flakes/openarc/flake.nix

   1 {
   2   description = "Open source ARC implementation";
   3
   4   inputs.myuids = {
   5     url = "path:../myuids";
   6   };
   7   inputs.flake-utils.url = "github:numtide/flake-utils";
   8   inputs.nixpkgs.url = "github:NixOS/nixpkgs";
   9   inputs.openarc = {
  10     url = "github:trusteddomainproject/OpenARC";
  11     flake = false;
  12   };
  13
  14   outputs = { self, myuids, openarc, flake-utils, nixpkgs }: flake-utils.lib.eachDefaultSystem (system:
  15     let
  16       pkgs = import nixpkgs { inherit system; overlays = []; };
  17     in rec {
  18       packages.openarc = pkgs.callPackage ./. { src = openarc; };
  19       defaultPackage = packages.openarc;
  20       legacyPackages.openarc = packages.openarc;
  21       apps.openarc = flake-utils.lib.mkApp { drv = packages.openarc; };
  22       defaultApp = apps.openarc;
  23       hydraJobs = checks;
  24       checks = {
  25         build = defaultPackage;
  26       } // pkgs.lib.optionalAttrs (builtins.elem system pkgs.lib.systems.doubles.linux) {
  27         test =
  28           let testing = import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; };
  29           in testing.makeTest {
  30             nodes = {
  31               server = { pkgs, ... }: {
  32                 imports = [ self.nixosModule ];
  33                 config.services.openarc.enable = true;
  34                 config.services.openarc.configFile = pkgs.writeText "openarc.conf" ''
  35                   Domain    foo.example.org
  36                   KeyFile   /etc/openarc/foo.key
  37                   Selector  foo
  38                 '';
  39               };
  40             };
  41             testScript = ''
  42               start_all()
  43               server.wait_until_fails("openarc.service")
  44               server.execute("install -m 0700 -o openarc -g openarc -d /etc/openarc")
  45               server.execute("echo some_key > /etc/openarc/foo.key")
  46               server.execute("chown openarc:openarc /etc/openarc/foo.key")
  47               server.execute("chmod 400 /etc/openarc/foo.key")
  48               server.systemctl("restart openarc")
  49               server.wait_for_unit("openarc.service")
  50               server.succeed("[ -S /run/openarc/openarc.sock ]")
  51             '';
  52           };
  53         };
  54     }) // rec {
  55       overlays = {
  56         openarc = final: prev: {
  57           openarc = self.defaultPackage."${final.system}";
  58         };
  59       };
  60       overlay = overlays.openarc;
  61       nixosModule = { config, lib, pkgs, ... }:
  62         let
  63           cfg = config.services.openarc;
  64           defaultSock = "/run/openarc/openarc.sock";
  65           args = [ "-f" "-p" "local:${cfg.socket}" ] ++ lib.optionals (cfg.configFile != null) [ "-c" cfg.configFile ];
  66         in {
  67           # Necessary for situations where flake gets included multiple times
  68           key = builtins.hashString "sha256" (builtins.path { path = self.sourceInfo.outPath; name = "source"; });
  69           options = {
  70             services.openarc = {
  71               enable = lib.mkOption {
  72                 type = lib.types.bool;
  73                 default = false;
  74                 description = "Whether to enable the OpenARC sender authentication system.";
  75               };
  76
  77               socket = lib.mkOption {
  78                 type = lib.types.str;
  79                 default = defaultSock;
  80                 description = "Socket which is used for communication with OpenARC.";
  81               };
  82
  83               user = lib.mkOption {
  84                 type = lib.types.str;
  85                 default = "openarc";
  86                 description = "User for the daemon.";
  87               };
  88
  89               group = lib.mkOption {
  90                 type = lib.types.str;
  91                 default = "openarc";
  92                 description = "Group for the daemon.";
  93               };
  94
  95               configFile = lib.mkOption {
  96                 type = lib.types.nullOr lib.types.path;
  97                 default = null;
  98                 description = "Additional OpenARC configuration.";
  99               };
 100
 101             };
 102           };
 103
 104           config = lib.mkIf cfg.enable {
 105             nixpkgs.overlays = [ self.overlay ];
 106             users.users = lib.optionalAttrs (cfg.user == "openarc") {
 107               openarc = {
 108                 group = cfg.group;
 109                 uid = myuids.lib.uids.openarc;
 110               };
 111             };
 112
 113             users.groups = lib.optionalAttrs (cfg.group == "openarc") {
 114               openarc.gid = myuids.lib.gids.openarc;
 115             };
 116
 117             environment.systemPackages = [ pkgs.openarc ];
 118
 119             systemd.services.openarc = {
 120               description = "OpenARC daemon";
 121               after = [ "network.target" ];
 122               wantedBy = [ "multi-user.target" ];
 123
 124               serviceConfig = {
 125                 ExecStart = "${self.defaultApp."${pkgs.system}".program} ${lib.escapeShellArgs args}";
 126                 User = cfg.user;
 127                 Group = cfg.group;
 128                 RuntimeDirectory = lib.optional (cfg.socket == defaultSock) "openarc";
 129                 PermissionsStartOnly = true;
 130               };
 131             };
 132           };
 133         };
 134     };
 135   }