commit a72f22d0d8f91bda1fa8f546fd569c99e10d4b1e · pyrox.dev/nixpkgs

nixos/modules/module-list.nix

···

       1364
        
         ./services/scheduling/atd.nix

     

       1365
        
         ./services/scheduling/cron.nix

     

       1366
        
         ./services/scheduling/fcron.nix

     

       0
        
       
     

       1367
        
         ./services/scheduling/scx.nix

     

       1368
        
         ./services/search/elasticsearch-curator.nix

     

       1369
        
         ./services/search/elasticsearch.nix

···

       1364
        
         ./services/scheduling/atd.nix

     

       1365
        
         ./services/scheduling/cron.nix

     

       1366
        
         ./services/scheduling/fcron.nix

     

       1367
       +
         ./services/scheduling/prefect.nix

     

       1368
        
         ./services/scheduling/scx.nix

     

       1369
        
         ./services/search/elasticsearch-curator.nix

     

       1370
        
         ./services/search/elasticsearch.nix

+232

nixos/modules/services/scheduling/prefect.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         pkgs,

     

       4
       +
         config,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       

     

       8
       +
       let

     

       9
       +
         cfg = config.services.prefect;

     

       10
       +
         inherit (lib.types)

     

       11
       +
           bool

     

       12
       +
           str

     

       13
       +
           enum

     

       14
       +
           path

     

       15
       +
           attrsOf

     

       16
       +
           nullOr

     

       17
       +
           submodule

     

       18
       +
           port

     

       19
       +
           ;

     

       20
       +
       

     

       21
       +
       in

     

       22
       +
       {

     

       23
       +
         options.services.prefect = {

     

       24
       +
           enable = lib.mkOption {

     

       25
       +
             type = bool;

     

       26
       +
             default = false;

     

       27
       +
             description = "enable prefect server and worker services";

     

       28
       +
           };

     

       29
       +
       

     

       30
       +
           package = lib.mkPackageOption pkgs "prefect" { };

     

       31
       +
       

     

       32
       +
           host = lib.mkOption {

     

       33
       +
             type = str;

     

       34
       +
             default = "127.0.0.1";

     

       35
       +
             example = "0.0.0.0";

     

       36
       +
             description = "Prefect server host";

     

       37
       +
           };

     

       38
       +
       

     

       39
       +
           port = lib.mkOption {

     

       40
       +
             type = port;

     

       41
       +
             default = 4200;

     

       42
       +
             description = "Prefect server port";

     

       43
       +
           };

     

       44
       +
       

     

       45
       +
           dataDir = lib.mkOption {

     

       46
       +
             type = path;

     

       47
       +
             default = "/var/lib/prefect-server";

     

       48
       +
             description = ''

     

       49
       +
               Specify the directory for Prefect.

     

       50
       +
             '';

     

       51
       +
           };

     

       52
       +
       

     

       53
       +
           database = lib.mkOption {

     

       54
       +
             type = enum [

     

       55
       +
               "sqlite"

     

       56
       +
               "postgres"

     

       57
       +
             ];

     

       58
       +
             default = "sqlite";

     

       59
       +
             description = "which database to use for prefect server: sqlite or postgres";

     

       60
       +
           };

     

       61
       +
       

     

       62
       +
           databaseHost = lib.mkOption {

     

       63
       +
             type = str;

     

       64
       +
             default = "localhost";

     

       65
       +
             description = "database host for postgres only";

     

       66
       +
           };

     

       67
       +
       

     

       68
       +
           databasePort = lib.mkOption {

     

       69
       +
             type = str;

     

       70
       +
             default = "5432";

     

       71
       +
             description = "database port for postgres only";

     

       72
       +
           };

     

       73
       +
       

     

       74
       +
           databaseName = lib.mkOption {

     

       75
       +
             type = str;

     

       76
       +
             default = "prefect";

     

       77
       +
             description = "database name for postgres only";

     

       78
       +
           };

     

       79
       +
       

     

       80
       +
           databaseUser = lib.mkOption {

     

       81
       +
             type = str;

     

       82
       +
             default = "postgres";

     

       83
       +
             description = "database user for postgres only";

     

       84
       +
           };

     

       85
       +
       

     

       86
       +
           databasePasswordFile = lib.mkOption {

     

       87
       +
             type = nullOr str;

     

       88
       +
             default = null;

     

       89
       +
             description = ''

     

       90
       +
               path to a file containing e.g.:

     

       91
       +
                 DBPASSWORD=supersecret

     

       92
       +
       

     

       93
       +
               stored outside the nix store, read by systemd as EnvironmentFile.

     

       94
       +
             '';

     

       95
       +
           };

     

       96
       +
       

     

       97
       +
           # now define workerPools as an attribute set of submodules,

     

       98
       +
           # each key is the pool name, and the submodule has an installPolicy

     

       99
       +
           workerPools = lib.mkOption {

     

       100
       +
             type = attrsOf (submodule {

     

       101
       +
               options = {

     

       102
       +
                 installPolicy = lib.mkOption {

     

       103
       +
                   type = enum [

     

       104
       +
                     "always"

     

       105
       +
                     "if-not-present"

     

       106
       +
                     "never"

     

       107
       +
                     "prompt"

     

       108
       +
                   ];

     

       109
       +
                   default = "always";

     

       110
       +
                   description = "install policy for the worker (always, if-not-present, never, prompt)";

     

       111
       +
                 };

     

       112
       +
               };

     

       113
       +
             });

     

       114
       +
             default = { };

     

       115
       +
             description = ''

     

       116
       +
               define a set of worker pools with submodule config. example:

     

       117
       +
               workerPools.my-pool = {

     

       118
       +
                 installPolicy = "never";

     

       119
       +
               };

     

       120
       +
             '';

     

       121
       +
           };

     

       122
       +
       

     

       123
       +
           baseUrl = lib.mkOption {

     

       124
       +
             type = nullOr str;

     

       125
       +
             default = null;

     

       126
       +
             description = "external url when served by a reverse proxy, e.g. https://example.com/prefect";

     

       127
       +
           };

     

       128
       +
         };

     

       129
       +
       

     

       130
       +
         config = lib.mkIf cfg.enable {

     

       131
       +
           # define systemd.services as the server plus any worker definitions

     

       132
       +
           systemd.services =

     

       133
       +
             {

     

       134
       +
               "prefect-server" = {

     

       135
       +
                 description = "prefect server";

     

       136
       +
                 wantedBy = [ "multi-user.target" ];

     

       137
       +
                 after = [ "network.target" ];

     

       138
       +
       

     

       139
       +
                 serviceConfig = {

     

       140
       +
                   DynamicUser = true;

     

       141
       +
                   StateDirectory = "prefect-server";

     

       142
       +
                   # TODO all my efforts to setup the database url

     

       143
       +
                   # have failed with some unable to open file

     

       144
       +
                   Environment = [

     

       145
       +
                     "PREFECT_HOME=%S/prefect-server"

     

       146
       +
                     "PREFECT_UI_STATIC_DIRECTORY=%S/prefect-server"

     

       147
       +
                     "PREFECT_SERVER_ANALYTICS_ENABLED=off"

     

       148
       +
                     "PREFECT_UI_API_URL=${cfg.baseUrl}/api"

     

       149
       +
                     "PREFECT_UI_URL=${cfg.baseUrl}"

     

       150
       +
                   ];

     

       151
       +
                   EnvironmentFile =

     

       152
       +
                     if cfg.database == "postgres" && cfg.databasePasswordFile != null then

     

       153
       +
                       [ cfg.databasePasswordFile ]

     

       154
       +
                     else

     

       155
       +
                       [ ];

     

       156
       +
       

     

       157
       +
                   # ReadWritePaths = [ cfg.dataDir ];

     

       158
       +
                   ProtectSystem = "strict";

     

       159
       +
                   ProtectHome = true;

     

       160
       +
                   PrivateTmp = true;

     

       161
       +
                   NoNewPrivileges = true;

     

       162
       +
                   MemoryDenyWriteExecute = true;

     

       163
       +
                   LockPersonality = true;

     

       164
       +
                   CapabilityBoundingSet = [ ];

     

       165
       +
                   AmbientCapabilities = [ ];

     

       166
       +
                   RestrictSUIDSGID = true;

     

       167
       +
                   RestrictAddressFamilies = [

     

       168
       +
                     "AF_INET"

     

       169
       +
                     "AF_INET6"

     

       170
       +
                     "AF_UNIX"

     

       171
       +
                   ];

     

       172
       +
                   ProtectKernelTunables = true;

     

       173
       +
                   ProtectKernelModules = true;

     

       174
       +
                   ProtectKernelLogs = true;

     

       175
       +
                   ProtectControlGroups = true;

     

       176
       +
                   MemoryAccounting = true;

     

       177
       +
                   CPUAccounting = true;

     

       178
       +
       

     

       179
       +
                   ExecStart = "${pkgs.prefect}/bin/prefect server start --host ${cfg.host} --port ${toString cfg.port}";

     

       180
       +
                   Restart = "always";

     

       181
       +
                   WorkingDirectory = cfg.dataDir;

     

       182
       +
                 };

     

       183
       +
               };

     

       184
       +
             }

     

       185
       +
             // lib.concatMapAttrs (poolName: poolCfg: {

     

       186
       +
               # return a partial attr set with one key: "prefect-worker-..."

     

       187
       +
               "prefect-worker-${poolName}" = {

     

       188
       +
                 description = "prefect worker for pool '${poolName}'";

     

       189
       +
                 wantedBy = [ "multi-user.target" ];

     

       190
       +
                 after = [ "network.target" ];

     

       191
       +
       

     

       192
       +
                 environment.systemPackages = cfg.package;

     

       193
       +
       

     

       194
       +
                 serviceConfig = {

     

       195
       +
                   DynamicUser = true;

     

       196
       +
                   StateDirectory = "prefect-worker-${poolName}";

     

       197
       +
                   Environment = [

     

       198
       +
                     "PREFECT_HOME=%S/prefect-worker-${poolName}"

     

       199
       +
                     "PREFECT_API_URL=${cfg.baseUrl}/api"

     

       200
       +
                   ];

     

       201
       +
                   ProtectSystem = "strict";

     

       202
       +
                   ProtectHome = true;

     

       203
       +
                   PrivateTmp = true;

     

       204
       +
                   NoNewPrivileges = true;

     

       205
       +
                   MemoryDenyWriteExecute = true;

     

       206
       +
                   LockPersonality = true;

     

       207
       +
                   CapabilityBoundingSet = [ ];

     

       208
       +
                   AmbientCapabilities = [ ];

     

       209
       +
                   RestrictSUIDSGID = true;

     

       210
       +
                   RestrictAddressFamilies = [

     

       211
       +
                     "AF_INET"

     

       212
       +
                     "AF_INET6"

     

       213
       +
                     "AF_UNIX"

     

       214
       +
                   ];

     

       215
       +
                   ProtectKernelTunables = true;

     

       216
       +
                   ProtectKernelModules = true;

     

       217
       +
                   ProtectKernelLogs = true;

     

       218
       +
                   ProtectControlGroups = true;

     

       219
       +
                   MemoryAccounting = true;

     

       220
       +
                   CPUAccounting = true;

     

       221
       +
                   ExecStart = ''

     

       222
       +
                     ${pkgs.prefect}/bin/prefect worker start \

     

       223
       +
                       --pool ${poolName} \

     

       224
       +
                       --type process \

     

       225
       +
                       --install-policy ${poolCfg.installPolicy}

     

       226
       +
                   '';

     

       227
       +
                   Restart = "always";

     

       228
       +
                 };

     

       229
       +
               };

     

       230
       +
             }) cfg.workerPools;

     

       231
       +
         };

     

       232
       +
       }

nixos/tests/all-tests.nix

···

       969
        
         pppd = handleTest ./pppd.nix {};

     

       970
        
         predictable-interface-names = handleTest ./predictable-interface-names.nix {};

     

       971
        
         pretalx = runTest ./web-apps/pretalx.nix;

     

       0
        
       
     

       972
        
         pretix = runTest ./web-apps/pretix.nix;

     

       973
        
         printing-socket = handleTest ./printing.nix { socket = true; listenTcp = true; };

     

       974
        
         printing-service = handleTest ./printing.nix { socket = false; listenTcp = true; };

···

       969
        
         pppd = handleTest ./pppd.nix {};

     

       970
        
         predictable-interface-names = handleTest ./predictable-interface-names.nix {};

     

       971
        
         pretalx = runTest ./web-apps/pretalx.nix;

     

       972
       +
         prefect = runTest ./prefect.nix;

     

       973
        
         pretix = runTest ./web-apps/pretix.nix;

     

       974
        
         printing-socket = handleTest ./printing.nix { socket = true; listenTcp = true; };

     

       975
        
         printing-service = handleTest ./printing.nix { socket = false; listenTcp = true; };

+27

nixos/tests/prefect.nix

···

       1
       +
       { lib, ... }:

     

       2
       +
       let

     

       3
       +
         mainPort = "4200";

     

       4
       +
       in

     

       5
       +
       {

     

       6
       +
         name = "prefect";

     

       7
       +
       

     

       8
       +
         nodes = {

     

       9
       +
           machine =

     

       10
       +
             { ... }:

     

       11
       +
             {

     

       12
       +
               services.prefect = {

     

       13
       +
                 enable = true;

     

       14
       +
               };

     

       15
       +
             };

     

       16
       +
         };

     

       17
       +
       

     

       18
       +
         testScript = ''

     

       19
       +
           machine.start()

     

       20
       +
           machine.wait_for_unit("prefect-server.service")

     

       21
       +
           machine.wait_for_open_port("${mainPort}")

     

       22
       +
         '';

     

       23
       +
       

     

       24
       +
         meta = with lib.maintainers; {

     

       25
       +
           maintainers = [ happysalada ];

     

       26
       +
         };

     

       27
       +
       }

+42

pkgs/by-name/pr/prefect/make_ui_files_writeable_on_startup.patch

···

       1
       +
       From a97d5f501ff3125d96e6c64dfa498ca1a598a4bd Mon Sep 17 00:00:00 2001

     

       2
       +
       From: happysalada <raphael@megzari.com>

     

       3
       +
       Date: Sun, 2 Mar 2025 08:30:36 -0500

     

       4
       +
       Subject: [PATCH] feat: ensure ui files are writeable On startup prefect copies

     

       5
       +
        over files from the ui into the ui directory. If for any reason the ui files

     

       6
       +
        were not writeable, the whole setup will fail. This PR ensures that the

     

       7
       +
        copied files are writeable. To give a bit more context, I am currently

     

       8
       +
        packaging Prefect for nixos. Nix having a little bit of a strict build

     

       9
       +
        system, makes sure that the built package has only read-only files. this is

     

       10
       +
        to ensure the build is deterministic. I understand that this might appear as

     

       11
       +
        a detail related to nix build system only. I can patch the source when

     

       12
       +
        building the nix package, but I thought I would try to contribute the patch.

     

       13
       +
        No hard feelings if you are not interested in this patch. Thank you for

     

       14
       +
        developping prefect!

     

       15
       +
       

     

       16
       +
       fix formatting

     

       17
       +
       ---

     

       18
       +
        src/prefect/server/api/server.py | 6 ++++++

     

       19
       +
        1 file changed, 6 insertions(+)

     

       20
       +
       

     

       21
       +
       diff --git a/src/prefect/server/api/server.py b/src/prefect/server/api/server.py

     

       22
       +
       index e5b64d527..ac64616ef 100644

     

       23
       +
       --- a/src/prefect/server/api/server.py

     

       24
       +
       +++ b/src/prefect/server/api/server.py

     

       25
       +
       @@ -250,8 +250,14 @@ def copy_directory(directory: str, path: str) -> None:

     

       26
       +
                    if os.path.exists(destination):

     

       27
       +
                        shutil.rmtree(destination)

     

       28
       +
                    shutil.copytree(source, destination, symlinks=True)

     

       29
       +
       +            # ensure copied files are writeable

     

       30
       +
       +            for root, dirs, files in os.walk(destination):

     

       31
       +
       +                for f in files:

     

       32
       +
       +                    os.chmod(os.path.join(root, f), 0o600)

     

       33
       +
                else:

     

       34
       +
                    shutil.copy2(source, destination)

     

       35
       +
       +            # Ensure copied file is writeable

     

       36
       +
       +            os.chmod(destination, 0o600)

     

       37
       +
        

     

       38
       +
        

     

       39
       +
        async def custom_internal_exception_handler(

     

       40
       +
       -- 

     

       41
       +
       2.48.1

     

       42
       +

+15

pkgs/by-name/pr/prefect/package.nix

···

       2
        
         lib,

     

       3
        
         python3Packages,

     

       4
        
         fetchPypi,

     

       0
        
       
     

       5
        
       }:

     

       6
        
       

     

       7
        
       python3Packages.buildPythonApplication rec {

     
···

       17
        
           inherit pname version;

     

       18
        
           hash = "sha256-4kwGrKvDihBi6Gcvcf6ophNI6GGd+M4qR0nnu/AUK1Q=";

     

       19
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       20
        
       

     

       21
        
         pythonRelaxDeps = [

     

       22
        
           "websockets"

     
···

       145
        
           sqlalchemy = [

     

       146
        
             # prefect-sqlalchemy

     

       147
        
           ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       148
        
         };

     

       149
        
       

     

       150
        
         # Tests are not included in the pypi source

···

       2
        
         lib,

     

       3
        
         python3Packages,

     

       4
        
         fetchPypi,

     

       5
       +
         nixosTests,

     

       6
        
       }:

     

       7
        
       

     

       8
        
       python3Packages.buildPythonApplication rec {

     
···

       18
        
           inherit pname version;

     

       19
        
           hash = "sha256-4kwGrKvDihBi6Gcvcf6ophNI6GGd+M4qR0nnu/AUK1Q=";

     

       20
        
         };

     

       21
       +
       

     

       22
       +
         patches = [

     

       23
       +
           ./make_ui_files_writeable_on_startup.patch

     

       24
       +
         ];

     

       25
        
       

     

       26
        
         pythonRelaxDeps = [

     

       27
        
           "websockets"

     
···

       150
        
           sqlalchemy = [

     

       151
        
             # prefect-sqlalchemy

     

       152
        
           ];

     

       153
       +
         };

     

       154
       +
       

     

       155
       +
         makeWrapperArgs = [

     

       156
       +
           # Add the installed directories to the python path so the worker can find them

     

       157
       +
           "--prefix PYTHONPATH : ${python3Packages.makePythonPath dependencies}"

     

       158
       +
           "--prefix PYTHONPATH : $out/${python3Packages.python.sitePackages}"

     

       159
       +
         ];

     

       160
       +
       

     

       161
       +
         passthru.tests = {

     

       162
       +
           inherit (nixosTests) prefect;

     

       163
        
         };

     

       164
        
       

     

       165
        
         # Tests are not included in the pypi source