
+              output.ssh-host = {
-              {
+                ssh = {
-                options.enable = lib.mkEnableOption "Hello in the shell";
+                  host = "localhost";
-              };
+                  username = "root";
-            implementation = cfg: {
+                  authentication.password = "password";
-              input = cfg;
-              output = lib.optionalAttrs cfg.enable {
-                resources.hello.login-shell.packages.hello = pkgs.hello;
-              };
-            };
-          };
-        environments.single-nixos-vm = environment: {
-          resources."operator-environment".login-shell.username = "operator";
-          implementation = requests: {
-            input = requests;
-            output.ssh-host = {
-              ssh = {
-                username = "root";
-                inherit (deployment-config) host;
-                key-file = null;
-              };
-              nixos-configuration =
-                { ... }:
-                {
-                  imports = [
-                    ./options.nix
-                    ../common/sharedOptions.nix
-                    ../common/targetNode.nix
-                    "${nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
-                  ];
-
-                  inherit (deployment-config) enableAcme;
-                  acmeNodeIP =
-                    if deployment-config.enableAcme then
-                      deployment-config.nodes.acme.networking.primaryIPAddress
-                    else
-                      null;
-
-                  users.users = environment.config.resources."operator-environment".login-shell.apply {
-                    resources = lib.filterAttrs (_name: value: value ? login-shell) requests;
-                  };
                 };
+                nixos-configuration =
+                  { ... }:
+                  {
+                    users.users = config.resources.shell.login-shell.apply (
+                      lib.filterAttrs (_name: value: value ? login-shell) requests
+                    );
+                  };
+              };
             };
           };
-        };
-      };
-      options = {
-        "example-configuration" = mkOption {
-          type = config.configuration;
-          default = {
-            enable = true;
-            applications.hello.enable = true;
-          };
-        };
-        "example-deployment" = mkOption {
-          default = config.environments.single-nixos-vm.deployment config."example-configuration";
-        };
       };
     }
   );
 in
-fediversity."example-deployment"
+fediversity.environments.single-nixos-vm.deployment {
+  enable = true;
+}

deployment/check/data-model/nixosTest.nix

@@ -1,19 +1,13 @@
 {
   lib,
   config,
-  pkgs,
   ...
 }:
 let
   inherit (import ./constants.nix) targetMachines pathToRoot;
-  escapedJson = v: lib.replaceStrings [ "\"" ] [ "\\\\\"" ] (lib.strings.toJSON v);
 in
 {
   _class = "nixosTest";
-  imports = [
-    ./options.nix
-  ];
-
   name = "deployment-model";
   sourceFileset = lib.fileset.unions [
     ../../data-model.nix
@@ -39,76 +33,57 @@ in
 
   extraTestScript = ''
     ${lib.concatStringsSep "\n" (
-      lib.lists.map (
+      lib.lists.map (nodeName: ''
-        nodeName:
+        with subtest("Check the status before deployment"):
-        let
+          ${nodeName}.fail("${nodeName} 1>&2")
-          deployment-config = {
+
-            inherit (config) enableAcme;
+        with subtest("Run the deployment for ${nodeName}"):
-            acmeNodeIP = if config.enableAcme then config.nodes.acme.networking.primaryIPAddress else null;
+          deployer.succeed("""
-            host = nodeName;
+            set -euo pipefail
-          };
+
-          inherit
+            # INSTANTIATE
-            ((import ./deployment.nix {
+            command=(nix-instantiate --expr '
-              inherit (pkgs) system;
+              let
-              config = deployment-config;
+                configuration = { pkgs, config, ... }: {
-            }).ssh-host.ssh
+                  imports = [
+                    ${pathToRoot}/deployment/check/common/sharedOptions.nix
+                    ${pathToRoot}/deployment/check/common/targetNode.nix
+                  ];
+                  enableAcme = ${lib.strings.toJSON config.enableAcme};
+                  acmeNodeIP = if config.enableAcme then config.nodes.acme.networking.primaryIPAddress else null;
+                  environment.systemPackages = with pkgs; [
+                    hello
+                  ];
+                };
+              in
+              import ${pathToRoot}/deployment/nixos.nix { inherit configuration; }
+            ')
+            # DEPLOY
+            host="root@${nodeName}"
+            sshOpts=(
+              -o StrictHostKeyChecking=no
+              -o "ConnectTimeout=1"
+              -o "ServerAliveInterval=1"
             )
-            host
+            # instantiate the config in /nix/store
-            username
+            "''${command[@]}" -A out_path
-            key-file
+            # get the realized derivation to deploy
-            ;
+            outPath=$(nix-store --realize "$("''${command[@]}" --eval --strict --json | jq -r '.drv_path')")
-        in
+            # deploy the config by nix-copy-closure
-        ''
+            NIX_SSHOPTS="''${sshOpts[*]}" nix-copy-closure --to "$host" "$outPath" --gzip --use-substitutes
-          with subtest("Check the status before deployment"):
+            # switch the remote host to the config
-            ${nodeName}.fail("${nodeName} 1>&2")
+            output=$(ssh "''${sshOpts[@]}" "$host" "nix-env --profile /nix/var/nix/profiles/system --set $outPath; nohup $outPath/bin/switch-to-configuration switch &" 2>&1) || echo "status code: $?"
-
+            echo "output: $output"
-          with subtest("Run the deployment for ${nodeName}"):
+            if [[ $output != *"Timeout, server ${nodeName} not responding"* ]]; then
-            deployer.succeed("""
+              echo "non-timeout error: $output"
-              set -euo pipefail
+              exit 1
-
+            else
-              # INSTANTIATE
+              exit 0
-              command=(nix-instantiate --show-trace --expr '
+            fi
-                let
+          """)
-                  system = "${pkgs.system}"; # FIXME: what system are we deploying to?
+          ${nodeName}.wait_for_unit("multi-user.target")
-                in
+          ${nodeName}.succeed("${nodeName} 1>&2")
-                import ${pathToRoot}/deployment/nixos.nix {
+      '') targetMachines
-                  inherit system;
-                  configuration = (
-                    import ${pathToRoot}/deployment/check/data-model/deployment.nix {
-                      inherit system;
-                      config = builtins.fromJSON "${escapedJson deployment-config}";
-                    }
-                  ).ssh-host.nixos-configuration;
-                }
-              ')
-              # DEPLOY
-              host="${lib.defaultTo "root" username}@${host}"
-              sshOpts=(
-                ${if key-file == null then "" else "-i ${key-file}"}
-                -o StrictHostKeyChecking=no
-                -o "ConnectTimeout=1"
-                -o "ServerAliveInterval=1"
-              )
-              # instantiate the config in /nix/store
-              "''${command[@]}" --show-trace -A out_path
-              # get the realized derivation to deploy
-              outPath=$(nix-store --realize "$("''${command[@]}" --show-trace --eval --strict --json | jq -r '.drv_path')")
-              # deploy the config by nix-copy-closure
-              NIX_SSHOPTS="''${sshOpts[*]}" nix-copy-closure --to "$host" "$outPath" --gzip --use-substitutes
-              # switch the remote host to the config
-              output=$(ssh "''${sshOpts[@]}" "$host" "nix-env --profile /nix/var/nix/profiles/system --set $outPath; nohup $outPath/bin/switch-to-configuration switch &" 2>&1) || echo "status code: $?"
-              echo "output: $output"
-              if [[ $output != *"Timeout, server ${nodeName} not responding"* ]]; then
-                echo "non-timeout error: $output"
-                exit 1
-              else
-                exit 0
-              fi
-            """)
-            ${nodeName}.wait_for_unit("multi-user.target")
-            ${nodeName}.succeed("su - operator -c ${nodeName} 1>&2")
-        ''
-      ) targetMachines
     )}
   '';
 }

deployment/check/data-model/options.nix

@@ -1,15 +0,0 @@
-{
-  lib,
-  ...
-}:
-let
-  inherit (lib) types;
-in
-{
-  options = {
-    host = lib.mkOption {
-      type = types.str;
-      description = "name of the host to deploy to";
-    };
-  };
-}

deployment/data-model-test.nix

@@ -108,7 +108,7 @@ in
               environments.single-nixos-vm =
                 { config, ... }:
                 {
-                  resources."operator-environment".login-shell.username = "operator";
+                  resources.operator-environment.login-shell.username = "operator";
                   implementation = requests: {
                     input = requests;
                     output.nixops4 =
@@ -125,9 +125,9 @@ in
                           nixos.module =
                             { ... }:
                             {
-                              users.users = config.resources."operator-environment".login-shell.apply {
+                              users.users = config.resources.shell.login-shell.apply (
-                                resources = lib.filterAttrs (_name: value: value ? login-shell) requests;
+                                lib.filterAttrs (_name: value: value ? login-shell) requests
-                              };
+                              );
                             };
                         };
                       };
@@ -135,7 +135,7 @@ in
                 };
             };
             options = {
-              "example-configuration" = mkOption {
+              example-configuration = mkOption {
                 type = config.configuration;
                 readOnly = true;
                 default = {
@@ -143,22 +143,20 @@ in
                   applications.hello.enable = true;
                 };
               };
-              "example-deployment" = mkOption {
+              example-deployment = mkOption {
                 type = options.deployments.nestedType;
                 readOnly = true;
-                default = config.environments.single-nixos-vm.deployment config."example-configuration";
+                default = config.environments.single-nixos-vm.deployment config.example-configuration;
               };
             };
           }
         );
-        resources =
+        resources = fediversity.applications.hello.resources fediversity.example-configuration.applications.hello;
-          fediversity.applications.hello.resources
-            fediversity."example-configuration".applications.hello;
         hello-shell = resources.resources.hello.login-shell;
-        environment = fediversity.environments.single-nixos-vm.resources."operator-environment".login-shell;
+        environment = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell;
         result = mkDeployment {
           modules = [
-            (fediversity.environments.single-nixos-vm.deployment fediversity."example-configuration")
+            (fediversity.environments.single-nixos-vm.deployment fediversity.example-configuration)
           ];
         };
 

deployment/data-model.nix

@@ -45,16 +45,26 @@ let
           type = nullOr str;
           default = null;
         };
-        key-file = mkOption {
+        authentication = mkOption {
-          description = "path to the user's SSH private key";
+          description = "authentication method";
-          type = nullOr str;
+          type = attrTag {
-          example = "/root/.ssh/id_ed25519";
+            private-key = mkOption {
+              description = "path to the user's SSH private key";
+              type = str;
+              example = "/root/.ssh/id_ed25519";
+            };
+            password = mkOption {
+              description = "SSH password";
+              # TODO: mark as sensitive
+              type = str;
+            };
+          };
         };
       };
     };
   };
-  deployment-type = attrTag {
+  deployment = attrTag {
-    ssh-host = mkOption {
+    ssh-host = {
       description = "A Terraform deployment by SSH to update a single existing NixOS host.";
       type = submodule {
         options = {
@@ -175,7 +185,7 @@ in
               readOnly = true;
               default = {
                 input-type = application-resources;
-                output-type = deployment-type;
+                output-type = deployment;
               };
             };
             # TODO(@fricklerhandwerk): maybe this should be a separate thing such as `fediversity-setup`,

deployment/nixos.nix

@@ -1,9 +1,9 @@
 {
   configuration,
-  system,
+  system ? builtins.currentSystem,
-  sources ? import ../npins,
 }:
 let
+  sources = import ../npins;
   eval = import "${sources.nixpkgs}/nixos/lib/eval-config.nix" {
     inherit system;
     specialArgs = {