summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
authortv <tv@shackspace.de>2015-09-27 00:22:50 +0200
committertv <tv@shackspace.de>2015-09-27 00:37:20 +0200
commitc9ccf22b154205caf55262ba6aa305e2c2247a02 (patch)
tree1190657c3702bbeada39de2c449a17aea3d931c5 /krebs
parent9157c6fbc9e355dd7a6ea8c9e33a280492a4d35b (diff)
krebs.build: merge deploy and infest
Diffstat (limited to 'krebs')
-rw-r--r--krebs/3modules/build/default.nix264
-rw-r--r--krebs/3modules/build/infest/finalize.sh (renamed from krebs/4lib/infest/4finalize)2
-rw-r--r--krebs/3modules/build/infest/install-nix.sh (renamed from krebs/4lib/infest/2install-nix)8
-rw-r--r--krebs/3modules/build/infest/prepare.sh (renamed from krebs/4lib/infest/1prepare)0
-rw-r--r--krebs/3modules/default.nix230
-rw-r--r--krebs/3modules/github-hosts-sync.nix2
-rw-r--r--krebs/3modules/retiolum.nix2
-rw-r--r--krebs/4lib/infest/3install-nix-tools9
-rw-r--r--krebs/4lib/types.nix10
9 files changed, 288 insertions, 239 deletions
diff --git a/krebs/3modules/build/default.nix b/krebs/3modules/build/default.nix
new file mode 100644
index 000000000..d6ee5c917
--- /dev/null
+++ b/krebs/3modules/build/default.nix
@@ -0,0 +1,264 @@
+{ config, lib, ... }:
+
+with import ../../4lib { inherit lib; };
+
+let
+ target = config.krebs.build // { user.name = "root"; };
+
+ out = {
+ # TODO deprecate krebs.build.host
+ options.krebs.build.host = mkOption {
+ type = types.host;
+ };
+
+ # TODO make krebs.build.profile shell safe
+ options.krebs.build.profile = mkOption {
+ type = types.str;
+ default = "/nix/var/nix/profiles/system";
+ };
+
+ # TODO make krebs.build.target.host :: host
+ options.krebs.build.target = mkOption {
+ type = with types; nullOr str;
+ default = null;
+ };
+
+ # TODO deprecate krebs.build.user
+ options.krebs.build.user = mkOption {
+ type = types.user;
+ };
+
+ options.krebs.build.scripts.deploy = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+ (${config.krebs.build.scripts._source})
+ ${ssh-target ''
+ ${config.krebs.build.scripts._nix-env}
+ ${config.krebs.build.profile}/bin/switch-to-configuration switch
+ ''}
+ echo OK
+ '';
+ };
+
+ options.krebs.build.scripts.infest = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+
+ export RSYNC_RSH; RSYNC_RSH="$(type -p ssh) \
+ -o 'HostName ${target.host.infest.addr}' \
+ -o 'Port ${toString target.host.infest.port}' \
+ "
+ ssh() {
+ eval "$RSYNC_RSH \"\$@\""
+ }
+
+ ${ssh-target ''
+ ${readFile ./infest/prepare.sh}
+ ${readFile ./infest/install-nix.sh}
+ ''}
+
+ (${config.krebs.build.scripts._source})
+
+ ${ssh-target ''
+ export PATH; PATH=/root/.nix-profile/bin:$PATH
+
+ src=$(type -p nixos-install)
+ cat_src() {
+ sed < "$src" "$(
+ sed < "$src" -n '
+ /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
+ /^nixpkgs=/=
+ /^NIX_PATH=/,/^$/{/./=}
+ ' \
+ | sed 's:$:s/^/#krebs#/:'
+ )"
+ }
+
+ # Location to insert config.krebs.build.scripts._nix-env
+ i=$(sed -n '/^echo "building the system configuration/=' "$src")
+
+ {
+ cat_src | sed -n "1,$i{p}"
+ cat ${doc config.krebs.build.scripts._nix-env}
+ cat_src | sed -n "$i,\''${$i!p}"
+ } > nixos-install
+ chmod +x nixos-install
+
+ # Wrap inserted config.krebs.build.scripts._nix-env into chroot.
+ nix_env=$(cat_src | sed -n '
+ s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
+ ')
+ echo nix-env is $nix_env
+ sed -i '
+ s:^nix-env:chroot $mountPoint '"$nix_env"':
+ ' nixos-install
+
+ ./nixos-install
+
+ ${readFile ./infest/finalize.sh}
+ ''}
+ '';
+ };
+
+ options.krebs.build.scripts._nix-env = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+ NIX_PATH=${config.krebs.build.source.NIX_PATH} \
+ nix-env \
+ -f '<stockholm>' \
+ -Q \
+ --argstr user-name ${config.krebs.exec.user.name} \
+ --argstr host-name ${target.host.name} \
+ --profile ${config.krebs.build.profile} \
+ --set \
+ -A ${lib.escapeShellArg (lib.concatStringsSep "." [
+ config.krebs.build.user.name
+ config.krebs.build.host.name
+ "system"
+ ])}
+ '';
+ };
+
+ options.krebs.build.scripts._source = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+ ${
+ lib.concatStringsSep "\n"
+ (lib.mapAttrsToList
+ (name: { scripts, url, ... }: "(${scripts._source})")
+ (config.krebs.build.source.dir //
+ config.krebs.build.source.git))
+ }
+ '';
+ };
+
+ options.krebs.build.source.NIX_PATH = mkOption {
+ type = types.str;
+ default =
+ lib.concatStringsSep ":"
+ (lib.mapAttrsToList (name: _: "${name}=/root/${name}")
+ (config.krebs.build.source.dir //
+ config.krebs.build.source.git));
+ };
+
+ options.krebs.build.source.dir = mkOption {
+ type =
+ let
+ exec = config.krebs.exec;
+ in
+ types.attrsOf (types.submodule ({ config, ... }:
+ let
+ url = "file://${config.host.name}${config.path}";
+
+ can-link = config.host.name == target.host.name;
+ can-push = config.host.name == exec.host.name;
+
+ push-method = ''
+ rsync \
+ --exclude .git \
+ --exclude .graveyard \
+ --exclude old \
+ --exclude tmp \
+ --rsync-path='mkdir -p ${config.target-path} && rsync' \
+ --delete-excluded \
+ -vrLptgoD \
+ ${config.path}/ \
+ ${target.user.name}@${target.host.name}:${config.target-path}
+ '';
+ in
+ {
+ options = {
+ host = mkOption {
+ type = types.host;
+ };
+ path = mkOption {
+ type = types.str;
+ };
+ scripts._source = mkOption {
+ type = types.str;
+ default =
+ #if can-link then link-method else
+ if can-push then push-method else
+ throw "cannot source ${url}";
+ };
+ target-path = mkOption {
+ type = types.str;
+ default = "/root/${config._module.args.name}";
+ };
+ url = mkOption {
+ type = types.str;
+ default = "file://${config.host.name}${config.path}";
+ };
+ };
+ }
+ ));
+ default = {};
+ };
+
+ options.krebs.build.source.git = mkOption {
+ type =
+ let
+ target = config.krebs.build // { user.name = "root"; };
+ in
+ with types; attrsOf (submodule ({ config, ... }:
+ {
+ options = {
+ url = mkOption {
+ type = types.str; # TODO must be shell safe
+ };
+ rev = mkOption {
+ type = types.str;
+ };
+ scripts._source = mkOption {
+ type = types.str;
+ default = ssh-target ''
+ mkdir -p ${config.target-path}
+ cd ${config.target-path}
+ if ! test -e .git; then
+ git init
+ fi
+ if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
+ git remote add origin ${config.url}
+ elif test "$cur_url" != ${config.url}; then
+ git remote set-url origin ${config.url}
+ fi
+ if test "$(git rev-parse --verify HEAD 2>/dev/null)" != ${config.rev}; then
+ git fetch origin
+ git checkout ${config.rev} -- .
+ git checkout -q ${config.rev}
+ git submodule init
+ git submodule update
+ fi
+ git clean -dxf
+ '';
+ };
+ target-path = mkOption {
+ type = types.str;
+ default = "/root/${config._module.args.name}";
+ };
+ };
+ }
+ ));
+ default = {};
+ };
+ };
+
+ doc = s:
+ let b = "EOF${hashString "sha256" s}"; in
+ ''
+ <<\${b}
+ ${s}
+ ${b}
+ '';
+
+ ssh-target = script:
+ "ssh root@${target.host.name} -T ${doc ''
+ set -efu
+ ${script}
+ ''}";
+
+in out
diff --git a/krebs/4lib/infest/4finalize b/krebs/3modules/build/infest/finalize.sh
index d095fa31b..ced5a4d4d 100644
--- a/krebs/4lib/infest/4finalize
+++ b/krebs/3modules/build/infest/finalize.sh
@@ -7,7 +7,7 @@ set -eux
umount /mnt || [ $? -eq 32 ]
umount /boot || [ $? -eq 32 ]
- PATH=$(for i in /nix/store/*coreutils*/bin; do :; done; echo $i)
+ PATH=$(set +f; for i in /nix/store/*coreutils*/bin; do :; done; echo $i)
export PATH
mkdir /oldshit
diff --git a/krebs/4lib/infest/2install-nix b/krebs/3modules/build/infest/install-nix.sh
index 3021c1143..88c8c3e1e 100644
--- a/krebs/4lib/infest/2install-nix
+++ b/krebs/3modules/build/infest/install-nix.sh
@@ -2,9 +2,9 @@
set -efu
nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
-nix_sha256="504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4"
+nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
-install-nix() {(
+install_nix() {(
# install nix on host (cf. https://nixos.org/nix/install)
if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
@@ -23,7 +23,7 @@ install-nix() {(
$nix_src_dir/install
fi
- #TODO: make this general or move to 1prepare
+ #TODO: make this general or move to prepare
if ! mount | grep -Fq '/dev/mapper/centos-root on /mnt/nix type xfs'; then
mkdir -p /mnt/nix
mount --bind /nix /mnt/nix
@@ -54,4 +54,4 @@ install-nix() {(
fi
)}
-install-nix "$@"
+install_nix "$@"
diff --git a/krebs/4lib/infest/1prepare b/krebs/3modules/build/infest/prepare.sh
index 07c00c3a5..07c00c3a5 100644
--- a/krebs/4lib/infest/1prepare
+++ b/krebs/3modules/build/infest/prepare.sh
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 0ffdec5f8..5fb129747 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -6,6 +6,7 @@ let
out = {
imports = [
+ ./build
./exim-retiolum.nix
./exim-smarthost.nix
./github-hosts-sync.nix
@@ -22,225 +23,6 @@ let
api = {
enable = mkEnableOption "krebs";
- build = mkOption {
- type = types.submodule ({ config, ... }: {
- options = {
- target = mkOption {
- type = with types; nullOr str;
- default = null;
- };
- deps = mkOption {
- type = with types; attrsOf (submodule {
- options = {
- url = mkOption {
- type = str;
- };
- rev = mkOption {
- type = nullOr str;
- default = null;
- };
- };
- });
- default = {};
- };
- script = mkOption {
- type = types.str;
- default = ''
- #! /bin/sh
- set -efux
-
- target=${escapeShellArg cfg.build.target}
-
- push(){(
- src=$1/
- dst=$target:$2
- rsync \
- --exclude .git \
- --exclude .graveyard \
- --exclude old \
- --rsync-path="mkdir -p \"$2\" && rsync" \
- --delete-excluded \
- -vrLptgoD \
- "$src" "$dst"
- )}
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev == null) ''
- push ${toString (map escapeShellArg [
- "${url}"
- "/root/src/${name}"
- ])}
- '') config.deps)}
-
- exec ssh -S none "$target" /bin/sh <<\EOF
- set -efux
- fetch(){(
- url=$1
- rev=$2
- dst=$3
- mkdir -p "$dst"
- cd "$dst"
- if ! test -e .git; then
- git init
- fi
- if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
- git remote add origin "$url"
- elif test "$cur_url" != "$url"; then
- git remote set-url origin "$url"
- fi
- if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then
- git fetch origin
- git checkout "$rev" -- .
- git checkout -q "$rev"
- git submodule init
- git submodule update
- fi
- git clean -dxf
- )}
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev != null) ''
- fetch ${toString (map escapeShellArg [
- url
- rev
- "/root/src/${name}"
- ])}
- '') config.deps)}
-
- echo build system...
- profile=/nix/var/nix/profiles/system
- NIX_PATH=/root/src \
- nix-env \
- -Q \
- -p "$profile" \
- -f '<stockholm>' \
- --set \
- -A system \
- --argstr user-name ${escapeShellArg cfg.build.user.name} \
- --argstr system-name ${escapeShellArg cfg.build.host.name}
-
- exec "$profile"/bin/switch-to-configuration switch
- EOF
-
- '';
- };
- infest = mkOption {
- type = types.str;
- default = ''
- #! /bin/sh
- set -efux
-
- target=${escapeShellArg cfg.build.target}
-
- push(){(
- src=$1/
- dst=$target:/mnt$2
- rsync \
- --exclude .git \
- --exclude .graveyard \
- --exclude old \
- --rsync-path="mkdir -p \"/mnt$2\" && rsync" \
- --delete-excluded \
- -vrLptgoD \
- "$src" "$dst"
- )}
-
- cat krebs/4lib/infest/1prepare | ssh "$target"
- cat krebs/4lib/infest/2install-nix | ssh "$target"
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev == null) ''
- push ${toString (map escapeShellArg [
- "${url}"
- "/root/src/${name}"
- ])}
- '') config.deps)}
-
- ssh -S none "$target" /bin/sh <<\EOF
- set -efux
-
- fetch(){(
- url=$1
- rev=$2
- dst=$3
- mkdir -p "$dst"
- cd "$dst"
- if ! test -e .git; then
- git init
- fi
- if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
- git remote add origin "$url"
- elif test "$cur_url" != "$url"; then
- git remote set-url origin "$url"
- fi
- if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then
- git fetch origin
- git checkout "$rev" -- .
- git checkout -q "$rev"
- git submodule init
- git submodule update
- fi
- git clean -dxf
- )}
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev != null) ''
- fetch ${toString (map escapeShellArg [
- url
- rev
- "/mnt/root/src/${name}"
- ])}
- '') config.deps)}
-
- export PATH=/root/.nix-profile/bin:/root/.nix-profile/sbin:$PATH
-
- sed < "$(type -p nixos-install)" > nixos-install '
- /^echo "building the system configuration..."/,/--set -A system/{
- s/.*/# &/
- s@.*--set -A system.*@&\n${concatStringsSep " " [
- "NIX_PATH=/mnt/root/src/"
- "nix-env"
- "-Q"
- "-p /nix/var/nix/profiles/system"
- "-f \"<stockholm>\""
- "--set"
- "-A system"
- "--argstr user-name ${escapeShellArg cfg.build.user.name}"
- "--argstr system-name ${escapeShellArg cfg.build.host.name}"
- ]}@
- }
- '
-
- sed -i 's/^nixpkgs=.*$/#&/' nixos-install
-
-
- chmod +x nixos-install
-
- echo {} > /root/dummy.nix
-
- echo build system...
- profile=/nix/var/nix/profiles/system
- NIXOS_CONFIG=/root/dummy.nix \
- ./nixos-install -I /root/src/
- #nl -bp nixos-install
-
- EOF
-
- cat krebs/4lib/infest/4finalize | ssh "$target"
- '';
- };
- host = mkOption {
- type = types.host;
- };
- user = mkOption {
- type = types.user;
- };
- };
- });
- # Define defaul value, so unset values of the submodule get reported.
- default = {};
- };
-
dns = {
providers = mkOption {
# TODO with types; tree dns.label dns.provider, so we can merge.
@@ -706,12 +488,13 @@ let
};
};
};
- mkdir = {
+ mkdir = rec {
cores = 1;
dc = "tv"; #dc = "cac";
+ infest.addr = head nets.internet.addrs4;
nets = rec {
internet = {
- addrs4 = ["162.248.167.241"];
+ addrs4 = ["104.233.84.102"];
aliases = [
"mkdir.internet"
];
@@ -762,12 +545,13 @@ let
};
secure = true;
};
- rmdir = {
+ rmdir = rec {
cores = 1;
dc = "tv"; #dc = "cac";
+ infest.addr = head nets.internet.addrs4;
nets = rec {
internet = {
- addrs4 = ["167.88.44.94"];
+ addrs4 = ["104.233.84.70"];
aliases = [
"rmdir.internet"
];
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index dbc0cc1de..f44fe3ad8 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -22,7 +22,7 @@ let
};
ssh-identity-file = mkOption {
type = types.str; # TODO must be named *.ssh.{id_rsa,id_ed25519}
- default = "/root/src/secrets/github-hosts-sync.ssh.id_rsa";
+ default = toString <secrets/github-hosts-sync.ssh.id_rsa>;
};
};
diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix
index 2617644d9..633642537 100644
--- a/krebs/3modules/retiolum.nix
+++ b/krebs/3modules/retiolum.nix
@@ -75,7 +75,7 @@ let
# TODO if it's types.path then it gets copied to /nix/store with
# bad unsafe permissions...
type = types.str;
- default = "/root/src/secrets/retiolum.rsa_key.priv";
+ default = toString <secrets/retiolum.rsa_key.priv>;
description = ''
Generate file with <literal>tincd -K</literal>.
This file must exist on the local system. The default points to
diff --git a/krebs/4lib/infest/3install-nix-tools b/krebs/4lib/infest/3install-nix-tools
deleted file mode 100644
index 59fa6f14a..000000000
--- a/krebs/4lib/infest/3install-nix-tools
+++ /dev/null
@@ -1,9 +0,0 @@
-#! /bin/sh
-set -efu
-
-install-nix-tools() {(
-
-
-)}
-
-install-nix-tools "$@"
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index f6b4bd8b1..dbffdf850 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -27,6 +27,16 @@ types // rec {
type = with types; attrsOf string;
};
+ infest = {
+ addr = mkOption {
+ type = str;
+ };
+ port = mkOption {
+ type = int;
+ default = 22;
+ };
+ };
+
secure = mkOption {
type = bool;
default = false;