forked from Fediversity/Fediversity
153 lines
5 KiB
Nix
153 lines
5 KiB
Nix
{
|
|
config,
|
|
inputs ? (import ../../../default.nix { }).inputs,
|
|
sources ? import ../../../npins,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (sources) nixpkgs;
|
|
lib = import "${nixpkgs}/lib";
|
|
deployment-config = config;
|
|
inherit (lib) mkOption types;
|
|
eval =
|
|
module:
|
|
(lib.evalModules {
|
|
specialArgs = {
|
|
inherit inputs;
|
|
};
|
|
modules = [
|
|
module
|
|
../../data-model.nix
|
|
];
|
|
}).config;
|
|
fediversity = eval (
|
|
{ config, ... }:
|
|
{
|
|
config = {
|
|
resources.login-shell = {
|
|
description = "The operator needs to be able to log into the shell";
|
|
request =
|
|
{ ... }:
|
|
{
|
|
_class = "fediversity-resource-request";
|
|
options = {
|
|
wheel = mkOption {
|
|
description = "Whether the login user needs root permissions";
|
|
type = types.bool;
|
|
default = false;
|
|
};
|
|
packages = mkOption {
|
|
description = "Packages that need to be available in the user environment";
|
|
type = with types; attrsOf package;
|
|
};
|
|
};
|
|
};
|
|
policy =
|
|
{ config, ... }:
|
|
{
|
|
_class = "fediversity-resource-policy";
|
|
options = {
|
|
username = mkOption {
|
|
description = "Username for the operator";
|
|
type = types.str; # TODO: use the proper constraints from NixOS
|
|
};
|
|
wheel = mkOption {
|
|
description = "Whether to allow login with root permissions";
|
|
type = types.bool;
|
|
default = false;
|
|
};
|
|
};
|
|
config = {
|
|
resource-type = types.raw; # TODO: splice out the user type from NixOS
|
|
apply =
|
|
requests:
|
|
let
|
|
# Filter out requests that need wheel if policy doesn't allow it
|
|
validRequests = lib.filterAttrs (
|
|
_name: req: !req.login-shell.wheel || config.wheel
|
|
) requests.resources;
|
|
in
|
|
lib.optionalAttrs (validRequests != { }) {
|
|
${config.username} = {
|
|
isNormalUser = true;
|
|
packages =
|
|
with lib;
|
|
attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
|
|
extraGroups = lib.optional config.wheel "wheel";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
applications.hello =
|
|
{ pkgs, ... }:
|
|
{
|
|
description = ''Command-line tool that will print "Hello, world!" on the terminal'';
|
|
module =
|
|
{ ... }:
|
|
{
|
|
options.enable = lib.mkEnableOption "Hello in the shell";
|
|
};
|
|
implementation = cfg: {
|
|
input = cfg;
|
|
output = lib.optionalAttrs cfg.enable {
|
|
resources.hello.login-shell.packages.hello = pkgs.hello;
|
|
};
|
|
};
|
|
};
|
|
environments.single-nixos-vm = environment: {
|
|
resources."operator-environment".login-shell.username = "operator";
|
|
implementation = requests: {
|
|
input = requests;
|
|
output.ssh-host = {
|
|
ssh = {
|
|
username = "root";
|
|
inherit (deployment-config) host;
|
|
key-file = null;
|
|
};
|
|
nixos-configuration =
|
|
{ pkgs, ... }:
|
|
{
|
|
imports = [
|
|
./options.nix
|
|
../common/sharedOptions.nix
|
|
../common/targetNode.nix
|
|
"${nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
|
|
];
|
|
|
|
inherit (deployment-config) enableAcme;
|
|
acmeNodeIP =
|
|
if deployment-config.enableAcme then
|
|
deployment-config.nodes.acme.networking.primaryIPAddress
|
|
else
|
|
null;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
hello
|
|
];
|
|
|
|
users.users = environment.config.resources."operator-environment".login-shell.apply {
|
|
resources = lib.filterAttrs (_name: value: value ? login-shell) requests;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
options = {
|
|
"example-configuration" = mkOption {
|
|
type = config.configuration;
|
|
default = {
|
|
enable = true;
|
|
applications.hello.enable = true;
|
|
};
|
|
};
|
|
"example-deployment" = mkOption {
|
|
default = config.environments.single-nixos-vm.deployment config."example-configuration";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
in
|
|
fediversity."example-deployment"
|