From 28ba46ec1ade360fbc77fc1102ee68b909697539 Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Sun, 8 Feb 2026 20:10:05 +0100 Subject: [PATCH] nix setup --- .envrc | 1 + .gitignore | 3 +- flake.lock | 107 ++++++++++++++++++++++++++++++++++++++++ flake.nix | 30 ++++++++++++ nix/module.nix | 126 ++++++++++++++++++++++++++++++++++++++++++++++++ nix/overlay.nix | 3 ++ nix/package.nix | 31 ++++++++++++ src/main.rs | 1 + 8 files changed, 301 insertions(+), 1 deletion(-) create mode 100644 .envrc create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 nix/module.nix create mode 100644 nix/overlay.nix create mode 100644 nix/package.nix diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..3550a30 --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use flake diff --git a/.gitignore b/.gitignore index 0b745e2..99c3d48 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /target -.env \ No newline at end of file +.env +result \ No newline at end of file diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..37259bc --- /dev/null +++ b/flake.lock @@ -0,0 +1,107 @@ +{ + "nodes": { + "crane": { + "locked": { + "lastModified": 1763938834, + "narHash": "sha256-j8iB0Yr4zAvQLueCZ5abxfk6fnG/SJ5JnGUziETjwfg=", + "owner": "ipetkov", + "repo": "crane", + "rev": "d9e753122e51cee64eb8d2dddfe11148f339f5a2", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, + "flakelight": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1770037869, + "narHash": "sha256-ydw7wUkviUdv7J7YweFp6kxXl24QJgJ1+NC5S02gkz0=", + "owner": "nix-community", + "repo": "flakelight", + "rev": "49027dc3f2426de7cb2a6e29a13bbdd824f9b73a", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "flakelight", + "type": "github" + } + }, + "mill-scale": { + "inputs": { + "crane": "crane", + "flakelight": [ + "flakelight" + ], + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1764619631, + "narHash": "sha256-WojMP5S9qLmOLecEQ+7+yc33Ly1ydoRsODNG6hlLqiQ=", + "ref": "refs/heads/main", + "rev": "0fae557bf52d8493840aca52d433c473ecc305ef", + "revCount": 67, + "type": "git", + "url": "https://codeberg.org/icewind/mill-scale.git" + }, + "original": { + "type": "git", + "url": "https://codeberg.org/icewind/mill-scale.git" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1770464364, + "narHash": "sha256-z5NJPSBwsLf/OfD8WTmh79tlSU8XgIbwmk6qB1/TFzY=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "23d72dabcb3b12469f57b37170fcbc1789bd7457", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-25.11", + "type": "indirect" + } + }, + "root": { + "inputs": { + "flakelight": "flakelight", + "mill-scale": "mill-scale", + "nixpkgs": "nixpkgs" + } + }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "mill-scale", + "flakelight", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1764557621, + "narHash": "sha256-kX5PoY8hQZ80+amMQgOO9t8Tc1JZ70gYRnzaVD4AA+o=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "93316876c2229460a5d6f5f052766cc4cef538ce", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..4cf1dbf --- /dev/null +++ b/flake.nix @@ -0,0 +1,30 @@ +{ + inputs = { + nixpkgs.url = "nixpkgs/nixos-25.11"; + flakelight = { + url = "github:nix-community/flakelight"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + mill-scale = { + url = "git+https://codeberg.org/icewind/mill-scale.git"; + inputs.flakelight.follows = "flakelight"; + }; + }; + outputs = {mill-scale, ...}: + mill-scale ./. { + nixosModules = {outputs, ...}: { + default = { + pkgs, + config, + lib, + ... + }: { + imports = [./nix/module.nix]; + config = lib.mkIf config.services.demostf-cleanup.enable { + nixpkgs.overlays = [outputs.overlays.default]; + services.demostf-cleanup.package = lib.mkDefault pkgs.demostf-cleanup; + }; + }; + }; + }; +} diff --git a/nix/module.nix b/nix/module.nix new file mode 100644 index 0000000..1f87f00 --- /dev/null +++ b/nix/module.nix @@ -0,0 +1,126 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.services.demostf-cleanup; + format = pkgs.formats.toml {}; + configFile = format.generate "demostf-cleanup.toml" { + api = { + url = cfg.source; + key_file = "$CREDENTIALS_DIRECTORY/api_key"; + }; + storage = { + root = cfg.storageRoot; + }; + cleanup = { + from_backend = cfg.backend; + age = cfg.age; + }; + }; +in { + options.services.demostf-cleanup = { + enable = mkEnableOption "demostf-cleanup"; + + source = mkOption { + type = types.str; + default = "https://api.demos.tf"; + description = "Api endpoint to cleanup demos for"; + }; + + storageRoot = mkOption { + type = types.str; + description = "path local demo files are stored at"; + }; + + backend = mkOption { + type = types.str; + description = "name of the local demos backend"; + }; + + age = mkOption { + type = types.int; + default = 157784629; # 5 years + description = "age of demos to cleanup"; + }; + + keyFile = mkOption { + type = types.str; + description = "path containing the edit secret"; + }; + + user = mkOption { + type = types.str; + description = "user that owns the local demos"; + }; + + log = mkOption { + type = types.str; + default = "info"; + description = "log level"; + }; + + interval = mkOption { + type = types.str; + default = "*:0/10"; + description = "how often to run"; + }; + + package = mkOption { + type = types.package; + defaultText = literalExpression "pkgs.demostf-cleanup"; + description = "package to use"; + }; + }; + + config = mkIf cfg.enable { + systemd.services."demostf-cleanup" = { + environment = { + RUST_LOG = cfg.log; + }; + + serviceConfig = { + ExecStart = "${getExe cfg.package} ${configFile}"; + ReadWritePaths = [cfg.storageRoot]; + LoadCredential = [ + "api_key:${cfg.keyFile}" + ]; + Restart = "on-failure"; + User = cfg.user; + PrivateTmp = true; + ProtectSystem = "strict"; + ProtectHome = true; + NoNewPrivileges = true; + PrivateDevices = true; + ProtectClock = true; + CapabilityBoundingSet = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + SystemCallArchitectures = "native"; + ProtectKernelModules = true; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectHostname = true; + LockPersonality = true; + ProtectKernelTunables = true; + RestrictAddressFamilies = ["AF_INET" "AF_INET6"]; + RestrictRealtime = true; + ProtectProc = "noaccess"; + SystemCallFilter = ["@system-service" "~@resources" "~@privileged"]; + IPAddressDeny = ["localhost" "link-local" "multicast"]; + ProcSubset = "pid"; + }; + }; + + systemd.timers."demostf-cleanup" = { + enable = true; + description = "Cleanup demos for demos.tf"; + wantedBy = ["multi-user.target"]; + timerConfig = { + OnCalendar = cfg.interval; + }; + }; + }; +} diff --git a/nix/overlay.nix b/nix/overlay.nix new file mode 100644 index 0000000..248d865 --- /dev/null +++ b/nix/overlay.nix @@ -0,0 +1,3 @@ +final: prev: { + demostf-cleanup = final.callPackage ./package.nix {}; +} diff --git a/nix/package.nix b/nix/package.nix new file mode 100644 index 0000000..856f163 --- /dev/null +++ b/nix/package.nix @@ -0,0 +1,31 @@ +{ + rustPlatform, + lib, + openssl, + pkg-config, +}: let + inherit (lib.sources) sourceByRegex; + inherit (builtins) fromTOML readFile; + src = sourceByRegex ../. ["Cargo.*" "(src)(/.*)?"]; + cargoPackage = (fromTOML (readFile ../Cargo.toml)).package; +in + rustPlatform.buildRustPackage { + pname = cargoPackage.name; + inherit (cargoPackage) version; + + inherit src; + + buildInputs = [ + openssl + ]; + + nativeBuildInputs = [ + pkg-config + ]; + + cargoLock = { + lockFile = ../Cargo.lock; + }; + + meta.mainProgram = "cleanup"; + } diff --git a/src/main.rs b/src/main.rs index 62eeb9d..39be64d 100644 --- a/src/main.rs +++ b/src/main.rs @@ -4,6 +4,7 @@ use crate::config::Config; use clap::Parser; use demostf_client::{ApiClient, ListOrder, ListParams}; use main_error::MainError; +use secretfile::load; use std::fs::remove_file; use std::path::PathBuf; use time::{Duration, OffsetDateTime};