Revert "simpler data model, not sure it's desirable but at least it's consistent"

This reverts commit ede5b4db11.

deployment/check/data-model/deployment.nix

@@ -1,11 +1,17 @@
 {
-  inputs,
-  lib,
   config,
+  system,
+  inputs ? (import ../../../default.nix { }).inputs,
+  sources ? import ../../../npins,
   ...
 }:
 
 let
+  inherit (sources) nixpkgs;
+  pkgs = import nixpkgs { inherit system; };
+  inherit (pkgs) lib;
+  deployment-config = config;
+  inherit (lib) mkOption types;
   eval =
     module:
     (lib.evalModules {
@@ -18,34 +24,128 @@ let
       ];
     }).config;
   fediversity = eval (
-    { ... }:
+    { config, ... }:
     {
       config = {
-        environments.single-nixos-vm =
-          { ... }:
-          {
-            implementation = requests: {
-              input = requests;
-              output.ssh-host = {
-                ssh = {
-                  host = "localhost";
-                  username = "root";
-                  authentication.password = "password";
+        resources.login-shell = {
+          description = "The operator needs to be able to log into the shell";
+          request =
+            { ... }:
+            {
+              _class = "fediversity-resource-request";
+              options = {
+                wheel = mkOption {
+                  description = "Whether the login user needs root permissions";
+                  type = types.bool;
+                  default = false;
                 };
-                nixos-configuration =
-                  { ... }:
-                  {
-                    users.users = config.resources.shell.login-shell.apply (
-                      lib.filterAttrs (_name: value: value ? login-shell) requests
-                    );
+                packages = mkOption {
+                  description = "Packages that need to be available in the user environment";
+                  type = with types; attrsOf package;
+                };
+              };
+            };
+          policy =
+            { config, ... }:
+            {
+              _class = "fediversity-resource-policy";
+              options = {
+                username = mkOption {
+                  description = "Username for the operator";
+                  type = types.str; # TODO: use the proper constraints from NixOS
+                };
+                wheel = mkOption {
+                  description = "Whether to allow login with root permissions";
+                  type = types.bool;
+                  default = false;
+                };
+              };
+              config = {
+                resource-type = types.raw; # TODO: splice out the user type from NixOS
+                apply =
+                  requests:
+                  let
+                    # Filter out requests that need wheel if policy doesn't allow it
+                    validRequests = lib.filterAttrs (
+                      _name: req: !req.login-shell.wheel || config.wheel
+                    ) requests.resources;
+                  in
+                  lib.optionalAttrs (validRequests != { }) {
+                    ${config.username} = {
+                      isNormalUser = true;
+                      packages =
+                        with lib;
+                        attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
+                      extraGroups = lib.optional config.wheel "wheel";
+                    };
                   };
               };
             };
+        };
+        applications.hello =
+          { ... }:
+          {
+            description = ''Command-line tool that will print "Hello, world!" on the terminal'';
+            module =
+              { ... }:
+              {
+                options.enable = lib.mkEnableOption "Hello in the shell";
+              };
+            implementation = cfg: {
+              input = cfg;
+              output = lib.optionalAttrs cfg.enable {
+                resources.hello.login-shell.packages.hello = pkgs.hello;
+              };
+            };
           };
+        environments.single-nixos-vm = environment: {
+          resources."operator-environment".login-shell.username = "operator";
+          implementation = requests: {
+            input = requests;
+            output.ssh-host = {
+              ssh = {
+                username = "root";
+                inherit (deployment-config) host;
+                key-file = null;
+              };
+              nixos-configuration =
+                { ... }:
+                {
+                  imports = [
+                    ./options.nix
+                    ../common/sharedOptions.nix
+                    ../common/targetNode.nix
+                    "${nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
+                  ];
+
+                  inherit (deployment-config) enableAcme;
+                  acmeNodeIP =
+                    if deployment-config.enableAcme then
+                      deployment-config.nodes.acme.networking.primaryIPAddress
+                    else
+                      null;
+
+                  users.users = environment.config.resources."operator-environment".login-shell.apply {
+                    resources = lib.filterAttrs (_name: value: value ? login-shell) requests;
+                  };
+                };
+            };
+          };
+        };
+      };
+      options = {
+        "example-configuration" = mkOption {
+          type = config.configuration;
+          default = {
+            enable = true;
+            applications.hello.enable = true;
+          };
+        };
+        "example-deployment" = mkOption {
+          default = config.environments.single-nixos-vm.deployment config."example-configuration";
+        };
       };
     }
   );
 in
-fediversity.environments.single-nixos-vm.deployment {
-  enable = true;
-}
+fediversity."example-deployment"

deployment/check/data-model/nixosTest.nix

@@ -1,13 +1,19 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 let
   inherit (import ./constants.nix) targetMachines pathToRoot;
+  escapedJson = v: lib.replaceStrings [ "\"" ] [ "\\\\\"" ] (lib.strings.toJSON v);
 in
 {
   _class = "nixosTest";
+  imports = [
+    ./options.nix
+  ];
+
   name = "deployment-model";
   sourceFileset = lib.fileset.unions [
     ../../data-model.nix
@@ -33,57 +39,76 @@ in
 
   extraTestScript = ''
     ${lib.concatStringsSep "\n" (
-      lib.lists.map (nodeName: ''
-        with subtest("Check the status before deployment"):
-          ${nodeName}.fail("${nodeName} 1>&2")
-
-        with subtest("Run the deployment for ${nodeName}"):
-          deployer.succeed("""
-            set -euo pipefail
-
-            # INSTANTIATE
-            command=(nix-instantiate --expr '
-              let
-                configuration = { pkgs, config, ... }: {
-                  imports = [
-                    ${pathToRoot}/deployment/check/common/sharedOptions.nix
-                    ${pathToRoot}/deployment/check/common/targetNode.nix
-                  ];
-                  enableAcme = ${lib.strings.toJSON config.enableAcme};
-                  acmeNodeIP = if config.enableAcme then config.nodes.acme.networking.primaryIPAddress else null;
-                  environment.systemPackages = with pkgs; [
-                    hello
-                  ];
-                };
-              in
-              import ${pathToRoot}/deployment/nixos.nix { inherit configuration; }
-            ')
-            # DEPLOY
-            host="root@${nodeName}"
-            sshOpts=(
-              -o StrictHostKeyChecking=no
-              -o "ConnectTimeout=1"
-              -o "ServerAliveInterval=1"
+      lib.lists.map (
+        nodeName:
+        let
+          deployment-config = {
+            inherit (config) enableAcme;
+            acmeNodeIP = if config.enableAcme then config.nodes.acme.networking.primaryIPAddress else null;
+            host = nodeName;
+          };
+          inherit
+            ((import ./deployment.nix {
+              inherit (pkgs) system;
+              config = deployment-config;
+            }).ssh-host.ssh
             )
-            # instantiate the config in /nix/store
-            "''${command[@]}" -A out_path
-            # get the realized derivation to deploy
-            outPath=$(nix-store --realize "$("''${command[@]}" --eval --strict --json | jq -r '.drv_path')")
-            # deploy the config by nix-copy-closure
-            NIX_SSHOPTS="''${sshOpts[*]}" nix-copy-closure --to "$host" "$outPath" --gzip --use-substitutes
-            # switch the remote host to the config
-            output=$(ssh "''${sshOpts[@]}" "$host" "nix-env --profile /nix/var/nix/profiles/system --set $outPath; nohup $outPath/bin/switch-to-configuration switch &" 2>&1) || echo "status code: $?"
-            echo "output: $output"
-            if [[ $output != *"Timeout, server ${nodeName} not responding"* ]]; then
-              echo "non-timeout error: $output"
-              exit 1
-            else
-              exit 0
-            fi
-          """)
-          ${nodeName}.wait_for_unit("multi-user.target")
-          ${nodeName}.succeed("${nodeName} 1>&2")
-      '') targetMachines
+            host
+            username
+            key-file
+            ;
+        in
+        ''
+          with subtest("Check the status before deployment"):
+            ${nodeName}.fail("${nodeName} 1>&2")
+
+          with subtest("Run the deployment for ${nodeName}"):
+            deployer.succeed("""
+              set -euo pipefail
+
+              # INSTANTIATE
+              command=(nix-instantiate --show-trace --expr '
+                let
+                  system = "${pkgs.system}"; # FIXME: what system are we deploying to?
+                in
+                import ${pathToRoot}/deployment/nixos.nix {
+                  inherit system;
+                  configuration = (
+                    import ${pathToRoot}/deployment/check/data-model/deployment.nix {
+                      inherit system;
+                      config = builtins.fromJSON "${escapedJson deployment-config}";
+                    }
+                  ).ssh-host.nixos-configuration;
+                }
+              ')
+              # DEPLOY
+              host="${lib.defaultTo "root" username}@${host}"
+              sshOpts=(
+                ${if key-file == null then "" else "-i ${key-file}"}
+                -o StrictHostKeyChecking=no
+                -o "ConnectTimeout=1"
+                -o "ServerAliveInterval=1"
+              )
+              # instantiate the config in /nix/store
+              "''${command[@]}" --show-trace -A out_path
+              # get the realized derivation to deploy
+              outPath=$(nix-store --realize "$("''${command[@]}" --show-trace --eval --strict --json | jq -r '.drv_path')")
+              # deploy the config by nix-copy-closure
+              NIX_SSHOPTS="''${sshOpts[*]}" nix-copy-closure --to "$host" "$outPath" --gzip --use-substitutes
+              # switch the remote host to the config
+              output=$(ssh "''${sshOpts[@]}" "$host" "nix-env --profile /nix/var/nix/profiles/system --set $outPath; nohup $outPath/bin/switch-to-configuration switch &" 2>&1) || echo "status code: $?"
+              echo "output: $output"
+              if [[ $output != *"Timeout, server ${nodeName} not responding"* ]]; then
+                echo "non-timeout error: $output"
+                exit 1
+              else
+                exit 0
+              fi
+            """)
+            ${nodeName}.wait_for_unit("multi-user.target")
+            ${nodeName}.succeed("su - operator -c ${nodeName} 1>&2")
+        ''
+      ) targetMachines
     )}
   '';
 }

deployment/check/data-model/options.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+in
+{
+  options = {
+    host = lib.mkOption {
+      type = types.str;
+      description = "name of the host to deploy to";
+    };
+  };
+}

deployment/data-model-test.nix

@@ -108,7 +108,7 @@ in
               environments.single-nixos-vm =
                 { config, ... }:
                 {
-                  resources.operator-environment.login-shell.username = "operator";
+                  resources."operator-environment".login-shell.username = "operator";
                   implementation = requests: {
                     input = requests;
                     output.nixops4 =
@@ -125,9 +125,9 @@ in
                           nixos.module =
                             { ... }:
                             {
-                              users.users = config.resources.shell.login-shell.apply (
-                                lib.filterAttrs (_name: value: value ? login-shell) requests
-                              );
+                              users.users = config.resources."operator-environment".login-shell.apply {
+                                resources = lib.filterAttrs (_name: value: value ? login-shell) requests;
+                              };
                             };
                         };
                       };
@@ -135,7 +135,7 @@ in
                 };
             };
             options = {
-              example-configuration = mkOption {
+              "example-configuration" = mkOption {
                 type = config.configuration;
                 readOnly = true;
                 default = {
@@ -143,20 +143,22 @@ in
                   applications.hello.enable = true;
                 };
               };
-              example-deployment = mkOption {
+              "example-deployment" = mkOption {
                 type = options.deployments.nestedType;
                 readOnly = true;
-                default = config.environments.single-nixos-vm.deployment config.example-configuration;
+                default = config.environments.single-nixos-vm.deployment config."example-configuration";
               };
             };
           }
         );
-        resources = fediversity.applications.hello.resources fediversity.example-configuration.applications.hello;
+        resources =
+          fediversity.applications.hello.resources
+            fediversity."example-configuration".applications.hello;
         hello-shell = resources.resources.hello.login-shell;
-        environment = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell;
+        environment = fediversity.environments.single-nixos-vm.resources."operator-environment".login-shell;
         result = mkDeployment {
           modules = [
-            (fediversity.environments.single-nixos-vm.deployment fediversity.example-configuration)
+            (fediversity.environments.single-nixos-vm.deployment fediversity."example-configuration")
           ];
         };
 

deployment/data-model.nix

@@ -45,26 +45,16 @@ let
           type = nullOr str;
           default = null;
         };
-        authentication = mkOption {
-          description = "authentication method";
-          type = attrTag {
-            private-key = mkOption {
-              description = "path to the user's SSH private key";
-              type = str;
-              example = "/root/.ssh/id_ed25519";
-            };
-            password = mkOption {
-              description = "SSH password";
-              # TODO: mark as sensitive
-              type = str;
-            };
-          };
+        key-file = mkOption {
+          description = "path to the user's SSH private key";
+          type = nullOr str;
+          example = "/root/.ssh/id_ed25519";
         };
       };
     };
   };
-  deployment = attrTag {
-    ssh-host = {
+  deployment-type = attrTag {
+    ssh-host = mkOption {
       description = "A Terraform deployment by SSH to update a single existing NixOS host.";
       type = submodule {
         options = {
@@ -185,7 +175,7 @@ in
               readOnly = true;
               default = {
                 input-type = application-resources;
-                output-type = deployment;
+                output-type = deployment-type;
               };
             };
             # TODO(@fricklerhandwerk): maybe this should be a separate thing such as `fediversity-setup`,

deployment/nixos.nix

@@ -1,9 +1,9 @@
 {
   configuration,
-  system ? builtins.currentSystem,
+  system,
+  sources ? import ../npins,
 }:
 let
-  sources = import ../npins;
   eval = import "${sources.nixpkgs}/nixos/lib/eval-config.nix" {
     inherit system;
     specialArgs = {