tristan/nixinate
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity

Run nixpkgs-fmt

Browse source
This commit is contained in:
Tristan D. 2023-12-11 20:37:06 +01:00
parent 46696bdb78
commit 54df2c1238
Signed by: tristan
SSH key fingerprint: SHA256:U7y6eMb7CQDaTHv9XoX6/BaQnPqyxxKc+Xnfcefi6rY
6 changed files with 227 additions and 152 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
examples/flake.nix
View file

@ -6,22 +6,27 @@
nixinate.url = "github:matthewcroughan/nixinate"; nixinate.url = "github:matthewcroughan/nixinate";
}; };
outputs = { self, nixpkgs, nixinate }: { outputs =
apps = nixinate.nixinate.x86_64-linux self; { self
nixosConfigurations = { , nixpkgs
myMachine = nixpkgs.lib.nixosSystem { , nixinate
system = "x86_64-linux"; ,
modules = [ }: {
{ apps = nixinate.nixinate.x86_64-linux self;
_module.args.nixinate = { nixosConfigurations = {
host = "itchy.scratchy.com"; myMachine = nixpkgs.lib.nixosSystem {
sshUser = "matthew"; system = "x86_64-linux";
buildOn = "local"; # valid args are "local" or "remote" modules = [
}; {
} _module.args.nixinate = {
# ... other configuration ... host = "itchy.scratchy.com";
]; sshUser = "matthew";
buildOn = "local"; # valid args are "local" or "remote"
};
}
# ... other configuration ...
];
};
}; };
}; };
};
} }

224
flake.nix
View file

@ -3,118 +3,162 @@
inputs = { inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
}; };
outputs = { self, nixpkgs, ... }@inputs: outputs =
{ self
, nixpkgs
, ...
} @ inputs:
let let
version = builtins.substring 0 8 self.lastModifiedDate; version = builtins.substring 0 8 self.lastModifiedDate;
supportedSystems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ]; supportedSystems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
forSystems = systems: f: forSystems = systems: f:
nixpkgs.lib.genAttrs systems nixpkgs.lib.genAttrs systems
(system: f system nixpkgs.legacyPackages.${system}); (system: f system nixpkgs.legacyPackages.${system});
forAllSystems = forSystems supportedSystems; forAllSystems = forSystems supportedSystems;
nixpkgsFor = forAllSystems (system: pkgs: import nixpkgs { inherit system; overlays = [ self.overlay ]; }); nixpkgsFor = forAllSystems (system: pkgs:
in rec import nixpkgs {
inherit system;
overlays = [ self.overlay ];
});
in
rec
{ {
herculesCI.ciSystems = [ "x86_64-linux" ]; herculesCI.ciSystems = [ "x86_64-linux" ];
overlay = final: prev: { overlay = final: prev: {
nixinate = { nixinate = {
nix = prev.pkgs.writeShellScriptBin "nix" nix =
''${final.nixVersions.unstable}/bin/nix --experimental-features "nix-command flakes" "$@"''; prev.pkgs.writeShellScriptBin "nix"
''${final.nixVersions.unstable}/bin/nix --experimental-features "nix-command flakes" "$@"'';
nixos-rebuild = prev.nixos-rebuild.override { inherit (final) nix; }; nixos-rebuild = prev.nixos-rebuild.override { inherit (final) nix; };
}; };
generateApps = flake: generateApps = flake:
let let
machines = builtins.attrNames flake.nixosConfigurations; machines = builtins.attrNames flake.nixosConfigurations;
validMachines = final.lib.remove "" (final.lib.forEach machines (x: final.lib.optionalString (flake.nixosConfigurations."${x}"._module.args ? nixinate) "${x}" )); validMachines = final.lib.remove "" (final.lib.forEach machines (x: final.lib.optionalString (flake.nixosConfigurations."${x}"._module.args ? nixinate) "${x}"));
mkDeployScript = { machine, dryRun }: let mkDeployScript =
inherit (builtins) abort; { machine
inherit (final.lib) getExe optionalString concatStringsSep; , dryRun
nix = "${getExe final.nix}"; ,
nixos-rebuild = "${getExe final.nixos-rebuild}"; }:
openssh = "${getExe final.openssh}"; let
bash = "${getExe final.bash}"; inherit (builtins) abort;
flock = "${getExe final.flock}"; inherit (final.lib) getExe optionalString concatStringsSep;
nix = "${getExe final.nix}";
nixos-rebuild = "${getExe final.nixos-rebuild}";
openssh = "${getExe final.openssh}";
bash = "${getExe final.bash}";
flock = "${getExe final.flock}";
n = flake.nixosConfigurations.${machine}._module.args.nixinate; n = flake.nixosConfigurations.${machine}._module.args.nixinate;
hermetic = n.hermetic or true; hermetic = n.hermetic or true;
user = n.sshUser or "root"; user = n.sshUser or "root";
host = n.host or ""; host = n.host or "";
sshConfigHost = n.sshConfigHost or ""; sshConfigHost = n.sshConfigHost or "";
userHost = if sshConfigHost != "" then sshConfigHost else if host != "" then "${user}@${host}" else abort "_module.args.nixinate.host or _module.args.nixinate.sshConfigHost must be set"; userHost =
where = n.buildOn or "remote"; if sshConfigHost != ""
remote = if where == "remote" then true else if where == "local" then false else abort "_module.args.nixinate.buildOn is not set to a valid value of 'local' or 'remote'"; then sshConfigHost
substituteOnTarget = n.substituteOnTarget or false; else if host != ""
switch = if dryRun then "dry-activate" else "switch"; then "${user}@${host}"
nixOptions = concatStringsSep " " (n.nixOptions or []); else abort "_module.args.nixinate.host or _module.args.nixinate.sshConfigHost must be set";
where = n.buildOn or "remote";
remote =
if where == "remote"
then true
else if where == "local"
then false
else abort "_module.args.nixinate.buildOn is not set to a valid value of 'local' or 'remote'";
substituteOnTarget = n.substituteOnTarget or false;
switch =
if dryRun
then "dry-activate"
else "switch";
nixOptions = concatStringsSep " " (n.nixOptions or [ ]);
script = script =
'' ''
#!${bash} #!${bash}
set -e set -e
echo "🚀 Deploying nixosConfigurations.${machine} from ${flake}" echo "🚀 Deploying nixosConfigurations.${machine} from ${flake}"
'' + (if sshConfigHost != "" then '' ''
echo "🌐 SSH Config Host: ${sshConfigHost}" + (
'' else '' if sshConfigHost != ""
echo "👤 SSH User: ${user}" then ''
echo "🌐 SSH Host: ${host}" echo "🌐 SSH Config Host: ${sshConfigHost}"
'') + (if remote then '' ''
echo "🚀 Sending flake to ${machine} via nix copy:" else ''
( set -x; ${nix} ${nixOptions} copy ${flake} --to ssh://${userHost} ) echo "👤 SSH User: ${user}"
'' + (if hermetic then '' echo "🌐 SSH Host: ${host}"
echo "🤞 Activating configuration hermetically on ${machine} via ssh:" ''
( set -x; ${nix} ${nixOptions} copy --derivation ${nixos-rebuild} ${flock} --to ssh://${userHost} ) )
( set -x; ${openssh} -t ${userHost} "sudo nix-store --realise ${nixos-rebuild} ${flock} && sudo ${flock} -w 60 /dev/shm/nixinate-${machine} ${nixos-rebuild} ${nixOptions} ${switch} --flake ${flake}#${machine}" ) + (
'' else '' if remote
echo "🤞 Activating configuration non-hermetically on ${machine} via ssh:" then
( set -x; ${openssh} -t ${userHost} "sudo flock -w 60 /dev/shm/nixinate-${machine} nixos-rebuild ${switch} --flake ${flake}#${machine}" ) ''
'') echo "🚀 Sending flake to ${machine} via nix copy:"
else '' ( set -x; ${nix} ${nixOptions} copy ${flake} --to ssh://${userHost} )
echo "🔨 Building system closure locally, copying it to remote store and activating it:" ''
( set -x; NIX_SSHOPTS="-t" ${flock} -w 60 /dev/shm/nixinate-${machine} ${nixos-rebuild} ${nixOptions} ${switch} --flake ${flake}#${machine} --target-host ${userHost} --use-remote-sudo ${optionalString substituteOnTarget "-s"} ) + (
if hermetic
then ''
echo "🤞 Activating configuration hermetically on ${machine} via ssh:"
( set -x; ${nix} ${nixOptions} copy --derivation ${nixos-rebuild} ${flock} --to ssh://${userHost} )
( set -x; ${openssh} -t ${userHost} "sudo nix-store --realise ${nixos-rebuild} ${flock} && sudo ${flock} -w 60 /dev/shm/nixinate-${machine} ${nixos-rebuild} ${nixOptions} ${switch} --flake ${flake}#${machine}" )
''
else ''
echo "🤞 Activating configuration non-hermetically on ${machine} via ssh:"
( set -x; ${openssh} -t ${userHost} "sudo flock -w 60 /dev/shm/nixinate-${machine} nixos-rebuild ${switch} --flake ${flake}#${machine}" )
''
)
else ''
echo "🔨 Building system closure locally, copying it to remote store and activating it:"
( set -x; NIX_SSHOPTS="-t" ${flock} -w 60 /dev/shm/nixinate-${machine} ${nixos-rebuild} ${nixOptions} ${switch} --flake ${flake}#${machine} --target-host ${userHost} --use-remote-sudo ${optionalString substituteOnTarget "-s"} )
''); ''
in final.writeScript "deploy-${machine}.sh" script; );
in
final.writeScript "deploy-${machine}.sh" script;
in in
{ {
nixinate = nixinate = (
( nixpkgs.lib.genAttrs
nixpkgs.lib.genAttrs validMachines
validMachines (
(x: x: {
{ type = "app";
type = "app"; program = toString (mkDeployScript {
program = toString (mkDeployScript { machine = x;
machine = x; dryRun = false;
dryRun = false; });
}); }
} )
) // nixpkgs.lib.genAttrs
// nixpkgs.lib.genAttrs (map (a: a + "-dry-run") validMachines)
(map (a: a + "-dry-run") validMachines) (
(x: x: {
{ type = "app";
type = "app"; program = toString (mkDeployScript {
program = toString (mkDeployScript { machine = nixpkgs.lib.removeSuffix "-dry-run" x;
machine = nixpkgs.lib.removeSuffix "-dry-run" x; dryRun = true;
dryRun = true; });
}); }
} )
) );
);
}; };
}; };
nixinate = forAllSystems (system: pkgs: nixpkgsFor.${system}.generateApps); nixinate = forAllSystems (system: pkgs: nixpkgsFor.${system}.generateApps);
checks = forAllSystems (system: pkgs: checks = forAllSystems (
let system: pkgs:
vmTests = import ./tests { let
makeTest = (import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; }).makeTest; vmTests = import ./tests {
inherit inputs; pkgs = nixpkgsFor.${system}; makeTest = (import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; }).makeTest;
}; inherit inputs;
in pkgs = nixpkgsFor.${system};
pkgs.lib.optionalAttrs pkgs.stdenv.isLinux vmTests # vmTests can only be ran on Linux, so append them only if on Linux. };
// in
{ pkgs.lib.optionalAttrs pkgs.stdenv.isLinux vmTests # vmTests can only be ran on Linux, so append them only if on Linux.
# Other checks here... // {
} # Other checks here...
}
); );
}; };
} }

7
tests/default.nix
View file

@ -1,5 +1,8 @@
{ pkgs, makeTest, inputs }: { pkgs
{ , makeTest
, inputs
,
}: {
vmTestLocal = (import ./vmTest { inherit pkgs makeTest inputs; }).local; vmTestLocal = (import ./vmTest { inherit pkgs makeTest inputs; }).local;
vmTestRemote = (import ./vmTest { inherit pkgs makeTest inputs; }).remote; vmTestRemote = (import ./vmTest { inherit pkgs makeTest inputs; }).remote;
vmTestLocalHermetic = (import ./vmTest { inherit pkgs makeTest inputs; }).localHermetic; vmTestLocalHermetic = (import ./vmTest { inherit pkgs makeTest inputs; }).localHermetic;

7
tests/vmTest/common.nix
View file

@ -1,10 +1,11 @@
# Configuration that will be added to both the nixinatee node and the nixinator # Configuration that will be added to both the nixinatee node and the nixinator
# node. # node.
{ inputs }: { inputs }: {
{
nix = { nix = {
extraOptions = extraOptions =
let empty_registry = builtins.toFile "empty-flake-registry.json" ''{"flakes":[],"version":2}''; in let
empty_registry = builtins.toFile "empty-flake-registry.json" ''{"flakes":[],"version":2}'';
in
'' ''
experimental-features = nix-command flakes experimental-features = nix-command flakes
flake-registry = ${empty_registry} flake-registry = ${empty_registry}

86
tests/vmTest/default.nix
View file

@ -1,10 +1,15 @@
{ pkgs, makeTest, inputs }: { pkgs
, makeTest
, inputs
,
}:
let let
inherit (pkgs) lib; inherit (pkgs) lib;
# Return a store path with a closure containing everything including # Return a store path with a closure containing everything including
# derivations and all build dependency outputs, all the way down. # derivations and all build dependency outputs, all the way down.
allDrvOutputs = pkg: allDrvOutputs = pkg:
let name = "allDrvOutputs-${pkg.pname or pkg.name or "unknown"}"; let
name = "allDrvOutputs-${pkg.pname or pkg.name or "unknown"}";
in in
pkgs.runCommand name { refs = pkgs.writeReferencesToFile pkg.drvPath; } '' pkgs.runCommand name { refs = pkgs.writeReferencesToFile pkg.drvPath; } ''
touch $out touch $out
@ -18,12 +23,18 @@ let
''; '';
# Imports a flake with inputs passed in by hand, rather than # Imports a flake with inputs passed in by hand, rather than
# builtins.getFlake, which cannot be used in this way. # builtins.getFlake, which cannot be used in this way.
callLocklessFlake = path: inputs: let callLocklessFlake = path: inputs:
r = {outPath = path;} // let
((import (path + "/flake.nix")).outputs (inputs // {self = r;})); r =
in { outPath = path; }
// ((import (path + "/flake.nix")).outputs (inputs // { self = r; }));
in
r; r;
mkNixinateTest = { buildOn, hermetic ? false, ... }: mkNixinateTest =
{ buildOn
, hermetic ? false
, ...
}:
let let
exampleFlake = pkgs.writeTextFile { exampleFlake = pkgs.writeTextFile {
name = "nixinate-example-flake"; name = "nixinate-example-flake";
@ -68,7 +79,8 @@ let
]; ];
virtualisation = { virtualisation = {
writableStore = true; writableStore = true;
additionalPaths = [] additionalPaths =
[ ]
++ lib.optional (buildOn == "remote") (allDrvOutputs exampleSystem) ++ lib.optional (buildOn == "remote") (allDrvOutputs exampleSystem)
++ lib.optional (hermetic == true) (pkgs.nixinate.nixos-rebuild.drvPath) ++ lib.optional (hermetic == true) (pkgs.nixinate.nixos-rebuild.drvPath)
++ lib.optional (hermetic == true) (pkgs.flock.drvPath); ++ lib.optional (hermetic == true) (pkgs.flock.drvPath);
@ -79,38 +91,44 @@ let
(import ./common.nix { inherit inputs; }) (import ./common.nix { inherit inputs; })
]; ];
virtualisation = { virtualisation = {
additionalPaths = [ additionalPaths =
(allDrvOutputs exampleSystem) [
] (allDrvOutputs exampleSystem)
]
++ lib.optional (buildOn == "remote") exampleFlake ++ lib.optional (buildOn == "remote") exampleFlake
++ lib.optional (hermetic == true) pkgs.flock.drvPath; ++ lib.optional (hermetic == true) pkgs.flock.drvPath;
}; };
}; };
}; };
testScript = testScript = ''
'' start_all()
start_all() nixinatee.wait_for_unit("sshd.service")
nixinatee.wait_for_unit("sshd.service") nixinator.wait_for_unit("multi-user.target")
nixinator.wait_for_unit("multi-user.target") nixinator.succeed("mkdir ~/.ssh/")
nixinator.succeed("mkdir ~/.ssh/") nixinator.succeed("ssh-keyscan -H nixinatee >> ~/.ssh/known_hosts")
nixinator.succeed("ssh-keyscan -H nixinatee >> ~/.ssh/known_hosts") nixinator.succeed("exec ${deployScript.nixinate.nixinatee.program} >&2")
nixinator.succeed("exec ${deployScript.nixinate.nixinatee.program} >&2") nixinatee.wait_for_unit("nginx.service")
nixinatee.wait_for_unit("nginx.service") nixinatee.wait_for_open_port("80")
nixinatee.wait_for_open_port("80") with subtest("Check that Nginx webserver can be reached by deployer after deployment"):
with subtest("Check that Nginx webserver can be reached by deployer after deployment"): assert "<title>Welcome to nginx!</title>" in nixinator.succeed(
assert "<title>Welcome to nginx!</title>" in nixinator.succeed( "curl -sSf http:/nixinatee/ | grep title"
"curl -sSf http:/nixinatee/ | grep title" )
) with subtest("Check that Nginx webserver can be reached by deployee after deployment"):
with subtest("Check that Nginx webserver can be reached by deployee after deployment"): assert "<title>Welcome to nginx!</title>" in nixinatee.succeed(
assert "<title>Welcome to nginx!</title>" in nixinatee.succeed( "curl -sSf http:/127.0.0.1/ | grep title"
"curl -sSf http:/127.0.0.1/ | grep title" )
) '';
'';
}; };
in in
{ {
local = (mkNixinateTest { buildOn = "local"; }); local = mkNixinateTest { buildOn = "local"; };
remote = (mkNixinateTest { buildOn = "remote"; }); remote = mkNixinateTest { buildOn = "remote"; };
localHermetic = (mkNixinateTest { buildOn = "local"; hermetic = true; }); localHermetic = mkNixinateTest {
remoteHermetic = (mkNixinateTest { buildOn = "remote"; hermetic = true; }); buildOn = "local";
hermetic = true;
};
remoteHermetic = mkNixinateTest {
buildOn = "remote";
hermetic = true;
};
} }

18
tests/vmTest/nixinateeBase.nix
View file

@ -3,13 +3,17 @@
{ {
config = { config = {
nix.trustedUsers = [ "nixinator" ]; nix.trustedUsers = [ "nixinator" ];
security.sudo.extraRules = [{ security.sudo.extraRules = [
users = [ "nixinator" ]; {
commands = [{ users = [ "nixinator" ];
command = "ALL"; commands = [
options = [ "NOPASSWD" ]; {
}]; command = "ALL";
}]; options = [ "NOPASSWD" ];
}
];
}
];
users = { users = {
mutableUsers = false; mutableUsers = false;
users = { users = {