mirror of
https://codeberg.org/icewind/palantir.git
synced 2026-06-03 10:14:09 +02:00
flake reorg
This commit is contained in:
parent
898737eea8
commit
bc6b1b1c8f
4 changed files with 177 additions and 125 deletions
160
flake.nix
160
flake.nix
|
|
@ -21,7 +21,10 @@
|
|||
cross-naersk,
|
||||
}:
|
||||
utils.lib.eachDefaultSystem (system: let
|
||||
overlays = [ (import rust-overlay) ];
|
||||
overlays = [
|
||||
(import rust-overlay)
|
||||
(import ./overlay.nix)
|
||||
];
|
||||
pkgs = import nixpkgs {
|
||||
inherit system overlays;
|
||||
};
|
||||
|
|
@ -44,34 +47,31 @@
|
|||
|
||||
cross-naersk' = pkgs.callPackage cross-naersk {inherit naersk;};
|
||||
|
||||
addUdev = ''
|
||||
mkdir -p $out/lib/udev/rules.d/
|
||||
echo 'SUBSYSTEM=="powercap", ACTION=="add", RUN+="${pkgs.coreutils-full}/bin/chgrp -R powermonitoring /sys%p", RUN+="${pkgs.coreutils-full}/bin/chmod -R g=u /sys%p"' >> $out/lib/udev/rules.d/51-palantir.rules
|
||||
echo 'SUBSYSTEM=="powercap", ACTION=="change", ENV{TRIGGER}!="none", RUN+="${pkgs.coreutils-full}/bin/chgrp -R powermonitoring /sys%p", RUN+="${pkgs.coreutils-full}/bin/chmod -R g=u /sys%p"' >> $out/lib/udev/rules.d/51-palantir.rules
|
||||
'';
|
||||
|
||||
src = lib.sources.sourceByRegex (lib.cleanSource ./.) ["Cargo.*" "(src|benches)(/.*)?"];
|
||||
|
||||
nearskOpt = {
|
||||
pname = "palantir";
|
||||
root = src;
|
||||
|
||||
postInstall = addUdev;
|
||||
postInstall = pkgs.palantir.postInstall;
|
||||
};
|
||||
buildTarget = target: (cross-naersk'.buildPackage target) nearskOpt;
|
||||
hostNaersk = cross-naersk'.hostNaersk;
|
||||
in rec {
|
||||
# `nix build`
|
||||
packages = nixpkgs.lib.attrsets.genAttrs targets buildTarget // rec {
|
||||
palantir = packages.${hostTarget};
|
||||
check = hostNaersk.buildPackage (nearskOpt // {
|
||||
mode = "check";
|
||||
});
|
||||
clippy = hostNaersk.buildPackage (nearskOpt // {
|
||||
mode = "clippy";
|
||||
});
|
||||
default = palantir;
|
||||
};
|
||||
packages =
|
||||
nixpkgs.lib.attrsets.genAttrs targets buildTarget
|
||||
// rec {
|
||||
palantir = pkgs.palantir;
|
||||
check = hostNaersk.buildPackage (nearskOpt
|
||||
// {
|
||||
mode = "check";
|
||||
});
|
||||
clippy = hostNaersk.buildPackage (nearskOpt
|
||||
// {
|
||||
mode = "clippy";
|
||||
});
|
||||
default = palantir;
|
||||
};
|
||||
|
||||
apps.palantir = utils.lib.mkApp {
|
||||
drv = packages.palantir;
|
||||
|
|
@ -80,11 +80,13 @@
|
|||
|
||||
inherit targets;
|
||||
releaseMatrix = {
|
||||
include = builtins.map (target: {
|
||||
inherit target;
|
||||
artifact_name = artifactForTarget target;
|
||||
asset_name = assetNameForTarget target;
|
||||
}) releaseTargets;
|
||||
include =
|
||||
builtins.map (target: {
|
||||
inherit target;
|
||||
artifact_name = artifactForTarget target;
|
||||
asset_name = assetNameForTarget target;
|
||||
})
|
||||
releaseTargets;
|
||||
};
|
||||
|
||||
# `nix develop`
|
||||
|
|
@ -95,110 +97,18 @@
|
|||
};
|
||||
})
|
||||
// {
|
||||
nixosModule = {
|
||||
overlays = import ./overlay.nix;
|
||||
modules.default = {
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.palantir.services.palantir;
|
||||
in {
|
||||
options.palantir.services.palantir = {
|
||||
enable = mkEnableOption "Enables the palantir service";
|
||||
|
||||
port = mkOption rec {
|
||||
type = types.int;
|
||||
default = 5665;
|
||||
example = default;
|
||||
description = "The port to listen on";
|
||||
};
|
||||
|
||||
zfs = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "enable zfs integration";
|
||||
};
|
||||
|
||||
docker = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "enable docker integration";
|
||||
};
|
||||
|
||||
mdns = mkOption rec {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
example = true;
|
||||
description = "enable mdns discovery";
|
||||
};
|
||||
|
||||
openPort = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "open port";
|
||||
};
|
||||
|
||||
openMDNSPort = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "open mdns port";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = lib.optional cfg.openPort cfg.port;
|
||||
networking.firewall.allowedUDPPorts = lib.optional cfg.openMDNSPort 5353;
|
||||
|
||||
users.groups.powermonitoring = {};
|
||||
|
||||
services.udev.packages = [self.packages.${pkgs.system}.default];
|
||||
|
||||
systemd.services."palantir" = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = lib.optional cfg.zfs pkgs.zfs;
|
||||
environment = {
|
||||
PORT = "${toString cfg.port}";
|
||||
LD_LIBRARY_PATH = "/run/opengl-driver/lib/"; # needed for nvidia
|
||||
} // (if (cfg.mdns == false) then {
|
||||
DISABLE_MDNS = "true";
|
||||
} else {});
|
||||
|
||||
serviceConfig = let
|
||||
pkg = self.packages.${pkgs.system}.default;
|
||||
in {
|
||||
Restart = "on-failure";
|
||||
ExecStart = "${pkg}/bin/palantir";
|
||||
DynamicUser = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectClock = !cfg.zfs; # Enabling this breaks libzfs
|
||||
CapabilityBoundingSet = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
SystemCallArchitectures = "native";
|
||||
ProtectKernelModules = true;
|
||||
RestrictNamespaces = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
ProtectHostname = true;
|
||||
LockPersonality = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"] ++ lib.optional cfg.docker "AF_UNIX"; # netlink is required to make `getifaddrs` not err
|
||||
RestrictRealtime = true;
|
||||
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
|
||||
IPAddressAllow = ["localhost"] ++ lib.optional cfg.mdns "multicast";
|
||||
UMask = "0077";
|
||||
SupplementaryGroups = ["powermonitoring"] ++ lib.optional cfg.docker "docker";
|
||||
};
|
||||
};
|
||||
};
|
||||
}: {
|
||||
imports = [./module.nix];
|
||||
config = lib.mkIf config.services.palantir.enable {
|
||||
nixpkgs.overlays = [self.overlays.default];
|
||||
services.palantir.package = lib.mkDefault pkgs.palantir;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
114
module.nix
Normal file
114
module.nix
Normal file
|
|
@ -0,0 +1,114 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.palantir.services.palantir;
|
||||
in {
|
||||
options.palantir.services.palantir = {
|
||||
enable = mkEnableOption "Enables the palantir service";
|
||||
|
||||
port = mkOption rec {
|
||||
type = types.int;
|
||||
default = 5665;
|
||||
example = default;
|
||||
description = "The port to listen on";
|
||||
};
|
||||
|
||||
zfs = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "enable zfs integration";
|
||||
};
|
||||
|
||||
docker = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "enable docker integration";
|
||||
};
|
||||
|
||||
mdns = mkOption rec {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
example = true;
|
||||
description = "enable mdns discovery";
|
||||
};
|
||||
|
||||
openPort = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "open port";
|
||||
};
|
||||
|
||||
openMDNSPort = mkOption rec {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = "open mdns port";
|
||||
};
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
description = "package to use";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = lib.optional cfg.openPort cfg.port;
|
||||
networking.firewall.allowedUDPPorts = lib.optional cfg.openMDNSPort 5353;
|
||||
|
||||
users.groups.powermonitoring = {};
|
||||
|
||||
services.udev.packages = [cfg.package];
|
||||
|
||||
systemd.services."palantir" = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = lib.optional cfg.zfs pkgs.zfs;
|
||||
environment =
|
||||
{
|
||||
PORT = "${toString cfg.port}";
|
||||
LD_LIBRARY_PATH = "/run/opengl-driver/lib/"; # needed for nvidia
|
||||
}
|
||||
// (
|
||||
if (cfg.mdns == false)
|
||||
then {
|
||||
DISABLE_MDNS = "true";
|
||||
}
|
||||
else {}
|
||||
);
|
||||
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
ExecStart = "${cfg.package}/bin/palantir";
|
||||
DynamicUser = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectClock = !cfg.zfs; # Enabling this breaks libzfs
|
||||
CapabilityBoundingSet = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
SystemCallArchitectures = "native";
|
||||
ProtectKernelModules = true;
|
||||
RestrictNamespaces = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
ProtectHostname = true;
|
||||
LockPersonality = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"] ++ lib.optional cfg.docker "AF_UNIX"; # netlink is required to make `getifaddrs` not err
|
||||
RestrictRealtime = true;
|
||||
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
|
||||
IPAddressAllow = ["localhost"] ++ lib.optional cfg.mdns "multicast";
|
||||
UMask = "0077";
|
||||
SupplementaryGroups = ["powermonitoring"] ++ lib.optional cfg.docker "docker";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
3
overlay.nix
Normal file
3
overlay.nix
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
final: prev: {
|
||||
palantir = final.callPackage ./package.nix {};
|
||||
}
|
||||
25
package.nix
Normal file
25
package.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
stdenv,
|
||||
rustPlatform,
|
||||
coreutils,
|
||||
lib,
|
||||
}: let
|
||||
inherit (lib.sources) sourceByRegex;
|
||||
src = sourceByRegex ./. ["Cargo.*" "(src|benches)(/.*)?"];
|
||||
in
|
||||
rustPlatform.buildRustPackage rec {
|
||||
name = "palantir";
|
||||
version = "0.1.0";
|
||||
|
||||
inherit src;
|
||||
|
||||
cargoLock = {
|
||||
lockFile = ./Cargo.lock;
|
||||
};
|
||||
|
||||
postInstall = ''
|
||||
mkdir -p $out/lib/udev/rules.d/
|
||||
echo 'SUBSYSTEM=="powercap", ACTION=="add", RUN+="${coreutils}/bin/chgrp -R powermonitoring /sys%p", RUN+="${coreutils}/bin/chmod -R g=u /sys%p"' >> $out/lib/udev/rules.d/51-palantir.rules
|
||||
echo 'SUBSYSTEM=="powercap", ACTION=="change", ENV{TRIGGER}!="none", RUN+="${coreutils}/bin/chgrp -R powermonitoring /sys%p", RUN+="${coreutils}/bin/chmod -R g=u /sys%p"' >> $out/lib/udev/rules.d/51-palantir.rules
|
||||
'';
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue