forked from Fediversity/Fediversity
Compare commits
1 commit
repro-user
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
e5710979ba
|
3 changed files with 67 additions and 301 deletions
|
|
@ -1,7 +1,7 @@
|
|||
let
|
||||
inherit (import ../default.nix { }) pkgs inputs;
|
||||
inherit (pkgs) lib;
|
||||
inherit (lib) mkOption types;
|
||||
inherit (lib) mkOption;
|
||||
eval =
|
||||
module:
|
||||
(lib.evalModules {
|
||||
|
|
@ -23,144 +23,34 @@ in
|
|||
fediversity = eval (
|
||||
{ config, ... }:
|
||||
{
|
||||
_class = "fediversity-settings";
|
||||
config = {
|
||||
resources.nixos-configuration = {
|
||||
description = "An entire NixOS configuration";
|
||||
request =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-resource-request";
|
||||
options.config = mkOption {
|
||||
description = "Any options from NixOS";
|
||||
};
|
||||
};
|
||||
|
||||
policy =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-resource-policy";
|
||||
|
||||
options = {
|
||||
extra-config = mkOption {
|
||||
description = "Any options from NixOS";
|
||||
};
|
||||
};
|
||||
config = {
|
||||
resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
|
||||
apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
|
||||
};
|
||||
};
|
||||
};
|
||||
resources.login-shell = {
|
||||
_class = "fediversity-resource";
|
||||
description = "The operator needs to be able to log into the shell";
|
||||
request =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-resource-request";
|
||||
options = {
|
||||
wheel = mkOption {
|
||||
description = "Whether the login user needs root permissions";
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
packages = mkOption {
|
||||
description = "Packages that need to be available in the user environment";
|
||||
type = with types; attrsOf package;
|
||||
};
|
||||
};
|
||||
};
|
||||
policy =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-resource-policy";
|
||||
options = {
|
||||
username = mkOption {
|
||||
description = "Username for the operator";
|
||||
type = types.str; # TODO: use the proper constraints from NixOS
|
||||
};
|
||||
wheel = mkOption {
|
||||
description = "Whether to allow login with root permissions";
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
config = {
|
||||
resource-type = types.raw; # TODO: splice out the user type from NixOS
|
||||
apply =
|
||||
policy: requests:
|
||||
let
|
||||
# Filter out requests that need wheel if policy doesn't allow it
|
||||
validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
|
||||
in
|
||||
lib.optionalAttrs (validRequests != { }) {
|
||||
${policy.username} = {
|
||||
isNormalUser = true;
|
||||
packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
|
||||
extraGroups = lib.optional policy.wheel "wheel";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
applications.hello =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-application";
|
||||
description = ''Command-line tool that will print "Hello, world!" on the terminal'';
|
||||
module =
|
||||
{ ... }:
|
||||
{
|
||||
_class = "fediversity-application-config";
|
||||
options = {
|
||||
enable = lib.mkEnableOption "Hello in the shell";
|
||||
};
|
||||
};
|
||||
resources =
|
||||
implementation =
|
||||
cfg:
|
||||
lib.optionalAttrs cfg.enable {
|
||||
hello.login-shell.packages = {
|
||||
inherit (pkgs) hello;
|
||||
};
|
||||
dummy.login-shell.packages.hello = pkgs.hello;
|
||||
};
|
||||
};
|
||||
environments.single-nixos-vm = environment: {
|
||||
_class = "fediversity-environment";
|
||||
resources.shell.login-shell = {
|
||||
username = "operator";
|
||||
wheel = false; # FIXME: default needs the type uncommented
|
||||
};
|
||||
implementation = requests: {
|
||||
_class = "nixos";
|
||||
users.users = (
|
||||
config.resources.login-shell.policy.apply environment.config.resources.shell.login-shell (
|
||||
lib.concatMapAttrs (
|
||||
_application: resources:
|
||||
lib.mapAttrs (_k: lib.getAttr "login-shell") (
|
||||
lib.filterAttrs (_name: value: value ? login-shell) resources
|
||||
)
|
||||
) requests
|
||||
)
|
||||
);
|
||||
};
|
||||
};
|
||||
};
|
||||
options = {
|
||||
example-configuration = mkOption {
|
||||
type = config.configuration;
|
||||
readOnly = true;
|
||||
default = {
|
||||
_class = "fediversity-configuration";
|
||||
enable = true;
|
||||
applications.hello.enable = true;
|
||||
};
|
||||
};
|
||||
example-deployment = mkOption {
|
||||
type = types.raw;
|
||||
readOnly = true;
|
||||
default = config.environments.single-nixos-vm.deployment config.example-configuration;
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
|
|
@ -169,14 +59,12 @@ in
|
|||
inherit (fediversity)
|
||||
example-configuration
|
||||
;
|
||||
num-packages = lib.lists.length fediversity.example-deployment.users.users.operator.packages;
|
||||
};
|
||||
expected = {
|
||||
example-configuration = {
|
||||
enable = true;
|
||||
applications.hello.enable = true;
|
||||
};
|
||||
num-packages = 1;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{
|
||||
lib,
|
||||
config,
|
||||
options,
|
||||
...
|
||||
}:
|
||||
let
|
||||
|
|
@ -11,202 +10,80 @@ let
|
|||
attrTag
|
||||
deferredModuleWith
|
||||
submodule
|
||||
submoduleWith
|
||||
optionType
|
||||
functionTo
|
||||
raw
|
||||
;
|
||||
|
||||
functionType = import ./function.nix;
|
||||
|
||||
configuration = mkOption {
|
||||
description = "Configuration type declaring options to be set by operators";
|
||||
type = optionType;
|
||||
readOnly = true;
|
||||
default = submoduleWith {
|
||||
class = "fediversity-configuration";
|
||||
modules = [
|
||||
{
|
||||
options = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "your Fediversity configuration";
|
||||
};
|
||||
applications = lib.mapAttrs (
|
||||
_name: application:
|
||||
mkOption {
|
||||
description = application.description;
|
||||
type = submoduleWith {
|
||||
class = "fediversity-application-config";
|
||||
modules = [ application.module ];
|
||||
};
|
||||
default = { };
|
||||
}
|
||||
) config.applications;
|
||||
};
|
||||
}
|
||||
];
|
||||
application-resources = {
|
||||
options.resources = mkOption {
|
||||
# TODO: maybe transpose, and group the resources by type instead
|
||||
type = attrsOf (
|
||||
attrTag (lib.mapAttrs (_name: resource: mkOption { type = resource.request; }) config.resources)
|
||||
);
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
_class = "fediversity-settings";
|
||||
_class = "nixops4Deployment";
|
||||
|
||||
options = {
|
||||
inherit configuration;
|
||||
resources = mkOption {
|
||||
description = "Collection of deployment resources that can be required by applications and policed by hosting providers";
|
||||
type = attrsOf (submoduleWith {
|
||||
class = "fediversity-resource";
|
||||
modules = [
|
||||
(
|
||||
{ ... }:
|
||||
{
|
||||
options = {
|
||||
description = mkOption {
|
||||
description = "Description of the resource to help application module authors and hosting providers to work with it";
|
||||
type = types.str;
|
||||
};
|
||||
request = mkOption {
|
||||
description = "Options for declaring resource requirements by an application, a description of how the resource is consumed or accessed";
|
||||
type = deferredModuleWith { staticModules = [ { _class = "fediversity-resource-request"; } ]; };
|
||||
};
|
||||
policy = mkOption {
|
||||
description = "Options for configuring the resource policy for the hosting provider, a description of how the resource is made available";
|
||||
type = submoduleWith {
|
||||
class = "fediversity-resource-policy";
|
||||
modules = [
|
||||
(policy: {
|
||||
_class = "fediversity-resource-policy";
|
||||
options = {
|
||||
# TODO(@fricklerhandwerk): not sure it can be made
|
||||
# sensible syntactically, but essentially we want to
|
||||
# ensure that `apply` is defined, but since its output
|
||||
# depends on the specific policy we also need to
|
||||
# determine that somehow.
|
||||
# hopefully this also helps with correct composition down the line.
|
||||
resource-type = mkOption {
|
||||
description = "The type of resource this policy configures";
|
||||
type = types.optionType;
|
||||
};
|
||||
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
|
||||
apply = mkOption {
|
||||
description = "Apply the policy to a request";
|
||||
type = functionTo policy.config.resource-type;
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
];
|
||||
});
|
||||
};
|
||||
applications = mkOption {
|
||||
description = "Collection of Fediversity applications";
|
||||
type = attrsOf (submoduleWith {
|
||||
class = "fediversity-application";
|
||||
modules = [
|
||||
{
|
||||
options = {
|
||||
description = mkOption {
|
||||
description = "Description to be shown in the application overview";
|
||||
type = types.str;
|
||||
};
|
||||
module = mkOption {
|
||||
description = "Operator-facing configuration options for the application";
|
||||
type = deferredModuleWith { staticModules = [ { _class = "fediversity-application-config"; } ]; };
|
||||
};
|
||||
resources = mkOption {
|
||||
description = "Mapping of application configuration to deployment resources, a description of what an application needs to run";
|
||||
# TODO: maybe transpose, and group the resources by type instead
|
||||
type = functionTo (
|
||||
attrsOf (
|
||||
attrTag (
|
||||
lib.mapAttrs (
|
||||
_name: resource: mkOption { type = types.submodule resource.request; }
|
||||
) config.resources
|
||||
)
|
||||
)
|
||||
);
|
||||
type = attrsOf (
|
||||
submodule (application: {
|
||||
_class = "fediversity-application";
|
||||
options = {
|
||||
description = mkOption {
|
||||
description = "Description to be shown in the application overview";
|
||||
type = types.str;
|
||||
};
|
||||
module = mkOption {
|
||||
description = "Operator-facing configuration options for the application";
|
||||
type = deferredModuleWith { staticModules = [ { _class = "fediversity-application-config"; } ]; };
|
||||
};
|
||||
implementation = mkOption {
|
||||
description = "Mapping of application configuration to deployment resources, a description of what an application needs to run";
|
||||
type = application.config.config-mapping.function-type;
|
||||
};
|
||||
resources = mkOption {
|
||||
description = "Compute resources required by an application";
|
||||
type = functionTo application.config.config-mapping.output-type;
|
||||
readOnly = true;
|
||||
default = input: (application.config.implementation input).output;
|
||||
};
|
||||
config-mapping = mkOption {
|
||||
description = "Function type for the mapping from application configuration to required resources";
|
||||
type = submodule functionType;
|
||||
readOnly = true;
|
||||
default = {
|
||||
input-type = application.config.module;
|
||||
output-type = application-resources;
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
});
|
||||
};
|
||||
})
|
||||
);
|
||||
};
|
||||
environments = mkOption {
|
||||
description = "Run-time environments for Fediversity applications to be deployed to";
|
||||
type = attrsOf (submoduleWith {
|
||||
class = "fediversity-environment";
|
||||
modules = [
|
||||
(environment: {
|
||||
options = {
|
||||
resources = mkOption {
|
||||
description = ''
|
||||
Resources made available by the hosting provider, and their policies.
|
||||
|
||||
Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
|
||||
'';
|
||||
# TODO: maybe transpose, and group the resources by type instead
|
||||
type = attrsOf (
|
||||
attrTag (
|
||||
lib.mapAttrs (
|
||||
name: resource:
|
||||
mkOption {
|
||||
type = submoduleWith {
|
||||
class = "fediversity-resource-policy";
|
||||
modules =
|
||||
(lib.evalModules {
|
||||
modules =
|
||||
options.resources.type.nestedTypes.elemType.getSubModules
|
||||
;
|
||||
}).options.policy.type.getSubModules
|
||||
++ [
|
||||
options.resources.value.${name}
|
||||
];
|
||||
};
|
||||
}
|
||||
) config.resources
|
||||
)
|
||||
);
|
||||
};
|
||||
implementation = mkOption {
|
||||
description = "Mapping of resources required by applications to available resources; the result can be deployed";
|
||||
type = functionTo environment.config.resource-mapping.output-type;
|
||||
};
|
||||
resource-mapping = mkOption {
|
||||
description = "Function type for the mapping from resources to a (NixOps4) deployment";
|
||||
type = submoduleWith {
|
||||
class = "module-function";
|
||||
modules = [ functionType ];
|
||||
};
|
||||
readOnly = true;
|
||||
default = {
|
||||
input-type = submodule configuration;
|
||||
output-type = raw;
|
||||
};
|
||||
};
|
||||
deployment = mkOption {
|
||||
description = "Generate a deployment from a configuration";
|
||||
type = functionTo environment.config.resource-mapping.output-type;
|
||||
readOnly = true;
|
||||
default =
|
||||
cfg:
|
||||
# TODO: check cfg.enable.true
|
||||
let
|
||||
required-resources = lib.mapAttrs (
|
||||
name: application-settings: config.applications.${name}.resources application-settings
|
||||
) cfg.applications;
|
||||
in
|
||||
(environment.config.implementation required-resources);
|
||||
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
});
|
||||
configuration = mkOption {
|
||||
description = "Configuration type declaring options to be set by operators";
|
||||
type = optionType;
|
||||
readOnly = true;
|
||||
default = submodule {
|
||||
options = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "your Fediversity configuration";
|
||||
};
|
||||
applications = lib.mapAttrs (
|
||||
_name: application:
|
||||
mkOption {
|
||||
description = application.description;
|
||||
type = submodule application.module;
|
||||
default = { };
|
||||
}
|
||||
) config.applications;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@
|
|||
let
|
||||
inherit (lib) mkOption types;
|
||||
inherit (types)
|
||||
deferredModule
|
||||
submodule
|
||||
functionTo
|
||||
optionType
|
||||
|
|
@ -13,10 +14,10 @@ in
|
|||
{
|
||||
options = {
|
||||
input-type = mkOption {
|
||||
type = optionType;
|
||||
type = deferredModule;
|
||||
};
|
||||
output-type = mkOption {
|
||||
type = optionType;
|
||||
type = deferredModule;
|
||||
};
|
||||
function-type = mkOption {
|
||||
type = optionType;
|
||||
|
|
@ -24,10 +25,10 @@ in
|
|||
default = functionTo (submodule {
|
||||
options = {
|
||||
input = mkOption {
|
||||
type = config.input-type;
|
||||
type = submodule config.input-type;
|
||||
};
|
||||
output = mkOption {
|
||||
type = config.output-type;
|
||||
type = submodule config.output-type;
|
||||
};
|
||||
};
|
||||
});
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue