forked from fediversity/fediversity
Compare commits
No commits in common. "753dd0e0371fa87ec456bd8355962d188eab325b" and "0f7da573926331240dae97debb86af952b2f6487" have entirely different histories.
753dd0e037
...
0f7da57392
3 changed files with 65 additions and 119 deletions
|
|
@ -43,9 +43,11 @@ in
|
|||
extra-config = mkOption {
|
||||
description = "Any options from NixOS";
|
||||
};
|
||||
apply = mkOption {
|
||||
type = with types; functionTo raw;
|
||||
default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
|
||||
};
|
||||
};
|
||||
config.resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
|
||||
config.apply = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
|
||||
};
|
||||
};
|
||||
resources.login-shell = {
|
||||
|
|
@ -80,27 +82,25 @@ in
|
|||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
config.resource-type = types.raw; # TODO: splice out the user type from NixOS
|
||||
config.apply =
|
||||
apply = mkOption {
|
||||
type = with types; functionTo raw; # TODO: splice out the user type from NixOS
|
||||
default =
|
||||
requests:
|
||||
let
|
||||
# Filter out requests that need wheel if policy doesn't allow it
|
||||
validRequests = lib.filterAttrs (
|
||||
_name: req: !req.login-shell.wheel || config.wheel
|
||||
) requests.resources;
|
||||
validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
|
||||
in
|
||||
lib.optionalAttrs (validRequests != { }) {
|
||||
${config.username} = {
|
||||
isNormalUser = true;
|
||||
packages =
|
||||
with lib;
|
||||
attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
|
||||
packages = with lib; concatMapAttrs (_name: request: attrValues request.packages) validRequests;
|
||||
extraGroups = lib.optional config.wheel "wheel";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
applications.hello =
|
||||
{ ... }:
|
||||
{
|
||||
|
|
@ -108,22 +108,20 @@ in
|
|||
module =
|
||||
{ ... }:
|
||||
{
|
||||
options.enable = lib.mkEnableOption "Hello in the shell";
|
||||
};
|
||||
implementation = cfg: {
|
||||
input = cfg;
|
||||
output = lib.optionalAttrs cfg.enable {
|
||||
resources.hello.login-shell.packages.hello = pkgs.hello;
|
||||
enable = lib.mkEnableOption "Hello in the shell";
|
||||
};
|
||||
implementation =
|
||||
cfg:
|
||||
lib.optionalAttrs cfg.enable {
|
||||
dummy.login-shell.packages.hello = pkgs.hello;
|
||||
};
|
||||
};
|
||||
environments.single-nixos-vm =
|
||||
{ config, ... }:
|
||||
{
|
||||
resources.operator-environment.login-shell.username = "operator";
|
||||
implementation = requests: {
|
||||
input = requests;
|
||||
output =
|
||||
resources.shell.login-shell.username = "operator";
|
||||
implementation =
|
||||
requests:
|
||||
{ providers, ... }:
|
||||
{
|
||||
providers = {
|
||||
|
|
@ -145,7 +143,6 @@ in
|
|||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
options = {
|
||||
example-configuration = mkOption {
|
||||
type = config.configuration;
|
||||
|
|
@ -164,42 +161,11 @@ in
|
|||
}
|
||||
);
|
||||
in
|
||||
rec {
|
||||
number-of-resources = with lib; length (attrNames fediversity.resources);
|
||||
inherit (fediversity) example-configuration;
|
||||
hello-package-exists =
|
||||
(fediversity.applications.hello.resources example-configuration.applications.hello)
|
||||
.resources.hello.login-shell.packages ? hello;
|
||||
wheel-required =
|
||||
(fediversity.applications.hello.resources example-configuration.applications.hello)
|
||||
.resources.hello.login-shell.wheel;
|
||||
wheel-allowed =
|
||||
fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell.wheel;
|
||||
operator-shell =
|
||||
let
|
||||
resources = fediversity.applications.hello.resources example-configuration.applications.hello;
|
||||
users = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell.apply resources;
|
||||
in
|
||||
{
|
||||
inherit (users.operator) isNormalUser;
|
||||
packages = with lib; map (p: "${p.pname}") users.operator.packages;
|
||||
extraGroups = users.operator.extraGroups;
|
||||
};
|
||||
};
|
||||
expected = {
|
||||
number-of-resources = 2;
|
||||
example-configuration = {
|
||||
enable = true;
|
||||
applications.hello.enable = true;
|
||||
};
|
||||
hello-package-exists = true;
|
||||
wheel-required = false;
|
||||
wheel-allowed = false;
|
||||
operator-shell = {
|
||||
isNormalUser = true;
|
||||
packages = [ "hello" ];
|
||||
extraGroups = [ ];
|
||||
inherit (fediversity) example-deployment;
|
||||
};
|
||||
expected =
|
||||
{
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,28 +17,19 @@ let
|
|||
;
|
||||
|
||||
functionType = import ./function.nix;
|
||||
application-resources = submodule {
|
||||
application-resources = {
|
||||
options.resources = mkOption {
|
||||
# TODO: maybe transpose, and group the resources by type instead
|
||||
type = attrsOf (
|
||||
attrTag (
|
||||
lib.mapAttrs (_name: resource: mkOption { type = submodule resource.request; }) config.resources
|
||||
lib.mapAttrs' (name: resource: {
|
||||
${name} = mkOption { type = resource.request; };
|
||||
}) config.resources
|
||||
)
|
||||
);
|
||||
};
|
||||
};
|
||||
nixops4Deployment = types.deferredModuleWith {
|
||||
staticModules = [
|
||||
inputs.nixops4.modules.nixops4Deployment.default
|
||||
|
||||
{
|
||||
_module.args = {
|
||||
resourceProviderSystem = builtins.currentSystem;
|
||||
resources = { };
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
|
|
@ -62,24 +53,12 @@ in
|
|||
description = "Options for configuring the resource policy for the hosting provider, a description of how the resource is made available";
|
||||
type = deferredModuleWith {
|
||||
staticModules = [
|
||||
(policy: {
|
||||
{
|
||||
_class = "fediversity-resource-policy";
|
||||
# TODO(@fricklerhandwerk): not sure it can be made
|
||||
# sensible syntactically, but essentially we want to
|
||||
# ensure that `apply` is defined, but since its output
|
||||
# depends on the specific policy we also need to
|
||||
# determine that somehow.
|
||||
# hopefully this also helps with correct composition down the line.
|
||||
options.resource-type = mkOption {
|
||||
description = "The type of resource this policy configures";
|
||||
type = types.optionType;
|
||||
};
|
||||
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
|
||||
options.apply = mkOption {
|
||||
description = "Apply the policy to a request";
|
||||
type = with types; functionTo policy.config.resource-type;
|
||||
};
|
||||
})
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
@ -117,7 +96,7 @@ in
|
|||
type = submodule functionType;
|
||||
readOnly = true;
|
||||
default = {
|
||||
input-type = submodule application.config.module;
|
||||
input-type = application.config.module;
|
||||
output-type = application-resources;
|
||||
};
|
||||
};
|
||||
|
|
@ -154,12 +133,12 @@ in
|
|||
readOnly = true;
|
||||
default = {
|
||||
input-type = application-resources;
|
||||
output-type = types.raw;
|
||||
output-type = nixops4Deployment;
|
||||
};
|
||||
};
|
||||
deployment = mkOption {
|
||||
description = "Generate a deployment from a configuration";
|
||||
type = functionTo environment.config.resource-mapping.output-type;
|
||||
type = functionTo (submodule environment.config.resource-mapping.output-type);
|
||||
readOnly = true;
|
||||
default =
|
||||
cfg:
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@
|
|||
let
|
||||
inherit (lib) mkOption types;
|
||||
inherit (types)
|
||||
deferredModule
|
||||
submodule
|
||||
functionTo
|
||||
optionType
|
||||
|
|
@ -13,10 +14,10 @@ in
|
|||
{
|
||||
options = {
|
||||
input-type = mkOption {
|
||||
type = optionType;
|
||||
type = deferredModule;
|
||||
};
|
||||
output-type = mkOption {
|
||||
type = optionType;
|
||||
type = deferredModule;
|
||||
};
|
||||
function-type = mkOption {
|
||||
type = optionType;
|
||||
|
|
@ -25,10 +26,10 @@ in
|
|||
submodule (function: {
|
||||
options = {
|
||||
input = mkOption {
|
||||
type = config.input-type;
|
||||
type = submodule config.input-type;
|
||||
};
|
||||
output = mkOption {
|
||||
type = config.output-type;
|
||||
type = submodule config.output-type;
|
||||
};
|
||||
};
|
||||
})
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue