build-clan: move clan attribute relates modules into subfolder
This commit is contained in:
Johannes Kirschbauer
23
lib/modules/clan/computed-tags.nix
Normal file
23
lib/modules/clan/computed-tags.nix
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
# Add the computed tags to machine tags for displaying them
|
||||
inventory = {
|
||||
tags = (
|
||||
{ machines, ... }:
|
||||
{
|
||||
# Only compute the default value
|
||||
# The option MUST be defined in ./build-inventory/interface.nix
|
||||
all = lib.mkDefault (builtins.attrNames machines);
|
||||
nixos = lib.mkDefault (
|
||||
builtins.attrNames (lib.filterAttrs (_n: m: m.machineClass == "nixos") machines)
|
||||
);
|
||||
darwin = lib.mkDefault (
|
||||
builtins.attrNames (lib.filterAttrs (_n: m: m.machineClass == "darwin") machines)
|
||||
);
|
||||
}
|
||||
);
|
||||
};
|
||||
}
|
||||
223
lib/modules/clan/interface.nix
Normal file
223
lib/modules/clan/interface.nix
Normal file
@@ -0,0 +1,223 @@
|
||||
{ clanLib }:
|
||||
{
|
||||
lib,
|
||||
self,
|
||||
# TODO: Use dependency injection to allow for testing
|
||||
# inventoryInterface,
|
||||
...
|
||||
}:
|
||||
let
|
||||
types = lib.types;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
_prefix = lib.mkOption {
|
||||
type = types.listOf types.str;
|
||||
internal = true;
|
||||
visible = false;
|
||||
default = [ ];
|
||||
};
|
||||
self = lib.mkOption {
|
||||
type = types.raw;
|
||||
default = self;
|
||||
defaultText = "Reference to the current flake";
|
||||
description = ''
|
||||
This is used to import external clan modules.
|
||||
'';
|
||||
};
|
||||
|
||||
directory = lib.mkOption {
|
||||
type = types.coercedTo lib.types.raw (
|
||||
v:
|
||||
if lib.isAttrs v then
|
||||
lib.warn "It appears you set 'clan.directory = self'. Instead set 'clan.self = self'. 'clan.directory' expects a path" v
|
||||
else if v == null then
|
||||
throw "Please set either clan.self or clan.directory"
|
||||
else
|
||||
v
|
||||
) lib.types.path;
|
||||
default = builtins.toString self;
|
||||
defaultText = "Root directory of the flake";
|
||||
description = ''
|
||||
The directory containing the clan.
|
||||
|
||||
A typical directory structure could look like this:
|
||||
|
||||
```
|
||||
.
|
||||
├── flake.nix
|
||||
├── assets
|
||||
├── machines
|
||||
├── modules
|
||||
└── sops
|
||||
```
|
||||
'';
|
||||
};
|
||||
|
||||
specialArgs = lib.mkOption {
|
||||
type = types.attrsOf types.raw;
|
||||
default = { };
|
||||
description = "Extra arguments to pass to nixosSystem i.e. useful to make self available";
|
||||
};
|
||||
|
||||
# Optional
|
||||
machines = lib.mkOption {
|
||||
type = types.attrsOf types.deferredModule;
|
||||
default = { };
|
||||
description = ''
|
||||
A mapping of machine names to their nixos configuration.
|
||||
|
||||
???+ example
|
||||
|
||||
```nix
|
||||
machines = {
|
||||
my-machine = {
|
||||
# Your nixos configuration
|
||||
};
|
||||
};
|
||||
```
|
||||
'';
|
||||
};
|
||||
|
||||
modules = lib.mkOption {
|
||||
# Correct type would be `types.attrsOf types.deferredModule` but that allows for
|
||||
# Merging and transforms the value, which add eval overhead.
|
||||
type = types.attrsOf types.raw;
|
||||
default = { };
|
||||
description = ''
|
||||
An attribute set of exported modules.
|
||||
'';
|
||||
};
|
||||
|
||||
templates = lib.mkOption {
|
||||
type = types.submodule { imports = [ ./templates.nix ]; };
|
||||
default = { };
|
||||
description = ''
|
||||
Define Clan templates.
|
||||
'';
|
||||
};
|
||||
|
||||
inventory = lib.mkOption {
|
||||
type = types.submodule {
|
||||
imports = [
|
||||
(lib.modules.importApply ../../inventory/build-inventory/interface.nix { inherit clanLib; })
|
||||
];
|
||||
};
|
||||
description = ''
|
||||
The `Inventory` submodule.
|
||||
|
||||
For details see the [Inventory](./inventory.md) documentation.
|
||||
'';
|
||||
};
|
||||
|
||||
# Meta
|
||||
meta = lib.mkOption {
|
||||
description = ''
|
||||
Global information about the clan.
|
||||
'';
|
||||
type = types.deferredModuleWith {
|
||||
staticModules = [ ../../inventory/build-inventory/meta-interface.nix ];
|
||||
};
|
||||
default = { };
|
||||
};
|
||||
|
||||
secrets = lib.mkOption {
|
||||
type = types.submodule { imports = [ ./secrets.nix ]; };
|
||||
description = ''
|
||||
Secrets related options such as AGE plugins required to encrypt/decrypt secrets using the CLI.
|
||||
'';
|
||||
default = { };
|
||||
};
|
||||
|
||||
pkgsForSystem = lib.mkOption {
|
||||
type = types.functionTo (types.nullOr types.attrs);
|
||||
default = _system: null;
|
||||
defaultText = "system: null";
|
||||
description = ''
|
||||
A function that maps from architecture to pkg. `( string -> pkgs )`
|
||||
|
||||
If specified this nixpkgs will be only imported once for each system.
|
||||
This improves performance, but all `nixpkgs.*` options will be ignored.
|
||||
|
||||
Returning `null` for a system will fallback to the default behavior of respecting the `nixpkgs.*` options.
|
||||
'';
|
||||
};
|
||||
|
||||
# Outputs
|
||||
darwinConfigurations = lib.mkOption {
|
||||
# Hide from documentation.
|
||||
# Exposed at the top-level of the flake, clan.darwinConfigurations should not used by the user.
|
||||
# Instead, the user should use the `.#darwinConfigurations` attribute of the flake output.
|
||||
visible = false;
|
||||
type = types.lazyAttrsOf types.raw;
|
||||
default = { };
|
||||
};
|
||||
|
||||
nixosConfigurations = lib.mkOption {
|
||||
# Hide from documentation.
|
||||
# Exposed at the top-level of the flake, clan.nixosConfigurations should not used by the user.
|
||||
# Instead, the user should use the `.#nixosConfigurations` attribute of the flake output.
|
||||
visible = false;
|
||||
type = types.lazyAttrsOf types.raw;
|
||||
default = { };
|
||||
};
|
||||
|
||||
nixosModules = lib.mkOption {
|
||||
# Hide from documentation.
|
||||
# Exposed at the top-level of the flake, clan.nixosModules should not used by the user.
|
||||
# Instead, the user should use the `.#nixosModules` attribute of the flake output.
|
||||
visible = false;
|
||||
type = types.lazyAttrsOf types.raw;
|
||||
default = { };
|
||||
description = ''
|
||||
NixOS modules that are generated by clan.
|
||||
These are used to generate the `nixosConfigurations`.
|
||||
'';
|
||||
};
|
||||
|
||||
darwinModules = lib.mkOption {
|
||||
# Hide from documentation.
|
||||
# Exposed at the top-level of the flake, clan.darwinModules should not used by the user.
|
||||
# Instead, the user should use the `.#darwinModules` attribute of the flake output.
|
||||
visible = false;
|
||||
type = types.lazyAttrsOf types.raw;
|
||||
default = { };
|
||||
description = ''
|
||||
Darwin modules that are generated by clan.
|
||||
These are used to generate the `darwinConfigurations`.
|
||||
'';
|
||||
};
|
||||
|
||||
# flake.clanInternals
|
||||
clanInternals = lib.mkOption {
|
||||
# Hide from documentation. Exposes internals to the cli.
|
||||
visible = false;
|
||||
# ClanInternals
|
||||
type = types.submodule {
|
||||
# Uncomment this if you want to add more stuff while debugging
|
||||
# freeformType = types.attrsOf types.raw;
|
||||
options = {
|
||||
# Those options are interfaced by the CLI
|
||||
# We don't specify the type here, for better performance.
|
||||
# clan-core's modules
|
||||
clanModules = lib.mkOption { type = lib.types.raw; };
|
||||
|
||||
# The machine 'imports' generated by the inventory per machine
|
||||
inventoryClass = lib.mkOption { type = lib.types.raw; };
|
||||
|
||||
# TODO: remove all dependents in python, delete this option
|
||||
inventory = lib.mkOption {
|
||||
type = lib.types.raw;
|
||||
apply = lib.warn "The 'clanInternals.inventory' option is deprecated, use 'clanInternals.inventoryClass' instead.";
|
||||
};
|
||||
|
||||
secrets = lib.mkOption { type = lib.types.raw; };
|
||||
|
||||
templates = lib.mkOption { type = lib.types.raw; };
|
||||
|
||||
machines = lib.mkOption { type = lib.types.raw; };
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
262
lib/modules/clan/module.nix
Normal file
262
lib/modules/clan/module.nix
Normal file
@@ -0,0 +1,262 @@
|
||||
{
|
||||
config,
|
||||
clan-core,
|
||||
nixpkgs,
|
||||
nix-darwin,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
flip
|
||||
mapAttrs'
|
||||
;
|
||||
|
||||
inherit (config)
|
||||
directory
|
||||
inventory
|
||||
pkgsForSystem
|
||||
specialArgs
|
||||
;
|
||||
|
||||
inherit (clan-core.clanLib.inventory) buildInventory;
|
||||
|
||||
supportedSystems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
"riscv64-linux"
|
||||
"x86_64-darwin"
|
||||
"aarch64-darwin"
|
||||
];
|
||||
|
||||
/*
|
||||
An attrset with nixpkgs instantiated for each platform.
|
||||
This is important, as:
|
||||
1. We don't want to call `pkgsForSystem system` multiple times
|
||||
2. We need to fall back to `nixpkgs.legacyPackages.${system}` in case pkgsForSystem returns null
|
||||
*/
|
||||
pkgsFor = lib.genAttrs supportedSystems (
|
||||
system:
|
||||
let
|
||||
pkgs = pkgsForSystem system;
|
||||
in
|
||||
if pkgs != null then pkgs else nixpkgs.legacyPackages.${system}
|
||||
);
|
||||
|
||||
# map from machine name to service configuration
|
||||
# { ${machineName} :: Config }
|
||||
inventoryClass = (
|
||||
buildInventory {
|
||||
inherit inventory directory;
|
||||
flakeInputs = config.self.inputs;
|
||||
prefix = config._prefix ++ [ "inventoryClass" ];
|
||||
# TODO: remove inventory.modules, this is here for backwards compatibility
|
||||
localModuleSet =
|
||||
lib.filterAttrs (n: _: !inventory._legacyModules ? ${n}) inventory.modules // config.modules;
|
||||
}
|
||||
);
|
||||
|
||||
moduleSystemConstructor = {
|
||||
# TODO: remove default system once we have a hardware-config mechanism
|
||||
nixos = nixpkgs.lib.nixosSystem;
|
||||
darwin = nix-darwin.lib.darwinSystem;
|
||||
};
|
||||
|
||||
allMachines = inventoryClass.machines; # <- inventory.machines <- clan.machines
|
||||
|
||||
machineClasses = lib.mapAttrs (
|
||||
name: _: inventory.machines.${name}.machineClass or "nixos"
|
||||
) allMachines;
|
||||
|
||||
configurations = lib.mapAttrs (
|
||||
name: _:
|
||||
moduleSystemConstructor.${machineClasses.${name}} {
|
||||
# ATTENTION!: Dont add any modules here.
|
||||
# Add them to 'outputs.moduleForMachine.${name}' instead.
|
||||
modules = [ (config.outputs.moduleForMachine.${name} or { }) ];
|
||||
specialArgs = {
|
||||
inherit clan-core;
|
||||
} // specialArgs;
|
||||
}
|
||||
) allMachines;
|
||||
|
||||
# Expose reusable modules these can be imported or wrapped or instantiated
|
||||
# - by the user
|
||||
# - by some test frameworks
|
||||
# IMPORTANT!: It is utterly important that we don't add any logic outside of these modules, as it would get tested.
|
||||
nixosModules' = lib.filterAttrs (
|
||||
name: _: inventory.machines.${name}.machineClass or "nixos" == "nixos"
|
||||
) (config.outputs.moduleForMachine);
|
||||
darwinModules' = lib.filterAttrs (
|
||||
name: _: inventory.machines.${name}.machineClass or "nixos" == "darwin"
|
||||
) (config.outputs.moduleForMachine);
|
||||
|
||||
nixosModules = flip mapAttrs' nixosModules' (
|
||||
name: machineModule: {
|
||||
name = "clan-machine-${name}";
|
||||
value = machineModule;
|
||||
}
|
||||
);
|
||||
|
||||
darwinModules = flip mapAttrs' darwinModules' (
|
||||
name: machineModule: {
|
||||
name = "clan-machine-${name}";
|
||||
value = machineModule;
|
||||
}
|
||||
);
|
||||
|
||||
nixosConfigurations = lib.filterAttrs (name: _: machineClasses.${name} == "nixos") configurations;
|
||||
darwinConfigurations = lib.filterAttrs (name: _: machineClasses.${name} == "darwin") configurations;
|
||||
|
||||
# This instantiates NixOS for each system that we support:
|
||||
# configPerSystem = <system>.<machine>.nixosConfiguration
|
||||
# We need this to build nixos secret generators for each system
|
||||
configsPerSystem = builtins.listToAttrs (
|
||||
builtins.map (
|
||||
system:
|
||||
lib.nameValuePair system (
|
||||
lib.mapAttrs (
|
||||
name: _:
|
||||
moduleSystemConstructor.${machineClasses.${name}} {
|
||||
modules = [
|
||||
(config.outputs.moduleForMachine.${name} or { })
|
||||
(lib.modules.importApply ../machineModules/overridePkgs.nix {
|
||||
pkgs = pkgsFor.${system};
|
||||
})
|
||||
];
|
||||
specialArgs = {
|
||||
inherit clan-core;
|
||||
} // specialArgs;
|
||||
}
|
||||
) allMachines
|
||||
)
|
||||
) supportedSystems
|
||||
);
|
||||
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
(
|
||||
{ ... }:
|
||||
let
|
||||
file = "${directory}/inventory.json";
|
||||
|
||||
inventoryLoaded =
|
||||
if builtins.pathExists file then (builtins.fromJSON (builtins.readFile file)) else { };
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
{
|
||||
inventory._inventoryFile = file;
|
||||
}
|
||||
];
|
||||
# Weirdly this works only if it is a function
|
||||
# This seems to be a bug in nixpkgs
|
||||
inventory = _: lib.setDefaultModuleLocation file inventoryLoaded;
|
||||
}
|
||||
)
|
||||
{
|
||||
# TODO: Figure out why this causes infinite recursion
|
||||
inventory.machines = lib.optionalAttrs (builtins.pathExists "${directory}/machines") (
|
||||
builtins.mapAttrs (_n: _v: { }) (
|
||||
lib.filterAttrs (_: t: t == "directory") (builtins.readDir "${directory}/machines")
|
||||
)
|
||||
);
|
||||
}
|
||||
{
|
||||
inventory.machines = lib.mapAttrs (_n: _: { }) config.machines;
|
||||
}
|
||||
# config.inventory.meta <- config.meta
|
||||
# Set default for computed tags
|
||||
./computed-tags.nix
|
||||
];
|
||||
|
||||
options.outputs.moduleForMachine = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.deferredModule;
|
||||
};
|
||||
|
||||
config = {
|
||||
inventory.modules = clan-core.clanModules;
|
||||
inventory._legacyModules = clan-core.clanModules;
|
||||
# Merge the meta attributes from the buildClan function
|
||||
inventory.meta = config.meta;
|
||||
|
||||
outputs.moduleForMachine = lib.mkMerge [
|
||||
# Create some modules for each machine
|
||||
# These can depend on the 'name' and
|
||||
# everything that can be derived from the machine 'name'
|
||||
# i.e. by looking up the corresponding information in the 'inventory' or 'clan' submodule
|
||||
(lib.mapAttrs (
|
||||
name: v:
|
||||
(
|
||||
{ ... }@args:
|
||||
let
|
||||
_class =
|
||||
args._class or (throw ''
|
||||
Your version of nixpkgs is incompatible with the latest clan.
|
||||
Please update nixpkgs input to the latest nixos-unstable or nixpkgs-unstable.
|
||||
Run:
|
||||
nix flake update nixpkgs
|
||||
'');
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
(lib.modules.importApply ../machineModules/forName.nix {
|
||||
inherit (config.inventory) meta;
|
||||
inherit
|
||||
name
|
||||
directory
|
||||
;
|
||||
})
|
||||
# Import the correct 'core' module
|
||||
# We assume either:
|
||||
# - nixosModules (_class = nixos)
|
||||
# - darwinModules (_class = darwin)
|
||||
(lib.optionalAttrs (clan-core ? "${_class}Modules") clan-core."${_class}Modules".clanCore)
|
||||
] ++ lib.optionals (_class == "nixos") (v.machineImports or [ ]);
|
||||
|
||||
# default hostname
|
||||
networking.hostName = lib.mkDefault name;
|
||||
}
|
||||
)
|
||||
) inventoryClass.machines)
|
||||
|
||||
# The user can define some machine config here
|
||||
# i.e. 'clan.machines.jon = ...'
|
||||
config.machines
|
||||
];
|
||||
|
||||
specialArgs = {
|
||||
self = lib.mkDefault config.self;
|
||||
};
|
||||
|
||||
# expose all machines as modules for re-use
|
||||
inherit nixosModules;
|
||||
inherit darwinModules;
|
||||
|
||||
# Ready to use configurations
|
||||
# These are only shallow wrapping the 'nixosModules' or 'darwinModules' with
|
||||
# lib.nixosSystem
|
||||
inherit nixosConfigurations;
|
||||
inherit darwinConfigurations;
|
||||
|
||||
clanInternals = {
|
||||
inherit inventoryClass;
|
||||
# TODO: remove this after a month or so
|
||||
# This is here for backwards compatibility for older CLI versions
|
||||
inventory = config.inventory;
|
||||
|
||||
# TODO: unify this interface
|
||||
# We should have only clan.modules. (consistent with clan.templates)
|
||||
inherit (clan-core) clanModules;
|
||||
|
||||
# Statically export the predefined clan modules
|
||||
templates = clan-core.clan.templates;
|
||||
|
||||
secrets = config.secrets;
|
||||
|
||||
# machine specifics
|
||||
machines = configsPerSystem;
|
||||
};
|
||||
};
|
||||
}
|
||||
18
lib/modules/clan/secrets.nix
Normal file
18
lib/modules/clan/secrets.nix
Normal file
@@ -0,0 +1,18 @@
|
||||
{
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) types;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
age.plugins = lib.mkOption {
|
||||
type = types.listOf (types.strMatching "age-plugin-.*");
|
||||
default = [ ];
|
||||
description = ''
|
||||
A list of age plugins which must be available in the shell when encrypting and decrypting secrets.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
57
lib/modules/clan/templates.nix
Normal file
57
lib/modules/clan/templates.nix
Normal file
@@ -0,0 +1,57 @@
|
||||
{
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) types;
|
||||
|
||||
templateType = types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options.description = lib.mkOption {
|
||||
type = types.str;
|
||||
default = name;
|
||||
description = ''
|
||||
The name of the template.
|
||||
'';
|
||||
};
|
||||
|
||||
options.path = lib.mkOption {
|
||||
type = types.path;
|
||||
description = ''
|
||||
Holds the path to the clan template.
|
||||
'';
|
||||
};
|
||||
}
|
||||
);
|
||||
in
|
||||
{
|
||||
options = {
|
||||
# clan.templates.clan
|
||||
clan = lib.mkOption {
|
||||
type = types.attrsOf templateType;
|
||||
default = { };
|
||||
description = ''
|
||||
Holds the different clan templates.
|
||||
'';
|
||||
};
|
||||
|
||||
# clan.templates.disko
|
||||
disko = lib.mkOption {
|
||||
type = types.attrsOf templateType;
|
||||
default = { };
|
||||
description = ''
|
||||
Holds different disko templates.
|
||||
'';
|
||||
};
|
||||
|
||||
# clan.templates.machine
|
||||
machine = lib.mkOption {
|
||||
type = types.attrsOf templateType;
|
||||
default = { };
|
||||
description = ''
|
||||
Holds the different machine templates.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user