mirrors/attic
1
0
Fork 0
mirror of https://github.com/zhaofengli/attic.git synced 2024-12-14 11:57:30 +00:00
Code Activity

nixos: Match nixpkgs formatting

Browse source 
Co-authored-by: Adam Stephens <adam@valkor.net>
This commit is contained in:
Zhaofeng Li 2024-10-14 10:23:29 -06:00
parent b3a76bc237
commit 7ffcf2d138
1 changed files with 117 additions and 93 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

100
nixos/atticd.nix
View file

@ -1,4 +1,9 @@
{ lib, pkgs, config, ... }:
{
lib,
pkgs,
config,
...
}:
let
inherit (lib) types;
@ -11,9 +16,12 @@ let
format = pkgs.formats.toml { };
checkedConfigFile = pkgs.runCommand "checked-attic-server.toml" {
checkedConfigFile =
pkgs.runCommand "checked-attic-server.toml"
{
configFile = cfg.configFile;
} ''
}
''
cat $configFile
export ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="dGVzdCBzZWNyZXQ="
@ -51,29 +59,25 @@ let
${atticadmShim} "$@"
'';
hasLocalPostgresDB = let
hasLocalPostgresDB =
let
url = cfg.settings.database.url or "";
localStrings = [ "localhost" "127.0.0.1" "/run/postgresql" ];
localStrings = [
"localhost"
"127.0.0.1"
"/run/postgresql"
];
hasLocalStrings = lib.any (lib.flip lib.hasInfix url) localStrings;
in config.services.postgresql.enable && lib.hasPrefix "postgresql://" url && hasLocalStrings;
in
config.services.postgresql.enable && lib.hasPrefix "postgresql://" url && hasLocalStrings;
in
{
options = {
services.atticd = {
enable = lib.mkOption {
description = ''
Whether to enable the atticd, the Nix Binary Cache server.
'';
type = types.bool;
default = false;
};
package = lib.mkOption {
description = ''
The package to use.
'';
type = types.package;
default = pkgs.attic-server;
};
enable = lib.mkEnableOption "the atticd, the Nix Binary Cache server";
package = lib.mkPackageOption pkgs "attic-server" { };
credentialsFile = lib.mkOption {
description = ''
Path to an EnvironmentFile containing required environment
@ -85,6 +89,7 @@ in
type = types.nullOr types.path;
default = null;
};
user = lib.mkOption {
description = ''
The group under which attic runs.
@ -92,6 +97,7 @@ in
type = types.str;
default = "atticd";
};
group = lib.mkOption {
description = ''
The user under which attic runs.
@ -99,6 +105,7 @@ in
type = types.str;
default = "atticd";
};
settings = lib.mkOption {
description = ''
Structured configurations of atticd.
@ -106,6 +113,7 @@ in
type = format.type;
default = { }; # setting defaults here does not compose well
};
configFile = lib.mkOption {
description = ''
Path to an existing atticd configuration file.
@ -131,7 +139,11 @@ in
There are several other supported modes that perform one-off operations, but these are the only ones that make sense to run via the NixOS module.
'';
type = lib.types.enum ["monolithic" "api-server" "garbage-collector"];
type = lib.types.enum [
"monolithic"
"api-server"
"garbage-collector"
];
default = "monolithic";
};
@ -146,8 +158,8 @@ in
};
};
};
config = lib.mkIf (cfg.enable) (lib.mkMerge [
{
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.credentialsFile != null;
@ -184,8 +196,11 @@ in
systemd.services.atticd = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ]
++ lib.optionals hasLocalPostgresDB [ "postgresql.service" "nss-lookup.target" ];
after = [ "network.target" ] ++ lib.optionals hasLocalPostgresDB [
"postgresql.service"
"nss-lookup.target"
];
serviceConfig = {
ExecStart = "${cfg.package}/bin/atticd -f ${checkedConfigFile} --mode ${cfg.mode}";
EnvironmentFile = cfg.credentialsFile;
@ -193,6 +208,9 @@ in
DynamicUser = true;
User = cfg.user;
Group = cfg.group;
Restart = "on-failure";
RestartSec = 10;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
@ -200,23 +218,29 @@ in
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
Restart = "on-failure";
RestartSec = 10;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
ReadWritePaths =
let
path = cfg.settings.storage.path;
isDefaultStateDirectory = path == "/var/lib/atticd" || lib.hasPrefix "/var/lib/atticd/" path;
in
lib.optionals (cfg.settings.storage.type or "" == "local" && !isDefaultStateDirectory) [ path ];
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
ReadWritePaths = let
path = cfg.settings.storage.path;
isDefaultStateDirectory = path == "/var/lib/atticd" || lib.hasPrefix "/var/lib/atticd/" path;
in lib.optionals (cfg.settings.storage.type or "" == "local" && !isDefaultStateDirectory) [ path ];
};
};
environment.systemPackages = [ atticadmWrapper ];
}
(lib.mkIf cfg.useFlakeCompatOverlay {
nixpkgs.overlays = [ overlay ];
})
]);
environment.systemPackages = [
atticadmWrapper
];
nixpkgs.overlays = lib.mkIf cfg.useFlakeCompatOverlay [
overlay
];
};
}