commit f5ee08446ae3b6d3bb3e86a70a49e3ab0ce0039f · pyrox.dev/nixpkgs

+34

nixos/doc/manual/default.nix

···

       15
        
         inherit (pkgs) buildPackages runCommand docbook_xsl_ns;

     

       16
        
       

     

       17
        
         inherit (pkgs.lib)

     

       0
        
       
     

       18
        
           hasPrefix

     

       19
        
           removePrefix

     

       20
        
           flip

     
···

       117
        
               ${testOptionsDoc.optionsJSON}/${common.outputPath}/options.json

     

       118
        
           sed -e '/@PYTHON_MACHINE_METHODS@/ {' -e 'r ${testDriverMachineDocstrings}/machine-methods.md' -e 'd' -e '}' \

     

       119
        
             -i ./development/writing-nixos-tests.section.md

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       120
        
         '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       121
        
       

     

       122
        
       in

     

       123
        
       rec {

···

       15
        
         inherit (pkgs) buildPackages runCommand docbook_xsl_ns;

     

       16
        
       

     

       17
        
         inherit (pkgs.lib)

     

       18
       +
           evalModules

     

       19
        
           hasPrefix

     

       20
        
           removePrefix

     

       21
        
           flip

     
···

       118
        
               ${testOptionsDoc.optionsJSON}/${common.outputPath}/options.json

     

       119
        
           sed -e '/@PYTHON_MACHINE_METHODS@/ {' -e 'r ${testDriverMachineDocstrings}/machine-methods.md' -e 'd' -e '}' \

     

       120
        
             -i ./development/writing-nixos-tests.section.md

     

       121
       +
           substituteInPlace ./development/modular-services.md \

     

       122
       +
             --replace-fail \

     

       123
       +
               '@PORTABLE_SERVICE_OPTIONS@' \

     

       124
       +
               ${portableServiceOptions.optionsJSON}/${common.outputPath}/options.json

     

       125
       +
           substituteInPlace ./development/modular-services.md \

     

       126
       +
             --replace-fail \

     

       127
       +
               '@SYSTEMD_SERVICE_OPTIONS@' \

     

       128
       +
               ${systemdServiceOptions.optionsJSON}/${common.outputPath}/options.json

     

       129
        
         '';

     

       130
       +
       

     

       131
       +
         portableServiceOptions = buildPackages.nixosOptionsDoc {

     

       132
       +
           inherit (evalModules { modules = [ ../../modules/system/service/portable/service.nix ]; }) options;

     

       133
       +
           inherit revision warningsAreErrors;

     

       134
       +
           transformOptions =

     

       135
       +
             opt:

     

       136
       +
             opt

     

       137
       +
             // {

     

       138
       +
               # Clean up declaration sites to not refer to the NixOS source tree.

     

       139
       +
               declarations = map stripAnyPrefixes opt.declarations;

     

       140
       +
             };

     

       141
       +
         };

     

       142
       +
       

     

       143
       +
         systemdServiceOptions = buildPackages.nixosOptionsDoc {

     

       144
       +
           inherit (evalModules { modules = [ ../../modules/system/service/systemd/service.nix ]; }) options;

     

       145
       +
           # TODO: filter out options that are not systemd-specific, maybe also change option prefix to just `service-opt-`?

     

       146
       +
           inherit revision warningsAreErrors;

     

       147
       +
           transformOptions =

     

       148
       +
             opt:

     

       149
       +
             opt

     

       150
       +
             // {

     

       151
       +
               # Clean up declaration sites to not refer to the NixOS source tree.

     

       152
       +
               declarations = map stripAnyPrefixes opt.declarations;

     

       153
       +
             };

     

       154
       +
         };

     

       155
        
       

     

       156
        
       in

     

       157
        
       rec {

nixos/doc/manual/development/development.md

···

       12
        
       nixos-tests.chapter.md

     

       13
        
       developing-the-test-driver.chapter.md

     

       14
        
       testing-installer.chapter.md

     

       0
        
       
     

       15
        
       ```

···

       12
        
       nixos-tests.chapter.md

     

       13
        
       developing-the-test-driver.chapter.md

     

       14
        
       testing-installer.chapter.md

     

       15
       +
       modular-services.md

     

       16
        
       ```

+98

nixos/doc/manual/development/modular-services.md

···

       1
       +
       

     

       2
       +
       # Modular Services {#modular-services}

     

       3
       +
       

     

       4
       +
       Status: in development. This functionality is new in NixOS 25.11, and significant changes should be expected. We'd love to hear your feedback in <https://github.com/NixOS/nixpkgs/pull/372170>

     

       5
       +
       

     

       6
       +
       Traditionally, NixOS services were defined using sets of options *in* modules, not *as* modules. This made them non-modular, resulting in problems with composability, reuse, and portability.

     

       7
       +
       

     

       8
       +
       A configuration management framework is an application of `evalModules` with the `class` and `specialArgs` input attribute set to particular values.

     

       9
       +
       NixOS is such a configuration management framework, and so are [Home Manager](https://github.com/nix-community/home-manager) and [`nix-darwin`](https://github.com/lnl7/nix-darwin).

     

       10
       +
       

     

       11
       +
       The service management component of a configuration management framework is the set of module options that connects Nix expressions with the underlying service (or process) manager.

     

       12
       +
       For NixOS this is the module wrapping [`systemd`](https://systemd.io/), on `nix-darwin` this is the module wrapping [`launchd`](https://en.wikipedia.org/wiki/Launchd).

     

       13
       +
       

     

       14
       +
       A *modular service* is a [module] that defines values for a core set of options declared in the service management component of a configuration management framework, including which program to run.

     

       15
       +
       Since it's a module, it can be composed with other modules via `imports` to extend its functionality.

     

       16
       +
       

     

       17
       +
       NixOS provides two options into which such modules can be plugged:

     

       18
       +
       

     

       19
       +
       - `system.services.<name>`

     

       20
       +
       - an option for user services (TBD)

     

       21
       +
       

     

       22
       +
       Crucially, these options have the type [`attrsOf`] [`submodule`].

     

       23
       +
       The name of the service is the attribute name corresponding to `attrsOf`.

     

       24
       +
       <!-- ^ This is how composition is *always* provided, instead of a difficult thing (but this is reference docs, not a changelog) -->

     

       25
       +
       The `submodule` is pre-loaded with two modules:

     

       26
       +
       - a generic module that is intended to be portable

     

       27
       +
       - a module with systemd-specific options, whose values or defaults derive from the generic module's option values.

     

       28
       +
       

     

       29
       +
       So note that the default value of `system.services.<name>` is not a complete service. It requires that the user provide a value, and this is typically done by importing a module. For example:

     

       30
       +
       

     

       31
       +
       <!-- Not using typical example syntax, because reading this is *not* optional, and should it should not be folded closed. -->

     

       32
       +
       ```nix

     

       33
       +
       {

     

       34
       +
         system.services.my-service-instance = {

     

       35
       +
           imports = [ pkgs.some-application.services.some-service-module ];

     

       36
       +
           foo.settings = {

     

       37
       +
             # ...

     

       38
       +
           };

     

       39
       +
         };

     

       40
       +
       }

     

       41
       +
       ```

     

       42
       +
       

     

       43
       +
       ## Portability {#modular-service-portability}

     

       44
       +
       

     

       45
       +
       It is possible to write service modules that are portable. This is done by either avoiding the `systemd` option tree, or by defining process-manager-specific definitions in an optional way:

     

       46
       +
       

     

       47
       +
       ```nix

     

       48
       +
       { config, options, lib, ... }: {

     

       49
       +
         _class = "service";

     

       50
       +
         config = {

     

       51
       +
           process.argv = [ (lib.getExe config.foo.program) ];

     

       52
       +
         } // lib.optionalAttrs (options?systemd) {

     

       53
       +
           # ... systemd-specific definitions ...

     

       54
       +
         };

     

       55
       +
       }

     

       56
       +
       ```

     

       57
       +
       

     

       58
       +
       This way, the module can be loaded into a configuration manager that does not use systemd, and the `systemd` definitions will be ignored.

     

       59
       +
       Similarly, other configuration managers can declare their own options for services to customize.

     

       60
       +
       

     

       61
       +
       ## Composition and Ownership {#modular-service-composition}

     

       62
       +
       

     

       63
       +
       Compared to traditional services, modular services are inherently more composable, by virtue of being modules and receiving a user-provided name when imported.

     

       64
       +
       However, composition can not end there, because services need to be able to interact with each other.

     

       65
       +
       This can be achieved in two ways:

     

       66
       +
       1. Users can link services together by providing the necessary NixOS configuration.

     

       67
       +
       2. Services can be compositions of other services.

     

       68
       +
       

     

       69
       +
       These aren't mutually exclusive. In fact, it is a good practice when developing services to first write them as individual services, and then compose them into a higher-level composition. Each of these services is a valid modular service, including their composition.

     

       70
       +
       

     

       71
       +
       ## Migration {#modular-service-migration}

     

       72
       +
       

     

       73
       +
       Many services could be migrated to the modular service system, but even when the modular service system is mature, it is not necessary to migrate all services.

     

       74
       +
       For instance, many system-wide services are a mandatory part of a desktop system, and it doesn't make sense to have multiple instances of them.

     

       75
       +
       Moving their logic into separate Nix files may still be beneficial for the efficient evaluation of configurations that don't use those services, but that is a rather minor benefit, unless modular services potentially become the standard way to define services.

     

       76
       +
       

     

       77
       +
       <!-- TODO example of a single-instance service -->

     

       78
       +
       

     

       79
       +
       ## Portable Service Options {#modular-service-options-portable}

     

       80
       +
       

     

       81
       +
       ```{=include=} options

     

       82
       +
       id-prefix: service-opt-

     

       83
       +
       list-id: service-options

     

       84
       +
       source: @PORTABLE_SERVICE_OPTIONS@

     

       85
       +
       ```

     

       86
       +
       

     

       87
       +
       ## Systemd-specific Service Options {#modular-service-options-systemd}

     

       88
       +
       

     

       89
       +
       ```{=include=} options

     

       90
       +
       id-prefix: systemd-service-opt-

     

       91
       +
       list-id: systemd-service-options

     

       92
       +
       source: @SYSTEMD_SERVICE_OPTIONS@

     

       93
       +
       ```

     

       94
       +
       

     

       95
       +
       [module]: https://nixos.org/manual/nixpkgs/stable/index.html#module-system

     

       96
       +
       <!-- TODO: more anchors -->

     

       97
       +
       [`attrsOf`]: #sec-option-types-composed

     

       98
       +
       [`submodule`]: #sec-option-types-submodule

+18

nixos/doc/manual/redirects.json

···

       11
        
         "book-nixos-manual": [

     

       12
        
           "index.html#book-nixos-manual"

     

       13
        
         ],

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
         "module-services-anubis": [

     

       15
        
           "index.html#module-services-anubis"

     

       16
        
         ],

···

       11
        
         "book-nixos-manual": [

     

       12
        
           "index.html#book-nixos-manual"

     

       13
        
         ],

     

       14
       +
         "modular-service-composition": [

     

       15
       +
           "index.html#modular-service-composition"

     

       16
       +
         ],

     

       17
       +
         "modular-service-migration": [

     

       18
       +
           "index.html#modular-service-migration"

     

       19
       +
         ],

     

       20
       +
         "modular-service-options-portable": [

     

       21
       +
           "index.html#modular-service-options-portable"

     

       22
       +
         ],

     

       23
       +
         "modular-service-options-systemd": [

     

       24
       +
           "index.html#modular-service-options-systemd"

     

       25
       +
         ],

     

       26
       +
         "modular-service-portability": [

     

       27
       +
           "index.html#modular-service-portability"

     

       28
       +
         ],

     

       29
       +
         "modular-services": [

     

       30
       +
           "index.html#modular-services"

     

       31
       +
         ],

     

       32
        
         "module-services-anubis": [

     

       33
        
           "index.html#module-services-anubis"

     

       34
        
         ],

+3 -1

nixos/modules/misc/assertions.nix

···

       32
        
           };

     

       33
        
       

     

       34
        
         };

     

       35
       -
         # impl of assertions is in <nixpkgs/nixos/modules/system/activation/top-level.nix>

     

       0
        
       
     

       0
        
       
     

       36
        
       }

···

       32
        
           };

     

       33
        
       

     

       34
        
         };

     

       35
       +
         # impl of assertions is in

     

       36
       +
         # - <nixpkgs/nixos/modules/system/activation/top-level.nix>

     

       37
       +
         # - <nixpkgs/nixos/modules/system/service/portable/lib.nix>

     

       38
        
       }

nixos/modules/module-list.nix

···

       1843
        
         ./system/boot/uvesafb.nix

     

       1844
        
         ./system/boot/zram-as-tmp.nix

     

       1845
        
         ./system/etc/etc-activation.nix

     

       0
        
       
     

       0
        
       
     

       1846
        
         ./tasks/auto-upgrade.nix

     

       1847
        
         ./tasks/bcache.nix

     

       1848
        
         ./tasks/cpu-freq.nix

···

       1843
        
         ./system/boot/uvesafb.nix

     

       1844
        
         ./system/boot/zram-as-tmp.nix

     

       1845
        
         ./system/etc/etc-activation.nix

     

       1846
       +
         ./system/service/systemd/system.nix

     

       1847
       +
         ./system/service/systemd/user.nix

     

       1848
        
         ./tasks/auto-upgrade.nix

     

       1849
        
         ./tasks/bcache.nix

     

       1850
        
         ./tasks/cpu-freq.nix

+28

nixos/modules/system/service/README.md

···

       1
       +
       

     

       2
       +
       # Modular Services

     

       3
       +
       

     

       4
       +
       This directory defines a modular service infrastructure for NixOS.

     

       5
       +
       See the [Modular Services chapter] in the manual [[source]](../../doc/manual/development/modular-services.md).

     

       6
       +
       

     

       7
       +
       [Modular Services chapter]: https://nixos.org/manual/nixos/unstable/#modular-services

     

       8
       +
       

     

       9
       +
       # Design decision log

     

       10
       +
       

     

       11
       +
       - `system.services.<name>`. Alternatives considered

     

       12
       +
         - `systemServices`: similar to does not allow importing a composition of services into `system`. Not sure if that's a good idea in the first place, but I've kept the possibility open.

     

       13
       +
         - `services.abstract`: used in https://github.com/NixOS/nixpkgs/pull/267111, but too weird. Service modules should fit naturally into the configuration system.

     

       14
       +
           Also "abstract" is wrong, because it has submodules - in other words, evalModules results, concrete services - not abstract at all.

     

       15
       +
         - `services.modular`: only slightly better than `services.abstract`, but still weird

     

       16
       +
       

     

       17
       +
       - No `daemon.*` options. https://github.com/NixOS/nixpkgs/pull/267111/files#r1723206521

     

       18
       +
       

     

       19
       +
       - For now, do not add an `enable` option, because it's ambiguous. Does it disable at the Nix level (not generate anything) or at the systemd level (generate a service that is disabled)?

     

       20
       +
       

     

       21
       +
       - Move all process options into a `process` option tree. Putting this at the root is messy, because we also have sub-services at that level. Those are rather distinct. Grouping them "by kind" should raise fewer questions.

     

       22
       +
       

     

       23
       +
       - `modules/system/service/systemd/system.nix` has `system` twice. Not great, but

     

       24
       +
         - they have different meanings

     

       25
       +
           1. These are system-provided modules, provided by the configuration manager

     

       26
       +
           2. `systemd/system` configures SystemD _system units_.

     

       27
       +
         - This reserves `modules/service` for actual service modules, at least until those are lifted out of NixOS, potentially

     

       28
       +

+33

nixos/modules/system/service/portable/lib.nix

···

       1
       +
       { lib, ... }:

     

       2
       +
       let

     

       3
       +
         inherit (lib) concatLists mapAttrsToList showOption;

     

       4
       +
       in

     

       5
       +
       rec {

     

       6
       +
         flattenMapServicesConfigToList =

     

       7
       +
           f: loc: config:

     

       8
       +
           f loc config

     

       9
       +
           ++ concatLists (

     

       10
       +
             mapAttrsToList (

     

       11
       +
               k: v:

     

       12
       +
               flattenMapServicesConfigToList f (

     

       13
       +
                 loc

     

       14
       +
                 ++ [

     

       15
       +
                   "services"

     

       16
       +
                   k

     

       17
       +
                 ]

     

       18
       +
               ) v

     

       19
       +
             ) config.services

     

       20
       +
           );

     

       21
       +
       

     

       22
       +
         getWarnings = flattenMapServicesConfigToList (

     

       23
       +
           loc: config: map (msg: "in ${showOption loc}: ${msg}") config.warnings

     

       24
       +
         );

     

       25
       +
       

     

       26
       +
         getAssertions = flattenMapServicesConfigToList (

     

       27
       +
           loc: config:

     

       28
       +
           map (ass: {

     

       29
       +
             message = "in ${showOption loc}: ${ass.message}";

     

       30
       +
             assertion = ass.assertion;

     

       31
       +
           }) config.assertions

     

       32
       +
         );

     

       33
       +
       }

+48

nixos/modules/system/service/portable/service.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         options,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
       +
         inherit (lib) mkOption types;

     

       9
       +
         pathOrStr = types.coercedTo types.path (x: "${x}") types.str;

     

       10
       +
       in

     

       11
       +
       {

     

       12
       +
         # https://nixos.org/manual/nixos/unstable/#modular-services

     

       13
       +
         _class = "service";

     

       14
       +
         imports = [

     

       15
       +
           ../../../misc/assertions.nix

     

       16
       +
         ];

     

       17
       +
         options = {

     

       18
       +
           services = mkOption {

     

       19
       +
             type = types.attrsOf (

     

       20
       +
               types.submoduleWith {

     

       21
       +
                 modules = [

     

       22
       +
                   ./service.nix

     

       23
       +
                 ];

     

       24
       +
               }

     

       25
       +
             );

     

       26
       +
             description = ''

     

       27
       +
               A collection of [modular services](https://nixos.org/manual/nixos/unstable/#modular-services) that are configured in one go.

     

       28
       +
       

     

       29
       +
               You could consider the sub-service relationship to be an ownership relation.

     

       30
       +
               It **does not** automatically create any other relationship between services (e.g. systemd slices), unless perhaps such a behavior is explicitly defined and enabled in another option.

     

       31
       +
             '';

     

       32
       +
             default = { };

     

       33
       +
             visible = "shallow";

     

       34
       +
           };

     

       35
       +
           process = {

     

       36
       +
             argv = lib.mkOption {

     

       37
       +
               type = types.listOf pathOrStr;

     

       38
       +
               example = lib.literalExpression ''[ (lib.getExe config.package) "--nobackground" ]'';

     

       39
       +
               description = ''

     

       40
       +
                 Command filename and arguments for starting this service.

     

       41
       +
                 This is a raw command-line that should not contain any shell escaping.

     

       42
       +
                 If expansion of environmental variables is required then use

     

       43
       +
                 a shell script or `importas` from `pkgs.execline`.

     

       44
       +
               '';

     

       45
       +
             };

     

       46
       +
           };

     

       47
       +
         };

     

       48
       +
       }

+183

nixos/modules/system/service/portable/test.nix

···

       1
       +
       # Run:

     

       2
       +
       #   nix-instantiate --eval nixos/modules/system/service/portable/test.nix

     

       3
       +
       let

     

       4
       +
         lib = import ../../../../../lib;

     

       5
       +
       

     

       6
       +
         inherit (lib) mkOption types;

     

       7
       +
       

     

       8
       +
         portable-lib = import ./lib.nix { inherit lib; };

     

       9
       +
       

     

       10
       +
         dummyPkg =

     

       11
       +
           name:

     

       12
       +
           derivation {

     

       13
       +
             system = "dummy";

     

       14
       +
             name = name;

     

       15
       +
             builder = "/bin/false";

     

       16
       +
           };

     

       17
       +
       

     

       18
       +
         exampleConfig = {

     

       19
       +
           _file = "${__curPos.file}:${toString __curPos.line}";

     

       20
       +
           services = {

     

       21
       +
             service1 = {

     

       22
       +
               process = {

     

       23
       +
                 argv = [

     

       24
       +
                   "/usr/bin/echo" # *giggles*

     

       25
       +
                   "hello"

     

       26
       +
                 ];

     

       27
       +
               };

     

       28
       +
               assertions = [

     

       29
       +
                 {

     

       30
       +
                   assertion = false;

     

       31
       +
                   message = "you can't enable this for that reason";

     

       32
       +
                 }

     

       33
       +
               ];

     

       34
       +
               warnings = [

     

       35
       +
                 "The `foo' service is deprecated and will go away soon!"

     

       36
       +
               ];

     

       37
       +
             };

     

       38
       +
             service2 = {

     

       39
       +
               process = {

     

       40
       +
                 # No meta.mainProgram, because it's supposedly an executable script _file_,

     

       41
       +
                 # not a directory with a bin directory containing the main program.

     

       42
       +
                 argv = [

     

       43
       +
                   (dummyPkg "cowsay.sh")

     

       44
       +
                   "world"

     

       45
       +
                 ];

     

       46
       +
               };

     

       47
       +
             };

     

       48
       +
             service3 = {

     

       49
       +
               process = {

     

       50
       +
                 argv = [ "/bin/false" ];

     

       51
       +
               };

     

       52
       +
               services.exclacow = {

     

       53
       +
                 process = {

     

       54
       +
                   argv = [

     

       55
       +
                     (lib.getExe (

     

       56
       +
                       dummyPkg "cowsay-ng"

     

       57
       +
                       // {

     

       58
       +
                         meta.mainProgram = "cowsay";

     

       59
       +
                       }

     

       60
       +
                     ))

     

       61
       +
                     "!"

     

       62
       +
                   ];

     

       63
       +
                 };

     

       64
       +
                 assertions = [

     

       65
       +
                   {

     

       66
       +
                     assertion = false;

     

       67
       +
                     message = "you can't enable this for such reason";

     

       68
       +
                   }

     

       69
       +
                 ];

     

       70
       +
                 warnings = [

     

       71
       +
                   "The `bar' service is deprecated and will go away soon!"

     

       72
       +
                 ];

     

       73
       +
               };

     

       74
       +
             };

     

       75
       +
           };

     

       76
       +
         };

     

       77
       +
       

     

       78
       +
         exampleEval = lib.evalModules {

     

       79
       +
           modules = [

     

       80
       +
             {

     

       81
       +
               options.services = mkOption {

     

       82
       +
                 type = types.attrsOf (

     

       83
       +
                   types.submoduleWith {

     

       84
       +
                     class = "service";

     

       85
       +
                     modules = [

     

       86
       +
                       ./service.nix

     

       87
       +
                     ];

     

       88
       +
                   }

     

       89
       +
                 );

     

       90
       +
               };

     

       91
       +
             }

     

       92
       +
             exampleConfig

     

       93
       +
           ];

     

       94
       +
         };

     

       95
       +
       

     

       96
       +
         test =

     

       97
       +
           assert

     

       98
       +
             exampleEval.config == {

     

       99
       +
               services = {

     

       100
       +
                 service1 = {

     

       101
       +
                   process = {

     

       102
       +
                     argv = [

     

       103
       +
                       "/usr/bin/echo"

     

       104
       +
                       "hello"

     

       105
       +
                     ];

     

       106
       +
                   };

     

       107
       +
                   services = { };

     

       108
       +
                   assertions = [

     

       109
       +
                     {

     

       110
       +
                       assertion = false;

     

       111
       +
                       message = "you can't enable this for that reason";

     

       112
       +
                     }

     

       113
       +
                   ];

     

       114
       +
                   warnings = [

     

       115
       +
                     "The `foo' service is deprecated and will go away soon!"

     

       116
       +
                   ];

     

       117
       +
                 };

     

       118
       +
                 service2 = {

     

       119
       +
                   process = {

     

       120
       +
                     argv = [

     

       121
       +
                       "${dummyPkg "cowsay.sh"}"

     

       122
       +
                       "world"

     

       123
       +
                     ];

     

       124
       +
                   };

     

       125
       +
                   services = { };

     

       126
       +
                   assertions = [ ];

     

       127
       +
                   warnings = [ ];

     

       128
       +
                 };

     

       129
       +
                 service3 = {

     

       130
       +
                   process = {

     

       131
       +
                     argv = [ "/bin/false" ];

     

       132
       +
                   };

     

       133
       +
                   services.exclacow = {

     

       134
       +
                     process = {

     

       135
       +
                       argv = [

     

       136
       +
                         "${dummyPkg "cowsay-ng"}/bin/cowsay"

     

       137
       +
                         "!"

     

       138
       +
                       ];

     

       139
       +
                     };

     

       140
       +
                     services = { };

     

       141
       +
                     assertions = [

     

       142
       +
                       {

     

       143
       +
                         assertion = false;

     

       144
       +
                         message = "you can't enable this for such reason";

     

       145
       +
                       }

     

       146
       +
                     ];

     

       147
       +
                     warnings = [ "The `bar' service is deprecated and will go away soon!" ];

     

       148
       +
                   };

     

       149
       +
                   assertions = [ ];

     

       150
       +
                   warnings = [ ];

     

       151
       +
                 };

     

       152
       +
               };

     

       153
       +
             };

     

       154
       +
       

     

       155
       +
           assert

     

       156
       +
             portable-lib.getWarnings [ "service1" ] exampleEval.config.services.service1 == [

     

       157
       +
               "in service1: The `foo' service is deprecated and will go away soon!"

     

       158
       +
             ];

     

       159
       +
       

     

       160
       +
           assert

     

       161
       +
             portable-lib.getAssertions [ "service1" ] exampleEval.config.services.service1 == [

     

       162
       +
               {

     

       163
       +
                 message = "in service1: you can't enable this for that reason";

     

       164
       +
                 assertion = false;

     

       165
       +
               }

     

       166
       +
             ];

     

       167
       +
       

     

       168
       +
           assert

     

       169
       +
             portable-lib.getWarnings [ "service3" ] exampleEval.config.services.service3 == [

     

       170
       +
               "in service3.services.exclacow: The `bar' service is deprecated and will go away soon!"

     

       171
       +
             ];

     

       172
       +
           assert

     

       173
       +
             portable-lib.getAssertions [ "service3" ] exampleEval.config.services.service3 == [

     

       174
       +
               {

     

       175
       +
                 message = "in service3.services.exclacow: you can't enable this for such reason";

     

       176
       +
                 assertion = false;

     

       177
       +
               }

     

       178
       +
             ];

     

       179
       +
       

     

       180
       +
           "ok";

     

       181
       +
       

     

       182
       +
       in

     

       183
       +
       test

+121

nixos/modules/system/service/systemd/service.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         systemdPackage,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
       +
         inherit (lib)

     

       9
       +
           concatMapStringsSep

     

       10
       +
           isDerivation

     

       11
       +
           isInt

     

       12
       +
           isFloat

     

       13
       +
           isPath

     

       14
       +
           isString

     

       15
       +
           mkOption

     

       16
       +
           replaceStrings

     

       17
       +
           types

     

       18
       +
           ;

     

       19
       +
         inherit (builtins) toJSON;

     

       20
       +
       

     

       21
       +
         # Local copy of systemd exec argument escaping function.

     

       22
       +
         # TODO: This could perhaps be deduplicated, but it is unclear where it should go.

     

       23
       +
         #       Preferably, we don't create a hard dependency on NixOS here, so that this

     

       24
       +
         #       module can be reused in a non-NixOS context, such as mutaable services

     

       25
       +
         #       in /run/systemd/system.

     

       26
       +
       

     

       27
       +
         # Quotes an argument for use in Exec* service lines.

     

       28
       +
         # systemd accepts "-quoted strings with escape sequences, toJSON produces

     

       29
       +
         # a subset of these.

     

       30
       +
         # Additionally we escape % to disallow expansion of % specifiers. Any lone ;

     

       31
       +
         # in the input will be turned it ";" and thus lose its special meaning.

     

       32
       +
         # Every $ is escaped to $$, this makes it unnecessary to disable environment

     

       33
       +
         # substitution for the directive.

     

       34
       +
         escapeSystemdExecArg =

     

       35
       +
           arg:

     

       36
       +
           let

     

       37
       +
             s =

     

       38
       +
               if isPath arg then

     

       39
       +
                 "${arg}"

     

       40
       +
               else if isString arg then

     

       41
       +
                 arg

     

       42
       +
               else if isInt arg || isFloat arg || isDerivation arg then

     

       43
       +
                 toString arg

     

       44
       +
               else

     

       45
       +
                 throw "escapeSystemdExecArg only allows strings, paths, numbers and derivations";

     

       46
       +
           in

     

       47
       +
           replaceStrings [ "%" "$" ] [ "%%" "$$" ] (toJSON s);

     

       48
       +
       

     

       49
       +
         # Quotes a list of arguments into a single string for use in a Exec*

     

       50
       +
         # line.

     

       51
       +
         escapeSystemdExecArgs = concatMapStringsSep " " escapeSystemdExecArg;

     

       52
       +
       

     

       53
       +
       in

     

       54
       +
       {

     

       55
       +
         imports = [

     

       56
       +
           ../portable/service.nix

     

       57
       +
           (lib.mkAliasOptionModule [ "systemd" "service" ] [ "systemd" "services" "" ])

     

       58
       +
           (lib.mkAliasOptionModule [ "systemd" "socket" ] [ "systemd" "sockets" "" ])

     

       59
       +
         ];

     

       60
       +
         options = {

     

       61
       +
           systemd.services = mkOption {

     

       62
       +
             description = ''

     

       63
       +
               This module configures systemd services, with the notable difference that their unit names will be prefixed with the abstract service name.

     

       64
       +
       

     

       65
       +
               This option's value is not suitable for reading, but you can define a module here that interacts with just the unit configuration in the host system configuration.

     

       66
       +
       

     

       67
       +
               Note that this option contains _deferred_ modules.

     

       68
       +
               This means that the module has not been combined with the system configuration yet, no values can be read from this option.

     

       69
       +
               What you can do instead is define a module that reads from the module arguments (such as `config`) that are available when the module is merged into the system configuration.

     

       70
       +
             '';

     

       71
       +
             type = types.lazyAttrsOf (

     

       72
       +
               types.deferredModuleWith {

     

       73
       +
                 staticModules = [

     

       74
       +
                   # TODO: Add modules for the purpose of generating documentation?

     

       75
       +
                 ];

     

       76
       +
               }

     

       77
       +
             );

     

       78
       +
             default = { };

     

       79
       +
           };

     

       80
       +
           systemd.sockets = mkOption {

     

       81
       +
             description = ''

     

       82
       +
               Declares systemd socket units. Names will be prefixed by the service name / path.

     

       83
       +
       

     

       84
       +
               See {option}`systemd.services`.

     

       85
       +
             '';

     

       86
       +
             type = types.lazyAttrsOf types.deferredModule;

     

       87
       +
             default = { };

     

       88
       +
           };

     

       89
       +
       

     

       90
       +
           # Also import systemd logic into sub-services

     

       91
       +
           # extends the portable `services` option

     

       92
       +
           services = mkOption {

     

       93
       +
             type = types.attrsOf (

     

       94
       +
               types.submoduleWith {

     

       95
       +
                 class = "service";

     

       96
       +
                 modules = [

     

       97
       +
                   ./service.nix

     

       98
       +
                 ];

     

       99
       +
                 specialArgs = {

     

       100
       +
                   inherit systemdPackage;

     

       101
       +
                 };

     

       102
       +
               }

     

       103
       +
             );

     

       104
       +
           };

     

       105
       +
         };

     

       106
       +
         config = {

     

       107
       +
           # Note that this is the systemd.services option above, not the system one.

     

       108
       +
           systemd.services."" = {

     

       109
       +
             # TODO description;

     

       110
       +
             wantedBy = lib.mkDefault [ "multi-user.target" ];

     

       111
       +
             serviceConfig = {

     

       112
       +
               Type = lib.mkDefault "simple";

     

       113
       +
               Restart = lib.mkDefault "always";

     

       114
       +
               RestartSec = lib.mkDefault "5";

     

       115
       +
               ExecStart = [

     

       116
       +
                 (escapeSystemdExecArgs config.process.argv)

     

       117
       +
               ];

     

       118
       +
             };

     

       119
       +
           };

     

       120
       +
         };

     

       121
       +
       }

+90

nixos/modules/system/service/systemd/system.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         options,

     

       5
       +
         pkgs,

     

       6
       +
         ...

     

       7
       +
       }:

     

       8
       +
       

     

       9
       +
       let

     

       10
       +
         inherit (lib)

     

       11
       +
           concatMapAttrs

     

       12
       +
           mkOption

     

       13
       +
           types

     

       14
       +
           concatLists

     

       15
       +
           mapAttrsToList

     

       16
       +
           ;

     

       17
       +
       

     

       18
       +
         portable-lib = import ../portable/lib.nix { inherit lib; };

     

       19
       +
       

     

       20
       +
         dash =

     

       21
       +
           before: after:

     

       22
       +
           if after == "" then

     

       23
       +
             before

     

       24
       +
           else if before == "" then

     

       25
       +
             after

     

       26
       +
           else

     

       27
       +
             "${before}-${after}";

     

       28
       +
       

     

       29
       +
         makeUnits =

     

       30
       +
           unitType: prefix: service:

     

       31
       +
           concatMapAttrs (unitName: unitModule: {

     

       32
       +
             "${dash prefix unitName}" =

     

       33
       +
               { ... }:

     

       34
       +
               {

     

       35
       +
                 imports = [ unitModule ];

     

       36
       +
               };

     

       37
       +
           }) service.systemd.${unitType}

     

       38
       +
           // concatMapAttrs (

     

       39
       +
             subServiceName: subService: makeUnits unitType (dash prefix subServiceName) subService

     

       40
       +
           ) service.services;

     

       41
       +
       in

     

       42
       +
       {

     

       43
       +
         # First half of the magic: mix systemd logic into the otherwise abstract services

     

       44
       +
         options = {

     

       45
       +
           system.services = mkOption {

     

       46
       +
             description = ''

     

       47
       +
               A collection of NixOS [modular services](https://nixos.org/manual/nixos/unstable/#modular-services) that are configured as systemd services.

     

       48
       +
             '';

     

       49
       +
             type = types.attrsOf (

     

       50
       +
               types.submoduleWith {

     

       51
       +
                 class = "service";

     

       52
       +
                 modules = [

     

       53
       +
                   ./service.nix

     

       54
       +
                 ];

     

       55
       +
                 specialArgs = {

     

       56
       +
                   # perhaps: features."systemd" = { };

     

       57
       +
                   inherit pkgs;

     

       58
       +
                   systemdPackage = config.systemd.package;

     

       59
       +
                 };

     

       60
       +
               }

     

       61
       +
             );

     

       62
       +
             default = { };

     

       63
       +
             visible = "shallow";

     

       64
       +
           };

     

       65
       +
         };

     

       66
       +
       

     

       67
       +
         # Second half of the magic: siphon units that were defined in isolation to the system

     

       68
       +
         config = {

     

       69
       +
       

     

       70
       +
           assertions = concatLists (

     

       71
       +
             mapAttrsToList (

     

       72
       +
               name: cfg: portable-lib.getAssertions (options.system.services.loc ++ [ name ]) cfg

     

       73
       +
             ) config.system.services

     

       74
       +
           );

     

       75
       +
       

     

       76
       +
           warnings = concatLists (

     

       77
       +
             mapAttrsToList (

     

       78
       +
               name: cfg: portable-lib.getWarnings (options.system.services.loc ++ [ name ]) cfg

     

       79
       +
             ) config.system.services

     

       80
       +
           );

     

       81
       +
       

     

       82
       +
           systemd.services = concatMapAttrs (

     

       83
       +
             serviceName: topLevelService: makeUnits "services" serviceName topLevelService

     

       84
       +
           ) config.system.services;

     

       85
       +
       

     

       86
       +
           systemd.sockets = concatMapAttrs (

     

       87
       +
             serviceName: topLevelService: makeUnits "sockets" serviceName topLevelService

     

       88
       +
           ) config.system.services;

     

       89
       +
         };

     

       90
       +
       }

+92

nixos/modules/system/service/systemd/test.nix

···

       1
       +
       # Run:

     

       2
       +
       #   nix-build -A nixosTests.modularService

     

       3
       +
       

     

       4
       +
       {

     

       5
       +
         evalSystem,

     

       6
       +
         runCommand,

     

       7
       +
         hello,

     

       8
       +
         ...

     

       9
       +
       }:

     

       10
       +
       

     

       11
       +
       let

     

       12
       +
         machine = evalSystem (

     

       13
       +
           { lib, ... }:

     

       14
       +
           let

     

       15
       +
             hello' = lib.getExe hello;

     

       16
       +
           in

     

       17
       +
           {

     

       18
       +
       

     

       19
       +
             # Test input

     

       20
       +
       

     

       21
       +
             system.services.foo = {

     

       22
       +
               process = {

     

       23
       +
                 argv = [

     

       24
       +
                   hello'

     

       25
       +
                   "--greeting"

     

       26
       +
                   "hoi"

     

       27
       +
                 ];

     

       28
       +
               };

     

       29
       +
             };

     

       30
       +
             system.services.bar = {

     

       31
       +
               process = {

     

       32
       +
                 argv = [

     

       33
       +
                   hello'

     

       34
       +
                   "--greeting"

     

       35
       +
                   "hoi"

     

       36
       +
                 ];

     

       37
       +
               };

     

       38
       +
               systemd.service = {

     

       39
       +
                 serviceConfig.X-Bar = "lol crossbar whatever";

     

       40
       +
               };

     

       41
       +
               services.db = {

     

       42
       +
                 process = {

     

       43
       +
                   argv = [

     

       44
       +
                     hello'

     

       45
       +
                     "--greeting"

     

       46
       +
                     "Hi, I'm a database, would you believe it"

     

       47
       +
                   ];

     

       48
       +
                 };

     

       49
       +
                 systemd.service = {

     

       50
       +
                   serviceConfig.RestartSec = "42";

     

       51
       +
                 };

     

       52
       +
               };

     

       53
       +
             };

     

       54
       +
       

     

       55
       +
             # irrelevant stuff

     

       56
       +
             system.stateVersion = "25.05";

     

       57
       +
             fileSystems."/".device = "/test/dummy";

     

       58
       +
             boot.loader.grub.enable = false;

     

       59
       +
           }

     

       60
       +
         );

     

       61
       +
       

     

       62
       +
         inherit (machine.config.system.build) toplevel;

     

       63
       +
       in

     

       64
       +
       runCommand "test-modular-service-systemd-units"

     

       65
       +
         {

     

       66
       +
           passthru = {

     

       67
       +
             inherit

     

       68
       +
               machine

     

       69
       +
               toplevel

     

       70
       +
               ;

     

       71
       +
           };

     

       72
       +
         }

     

       73
       +
         ''

     

       74
       +
           echo ${toplevel}/etc/systemd/system/foo.service:

     

       75
       +
           cat -n ${toplevel}/etc/systemd/system/foo.service

     

       76
       +
           (

     

       77
       +
             set -x

     

       78
       +
             grep -F 'ExecStart="${hello}/bin/hello" "--greeting" "hoi"' ${toplevel}/etc/systemd/system/foo.service >/dev/null

     

       79
       +
       

     

       80
       +
             grep -F 'ExecStart="${hello}/bin/hello" "--greeting" "hoi"' ${toplevel}/etc/systemd/system/bar.service >/dev/null

     

       81
       +
             grep -F 'X-Bar=lol crossbar whatever' ${toplevel}/etc/systemd/system/bar.service >/dev/null

     

       82
       +
       

     

       83
       +
             grep    'ExecStart="${hello}/bin/hello" "--greeting" ".*database.*"' ${toplevel}/etc/systemd/system/bar-db.service >/dev/null

     

       84
       +
             grep -F 'RestartSec=42' ${toplevel}/etc/systemd/system/bar-db.service >/dev/null

     

       85
       +
       

     

       86
       +
             [[ ! -e ${toplevel}/etc/systemd/system/foo.socket ]]

     

       87
       +
             [[ ! -e ${toplevel}/etc/systemd/system/bar.socket ]]

     

       88
       +
             [[ ! -e ${toplevel}/etc/systemd/system/bar-db.socket ]]

     

       89
       +
           )

     

       90
       +
           echo 🐬👍

     

       91
       +
           touch $out

     

       92
       +
         ''

nixos/modules/system/service/systemd/user.nix

···

       1
       +
       # TBD, analogous to system.nix but for user units

     

       2
       +
       {

     

       3
       +
       }

+14

nixos/tests/all-tests.nix

···

       89
        
           featureFlags.minimalModules = { };

     

       90
        
         };

     

       91
        
         evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       92
        
       

     

       93
        
         inherit

     

       94
        
           (rec {

     
···

       589
        
         gerrit = runTest ./gerrit.nix;

     

       590
        
         geth = runTest ./geth.nix;

     

       591
        
         ghostunnel = runTest ./ghostunnel.nix;

     

       0
        
       
     

       592
        
         gitdaemon = runTest ./gitdaemon.nix;

     

       593
        
         gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };

     

       594
        
         github-runner = runTest ./github-runner.nix;

     
···

       894
        
         mjolnir = runTest ./matrix/mjolnir.nix;

     

       895
        
         mobilizon = runTest ./mobilizon.nix;

     

       896
        
         mod_perl = runTest ./mod_perl.nix;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       897
        
         molly-brown = runTest ./molly-brown.nix;

     

       898
        
         mollysocket = runTest ./mollysocket.nix;

     

       899
        
         monado = runTest ./monado.nix;

···

       89
        
           featureFlags.minimalModules = { };

     

       90
        
         };

     

       91
        
         evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };

     

       92
       +
         evalSystem =

     

       93
       +
           module:

     

       94
       +
           import ../lib/eval-config.nix {

     

       95
       +
             system = null;

     

       96
       +
             modules = [

     

       97
       +
               ../modules/misc/nixpkgs/read-only.nix

     

       98
       +
               { nixpkgs.pkgs = pkgs; }

     

       99
       +
               module

     

       100
       +
             ];

     

       101
       +
           };

     

       102
        
       

     

       103
        
         inherit

     

       104
        
           (rec {

     
···

       599
        
         gerrit = runTest ./gerrit.nix;

     

       600
        
         geth = runTest ./geth.nix;

     

       601
        
         ghostunnel = runTest ./ghostunnel.nix;

     

       602
       +
         ghostunnel-modular = runTest ./ghostunnel-modular.nix;

     

       603
        
         gitdaemon = runTest ./gitdaemon.nix;

     

       604
        
         gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };

     

       605
        
         github-runner = runTest ./github-runner.nix;

     
···

       905
        
         mjolnir = runTest ./matrix/mjolnir.nix;

     

       906
        
         mobilizon = runTest ./mobilizon.nix;

     

       907
        
         mod_perl = runTest ./mod_perl.nix;

     

       908
       +
         modularService = pkgs.callPackage ../modules/system/service/systemd/test.nix {

     

       909
       +
           inherit evalSystem;

     

       910
       +
         };

     

       911
        
         molly-brown = runTest ./molly-brown.nix;

     

       912
        
         mollysocket = runTest ./mollysocket.nix;

     

       913
        
         monado = runTest ./monado.nix;

+120

nixos/tests/ghostunnel-modular.nix

···

       1
       +
       { hostPkgs, lib, ... }:

     

       2
       +
       {

     

       3
       +
         _class = "nixosTest";

     

       4
       +
         name = "ghostunnel";

     

       5
       +
         nodes = {

     

       6
       +
           backend =

     

       7
       +
             { pkgs, ... }:

     

       8
       +
             {

     

       9
       +
               services.nginx.enable = true;

     

       10
       +
               services.nginx.virtualHosts."backend".root = pkgs.runCommand "webroot" { } ''

     

       11
       +
                 mkdir $out

     

       12
       +
                 echo hi >$out/hi.txt

     

       13
       +
               '';

     

       14
       +
               networking.firewall.allowedTCPPorts = [ 80 ];

     

       15
       +
             };

     

       16
       +
           service =

     

       17
       +
             { pkgs, ... }:

     

       18
       +
             {

     

       19
       +
               system.services."ghostunnel-plain-old" = {

     

       20
       +
                 imports = [ pkgs.ghostunnel.services.default ];

     

       21
       +
                 ghostunnel = {

     

       22
       +
                   listen = "0.0.0.0:443";

     

       23
       +
                   cert = "/root/service-cert.pem";

     

       24
       +
                   key = "/root/service-key.pem";

     

       25
       +
                   disableAuthentication = true;

     

       26
       +
                   target = "backend:80";

     

       27
       +
                   unsafeTarget = true;

     

       28
       +
                 };

     

       29
       +
               };

     

       30
       +
               system.services."ghostunnel-client-cert" = {

     

       31
       +
                 imports = [ pkgs.ghostunnel.services.default ];

     

       32
       +
                 ghostunnel = {

     

       33
       +
                   listen = "0.0.0.0:1443";

     

       34
       +
                   cert = "/root/service-cert.pem";

     

       35
       +
                   key = "/root/service-key.pem";

     

       36
       +
                   cacert = "/root/ca.pem";

     

       37
       +
                   target = "backend:80";

     

       38
       +
                   allowCN = [ "client" ];

     

       39
       +
                   unsafeTarget = true;

     

       40
       +
                 };

     

       41
       +
               };

     

       42
       +
               networking.firewall.allowedTCPPorts = [

     

       43
       +
                 443

     

       44
       +
                 1443

     

       45
       +
               ];

     

       46
       +
             };

     

       47
       +
           client =

     

       48
       +
             { pkgs, ... }:

     

       49
       +
             {

     

       50
       +
               environment.systemPackages = [

     

       51
       +
                 pkgs.curl

     

       52
       +
               ];

     

       53
       +
             };

     

       54
       +
         };

     

       55
       +
       

     

       56
       +
         testScript = ''

     

       57
       +
       

     

       58
       +
           # prepare certificates

     

       59
       +
       

     

       60
       +
           def cmd(command):

     

       61
       +
             print(f"+{command}")

     

       62
       +
             r = os.system(command)

     

       63
       +
             if r != 0:

     

       64
       +
               raise Exception(f"Command {command} failed with exit code {r}")

     

       65
       +
       

     

       66
       +
           # Create CA

     

       67
       +
           cmd("${hostPkgs.openssl}/bin/openssl genrsa -out ca-key.pem 4096")

     

       68
       +
           cmd("${hostPkgs.openssl}/bin/openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -subj '/C=NL/ST=Zuid-Holland/L=The Hague/O=Stevige Balken en Planken B.V./OU=OpSec/CN=Certificate Authority' -out ca.pem")

     

       69
       +
       

     

       70
       +
           # Create service

     

       71
       +
           cmd("${hostPkgs.openssl}/bin/openssl genrsa -out service-key.pem 4096")

     

       72
       +
           cmd("${hostPkgs.openssl}/bin/openssl req -subj '/CN=service' -sha256 -new -key service-key.pem -out service.csr")

     

       73
       +
           cmd("echo subjectAltName = DNS:service,IP:127.0.0.1 >> extfile.cnf")

     

       74
       +
           cmd("echo extendedKeyUsage = serverAuth >> extfile.cnf")

     

       75
       +
           cmd("${hostPkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in service.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out service-cert.pem -extfile extfile.cnf")

     

       76
       +
       

     

       77
       +
           # Create client

     

       78
       +
           cmd("${hostPkgs.openssl}/bin/openssl genrsa -out client-key.pem 4096")

     

       79
       +
           cmd("${hostPkgs.openssl}/bin/openssl req -subj '/CN=client' -new -key client-key.pem -out client.csr")

     

       80
       +
           cmd("echo extendedKeyUsage = clientAuth > extfile-client.cnf")

     

       81
       +
           cmd("${hostPkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extfile extfile-client.cnf")

     

       82
       +
       

     

       83
       +
           cmd("ls -al")

     

       84
       +
       

     

       85
       +
           start_all()

     

       86
       +
       

     

       87
       +
           # Configuration

     

       88
       +
           service.copy_from_host("ca.pem", "/root/ca.pem")

     

       89
       +
           service.copy_from_host("service-cert.pem", "/root/service-cert.pem")

     

       90
       +
           service.copy_from_host("service-key.pem", "/root/service-key.pem")

     

       91
       +
           client.copy_from_host("ca.pem", "/root/ca.pem")

     

       92
       +
           client.copy_from_host("service-cert.pem", "/root/service-cert.pem")

     

       93
       +
           client.copy_from_host("client-cert.pem", "/root/client-cert.pem")

     

       94
       +
           client.copy_from_host("client-key.pem", "/root/client-key.pem")

     

       95
       +
       

     

       96
       +
           backend.wait_for_unit("nginx.service")

     

       97
       +
           service.wait_for_unit("multi-user.target")

     

       98
       +
           service.wait_for_unit("multi-user.target")

     

       99
       +
           client.wait_for_unit("multi-user.target")

     

       100
       +
       

     

       101
       +
           # Check assumptions before the real test

     

       102
       +
           client.succeed("bash -c 'diff <(curl -v --no-progress-meter http://backend/hi.txt) <(echo hi)'")

     

       103
       +
       

     

       104
       +
           # Plain old simple TLS can connect, ignoring cert

     

       105
       +
           client.succeed("bash -c 'diff <(curl -v --no-progress-meter --insecure https://service/hi.txt) <(echo hi)'")

     

       106
       +
       

     

       107
       +
           # Plain old simple TLS provides correct signature with its cert

     

       108
       +
           client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service/hi.txt) <(echo hi)'")

     

       109
       +
       

     

       110
       +
           # Client can authenticate with certificate

     

       111
       +
           client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cert /root/client-cert.pem --key /root/client-key.pem --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")

     

       112
       +
       

     

       113
       +
           # Client must authenticate with certificate

     

       114
       +
           client.fail("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")

     

       115
       +
         '';

     

       116
       +
       

     

       117
       +
         meta.maintainers = with lib.maintainers; [

     

       118
       +
           roberth

     

       119
       +
         ];

     

       120
       +
       }

pkgs/by-name/gh/ghostunnel/package.nix

···

       4
        
         fetchFromGitHub,

     

       5
        
         lib,

     

       6
        
         nixosTests,

     

       0
        
       
     

       7
        
         apple-sdk_12,

     

       8
        
         darwinMinVersionHook,

     

       9
        
       }:

     
···

       37
        
         passthru.tests = {

     

       38
        
           nixos = nixosTests.ghostunnel;

     

       39
        
           podman = nixosTests.podman-tls-ghostunnel;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       40
        
         };

     

       41
        
       

     

       42
        
         meta = {

···

       4
        
         fetchFromGitHub,

     

       5
        
         lib,

     

       6
        
         nixosTests,

     

       7
       +
         ghostunnel,

     

       8
        
         apple-sdk_12,

     

       9
        
         darwinMinVersionHook,

     

       10
        
       }:

     
···

       38
        
         passthru.tests = {

     

       39
        
           nixos = nixosTests.ghostunnel;

     

       40
        
           podman = nixosTests.podman-tls-ghostunnel;

     

       41
       +
         };

     

       42
       +
       

     

       43
       +
         passthru.services.default = {

     

       44
       +
           imports = [ ./service.nix ];

     

       45
       +
           ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage

     

       46
        
         };

     

       47
        
       

     

       48
        
         meta = {

+241

pkgs/by-name/gh/ghostunnel/service.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         options,

     

       5
       +
         pkgs,

     

       6
       +
         ...

     

       7
       +
       }:

     

       8
       +
       let

     

       9
       +
         inherit (lib)

     

       10
       +
           concatStringsSep

     

       11
       +
           getExe

     

       12
       +
           mkDefault

     

       13
       +
           mkIf

     

       14
       +
           mkOption

     

       15
       +
           optional

     

       16
       +
           types

     

       17
       +
           ;

     

       18
       +
         cfg = config.ghostunnel;

     

       19
       +
       

     

       20
       +
       in

     

       21
       +
       {

     

       22
       +
         # https://nixos.org/manual/nixos/unstable/#modular-services

     

       23
       +
         _class = "service";

     

       24
       +
         options = {

     

       25
       +
           ghostunnel = {

     

       26
       +
             package = mkOption {

     

       27
       +
               description = "Package to use for ghostunnel";

     

       28
       +
               type = types.package;

     

       29
       +
             };

     

       30
       +
       

     

       31
       +
             listen = mkOption {

     

       32
       +
               description = ''

     

       33
       +
                 Address and port to listen on (can be HOST:PORT, unix:PATH).

     

       34
       +
               '';

     

       35
       +
               type = types.str;

     

       36
       +
             };

     

       37
       +
       

     

       38
       +
             target = mkOption {

     

       39
       +
               description = ''

     

       40
       +
                 Address to forward connections to (can be HOST:PORT or unix:PATH).

     

       41
       +
               '';

     

       42
       +
               type = types.str;

     

       43
       +
             };

     

       44
       +
       

     

       45
       +
             keystore = mkOption {

     

       46
       +
               description = ''

     

       47
       +
                 Path to keystore (combined PEM with cert/key, or PKCS12 keystore).

     

       48
       +
       

     

       49
       +
                 NB: storepass is not supported because it would expose credentials via `/proc/*/cmdline`.

     

       50
       +
       

     

       51
       +
                 Specify this or `cert` and `key`.

     

       52
       +
               '';

     

       53
       +
               type = types.nullOr types.str;

     

       54
       +
               default = null;

     

       55
       +
             };

     

       56
       +
       

     

       57
       +
             cert = mkOption {

     

       58
       +
               description = ''

     

       59
       +
                 Path to certificate (PEM with certificate chain).

     

       60
       +
       

     

       61
       +
                 Not required if `keystore` is set.

     

       62
       +
               '';

     

       63
       +
               type = types.nullOr types.str;

     

       64
       +
               default = null;

     

       65
       +
             };

     

       66
       +
       

     

       67
       +
             key = mkOption {

     

       68
       +
               description = ''

     

       69
       +
                 Path to certificate private key (PEM with private key).

     

       70
       +
       

     

       71
       +
                 Not required if `keystore` is set.

     

       72
       +
               '';

     

       73
       +
               type = types.nullOr types.str;

     

       74
       +
               default = null;

     

       75
       +
             };

     

       76
       +
       

     

       77
       +
             cacert = mkOption {

     

       78
       +
               description = ''

     

       79
       +
                 Path to CA bundle file (PEM/X509). Uses system trust store if `null`.

     

       80
       +
               '';

     

       81
       +
               type = types.nullOr types.str;

     

       82
       +
             };

     

       83
       +
       

     

       84
       +
             disableAuthentication = mkOption {

     

       85
       +
               description = ''

     

       86
       +
                 Disable client authentication, no client certificate will be required.

     

       87
       +
               '';

     

       88
       +
               type = types.bool;

     

       89
       +
               default = false;

     

       90
       +
             };

     

       91
       +
       

     

       92
       +
             allowAll = mkOption {

     

       93
       +
               description = ''

     

       94
       +
                 If true, allow all clients, do not check client cert subject.

     

       95
       +
               '';

     

       96
       +
               type = types.bool;

     

       97
       +
               default = false;

     

       98
       +
             };

     

       99
       +
       

     

       100
       +
             allowCN = mkOption {

     

       101
       +
               description = ''

     

       102
       +
                 Allow client if common name appears in the list.

     

       103
       +
               '';

     

       104
       +
               type = types.listOf types.str;

     

       105
       +
               default = [ ];

     

       106
       +
             };

     

       107
       +
       

     

       108
       +
             allowOU = mkOption {

     

       109
       +
               description = ''

     

       110
       +
                 Allow client if organizational unit name appears in the list.

     

       111
       +
               '';

     

       112
       +
               type = types.listOf types.str;

     

       113
       +
               default = [ ];

     

       114
       +
             };

     

       115
       +
       

     

       116
       +
             allowDNS = mkOption {

     

       117
       +
               description = ''

     

       118
       +
                 Allow client if DNS subject alternative name appears in the list.

     

       119
       +
               '';

     

       120
       +
               type = types.listOf types.str;

     

       121
       +
               default = [ ];

     

       122
       +
             };

     

       123
       +
       

     

       124
       +
             allowURI = mkOption {

     

       125
       +
               description = ''

     

       126
       +
                 Allow client if URI subject alternative name appears in the list.

     

       127
       +
               '';

     

       128
       +
               type = types.listOf types.str;

     

       129
       +
               default = [ ];

     

       130
       +
             };

     

       131
       +
       

     

       132
       +
             extraArguments = mkOption {

     

       133
       +
               description = "Extra arguments to pass to `ghostunnel server`";

     

       134
       +
               type = types.listOf types.str;

     

       135
       +
               default = [ ];

     

       136
       +
             };

     

       137
       +
       

     

       138
       +
             unsafeTarget = mkOption {

     

       139
       +
               description = ''

     

       140
       +
                 If set, does not limit target to localhost, 127.0.0.1, [::1], or UNIX sockets.

     

       141
       +
       

     

       142
       +
                 This is meant to protect against accidental unencrypted traffic on

     

       143
       +
                 untrusted networks.

     

       144
       +
               '';

     

       145
       +
               type = types.bool;

     

       146
       +
               default = false;

     

       147
       +
             };

     

       148
       +
           };

     

       149
       +
         };

     

       150
       +
       

     

       151
       +
         config = {

     

       152
       +
           assertions = [

     

       153
       +
             {

     

       154
       +
               message = ''

     

       155
       +
                 At least one access control flag is required.

     

       156
       +
                 Set at least one of:

     

       157
       +
                   - ${options.ghostunnel.disableAuthentication}

     

       158
       +
                   - ${options.ghostunnel.allowAll}

     

       159
       +
                   - ${options.ghostunnel.allowCN}

     

       160
       +
                   - ${options.ghostunnel.allowOU}

     

       161
       +
                   - ${options.ghostunnel.allowDNS}

     

       162
       +
                   - ${options.ghostunnel.allowURI}

     

       163
       +
               '';

     

       164
       +
               assertion =

     

       165
       +
                 cfg.disableAuthentication

     

       166
       +
                 || cfg.allowAll

     

       167
       +
                 || cfg.allowCN != [ ]

     

       168
       +
                 || cfg.allowOU != [ ]

     

       169
       +
                 || cfg.allowDNS != [ ]

     

       170
       +
                 || cfg.allowURI != [ ];

     

       171
       +
             }

     

       172
       +
           ];

     

       173
       +
       

     

       174
       +
           ghostunnel = {

     

       175
       +
             # Clients should not be authenticated with the public root certificates

     

       176
       +
             # (afaict, it doesn't make sense), so we only provide that default when

     

       177
       +
             # client cert auth is disabled.

     

       178
       +
             cacert = mkIf cfg.disableAuthentication (mkDefault null);

     

       179
       +
           };

     

       180
       +
       

     

       181
       +
           # TODO assertions

     

       182
       +
       

     

       183
       +
           process = {

     

       184
       +
             argv =

     

       185
       +
               # Use a shell if credentials need to be pulled from the environment.

     

       186
       +
               optional

     

       187
       +
                 (builtins.any (v: v != null) [

     

       188
       +
                   cfg.keystore

     

       189
       +
                   cfg.cert

     

       190
       +
                   cfg.key

     

       191
       +
                   cfg.cacert

     

       192
       +
                 ])

     

       193
       +
                 (

     

       194
       +
                   pkgs.writeScript "load-credentials" ''

     

       195
       +
                     #!${pkgs.runtimeShell}

     

       196
       +
                     exec $@ ${

     

       197
       +
                       concatStringsSep " " (

     

       198
       +
                         optional (cfg.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"

     

       199
       +
                         ++ optional (cfg.cert != null) "--cert=$CREDENTIALS_DIRECTORY/cert"

     

       200
       +
                         ++ optional (cfg.key != null) "--key=$CREDENTIALS_DIRECTORY/key"

     

       201
       +
                         ++ optional (cfg.cacert != null) "--cacert=$CREDENTIALS_DIRECTORY/cacert"

     

       202
       +
                       )

     

       203
       +
                     }

     

       204
       +
                   ''

     

       205
       +
                 )

     

       206
       +
               ++ [

     

       207
       +
                 (getExe cfg.package)

     

       208
       +
                 "server"

     

       209
       +
                 "--listen"

     

       210
       +
                 cfg.listen

     

       211
       +
                 "--target"

     

       212
       +
                 cfg.target

     

       213
       +
               ]

     

       214
       +
               ++ optional cfg.allowAll "--allow-all"

     

       215
       +
               ++ map (v: "--allow-cn=${v}") cfg.allowCN

     

       216
       +
               ++ map (v: "--allow-ou=${v}") cfg.allowOU

     

       217
       +
               ++ map (v: "--allow-dns=${v}") cfg.allowDNS

     

       218
       +
               ++ map (v: "--allow-uri=${v}") cfg.allowURI

     

       219
       +
               ++ optional cfg.disableAuthentication "--disable-authentication"

     

       220
       +
               ++ optional cfg.unsafeTarget "--unsafe-target"

     

       221
       +
               ++ cfg.extraArguments;

     

       222
       +
           };

     

       223
       +
       

     

       224
       +
           # refine the service

     

       225
       +
           systemd.service = {

     

       226
       +
             after = [ "network.target" ];

     

       227
       +
             wants = [ "network.target" ];

     

       228
       +
             wantedBy = [ "multi-user.target" ];

     

       229
       +
             serviceConfig = {

     

       230
       +
               Restart = "always";

     

       231
       +
               AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       232
       +
               DynamicUser = true;

     

       233
       +
               LoadCredential =

     

       234
       +
                 optional (cfg.keystore != null) "keystore:${cfg.keystore}"

     

       235
       +
                 ++ optional (cfg.cert != null) "cert:${cfg.cert}"

     

       236
       +
                 ++ optional (cfg.key != null) "key:${cfg.key}"

     

       237
       +
                 ++ optional (cfg.cacert != null) "cacert:${cfg.cacert}";

     

       238
       +
             };

     

       239
       +
           };

     

       240
       +
         };

     

       241
       +
       }

+1 -1

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py

···

       94
        
                 - The first element of an identifier's redirects list must denote its current location.

     

       95
        
               """

     

       96
        
               xref_targets = {}

     

       97
       -
               ignored_identifier_patterns = ("opt-", "auto-generated-", "function-library-")

     

       98
        
               for id, target in initial_xref_targets.items():

     

       99
        
                   # filter out automatically generated identifiers from module options and library documentation

     

       100
        
                   if id.startswith(ignored_identifier_patterns):

···

       94
        
                 - The first element of an identifier's redirects list must denote its current location.

     

       95
        
               """

     

       96
        
               xref_targets = {}

     

       97
       +
               ignored_identifier_patterns = ("opt-", "auto-generated-", "function-library-", "service-opt-", "systemd-service-opt")

     

       98
        
               for id, target in initial_xref_targets.items():

     

       99
        
                   # filter out automatically generated identifiers from module options and library documentation

     

       100
        
                   if id.startswith(ignored_identifier_patterns):