danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mod: merge shb functions into lib

Browse source
This commit is contained in:
ibizaman 2025-10-13 00:15:08 +02:00 committed by Pierre Penninckx
parent 283e12d87d
commit 6e64c7f8cf
25 changed files with 119 additions and 135 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
demo/homeassistant/flake.nix
View file

@ -10,7 +10,7 @@
let
system = "x86_64-linux";
nixpkgs' = selfhostblocks.lib.${system}.patchedNixpkgs;
nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix";
inherit (selfhostblocks.lib.${system}) pkgs;
basic = { config, ... }: {
imports = [
@ -96,7 +96,7 @@
in
{
nixosConfigurations = {
basic = nixosSystem' {
basic = pkgs.nixosSystem {
system = "x86_64-linux";
modules = [
basic
@ -104,7 +104,7 @@
];
};
ldap = nixosSystem' {
ldap = pkgs.nixosSystem {
system = "x86_64-linux";
modules = [
basic

8
demo/nextcloud/flake.nix
View file

@ -10,7 +10,7 @@
let
system = "x86_64-linux";
nixpkgs' = selfhostblocks.lib.${system}.patchedNixpkgs;
nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix";
inherit (selfhostblocks.lib.${system}) pkgs;
basic = { config, ... }: {
imports = [
@ -164,14 +164,14 @@
in
{
nixosConfigurations = {
basic = nixosSystem' {
basic = pkgs.nixosSystem {
system = "x86_64-linux";
modules = [
sopsConfig
basic
];
};
ldap = nixosSystem' {
ldap = pkgs.nixosSystem {
system = "x86_64-linux";
modules = [
sopsConfig
@ -179,7 +179,7 @@
ldap
];
};
sso = nixosSystem' {
sso = pkgs.nixosSystem {
system = "x86_64-linux";
modules = [
sopsConfig

1
docs/service-implementation-guide.md
View file

@ -71,7 +71,6 @@ Location: `modules/services/servicename.nix`
let
cfg = config.shb.servicename;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
# Choose appropriate format based on service config

36
docs/usage.md
View file

@ -54,9 +54,9 @@ following code instead wherever you import `nixpkgs`:
outputs = { selfhostblocks, ... }: let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' {
inherit system;
@ -98,10 +98,10 @@ Access any functions exposed by the [lib][] with this snippet:
};
outputs = { selfhostblocks, ... }:
let
shblib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
in
{
// Use shblib.replaceSecrets for example.
// Use lib.shb.replaceSecrets for example.
}
}
```
@ -123,9 +123,9 @@ The following snippets show how to deploy Self Host Blocks using the standard de
outputs = { self, selfhostblocks }: {
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix";
in
@ -157,9 +157,9 @@ some not using Self Host Blocks, then you can do the following:
outputs = { self, selfhostblocks }: {
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' {
inherit system;
@ -197,9 +197,9 @@ The following snippets show how to deploy Self Host Blocks using the deployment
outputs = { self, selfhostblocks }: {
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' {
inherit system;
@ -237,9 +237,9 @@ in this case you can use the `colmena.meta.nodeNixpkgs` option:
outputs = { self, selfhostblocks }: {
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' {
inherit system;
@ -286,9 +286,9 @@ The following snippets show how to deploy Self Host Blocks using the deployment
outputs = { self, selfhostblocks }: {
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbPkgs = import shbNixpkgs { inherit system; };
@ -353,9 +353,9 @@ in this case you can do:
outputs = { self, selfhostblocks }: {
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbPkgs = import nixpkgs' { inherit system; };
@ -552,9 +552,9 @@ as well as [Skarabox][], my sibling project used to bootstrap a server.
outputs = { self, skarabox, selfhostblocks, sops-nix, deploy-rs }:
let
system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system};
lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs;
nixpkgs' = lib.shb.patchedNixpkgs;
shbPkgs = import nixpkgs' { inherit system; };

29
flake.nix
View file

@ -42,6 +42,19 @@
pkgs = import patchedNixpkgs {
inherit system;
config.allowUnfree = true;
overlays = [
(final: prev: {
lib = prev.lib // {
shb = self.lib.${system};
evalModules = args: ((prev.lib.makeOverridable prev.lib.evalModules) args).override (prevAttrs: {
specialArgs = (prevAttrs.specialArgs or {}) // { inherit (pkgs) lib; };
});
};
nixosSystem = args: ((prev.lib.makeOverridable (import "${patchedNixpkgs}/nixos/lib/eval-config.nix")) args).override (prevAttrs: {
inherit (pkgs) lib;
});
})
];
};
# The contract dummies are used to show options for contracts.
@ -156,15 +169,16 @@
lib =
(pkgs.callPackage ./lib {})
// (pkgs.callPackage ./test/common.nix {})
// {
contracts = pkgs.callPackage ./modules/contracts {};
patches = shbPatches;
inherit patchNixpkgs patchedNixpkgs;
inherit patchNixpkgs patchedNixpkgs pkgs;
};
checks =
let
inherit (pkgs.lib) foldl foldlAttrs mergeAttrs optionalAttrs;
inherit (pkgs.lib) foldl foldlAttrs removeAttrs mergeAttrs optionalAttrs;
importFiles = files:
map (m: pkgs.callPackage m {}) files;
@ -176,17 +190,10 @@
}) {} attrset;
vm_test = name: path: flattenAttrs "vm_${name}" (
import path {
inherit pkgs;
lib = pkgs.lib // {
shb = pkgs.callPackage ./test/common.nix {};
};
}
removeAttrs (pkgs.callPackage path {}) [ "override" "overrideDerivation" ]
);
shblib = pkgs.callPackage ./lib {};
in (optionalAttrs (system == "x86_64-linux") ({
modules = shblib.check {
modules = pkgs.lib.shb.check {
inherit pkgs;
tests =
mergeTests (importFiles [

7
modules/blocks/authelia.nix
View file

@ -5,7 +5,6 @@ let
opt = options.shb.authelia;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
fqdnWithPort = if isNull cfg.port then fqdn else "${fqdn}:${toString cfg.port}";
@ -192,7 +191,7 @@ in
};
client_secret = lib.mkOption {
type = shblib.secretFileType;
type = lib.shb.secretFileType;
description = ''
File containing the shared secret with the OIDC client.
@ -503,12 +502,12 @@ in
systemd.services."authelia-${fqdn}".preStart =
let
mkCfg = clients:
shblib.replaceSecrets {
lib.shb.replaceSecrets {
userConfig = {
identity_providers.oidc.clients = clients;
};
resultPath = "/var/lib/authelia-${fqdn}/oidc_clients.yaml";
generator = shblib.replaceSecretsGeneratorAdapter (lib.generators.toYAML {});
generator = lib.shb.replaceSecretsGeneratorAdapter (lib.generators.toYAML {});
};
in
lib.mkBefore (mkCfg cfg.oidcClients + ''

4
modules/blocks/davfs.nix
View file

@ -1,9 +1,7 @@
{ config, pkgs, lib, ... }:
{ config, lib, ... }:
let
cfg = config.shb.davfs;
shblib = pkgs.callPackage ../../lib {};
in
{
options.shb.davfs = {

2
modules/blocks/hardcodedsecret.nix
View file

@ -2,7 +2,7 @@
let
cfg = config.shb.hardcodedsecret;
contracts = pkgs.callPackage ../contracts {};
contracts = pkgs.callPackage ../contracts { inherit lib; };
inherit (lib) mapAttrs' mkOption nameValuePair;
inherit (lib.types) attrsOf nullOr str submodule;

11
modules/blocks/restic.nix
View file

@ -3,7 +3,6 @@
let
cfg = config.shb.restic;
shblib = pkgs.callPackage ../../lib {};
contracts = pkgs.callPackage ../contracts {};
inherit (lib) concatStringsSep filterAttrs flatten literalExpression optionals listToAttrs mapAttrsToList mkEnableOption mkOption mkMerge;
@ -41,7 +40,7 @@ let
};
secrets = mkOption {
type = attrsOf shblib.secretFileType;
type = attrsOf lib.shb.secretFileType;
default = {};
description = ''
Secrets needed to access the repository where the backups will be stored.
@ -315,10 +314,10 @@ in
"${serviceName}-pre" = mkIf (instance.settings.repository.secrets != {})
(let
script = shblib.genConfigOutOfBandSystemd {
script = lib.shb.genConfigOutOfBandSystemd {
config = instance.settings.repository.secrets;
configLocation = "/run/secrets_restic/${serviceName}";
generator = shblib.toEnvVar;
generator = lib.shb.toEnvVar;
user = instance.request.user;
};
in
@ -338,13 +337,13 @@ in
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = (shblib.replaceSecrets {
script = (lib.shb.replaceSecrets {
userConfig = instance.settings.repository.secrets // {
RESTIC_PASSWORD_FILE = toString instance.settings.passphrase.result.path;
RESTIC_REPOSITORY = instance.settings.repository.path;
};
resultPath = "/run/secrets_restic_env/${fullName name instance.settings.repository}";
generator = shblib.toEnvVar;
generator = lib.shb.toEnvVar;
user = instance.request.user;
});
};

6
modules/contracts/backup.nix
View file

@ -1,10 +1,8 @@
{ pkgs, lib, ... }:
{ lib, ... }:
let
inherit (lib) concatStringsSep literalMD mkOption optionalAttrs optionalString;
inherit (lib.types) listOf nonEmptyListOf submodule str;
shblib = pkgs.callPackage ../../lib {};
inherit (shblib) anyNotNull;
inherit (lib.shb) anyNotNull;
in
{
mkRequest =

6
modules/contracts/databasebackup.nix
View file

@ -1,10 +1,8 @@
{ pkgs, lib, ... }:
{ lib, ... }:
let
inherit (lib) mkOption literalExpression literalMD optionalAttrs optionalString;
inherit (lib.types) submodule str;
shblib = pkgs.callPackage ../../lib {};
inherit (shblib) anyNotNull;
inherit (lib.shb) anyNotNull;
in
{
mkRequest =

6
modules/contracts/secret.nix
View file

@ -1,10 +1,8 @@
{ pkgs, lib, ... }:
{ lib, ... }:
let
inherit (lib) concatStringsSep literalMD mkOption optionalAttrs optionalString;
inherit (lib.types) listOf submodule str;
shblib = pkgs.callPackage ../../lib {};
inherit (shblib) anyNotNull;
inherit (lib.shb) anyNotNull;
in
{
mkRequest =

35
modules/services/arr.nix
View file

@ -4,11 +4,10 @@ let
cfg = config.shb.arr;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
apps = {
radarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; };
settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = {
settings = lib.mkOption {
description = "Specific options for radarr.";
@ -17,7 +16,7 @@ let
freeformType = apps.radarr.settingsFormat.type;
options = {
ApiKey = lib.mkOption {
type = shblib.secretFileType;
type = lib.shb.secretFileType;
description = "Path to api key secret file.";
};
LogLevel = lib.mkOption {
@ -66,7 +65,7 @@ let
};
};
sonarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; };
settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = {
settings = lib.mkOption {
description = "Specific options for sonarr.";
@ -75,7 +74,7 @@ let
freeformType = apps.sonarr.settingsFormat.type;
options = {
ApiKey = lib.mkOption {
type = shblib.secretFileType;
type = lib.shb.secretFileType;
description = "Path to api key secret file.";
};
LogLevel = lib.mkOption {
@ -119,7 +118,7 @@ let
};
};
bazarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; };
settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = {
settings = lib.mkOption {
description = "Specific options for bazarr.";
@ -144,7 +143,7 @@ let
};
};
readarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; };
settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = {
settings = lib.mkOption {
description = "Specific options for readarr.";
@ -168,7 +167,7 @@ let
};
};
lidarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; };
settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = {
settings = lib.mkOption {
description = "Specific options for lidarr.";
@ -201,7 +200,7 @@ let
freeformType = apps.jackett.settingsFormat.type;
options = {
ApiKey = lib.mkOption {
type = shblib.secretFileType;
type = lib.shb.secretFileType;
description = "Path to api key secret file.";
};
FlareSolverrUrl = lib.mkOption {
@ -210,7 +209,7 @@ let
default = null;
};
OmdbApiKey = lib.mkOption {
type = lib.types.nullOr shblib.secretFileType;
type = lib.types.nullOr lib.shb.secretFileType;
description = "File containing the Open Movie Database API key.";
default = null;
};
@ -356,14 +355,14 @@ in
dataDir = "/var/lib/radarr";
};
systemd.services.radarr.preStart = shblib.replaceSecrets {
systemd.services.radarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses";
AuthenticationMethod = "External";
});
resultPath = "${config.services.radarr.dataDir}/config.xml";
generator = shblib.replaceSecretsFormatAdapter apps.radarr.settingsFormat;
generator = lib.shb.replaceSecretsFormatAdapter apps.radarr.settingsFormat;
};
shb.nginx.vhosts = [ (vhosts {} cfg') ];
@ -385,7 +384,7 @@ in
extraGroups = [ "media" ];
};
systemd.services.sonarr.preStart = shblib.replaceSecrets {
systemd.services.sonarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses";
@ -411,7 +410,7 @@ in
users.users.bazarr = {
extraGroups = [ "media" ];
};
systemd.services.bazarr.preStart = shblib.replaceSecrets {
systemd.services.bazarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses";
@ -436,7 +435,7 @@ in
users.users.readarr = {
extraGroups = [ "media" ];
};
systemd.services.readarr.preStart = shblib.replaceSecrets {
systemd.services.readarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings;
resultPath = "${config.services.readarr.dataDir}/config.xml";
generator = apps.readarr.settingsFormat.generate;
@ -458,7 +457,7 @@ in
users.users.lidarr = {
extraGroups = [ "media" ];
};
systemd.services.lidarr.preStart = shblib.replaceSecrets {
systemd.services.lidarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses";
@ -484,8 +483,8 @@ in
users.users.jackett = {
extraGroups = [ "media" ];
};
systemd.services.jackett.preStart = shblib.replaceSecrets {
userConfig = shblib.renameAttrName cfg'.settings "ApiKey" "APIKey";
systemd.services.jackett.preStart = lib.shb.replaceSecrets {
userConfig = lib.shb.renameAttrName cfg'.settings "ApiKey" "APIKey";
resultPath = "${config.services.jackett.dataDir}/ServerConfig.json";
generator = apps.jackett.settingsFormat.generate;
};

5
modules/services/deluge.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.deluge;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -180,7 +179,7 @@ in
type = lib.types.attrsOf (lib.types.submodule {
options = {
password = lib.mkOption {
type = shblib.secretFileType;
type = lib.shb.secretFileType;
description = "File containing the user password.";
};
};
@ -328,7 +327,7 @@ in
web.port = cfg.webPort;
};
systemd.services.deluged.preStart = lib.mkBefore (shblib.replaceSecrets {
systemd.services.deluged.preStart = lib.mkBefore (lib.shb.replaceSecrets {
userConfig = cfg.extraUsers // {
localclient.password.source = config.shb.deluge.localclientPassword.result.path;
} // (lib.optionalAttrs (config.shb.deluge.prometheusScraperPassword != null) {

15
modules/services/home-assistant.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.home-assistant;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -57,23 +56,23 @@ in
freeformType = lib.types.attrsOf lib.types.str;
options = {
name = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ];
type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Name of the Home Assistant instance.";
};
country = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ];
type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Two letter country code where this instance is located.";
};
latitude = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ];
type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Latitude where this instance is located.";
};
longitude = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ];
type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Longitude where this instance is located.";
};
time_zone = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ];
type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Timezone of this instance.";
example = "America/Los_Angeles";
};
@ -348,10 +347,10 @@ in
mkdir -p ''$(dirname ${file}) && cp ${onboarding} ${file}
fi
'')
+ (shblib.replaceSecrets {
+ (lib.shb.replaceSecrets {
userConfig = cfg.config;
resultPath = "${config.services.home-assistant.configDir}/secrets.yaml";
generator = shblib.replaceSecretsGeneratorAdapter (lib.generators.toYAML {});
generator = lib.shb.replaceSecretsGeneratorAdapter (lib.generators.toYAML {});
});
systemd.tmpfiles.rules = [

5
modules/services/immich.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.immich;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
protocol = if !(isNull cfg.ssl) then "https" else "http";
@ -62,10 +61,10 @@ let
# Use SHB's replaceSecrets function for loading secrets at runtime
configSetupScript = lib.optionalString (cfg.sso.enable || cfg.smtp != null) (
shblib.replaceSecrets {
lib.shb.replaceSecrets {
userConfig = shbManagedSettings;
resultPath = configFile;
generator = shblib.replaceSecretsFormatAdapter (pkgs.formats.json {});
generator = lib.shb.replaceSecretsFormatAdapter (pkgs.formats.json {});
user = "immich";
permissions = "u=r,g=,o=";
}

9
modules/services/jellyfin.nix
View file

@ -6,7 +6,6 @@ let
cfg = config.shb.jellyfin;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -569,7 +568,7 @@ in
fi
ln -fs "${debugLogging}" "${config.services.jellyfin.configDir}/logging.json"
''
+ (shblib.replaceSecretsScript {
+ (lib.shb.replaceSecretsScript {
file = networkConfig;
# Write permissions are needed otherwise the jellyfin-cli tool will not work correctly.
permissions = "u=rw,g=rw,o=";
@ -577,7 +576,7 @@ in
replacements = [
];
})
+ lib.strings.optionalString cfg.ldap.enable (shblib.replaceSecretsScript {
+ lib.strings.optionalString cfg.ldap.enable (lib.shb.replaceSecretsScript {
file = ldapConfig;
resultPath = "${config.services.jellyfin.dataDir}/plugins/configurations/LDAP-Auth.xml";
replacements = [
@ -587,7 +586,7 @@ in
}
];
})
+ lib.strings.optionalString cfg.sso.enable (shblib.replaceSecretsScript {
+ lib.strings.optionalString cfg.sso.enable (lib.shb.replaceSecretsScript {
file = ssoConfig;
resultPath = "${config.services.jellyfin.dataDir}/plugins/configurations/SSO-Auth.xml";
replacements = [
@ -597,7 +596,7 @@ in
}
];
})
+ lib.strings.optionalString cfg.sso.enable (shblib.replaceSecretsScript {
+ lib.strings.optionalString cfg.sso.enable (lib.shb.replaceSecretsScript {
file = brandingConfig;
resultPath = "${config.services.jellyfin.dataDir}/config/branding.xml";
replacements = [

5
modules/services/open-webui.nix
View file

@ -3,7 +3,6 @@ let
cfg = config.shb.open-webui;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
roleClaim = "openwebui_groups";
oauthScopes = [ "openid" "email" "profile" "groups" "${roleClaim}" ];
@ -256,12 +255,12 @@ in
"d '/run/open-webui' 0750 root root - -"
];
systemd.services.open-webui-pre = {
script = shblib.replaceSecrets {
script = lib.shb.replaceSecrets {
userConfig = {
OAUTH_CLIENT_SECRET.source = cfg.sso.sharedSecret.result.path;
};
resultPath = "/run/open-webui/secrets.env";
generator = shblib.toEnvVar;
generator = lib.shb.toEnvVar;
};
serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ];

7
modules/services/pinchflat.nix
View file

@ -5,7 +5,6 @@ let
inherit (lib) types;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
in
{
imports = [
@ -58,7 +57,7 @@ in
};
timeZone = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ];
type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Timezone of this instance.";
example = "America/Los_Angeles";
};
@ -147,13 +146,13 @@ in
};
systemd.services.pinchflat-pre = {
script = shblib.replaceSecrets {
script = lib.shb.replaceSecrets {
userConfig = {
SECRET_KEY_BASE.source = cfg.secretKeyBase.result.path;
# TZ = cfg.secretKeyBase.result.path; # Uncomment when PR is merged.
};
resultPath = "/run/pinchflat/secrets.env";
generator = shblib.toEnvVar;
generator = lib.shb.toEnvVar;
};
serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ];

5
modules/services/vaultwarden.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.vaultwarden;
contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -191,7 +190,7 @@ in
# Needed to be able to write template config.
systemd.services.vaultwarden.serviceConfig.ProtectHome = lib.mkForce false;
systemd.services.vaultwarden.preStart =
shblib.replaceSecrets {
lib.shb.replaceSecrets {
userConfig = {
DATABASE_URL.source = cfg.databasePassword.result.path;
DATABASE_URL.transform = v: "postgresql://vaultwarden:${v}@127.0.0.1:5432/vaultwarden";
@ -199,7 +198,7 @@ in
SMTP_PASSWORD.source = cfg.smtp.password.result.path;
};
resultPath = "${dataFolder}/vaultwarden.env";
generator = shblib.toEnvVar;
generator = lib.shb.toEnvVar;
};
shb.nginx.vhosts = [

22
test/blocks/lib.nix
View file

@ -1,8 +1,6 @@
{ pkgs, lib, ... }:
let
pkgs' = pkgs;
shblib = pkgs.callPackage ../../lib {};
in
{
template =
@ -24,34 +22,34 @@ in
d.d = "not secret D";
};
configWithTemplates = shblib.withReplacements userConfig;
configWithTemplates = lib.shb.withReplacements userConfig;
nonSecretConfigFile = pkgs.writeText "config.yaml.template" (lib.generators.toJSON {} configWithTemplates);
replacements = shblib.getReplacements userConfig;
replacements = lib.shb.getReplacements userConfig;
replaceInTemplate = shblib.replaceSecretsScript {
replaceInTemplate = lib.shb.replaceSecretsScript {
file = nonSecretConfigFile;
resultPath = "/var/lib/config.yaml";
inherit replacements;
};
replaceInTemplateJSON = shblib.replaceSecrets {
replaceInTemplateJSON = lib.shb.replaceSecrets {
inherit userConfig;
resultPath = "/var/lib/config.json";
generator = shblib.replaceSecretsFormatAdapter (pkgs.formats.json {});
generator = lib.shb.replaceSecretsFormatAdapter (pkgs.formats.json {});
};
replaceInTemplateJSONGen = shblib.replaceSecrets {
replaceInTemplateJSONGen = lib.shb.replaceSecrets {
inherit userConfig;
resultPath = "/var/lib/config_gen.json";
generator = shblib.replaceSecretsGeneratorAdapter (lib.generators.toJSON {});
generator = lib.shb.replaceSecretsGeneratorAdapter (lib.generators.toJSON {});
};
replaceInTemplateXML = shblib.replaceSecrets {
replaceInTemplateXML = lib.shb.replaceSecrets {
inherit userConfig;
resultPath = "/var/lib/config.xml";
generator = shblib.replaceSecretsFormatAdapter (shblib.formatXML {enclosingRoot = "Root";});
generator = lib.shb.replaceSecretsFormatAdapter (lib.shb.formatXML {enclosingRoot = "Root";});
};
in
lib.shb.runNixOSTest {
@ -64,7 +62,7 @@ in
{
options = {
libtest.config = lib.mkOption {
type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str shblib.secretFileType ]);
type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str lib.secretFileType ]);
};
};
}

4
test/contracts/backup.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
{ pkgs, lib, ... }:
let
contracts = pkgs.callPackage ../../modules/contracts {};
contracts = pkgs.callPackage ../../modules/contracts { inherit lib; };
in
{
restic_root = contracts.test.backup {

4
test/contracts/databasebackup.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
{ pkgs, lib, ... }:
let
contracts = pkgs.callPackage ../../modules/contracts {};
contracts = pkgs.callPackage ../../modules/contracts { inherit lib; };
in
{
restic_postgres = contracts.test.databasebackup {

4
test/contracts/secret.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
{ pkgs, lib, ... }:
let
contracts = pkgs.callPackage ../../modules/contracts {};
contracts = pkgs.callPackage ../../modules/contracts { inherit lib; };
in
{
hardcoded_root_root = contracts.test.secret {

12
test/modules/lib.nix
View file

@ -1,7 +1,5 @@
{ pkgs, lib, ... }:
{ lib, ... }:
let
shblib = pkgs.callPackage ../../lib {};
inherit (lib) nameValuePair;
in
{
@ -35,7 +33,7 @@ in
c.other = "other";
};
in
shblib.withReplacements (
lib.shb.withReplacements (
item // {
nestedAttr = item;
nestedList = [ item ];
@ -70,7 +68,7 @@ in
c.other = "other";
};
in
shblib.withReplacements [
lib.shb.withReplacements [
item
item
[ item ]
@ -101,7 +99,7 @@ in
c.other = "other";
};
in
map shblib.genReplacement (shblib.getReplacements (
map lib.shb.genReplacement (lib.shb.getReplacements (
item // {
nestedAttr = item;
nestedList = [ item ];
@ -120,7 +118,7 @@ in
};
};
expr = shblib.parseXML ''
expr = lib.shb.parseXML ''
<a>
<b>1</b>
<c><d>1</d></c>