From a5754e702344e12b231a6d2537d29497bd695386 Mon Sep 17 00:00:00 2001 From: Tim Van Baak Date: Sat, 21 Sep 2024 12:51:24 -0700 Subject: [PATCH] Apply nixfmt --- default.nix | 19 ++-- demo/default.nix | 42 ++++---- flake.nix | 136 +++++++++++++++----------- module.nix | 244 ++++++++++++++++++++++++++--------------------- shell.nix | 19 ++-- 5 files changed, 257 insertions(+), 203 deletions(-) diff --git a/default.nix b/default.nix index 2cccff2..6466507 100644 --- a/default.nix +++ b/default.nix @@ -1,10 +1,9 @@ -(import - ( - let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in - fetchTarball { - url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz"; - sha256 = lock.nodes.flake-compat.locked.narHash; - } - ) - { src = ./.; } -).defaultNix +(import ( + let + lock = builtins.fromJSON (builtins.readFile ./flake.lock); + in + fetchTarball { + url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz"; + sha256 = lock.nodes.flake-compat.locked.narHash; + } +) { src = ./.; }).defaultNix diff --git a/demo/default.nix b/demo/default.nix index 046aaa1..e9ca54b 100644 --- a/demo/default.nix +++ b/demo/default.nix @@ -14,7 +14,7 @@ users.users.bob = { isNormalUser = true; password = "beta"; - uid = 1001; + uid = 1001; packages = [ pkgs.intake ]; }; @@ -26,11 +26,13 @@ }; # Expose the vm's intake revproxy at host port 5234 - virtualisation.forwardPorts = [{ - from = "host"; - host.port = 5234; - guest.port = 8080; - }]; + virtualisation.forwardPorts = [ + { + from = "host"; + host.port = 5234; + guest.port = 8080; + } + ]; # Mount the demo content for both users nixos-shell.mounts = { @@ -47,20 +49,20 @@ # Create an activation script that copies and chowns the demo content # chmod 777 because the users may not exist when the activation script runs - system.activationScripts = - let - userSetup = name: uid: '' - ${pkgs.coreutils}/bin/mkdir -p /home/${name}/.local/share/intake - ${pkgs.coreutils}/bin/cp -r /mnt/${name}/* /home/${name}/.local/share/intake/ - ${pkgs.coreutils}/bin/chown -R ${uid} /home/${name} - ${pkgs.findutils}/bin/find /home/${name} -type d -exec ${pkgs.coreutils}/bin/chmod 755 {} \; - ${pkgs.findutils}/bin/find /home/${name} -type f -exec ${pkgs.coreutils}/bin/chmod 644 {} \; - ''; - in - { - aliceSetup = userSetup "alice" "1000"; - bobSetup = userSetup "bob" "1001"; - }; + system.activationScripts = + let + userSetup = name: uid: '' + ${pkgs.coreutils}/bin/mkdir -p /home/${name}/.local/share/intake + ${pkgs.coreutils}/bin/cp -r /mnt/${name}/* /home/${name}/.local/share/intake/ + ${pkgs.coreutils}/bin/chown -R ${uid} /home/${name} + ${pkgs.findutils}/bin/find /home/${name} -type d -exec ${pkgs.coreutils}/bin/chmod 755 {} \; + ${pkgs.findutils}/bin/find /home/${name} -type f -exec ${pkgs.coreutils}/bin/chmod 644 {} \; + ''; + in + { + aliceSetup = userSetup "alice" "1000"; + bobSetup = userSetup "bob" "1001"; + }; # Put the demo sources on the global PATH environment.variables.PATH = "/mnt/sources"; diff --git a/flake.nix b/flake.nix index fc479a7..98ea838 100644 --- a/flake.nix +++ b/flake.nix @@ -13,63 +13,91 @@ nixos-shell.inputs.nixpkgs.follows = "nixpkgs"; }; - outputs = { self, nixpkgs, flake-compat, nixos-shell }: - let - inherit (nixpkgs.lib) makeOverridable nixosSystem; - system = "x86_64-linux"; - in { - formatter.${system} = nixpkgs.legacyPackages.${system}.nixfmt-rfc-style; + outputs = + { + self, + nixpkgs, + flake-compat, + nixos-shell, + }: + let + inherit (nixpkgs.lib) makeOverridable nixosSystem; + system = "x86_64-linux"; + in + { + formatter.${system} = nixpkgs.legacyPackages.${system}.nixfmt-rfc-style; - packages.${system} = let - pkgs = (import nixpkgs { + packages.${system} = + let + pkgs = ( + import nixpkgs { + inherit system; + overlays = [ self.overlays.default ]; + } + ); + in + { + default = self.packages.${system}.intake; + inherit (pkgs) intake; + }; + + devShells.${system} = { + default = + let + pkgs = nixpkgs.legacyPackages.${system}; + pythonEnv = pkgs.python3.withPackages ( + pypkgs: with pypkgs; [ + flask + black + pytest + ] + ); + in + pkgs.mkShell { + packages = [ + pythonEnv + pkgs.nixos-shell + # We only take this dependency for htpasswd, which is a little unfortunate + pkgs.apacheHttpd + ]; + shellHook = '' + PS1="(develop) $PS1" + ''; + }; + }; + + overlays.default = final: prev: { + intake = final.python3Packages.buildPythonPackage { + name = "intake"; + src = builtins.path { + path = ./.; + name = "intake"; + }; + format = "pyproject"; + propagatedBuildInputs = with final.python3Packages; [ + flask + setuptools + ]; + }; + }; + + templates.source = { + path = builtins.path { + path = ./template; + name = "source"; + }; + description = "A basic intake source config"; + }; + + nixosModules.default = import ./module.nix self; + + nixosConfigurations."demo" = makeOverridable nixosSystem { inherit system; - overlays = [ self.overlays.default ]; - }); - in { - default = self.packages.${system}.intake; - inherit (pkgs) intake; - }; - - devShells.${system} = { - default = let - pkgs = nixpkgs.legacyPackages.${system}; - pythonEnv = pkgs.python3.withPackages (pypkgs: with pypkgs; [ flask black pytest ]); - in pkgs.mkShell { - packages = [ - pythonEnv - pkgs.nixos-shell - # We only take this dependency for htpasswd, which is a little unfortunate - pkgs.apacheHttpd + modules = [ + nixos-shell.nixosModules.nixos-shell + self.nixosModules.default + ./demo ]; - shellHook = '' - PS1="(develop) $PS1" - ''; }; }; - - overlays.default = final: prev: { - intake = final.python3Packages.buildPythonPackage { - name = "intake"; - src = builtins.path { path = ./.; name = "intake"; }; - format = "pyproject"; - propagatedBuildInputs = with final.python3Packages; [ flask setuptools ]; - }; - }; - - templates.source = { - path = builtins.path { path = ./template; name = "source"; }; - description = "A basic intake source config"; - }; - - nixosModules.default = import ./module.nix self; - - nixosConfigurations."demo" = makeOverridable nixosSystem { - inherit system; - modules = [ - nixos-shell.nixosModules.nixos-shell - self.nixosModules.default - ./demo - ]; - }; - }; } diff --git a/module.nix b/module.nix index 10c68f9..43e985e 100644 --- a/module.nix +++ b/module.nix @@ -1,153 +1,179 @@ -flake: { config, lib, pkgs, ... }: +flake: +{ + config, + lib, + pkgs, + ... +}: let - inherit (lib) filterAttrs foldl imap1 mapAttrsToList mkEnableOption mkIf mkMerge mkOption mkPackageOption types; + inherit (lib) + filterAttrs + foldl + imap1 + mapAttrsToList + mkEnableOption + mkIf + mkMerge + mkOption + mkPackageOption + types + ; intakeCfg = config.services.intake; -in { +in +{ options = { services.intake = { listen.addr = mkOption { type = types.str; default = "0.0.0.0"; - description = "The listen address for the entry point to intake services. This endpoint will redirect to a " - "local port based on the request's HTTP Basic Auth credentials."; + description = "The listen address for the entry point to intake services. This endpoint will redirect to a local port based on the request's HTTP Basic Auth credentials."; }; listen.port = mkOption { type = types.port; default = 80; - description = "The listen port for the entry point to intake services. This endpoint will redirect to a local " - "port based on the request's HTTP Basic Auth credentials."; + description = "The listen port for the entry point to intake services. This endpoint will redirect to a local port based on the request's HTTP Basic Auth credentials."; }; - package = mkPackageOption pkgs "intake" {}; + package = mkPackageOption pkgs "intake" { }; internalPortStart = mkOption { type = types.port; default = 24130; - description = "The first port to use for internal service endpoints. A number of ports will be continguously " - "allocated equal to the number of users with enabled intake services."; + description = "The first port to use for internal service endpoints. A number of ports will be continguously allocated equal to the number of users with enabled intake services."; }; extraPackages = mkOption { type = types.listOf types.package; - default = []; + default = [ ]; description = "Extra packages available to all enabled users and their intake services."; }; users = mkOption { description = "User intake service definitions."; - default = {}; - type = types.attrsOf (types.submodule { - options = { - enable = mkEnableOption "intake, a personal feed aggregator."; + default = { }; + type = types.attrsOf ( + types.submodule { + options = { + enable = mkEnableOption "intake, a personal feed aggregator."; - extraPackages = mkOption { - type = types.listOf types.package; - default = []; - description = "Extra packages available to this user and their intake service."; + extraPackages = mkOption { + type = types.listOf types.package; + default = [ ]; + description = "Extra packages available to this user and their intake service."; + }; }; - }; - }); + } + ); }; }; }; config = - let - # Define the intake package and a python environment to run it from - intake = intakeCfg.package; - pythonEnv = pkgs.python3.withPackages (pypkgs: [ intake ]); - - # Assign each user an internal port for their personal intake instance - enabledUsers = filterAttrs (userName: userCfg: userCfg.enable) intakeCfg.users; - enabledUserNames = mapAttrsToList (userName: userCfg: userName) enabledUsers; - userPortList = imap1 (i: userName: { ${userName} = i + intakeCfg.internalPortStart; }) enabledUserNames; - userPort = foldl (acc: val: acc // val) {} userPortList; - - # To avoid polluting PATH with httpd programs, define an htpasswd wrapper - htpasswdWrapper = pkgs.writeShellScriptBin "htpasswd" '' - ${pkgs.apacheHttpd}/bin/htpasswd $@ - ''; - - # File locations - intakeDir = "/etc/intake"; - intakePwd = "${intakeDir}/htpasswd"; - in { - # Apply the overlay so intake is included in pkgs. - nixpkgs.overlays = [ flake.overlays.default ]; - - # Define a user group for access to the htpasswd file. nginx needs to be able to read it. - users.groups.intake.members = mkIf (enabledUsers != {}) (enabledUserNames ++ [ "nginx" ]); - - # Define an activation script that ensures that the htpasswd file exists. - system.activationScripts.etc-intake = '' - if [ ! -e ${intakeDir} ]; then - ${pkgs.coreutils}/bin/mkdir -p ${intakeDir}; - fi - ${pkgs.coreutils}/bin/chown root:root ${intakeDir} - ${pkgs.coreutils}/bin/chmod 755 ${intakeDir} - if [ ! -e ${intakePwd} ]; then - ${pkgs.coreutils}/bin/touch ${intakePwd} - fi - ${pkgs.coreutils}/bin/chown root:intake ${intakePwd} - ${pkgs.coreutils}/bin/chmod 660 ${intakePwd} - ''; - - # Give every intake user the htpasswd wrapper, the shared packages, and the user-specific packages. - users.users = let - addPackagesToUser = userName: { - ${userName}.packages = - [ htpasswdWrapper intake ] - ++ intakeCfg.extraPackages - ++ intakeCfg.users.${userName}.extraPackages; - }; - in mkMerge (map addPackagesToUser enabledUserNames); + # Define the intake package and a python environment to run it from + intake = intakeCfg.package; + pythonEnv = pkgs.python3.withPackages (pypkgs: [ intake ]); - # Enable cron - services.cron.enable = true; + # Assign each user an internal port for their personal intake instance + enabledUsers = filterAttrs (userName: userCfg: userCfg.enable) intakeCfg.users; + enabledUserNames = mapAttrsToList (userName: userCfg: userName) enabledUsers; + userPortList = imap1 (i: userName: { + ${userName} = i + intakeCfg.internalPortStart; + }) enabledUserNames; + userPort = foldl (acc: val: acc // val) { } userPortList; - # Define a user service for each configured user - systemd.services = - let - runScript = userName: pkgs.writeShellScript "intake-run.sh" '' - # Add the setuid wrapper directory so `crontab` is accessible - export PATH="${config.security.wrapperDir}:$PATH" - ${pythonEnv}/bin/intake run -d /home/${userName}/.local/share/intake --port ${toString userPort.${userName}} + # To avoid polluting PATH with httpd programs, define an htpasswd wrapper + htpasswdWrapper = pkgs.writeShellScriptBin "htpasswd" '' + ${pkgs.apacheHttpd}/bin/htpasswd $@ ''; - # systemd service definition for a single user, given `services.intake.users.userName` = `userCfg` - userServiceConfig = userName: userCfg: { - "intake@${userName}" = { - description = "Intake service for user ${userName}"; - script = "${runScript userName}"; - path = intakeCfg.extraPackages ++ userCfg.extraPackages; - serviceConfig = { - User = userName; - Type = "simple"; - }; - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - enable = userCfg.enable; - }; - }; - in mkMerge (mapAttrsToList userServiceConfig intakeCfg.users); - # Define an nginx reverse proxy to request auth - services.nginx = mkIf (enabledUsers != {}) { - enable = true; - virtualHosts."intake" = mkIf (enabledUsers != {}) { - listen = [ intakeCfg.listen ]; - locations."/" = { - proxyPass = "http://127.0.0.1:$target_port"; - basicAuthFile = intakePwd; + # File locations + intakeDir = "/etc/intake"; + intakePwd = "${intakeDir}/htpasswd"; + in + { + # Apply the overlay so intake is included in pkgs. + nixpkgs.overlays = [ flake.overlays.default ]; + + # Define a user group for access to the htpasswd file. nginx needs to be able to read it. + users.groups.intake.members = mkIf (enabledUsers != { }) (enabledUserNames ++ [ "nginx" ]); + + # Define an activation script that ensures that the htpasswd file exists. + system.activationScripts.etc-intake = '' + if [ ! -e ${intakeDir} ]; then + ${pkgs.coreutils}/bin/mkdir -p ${intakeDir}; + fi + ${pkgs.coreutils}/bin/chown root:root ${intakeDir} + ${pkgs.coreutils}/bin/chmod 755 ${intakeDir} + if [ ! -e ${intakePwd} ]; then + ${pkgs.coreutils}/bin/touch ${intakePwd} + fi + ${pkgs.coreutils}/bin/chown root:intake ${intakePwd} + ${pkgs.coreutils}/bin/chmod 660 ${intakePwd} + ''; + + # Give every intake user the htpasswd wrapper, the shared packages, and the user-specific packages. + users.users = + let + addPackagesToUser = userName: { + ${userName}.packages = [ + htpasswdWrapper + intake + ] ++ intakeCfg.extraPackages ++ intakeCfg.users.${userName}.extraPackages; + }; + in + mkMerge (map addPackagesToUser enabledUserNames); + + # Enable cron + services.cron.enable = true; + + # Define a user service for each configured user + systemd.services = + let + runScript = + userName: + pkgs.writeShellScript "intake-run.sh" '' + # Add the setuid wrapper directory so `crontab` is accessible + export PATH="${config.security.wrapperDir}:$PATH" + ${pythonEnv}/bin/intake run -d /home/${userName}/.local/share/intake --port ${toString userPort.${userName}} + ''; + # systemd service definition for a single user, given `services.intake.users.userName` = `userCfg` + userServiceConfig = userName: userCfg: { + "intake@${userName}" = { + description = "Intake service for user ${userName}"; + script = "${runScript userName}"; + path = intakeCfg.extraPackages ++ userCfg.extraPackages; + serviceConfig = { + User = userName; + Type = "simple"; + }; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + enable = userCfg.enable; + }; + }; + in + mkMerge (mapAttrsToList userServiceConfig intakeCfg.users); + + # Define an nginx reverse proxy to request auth + services.nginx = mkIf (enabledUsers != { }) { + enable = true; + virtualHosts."intake" = mkIf (enabledUsers != { }) { + listen = [ intakeCfg.listen ]; + locations."/" = { + proxyPass = "http://127.0.0.1:$target_port"; + basicAuthFile = intakePwd; + }; + extraConfig = foldl (acc: val: acc + val) "" ( + mapAttrsToList (userName: port: '' + if ($remote_user = "${userName}") { + set $target_port ${toString port}; + } + '') userPort + ); }; - extraConfig = foldl (acc: val: acc + val) "" (mapAttrsToList (userName: port: '' - if ($remote_user = "${userName}") { - set $target_port ${toString port}; - } - '') userPort); }; }; - }; } diff --git a/shell.nix b/shell.nix index 6234bb4..493783d 100644 --- a/shell.nix +++ b/shell.nix @@ -1,10 +1,9 @@ -(import - ( - let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in - fetchTarball { - url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz"; - sha256 = lock.nodes.flake-compat.locked.narHash; - } - ) - { src = ./.; } -).shellNix +(import ( + let + lock = builtins.fromJSON (builtins.readFile ./flake.lock); + in + fetchTarball { + url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz"; + sha256 = lock.nodes.flake-compat.locked.narHash; + } +) { src = ./.; }).shellNix