robin/haze
1
0
Fork 0
mirror of https://codeberg.org/icewind/haze.git synced 2026-08-02 04:04:44 +02:00
Code Issues Projects Releases Wiki Activity

switch to nix2container for image building

Browse source
This commit is contained in:
Robin Appelman 2026-06-21 14:54:13 +02:00
commit 3f15ab0551
4 changed files with 230 additions and 142 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.forgejo/workflows/docker.yaml
View file

@ -37,5 +37,4 @@ jobs:
- name: Push image
if: github.ref == 'refs/heads/main'
run: |
skopeo copy --insecure-policy --dest-creds="${{ secrets.DOCKER_USERNAME }}:${{ secrets.DOCKER_PASSWORD }}" \
"docker-archive:$(nix build .#'"haze-image-php-${{ matrix.php-version }}"' --print-out-paths)" "docker://icewind1991/haze:${{ matrix.php-version }}"
nix run .#'"haze-image-php-${{ matrix.php-version }}"'.copyToRegistry -- --dest-creds="${{ secrets.DOCKER_USERNAME }}:${{ secrets.DOCKER_PASSWORD }}"

67
flake.lock generated
View file

@ -2,11 +2,11 @@
"nodes": {
"crane": {
"locked": {
"lastModified": 1763938834,
"narHash": "sha256-j8iB0Yr4zAvQLueCZ5abxfk6fnG/SJ5JnGUziETjwfg=",
"lastModified": 1780099841,
"narHash": "sha256-EVZd2RsbpreRUDSi9rBwPY+ZxoyMaiEBbZxxhljbaS4=",
"owner": "ipetkov",
"repo": "crane",
"rev": "d9e753122e51cee64eb8d2dddfe11148f339f5a2",
"rev": "0532eb17955225173906d671fb36306bdeb1e2dc",
"type": "github"
},
"original": {
@ -38,11 +38,11 @@
]
},
"locked": {
"lastModified": 1773062095,
"narHash": "sha256-u+cK9IoJokO4YzQwMc2s8Vti0RL/LVSrROOEn2opc5U=",
"lastModified": 1781543995,
"narHash": "sha256-wsSyxNWOSMofu4F5xGYGMrB1d8cepvBNhxhm9bGGmXg=",
"owner": "nix-community",
"repo": "flakelight",
"rev": "c99e4d5f40e578cb2d8f460ea2bbd5dc26316d24",
"rev": "fd1d557721e07b5a9d319442e4bcb5d286600011",
"type": "github"
},
"original": {
@ -60,11 +60,11 @@
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1772297202,
"narHash": "sha256-UEzHO/tCmhPhr8RpWtbm1MTa7ABobwt3nCjrcuDAPm0=",
"lastModified": 1780231986,
"narHash": "sha256-OyafczPtzE0Xa2zl3j/KvV2+ZVYGhYQHt0MOVWtDXlY=",
"ref": "refs/heads/main",
"rev": "8690e1514863b934de12f2a503c9431d186ce30b",
"revCount": 68,
"rev": "f5cbda29b945df03256bf63c22fa4cd5fa429e67",
"revCount": 72,
"type": "git",
"url": "https://codeberg.org/icewind/mill-scale.git"
},
@ -73,28 +73,48 @@
"url": "https://codeberg.org/icewind/mill-scale.git"
}
},
"nix2container": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1775487831,
"narHash": "sha256-2lguQpLPQaxpQCJjXhmEEAfabwsAhkP29Z7fgLzHARA=",
"owner": "nlewo",
"repo": "nix2container",
"rev": "76be9608a7f4d6c985d28b0e7be903ae2547df3e",
"type": "github"
},
"original": {
"owner": "nlewo",
"repo": "nix2container",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1772822230,
"narHash": "sha256-yf3iYLGbGVlIthlQIk5/4/EQDZNNEmuqKZkQssMljuw=",
"lastModified": 1781216227,
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "71caefce12ba78d84fe618cf61644dce01cf3a96",
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
"type": "github"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-25.11",
"ref": "nixos-26.05",
"type": "indirect"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1772173633,
"narHash": "sha256-MOH58F4AIbCkh6qlQcwMycyk5SWvsqnS/TCfnqDlpj4=",
"lastModified": 1781268102,
"narHash": "sha256-Zn5KTggEmUB3lXn/ccERNcBdddE6IaOFber9dWViWDg=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c0f3d81a7ddbc2b1332be0d8481a672b4f6004d6",
"rev": "49a4bd0573c376468dd7996ddb6f9fa31d8c4d97",
"type": "github"
},
"original": {
@ -111,11 +131,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1772365008,
"narHash": "sha256-/ynkWKeZ1dyRIUkQas0AB35semWAwCbTKXu+/q+8MGg=",
"lastModified": 1781456983,
"narHash": "sha256-z3SNuQpkSeIRTS6Y/Q5FgGAuGSY5+YJBXtqWPXw0f0k=",
"owner": "fossar",
"repo": "nix-phps",
"rev": "f47eb877bf1c219809e4357eec2fdab8e3263b7b",
"rev": "6458735dece7e48f27d52ac68eee2d2cfe55b79a",
"type": "github"
},
"original": {
@ -128,6 +148,7 @@
"inputs": {
"flakelight": "flakelight",
"mill-scale": "mill-scale",
"nix2container": "nix2container",
"nixpkgs": "nixpkgs",
"phps": "phps"
}
@ -141,11 +162,11 @@
]
},
"locked": {
"lastModified": 1764557621,
"narHash": "sha256-kX5PoY8hQZ80+amMQgOO9t8Tc1JZ70gYRnzaVD4AA+o=",
"lastModified": 1780197589,
"narHash": "sha256-FVCr2Ij/jKf59a4LW481eeOF6rJRreOBrVgW/aUBTrw=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "93316876c2229460a5d6f5f052766cc4cef538ce",
"rev": "21632e942d89bf1cce4e5a63d7e58a215a0cbfcc",
"type": "github"
},
"original": {

35
flake.nix
View file

@ -1,6 +1,6 @@
{
inputs = {
nixpkgs.url = "nixpkgs/nixos-25.11";
nixpkgs.url = "nixpkgs/nixos-26.05";
flakelight = {
url = "github:nix-community/flakelight";
inputs.nixpkgs.follows = "nixpkgs";
@ -12,8 +12,14 @@
phps = {
url = "github:fossar/nix-phps";
};
nix2container = {
url = "github:nlewo/nix2container";
inputs.nixpkgs.follows = "nixpkgs";
};
outputs = {
};
outputs =
{
nix2container,
mill-scale,
phps,
...
@ -36,8 +42,17 @@
withOverlays = [
(import ./nix/overlay.nix)
(prev: final: {
(final: prev: {
inherit (phps.packages.${prev.system}) php81 php80;
inherit (nix2container.packages.x86_64-linux) nix2container;
blackfire = prev.blackfire.overrideAttrs (
oldAttrs: finalAttrs: {
src = final.fetchurl {
url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${finalAttrs.version}_amd64.deb";
sha256 = "sha256-1fswfZEElLyXWqvNW76BpKTpBomK9cglJtitZgcpxhM=";
};
}
);
})
];
@ -50,15 +65,23 @@
"haze-image-php-8.0" = pkgs: pkgs.haze-image-php-80;
};
tools = pkgs: with pkgs; [cargo-edit bacon skopeo];
tools =
pkgs: with pkgs; [
cargo-edit
bacon
skopeo
dive
];
homeModules = {
default = {
default =
{
pkgs,
config,
lib,
...
}: {
}:
{
imports = [ ./nix/hm-module.nix ];
config = lib.mkIf config.programs.haze.enable {
programs.haze.package = lib.mkDefault pkgs.haze;

115
nix/image/haze.nix
View file

@ -36,9 +36,19 @@
dnsmasq,
frankenphp,
nushell,
}: let
nix2container,
buildEnv,
}:
let
inherit (builtins) toString compareVersions;
inherit (lib) readFile getExe concatStringsSep splitString take optionals;
inherit (lib)
readFile
getExe
concatStringsSep
splitString
take
optionals
;
version = (fromTOML (readFile ../../Cargo.toml)).package.version;
@ -51,7 +61,7 @@
text = dockerTools.shadowSetup;
};
tmpDir = runCommand "tmp-dir" {} ''
baseDirs = runCommand "tmp-dir" { } ''
mkdir -p $out/tmp
mkdir -p $out/var/cache/nginx
mkdir -p $out/var/log/nginx
@ -65,7 +75,8 @@
'';
configs = callPackage ./configs.nix { };
scripts = callPackage ./scripts.nix { };
phpunitUnwrapped = majorVersion:
phpunitUnwrapped =
majorVersion:
callPackage ./phpunit.nix {
inherit majorVersion;
php = phpEnv;
@ -108,11 +119,7 @@
cp -r ${configs/clamav} $out/etc/clamav
'';
baseImage = dockerTools.buildImage {
name = "icewind1991/haze-base";
tag = phpVersion;
copyToRoot = [
basePackages = [
dockerTools.caCertificates
dockerTools.usrBinEnv
bash
@ -142,53 +149,91 @@
dnsmasq
nushell
getent
clamav-data
];
};
phpImage = dockerTools.buildImage {
name = "icewind1991/haze-php";
tag = phpVersion;
fromImage = baseImage;
copyToRoot =
[
phpPackages = [
phpEnv
phpEnv.packages.composer
phpunit
]
++ optionals ((compareVersions phpVersion "8.2") == 1) [
(frankenphp.override {
php = php.withExtensions (import ./php-ext.nix {
php = php.withExtensions (
import ./php-ext.nix {
inherit lib php;
enableBlackfire = false;
});
}
);
})
];
};
# https://blog.eigenvalue.net/2023-nix2container-everything-once/
foldImageLayers =
let
mergeToLayer =
priorLayers: component:
assert builtins.isList priorLayers;
assert builtins.isAttrs component;
let
layer = nix2container.buildLayer (
component
// {
layers = priorLayers;
}
);
in
dockerTools.buildLayeredImage {
priorLayers ++ [ layer ];
in
layers: lib.foldl mergeToLayer [ ] layers;
in
nix2container.buildImage {
name = "icewind1991/haze";
tag = phpVersion;
maxLayers = 5;
fromImage = phpImage;
contents = [
tmpDir
layers = foldImageLayers [
{
copyToRoot = buildEnv {
name = "base";
paths = basePackages;
pathsToLink = [
"/bin"
"/sbin"
"/etc"
"/usr"
"/conf"
];
};
}
{
copyToRoot = buildEnv {
name = "php";
paths = phpPackages;
pathsToLink = [ "/bin" ];
};
}
{
copyToRoot = [
baseDirs
bootstrap
configs
scripts
certificates
clamav-data
shadowSetupScript
];
fakeRootCommands = ''
chmod 1777 tmp
chmod 1777 var/tmp
chmod 1777 var/run
chmod 1777 var/log/nginx
chmod 1777 var/cache/nginx
chmod 1777 var/spool
chmod -R 0755 etc/nc
'';
perms = [
{
path = baseDirs;
regex = "/tmp|var/(tmp|run|log/nginx|cache/nginx|spool)";
mode = "0777";
}
{
path = baseDirs;
regex = "/etc/nc";
mode = "0755";
}
];
}
];
config = {
Cmd = [ (getExe bootstrap) ];
Env = [