Fediversity/deployment/default.nix

## `makeMakeDeployment` -- Function to help hosting providers make a
## `makeDeployment` function.
##
## https://factoryfactoryfactory.net/

## Generic utilities used in this function, eg. nixpkgs, NixOps4 providers, etc.
## REVIEW: We should maybe be more specific than just `inputs`.
{
  lib,
  nixops4,
  nixops4-nixos,
  fediversity,
}:

## Information on the hosting provider's infrastructure. This is where we inform
## this function of where it can find eg. Proxmox.
{
  ## Four NixOS configuration resource modules for four services. Those are VMs
  ## that are already deployed and on which we will push our configurations.
  ##
  ## - Ultimately, we just want a pool of VMs, or even just a Proxmox.
  ## - Each machine is flagged for a certain use case until we control DNS.
  garageConfigurationResource,
  mastodonConfigurationResource,
  peertubeConfigurationResource,
  pixelfedConfigurationResource,
}:

## From the hosting provider's perspective, the function is meant to be
## partially applied only until here.

## Information on the specific deployment that we request. This is the
## information coming from the FediPanel.
##
## FIXME: lock step the interface with the definitions in the FediPanel
panelConfigNullable:

let
  inherit (lib) mkIf;

  ## The convertor from module options to JSON schema does not generate proper
  ## JSON schema types, forcing us to use nullable fields for default values.
  ## However, working with those fields in the deployment code is annoying (and
  ## unusual for Nix programmers), so we sanitize the input here and add back
  ## the default value by hand.
  nonNull = x: v: if x == null then v else x;
  panelConfig = {
    domain = nonNull panelConfigNullable.domain "fediversity.net";
    initialUser = nonNull panelConfigNullable.initialUser {
      displayName = "Testy McTestface";
      username = "test";
      password = "testtest";
      email = "test@test.com";
    };
    mastodon = nonNull panelConfigNullable.mastodon { enable = false; };
    peertube = nonNull panelConfigNullable.peertube { enable = false; };
    pixelfed = nonNull panelConfigNullable.pixelfed { enable = false; };
  };
in

## Regular arguments of a NixOps4 deployment module.
{ config, providers, ... }:

let
  cfg = config.deployment;
in
{
  _class = "nixops4Deployment";

  options = {
    deployment = lib.mkOption {
      description = ''
        Configuration to be deployed
      '';
      # XXX(@fricklerhandwerk):
      #     misusing this will produce obscure errors that will be truncated by NixOps4
      type = lib.types.submodule ./options.nix;
      default = panelConfig;
    };
  };

  config = {
    providers = { inherit (nixops4.modules.nixops4Provider) local; };

    resources =
      let
        ## NOTE: All of these secrets are publicly available in this source file
        ## and will end up in the Nix store. We don't care as they are only ever
        ## used for testing anyway.
        ##
        ## FIXME: Generate and store in NixOps4's state.
        mastodonS3KeyConfig =
          { pkgs, ... }:
          {
            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GK3515373e4c851ebaad366558";
            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34";
          };
        peertubeS3KeyConfig =
          { pkgs, ... }:
          {
            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GK1f9feea9960f6f95ff404c9b";
            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "7295c4201966a02c2c3d25b5cea4a5ff782966a2415e3a196f91924631191395";
          };
        pixelfedS3KeyConfig =
          { pkgs, ... }:
          {
            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GKb5615457d44214411e673b7b";
            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "5be6799a88ca9b9d813d1a806b64f15efa49482dbe15339ddfaf7f19cf434987";
          };

        makeConfigurationResource = resourceModule: config: {
          type = providers.local.exec;
          imports = [
            nixops4-nixos.modules.nixops4Resource.nixos
            resourceModule

            {
              ## NOTE: With NixOps4, there are several levels and all of them live
              ## in the NixOS module system:
              ##
              ##   1. Each NixOps4 deployment is a module.
              ##   2. Each NixOps4 resource is a module. This very comment is
              ##      inside an attrset imported as a module in a resource.
              ##   3. Each NixOps4 'configuration' resource contains an attribute
              ##      'nixos.module', itself a NixOS configuration module.
              nixos.module =
                { ... }:
                {
                  imports = [
                    config
                    fediversity
                  ];
                };
            }
          ];
        };

      in

      {
        garage-configuration = makeConfigurationResource garageConfigurationResource (
          { pkgs, ... }:
          mkIf (cfg.mastodon.enable || cfg.peertube.enable || cfg.pixelfed.enable) {
            fediversity = {
              inherit (cfg) domain;
              garage.enable = true;
              pixelfed = pixelfedS3KeyConfig { inherit pkgs; };
              mastodon = mastodonS3KeyConfig { inherit pkgs; };
              peertube = peertubeS3KeyConfig { inherit pkgs; };
            };
          }
        );

        mastodon-configuration = makeConfigurationResource mastodonConfigurationResource (
          { pkgs, ... }:
          mkIf cfg.mastodon.enable {
            fediversity = {
              inherit (cfg) domain;
              temp.initialUser = {
                inherit (cfg.initialUser) username email displayName;
                # FIXME: disgusting, but nvm, this is going to be replaced by
                # proper central authentication at some point
                passwordFile = pkgs.writeText "password" cfg.initialUser.password;
              };

              mastodon = mastodonS3KeyConfig { inherit pkgs; } // {
                enable = true;
              };

              temp.cores = 1; # FIXME: should come from NixOps4 eventually
            };
          }
        );

        peertube-configuration = makeConfigurationResource peertubeConfigurationResource (
          { pkgs, ... }:
          mkIf cfg.peertube.enable {
            fediversity = {
              inherit (cfg) domain;
              temp.initialUser = {
                inherit (cfg.initialUser) username email displayName;
                # FIXME: disgusting, but nvm, this is going to be replaced by
                # proper central authentication at some point
                passwordFile = pkgs.writeText "password" cfg.initialUser.password;
              };

              peertube = peertubeS3KeyConfig { inherit pkgs; } // {
                enable = true;
                ## NOTE: Only ever used for testing anyway.
                ##
                ## FIXME: Generate and store in NixOps4's state.
                secretsFile = pkgs.writeText "secret" "574e093907d1157ac0f8e760a6deb1035402003af5763135bae9cbd6abe32b24";
              };
            };
          }
        );

        pixelfed-configuration = makeConfigurationResource pixelfedConfigurationResource (
          { pkgs, ... }:
          mkIf cfg.pixelfed.enable {
            fediversity = {
              inherit (cfg) domain;
              temp.initialUser = {
                inherit (cfg.initialUser) username email displayName;
                # FIXME: disgusting, but nvm, this is going to be replaced by
                # proper central authentication at some point
                passwordFile = pkgs.writeText "password" cfg.initialUser.password;
              };

              pixelfed = pixelfedS3KeyConfig { inherit pkgs; } // {
                enable = true;
              };
            };
          }
        );
      };
  };
}