diff options
| -rw-r--r-- | README.md | 92 | ||||
| -rw-r--r-- | lib/types/populate.nix | 24 | ||||
| -rw-r--r-- | pkgs/populate/default.nix | 20 |
3 files changed, 90 insertions, 46 deletions
@@ -281,17 +281,14 @@ Supported attributes: ### `flake` -The flake source type delivers a flake, or one of its locked inputs, to the -target. The flake gets archived locally using `nix flake archive`, the -selected input and its own inputs get copied into the target's Nix store using -`nix copy`, and the target path becomes a symlink to the input's store path, -registered as garbage collector root. The input's own inputs get garbage -collector roots in `.populate/flake-inputs/<name>`, which turns the sentinel -file into a directory. - -Because the target path points at the store path named by the flake's lock -file, it can be used in `NIX_PATH` as well as by flakes evaluated on the -target, without network access. +The flake source type delivers a flake to the target. The flake gets +archived locally using `nix flake archive`, which includes only files tracked +by Git, so use a `file` source for work trees with untracked files. The +flake and its inputs get copied into the target's Nix store using `nix copy`, +and the target path becomes a symlink to the flake's store path, registered +as garbage collector root. The inputs get garbage collector roots in +`.populate/flake-inputs/<name>`, which turns the sentinel file into a +directory. Supported attributes: @@ -300,39 +297,66 @@ Supported attributes: `flake.nix`. Its lock file is used as is; populating fails if the lock file needs to be updated. -* `input` (optional) - +* `inputs` (optional) - + inputs of the flake in this source to draw from other sources, see + [Flake inputs from sources](#flake-inputs-from-sources). + +Instead of an attribute set, the flake reference can be given as a string. + +The flake commands on the deploying machine run using krops' own Nix, so +flakes don't need to be enabled there. The target only needs `nix-store`. +Because the copied store paths aren't signed, the target user must be allowed +to import them, i.e. be `root` or a trusted user, and targets using `sudo` +aren't supported. + + +### `flake-input` + +The flake-input source type delivers an input of a flake, as recorded in the +flake's lock file, to the target. This makes the lock file of a flake the +single place that pins, e.g., nixpkgs, for flakes as well as for `NIX_PATH`. +It works like the `flake` source type, but delivers the selected input +instead of the flake, so the target path becomes a symlink to the input's +store path, and the input's own inputs get garbage collector roots in +`.populate/flake-inputs/<name>`. + +Because the target path points at the store path named by the lock file, it +can be used in `NIX_PATH` as well as by flakes evaluated on the target, +without network access. + +Supported attributes: + +* `flake` - + flake reference of the flake whose input gets delivered, e.g. the absolute + path of a directory containing a `flake.nix`. Its lock file is used as is; + populating fails if the lock file needs to be updated. + +* `name` - name of the input to deliver. Inputs of inputs are separated by `/`, - e.g. `stockholm/nixpkgs`. If omitted, the flake itself gets delivered, - which includes only files tracked by Git. Use a `file` source for work - trees with untracked files. + e.g. `stockholm/nixpkgs`. * `fetchOnTarget` (optional) - boolean that controls whether the target fetches the input itself instead of receiving it from the deploying machine. The target then uses the arguments recorded in the lock file, so inputs that refer to local paths of - the deploying machine can't be fetched this way. This requires `input`, - and Nix with flake support (Nix 2.4 or later) on the target. Defaults to - `false`. + the deploying machine can't be fetched this way. This requires Nix with + flake support (Nix 2.4 or later) on the target, and works for targets using + `sudo`. Defaults to `false`. * `inputs` (optional) - inputs of the flake in this source to draw from other sources, see [Flake inputs from sources](#flake-inputs-from-sources). -Instead of an attribute set, the flake reference can be given as a string. - -The flake commands on the deploying machine run using krops' own Nix, so -flakes don't need to be enabled there. Without `fetchOnTarget`, the target -only needs `nix-store`. Because the copied store paths aren't signed, the -target user must be allowed to import them, i.e. be `root` or a trusted user, -and targets using `sudo` aren't supported. +Without `fetchOnTarget`, the same requirements as for the `flake` source type +apply. Example: ```nix { - nixpkgs.flake = { + nixpkgs.flake-input = { flake = toString ./.; - input = "nixpkgs"; + name = "nixpkgs"; }; } ``` @@ -426,17 +450,17 @@ Supported attributes: ## Flake inputs from sources -Sources of type `file`, `flake`, `git`, and `symlink` can declare which inputs -of the flake they contain get drawn from other sources, in the style of -`flake.nix`, where `follows` names a source instead of an input. This makes -flakes on the target use what krops delivers there, much like `NIX_PATH` does -for Nix expressions. +Sources of type `file`, `flake`, `flake-input`, `git`, and `symlink` can +declare which inputs of the flake they contain get drawn from other sources, +in the style of `flake.nix`, where `follows` names a source instead of an +input. This makes flakes on the target use what krops delivers there, much +like `NIX_PATH` does for Nix expressions. ```nix { - nixpkgs.flake = { + nixpkgs.flake-input = { flake = toString ./.; - attribute = "nixpkgs"; + name = "nixpkgs"; }; crate2nix.flake = { flake = "github:nix-community/crate2nix"; diff --git a/lib/types/populate.nix b/lib/types/populate.nix index b1d4151..e971fd8 100644 --- a/lib/types/populate.nix +++ b/lib/types/populate.nix @@ -39,6 +39,10 @@ default = null; type = lib.types.nullOr (lib.types.either lib.types.str source-types.flake); }; + flake-input = lib.mkOption { + default = null; + type = lib.types.nullOr source-types.flake-input; + }; git = lib.mkOption { default = null; type = lib.types.nullOr source-types.git; @@ -166,6 +170,17 @@ }; flake = lib.types.submodule { options = { + flake = lib.mkOption { + type = lib.types.str; # TODO lib.types.flake-ref + }; + inputs = lib.mkOption { + default = {}; + type = flake-inputs; + }; + }; + }; + flake-input = lib.types.submodule { + options = { fetchOnTarget = lib.mkOption { default = false; type = lib.types.bool; @@ -173,9 +188,12 @@ flake = lib.mkOption { type = lib.types.str; # TODO lib.types.flake-ref }; - input = lib.mkOption { - default = null; - type = lib.types.nullOr lib.types.str; + inputs = lib.mkOption { + default = {}; + type = flake-inputs; + }; + name = lib.mkOption { + type = lib.types.str; }; }; }; diff --git a/pkgs/populate/default.nix b/pkgs/populate/default.nix index adf8479..c1bd9b8 100644 --- a/pkgs/populate/default.nix +++ b/pkgs/populate/default.nix @@ -190,10 +190,14 @@ let in rsync' target config sourcePath; - pop.flake = target: source: let + # Delivers the flake itself, as its input named null. Only inputs can be + # fetched on the target, so fetchOnTarget is always false here. + pop.flake = target: source: + pop.flake-input target (source // { name = null; fetchOnTarget = false; }); + + pop.flake-input = target: source: let nix' = "${nix}/bin/nix --extra-experimental-features ${quote "nix-command flakes"}"; - input = source.input or null; - inputPath = if input == null then [] else splitString "/" input; + inputPath = if source.name == null then [] else splitString "/" source.name; fetchOnTarget = source.fetchOnTarget or false; # Caches per-flake information, so it's obtained only once, even if # several sources use the same flake. @@ -211,12 +215,12 @@ let ''; noInput = /* sh */ '' >&2 printf 'error: flake %s has no input %s\n' \ - ${quote source.flake} ${quote (toString input)} + ${quote source.flake} ${quote (toString source.name)} exit 1 ''; # jq filter selecting the flake or input in nix flake archive's output. node = - if input == null then "." + if source.name == null then "." else concatMapStrings (name: ".inputs[${toJSON name}]") inputPath; # jq filter selecting the locked input and its own inputs in nix flake # metadata's output, as fetchTree arguments, the input first. @@ -287,10 +291,8 @@ let } ''; in - if fetchOnTarget && input == null then - throw "krops: flake source ${target.path}: fetching on the target needs an input" - else if !fetchOnTarget && !isLocalTarget target && target.sudo then - throw "krops: flake source ${target.path}: copying to targets with sudo is not supported" + if !fetchOnTarget && !isLocalTarget target && target.sudo then + throw "krops: source ${target.path}: copying flakes to targets with sudo is not supported" else if fetchOnTarget then /* sh */ '' set -efu |