patch of nix: break out knot module into separate file · round #0 · pull #215 · tangled.org/core

+1 -170

flake.nix

···

       200
        
             };

     

       201
        
           });

     

       202
        
       

     

       203
       -
           nixosModules.knot = {

     

       204
       -
             config,

     

       205
       -
             pkgs,

     

       206
       -
             lib,

     

       207
       -
             ...

     

       208
       -
           }: let

     

       209
       -
             cfg = config.services.tangled-knot;

     

       210
       -
           in

     

       211
       -
             with lib; {

     

       212
       -
               options = {

     

       213
       -
                 services.tangled-knot = {

     

       214
       -
                   enable = mkOption {

     

       215
       -
                     type = types.bool;

     

       216
       -
                     default = false;

     

       217
       -
                     description = "Enable a tangled knot";

     

       218
       -
                   };

     

       219
       -
       

     

       220
       -
                   appviewEndpoint = mkOption {

     

       221
       -
                     type = types.str;

     

       222
       -
                     default = "https://tangled.sh";

     

       223
       -
                     description = "Appview endpoint";

     

       224
       -
                   };

     

       225
       -
       

     

       226
       -
                   gitUser = mkOption {

     

       227
       -
                     type = types.str;

     

       228
       -
                     default = "git";

     

       229
       -
                     description = "User that hosts git repos and performs git operations";

     

       230
       -
                   };

     

       231
       -
       

     

       232
       -
                   openFirewall = mkOption {

     

       233
       -
                     type = types.bool;

     

       234
       -
                     default = true;

     

       235
       -
                     description = "Open port 22 in the firewall for ssh";

     

       236
       -
                   };

     

       237
       -
       

     

       238
       -
                   stateDir = mkOption {

     

       239
       -
                     type = types.path;

     

       240
       -
                     default = "/home/${cfg.gitUser}";

     

       241
       -
                     description = "Tangled knot data directory";

     

       242
       -
                   };

     

       243
       -
       

     

       244
       -
                   repo = {

     

       245
       -
                     scanPath = mkOption {

     

       246
       -
                       type = types.path;

     

       247
       -
                       default = cfg.stateDir;

     

       248
       -
                       description = "Path where repositories are scanned from";

     

       249
       -
                     };

     

       250
       -
       

     

       251
       -
                     mainBranch = mkOption {

     

       252
       -
                       type = types.str;

     

       253
       -
                       default = "main";

     

       254
       -
                       description = "Default branch name for repositories";

     

       255
       -
                     };

     

       256
       -
                   };

     

       257
       -
       

     

       258
       -
                   server = {

     

       259
       -
                     listenAddr = mkOption {

     

       260
       -
                       type = types.str;

     

       261
       -
                       default = "0.0.0.0:5555";

     

       262
       -
                       description = "Address to listen on";

     

       263
       -
                     };

     

       264
       -
       

     

       265
       -
                     internalListenAddr = mkOption {

     

       266
       -
                       type = types.str;

     

       267
       -
                       default = "127.0.0.1:5444";

     

       268
       -
                       description = "Internal address for inter-service communication";

     

       269
       -
                     };

     

       270
       -
       

     

       271
       -
                     secretFile = mkOption {

     

       272
       -
                       type = lib.types.path;

     

       273
       -
                       example = "KNOT_SERVER_SECRET=<hash>";

     

       274
       -
                       description = "File containing secret key provided by appview (required)";

     

       275
       -
                     };

     

       276
       -
       

     

       277
       -
                     dbPath = mkOption {

     

       278
       -
                       type = types.path;

     

       279
       -
                       default = "${cfg.stateDir}/knotserver.db";

     

       280
       -
                       description = "Path to the database file";

     

       281
       -
                     };

     

       282
       -
       

     

       283
       -
                     hostname = mkOption {

     

       284
       -
                       type = types.str;

     

       285
       -
                       example = "knot.tangled.sh";

     

       286
       -
                       description = "Hostname for the server (required)";

     

       287
       -
                     };

     

       288
       -
       

     

       289
       -
                     dev = mkOption {

     

       290
       -
                       type = types.bool;

     

       291
       -
                       default = false;

     

       292
       -
                       description = "Enable development mode (disables signature verification)";

     

       293
       -
                     };

     

       294
       -
                   };

     

       295
       -
                 };

     

       296
       -
               };

     

       297
       -
       

     

       298
       -
               config = mkIf cfg.enable {

     

       299
       -
                 environment.systemPackages = with pkgs; [git];

     

       300
       -
       

     

       301
       -
                 system.activationScripts.gitConfig = ''

     

       302
       -
                   mkdir -p "${cfg.repo.scanPath}"

     

       303
       -
                   chown -R ${cfg.gitUser}:${cfg.gitUser} \

     

       304
       -
                       "${cfg.repo.scanPath}"

     

       305
       -
       

     

       306
       -
                   mkdir -p "${cfg.stateDir}/.config/git"

     

       307
       -
                   cat > "${cfg.stateDir}/.config/git/config" << EOF

     

       308
       -
                   [user]

     

       309
       -
                       name = Git User

     

       310
       -
                       email = git@example.com

     

       311
       -
                   EOF

     

       312
       -
                   chown -R ${cfg.gitUser}:${cfg.gitUser} \

     

       313
       -
                       "${cfg.stateDir}"

     

       314
       -
                 '';

     

       315
       -
       

     

       316
       -
                 users.users.${cfg.gitUser} = {

     

       317
       -
                   isSystemUser = true;

     

       318
       -
                   useDefaultShell = true;

     

       319
       -
                   home = cfg.stateDir;

     

       320
       -
                   createHome = true;

     

       321
       -
                   group = cfg.gitUser;

     

       322
       -
                 };

     

       323
       -
       

     

       324
       -
                 users.groups.${cfg.gitUser} = {};

     

       325
       -
       

     

       326
       -
                 services.openssh = {

     

       327
       -
                   enable = true;

     

       328
       -
                   extraConfig = ''

     

       329
       -
                     Match User ${cfg.gitUser}

     

       330
       -
                         AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper

     

       331
       -
                         AuthorizedKeysCommandUser nobody

     

       332
       -
                   '';

     

       333
       -
                 };

     

       334
       -
       

     

       335
       -
                 environment.etc."ssh/keyfetch_wrapper" = {

     

       336
       -
                   mode = "0555";

     

       337
       -
                   text = ''

     

       338
       -
                     #!${pkgs.stdenv.shell}

     

       339
       -
                     ${self.packages.${pkgs.system}.knot}/bin/knot keys \

     

       340
       -
                       -output authorized-keys \

     

       341
       -
                       -internal-api "http://${cfg.server.internalListenAddr}" \

     

       342
       -
                       -git-dir "${cfg.repo.scanPath}" \

     

       343
       -
                       -log-path /tmp/knotguard.log

     

       344
       -
                   '';

     

       345
       -
                 };

     

       346
       -
       

     

       347
       -
                 systemd.services.knot = {

     

       348
       -
                   description = "knot service";

     

       349
       -
                   after = ["network.target" "sshd.service"];

     

       350
       -
                   wantedBy = ["multi-user.target"];

     

       351
       -
                   serviceConfig = {

     

       352
       -
                     User = cfg.gitUser;

     

       353
       -
                     WorkingDirectory = cfg.stateDir;

     

       354
       -
                     Environment = [

     

       355
       -
                       "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}"

     

       356
       -
                       "KNOT_REPO_MAIN_BRANCH=${cfg.repo.mainBranch}"

     

       357
       -
                       "APPVIEW_ENDPOINT=${cfg.appviewEndpoint}"

     

       358
       -
                       "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${cfg.server.internalListenAddr}"

     

       359
       -
                       "KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}"

     

       360
       -
                       "KNOT_SERVER_DB_PATH=${cfg.server.dbPath}"

     

       361
       -
                       "KNOT_SERVER_HOSTNAME=${cfg.server.hostname}"

     

       362
       -
                     ];

     

       363
       -
                     EnvironmentFile = cfg.server.secretFile;

     

       364
       -
                     ExecStart = "${self.packages.${pkgs.system}.knot}/bin/knot server";

     

       365
       -
                     Restart = "always";

     

       366
       -
                   };

     

       367
       -
                 };

     

       368
       -
       

     

       369
       -
                 networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22];

     

       370
       -
               };

     

       371
       -
             };

     

       372
       -
       

     

       373
        
           nixosConfigurations.knotVM = nixpkgs.lib.nixosSystem {

     

       374
        
             system = "x86_64-linux";

     

       375
        
             modules = [

     
···

       403
        
             ];

     

       404
        
           };

     

       405
        
           nixosModules.appview = import ./nix/modules/appview.nix {inherit self;};

     

       0
        
       
     

       406
        
         };

     

       407
        
       }

···

       200
        
             };

     

       201
        
           });

     

       202
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       203
        
           nixosConfigurations.knotVM = nixpkgs.lib.nixosSystem {

     

       204
        
             system = "x86_64-linux";

     

       205
        
             modules = [

     
···

       233
        
             ];

     

       234
        
           };

     

       235
        
           nixosModules.appview = import ./nix/modules/appview.nix {inherit self;};

     

       236
       +
           nixosModules.knot = import ./nix/modules/knot.nix {inherit self;};

     

       237
        
         };

     

       238
        
       }

+169

nix/modules/knot.nix

···

       1
       +
       {self}: {

     

       2
       +
         config,

     

       3
       +
         pkgs,

     

       4
       +
         lib,

     

       5
       +
         ...

     

       6
       +
       }: let

     

       7
       +
         cfg = config.services.tangled-knot;

     

       8
       +
       in

     

       9
       +
         with lib; {

     

       10
       +
           options = {

     

       11
       +
             services.tangled-knot = {

     

       12
       +
               enable = mkOption {

     

       13
       +
                 type = types.bool;

     

       14
       +
                 default = false;

     

       15
       +
                 description = "Enable a tangled knot";

     

       16
       +
               };

     

       17
       +
       

     

       18
       +
               appviewEndpoint = mkOption {

     

       19
       +
                 type = types.str;

     

       20
       +
                 default = "https://tangled.sh";

     

       21
       +
                 description = "Appview endpoint";

     

       22
       +
               };

     

       23
       +
       

     

       24
       +
               gitUser = mkOption {

     

       25
       +
                 type = types.str;

     

       26
       +
                 default = "git";

     

       27
       +
                 description = "User that hosts git repos and performs git operations";

     

       28
       +
               };

     

       29
       +
       

     

       30
       +
               openFirewall = mkOption {

     

       31
       +
                 type = types.bool;

     

       32
       +
                 default = true;

     

       33
       +
                 description = "Open port 22 in the firewall for ssh";

     

       34
       +
               };

     

       35
       +
       

     

       36
       +
               stateDir = mkOption {

     

       37
       +
                 type = types.path;

     

       38
       +
                 default = "/home/${cfg.gitUser}";

     

       39
       +
                 description = "Tangled knot data directory";

     

       40
       +
               };

     

       41
       +
       

     

       42
       +
               repo = {

     

       43
       +
                 scanPath = mkOption {

     

       44
       +
                   type = types.path;

     

       45
       +
                   default = cfg.stateDir;

     

       46
       +
                   description = "Path where repositories are scanned from";

     

       47
       +
                 };

     

       48
       +
       

     

       49
       +
                 mainBranch = mkOption {

     

       50
       +
                   type = types.str;

     

       51
       +
                   default = "main";

     

       52
       +
                   description = "Default branch name for repositories";

     

       53
       +
                 };

     

       54
       +
               };

     

       55
       +
       

     

       56
       +
               server = {

     

       57
       +
                 listenAddr = mkOption {

     

       58
       +
                   type = types.str;

     

       59
       +
                   default = "0.0.0.0:5555";

     

       60
       +
                   description = "Address to listen on";

     

       61
       +
                 };

     

       62
       +
       

     

       63
       +
                 internalListenAddr = mkOption {

     

       64
       +
                   type = types.str;

     

       65
       +
                   default = "127.0.0.1:5444";

     

       66
       +
                   description = "Internal address for inter-service communication";

     

       67
       +
                 };

     

       68
       +
       

     

       69
       +
                 secretFile = mkOption {

     

       70
       +
                   type = lib.types.path;

     

       71
       +
                   example = "KNOT_SERVER_SECRET=<hash>";

     

       72
       +
                   description = "File containing secret key provided by appview (required)";

     

       73
       +
                 };

     

       74
       +
       

     

       75
       +
                 dbPath = mkOption {

     

       76
       +
                   type = types.path;

     

       77
       +
                   default = "${cfg.stateDir}/knotserver.db";

     

       78
       +
                   description = "Path to the database file";

     

       79
       +
                 };

     

       80
       +
       

     

       81
       +
                 hostname = mkOption {

     

       82
       +
                   type = types.str;

     

       83
       +
                   example = "knot.tangled.sh";

     

       84
       +
                   description = "Hostname for the server (required)";

     

       85
       +
                 };

     

       86
       +
       

     

       87
       +
                 dev = mkOption {

     

       88
       +
                   type = types.bool;

     

       89
       +
                   default = false;

     

       90
       +
                   description = "Enable development mode (disables signature verification)";

     

       91
       +
                 };

     

       92
       +
               };

     

       93
       +
             };

     

       94
       +
           };

     

       95
       +
       

     

       96
       +
           config = mkIf cfg.enable {

     

       97
       +
             environment.systemPackages = with pkgs; [git];

     

       98
       +
       

     

       99
       +
             system.activationScripts.gitConfig = ''

     

       100
       +
               mkdir -p "${cfg.repo.scanPath}"

     

       101
       +
               chown -R ${cfg.gitUser}:${cfg.gitUser} \

     

       102
       +
                   "${cfg.repo.scanPath}"

     

       103
       +
       

     

       104
       +
               mkdir -p "${cfg.stateDir}/.config/git"

     

       105
       +
               cat > "${cfg.stateDir}/.config/git/config" << EOF

     

       106
       +
               [user]

     

       107
       +
                   name = Git User

     

       108
       +
                   email = git@example.com

     

       109
       +
               EOF

     

       110
       +
               chown -R ${cfg.gitUser}:${cfg.gitUser} \

     

       111
       +
                   "${cfg.stateDir}"

     

       112
       +
             '';

     

       113
       +
       

     

       114
       +
             users.users.${cfg.gitUser} = {

     

       115
       +
               isSystemUser = true;

     

       116
       +
               useDefaultShell = true;

     

       117
       +
               home = cfg.stateDir;

     

       118
       +
               createHome = true;

     

       119
       +
               group = cfg.gitUser;

     

       120
       +
             };

     

       121
       +
       

     

       122
       +
             users.groups.${cfg.gitUser} = {};

     

       123
       +
       

     

       124
       +
             services.openssh = {

     

       125
       +
               enable = true;

     

       126
       +
               extraConfig = ''

     

       127
       +
                 Match User ${cfg.gitUser}

     

       128
       +
                     AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper

     

       129
       +
                     AuthorizedKeysCommandUser nobody

     

       130
       +
               '';

     

       131
       +
             };

     

       132
       +
       

     

       133
       +
             environment.etc."ssh/keyfetch_wrapper" = {

     

       134
       +
               mode = "0555";

     

       135
       +
               text = ''

     

       136
       +
                 #!${pkgs.stdenv.shell}

     

       137
       +
                 ${self.packages.${pkgs.system}.knot}/bin/knot keys \

     

       138
       +
                   -output authorized-keys \

     

       139
       +
                   -internal-api "http://${cfg.server.internalListenAddr}" \

     

       140
       +
                   -git-dir "${cfg.repo.scanPath}" \

     

       141
       +
                   -log-path /tmp/knotguard.log

     

       142
       +
               '';

     

       143
       +
             };

     

       144
       +
       

     

       145
       +
             systemd.services.knot = {

     

       146
       +
               description = "knot service";

     

       147
       +
               after = ["network.target" "sshd.service"];

     

       148
       +
               wantedBy = ["multi-user.target"];

     

       149
       +
               serviceConfig = {

     

       150
       +
                 User = cfg.gitUser;

     

       151
       +
                 WorkingDirectory = cfg.stateDir;

     

       152
       +
                 Environment = [

     

       153
       +
                   "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}"

     

       154
       +
                   "KNOT_REPO_MAIN_BRANCH=${cfg.repo.mainBranch}"

     

       155
       +
                   "APPVIEW_ENDPOINT=${cfg.appviewEndpoint}"

     

       156
       +
                   "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${cfg.server.internalListenAddr}"

     

       157
       +
                   "KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}"

     

       158
       +
                   "KNOT_SERVER_DB_PATH=${cfg.server.dbPath}"

     

       159
       +
                   "KNOT_SERVER_HOSTNAME=${cfg.server.hostname}"

     

       160
       +
                 ];

     

       161
       +
                 EnvironmentFile = cfg.server.secretFile;

     

       162
       +
                 ExecStart = "${self.packages.${pkgs.system}.knot}/bin/knot server";

     

       163
       +
                 Restart = "always";

     

       164
       +
               };

     

       165
       +
             };

     

       166
       +
       

     

       167
       +
             networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22];

     

       168
       +
           };

     

       169
       +
         }