aboutsummaryrefslogtreecommitdiffstats
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/default.nix12
-rw-r--r--pkgs/krops/default.nix146
-rw-r--r--pkgs/populate/default.nix187
3 files changed, 276 insertions, 69 deletions
diff --git a/pkgs/default.nix b/pkgs/default.nix
index b8530a8..76c7f11 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,15 +1,7 @@
{ overlays ? [], ... }@args:
-let
- nix-writers = builtins.fetchGit {
- url = https://cgit.krebsco.de/nix-writers/;
- rev = "c27a9416e8ee04d708b11b48f8cf1a055c0cc079";
- };
-in
-
import <nixpkgs> (args // {
- overlays = overlays ++ [
+ overlays = [
(import ./overlay.nix)
- (import "${nix-writers}/pkgs")
- ];
+ ] ++ overlays;
})
diff --git a/pkgs/krops/default.nix b/pkgs/krops/default.nix
index d5a75d7..04c38cf 100644
--- a/pkgs/krops/default.nix
+++ b/pkgs/krops/default.nix
@@ -2,45 +2,145 @@ let
lib = import ../../lib;
in
-{ exec, nix, openssh, populate, writeDash }: rec {
+{ nix, openssh, populate, writers }: rec {
- rebuild = args: target:
- exec "rebuild.${target.host}" rec {
- filename = "${openssh}/bin/ssh";
- argv = [
- filename
- "-l" target.user
- "-p" target.port
- target.host
- "nixos-rebuild -I ${lib.escapeShellArg target.path} ${
- lib.concatMapStringsSep " " lib.escapeShellArg args
- }"
- ];
- };
+ rebuild = {
+ useNixOutputMonitor
+ }:
+ args: target:
+ runShell target {}
+ (withNixOutputMonitor target useNixOutputMonitor /* sh */ ''
+ NIX_PATH=${lib.escapeShellArg target.path} \
+ nixos-rebuild ${lib.escapeShellArgs args}
+ '');
- writeDeploy = name: { force ? false, source, target }: let
+ runShell = target: {
+ allocateTTY ? false
+ }: command:
+ let
+ command' = /* sh */ ''
+ ${lib.optionalString target.sudo "sudo"} \
+ /bin/sh -c ${lib.escapeShellArg command}
+ '';
+ in
+ if lib.isLocalTarget target
+ then command'
+ else
+ writers.writeDash "krops.${target.host}.${lib.firstWord command}" ''
+ exec ${openssh}/bin/ssh ${lib.escapeShellArgs (lib.flatten [
+ (lib.mkUserPortSSHOpts target)
+ (if allocateTTY then "-t" else "-T")
+ target.extraOptions
+ target.host
+ command'
+ ])}
+ '';
+
+ withNixOutputMonitor = target: mode_: command: let
+ mode =
+ lib.getAttr (lib.typeOf mode_) {
+ bool = lib.toJSON mode_;
+ string = mode_;
+ };
+ in /* sh */ ''
+ printf '# use nix-output-monitor: %s\n' ${lib.escapeShellArg mode} >&2
+ ${lib.getAttr mode rec {
+ opportunistic = /* sh */ ''
+ if command -v nom >/dev/null; then
+ ${optimistic}
+ else
+ ${false}
+ fi
+ '';
+ optimistic = /* sh */ ''
+ (${command}) 2>&1 | nom
+ '';
+ pessimistic = /* sh */ ''
+ NIX_PATH=${lib.escapeShellArg target.path} \
+ nix-shell -p nix-output-monitor --run ${lib.escapeShellArg optimistic}
+ '';
+ true = /* sh */ ''
+ if command -v nom >/dev/null; then
+ ${optimistic}
+ else
+ ${pessimistic}
+ fi
+ '';
+ false = command;
+ }}
+ '';
+
+ writeCommand = name: {
+ command ? (targetPath: "echo ${targetPath}"),
+ backup ? false,
+ force ? false,
+ allocateTTY ? false,
+ source,
+ target
+ }: let
target' = lib.mkTarget target;
in
- writeDash name ''
+ writers.writeDash name ''
set -efu
- ${populate { inherit force source; target = target'; }}
- ${rebuild ["switch"] target'}
+ ${populate { inherit backup force source; target = target'; }}
+ ${runShell target' { inherit allocateTTY; } (command target'.path)}
'';
- writeTest = name: { force ? false, source, target }: let
+ writeDeploy = name: {
+ backup ? false,
+ buildTarget ? null,
+ crossDeploy ? false,
+ fast ? null,
+ force ? false,
+ operation ? "switch",
+ source,
+ target,
+ useNixOutputMonitor ? "opportunistic"
+ }: let
+ buildTarget' =
+ if buildTarget == null
+ then target'
+ else lib.mkTarget buildTarget;
+ target' = lib.mkTarget target;
+ in
+ lib.traceIf (fast != null) "writeDeploy: it's now always fast, setting the `fast` attribute is deprecated and will be removed in future" (
+ writers.writeDash name ''
+ set -efu
+ ${lib.optionalString (buildTarget' != target')
+ (populate { inherit backup force source; target = buildTarget'; })}
+ ${populate { inherit backup force source; target = target'; }}
+ ${rebuild { inherit useNixOutputMonitor; } ([
+ operation
+ ] ++ lib.optionals crossDeploy [
+ "--no-build-nix"
+ ] ++ lib.optionals (buildTarget' != target') [
+ "--build-host" "${buildTarget'.user}@${buildTarget'.host}"
+ "--target-host" "${target'.user}@${target'.host}"
+ ] ++ lib.optionals target'.sudo [
+ "--use-remote-sudo"
+ ]) buildTarget'}
+ ''
+ );
+
+ writeTest = name: {
+ backup ? false,
+ force ? false,
+ source,
+ target,
+ trace ? false
+ }: let
target' = lib.mkTarget target;
in
assert lib.isLocalTarget target';
- writeDash name ''
+ writers.writeDash name ''
set -efu
- ${populate { inherit force source; target = target'; }} >&2
+ ${populate { inherit backup force source; target = target'; }} >&2
NIX_PATH=${lib.escapeShellArg target'.path} \
${nix}/bin/nix-build \
-A system \
--keep-going \
--no-out-link \
- --show-trace \
+ ${lib.optionalString trace "--show-trace"} \
'<nixpkgs/nixos>'
'';
-
}
diff --git a/pkgs/populate/default.nix b/pkgs/populate/default.nix
index 50bceca..7129b90 100644
--- a/pkgs/populate/default.nix
+++ b/pkgs/populate/default.nix
@@ -1,17 +1,17 @@
with import ../../lib;
with shell;
-{ coreutils, dash, findutils, git, jq, openssh, pass, rsync, writeDash }:
+{ coreutils, dash, findutils, git, jq, openssh, pass, passage, rsync, writers }:
let
check = { force, target }: let
sentinelFile = "${target.path}/.populate";
- in shell' target /* sh */ ''
+ in runShell target /* sh */ ''
${optionalString force /* sh */ ''
mkdir -vp ${quote (dirOf sentinelFile)} >&2
touch ${quote sentinelFile}
''}
- if ! test -f ${quote sentinelFile}; then
+ if ! test -e ${quote sentinelFile}; then
>&2 printf 'error: missing sentinel file: %s\n' ${quote (
optionalString (!isLocalTarget target) "${target.host}:" +
sentinelFile
@@ -20,20 +20,60 @@ let
fi
'';
- pop.derivation = target: source: shell' target /* sh */ ''
+ do-backup = { target }: let
+ sentinelFile = "${target.path}/.populate";
+ in
+ runShell target /* sh */ ''
+ if ! test -d ${quote sentinelFile}; then
+ >&2 printf 'error" sentinel file is not a directory: %s\n' ${quote (
+ optionalString (!isLocalTarget target) "${target.host}:" +
+ sentinelFile
+ )}
+ exit 1
+ fi
+ rsync >&2 \
+ -aAXF \
+ --delete \
+ --exclude /.populate \
+ --link-dest=${quote target.path} \
+ ${target.path}/ \
+ ${target.path}/.populate/backup/
+ '';
+
+ pop.derivation = target: source: runShell target /* sh */ ''
nix-build -E ${quote source.text} -o ${quote target.path} >&2
'';
pop.file = target: source: let
- configAttrs = ["useChecksum"];
- config = filterAttrs (name: _: elem name configAttrs) source;
+ config = rsyncDefaultConfig // derivedConfig // sourceConfig;
+ derivedConfig = {
+ useChecksum =
+ if isStorePath source.path
+ then true
+ else rsyncDefaultConfig.useChecksum;
+ };
+ sourceConfig =
+ filterAttrs (name: _: elem name (attrNames rsyncDefaultConfig)) source;
+ sourcePath =
+ if isStorePath source.path
+ then quote (toString source.path)
+ else quote source.path;
in
- rsync' target config (quote source.path);
+ rsync' target config sourcePath;
- pop.git = target: source: shell' target /* sh */ ''
+ pop.git = target: source: runShell target /* sh */ ''
set -efu
+ # Remove target path if it doesn't look like a git worktree.
+ # This can happen e.g. when it had a different type earlier.
+ if ! test -e ${quote target.path}/.git; then
+ rm -fR ${quote target.path}
+ fi
if ! test -e ${quote target.path}; then
- git clone --recurse-submodules ${quote source.url} ${quote target.path}
+ ${if source.shallow then /* sh */ ''
+ git init ${quote target.path}
+ '' else /* sh */ ''
+ git clone --recurse-submodules ${quote source.url} ${quote target.path}
+ ''}
fi
cd ${quote target.path}
if ! url=$(git config remote.origin.url); then
@@ -46,9 +86,21 @@ let
hash=${quote source.ref}
if ! test "$(git log --format=%H -1)" = "$hash"; then
- if ! git log -1 "$hash" >/dev/null 2>&1; then
- git fetch origin
- fi
+ ${if source.fetchAlways then /* sh */ ''
+ ${if source.shallow then /* sh */ ''
+ git fetch --depth=1 origin "$hash"
+ '' else /* sh */ ''
+ git fetch origin
+ ''}
+ '' else /* sh */ ''
+ if ! git log -1 "$hash" >/dev/null 2>&1; then
+ ${if source.shallow then /* sh */ ''
+ git fetch --depth=1 origin "$hash"
+ '' else /* sh */ ''
+ git fetch origin
+ ''}
+ fi
+ ''}
git reset --hard "$hash" >&2
git submodule update --init --recursive
fi
@@ -67,8 +119,16 @@ let
umask 0077
if test -e ${quote source.dir}/.git; then
- local_pass_info=${quote source.name}\ $(${git}/bin/git -C ${quote source.dir} log -1 --format=%H ${quote source.name})
- remote_pass_info=$(${shell' target /* sh */ ''
+ local_pass_info=${quote source.name}\ $(
+ ${git}/bin/git -C ${quote source.dir} log -1 --format=%H ${quote source.name}
+ # we append a hash for every symlink, otherwise we would miss updates on
+ # files where the symlink points to
+ ${findutils}/bin/find ${quote source.dir}/${quote source.name} -type l \
+ -exec ${coreutils}/bin/realpath {} + |
+ ${coreutils}/bin/sort |
+ ${findutils}/bin/xargs -r -n 1 ${git}/bin/git -C ${quote source.dir} log -1 --format=%H
+ )
+ remote_pass_info=$(${runShell target /* sh */ ''
cat ${quote target.path}/.pass_info || :
''})
@@ -83,45 +143,80 @@ let
rm -fR "$tmp_dir"
}
- ${findutils}/bin/find ${quote passPrefix} -type f |
+ ${findutils}/bin/find ${quote passPrefix} -type f -follow ! -name .gpg-id |
while read -r gpg_path; do
rel_name=''${gpg_path#${quote passPrefix}}
rel_name=''${rel_name%.gpg}
pass_date=$(
- ${git}/bin/git -C ${quote source.dir} log -1 --format=%aI "$gpg_path"
+ if test -e ${quote source.dir}/.git; then
+ ${git}/bin/git -C ${quote source.dir} log -1 --format=%aI "$gpg_path"
+ fi
)
pass_name=${quote source.name}/$rel_name
tmp_path=$tmp_dir/$rel_name
${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")"
PASSWORD_STORE_DIR=${quote source.dir} ${pass}/bin/pass show "$pass_name" > "$tmp_path"
- ${coreutils}/bin/touch -d "$pass_date" "$tmp_path"
+ if [ -n "$pass_date" ]; then
+ ${coreutils}/bin/touch -d "$pass_date" "$tmp_path"
+ fi
done
if test -n "''${local_pass_info-}"; then
echo "$local_pass_info" > "$tmp_dir"/.pass_info
fi
- ${rsync' target {} /* sh */ "$tmp_dir"}
+ ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
+ '';
+
+ pop.passage = target: source: /* sh */ ''
+ set -efu
+
+ export PASSAGE_AGE=${quote source.age}
+ export PASSAGE_DIR=${quote source.dir}
+ export PASSAGE_IDENTITIES_FILE=${quote source.identities_file}
+
+ umask 0077
+
+ tmp_dir=$(${coreutils}/bin/mktemp -dt populate-passage.XXXXXXXX)
+ trap cleanup EXIT
+ cleanup() {
+ rm -fR "$tmp_dir"
+ }
+
+ ${findutils}/bin/find "$PASSAGE_DIR" -type f -name \*.age -follow |
+ while read -r age_path; do
+
+ rel_name=''${age_path#$PASSAGE_DIR}
+ rel_name=''${rel_name%.age}
+
+ tmp_path=$tmp_dir/$rel_name
+
+ ${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")"
+ ${passage}/bin/passage show "$rel_name" > "$tmp_path"
+ ${coreutils}/bin/touch -r "$age_path" "$tmp_path"
+ done
+
+ ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
'';
pop.pipe = target: source: /* sh */ ''
${quote source.command} | {
- ${shell' target /* sh */ "cat > ${quote target.path}"}
+ ${runShell target /* sh */ "cat > ${quote target.path}"}
}
'';
# TODO rm -fR instead of ln -f?
- pop.symlink = target: source: shell' target /* sh */ ''
+ pop.symlink = target: source: runShell target /* sh */ ''
ln -fnsT ${quote source.target} ${quote target.path}
'';
populate = target: name: source: let
source' = source.${source.type};
target' = target // { path = "${target.path}/${name}"; };
- in writeDash "populate.${target'.host}.${name}" ''
+ in writers.writeDash "populate.${target'.host}.${name}" ''
set -efu
${pop.${source.type} target' source'}
'';
@@ -132,39 +227,59 @@ let
source_path=$source_path/
fi
${rsync}/bin/rsync \
- ${optionalString (config.useChecksum or false) /* sh */ "--checksum"} \
+ ${optionalString config.useChecksum /* sh */ "--checksum"} \
+ ${optionalString target.sudo /* sh */ "--rsync-path=\"sudo rsync\""} \
+ ${concatMapStringsSep " "
+ (pattern: /* sh */ "--exclude ${quote pattern}")
+ config.exclude} \
+ ${concatMapStringsSep " "
+ (filter: /* sh */ "--${filter.type} ${quote filter.pattern}")
+ config.filters} \
-e ${quote (ssh' target)} \
-vFrlptD \
- --delete-excluded \
+ ${optionalString config.deleteExcluded /* sh */ "--delete-excluded"} \
"$source_path" \
${quote (
- optionalString (!isLocalTarget target)
- "${target.user}@${target.host}:" +
+ optionalString (!isLocalTarget target) (
+ (optionalString (target.user != "") "${target.user}@") +
+ "${target.host}:"
+ ) +
target.path
)} \
>&2
'';
- shell' = target: script:
+ rsyncDefaultConfig = {
+ useChecksum = false;
+ exclude = [];
+ filters = [];
+ deleteExcluded = true;
+ };
+
+ runShell = target: command:
if isLocalTarget target
- then script
- else /* sh */ ''
- ${ssh' target} ${quote target.host} ${quote script}
- '';
+ then command
+ else
+ if target.sudo then /* sh */ ''
+ ${ssh' target} ${quote target.host} ${quote "sudo bash -c ${quote command}"}
+ '' else ''
+ ${ssh' target} ${quote target.host} ${quote command}
+ '';
- ssh' = target: concatMapStringsSep " " quote [
+ ssh' = target: concatMapStringsSep " " quote (flatten [
"${openssh}/bin/ssh"
- "-l" target.user
- "-o" "ControlPersist=no"
- "-p" target.port
+ (mkUserPortSSHOpts target)
"-T"
- ];
+ target.extraOptions
+ ]);
in
-{ force ? false, source, target }: writeDash "populate.${target.host}" ''
+{ backup ? false, force ? false, source, target }:
+writers.writeDash "populate.${target.host}" ''
set -efu
${check { inherit force target; }}
set -x
+ ${optionalString backup (do-backup { inherit target; })}
${concatStringsSep "\n" (mapAttrsToList (populate target) source)}
''
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 19:35:54 +0000