confctl 2.2.3 → 3.0.0

data/nix/modules/cluster/default.nix

@@ -1,17 +1,31 @@
-{ config, lib, confLib, ... }@args:
+{
+  config,
+  lib,
+  confLib,
+  ...
+}@args:
 with lib;
 let
   machine =
-    { config, ...}:
+    { config, ... }:
     {
       options = {
         managed = mkOption {
           type = types.nullOr types.bool;
           default = null;
-          apply = v:
-            if !isNull v then v
-            else if elem config.spin [ "nixos" "vpsadminos" ] then true
-            else false;
+          apply =
+            v:
+            if !isNull v then
+              v
+            else if
+              elem config.spin [
+                "nixos"
+                "vpsadminos"
+              ]
+            then
+              true
+            else
+              false;
           description = ''
             Determines whether the machine is managed using confctl or not
 
@@ -20,23 +34,30 @@ let
         };
 
         spin = mkOption {
-          type = types.enum [ "openvz" "nixos" "vpsadminos" "other" ];
+          type = types.enum [
+            "openvz"
+            "nixos"
+            "vpsadminos"
+            "other"
+          ];
           description = "OS type";
         };
 
         swpins = {
           channels = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = ''
               List of channels from <option>confctl.swpins.channels</option>
               to use on this machine
+
+              This option is legacy in flake mode, prefer <option>cluster.&lt;name&gt;.inputs.channels</option>.
             '';
           };
 
           pins = mkOption {
             type = types.attrsOf (types.submodule swpinOptions.specModule);
-            default = {};
+            default = { };
             description = ''
               List of swpins for this machine, which can supplement or
               override swpins from configured channels
@@ -44,9 +65,32 @@ let
           };
         };
 
+        inputs = {
+          channels = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = ''
+              List of flake pin channels to use on this machine.
+
+              In flake mode, this selects entries from the `channels` mapping
+              passed to `mkConfctlOutputs` (e.g. "production", "staging", "os-staging").
+
+              This replaces legacy `swpins.channels`.
+            '';
+          };
+
+          overrides = mkOption {
+            type = types.attrsOf types.str;
+            default = { };
+            description = ''
+              Override role -> flake input mapping for this machine
+            '';
+          };
+        };
+
         addresses = mkOption {
           type = types.nullOr (types.submodule addresses);
-          default = {};
+          default = { };
           description = ''
             IP addresses
           '';
@@ -56,7 +100,7 @@ let
           enable = mkEnableOption "Include this system on pxe servers";
           macs = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = ''
               List of MAC addresses for iPXE node auto-detection
             '';
@@ -65,7 +109,11 @@ let
 
         buildAttribute = mkOption {
           type = types.listOf types.str;
-          default = [ "system" "build" "toplevel" ];
+          default = [
+            "system"
+            "build"
+            "toplevel"
+          ];
           description = ''
             Path to the attribute in machine system config that should be built
 
@@ -79,7 +127,7 @@ let
 
           machines = mkOption {
             type = types.listOf (types.submodule carriedMachine);
-            default = [];
+            default = [ ];
             description = ''
               List of carried machines
             '';
@@ -93,7 +141,7 @@ let
 
         labels = mkOption {
           type = types.attrs;
-          default = {};
+          default = { };
           description = ''
             Optional user-defined labels to classify the machine
           '';
@@ -101,7 +149,7 @@ let
 
         tags = mkOption {
           type = types.listOf types.str;
-          default = [];
+          default = [ ];
           description = ''
             Optional user-defined tags to classify the machine
           '';
@@ -110,7 +158,7 @@ let
         nix = {
           nixPath = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = ''
               List of extra paths added to environment variable
               <literal>NIX_PATH</literal> for <literal>nix-build</literal>
@@ -219,7 +267,10 @@ let
             systemProperties = mkOption {
               type = types.listOf (types.submodule systemdProperty);
               default = [
-                { property = "SystemState"; value = "running"; }
+                {
+                  property = "SystemState";
+                  value = "running";
+                }
               ];
               description = ''
                 Check systemd manager properties reported by systemctl show
@@ -228,7 +279,7 @@ let
 
             unitProperties = mkOption {
               type = types.attrsOf (types.listOf (types.submodule systemdProperty));
-              default = {};
+              default = { };
               example = literalExpression ''
                 {
                   "firewall.service" = [
@@ -244,7 +295,7 @@ let
 
           builderCommands = mkOption {
             type = types.listOf (types.submodule checkCommand);
-            default = [];
+            default = [ ];
             example = literalExpression ''
               [
                 { description = "ping"; command = [ "ping" "-c1" "{host.fqdn}" ]; }
@@ -257,7 +308,7 @@ let
 
           machineCommands = mkOption {
             type = types.listOf (types.submodule checkCommand);
-            default = [];
+            default = [ ];
             example = literalExpression ''
               [
                 { description = "curl"; command = [ "curl" "-s" "http://localhost:80" ]; }
@@ -282,9 +333,9 @@ let
         primary = mkOption {
           type = types.nullOr (types.submodule (confLib.mkOptions.addresses 4));
           default =
-            if config.v4 != [] then
+            if config.v4 != [ ] then
               head config.v4
-            else if config.v6 != [] then
+            else if config.v6 != [ ] then
               head config.v6
             else
               null;
@@ -297,7 +348,7 @@ let
 
         v4 = mkOption {
           type = types.listOf (types.submodule (confLib.mkOptions.addresses 4));
-          default = [];
+          default = [ ];
           description = ''
             List of IPv4 addresses this machine responds to
           '';
@@ -305,7 +356,7 @@ let
 
         v6 = mkOption {
           type = types.listOf (types.submodule (confLib.mkOptions.addresses 6));
-          default = [];
+          default = [ ];
           description = ''
             List of IPv6 addresses this machine responds to
           '';
@@ -321,7 +372,7 @@ let
           type = types.nullOr types.str;
           default = null;
           description = ''
-           Host name
+            Host name
           '';
         };
 
@@ -347,12 +398,10 @@ let
           description = ''
             Domain including location, i.e. FQDN without host name
           '';
-          apply = v:
+          apply =
+            v:
             if isNull v && !isNull config.domain then
-              concatStringsSep "." (
-                (optional (!isNull config.location) config.location)
-                ++ [ config.domain ]
-              )
+              concatStringsSep "." ((optional (!isNull config.location) config.location) ++ [ config.domain ])
             else
               v;
         };
@@ -363,7 +412,8 @@ let
           description = ''
             Host FQDN
           '';
-          apply = v:
+          apply =
+            v:
             if isNull v && !isNull config.name then
               concatStringsSep "." (
                 [ config.name ]
@@ -384,6 +434,14 @@ let
             as a carried machine.
           '';
         };
+
+        port = mkOption {
+          type = types.int;
+          default = 22;
+          description = ''
+            SSH port used to connect to this machine.
+          '';
+        };
       };
     };
 
@@ -403,7 +461,7 @@ let
 
         labels = mkOption {
           type = types.attrs;
-          default = {};
+          default = { };
           description = ''
             Optional user-defined labels to classify the machine
           '';
@@ -411,7 +469,7 @@ let
 
         tags = mkOption {
           type = types.listOf types.str;
-          default = [];
+          default = [ ];
           description = ''
             Optional user-defined tags to classify the machine
           '';
@@ -419,7 +477,7 @@ let
 
         extraModules = mkOption {
           type = types.listOf types.path;
-          default = [];
+          default = [ ];
           description = ''
             A list of additional NixOS modules to be imported for this machine
           '';
@@ -427,7 +485,11 @@ let
 
         buildAttribute = mkOption {
           type = types.listOf types.str;
-          default = [ "system" "build" "toplevel" ];
+          default = [
+            "system"
+            "build"
+            "toplevel"
+          ];
           description = ''
             Path to the attribute in machine system config that should be built
 
@@ -564,13 +626,13 @@ let
 
           include = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = "Strings that must be included in standard output";
           };
 
           exclude = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = "Strings that must not be included in standard output";
           };
         };
@@ -584,13 +646,13 @@ let
 
           include = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = "String that must be included in standard error";
           };
 
           exclude = mkOption {
             type = types.listOf types.str;
-            default = [];
+            default = [ ];
             description = "String that must not be included in standard error";
           };
         };
@@ -608,11 +670,12 @@ let
         };
       };
     };
-in {
+in
+{
   options = {
     cluster = mkOption {
       type = types.attrsOf (types.submodule machine);
-      default = {};
+      default = { };
     };
   };
 }

data/nix/modules/confctl/carrier/base.nix

@@ -1,10 +1,16 @@
-{ config, pkgs, lib, confMachine, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  confMachine,
+  ...
+}:
 let
   inherit (lib) mkIf mkOption types;
 
   cfg = config.confctl.carrier;
 
-  carrier-env = pkgs.confReplaceVarsWith {
+  carrier-env = pkgs.replaceVarsWith {
     src = ./carrier-env.rb;
     name = "carrier-env";
     isExecutable = true;
@@ -17,7 +23,8 @@ let
       '';
     };
   };
-in {
+in
+{
   options = {
     confctl.carrier.onChangeCommands = mkOption {
       type = types.lines;
@@ -34,4 +41,4 @@ in {
       carrier-env
     ];
   };
-}
+}

data/nix/modules/confctl/carrier/carrier-env.rb

@@ -63,8 +63,8 @@ class CarrierEnv
     on_change_commands
   end
 
-  def nix_env(*args)
-    system_command('nix-env', '-p', @profile, *args)
+  def nix_env(*)
+    system_command('nix-env', '-p', @profile, *)
   end
 
   def on_change_commands

data/nix/modules/confctl/carrier/netboot/build-netboot-server.rb

@@ -128,7 +128,7 @@ class NetbootBuilder
       puts m.fqdn
 
       m.generations.each do |g|
-        puts "  - #{g.time_s} - #{g.version}#{g.current ? ' (current)' : ''}"
+        puts "  - #{g.time_s} - #{g.version}#{' (current)' if g.current}"
       end
 
       puts
@@ -434,14 +434,14 @@ class TftpBuilder < RootBuilder
         MENU LABEL <%= m.label %>
         LINUX boot/<%= m.fqdn %>/<%= m.current.generation %>/bzImage
         INITRD boot/<%= m.fqdn %>/<%= m.current.generation %>/initrd
-        APPEND init=<%= m.current.toplevel %>/init loglevel=7
+        APPEND <%= m.current.pxe_kernel_params.join(' ') %>
 
       <% m.generations[1..].each do |g| -%>
       LABEL <%= m.fqdn %>-<%= g.generation %>
         MENU LABEL Gen <%= g.generation %> - <%= g.time_s %> - <%= g.shortrev %>
         LINUX boot/<%= m.fqdn %>/<%= g.generation %>/bzImage
         INITRD boot/<%= m.fqdn %>/<%= g.generation %>/initrd
-        APPEND init=<%= g.toplevel %>/init loglevel=7
+        APPEND <%= g.pxe_kernel_params.join(' ') %>
 
       <% end -%>
       <% if enable_memtest -%>
@@ -466,6 +466,20 @@ class TftpBuilder < RootBuilder
       },
       "pxeserver/machines/#{machine.fqdn}/menu.cfg"
     )
+
+    tpl = <<~ERB
+      DEFAULT <%= m.fqdn %>
+      PROMPT 0
+      TIMEOUT 50
+
+      LABEL <%= m.fqdn %>
+        MENU LABEL <%= m.label %>
+        LINUX boot/<%= m.fqdn %>/<%= m.current.generation %>/bzImage
+        INITRD boot/<%= m.fqdn %>/<%= m.current.generation %>/initrd
+        APPEND <%= m.current.pxe_kernel_params.join(' ') %>
+    ERB
+
+    render_to(tpl, { m: machine }, "pxeserver/machines/#{machine.fqdn}/auto.cfg")
   end
 
   def render_machine_vpsadminos(machine)
@@ -694,7 +708,7 @@ class Machine
     nil
   end
 
-  def to_json(*args)
+  def to_json(*)
     {
       url:,
       name:,
@@ -702,7 +716,7 @@ class Machine
       fqdn:,
       label:,
       generations:
-    }.to_json(*args)
+    }.to_json(*)
   end
 
   protected
@@ -827,13 +841,20 @@ class Generation
     @url = File.join(machine.url, generation.to_s)
     @boot_files = find_boot_files
     @variants = Variant.for_machine(machine)
+    @kernel_params.reject! { |v| v.start_with?('httproot=') }
+    ensure_nixos_init_param
 
-    return if machine.spin != 'vpsadminos'
+    httproot =
+      if machine.spin == 'vpsadminos'
+        boot_files['root.squashfs']&.url
+      else
+        boot_files['initrd']&.url || boot_files['bzImage']&.url
+      end
 
-    @kernel_params.insert(0, "httproot=#{boot_files['root.squashfs'].url}")
+    @kernel_params.insert(0, "httproot=#{httproot}") if httproot
   end
 
-  def to_json(*args)
+  def to_json(*)
     {
       url:,
       store_path:,
@@ -851,11 +872,27 @@ class Generation
       boot_files:,
       variants:,
       swpins_info: json['swpins-info']
-    }.to_json(*args)
+    }.to_json(*)
+  end
+
+  def pxe_kernel_params
+    return kernel_params if kernel_params.any?
+
+    [
+      "init=#{toplevel}/init",
+      'loglevel=7'
+    ]
   end
 
   protected
 
+  def ensure_nixos_init_param
+    return unless machine.spin == 'nixos'
+    return if @kernel_params.any? { |v| v.start_with?('init=') }
+
+    @kernel_params.unshift("init=#{toplevel}/init")
+  end
+
   def extract_kernel_version
     link = File.readlink(File.join(toplevel, 'kernel'))
     return unless %r{\A/nix/store/[^-]+-linux-([^/]+)} =~ link
@@ -890,8 +927,8 @@ class BootFile
     @url = url
   end
 
-  def to_json(*args)
-    url.to_json(*args)
+  def to_json(*)
+    url.to_json(*)
   end
 end
 
@@ -947,12 +984,12 @@ class Variant
     @kernel_params = kernel_params
   end
 
-  def to_json(*args)
+  def to_json(*)
     {
       name:,
       label:,
       kernel_params:
-    }.to_json(*args)
+    }.to_json(*)
   end
 end
 

data/nix/modules/confctl/carrier/netboot/nixos.nix

@@ -1,7 +1,21 @@
-{ config, lib, pkgs, confMachine, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  confMachine,
+  ...
+}:
 let
-  inherit (lib) concatStringsSep flip mkOption mkEnableOption mkIf
-                optional optionalString types;
+  inherit (lib)
+    concatStringsSep
+    flip
+    mkOption
+    mkEnableOption
+    mkIf
+    optional
+    optionalString
+    types
+    ;
 
   concatNl = concatStringsSep "\n";
 
@@ -46,13 +60,16 @@ let
     httpUrl = "http://${cfg.host}";
     memtest =
       if cfg.memtest86.enable then
-        { package = pkgs.memtest86plus; params = cfg.memtest86.params; }
+        {
+          package = pkgs.memtest86plus;
+          params = cfg.memtest86.params;
+        }
       else
         null;
     isoImages = cfg.isoImages;
   };
 
-  builder = pkgs.confReplaceVarsWith {
+  builder = pkgs.replaceVarsWith {
     src = ./build-netboot-server.rb;
     name = "build-netboot-server";
     dir = "bin";
@@ -62,7 +79,8 @@ let
       jsonConfig = pkgs.writeText "netboot-server.json" builderConfig;
     };
   };
-in {
+in
+{
   options = {
     confctl.carrier.netboot = {
       enable = mkEnableOption ''
@@ -89,7 +107,7 @@ in {
 
         params = mkOption {
           type = types.listOf types.str;
-          default = [];
+          default = [ ];
           example = [ "console=ttyS0,115200" ];
           description = "See {option}`boot.loader.grub.memtest86.params`";
         };
@@ -97,7 +115,7 @@ in {
 
       isoImages = mkOption {
         type = types.listOf (types.submodule isoImage);
-        default = [];
+        default = [ ];
         description = "A list of ISO images to be included in boot menu";
       };
 
@@ -107,7 +125,7 @@ in {
           Allow HTTP access for these IP ranges, if not specified
           access is not restricted.
         '';
-        default = [];
+        default = [ ];
         example = "10.0.0.0/24";
       };
 
@@ -135,13 +153,21 @@ in {
     environment.systemPackages = [ builder ];
 
     networking.firewall = {
-      extraCommands = mkIf (cfg.allowedIPv4Ranges != []) (concatNl (map (net: ''
-        # Allow access from ${net} for netboot
-        iptables -A nixos-fw -p udp -s ${net} ${optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"} --dport 68 -j nixos-fw-accept
-        iptables -A nixos-fw -p udp -s ${net} ${optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"} --dport 69 -j nixos-fw-accept
-        iptables -A nixos-fw -p tcp -s ${net} --dport 80 -j nixos-fw-accept
-        ${optionalString cfg.enableACME "iptables -A nixos-fw -p tcp -s ${net} --dport 443 -j nixos-fw-accept"}
-      '') cfg.allowedIPv4Ranges));
+      extraCommands = mkIf (cfg.allowedIPv4Ranges != [ ]) (
+        concatNl (
+          map (net: ''
+            # Allow access from ${net} for netboot
+            iptables -A nixos-fw -p udp -s ${net} ${
+              optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"
+            } --dport 68 -j nixos-fw-accept
+            iptables -A nixos-fw -p udp -s ${net} ${
+              optionalString (!isNull cfg.tftp.bindAddress) "-d ${cfg.tftp.bindAddress}"
+            } --dport 69 -j nixos-fw-accept
+            iptables -A nixos-fw -p tcp -s ${net} --dport 80 -j nixos-fw-accept
+            ${optionalString cfg.enableACME "iptables -A nixos-fw -p tcp -s ${net} --dport 443 -j nixos-fw-accept"}
+          '') cfg.allowedIPv4Ranges
+        )
+      );
     };
 
     systemd.services.netboot-atftpd = {
@@ -149,12 +175,18 @@ in {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       # runs as nobody
-      serviceConfig.ExecStart = toString ([
-        "${pkgs.atftp}/sbin/atftpd"
-        "--daemon"
-        "--no-fork"
-      ] ++ (optional (!isNull cfg.tftp.bindAddress) [ "--bind-address" cfg.tftp.bindAddress ])
-        ++ [ tftpRoot ]);
+      serviceConfig.ExecStart = toString (
+        [
+          "${pkgs.atftp}/sbin/atftpd"
+          "--daemon"
+          "--no-fork"
+        ]
+        ++ (optional (!isNull cfg.tftp.bindAddress) [
+          "--bind-address"
+          cfg.tftp.bindAddress
+        ])
+        ++ [ tftpRoot ]
+      );
     };
 
     services.nginx = {
@@ -173,7 +205,7 @@ in {
             "/" = {
               extraConfig = ''
                 autoindex on;
-                ${optionalString (cfg.allowedIPv4Ranges != []) ''
+                ${optionalString (cfg.allowedIPv4Ranges != [ ]) ''
                   ${concatNl (flip map cfg.allowedIPv4Ranges (range: "allow ${range};"))}
                   deny all;
                 ''}
@@ -184,4 +216,4 @@ in {
       };
     };
   };
-}
+}