···
+
supportedSystems = ["x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin"];
+
forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+
nixpkgsFor = forAllSystems (system:
+
overlays = [self.overlays.default];
+
inherit (gitignore.lib) gitignoreSource;
+
overlays.default = final: prev: let
+
goModHash = "sha256-EilWxfqrcKDaSR5zA3ZuDSCq7V+/IfWpKPu8HWhpndA=";
+
buildCmdPackage = name:
+
src = gitignoreSource ./.;
+
subPackages = ["cmd/${name}"];
+
vendorHash = goModHash;
+
indigo-lexgen = final.buildGoModule {
+
pname = "indigo-lexgen";
+
subPackages = ["cmd/lexgen"];
+
vendorHash = "sha256-pGc29fgJFq8LP7n/pY1cv6ExZl88PAeFqIbFEhB3xXs=";
+
final.pkgsStatic.buildGoModule {
+
src = gitignoreSource ./.;
+
mkdir -p appview/pages/static/{fonts,icons}
+
cp -f ${htmx-src} appview/pages/static/htmx.min.js
+
cp -rf ${lucide-src}/*.svg appview/pages/static/icons/
+
cp -f ${inter-fonts-src}/web/InterVariable*.woff2 appview/pages/static/fonts/
+
cp -f ${inter-fonts-src}/web/InterDisplay*.woff2 appview/pages/static/fonts/
+
cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono-Regular.woff2 appview/pages/static/fonts/
+
${pkgs.tailwindcss}/bin/tailwindcss -i input.css -o appview/pages/static/tw.css
+
subPackages = ["cmd/appview"];
+
vendorHash = goModHash;
+
stdenv = pkgsStatic.stdenv;
+
knotserver = with final;
+
final.pkgsStatic.buildGoModule {
+
src = gitignoreSource ./.;
+
nativeBuildInputs = [final.makeWrapper];
+
subPackages = ["cmd/knotserver"];
+
vendorHash = goModHash;
+
cp $GOPATH/bin/knotserver $out/bin/knotserver
+
wrapProgram $out/bin/knotserver \
+
--prefix PATH : ${pkgs.git}/bin
+
knotserver-unwrapped = final.pkgsStatic.buildGoModule {
+
src = gitignoreSource ./.;
+
subPackages = ["cmd/knotserver"];
+
vendorHash = goModHash;
+
repoguard = buildCmdPackage "repoguard";
+
keyfetch = buildCmdPackage "keyfetch";
+
packages = forAllSystems (system: {
+
(nixpkgsFor."${system}")
+
defaultPackage = forAllSystems (system: nixpkgsFor.${system}.appview);
+
formatter = forAllSystems (system: nixpkgsFor."${system}".alejandra);
+
devShells = forAllSystems (system: let
+
pkgs = nixpkgsFor.${system};
+
staticShell = pkgs.mkShell.override {
+
stdenv = pkgs.pkgsStatic.stdenv;
+
default = staticShell {
+
mkdir -p appview/pages/static/{fonts,icons}
+
cp -f ${htmx-src} appview/pages/static/htmx.min.js
+
cp -rf ${lucide-src}/*.svg appview/pages/static/icons/
+
cp -f ${inter-fonts-src}/web/InterVariable*.woff2 appview/pages/static/fonts/
+
cp -f ${inter-fonts-src}/web/InterDisplay*.woff2 appview/pages/static/fonts/
+
cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono-Regular.woff2 appview/pages/static/fonts/
+
apps = forAllSystems (system: let
+
pkgs = nixpkgsFor."${system}";
+
pkgs.writeShellScriptBin "run"
+
TANGLED_DEV=true ${pkgs.air}/bin/air -c /dev/null \
+
-build.cmd "${pkgs.tailwindcss}/bin/tailwindcss -i input.css -o ./appview/pages/static/tw.css && ${pkgs.go}/bin/go build -o ./out/${name}.out ./cmd/${name}/main.go" \
+
-build.bin "./out/${name}.out" \
+
-build.include_ext "go"
+
pkgs.writeShellScriptBin "run"
+
${pkgs.tailwindcss}/bin/tailwindcss -w -i input.css -o ./appview/pages/static/tw.css
+
program = ''${air-watcher "appview"}/bin/run'';
+
program = ''${air-watcher "knotserver"}/bin/run'';
+
program = ''${tailwind-watcher}/bin/run'';
+
nixosModules.appview = {
+
services.tangled-appview = {
+
description = "Enable tangled appview";
+
description = "Port to run the appview on";
+
cookie_secret = mkOption {
+
default = "00000000000000000000000000000000";
+
description = "Cookie secret";
+
config = mkIf config.services.tangled-appview.enable {
+
systemd.services.tangled-appview = {
+
description = "tangled appview service";
+
wantedBy = ["multi-user.target"];
+
ListenStream = "0.0.0.0:${toString config.services.tangled-appview.port}";
+
ExecStart = "${self.packages.${pkgs.system}.appview}/bin/appview";
+
TANGLED_DB_PATH = "appview.db";
+
TANGLED_COOKIE_SECRET = config.services.tangled-appview.cookie_secret;
+
nixosModules.knotserver = {
+
cfg = config.services.tangled-knotserver;
+
services.tangled-knotserver = {
+
description = "Enable a tangled knotserver";
+
appviewEndpoint = mkOption {
+
default = "https://tangled.sh";
+
description = "Appview endpoint";
+
description = "User that hosts git repos and performs git operations";
+
openFirewall = mkOption {
+
description = "Open port 22 in the firewall for ssh";
+
default = "/home/${cfg.gitUser}";
+
description = "Tangled knot data directory";
+
default = cfg.stateDir;
+
description = "Path where repositories are scanned from";
+
mainBranch = mkOption {
+
description = "Default branch name for repositories";
+
listenAddr = mkOption {
+
default = "0.0.0.0:5555";
+
description = "Address to listen on";
+
internalListenAddr = mkOption {
+
default = "127.0.0.1:5444";
+
description = "Internal address for inter-service communication";
+
secretFile = mkOption {
+
example = "KNOT_SERVER_SECRET=<hash>";
+
description = "File containing secret key provided by appview (required)";
+
default = "${cfg.stateDir}/knotserver.db";
+
description = "Path to the database file";
+
example = "knot.tangled.sh";
+
description = "Hostname for the server (required)";
+
description = "Enable development mode (disables signature verification)";
+
config = mkIf cfg.enable {
+
environment.systemPackages = with pkgs; [git];
+
system.activationScripts.gitConfig = ''
+
mkdir -p "${cfg.repo.scanPath}"
+
chown -R ${cfg.gitUser}:${cfg.gitUser} \
+
mkdir -p "${cfg.stateDir}/.config/git"
+
cat > "${cfg.stateDir}/.config/git/config" << EOF
+
email = git@example.com
+
chown -R ${cfg.gitUser}:${cfg.gitUser} \
+
users.users.${cfg.gitUser} = {
+
useDefaultShell = true;
+
users.groups.${cfg.gitUser} = {};
+
Match User ${cfg.gitUser}
+
AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper
+
AuthorizedKeysCommandUser nobody
+
environment.etc."ssh/keyfetch_wrapper" = {
+
${self.packages.${pkgs.system}.keyfetch}/bin/keyfetch \
+
-repoguard-path ${self.packages.${pkgs.system}.repoguard}/bin/repoguard \
+
-internal-api "http://${cfg.server.internalListenAddr}" \
+
-git-dir "${cfg.repo.scanPath}" \
+
-log-path /tmp/repoguard.log
+
systemd.services.knotserver = {
+
description = "knotserver service";
+
after = ["network.target" "sshd.service"];
+
wantedBy = ["multi-user.target"];
+
WorkingDirectory = cfg.stateDir;
+
"KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}"
+
"KNOT_REPO_MAIN_BRANCH=${cfg.repo.mainBranch}"
+
"APPVIEW_ENDPOINT=${cfg.appviewEndpoint}"
+
"KNOT_SERVER_INTERNAL_LISTEN_ADDR=${cfg.server.internalListenAddr}"
+
"KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}"
+
"KNOT_SERVER_DB_PATH=${cfg.server.dbPath}"
+
"KNOT_SERVER_HOSTNAME=${cfg.server.hostname}"
+
EnvironmentFile = cfg.server.secretFile;
+
ExecStart = "${self.packages.${pkgs.system}.knotserver}/bin/knotserver";
+
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22];
+
nixosConfigurations.knotVM = nixpkgs.lib.nixosSystem {
+
system = "x86_64-linux";
+
self.nixosModules.knotserver
+
virtualisation.memorySize = 2048;
+
virtualisation.diskSize = 10 * 1024;
+
virtualisation.cores = 2;
+
services.getty.autologinUser = "root";
+
environment.systemPackages = with pkgs; [curl vim git];
+
systemd.tmpfiles.rules = let
+
u = config.services.tangled-knotserver.gitUser;
+
g = config.services.tangled-knotserver.gitUser;
+
"d /var/lib/knotserver 0770 ${u} ${g} - -" # Create the directory first
+
"f+ /var/lib/knotserver/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=679f15000084699abc6a20d3ef449efa3656583f38e456a08f0638250688ff2e"
+
services.tangled-knotserver = {
+
secretFile = "/var/lib/knotserver/secret";
+
hostname = "localhost:6000";
+
listenAddr = "0.0.0.0:6000";
veryroundbird.house
oppi.li