forked from fediversity/fediversity
Compare commits
9 commits
d713083feb
...
aa877b7678
| Author | SHA1 | Date | |
|---|---|---|---|
aa877b7678
|
|||
|
39f39c3ff7
|
|||
|
cc8f55b193
|
|||
|
ce51aa6809
|
|||
|
228365cdf0
|
|||
|
c8882e32f6
|
|||
|
d7e4830bd7
|
|||
|
286f0c245e
|
|||
|
44c0a548a8
|
3 changed files with 85 additions and 95 deletions
|
|
@ -11,7 +11,6 @@ let
|
|||
;
|
||||
inherit (pkgs) lib;
|
||||
inherit (import sources.flake-inputs) import-flake;
|
||||
inputs = (import-flake { src = ./.; }).inputs;
|
||||
inherit ((import-flake { src = ./.; }).inputs) nixops4;
|
||||
panel = import ./panel { inherit sources system; };
|
||||
pre-commit-check =
|
||||
|
|
@ -79,7 +78,6 @@ in
|
|||
# re-export inputs so they can be overridden granularly
|
||||
# (they can't be accessed from the outside any other way)
|
||||
inherit
|
||||
inputs
|
||||
sources
|
||||
system
|
||||
pkgs
|
||||
|
|
|
|||
|
|
@ -7,15 +7,12 @@ let
|
|||
(lib.evalModules {
|
||||
specialArgs = {
|
||||
inherit inputs;
|
||||
# to be passed to nixops4Deployment
|
||||
resourceProviderSystem = builtins.currentSystem;
|
||||
};
|
||||
modules = [
|
||||
module
|
||||
./data-model.nix
|
||||
];
|
||||
}).config;
|
||||
nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
|
||||
in
|
||||
{
|
||||
_class = "nix-unit";
|
||||
|
|
@ -40,7 +37,7 @@ in
|
|||
};
|
||||
|
||||
policy =
|
||||
{ config, ... }:
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-resource-policy";
|
||||
|
||||
|
|
@ -48,10 +45,10 @@ in
|
|||
extra-config = mkOption {
|
||||
description = "Any options from NixOS";
|
||||
};
|
||||
apply = mkOption {
|
||||
type = with types; functionTo raw;
|
||||
default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
|
||||
};
|
||||
};
|
||||
config = {
|
||||
resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
|
||||
apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -75,7 +72,7 @@ in
|
|||
};
|
||||
};
|
||||
policy =
|
||||
{ config, ... }:
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-resource-policy";
|
||||
options = {
|
||||
|
|
@ -88,22 +85,22 @@ in
|
|||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
apply = mkOption {
|
||||
type = with types; functionTo raw; # TODO: splice out the user type from NixOS
|
||||
default =
|
||||
requests:
|
||||
let
|
||||
# Filter out requests that need wheel if policy doesn't allow it
|
||||
validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
|
||||
in
|
||||
lib.optionalAttrs (validRequests != { }) {
|
||||
${config.username} = {
|
||||
isNormalUser = true;
|
||||
packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
|
||||
extraGroups = lib.optional config.wheel "wheel";
|
||||
};
|
||||
};
|
||||
config = {
|
||||
resource-type = types.raw; # TODO: splice out the user type from NixOS
|
||||
apply =
|
||||
policy: requests:
|
||||
let
|
||||
# Filter out requests that need wheel if policy doesn't allow it
|
||||
validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
|
||||
in
|
||||
lib.optionalAttrs (validRequests != { }) {
|
||||
${policy.username} = {
|
||||
isNormalUser = true;
|
||||
packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
|
||||
extraGroups = lib.optional policy.wheel "wheel";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -123,46 +120,31 @@ in
|
|||
resources =
|
||||
cfg:
|
||||
lib.optionalAttrs cfg.enable {
|
||||
dummy.login-shell.packages.hello = pkgs.hello;
|
||||
};
|
||||
};
|
||||
environments.single-nixos-vm =
|
||||
{ config, ... }:
|
||||
{
|
||||
_class = "fediversity-environment";
|
||||
resources.shell.login-shell.username = "operator";
|
||||
implementation =
|
||||
requests:
|
||||
{ providers, ... }:
|
||||
{
|
||||
_class = "nixops4Deployment";
|
||||
providers = {
|
||||
inherit (inputs.nixops4.modules.nixops4Provider) local;
|
||||
};
|
||||
resources.the-machine = {
|
||||
_class = "nixops4Resource";
|
||||
type = providers.local.exec;
|
||||
imports = [
|
||||
inputs.nixops4-nixos.modules.nixops4Resource.nixos
|
||||
];
|
||||
nixos.module =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "nixos";
|
||||
users.users = (
|
||||
config.resources.login-shell.policy.apply (
|
||||
lib.concatMapAttrs (
|
||||
_application: resources:
|
||||
lib.mapAttrs (_k: lib.getAttr "login-shell") (
|
||||
lib.filterAttrs (_name: value: value ? login-shell) resources
|
||||
)
|
||||
) requests
|
||||
)
|
||||
);
|
||||
};
|
||||
hello.login-shell.packages = {
|
||||
inherit (pkgs) hello;
|
||||
};
|
||||
};
|
||||
};
|
||||
environments.single-nixos-vm = environment: {
|
||||
_class = "fediversity-environment";
|
||||
resources.shell.login-shell = {
|
||||
username = "operator";
|
||||
wheel = false; # FIXME: default needs the type uncommented
|
||||
};
|
||||
implementation = requests: {
|
||||
_class = "nixos";
|
||||
users.users = (
|
||||
config.resources.login-shell.policy.apply environment.config.resources.shell.login-shell (
|
||||
lib.concatMapAttrs (
|
||||
_application: resources:
|
||||
lib.mapAttrs (_k: lib.getAttr "login-shell") (
|
||||
lib.filterAttrs (_name: value: value ? login-shell) resources
|
||||
)
|
||||
) requests
|
||||
)
|
||||
);
|
||||
};
|
||||
};
|
||||
};
|
||||
options = {
|
||||
example-configuration = mkOption {
|
||||
|
|
@ -175,10 +157,7 @@ in
|
|||
};
|
||||
};
|
||||
example-deployment = mkOption {
|
||||
type = types.submoduleWith {
|
||||
class = "nixops4Deployment";
|
||||
modules = [ nixops4Deployment ];
|
||||
};
|
||||
type = types.raw;
|
||||
readOnly = true;
|
||||
default = config.environments.single-nixos-vm.deployment config.example-configuration;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{
|
||||
lib,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
|
|
@ -13,10 +12,10 @@ let
|
|||
submoduleWith
|
||||
optionType
|
||||
functionTo
|
||||
raw
|
||||
;
|
||||
|
||||
functionType = import ./function.nix;
|
||||
nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
|
||||
|
||||
configuration = mkOption {
|
||||
description = "Configuration type declaring options to be set by operators";
|
||||
|
|
@ -73,11 +72,26 @@ in
|
|||
type = submoduleWith {
|
||||
class = "fediversity-resource-policy";
|
||||
modules = [
|
||||
{
|
||||
options.apply = mkOption {
|
||||
description = "Apply the policy to a request";
|
||||
(policy: {
|
||||
_class = "fediversity-resource-policy";
|
||||
options = {
|
||||
# TODO(@fricklerhandwerk): not sure it can be made
|
||||
# sensible syntactically, but essentially we want to
|
||||
# ensure that `apply` is defined, but since its output
|
||||
# depends on the specific policy we also need to
|
||||
# determine that somehow.
|
||||
# hopefully this also helps with correct composition down the line.
|
||||
resource-type = mkOption {
|
||||
description = "The type of resource this policy configures";
|
||||
type = types.optionType;
|
||||
};
|
||||
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
|
||||
apply = mkOption {
|
||||
description = "Apply the policy to a request";
|
||||
type = functionTo policy.config.resource-type;
|
||||
};
|
||||
};
|
||||
}
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
@ -134,26 +148,28 @@ in
|
|||
Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
|
||||
'';
|
||||
# TODO: maybe transpose, and group the resources by type instead
|
||||
type = attrsOf (
|
||||
attrTag (
|
||||
lib.mapAttrs (
|
||||
_name: resource:
|
||||
mkOption {
|
||||
type = submoduleWith {
|
||||
class = "fediversity-resource-policy";
|
||||
modules = [ resource.policy ];
|
||||
};
|
||||
}
|
||||
) config.resources
|
||||
)
|
||||
);
|
||||
# # FIXME: error: The option `environments.single-nixos-vm.resources.shell.login-shell.apply' does not exist. Definition values:
|
||||
# # - In `<unknown-file>': <function>
|
||||
# # However there are no options defined in `environments.single-nixos-vm.resources.shell.login-shell'. Are you sure you've
|
||||
# # declared your options properly? This can happen if you e.g. declared your options in `types.submodule'
|
||||
# # under `config' rather than `options'.
|
||||
# type = attrsOf (
|
||||
# attrTag (
|
||||
# lib.mapAttrs (
|
||||
# _name: resource:
|
||||
# mkOption {
|
||||
# type = submoduleWith {
|
||||
# class = "fediversity-resource-policy";
|
||||
# modules = [ resource.policy ];
|
||||
# };
|
||||
# }
|
||||
# ) config.resources
|
||||
# )
|
||||
# );
|
||||
};
|
||||
implementation = mkOption {
|
||||
description = "Mapping of resources required by applications to available resources; the result can be deployed";
|
||||
type = functionTo (submoduleWith {
|
||||
class = "nixops4Deployment";
|
||||
modules = [ environment.config.resource-mapping.output-type ];
|
||||
});
|
||||
type = functionTo raw;
|
||||
};
|
||||
resource-mapping = mkOption {
|
||||
description = "Function type for the mapping from resources to a (NixOps4) deployment";
|
||||
|
|
@ -164,15 +180,12 @@ in
|
|||
readOnly = true;
|
||||
default = {
|
||||
input-type = configuration;
|
||||
output-type = nixops4Deployment;
|
||||
output-type = raw;
|
||||
};
|
||||
};
|
||||
deployment = mkOption {
|
||||
description = "Generate a deployment from a configuration";
|
||||
type = functionTo (submoduleWith {
|
||||
class = "nixops4Deployment";
|
||||
modules = [ environment.config.resource-mapping.output-type ];
|
||||
});
|
||||
type = functionTo raw;
|
||||
readOnly = true;
|
||||
default =
|
||||
cfg:
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue