A fork of attic a self-hostable Nix Binary Cache server
Add NixOS module
Fixes #1. Still needs documentation though.
+153
-1
+1
-1
crane.nix
+1
-1
crane.nix
+14
flake.nix
+14
flake.nix
···
115
115
inherit (cranePkgs) attic attic-client attic-server;
116
116
};
117
117
};
118
+
119
+
nixosModules = {
120
+
atticd = {
121
+
imports = [
122
+
./nixos/atticd.nix
123
+
];
124
+
125
+
services.atticd.useFlakeCompatOverlay = false;
126
+
127
+
nixpkgs.overlays = [
128
+
self.overlays.default
129
+
];
130
+
};
131
+
};
118
132
};
119
133
}
+138
nixos/atticd.nix
+138
nixos/atticd.nix
···
1
+
{ lib, pkgs, config, ... }:
2
+
3
+
let
4
+
inherit (lib) types;
5
+
6
+
cfg = config.services.atticd;
7
+
8
+
# unused when the entrypoint is flake
9
+
flake = import ../flake-compat.nix;
10
+
overlay = flake.defaultNix.overlays.default;
11
+
12
+
format = pkgs.formats.toml { };
13
+
14
+
checkedConfigFile = pkgs.runCommand "checked-attic-server.toml" {
15
+
configFile = cfg.configFile;
16
+
} ''
17
+
cat $configFile
18
+
19
+
export ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="dGVzdCBzZWNyZXQ="
20
+
${cfg.package}/bin/atticd --mode check-config -f $configFile
21
+
cat <$configFile >$out
22
+
'';
23
+
24
+
hasLocalPostgresDB = let
25
+
url = cfg.settings.database.url;
26
+
localStrings = [ "localhost" "127.0.0.1" "/run/postgresql" ];
27
+
hasLocalStrings = lib.any (lib.flip lib.hasInfix url) localStrings;
28
+
in config.services.postgresql.enable && lib.hasPrefix "postgresql://" url && hasLocalStrings;
29
+
in
30
+
{
31
+
options = {
32
+
services.atticd = {
33
+
enable = lib.mkOption {
34
+
description = ''
35
+
Whether to enable the atticd, the Nix Binary Cache server.
36
+
'';
37
+
type = types.bool;
38
+
default = false;
39
+
};
40
+
package = lib.mkOption {
41
+
description = ''
42
+
The package to use.
43
+
'';
44
+
type = types.package;
45
+
default = pkgs.attic-server;
46
+
};
47
+
credentialsFile = lib.mkOption {
48
+
description = ''
49
+
Path to an EnvironmentFile containing required environment
50
+
variables:
51
+
52
+
- ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64: The Base64-encoded version of the
53
+
HS256 JWT secret.
54
+
'';
55
+
type = types.path;
56
+
};
57
+
settings = lib.mkOption {
58
+
description = ''
59
+
Structured configurations of atticd.
60
+
'';
61
+
type = format.type;
62
+
default = {}; # setting defaults here does not compose well
63
+
};
64
+
configFile = lib.mkOption {
65
+
description = ''
66
+
Path to an existing atticd configuration file.
67
+
68
+
By default, it's generated from `services.atticd.settings`.
69
+
'';
70
+
type = types.path;
71
+
default = format.generate "server.toml" cfg.settings;
72
+
defaultText = "generated from `services.atticd.settings`";
73
+
};
74
+
75
+
# Internal flags
76
+
useFlakeCompatOverlay = lib.mkOption {
77
+
description = ''
78
+
Whether to insert the overlay with flake-compat.
79
+
'';
80
+
type = types.bool;
81
+
internal = true;
82
+
default = true;
83
+
};
84
+
};
85
+
};
86
+
config = lib.mkIf (cfg.enable) (lib.mkMerge [
87
+
{
88
+
assertions = [
89
+
{
90
+
assertion = !lib.isStorePath cfg.credentialsFile;
91
+
message = ''
92
+
<option>services.atticd.credentialsFile</option> points to a path in the Nix store. The Nix store is globally readable.
93
+
94
+
You should use a quoted absolute path to prevent this.
95
+
'';
96
+
}
97
+
];
98
+
99
+
services.atticd.settings = {
100
+
database.url = lib.mkDefault "sqlite:///var/lib/atticd/server.db?mode=rwc";
101
+
102
+
# "storage" is internally tagged
103
+
# if the user sets something the whole thing must be replaced
104
+
storage = lib.mkDefault {
105
+
type = "local";
106
+
path = "/var/lib/atticd/storage";
107
+
};
108
+
};
109
+
110
+
systemd.services.atticd = {
111
+
wantedBy = [ "multi-user.target" ];
112
+
after = [ "network.target" ] ++ lib.optional hasLocalPostgresDB "postgresql.service";
113
+
serviceConfig = {
114
+
ExecStart = "${cfg.package}/bin/atticd -f ${checkedConfigFile}";
115
+
EnvironmentFile = cfg.credentialsFile;
116
+
StateDirectory = "atticd"; # for usage with local storage and sqlite
117
+
DynamicUser = true;
118
+
ProtectHome = true;
119
+
ProtectHostname = true;
120
+
ProtectKernelLogs = true;
121
+
ProtectKernelModules = true;
122
+
ProtectKernelTunables = true;
123
+
ProtectProc = "invisible";
124
+
ProtectSystem = "strict";
125
+
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
126
+
RestrictNamespaces = true;
127
+
RestrictRealtime = true;
128
+
RestrictSUIDSGID = true;
129
+
};
130
+
};
131
+
132
+
environment.systemPackages = [ cfg.package ];
133
+
}
134
+
(lib.mkIf cfg.useFlakeCompatOverlay {
135
+
nixpkgs.overlays = [ overlay ];
136
+
})
137
+
]);
138
+
}