flakes/openarc/flake.nix

   1 {
   2   description = "Open source ARC implementation";
   3
   4   inputs.myuids = {
   5     url = "https://git.immae.eu/perso/Immae/Config/Nix.git";
   6     type = "git";
   7     dir = "flakes/myuids";
   8   };
   9   inputs.flake-utils.url = "github:numtide/flake-utils";
  10   inputs.nixpkgs.url = "github:NixOS/nixpkgs";
  11   inputs.openarc = {
  12     url = "github:trusteddomainproject/OpenARC";
  13     flake = false;
  14   };
  15
  16   outputs = { self, myuids, openarc, flake-utils, nixpkgs }: flake-utils.lib.eachDefaultSystem (system:
  17     let
  18       pkgs = import nixpkgs { inherit system; overlays = []; };
  19     in rec {
  20       packages.openarc = pkgs.callPackage ./. { src = openarc; };
  21       defaultPackage = packages.openarc;
  22       legacyPackages.openarc = packages.openarc;
  23       apps.openarc = flake-utils.lib.mkApp { drv = packages.openarc; };
  24       defaultApp = apps.openarc;
  25       hydraJobs = checks;
  26       checks = {
  27         build = defaultPackage;
  28       } // pkgs.lib.optionalAttrs (builtins.elem system pkgs.lib.systems.doubles.linux) {
  29         test =
  30           let testing = import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; };
  31           in testing.makeTest {
  32             nodes = {
  33               server = { pkgs, ... }: {
  34                 imports = [ self.nixosModule ];
  35                 config.services.openarc.enable = true;
  36                 config.services.openarc.configFile = pkgs.writeText "openarc.conf" ''
  37                   Domain    foo.example.org
  38                   KeyFile   /etc/openarc/foo.key
  39                   Selector  foo
  40                 '';
  41               };
  42             };
  43             testScript = ''
  44               start_all()
  45               server.wait_until_fails("openarc.service")
  46               server.execute("install -m 0700 -o openarc -g openarc -d /etc/openarc")
  47               server.execute("echo some_key > /etc/openarc/foo.key")
  48               server.execute("chown openarc:openarc /etc/openarc/foo.key")
  49               server.execute("chmod 400 /etc/openarc/foo.key")
  50               server.systemctl("restart openarc")
  51               server.wait_for_unit("openarc.service")
  52               server.succeed("[ -S /run/openarc/openarc.sock ]")
  53             '';
  54           };
  55         };
  56     }) // rec {
  57       overlays = {
  58         openarc = final: prev: {
  59           openarc = self.defaultPackage."${final.system}";
  60         };
  61       };
  62       overlay = overlays.openarc;
  63       nixosModule = { config, lib, pkgs, ... }:
  64         let
  65           cfg = config.services.openarc;
  66           defaultSock = "local:/run/openarc/openarc.sock";
  67           args = [ "-f" "-p" cfg.socket ] ++ lib.optionals (cfg.configFile != null) [ "-c" cfg.configFile ];
  68         in {
  69           options = {
  70             services.openarc = {
  71               enable = lib.mkOption {
  72                 type = lib.types.bool;
  73                 default = false;
  74                 description = "Whether to enable the OpenARC sender authentication system.";
  75               };
  76
  77               socket = lib.mkOption {
  78                 type = lib.types.str;
  79                 default = defaultSock;
  80                 description = "Socket which is used for communication with OpenARC.";
  81               };
  82
  83               user = lib.mkOption {
  84                 type = lib.types.str;
  85                 default = "openarc";
  86                 description = "User for the daemon.";
  87               };
  88
  89               group = lib.mkOption {
  90                 type = lib.types.str;
  91                 default = "openarc";
  92                 description = "Group for the daemon.";
  93               };
  94
  95               configFile = lib.mkOption {
  96                 type = lib.types.nullOr lib.types.path;
  97                 default = null;
  98                 description = "Additional OpenARC configuration.";
  99               };
 100
 101             };
 102           };
 103
 104           config = lib.mkIf cfg.enable {
 105             nixpkgs.overlays = [ self.overlay ];
 106             users.users = lib.optionalAttrs (cfg.user == "openarc") {
 107               openarc = {
 108                 group = cfg.group;
 109                 uid = myuids.lib.uids.openarc;
 110               };
 111             };
 112
 113             users.groups = lib.optionalAttrs (cfg.group == "openarc") {
 114               openarc.gid = myuids.lib.gids.openarc;
 115             };
 116
 117             environment.systemPackages = [ pkgs.openarc ];
 118
 119             systemd.services.openarc = {
 120               description = "OpenARC daemon";
 121               after = [ "network.target" ];
 122               wantedBy = [ "multi-user.target" ];
 123
 124               serviceConfig = {
 125                 ExecStart = "${self.defaultApp."${pkgs.system}".program} ${lib.escapeShellArgs args}";
 126                 User = cfg.user;
 127                 Group = cfg.group;
 128                 RuntimeDirectory = lib.optional (cfg.socket == defaultSock) "openarc";
 129                 PermissionsStartOnly = true;
 130               };
 131             };
 132           };
 133         };
 134     };
 135   }