flake reorg

Cargo.toml

@@ -1,18 +1,18 @@
 [package]
-name = "backup"
+name = "demostf-backup"
 version = "0.1.0"
 authors = ["Robin Appelman <robin@icewind.nl>"]
 edition = "2018"
 
 [dependencies]
-thiserror = "1.0.30"
+thiserror = "1.0.56"
-dotenv = "0.15.0"
+dotenvy = "0.15.7"
 main_error = "0.1.2"
-demostf-client = { version = "0.4.0", default-features = false, features = ["rustls-tls"] }
+demostf-client = { version = "0.4.3", default-features = false, features = ["rustls-tls"] }
-tokio = { version = "1.17.0", features = ["rt-multi-thread", "macros"] }
+tokio = { version = "1.35.1", features = ["rt-multi-thread", "macros"] }
-tracing = "0.1.33"
+tracing = "0.1.40"
-tracing-subscriber = "0.3.11"
+tracing-subscriber = "0.3.18"
-futures-util = "0.3.21"
+futures-util = "0.3.30"
 md5 = "0.7.0"
 
 [profile.release]

docker.nix

@@ -0,0 +1,12 @@
+{
+  dockerTools,
+  demostf-backup,
+}:
+dockerTools.buildImage {
+  name = "demostf/backup";
+  tag = "latest";
+  copyToRoot = [demostf-backup];
+  config = {
+    Cmd = ["${demostf-backup}/bin/demostf-backup"];
+  };
+}

flake.lock

@@ -1,61 +1,58 @@
 {
   "nodes": {
     "flake-utils": {
-      "locked": {
-        "lastModified": 1656065134,
-        "narHash": "sha256-oc6E6ByIw3oJaIyc67maaFcnjYOz1mMcOtHxbEf9NwQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "bee6a7250dd1b01844a2de7e02e4df7d8a0a206c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "naersk": {
       "inputs": {
-        "nixpkgs": [
+        "systems": "systems"
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1655042882,
+        "lastModified": 1701680307,
-        "narHash": "sha256-9BX8Fuez5YJlN7cdPO63InoyBy7dm3VlJkkmTt6fS1A=",
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "owner": "nix-community",
+        "owner": "numtide",
-        "repo": "naersk",
+        "repo": "flake-utils",
-        "rev": "cddffb5aa211f50c4b8750adbec0bbbdfb26bb9f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "numtide",
-        "repo": "naersk",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1685636445,
+        "lastModified": 1705183652,
-        "narHash": "sha256-Cw7qu994bLHRJNy8gsvcGSYHKFFwaGYiI35jcEpO4HI=",
+        "narHash": "sha256-rnfkyUH0x72oHfiSDhuCHDHg3gFgF+lF8zkkg5Zihsw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "08f66773ab4ad3ad1b63c54133397b2c8b0e69b8",
+        "rev": "428544ae95eec077c7f823b422afae5f174dee4b",
         "type": "github"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "release-23.05",
+        "ref": "nixos-23.11",
         "type": "indirect"
       }
     },
     "root": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "naersk": "naersk",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,140 +1,46 @@
 {
   inputs = {
-    nixpkgs.url = "nixpkgs/release-23.05";
+    nixpkgs.url = "nixpkgs/nixos-23.11";
     flake-utils.url = "github:numtide/flake-utils";
-    naersk.url = "github:nix-community/naersk";
-    naersk.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { self, nixpkgs, flake-utils, naersk }:
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+  }:
     flake-utils.lib.eachDefaultSystem (
       system: let
-        pkgs = nixpkgs.legacyPackages."${system}";
+        overlays = [
-        naersk-lib = naersk.lib."${system}";
+          (import ./overlay.nix)
-        lib = pkgs.lib;
+        ];
-      in
+        pkgs = (import nixpkgs) {
-        rec {
+          inherit system overlays;
-          # `nix build`
+        };
+      in rec {
         packages = rec {
-            demobackup = naersk-lib.buildPackage {
+          demostf-backup = pkgs.demostf-backup;
-              pname = "demobackup";
+          dockerImage = pkgs.callPackage ./docker.nix {};
-              root = lib.sources.sourceByRegex (lib.cleanSource ./.) ["Cargo.*" "src" "src/.*"];
+          default = demostf-backup;
         };
-            dockerImage = pkgs.dockerTools.buildImage {
-              name = "demostf/backup";
-              tag = "latest";
-              copyToRoot = [demobackup];
-              config = {
-                Cmd = [ "${demobackup}/bin/backup"];
-              };
-            };
-          };
-          defaultPackage = packages.demobackup;
 
-          # `nix run`
-          apps.hello-world = flake-utils.lib.mkApp {
-            drv = packages.demobackup;
-          };
-          defaultApp = apps.demobackup;
-
-          # `nix develop`
         devShells.default = pkgs.mkShell {
-            nativeBuildInputs = with pkgs; [ rustc cargo rustfmt clippy ];
+          nativeBuildInputs = with pkgs; [rustc cargo rustfmt clippy cargo-edit cargo-audit bacon];
         };
       }
     )
     // {
-      nixosModule = {
+      overlays.default = import ./overlay.nix;
+      nixosModules.default = {
+        pkgs,
         config,
         lib,
-        pkgs,
         ...
-      }:
+      }: {
-        with lib; let
+        imports = [./module.nix];
-          cfg = config.services.demosbackup;
+        config = lib.mkIf config.services.demostf-backup.enable {
-        in {
+          nixpkgs.overlays = [self.overlays.default];
-          options.services.demosbackup = {
+          services.demostf-backup.package = lib.mkDefault pkgs.demostf-backup;
-            enable = mkEnableOption "Enables the demos backup service";
-
-            target = mkOption {
-              type = types.str;
-              description = "target directory";
-            };
-            api = mkOption {
-              type = types.str;
-              default = "https://api.demos.tf";
-              description = "demos.tf api url";
-            };
-            stateFile = mkOption {
-              type = types.str;
-              description = "state file path";
-            };
-            logLevel = mkOption {
-              type = types.str;
-              default = "INFO";
-              description = "log level";
-            };
-            user = mkOption {
-              type = types.str;
-              description = "user that owns the demos";
-            };
-            interval = mkOption {
-              type = types.str;
-              default = "*:0/10";
-              description = "Interval to run the service";
-            };
-          };
-
-          config = mkIf cfg.enable {
-            systemd.services.demosbackup = let
-              pkg = self.defaultPackage.${pkgs.system};
-            in {
-              script = "${pkg}/bin/backup";
-              description = "Backup demos for demos.tf";
-
-              environment = {
-                STORAGE_ROOT = cfg.target;
-                SOURCE = cfg.api;
-                STATE_FILE = cfg.stateFile;
-                RUST_LOG = cfg.logLevel;
-              };
-
-              serviceConfig = {
-                ReadWritePaths = [cfg.target cfg.stateFile];
-                Restart = "on-failure";
-                User = cfg.user;
-                PrivateTmp = true;
-                ProtectSystem = "strict";
-                ProtectHome = true;
-                NoNewPrivileges = true;
-                PrivateDevices = true;
-                ProtectClock = true;
-                CapabilityBoundingSet = true;
-                ProtectKernelLogs = true;
-                ProtectControlGroups = true;
-                SystemCallArchitectures = "native";
-                ProtectKernelModules = true;
-                RestrictNamespaces = true;
-                MemoryDenyWriteExecute = true;
-                ProtectHostname = true;
-                LockPersonality = true;
-                ProtectKernelTunables = true;
-                RestrictAddressFamilies = "AF_INET AF_INET6";
-                RestrictRealtime = true;
-                ProtectProc = "noaccess";
-                SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
-                IPAddressDeny = "localhost link-local multicast";
-              };
-            };
-
-            systemd.timers.demosbackup = {
-              enable = true;
-              description = "Backup demos for demos.tf";
-              wantedBy = ["multi-user.target"];
-              timerConfig = {
-                OnCalendar = "*:0/10";
-              };
-            };
         };
       };
     };

module.nix

@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.services.demostf-backup;
+in {
+  options.services.demostf-backup = {
+    enable = mkEnableOption "Enables the demos backup service";
+
+    target = mkOption {
+      type = types.str;
+      description = "target directory";
+    };
+    api = mkOption {
+      type = types.str;
+      default = "https://api.demos.tf";
+      description = "demos.tf api url";
+    };
+    stateFile = mkOption {
+      type = types.str;
+      description = "state file path";
+    };
+    logLevel = mkOption {
+      type = types.str;
+      default = "INFO";
+      description = "log level";
+    };
+    user = mkOption {
+      type = types.str;
+      description = "user that owns the demos";
+    };
+    interval = mkOption {
+      type = types.str;
+      default = "*:0/10";
+      description = "Interval to run the service";
+    };
+
+    package = mkOption {
+      type = types.package;
+      defaultText = literalExpression "pkgs.demostf-backup";
+      description = "package to use";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.demostf-backup = {
+      description = "Backup demos for demos.tf";
+
+      environment = {
+        STORAGE_ROOT = cfg.target;
+        SOURCE = cfg.api;
+        STATE_FILE = cfg.stateFile;
+        RUST_LOG = cfg.logLevel;
+      };
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/demostf-backup";
+        ReadWritePaths = [cfg.target cfg.stateFile];
+        Restart = "on-failure";
+        User = cfg.user;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        CapabilityBoundingSet = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        SystemCallArchitectures = "native";
+        ProtectKernelModules = true;
+        RestrictNamespaces = true;
+        MemoryDenyWriteExecute = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        RestrictRealtime = true;
+        ProtectProc = "noaccess";
+        SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
+        IPAddressDeny = "localhost link-local multicast";
+      };
+    };
+
+    systemd.timers.demostf-backup = {
+      enable = true;
+      description = "Backup demos for demos.tf";
+      wantedBy = ["multi-user.target"];
+      timerConfig = {
+        OnCalendar = "*:0/10";
+      };
+    };
+  };
+}

overlay.nix

@@ -0,0 +1,3 @@
+final: prev: {
+  demostf-backup = final.callPackage ./package.nix {};
+}

package.nix

@@ -0,0 +1,18 @@
+{
+  stdenv,
+  rustPlatform,
+  lib,
+}: let
+  inherit (lib.sources) sourceByRegex;
+  src = sourceByRegex ./. ["Cargo.*" "(src)(/.*)?"];
+in
+  rustPlatform.buildRustPackage rec {
+    pname = "demostf-backup";
+    version = "0.1.0";
+
+    inherit src;
+
+    cargoLock = {
+      lockFile = ./Cargo.lock;
+    };
+  }

src/main.rs

@@ -26,7 +26,7 @@ pub enum Error {
 async fn main() -> Result<(), MainError> {
     tracing_subscriber::fmt::init();
 
-    let mut args: HashMap<_, _> = dotenv::vars().collect();
+    let mut args: HashMap<_, _> = dotenvy::vars().collect();
     let store = Store::new(args.get("STORAGE_ROOT").expect("no STORAGE_ROOT set"));
     let state_path = PathBuf::from(args.remove("STATE_FILE").expect("no STATE_FILE set"));
     let backup = Backup::new(store);