This repository has no description
2.7 kB
77 lines
1{
2 config,
3 lib,
4 options,
5 self,
6 ...
7}:
8# Client of the neoprism build farm (configs/nix-farm), for NixOS and
9# nix-darwin. The plugin finds client.crt/client.key in
10# /var/lib/nix-grpc-store by itself; the CA has to be passed explicitly:
11# nix build --store 'grpc://neoprism.r:50051?ca-cert=/var/lib/nix-grpc-store/ca.crt' \
12# --eval-store auto .#nixosConfigurations.<m>.config.system.build.toplevel
13let
14 files = [
15 "ca.crt"
16 "client.crt"
17 "client.key"
18 ];
19 client = config.clan.core.vars.generators.nix-farm-client.files;
20in
21{
22 imports = [
23 # darwinModules.default is only the daemon; the grpc:// plugin is in the
24 # client module, which only sets nix.settings.plugin-files and works on
25 # nix-darwin as is.
26 "${self.inputs.nix-grpc-store}/nixos/client.nix"
27 ./ca.nix
28 ];
29
30 config = lib.mkMerge [
31 { programs.nix-grpc-store.enable = true; }
32
33 # Per-machine copy of the shared CA's client files (see ca.nix).
34 {
35 clan.core.vars.generators.nix-farm-client = {
36 dependencies = [ "nix-farm-ca" ];
37 files = lib.genAttrs files (_: { });
38 script = lib.concatMapStrings (f: ''
39 cp "$in/nix-farm-ca/${f}" "$out/${f}"
40 '') files;
41 };
42 }
43
44 # Branch on options, not pkgs: the latter recurses through the attr names.
45 (lib.optionalAttrs (options ? system.primaryUser) {
46 # clan's /run/secrets installer is Linux-only, so these come in as
47 # activation secrets (root-owned, below secretLocation) and are copied
48 # to where the plugin looks by default, readable by the user running nix.
49 clan.core.vars.generators.nix-farm-client.files = lib.genAttrs files (_: {
50 deploy = true;
51 neededFor = "activation";
52 });
53 # Skipped while the secrets have not been uploaded yet.
54 system.activationScripts.postActivation.text = ''
55 install -d -m 0755 /var/lib/nix-grpc-store
56 ''
57 + lib.concatMapStrings (f: ''
58 if [ -e ${client.${f}.path} ]; then
59 install -m 0400 -o ${config.system.primaryUser} ${client.${f}.path} /var/lib/nix-grpc-store/${f}
60 fi
61 '') files;
62 })
63
64 (lib.optionalAttrs (options ? systemd.tmpfiles) {
65 # Regular /run/secrets, readable by wheel (the users running nix) and
66 # root (nix-daemon's build hook), linked to where the plugin looks.
67 clan.core.vars.generators.nix-farm-client.files = lib.genAttrs files (_: {
68 deploy = true;
69 group = "wheel";
70 mode = "0440";
71 });
72 systemd.tmpfiles.rules = map (
73 f: "L+ /var/lib/nix-grpc-store/${f} - - - - ${client.${f}.path}"
74 ) files;
75 })
76 ];
77}