A fork of attic a self-hostable Nix Binary Cache server
0
fork

Configure Feed

Select the types of activity you want to include in your feed.

Add NixOS module

Fixes #1. Still needs documentation though.

+153 -1
+1 -1
crane.nix
··· 24 24 let 25 25 version = "0.1.0"; 26 26 27 - ignoredPaths = [ ".github" "target" "book" ]; 27 + ignoredPaths = [ ".github" "target" "book" "nixos" ]; 28 28 29 29 src = lib.cleanSourceWith { 30 30 filter = name: type: !(type == "directory" && builtins.elem (baseNameOf name) ignoredPaths);
+14
flake.nix
··· 115 115 inherit (cranePkgs) attic attic-client attic-server; 116 116 }; 117 117 }; 118 + 119 + nixosModules = { 120 + atticd = { 121 + imports = [ 122 + ./nixos/atticd.nix 123 + ]; 124 + 125 + services.atticd.useFlakeCompatOverlay = false; 126 + 127 + nixpkgs.overlays = [ 128 + self.overlays.default 129 + ]; 130 + }; 131 + }; 118 132 }; 119 133 }
+138
nixos/atticd.nix
··· 1 + { lib, pkgs, config, ... }: 2 + 3 + let 4 + inherit (lib) types; 5 + 6 + cfg = config.services.atticd; 7 + 8 + # unused when the entrypoint is flake 9 + flake = import ../flake-compat.nix; 10 + overlay = flake.defaultNix.overlays.default; 11 + 12 + format = pkgs.formats.toml { }; 13 + 14 + checkedConfigFile = pkgs.runCommand "checked-attic-server.toml" { 15 + configFile = cfg.configFile; 16 + } '' 17 + cat $configFile 18 + 19 + export ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="dGVzdCBzZWNyZXQ=" 20 + ${cfg.package}/bin/atticd --mode check-config -f $configFile 21 + cat <$configFile >$out 22 + ''; 23 + 24 + hasLocalPostgresDB = let 25 + url = cfg.settings.database.url; 26 + localStrings = [ "localhost" "127.0.0.1" "/run/postgresql" ]; 27 + hasLocalStrings = lib.any (lib.flip lib.hasInfix url) localStrings; 28 + in config.services.postgresql.enable && lib.hasPrefix "postgresql://" url && hasLocalStrings; 29 + in 30 + { 31 + options = { 32 + services.atticd = { 33 + enable = lib.mkOption { 34 + description = '' 35 + Whether to enable the atticd, the Nix Binary Cache server. 36 + ''; 37 + type = types.bool; 38 + default = false; 39 + }; 40 + package = lib.mkOption { 41 + description = '' 42 + The package to use. 43 + ''; 44 + type = types.package; 45 + default = pkgs.attic-server; 46 + }; 47 + credentialsFile = lib.mkOption { 48 + description = '' 49 + Path to an EnvironmentFile containing required environment 50 + variables: 51 + 52 + - ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64: The Base64-encoded version of the 53 + HS256 JWT secret. 54 + ''; 55 + type = types.path; 56 + }; 57 + settings = lib.mkOption { 58 + description = '' 59 + Structured configurations of atticd. 60 + ''; 61 + type = format.type; 62 + default = {}; # setting defaults here does not compose well 63 + }; 64 + configFile = lib.mkOption { 65 + description = '' 66 + Path to an existing atticd configuration file. 67 + 68 + By default, it's generated from `services.atticd.settings`. 69 + ''; 70 + type = types.path; 71 + default = format.generate "server.toml" cfg.settings; 72 + defaultText = "generated from `services.atticd.settings`"; 73 + }; 74 + 75 + # Internal flags 76 + useFlakeCompatOverlay = lib.mkOption { 77 + description = '' 78 + Whether to insert the overlay with flake-compat. 79 + ''; 80 + type = types.bool; 81 + internal = true; 82 + default = true; 83 + }; 84 + }; 85 + }; 86 + config = lib.mkIf (cfg.enable) (lib.mkMerge [ 87 + { 88 + assertions = [ 89 + { 90 + assertion = !lib.isStorePath cfg.credentialsFile; 91 + message = '' 92 + <option>services.atticd.credentialsFile</option> points to a path in the Nix store. The Nix store is globally readable. 93 + 94 + You should use a quoted absolute path to prevent this. 95 + ''; 96 + } 97 + ]; 98 + 99 + services.atticd.settings = { 100 + database.url = lib.mkDefault "sqlite:///var/lib/atticd/server.db?mode=rwc"; 101 + 102 + # "storage" is internally tagged 103 + # if the user sets something the whole thing must be replaced 104 + storage = lib.mkDefault { 105 + type = "local"; 106 + path = "/var/lib/atticd/storage"; 107 + }; 108 + }; 109 + 110 + systemd.services.atticd = { 111 + wantedBy = [ "multi-user.target" ]; 112 + after = [ "network.target" ] ++ lib.optional hasLocalPostgresDB "postgresql.service"; 113 + serviceConfig = { 114 + ExecStart = "${cfg.package}/bin/atticd -f ${checkedConfigFile}"; 115 + EnvironmentFile = cfg.credentialsFile; 116 + StateDirectory = "atticd"; # for usage with local storage and sqlite 117 + DynamicUser = true; 118 + ProtectHome = true; 119 + ProtectHostname = true; 120 + ProtectKernelLogs = true; 121 + ProtectKernelModules = true; 122 + ProtectKernelTunables = true; 123 + ProtectProc = "invisible"; 124 + ProtectSystem = "strict"; 125 + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; 126 + RestrictNamespaces = true; 127 + RestrictRealtime = true; 128 + RestrictSUIDSGID = true; 129 + }; 130 + }; 131 + 132 + environment.systemPackages = [ cfg.package ]; 133 + } 134 + (lib.mkIf cfg.useFlakeCompatOverlay { 135 + nixpkgs.overlays = [ overlay ]; 136 + }) 137 + ]); 138 + }