confctl 2.2.2 → 3.0.0

data/nix/flake/mk-confctl-outputs.nix

@@ -0,0 +1,522 @@
+{
+  confDir,
+  inputs,
+  channels ? { },
+  system ? null,
+}:
+let
+  resolvedSystem =
+    if system != null then
+      system
+    else if builtins ? currentSystem then
+      builtins.currentSystem
+    else
+      "x86_64-linux";
+
+  confctlSrc = inputs.confctl;
+
+  coreNixpkgs = inputs.nixpkgs;
+  corePkgs = import coreNixpkgs { system = resolvedSystem; };
+  coreLib = corePkgs.lib;
+
+  flakeInputs = coreLib.filterAttrs (n: _: n != "self") inputs;
+
+  configurationSource = inputs.self or null;
+  configurationRevision =
+    if configurationSource == null then
+      null
+    else if configurationSource ? rev then
+      configurationSource.rev
+    else if configurationSource ? dirtyRev then
+      coreLib.removeSuffix "-dirty" configurationSource.dirtyRev
+    else
+      null;
+  configurationInfo =
+    if configurationRevision != null && builtins.match "[0-9a-f]{40}" configurationRevision != null then
+      {
+        schemaVersion = 1;
+        revision = configurationRevision;
+        revisionDirty = !(configurationSource ? rev) && configurationSource ? dirtyRev;
+      }
+    else
+      null;
+
+  confLib = import (confctlSrc + "/nix/lib") {
+    inherit confDir;
+    coreLib = coreLib;
+    corePkgs = corePkgs;
+  };
+
+  userClusterModules = confDir + "/modules/cluster/default.nix";
+
+  clusterModules = [
+    (
+      { ... }:
+      {
+        _module.args = {
+          pkgs = corePkgs;
+          inherit confLib flakeInputs;
+          confMachine = null;
+        };
+      }
+    )
+    (confctlSrc + "/nix/modules/cluster")
+  ]
+  ++ (import (confDir + "/cluster/module-list.nix"))
+  ++ (coreLib.optional (builtins.pathExists userClusterModules) userClusterModules);
+
+  evalCluster = coreLib.evalModules {
+    modules = clusterModules;
+  };
+
+  cluster = evalCluster.config.cluster;
+
+  clusterModulesForSystem = [
+    (confctlSrc + "/nix/modules/cluster")
+  ]
+  ++ (import (confDir + "/cluster/module-list.nix"));
+
+  makeMachine =
+    {
+      name,
+      metaConfig,
+      carrier ? null,
+      alias ? null,
+      clusterName ? null,
+      extraModules ? [ ],
+    }:
+    let
+      ensuredClusterName = if clusterName == null then name else clusterName;
+    in
+    {
+      inherit
+        name
+        alias
+        metaConfig
+        carrier
+        extraModules
+        ;
+      clusterName = ensuredClusterName;
+    };
+
+  generationUpdates =
+    cm:
+    coreLib.flatten (
+      map
+        (
+          generations:
+          map
+            (attr: {
+              path = [
+                generations
+                attr
+              ];
+              update =
+                old:
+                let
+                  v = cm.${generations}.${attr};
+                in
+                if v == null then old else v;
+            })
+            [
+              "min"
+              "max"
+              "maxAge"
+            ]
+        )
+        [
+          "buildGenerations"
+          "hostGenerations"
+        ]
+    );
+
+  expandCarrier =
+    machineAttrs: carrierMachine:
+    map (
+      cm:
+      makeMachine {
+        name = "${carrierMachine.name}#${if cm.alias == null then cm.machine else cm.alias}";
+        alias = cm.alias;
+        clusterName = cm.machine;
+        carrier = carrierMachine.name;
+        extraModules = cm.extraModules;
+        metaConfig = coreLib.updateManyAttrsByPath (
+          [
+            {
+              path = [ "labels" ];
+              update = old: old // cm.labels;
+            }
+            {
+              path = [ "tags" ];
+              update = old: old ++ cm.tags;
+            }
+            {
+              path = [ "buildAttribute" ];
+              update = _: cm.buildAttribute;
+            }
+          ]
+          ++ (generationUpdates cm)
+        ) machineAttrs.${cm.machine}.metaConfig;
+      }
+    ) carrierMachine.metaConfig.carrier.machines;
+
+  expandCarriers =
+    machineAttrs:
+    coreLib.flatten (
+      coreLib.mapAttrsToList (
+        name: m: if m.metaConfig.carrier.enable then [ m ] ++ (expandCarrier machineAttrs m) else m
+      ) machineAttrs
+    );
+
+  getClusterMachines =
+    cluster:
+    let
+      machineAttrs = coreLib.mapAttrs (
+        name: metaConfig: makeMachine { inherit name metaConfig; }
+      ) cluster;
+    in
+    expandCarriers machineAttrs;
+
+  mkMachineKey =
+    name:
+    let
+      sanitized =
+        let
+          chars =
+            if builtins ? stringToCharacters then
+              builtins.stringToCharacters name
+            else
+              coreLib.stringToCharacters name;
+          safeChar =
+            c:
+            if (c >= "a" && c <= "z") || (c >= "A" && c <= "Z") || (c >= "0" && c <= "9") || (c == "_") then
+              c
+            else
+              "_";
+          s = builtins.concatStringsSep "" (map safeChar chars);
+        in
+        if builtins.match "^[0-9].*" s != null then "_" + s else s;
+
+      hash = builtins.substring 0 8 (builtins.hashString "sha256" name);
+    in
+    "m_" + sanitized + "_" + hash;
+
+  machines = getClusterMachines cluster;
+
+  machinesWithKey = map (m: m // { key = mkMachineKey m.name; }) machines;
+
+  machineNames = map (m: m.name) machinesWithKey;
+
+  machineKeys = builtins.listToAttrs (
+    map (m: {
+      name = m.name;
+      value = m.key;
+    }) machinesWithKey
+  );
+
+  machinesAttrs = builtins.listToAttrs (
+    map (m: {
+      name = m.name;
+      value = m // {
+        key = m.key;
+        flakeKey = m.key;
+      };
+    }) machinesWithKey
+  );
+
+  machinesByKey = builtins.listToAttrs (
+    map (m: {
+      name = m.key;
+      value = m;
+    }) machinesWithKey
+  );
+
+  lock = builtins.fromJSON (builtins.readFile (confDir + "/flake.lock"));
+
+  derivedUrlForNode =
+    node:
+    let
+      original = node.original or { };
+    in
+    if (original.type or null) == "github" then
+      "https://github.com/${original.owner}/${original.repo}"
+    else if original ? url then
+      let
+        raw = original.url;
+      in
+      if coreLib.hasPrefix "git+" raw then coreLib.removePrefix "git+" raw else raw
+    else
+      null;
+
+  roleInputsForChannels =
+    channelNames: builtins.foldl' (acc: chan: acc // (channels.${chan} or { })) { } channelNames;
+
+  inputPathsFor = roleInputs: coreLib.mapAttrs (_: inputName: inputs.${inputName}.outPath) roleInputs;
+
+  mkRoleInfo =
+    inputName:
+    let
+      node = lock.nodes.${inputName} or { };
+      src = node.locked or { };
+      rev = src.rev or null;
+    in
+    {
+      input = inputName;
+      url = derivedUrlForNode node;
+      inherit rev;
+      shortRev = if rev == null then null else builtins.substring 0 8 rev;
+      lastModified = src.lastModified or null;
+    };
+
+  inputsInfoFor = roleInputs: coreLib.mapAttrs (_: inputName: mkRoleInfo inputName) roleInputs;
+  buildPlan = builtins.listToAttrs (
+    map (
+      m:
+      let
+        channelNames = (m.metaConfig.inputs.channels or [ ]);
+        inputsOverrides = (m.metaConfig.inputs or { }).overrides or { };
+
+        roleInputs = (roleInputsForChannels channelNames) // inputsOverrides;
+        inputPaths = inputPathsFor roleInputs;
+        inputsInfo = inputsInfoFor roleInputs;
+      in
+      {
+        name = m.name;
+        value = {
+          key = m.key;
+          flakeKey = m.key;
+          inputs = inputPaths;
+          inputsInfo = inputsInfo;
+        };
+      }
+    ) machinesWithKey
+  );
+
+  inputsOutput = builtins.listToAttrs (
+    map (m: {
+      name = m.key;
+      value = buildPlan.${m.name}.inputs;
+    }) machinesWithKey
+  );
+
+  inputsInfoOutput = builtins.listToAttrs (
+    map (m: {
+      name = m.key;
+      value = buildPlan.${m.name}.inputsInfo;
+    }) machinesWithKey
+  );
+
+  confctlModules = [
+    (confctlSrc + "/nix/modules/confctl/generations.nix")
+    (confctlSrc + "/nix/modules/confctl/cli.nix")
+    (confctlSrc + "/nix/modules/confctl/nix.nix")
+    (confctlSrc + "/nix/modules/confctl/inputs-info.nix")
+    (confctlSrc + "/nix/modules/confctl/configuration-info.nix")
+  ];
+
+  confctlConfig = confDir + "/configs/confctl.nix";
+  userModuleListPath = confDir + "/modules/module-list.nix";
+  userModuleList =
+    if builtins.pathExists userModuleListPath then
+      import userModuleListPath
+    else
+      {
+        nixos = [ ];
+        vpsadminos = [ ];
+      };
+
+  evalConfctl = import (coreNixpkgs + "/nixos/lib/eval-config.nix") {
+    modules = confctlModules ++ (coreLib.optional (builtins.pathExists confctlConfig) confctlConfig);
+    pkgs = corePkgs;
+    lib = coreLib;
+    system = resolvedSystem;
+  };
+
+  settings = evalConfctl.config.confctl;
+  confData = import (confDir + "/data/default.nix") { lib = coreLib; };
+
+  baseSystemModule =
+    { ... }:
+    {
+      _module.args = {
+        inherit
+          confDir
+          confLib
+          configurationInfo
+          flakeInputs
+          ;
+        inherit confData;
+      };
+    };
+
+  confMachineFor =
+    m:
+    (confLib.findMetaConfig {
+      inherit cluster;
+      name = m.clusterName;
+    })
+    // {
+      name = m.clusterName;
+    };
+
+  machineArgsModule =
+    m:
+    { ... }:
+    let
+      plan = buildPlan.${m.name};
+    in
+    {
+      _module.args = {
+        inputs = plan.inputs;
+        inputsInfo = plan.inputsInfo;
+        confMachine = confMachineFor m;
+      };
+    };
+
+  specialArgsFor =
+    m:
+    let
+      plan = buildPlan.${m.name};
+    in
+    {
+      inherit
+        confDir
+        confLib
+        configurationInfo
+        flakeInputs
+        confData
+        ;
+      confMachine = confMachineFor m;
+      inputs = plan.inputs;
+      inputsInfo = plan.inputsInfo;
+    };
+
+  systemModulesFor =
+    m:
+    let
+      userModules = userModuleList.${m.metaConfig.spin} or [ ];
+      systemModules = (import (confctlSrc + "/nix/modules/system-list.nix")).${m.metaConfig.spin} or [ ];
+      moduleArgsModules =
+        if m.metaConfig.spin == "vpsadminos" then
+          [ ]
+        else
+          [
+            baseSystemModule
+            (machineArgsModule m)
+          ];
+    in
+    moduleArgsModules
+    ++ clusterModulesForSystem
+    ++ [
+      (confDir + "/cluster/${m.clusterName}/config.nix")
+    ]
+    ++ confctlModules
+    ++ systemModules
+    ++ userModules
+    ++ m.extraModules;
+
+  autoRollbackFor =
+    pkgs:
+    let
+      args = {
+        src = confctlSrc + "/libexec/auto-rollback.rb";
+        isExecutable = true;
+      };
+
+      replacements = {
+        ruby = pkgs.ruby;
+      };
+    in
+    if pkgs ? replaceVarsWith then
+      pkgs.replaceVarsWith {
+        inherit (args) src isExecutable;
+        inherit replacements;
+      }
+    else
+      pkgs.substituteAll ({ inherit (args) src isExecutable; } // replacements);
+
+  evalConfigFor =
+    m:
+    let
+      plan = buildPlan.${m.name};
+      nixpkgsInput = inputs.${plan.inputsInfo.nixpkgs.input};
+      modules = systemModulesFor m;
+      specialArgs = specialArgsFor m;
+    in
+    if m.metaConfig.spin == "nixos" then
+      let
+        evalConfig = nixpkgsInput.lib.nixosSystem {
+          inherit modules specialArgs;
+          system = resolvedSystem;
+        };
+      in
+      {
+        inherit evalConfig;
+        pkgs = evalConfig.pkgs;
+      }
+    else if m.metaConfig.spin == "vpsadminos" then
+      let
+        vpsadminosInput = inputs.${plan.inputsInfo.vpsadminos.input};
+        evalResult = vpsadminosInput.lib.vpsadminosSystem {
+          pkgs = nixpkgsInput.legacyPackages.${resolvedSystem};
+          inherit modules specialArgs;
+          system = resolvedSystem;
+        };
+        evalConfig = evalResult.eval;
+      in
+      {
+        evalConfig = evalConfig;
+        pkgs = evalResult.pkgs;
+      }
+    else
+      abort "Unsupported spin ${m.metaConfig.spin}";
+
+  buildOutputs = builtins.listToAttrs (
+    map (
+      m:
+      let
+        plan = buildPlan.${m.name};
+        evalResult = evalConfigFor m;
+        evalConfig = evalResult.evalConfig;
+        pkgs = evalResult.pkgs;
+        buildAttrPath =
+          m.metaConfig.buildAttribute or [
+            "system"
+            "build"
+            "toplevel"
+          ];
+        buildAttr = coreLib.attrByPath buildAttrPath null evalConfig.config;
+        buildValue =
+          if buildAttr == null then
+            abort "Attribute 'config.${coreLib.concatStringsSep "." buildAttrPath}' not found on machine ${m.name}"
+          else
+            buildAttr;
+      in
+      {
+        name = plan.key;
+        value = {
+          toplevel = buildValue;
+          autoRollback = autoRollbackFor pkgs;
+        };
+      }
+    ) machinesWithKey
+  );
+
+  toplevelOutput = coreLib.mapAttrs (_: v: v.toplevel) buildOutputs;
+in
+{
+  settings = settings;
+  channels = channels;
+  machineNames = machineNames;
+  machineKeys = machineKeys;
+  machines = machinesAttrs;
+  machinesJson = corePkgs.writeText "machine-list.json" (builtins.toJSON machinesAttrs);
+  buildPlan = buildPlan;
+  inputs = inputsOutput;
+  inputsInfo = inputsInfoOutput;
+  build = buildOutputs;
+  toplevel = toplevelOutput;
+  lib = {
+    mkMachineKey = mkMachineKey;
+  };
+}

data/nix/flake/mk-config-devshell.nix

@@ -0,0 +1,168 @@
+{ self, nixpkgs }:
+
+# mkConfigDevShell builds a dev shell intended for cluster configuration repos
+# that use confctl as a flake input.
+#
+# Modes:
+# - minimal: confctl comes from the flake package, no Bundler bootstrap
+# - tools: repo-local Bundler environment for repo tooling, confctl stays packaged
+# - bundled-confctl: repo-local Bundler environment and confctl runs via bundle exec
+
+{
+  system,
+  pkgs ? nixpkgs.legacyPackages.${system},
+  mode ? "minimal",
+  extraPackages ? [ ],
+  legacyCompat ? false,
+}:
+let
+  lib = pkgs.lib;
+  confctlPackage = self.packages.${system}.confctl;
+  bundlerMode = builtins.elem mode [
+    "tools"
+    "bundled-confctl"
+  ];
+
+  fail = message: ''
+    echo ${lib.escapeShellArg message} >&2
+    return 1 2>/dev/null || exit 1
+  '';
+
+  bundlerBootstrap = ''
+    export GEM_ROOT="$PWD/.gems"
+    export GEM_HOME="$GEM_ROOT/ruby/$(ruby -e 'require "rbconfig"; print RbConfig::CONFIG["ruby_version"]')"
+    export GEM_PATH="$GEM_HOME"
+    export BUNDLE_PATH="$GEM_ROOT"
+    export BUNDLE_APP_CONFIG="''${BUNDLE_APP_CONFIG:-$PWD/.bundle}"
+    export RUBOCOP_CACHE_ROOT="$PWD/.rubocop_cache"
+
+    mkdir -p "$GEM_ROOT" "$GEM_HOME" "$PWD/.bin"
+    rm -f "$PWD/.bin/bundle" "$PWD/.bin/bundler"
+
+    bundler_version=""
+    if [ -f "$PWD/Gemfile.lock" ]; then
+      bundler_version="$(awk '/^BUNDLED WITH$/{getline; sub(/^[[:space:]]+/, "", $0); print; exit}' "$PWD/Gemfile.lock")"
+    fi
+
+    if [ -n "$bundler_version" ]; then
+      export BUNDLER_VERSION="$bundler_version"
+      if [ ! -x "$GEM_HOME/bin/bundle" ] \
+         || ! gem list -i bundler -v "$bundler_version" >/dev/null 2>&1; then
+        gem install --no-document bundler -v "$bundler_version" >/dev/null
+      fi
+    elif [ ! -x "$GEM_HOME/bin/bundle" ]; then
+      gem install --no-document bundler >/dev/null
+    fi
+    bundle_bin="$GEM_HOME/bin/bundle"
+
+    "$bundle_bin" config set --local path "$BUNDLE_PATH" >/dev/null
+    "$bundle_bin" config set --local bin "$PWD/.bin" >/dev/null
+  '';
+
+  modeShellHook =
+    if mode == "minimal" then
+      ''
+        export PATH="${confctlPackage}/bin:$PATH"
+      ''
+    else if mode == "tools" then
+      ''
+        if [ ! -f "$PWD/Gemfile" ]; then
+          ${fail "mkConfigDevShell mode 'tools' requires ./Gemfile"}
+        fi
+
+        ${bundlerBootstrap}
+
+        export PATH="${confctlPackage}/bin:$PWD/.bin:$GEM_HOME/bin:$PATH"
+
+        NIX_ENFORCE_PURITY=0 "$bundle_bin" install >/dev/null
+
+        if "$bundle_bin" info rubocop >/dev/null 2>&1; then
+          "$bundle_bin" binstubs rubocop --force >/dev/null
+        fi
+      ''
+    else
+      ''
+        if [ ! -f "$PWD/Gemfile" ]; then
+          ${
+            if legacyCompat then
+              ''
+                  mkdir -p "$PWD/.confctl-shell"
+
+                  cat > "$PWD/.confctl-shell/Gemfile" <<EOF
+                source "https://rubygems.org"
+                gem "confctl", path: "$CONFCTL_SRC"
+                EOF
+
+                  export BUNDLE_GEMFILE="$PWD/.confctl-shell/Gemfile"
+                  export BUNDLE_APP_CONFIG="$PWD/.confctl-shell/.bundle"
+                  mkdir -p "$BUNDLE_APP_CONFIG"
+              ''
+            else
+              fail "mkConfigDevShell mode 'bundled-confctl' requires ./Gemfile containing `gem \"confctl\"`"
+          }
+        fi
+
+        ${bundlerBootstrap}
+
+        export PATH="$PWD/.bin:$GEM_HOME/bin:${confctlPackage}/bin:$PATH"
+
+        "$bundle_bin" config set --local "local.confctl" "$CONFCTL_SRC" >/dev/null
+
+        NIX_ENFORCE_PURITY=0 "$bundle_bin" install >/dev/null
+
+        if ! "$bundle_bin" info confctl >/dev/null 2>&1; then
+          ${fail "mkConfigDevShell mode 'bundled-confctl' requires ./Gemfile to include `gem \"confctl\"`"}
+        fi
+
+        if "$bundle_bin" info rubocop >/dev/null 2>&1; then
+          "$bundle_bin" binstubs rubocop --force >/dev/null
+        fi
+
+        cat > "$PWD/.bin/confctl" <<'EOF'
+        #!/usr/bin/env bash
+        bundle_bin="$GEM_HOME/bin/bundle"
+        exec "$bundle_bin" exec confctl "$@"
+        EOF
+
+        chmod +x "$PWD/.bin/confctl"
+      '';
+in
+assert builtins.elem mode [
+  "minimal"
+  "tools"
+  "bundled-confctl"
+];
+pkgs.mkShell {
+  packages =
+    (with pkgs; [
+      confctlPackage
+      git
+      ncurses
+      man-db
+      groff
+      less
+      nix-prefetch-git
+      nixfmt
+      nixfmt-tree
+    ])
+    ++ lib.optionals bundlerMode (
+      with pkgs;
+      [
+        openssl
+        ruby
+      ]
+    )
+    ++ extraPackages;
+
+  shellHook = ''
+    export CONFCTL_SRC="${self.outPath}"
+
+    ${modeShellHook}
+
+    export MANPATH="$CONFCTL_SRC/man:$(man --path)"
+    export PS1="(confctl) $PS1"
+
+    echo
+    echo "confctl config dev shell ready (${mode})"
+  '';
+}