confctl 2.2.2 → 3.0.0

data/nix/modules/confctl/carrier/netboot/nixos.nix

@@ -1,7 +1,21 @@
-{ config, lib, pkgs, confMachine, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  confMachine,
+  ...
+}:
 let
-  inherit (lib) concatStringsSep flip mkOption mkEnableOption mkIf
-                optional optionalString types;
+  inherit (lib)
+    concatStringsSep
+    flip
+    mkOption
+    mkEnableOption
+    mkIf
+    optional
+    optionalString
+    types
+    ;
 
   concatNl = concatStringsSep "\n";
 
@@ -46,13 +60,16 @@ let
     httpUrl = "http://${cfg.host}";
     memtest =
       if cfg.memtest86.enable then
-        { package = pkgs.memtest86plus; params = cfg.memtest86.params; }
+        {
+          package = pkgs.memtest86plus;
+          params = cfg.memtest86.params;
+        }
       else
         null;
     isoImages = cfg.isoImages;
   };
 
-  builder = pkgs.confReplaceVarsWith {
+  builder = pkgs.replaceVarsWith {
     src = ./build-netboot-server.rb;
     name = "build-netboot-server";
     dir = "bin";
@@ -62,7 +79,8 @@ let
       jsonConfig = pkgs.writeText "netboot-server.json" builderConfig;
     };
   };
-in {
+in
+{
   options = {
     confctl.carrier.netboot = {
       enable = mkEnableOption ''
@@ -89,7 +107,7 @@ in {
 
         params = mkOption {
           type = types.listOf types.str;
-          default = [];
+          default = [ ];
           example = [ "console=ttyS0,115200" ];
           description = "See {option}`boot.loader.grub.memtest86.params`";
         };
@@ -97,7 +115,7 @@ in {
 
       isoImages = mkOption {
         type = types.listOf (types.submodule isoImage);
-        default = [];
+        default = [ ];
         description = "A list of ISO images to be included in boot menu";
       };
 
@@ -107,7 +125,7 @@ in {
           Allow HTTP access for these IP ranges, if not specified
           access is not restricted.
         '';
-        default = [];
+        default = [ ];
         example = "10.0.0.0/24";
       };
 
@@ -135,13 +153,21 @@ in {
     environment.systemPackages = [ builder ];
 
     networking.firewall = {
-      extraCommands = mkIf (cfg.allowedIPv4Ranges != []) (concatNl (map (net: ''
-        # Allow access from ${net} for netboot
-        iptables -A nixos-fw -p udp -s ${net} ${optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"} --dport 68 -j nixos-fw-accept
-        iptables -A nixos-fw -p udp -s ${net} ${optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"} --dport 69 -j nixos-fw-accept
-        iptables -A nixos-fw -p tcp -s ${net} --dport 80 -j nixos-fw-accept
-        ${optionalString cfg.enableACME "iptables -A nixos-fw -p tcp -s ${net} --dport 443 -j nixos-fw-accept"}
-      '') cfg.allowedIPv4Ranges));
+      extraCommands = mkIf (cfg.allowedIPv4Ranges != [ ]) (
+        concatNl (
+          map (net: ''
+            # Allow access from ${net} for netboot
+            iptables -A nixos-fw -p udp -s ${net} ${
+              optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"
+            } --dport 68 -j nixos-fw-accept
+            iptables -A nixos-fw -p udp -s ${net} ${
+              optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"
+            } --dport 69 -j nixos-fw-accept
+            iptables -A nixos-fw -p tcp -s ${net} --dport 80 -j nixos-fw-accept
+            ${optionalString cfg.enableACME "iptables -A nixos-fw -p tcp -s ${net} --dport 443 -j nixos-fw-accept"}
+          '') cfg.allowedIPv4Ranges
+        )
+      );
     };
 
     systemd.services.netboot-atftpd = {
@@ -149,12 +175,18 @@ in {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       # runs as nobody
-      serviceConfig.ExecStart = toString ([
-        "${pkgs.atftp}/sbin/atftpd"
-        "--daemon"
-        "--no-fork"
-      ] ++ (optional (!isNull cfg.tftp.bindAddress) [ "--bind-address" cfg.tftp.bindAddress ])
-        ++ [ tftpRoot ]);
+      serviceConfig.ExecStart = toString (
+        [
+          "${pkgs.atftp}/sbin/atftpd"
+          "--daemon"
+          "--no-fork"
+        ]
+        ++ (optional (!isNull cfg.tftp.bindAddress) [
+          "--bind-address"
+          cfg.tftp.bindAddress
+        ])
+        ++ [ tftpRoot ]
+      );
     };
 
     services.nginx = {
@@ -173,7 +205,7 @@ in {
             "/" = {
               extraConfig = ''
                 autoindex on;
-                ${optionalString (cfg.allowedIPv4Ranges != []) ''
+                ${optionalString (cfg.allowedIPv4Ranges != [ ]) ''
                   ${concatNl (flip map cfg.allowedIPv4Ranges (range: "allow ${range};"))}
                   deny all;
                 ''}
@@ -184,4 +216,4 @@ in {
       };
     };
   };
-}
+}

data/nix/modules/confctl/configuration-info.nix

@@ -0,0 +1,17 @@
+{ lib, config, ... }:
+let
+  info = config._module.args.configurationInfo or null;
+  json = if info == null then null else builtins.toJSON info;
+in
+{
+  options.confctl.configurationInfo = lib.mkOption {
+    type = lib.types.nullOr lib.types.attrs;
+    default = info;
+    description = "Configuration source metadata written to /etc/confctl/configuration-info.json.";
+    readOnly = true;
+  };
+
+  config = lib.mkIf (json != null) {
+    environment.etc."confctl/configuration-info.json".text = json;
+  };
+}

data/nix/modules/confctl/generations.nix

@@ -26,7 +26,7 @@ with lib;
 
         maxAge = mkOption {
           type = types.int;
-          default = 180*24*60*60;
+          default = 180 * 24 * 60 * 60;
           description = ''
             Delete build generations older than
             <option>confctl.buildGenerations.maxAge</option> seconds. Old generations
@@ -61,7 +61,7 @@ with lib;
 
         maxAge = mkOption {
           type = types.int;
-          default = 180*24*60*60;
+          default = 180 * 24 * 60 * 60;
           description = ''
             Delete generations older than
             <option>confctl.hostGenerations.maxAge</option> seconds from

data/nix/modules/confctl/host.nix

@@ -0,0 +1,13 @@
+{ lib, confMachine, ... }:
+let
+  host = confMachine.host;
+in
+{
+  networking.hostName = lib.mkIf (host != null && host ? name && host.name != null) (
+    lib.mkDefault host.name
+  );
+
+  networking.domain = lib.mkIf (host != null && host ? fullDomain && host.fullDomain != null) (
+    lib.mkDefault host.fullDomain
+  );
+}

data/nix/modules/confctl/inputs-info.nix

@@ -0,0 +1,21 @@
+{ lib, config, ... }:
+let
+  # inputsInfo is provided by the config flake via specialArgs / _module.args
+  inputsInfo = config._module.args.inputsInfo or null;
+
+  info = inputsInfo;
+
+  json = if info == null then null else builtins.toJSON info;
+in
+{
+  options.confctl.inputsInfo = lib.mkOption {
+    type = lib.types.nullOr lib.types.attrs;
+    default = info;
+    description = "Flake input metadata written to /etc/confctl/inputs-info.json (provided via module args).";
+    readOnly = true;
+  };
+
+  config = lib.mkIf (json != null) {
+    environment.etc."confctl/inputs-info.json".text = json;
+  };
+}

data/nix/modules/confctl/kexec-netboot/default.nix

@@ -1,10 +1,16 @@
-{ config, lib, pkgs, confMachine, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  confMachine,
+  ...
+}:
 let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.confctl.programs.kexec-netboot;
 
-  kexecNetboot = pkgs.confReplaceVarsWith {
+  kexecNetboot = pkgs.replaceVarsWith {
     name = "kexec-netboot";
     src = ./kexec-netboot.rb;
     isExecutable = true;
@@ -15,7 +21,7 @@ let
     };
   };
 
-  kexecNetbootBin = pkgs.runCommand "kexec-netboot-bin" {} ''
+  kexecNetbootBin = pkgs.runCommand "kexec-netboot-bin" { } ''
     mkdir -p $out/bin
     ln -s ${kexecNetboot} $out/bin/kexec-netboot
 
@@ -25,8 +31,9 @@ let
       -D $out/share/man/man8 \
       ${./kexec-netboot.8.adoc}
   '';
-in {
-  options  = {
+in
+{
+  options = {
     confctl.programs.kexec-netboot = {
       enable = mkEnableOption "Enable kexec-netboot utility";
     };
@@ -35,4 +42,4 @@ in {
   config = mkIf cfg.enable {
     environment.systemPackages = [ kexecNetbootBin ];
   };
-}
+}

data/nix/modules/confctl/kexec-netboot/kexec-netboot.8.adoc

@@ -53,6 +53,9 @@ The following options are understood:
 *-e*, *--exec*::
   Run the currently loaded kernel.
 
+*-y*, *--no-sync*::
+  Skip syncing filesystems with *--exec*.
+
 == Bugs
 
 Report bugs to https://github.com/vpsfreecz/confctl/issues.

data/nix/modules/confctl/kexec-netboot/kexec-netboot.rb

@@ -20,6 +20,7 @@ class KexecNetboot
     @append_params = ''
     @exec          = false
     @unload        = false
+    @sync          = false
     @machines_json = nil
     @tmp_files     = []
   end
@@ -151,6 +152,10 @@ class KexecNetboot
       opts.on('-u', '--unload', 'Unload the current kexec target kernel and exit') do
         @unload = true
       end
+
+      opts.on('-y', '--no-sync', 'Skip syncing filesystems') do
+        @sync = false
+      end
     end
 
     opt_parser.parse!(ARGV)
@@ -374,18 +379,21 @@ class KexecNetboot
     uri = URI.parse(url)
     basename = File.basename(uri.path)
     tmp_file = Tempfile.new(basename)
+    tmp_file.binmode
 
     puts "Downloading #{url} -> #{tmp_file.path}"
 
     Net::HTTP.start(uri.host, uri.port) do |http|
-      resp = http.get(uri.request_uri)
+      http.request_get(uri.request_uri) do |resp|
+        unless resp.is_a?(Net::HTTPSuccess)
+          warn "ERROR: Could not download #{url}, HTTP #{resp.code}"
+          exit 1
+        end
 
-      unless resp.is_a?(Net::HTTPSuccess)
-        warn "ERROR: Could not download #{url}, HTTP #{resp.code}"
-        exit 1
+        resp.read_body do |chunk|
+          tmp_file.write(chunk)
+        end
       end
-
-      tmp_file.write(resp.body)
     end
 
     tmp_file.close
@@ -397,47 +405,48 @@ class KexecNetboot
   def load_kexec(kernel_path, initrd_path, kernel_params_string)
     cmd = [
       KEXEC,
-      '-l',
+      '--load',
       kernel_path,
       "--initrd=#{initrd_path}",
-      "--append=\"#{kernel_params_string}\""
+      "--append=\"#{kernel_params_string}\"",
+      '--no-sync'
     ].join(' ')
 
     puts "Executing: #{cmd}"
     system(cmd)
 
     if $?.exitstatus == 0
-      puts 'kexec -l completed successfully.'
+      puts 'kexec --load completed successfully.'
     else
-      warn 'ERROR: kexec -l failed!'
+      warn 'ERROR: kexec --load failed!'
       exit 1
     end
   end
 
   def exec_kexec
-    cmd = [KEXEC, '-e'].join(' ')
+    cmd = [KEXEC, '--exec', @sync ? nil : '--no-sync'].compact.join(' ')
 
     puts "Executing: #{cmd}"
     system(cmd)
 
     if $?.exitstatus == 0
-      puts 'kexec -e completed successfully.'
+      puts 'kexec --exec completed successfully.'
     else
-      warn 'ERROR: kexec -u failed!'
+      warn 'ERROR: kexec --exec failed!'
       exit 1
     end
   end
 
   def unload_kexec
-    cmd = [KEXEC, '-u'].join(' ')
+    cmd = [KEXEC, '--unload', '--no-sync'].join(' ')
 
     puts "Executing: #{cmd}"
     system(cmd)
 
     if $?.exitstatus == 0
-      puts 'kexec -u completed successfully.'
+      puts 'kexec --unload completed successfully.'
     else
-      warn 'ERROR: kexec -u failed!'
+      warn 'ERROR: kexec --unload failed!'
       exit 1
     end
   end

data/nix/modules/confctl/nix.nix

@@ -15,13 +15,43 @@ with lib;
 
         nixPath = mkOption {
           type = types.listOf types.str;
-          default = [];
+          default = [ ];
           description = ''
             List of extra paths added to environment variable
             <literal>NIX_PATH</literal> for all <literal>nix-build</literal>
             invokations
           '';
         };
+
+        impureEval = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable impure evaluation/builds (allows reading host paths outside the Nix store when they are referenced as Nix paths).
+          '';
+        };
+
+        legacyNixPath = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            If true, confctl adds -I mappings for selected inputs during flake
+            builds to support legacy <nixpkgs> or <vpsadminos> imports.
+          '';
+        };
+
+        legacyNixPathMap = mkOption {
+          type = types.listOf types.str;
+          default = [
+            "nixpkgs"
+            "vpsadminos"
+            "vpsadmin"
+          ];
+          description = ''
+            List of input names that should be mapped to NIX_PATH when
+            legacyNixPath is enabled.
+          '';
+        };
       };
     };
   };

data/nix/modules/confctl/swpins.nix

@@ -1,10 +1,17 @@
-{ config, pkgs, lib, swpinsInfo, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  swpinsInfo,
+  ...
+}:
 with lib;
 let
   swpinOptions = import ../../lib/swpins/options.nix { inherit lib; };
 
   machineSwpinsInfo = pkgs.writeText "swpins-info.json" (builtins.toJSON swpinsInfo);
-in {
+in
+{
   options = {
     confctl = {
       swpins.core = {
@@ -17,7 +24,7 @@ in {
                 url = "https://github.com/NixOS/nixpkgs";
                 update.ref = "refs/heads/nixos-unstable";
                 update.auto = true;
-                update.interval = 30*24*60*60; # 1 month
+                update.interval = 30 * 24 * 60 * 60; # 1 month
               };
             };
           };
@@ -31,7 +38,7 @@ in {
 
         channels = mkOption {
           type = types.listOf types.str;
-          default = [];
+          default = [ ];
           description = ''
             List of channels from <option>confctl.swpins.channels</option>
             to use for core swpins
@@ -41,7 +48,7 @@ in {
 
       swpins.channels = mkOption {
         type = types.attrsOf (types.attrsOf (types.submodule swpinOptions.specModule));
-        default = {};
+        default = { };
         description = ''
           Software pin channels
         '';
@@ -49,7 +56,7 @@ in {
     };
   };
 
-  config = {
+  config = mkIf (config.confctl.inputsInfo == null) {
     environment.etc."confctl/swpins-info.json".source = machineSwpinsInfo;
   };
 }

data/nix/modules/module-list.nix

@@ -4,8 +4,9 @@ let
     ./confctl/generations.nix
     ./confctl/cli.nix
     ./confctl/nix.nix
-    ./confctl/overlays.nix
     ./confctl/swpins.nix
+    ./confctl/inputs-info.nix
+    ./confctl/configuration-info.nix
   ];
 
   nixos = [
@@ -13,7 +14,8 @@ let
 
   vpsadminos = [
   ];
-in {
+in
+{
   nixos = shared ++ nixos;
   vpsadminos = shared ++ vpsadminos;
   all = shared ++ nixos ++ vpsadminos;

data/nix/modules/system-list.nix

@@ -2,9 +2,12 @@
   nixos = [
     ./confctl/carrier/base.nix
     ./confctl/carrier/netboot/nixos.nix
+    ./confctl/kexec-netboot
+    ./confctl/host.nix
   ];
 
   vpsadminos = [
     ./confctl/kexec-netboot
+    ./confctl/host.nix
   ];
-}
+}

data/nix/package.nix

@@ -0,0 +1,37 @@
+{
+  pkgs,
+  src ? ../.,
+  ruby ? (if pkgs ? ruby_3_4 then pkgs.ruby_3_4 else pkgs.ruby),
+  groups ? [ "default" ],
+}:
+let
+  lib = pkgs.lib;
+
+  deps = pkgs.bundlerEnv {
+    name = "confctl-deps";
+    inherit ruby;
+    gemdir = src;
+    lockfile = "${src}/Gemfile.lock";
+    inherit groups;
+  };
+
+  runtimePath = lib.makeBinPath [
+    pkgs.git
+    pkgs.openssh
+    pkgs.nix
+    pkgs.nix-prefetch-git
+  ];
+in
+(pkgs.writeShellScriptBin "confctl" ''
+  export GEM_HOME="${deps}/${ruby.gemPath}"
+  export GEM_PATH="${deps}/${ruby.gemPath}"
+  export RUBYLIB="${src}/lib"
+  export PATH="${runtimePath}:$PATH"
+
+  exec ${ruby}/bin/ruby ${src}/bin/confctl "$@"
+'').overrideAttrs
+  (_old: {
+    passthru = {
+      inherit deps ruby src;
+    };
+  })

data/shell.nix

@@ -1,14 +1,17 @@
 let
-  pkgs = import <nixpkgs> {};
+  pkgs = import <nixpkgs> { };
   lib = pkgs.lib;
   stdenv = pkgs.stdenv;
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   name = "confctl-shell";
 
   buildInputs = with pkgs; [
     git
     ncurses
     nix-prefetch-git
+    nixfmt
+    nixfmt-tree
     openssl
     ruby
   ];
@@ -16,23 +19,50 @@ in stdenv.mkDerivation rec {
   shellHook = ''
     CONFCTL="${toString ./.}"
     BASEDIR="$(realpath `pwd`)"
-    export GEM_HOME="$(pwd)/.gems"
-    BINDIR="$(ruby -e 'puts Gem.bindir')"
+    export GEM_ROOT="$(pwd)/.gems"
+    export GEM_HOME="$GEM_ROOT/ruby/$(ruby -e 'require "rbconfig"; print RbConfig::CONFIG["ruby_version"]')"
+    export GEM_PATH="$GEM_HOME"
+    export BUNDLE_PATH="$GEM_ROOT"
+    export BUNDLE_APP_CONFIG="$BASEDIR/.bundle"
+    export RUBOCOP_CACHE_ROOT="$CONFCTL/.rubocop_cache"
+    BINDIR="$GEM_HOME/bin"
     mkdir -p "$BINDIR"
 
     export PATH="$BINDIR:$PATH"
-    export RUBYLIB="$GEM_HOME:$CONFCTL/lib"
+    export RUBYLIB="$CONFCTL/lib"
     export MANPATH="$CONFCTL/man:$(man --path)"
-    gem install --no-document bundler
+
+    bundler_version=""
+    if [ -f "$CONFCTL/Gemfile.lock" ]; then
+      bundler_version="$(awk '/^BUNDLED WITH$/{getline; sub(/^[[:space:]]+/, "", $0); print; exit}' "$CONFCTL/Gemfile.lock")"
+    fi
+
+    if [ -n "$bundler_version" ]; then
+      export BUNDLER_VERSION="$bundler_version"
+      # Ruby can ship Bundler as a default gem without creating a wrapper in
+      # GEM_HOME/bin, but the shell below executes Bundler through that path.
+      if [ ! -x "$GEM_HOME/bin/bundle" ] \
+         || ! gem list -i bundler -v "$bundler_version" >/dev/null 2>&1; then
+        gem install --no-document bundler -v "$bundler_version"
+      fi
+    elif [ ! -x "$GEM_HOME/bin/bundle" ]; then
+      gem install --no-document bundler
+    fi
+    bundle_bin="$GEM_HOME/bin/bundle"
+
     pushd "$CONFCTL"
 
     # Purity disabled because of prism gem, which has a native extension.
     # The extension has its header files in .gems, which gets stripped but
     # cc wrapper in Nix. Without NIX_ENFORCE_PURITY=0, we get prism.h not found
     # error.
-    NIX_ENFORCE_PURITY=0 bundle install
+    NIX_ENFORCE_PURITY=0 "$bundle_bin" install
 
-    bundle exec rake md2man:man
+    "$bundle_bin" config set --local path "$BUNDLE_PATH"
+    "$bundle_bin" config set --local bin "$BINDIR"
+    "$bundle_bin" binstubs rubocop --force
+
+    "$bundle_bin" exec rake md2man:man
     popd
 
     cat <<EOF > "$BINDIR/confctl"
@@ -45,5 +75,6 @@ in stdenv.mkDerivation rec {
     load File.join('$CONFCTL', 'bin/confctl')
     EOF
     chmod +x "$BINDIR/confctl"
+
   '';
 }