danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mod: merge shb functions into lib

Browse source
This commit is contained in:
ibizaman 2025-10-13 00:15:08 +02:00 committed by Pierre Penninckx
parent 283e12d87d
commit 6e64c7f8cf
25 changed files with 119 additions and 135 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
demo/homeassistant/flake.nix
View file

@ -10,7 +10,7 @@
let let
system = "x86_64-linux"; system = "x86_64-linux";
nixpkgs' = selfhostblocks.lib.${system}.patchedNixpkgs; nixpkgs' = selfhostblocks.lib.${system}.patchedNixpkgs;
nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix"; inherit (selfhostblocks.lib.${system}) pkgs;
basic = { config, ... }: { basic = { config, ... }: {
imports = [ imports = [
@ -96,7 +96,7 @@
in in
{ {
nixosConfigurations = { nixosConfigurations = {
basic = nixosSystem' { basic = pkgs.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
modules = [ modules = [
basic basic
@ -104,7 +104,7 @@
]; ];
}; };
ldap = nixosSystem' { ldap = pkgs.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
modules = [ modules = [
basic basic

8
demo/nextcloud/flake.nix
View file

@ -10,7 +10,7 @@
let let
system = "x86_64-linux"; system = "x86_64-linux";
nixpkgs' = selfhostblocks.lib.${system}.patchedNixpkgs; nixpkgs' = selfhostblocks.lib.${system}.patchedNixpkgs;
nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix"; inherit (selfhostblocks.lib.${system}) pkgs;
basic = { config, ... }: { basic = { config, ... }: {
imports = [ imports = [
@ -164,14 +164,14 @@
in in
{ {
nixosConfigurations = { nixosConfigurations = {
basic = nixosSystem' { basic = pkgs.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
modules = [ modules = [
sopsConfig sopsConfig
basic basic
]; ];
}; };
ldap = nixosSystem' { ldap = pkgs.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
modules = [ modules = [
sopsConfig sopsConfig
@ -179,7 +179,7 @@
ldap ldap
]; ];
}; };
sso = nixosSystem' { sso = pkgs.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
modules = [ modules = [
sopsConfig sopsConfig

1
docs/service-implementation-guide.md
View file

@ -71,7 +71,6 @@ Location: `modules/services/servicename.nix`
let let
cfg = config.shb.servicename; cfg = config.shb.servicename;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
# Choose appropriate format based on service config # Choose appropriate format based on service config

36
docs/usage.md
View file

@ -54,9 +54,9 @@ following code instead wherever you import `nixpkgs`:
outputs = { selfhostblocks, ... }: let outputs = { selfhostblocks, ... }: let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' { shbNixpkgs = import nixpkgs' {
inherit system; inherit system;
@ -98,10 +98,10 @@ Access any functions exposed by the [lib][] with this snippet:
}; };
outputs = { selfhostblocks, ... }: outputs = { selfhostblocks, ... }:
let let
shblib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
in in
{ {
// Use shblib.replaceSecrets for example. // Use lib.shb.replaceSecrets for example.
} }
} }
``` ```
@ -123,9 +123,9 @@ The following snippets show how to deploy Self Host Blocks using the standard de
outputs = { self, selfhostblocks }: { outputs = { self, selfhostblocks }: {
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix"; nixosSystem' = import "${nixpkgs'}/nixos/lib/eval-config.nix";
in in
@ -157,9 +157,9 @@ some not using Self Host Blocks, then you can do the following:
outputs = { self, selfhostblocks }: { outputs = { self, selfhostblocks }: {
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' { shbNixpkgs = import nixpkgs' {
inherit system; inherit system;
@ -197,9 +197,9 @@ The following snippets show how to deploy Self Host Blocks using the deployment
outputs = { self, selfhostblocks }: { outputs = { self, selfhostblocks }: {
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' { shbNixpkgs = import nixpkgs' {
inherit system; inherit system;
@ -237,9 +237,9 @@ in this case you can use the `colmena.meta.nodeNixpkgs` option:
outputs = { self, selfhostblocks }: { outputs = { self, selfhostblocks }: {
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbNixpkgs = import nixpkgs' { shbNixpkgs = import nixpkgs' {
inherit system; inherit system;
@ -286,9 +286,9 @@ The following snippets show how to deploy Self Host Blocks using the deployment
outputs = { self, selfhostblocks }: { outputs = { self, selfhostblocks }: {
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbPkgs = import shbNixpkgs { inherit system; }; shbPkgs = import shbNixpkgs { inherit system; };
@ -353,9 +353,9 @@ in this case you can do:
outputs = { self, selfhostblocks }: { outputs = { self, selfhostblocks }: {
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbPkgs = import nixpkgs' { inherit system; }; shbPkgs = import nixpkgs' { inherit system; };
@ -552,9 +552,9 @@ as well as [Skarabox][], my sibling project used to bootstrap a server.
outputs = { self, skarabox, selfhostblocks, sops-nix, deploy-rs }: outputs = { self, skarabox, selfhostblocks, sops-nix, deploy-rs }:
let let
system = "x86_64-linux"; system = "x86_64-linux";
shbLib = selfhostblocks.lib.${system}; lib = selfhostblocks.lib.${system};
nixpkgs' = shbLib.patchedNixpkgs; nixpkgs' = lib.shb.patchedNixpkgs;
shbPkgs = import nixpkgs' { inherit system; }; shbPkgs = import nixpkgs' { inherit system; };

29
flake.nix
View file

@ -42,6 +42,19 @@
pkgs = import patchedNixpkgs { pkgs = import patchedNixpkgs {
inherit system; inherit system;
config.allowUnfree = true; config.allowUnfree = true;
overlays = [
(final: prev: {
lib = prev.lib // {
shb = self.lib.${system};
evalModules = args: ((prev.lib.makeOverridable prev.lib.evalModules) args).override (prevAttrs: {
specialArgs = (prevAttrs.specialArgs or {}) // { inherit (pkgs) lib; };
});
};
nixosSystem = args: ((prev.lib.makeOverridable (import "${patchedNixpkgs}/nixos/lib/eval-config.nix")) args).override (prevAttrs: {
inherit (pkgs) lib;
});
})
];
}; };
# The contract dummies are used to show options for contracts. # The contract dummies are used to show options for contracts.
@ -156,15 +169,16 @@
lib = lib =
(pkgs.callPackage ./lib {}) (pkgs.callPackage ./lib {})
// (pkgs.callPackage ./test/common.nix {})
// { // {
contracts = pkgs.callPackage ./modules/contracts {}; contracts = pkgs.callPackage ./modules/contracts {};
patches = shbPatches; patches = shbPatches;
inherit patchNixpkgs patchedNixpkgs; inherit patchNixpkgs patchedNixpkgs pkgs;
}; };
checks = checks =
let let
inherit (pkgs.lib) foldl foldlAttrs mergeAttrs optionalAttrs; inherit (pkgs.lib) foldl foldlAttrs removeAttrs mergeAttrs optionalAttrs;
importFiles = files: importFiles = files:
map (m: pkgs.callPackage m {}) files; map (m: pkgs.callPackage m {}) files;
@ -176,17 +190,10 @@
}) {} attrset; }) {} attrset;
vm_test = name: path: flattenAttrs "vm_${name}" ( vm_test = name: path: flattenAttrs "vm_${name}" (
import path { removeAttrs (pkgs.callPackage path {}) [ "override" "overrideDerivation" ]
inherit pkgs;
lib = pkgs.lib // {
shb = pkgs.callPackage ./test/common.nix {};
};
}
); );
shblib = pkgs.callPackage ./lib {};
in (optionalAttrs (system == "x86_64-linux") ({ in (optionalAttrs (system == "x86_64-linux") ({
modules = shblib.check { modules = pkgs.lib.shb.check {
inherit pkgs; inherit pkgs;
tests = tests =
mergeTests (importFiles [ mergeTests (importFiles [

7
modules/blocks/authelia.nix
View file

@ -5,7 +5,6 @@ let
opt = options.shb.authelia; opt = options.shb.authelia;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
fqdnWithPort = if isNull cfg.port then fqdn else "${fqdn}:${toString cfg.port}"; fqdnWithPort = if isNull cfg.port then fqdn else "${fqdn}:${toString cfg.port}";
@ -192,7 +191,7 @@ in
}; };
client_secret = lib.mkOption { client_secret = lib.mkOption {
type = shblib.secretFileType; type = lib.shb.secretFileType;
description = '' description = ''
File containing the shared secret with the OIDC client. File containing the shared secret with the OIDC client.
@ -503,12 +502,12 @@ in
systemd.services."authelia-${fqdn}".preStart = systemd.services."authelia-${fqdn}".preStart =
let let
mkCfg = clients: mkCfg = clients:
shblib.replaceSecrets { lib.shb.replaceSecrets {
userConfig = { userConfig = {
identity_providers.oidc.clients = clients; identity_providers.oidc.clients = clients;
}; };
resultPath = "/var/lib/authelia-${fqdn}/oidc_clients.yaml"; resultPath = "/var/lib/authelia-${fqdn}/oidc_clients.yaml";
generator = shblib.replaceSecretsGeneratorAdapter (lib.generators.toYAML {}); generator = lib.shb.replaceSecretsGeneratorAdapter (lib.generators.toYAML {});
}; };
in in
lib.mkBefore (mkCfg cfg.oidcClients + '' lib.mkBefore (mkCfg cfg.oidcClients + ''

4
modules/blocks/davfs.nix
View file

@ -1,9 +1,7 @@
{ config, pkgs, lib, ... }: { config, lib, ... }:
let let
cfg = config.shb.davfs; cfg = config.shb.davfs;
shblib = pkgs.callPackage ../../lib {};
in in
{ {
options.shb.davfs = { options.shb.davfs = {

2
modules/blocks/hardcodedsecret.nix
View file

@ -2,7 +2,7 @@
let let
cfg = config.shb.hardcodedsecret; cfg = config.shb.hardcodedsecret;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts { inherit lib; };
inherit (lib) mapAttrs' mkOption nameValuePair; inherit (lib) mapAttrs' mkOption nameValuePair;
inherit (lib.types) attrsOf nullOr str submodule; inherit (lib.types) attrsOf nullOr str submodule;

11
modules/blocks/restic.nix
View file

@ -3,7 +3,6 @@
let let
cfg = config.shb.restic; cfg = config.shb.restic;
shblib = pkgs.callPackage ../../lib {};
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
inherit (lib) concatStringsSep filterAttrs flatten literalExpression optionals listToAttrs mapAttrsToList mkEnableOption mkOption mkMerge; inherit (lib) concatStringsSep filterAttrs flatten literalExpression optionals listToAttrs mapAttrsToList mkEnableOption mkOption mkMerge;
@ -41,7 +40,7 @@ let
}; };
secrets = mkOption { secrets = mkOption {
type = attrsOf shblib.secretFileType; type = attrsOf lib.shb.secretFileType;
default = {}; default = {};
description = '' description = ''
Secrets needed to access the repository where the backups will be stored. Secrets needed to access the repository where the backups will be stored.
@ -315,10 +314,10 @@ in
"${serviceName}-pre" = mkIf (instance.settings.repository.secrets != {}) "${serviceName}-pre" = mkIf (instance.settings.repository.secrets != {})
(let (let
script = shblib.genConfigOutOfBandSystemd { script = lib.shb.genConfigOutOfBandSystemd {
config = instance.settings.repository.secrets; config = instance.settings.repository.secrets;
configLocation = "/run/secrets_restic/${serviceName}"; configLocation = "/run/secrets_restic/${serviceName}";
generator = shblib.toEnvVar; generator = lib.shb.toEnvVar;
user = instance.request.user; user = instance.request.user;
}; };
in in
@ -338,13 +337,13 @@ in
enable = true; enable = true;
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
script = (shblib.replaceSecrets { script = (lib.shb.replaceSecrets {
userConfig = instance.settings.repository.secrets // { userConfig = instance.settings.repository.secrets // {
RESTIC_PASSWORD_FILE = toString instance.settings.passphrase.result.path; RESTIC_PASSWORD_FILE = toString instance.settings.passphrase.result.path;
RESTIC_REPOSITORY = instance.settings.repository.path; RESTIC_REPOSITORY = instance.settings.repository.path;
}; };
resultPath = "/run/secrets_restic_env/${fullName name instance.settings.repository}"; resultPath = "/run/secrets_restic_env/${fullName name instance.settings.repository}";
generator = shblib.toEnvVar; generator = lib.shb.toEnvVar;
user = instance.request.user; user = instance.request.user;
}); });
}; };

6
modules/contracts/backup.nix
View file

@ -1,10 +1,8 @@
{ pkgs, lib, ... }: { lib, ... }:
let let
inherit (lib) concatStringsSep literalMD mkOption optionalAttrs optionalString; inherit (lib) concatStringsSep literalMD mkOption optionalAttrs optionalString;
inherit (lib.types) listOf nonEmptyListOf submodule str; inherit (lib.types) listOf nonEmptyListOf submodule str;
inherit (lib.shb) anyNotNull;
shblib = pkgs.callPackage ../../lib {};
inherit (shblib) anyNotNull;
in in
{ {
mkRequest = mkRequest =

6
modules/contracts/databasebackup.nix
View file

@ -1,10 +1,8 @@
{ pkgs, lib, ... }: { lib, ... }:
let let
inherit (lib) mkOption literalExpression literalMD optionalAttrs optionalString; inherit (lib) mkOption literalExpression literalMD optionalAttrs optionalString;
inherit (lib.types) submodule str; inherit (lib.types) submodule str;
inherit (lib.shb) anyNotNull;
shblib = pkgs.callPackage ../../lib {};
inherit (shblib) anyNotNull;
in in
{ {
mkRequest = mkRequest =

6
modules/contracts/secret.nix
View file

@ -1,10 +1,8 @@
{ pkgs, lib, ... }: { lib, ... }:
let let
inherit (lib) concatStringsSep literalMD mkOption optionalAttrs optionalString; inherit (lib) concatStringsSep literalMD mkOption optionalAttrs optionalString;
inherit (lib.types) listOf submodule str; inherit (lib.types) listOf submodule str;
inherit (lib.shb) anyNotNull;
shblib = pkgs.callPackage ../../lib {};
inherit (shblib) anyNotNull;
in in
{ {
mkRequest = mkRequest =

35
modules/services/arr.nix
View file

@ -4,11 +4,10 @@ let
cfg = config.shb.arr; cfg = config.shb.arr;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
apps = { apps = {
radarr = { radarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; }; settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = { moreOptions = {
settings = lib.mkOption { settings = lib.mkOption {
description = "Specific options for radarr."; description = "Specific options for radarr.";
@ -17,7 +16,7 @@ let
freeformType = apps.radarr.settingsFormat.type; freeformType = apps.radarr.settingsFormat.type;
options = { options = {
ApiKey = lib.mkOption { ApiKey = lib.mkOption {
type = shblib.secretFileType; type = lib.shb.secretFileType;
description = "Path to api key secret file."; description = "Path to api key secret file.";
}; };
LogLevel = lib.mkOption { LogLevel = lib.mkOption {
@ -66,7 +65,7 @@ let
}; };
}; };
sonarr = { sonarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; }; settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = { moreOptions = {
settings = lib.mkOption { settings = lib.mkOption {
description = "Specific options for sonarr."; description = "Specific options for sonarr.";
@ -75,7 +74,7 @@ let
freeformType = apps.sonarr.settingsFormat.type; freeformType = apps.sonarr.settingsFormat.type;
options = { options = {
ApiKey = lib.mkOption { ApiKey = lib.mkOption {
type = shblib.secretFileType; type = lib.shb.secretFileType;
description = "Path to api key secret file."; description = "Path to api key secret file.";
}; };
LogLevel = lib.mkOption { LogLevel = lib.mkOption {
@ -119,7 +118,7 @@ let
}; };
}; };
bazarr = { bazarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; }; settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = { moreOptions = {
settings = lib.mkOption { settings = lib.mkOption {
description = "Specific options for bazarr."; description = "Specific options for bazarr.";
@ -144,7 +143,7 @@ let
}; };
}; };
readarr = { readarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; }; settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = { moreOptions = {
settings = lib.mkOption { settings = lib.mkOption {
description = "Specific options for readarr."; description = "Specific options for readarr.";
@ -168,7 +167,7 @@ let
}; };
}; };
lidarr = { lidarr = {
settingsFormat = shblib.formatXML { enclosingRoot = "Config"; }; settingsFormat = lib.shb.formatXML { enclosingRoot = "Config"; };
moreOptions = { moreOptions = {
settings = lib.mkOption { settings = lib.mkOption {
description = "Specific options for lidarr."; description = "Specific options for lidarr.";
@ -201,7 +200,7 @@ let
freeformType = apps.jackett.settingsFormat.type; freeformType = apps.jackett.settingsFormat.type;
options = { options = {
ApiKey = lib.mkOption { ApiKey = lib.mkOption {
type = shblib.secretFileType; type = lib.shb.secretFileType;
description = "Path to api key secret file."; description = "Path to api key secret file.";
}; };
FlareSolverrUrl = lib.mkOption { FlareSolverrUrl = lib.mkOption {
@ -210,7 +209,7 @@ let
default = null; default = null;
}; };
OmdbApiKey = lib.mkOption { OmdbApiKey = lib.mkOption {
type = lib.types.nullOr shblib.secretFileType; type = lib.types.nullOr lib.shb.secretFileType;
description = "File containing the Open Movie Database API key."; description = "File containing the Open Movie Database API key.";
default = null; default = null;
}; };
@ -356,14 +355,14 @@ in
dataDir = "/var/lib/radarr"; dataDir = "/var/lib/radarr";
}; };
systemd.services.radarr.preStart = shblib.replaceSecrets { systemd.services.radarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled { // (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses"; AuthenticationRequired = "DisabledForLocalAddresses";
AuthenticationMethod = "External"; AuthenticationMethod = "External";
}); });
resultPath = "${config.services.radarr.dataDir}/config.xml"; resultPath = "${config.services.radarr.dataDir}/config.xml";
generator = shblib.replaceSecretsFormatAdapter apps.radarr.settingsFormat; generator = lib.shb.replaceSecretsFormatAdapter apps.radarr.settingsFormat;
}; };
shb.nginx.vhosts = [ (vhosts {} cfg') ]; shb.nginx.vhosts = [ (vhosts {} cfg') ];
@ -385,7 +384,7 @@ in
extraGroups = [ "media" ]; extraGroups = [ "media" ];
}; };
systemd.services.sonarr.preStart = shblib.replaceSecrets { systemd.services.sonarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled { // (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses"; AuthenticationRequired = "DisabledForLocalAddresses";
@ -411,7 +410,7 @@ in
users.users.bazarr = { users.users.bazarr = {
extraGroups = [ "media" ]; extraGroups = [ "media" ];
}; };
systemd.services.bazarr.preStart = shblib.replaceSecrets { systemd.services.bazarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled { // (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses"; AuthenticationRequired = "DisabledForLocalAddresses";
@ -436,7 +435,7 @@ in
users.users.readarr = { users.users.readarr = {
extraGroups = [ "media" ]; extraGroups = [ "media" ];
}; };
systemd.services.readarr.preStart = shblib.replaceSecrets { systemd.services.readarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings; userConfig = cfg'.settings;
resultPath = "${config.services.readarr.dataDir}/config.xml"; resultPath = "${config.services.readarr.dataDir}/config.xml";
generator = apps.readarr.settingsFormat.generate; generator = apps.readarr.settingsFormat.generate;
@ -458,7 +457,7 @@ in
users.users.lidarr = { users.users.lidarr = {
extraGroups = [ "media" ]; extraGroups = [ "media" ];
}; };
systemd.services.lidarr.preStart = shblib.replaceSecrets { systemd.services.lidarr.preStart = lib.shb.replaceSecrets {
userConfig = cfg'.settings userConfig = cfg'.settings
// (lib.optionalAttrs isSSOEnabled { // (lib.optionalAttrs isSSOEnabled {
AuthenticationRequired = "DisabledForLocalAddresses"; AuthenticationRequired = "DisabledForLocalAddresses";
@ -484,8 +483,8 @@ in
users.users.jackett = { users.users.jackett = {
extraGroups = [ "media" ]; extraGroups = [ "media" ];
}; };
systemd.services.jackett.preStart = shblib.replaceSecrets { systemd.services.jackett.preStart = lib.shb.replaceSecrets {
userConfig = shblib.renameAttrName cfg'.settings "ApiKey" "APIKey"; userConfig = lib.shb.renameAttrName cfg'.settings "ApiKey" "APIKey";
resultPath = "${config.services.jackett.dataDir}/ServerConfig.json"; resultPath = "${config.services.jackett.dataDir}/ServerConfig.json";
generator = apps.jackett.settingsFormat.generate; generator = apps.jackett.settingsFormat.generate;
}; };

5
modules/services/deluge.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.deluge; cfg = config.shb.deluge;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -180,7 +179,7 @@ in
type = lib.types.attrsOf (lib.types.submodule { type = lib.types.attrsOf (lib.types.submodule {
options = { options = {
password = lib.mkOption { password = lib.mkOption {
type = shblib.secretFileType; type = lib.shb.secretFileType;
description = "File containing the user password."; description = "File containing the user password.";
}; };
}; };
@ -328,7 +327,7 @@ in
web.port = cfg.webPort; web.port = cfg.webPort;
}; };
systemd.services.deluged.preStart = lib.mkBefore (shblib.replaceSecrets { systemd.services.deluged.preStart = lib.mkBefore (lib.shb.replaceSecrets {
userConfig = cfg.extraUsers // { userConfig = cfg.extraUsers // {
localclient.password.source = config.shb.deluge.localclientPassword.result.path; localclient.password.source = config.shb.deluge.localclientPassword.result.path;
} // (lib.optionalAttrs (config.shb.deluge.prometheusScraperPassword != null) { } // (lib.optionalAttrs (config.shb.deluge.prometheusScraperPassword != null) {

15
modules/services/home-assistant.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.home-assistant; cfg = config.shb.home-assistant;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -57,23 +56,23 @@ in
freeformType = lib.types.attrsOf lib.types.str; freeformType = lib.types.attrsOf lib.types.str;
options = { options = {
name = lib.mkOption { name = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ]; type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Name of the Home Assistant instance."; description = "Name of the Home Assistant instance.";
}; };
country = lib.mkOption { country = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ]; type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Two letter country code where this instance is located."; description = "Two letter country code where this instance is located.";
}; };
latitude = lib.mkOption { latitude = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ]; type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Latitude where this instance is located."; description = "Latitude where this instance is located.";
}; };
longitude = lib.mkOption { longitude = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ]; type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Longitude where this instance is located."; description = "Longitude where this instance is located.";
}; };
time_zone = lib.mkOption { time_zone = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ]; type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Timezone of this instance."; description = "Timezone of this instance.";
example = "America/Los_Angeles"; example = "America/Los_Angeles";
}; };
@ -348,10 +347,10 @@ in
mkdir -p ''$(dirname ${file}) && cp ${onboarding} ${file} mkdir -p ''$(dirname ${file}) && cp ${onboarding} ${file}
fi fi
'') '')
+ (shblib.replaceSecrets { + (lib.shb.replaceSecrets {
userConfig = cfg.config; userConfig = cfg.config;
resultPath = "${config.services.home-assistant.configDir}/secrets.yaml"; resultPath = "${config.services.home-assistant.configDir}/secrets.yaml";
generator = shblib.replaceSecretsGeneratorAdapter (lib.generators.toYAML {}); generator = lib.shb.replaceSecretsGeneratorAdapter (lib.generators.toYAML {});
}); });
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [

5
modules/services/immich.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.immich; cfg = config.shb.immich;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
protocol = if !(isNull cfg.ssl) then "https" else "http"; protocol = if !(isNull cfg.ssl) then "https" else "http";
@ -62,10 +61,10 @@ let
# Use SHB's replaceSecrets function for loading secrets at runtime # Use SHB's replaceSecrets function for loading secrets at runtime
configSetupScript = lib.optionalString (cfg.sso.enable || cfg.smtp != null) ( configSetupScript = lib.optionalString (cfg.sso.enable || cfg.smtp != null) (
shblib.replaceSecrets { lib.shb.replaceSecrets {
userConfig = shbManagedSettings; userConfig = shbManagedSettings;
resultPath = configFile; resultPath = configFile;
generator = shblib.replaceSecretsFormatAdapter (pkgs.formats.json {}); generator = lib.shb.replaceSecretsFormatAdapter (pkgs.formats.json {});
user = "immich"; user = "immich";
permissions = "u=r,g=,o="; permissions = "u=r,g=,o=";
} }

9
modules/services/jellyfin.nix
View file

@ -6,7 +6,6 @@ let
cfg = config.shb.jellyfin; cfg = config.shb.jellyfin;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -569,7 +568,7 @@ in
fi fi
ln -fs "${debugLogging}" "${config.services.jellyfin.configDir}/logging.json" ln -fs "${debugLogging}" "${config.services.jellyfin.configDir}/logging.json"
'' ''
+ (shblib.replaceSecretsScript { + (lib.shb.replaceSecretsScript {
file = networkConfig; file = networkConfig;
# Write permissions are needed otherwise the jellyfin-cli tool will not work correctly. # Write permissions are needed otherwise the jellyfin-cli tool will not work correctly.
permissions = "u=rw,g=rw,o="; permissions = "u=rw,g=rw,o=";
@ -577,7 +576,7 @@ in
replacements = [ replacements = [
]; ];
}) })
+ lib.strings.optionalString cfg.ldap.enable (shblib.replaceSecretsScript { + lib.strings.optionalString cfg.ldap.enable (lib.shb.replaceSecretsScript {
file = ldapConfig; file = ldapConfig;
resultPath = "${config.services.jellyfin.dataDir}/plugins/configurations/LDAP-Auth.xml"; resultPath = "${config.services.jellyfin.dataDir}/plugins/configurations/LDAP-Auth.xml";
replacements = [ replacements = [
@ -587,7 +586,7 @@ in
} }
]; ];
}) })
+ lib.strings.optionalString cfg.sso.enable (shblib.replaceSecretsScript { + lib.strings.optionalString cfg.sso.enable (lib.shb.replaceSecretsScript {
file = ssoConfig; file = ssoConfig;
resultPath = "${config.services.jellyfin.dataDir}/plugins/configurations/SSO-Auth.xml"; resultPath = "${config.services.jellyfin.dataDir}/plugins/configurations/SSO-Auth.xml";
replacements = [ replacements = [
@ -597,7 +596,7 @@ in
} }
]; ];
}) })
+ lib.strings.optionalString cfg.sso.enable (shblib.replaceSecretsScript { + lib.strings.optionalString cfg.sso.enable (lib.shb.replaceSecretsScript {
file = brandingConfig; file = brandingConfig;
resultPath = "${config.services.jellyfin.dataDir}/config/branding.xml"; resultPath = "${config.services.jellyfin.dataDir}/config/branding.xml";
replacements = [ replacements = [

5
modules/services/open-webui.nix
View file

@ -3,7 +3,6 @@ let
cfg = config.shb.open-webui; cfg = config.shb.open-webui;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
roleClaim = "openwebui_groups"; roleClaim = "openwebui_groups";
oauthScopes = [ "openid" "email" "profile" "groups" "${roleClaim}" ]; oauthScopes = [ "openid" "email" "profile" "groups" "${roleClaim}" ];
@ -256,12 +255,12 @@ in
"d '/run/open-webui' 0750 root root - -" "d '/run/open-webui' 0750 root root - -"
]; ];
systemd.services.open-webui-pre = { systemd.services.open-webui-pre = {
script = shblib.replaceSecrets { script = lib.shb.replaceSecrets {
userConfig = { userConfig = {
OAUTH_CLIENT_SECRET.source = cfg.sso.sharedSecret.result.path; OAUTH_CLIENT_SECRET.source = cfg.sso.sharedSecret.result.path;
}; };
resultPath = "/run/open-webui/secrets.env"; resultPath = "/run/open-webui/secrets.env";
generator = shblib.toEnvVar; generator = lib.shb.toEnvVar;
}; };
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];

7
modules/services/pinchflat.nix
View file

@ -5,7 +5,6 @@ let
inherit (lib) types; inherit (lib) types;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
in in
{ {
imports = [ imports = [
@ -58,7 +57,7 @@ in
}; };
timeZone = lib.mkOption { timeZone = lib.mkOption {
type = lib.types.oneOf [ lib.types.str shblib.secretFileType ]; type = lib.types.oneOf [ lib.types.str lib.shb.secretFileType ];
description = "Timezone of this instance."; description = "Timezone of this instance.";
example = "America/Los_Angeles"; example = "America/Los_Angeles";
}; };
@ -147,13 +146,13 @@ in
}; };
systemd.services.pinchflat-pre = { systemd.services.pinchflat-pre = {
script = shblib.replaceSecrets { script = lib.shb.replaceSecrets {
userConfig = { userConfig = {
SECRET_KEY_BASE.source = cfg.secretKeyBase.result.path; SECRET_KEY_BASE.source = cfg.secretKeyBase.result.path;
# TZ = cfg.secretKeyBase.result.path; # Uncomment when PR is merged. # TZ = cfg.secretKeyBase.result.path; # Uncomment when PR is merged.
}; };
resultPath = "/run/pinchflat/secrets.env"; resultPath = "/run/pinchflat/secrets.env";
generator = shblib.toEnvVar; generator = lib.shb.toEnvVar;
}; };
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];

5
modules/services/vaultwarden.nix
View file

@ -4,7 +4,6 @@ let
cfg = config.shb.vaultwarden; cfg = config.shb.vaultwarden;
contracts = pkgs.callPackage ../contracts {}; contracts = pkgs.callPackage ../contracts {};
shblib = pkgs.callPackage ../../lib {};
fqdn = "${cfg.subdomain}.${cfg.domain}"; fqdn = "${cfg.subdomain}.${cfg.domain}";
@ -191,7 +190,7 @@ in
# Needed to be able to write template config. # Needed to be able to write template config.
systemd.services.vaultwarden.serviceConfig.ProtectHome = lib.mkForce false; systemd.services.vaultwarden.serviceConfig.ProtectHome = lib.mkForce false;
systemd.services.vaultwarden.preStart = systemd.services.vaultwarden.preStart =
shblib.replaceSecrets { lib.shb.replaceSecrets {
userConfig = { userConfig = {
DATABASE_URL.source = cfg.databasePassword.result.path; DATABASE_URL.source = cfg.databasePassword.result.path;
DATABASE_URL.transform = v: "postgresql://vaultwarden:${v}@127.0.0.1:5432/vaultwarden"; DATABASE_URL.transform = v: "postgresql://vaultwarden:${v}@127.0.0.1:5432/vaultwarden";
@ -199,7 +198,7 @@ in
SMTP_PASSWORD.source = cfg.smtp.password.result.path; SMTP_PASSWORD.source = cfg.smtp.password.result.path;
}; };
resultPath = "${dataFolder}/vaultwarden.env"; resultPath = "${dataFolder}/vaultwarden.env";
generator = shblib.toEnvVar; generator = lib.shb.toEnvVar;
}; };
shb.nginx.vhosts = [ shb.nginx.vhosts = [

22
test/blocks/lib.nix
View file

@ -1,8 +1,6 @@
{ pkgs, lib, ... }: { pkgs, lib, ... }:
let let
pkgs' = pkgs; pkgs' = pkgs;
shblib = pkgs.callPackage ../../lib {};
in in
{ {
template = template =
@ -24,34 +22,34 @@ in
d.d = "not secret D"; d.d = "not secret D";
}; };
configWithTemplates = shblib.withReplacements userConfig; configWithTemplates = lib.shb.withReplacements userConfig;
nonSecretConfigFile = pkgs.writeText "config.yaml.template" (lib.generators.toJSON {} configWithTemplates); nonSecretConfigFile = pkgs.writeText "config.yaml.template" (lib.generators.toJSON {} configWithTemplates);
replacements = shblib.getReplacements userConfig; replacements = lib.shb.getReplacements userConfig;
replaceInTemplate = shblib.replaceSecretsScript { replaceInTemplate = lib.shb.replaceSecretsScript {
file = nonSecretConfigFile; file = nonSecretConfigFile;
resultPath = "/var/lib/config.yaml"; resultPath = "/var/lib/config.yaml";
inherit replacements; inherit replacements;
}; };
replaceInTemplateJSON = shblib.replaceSecrets { replaceInTemplateJSON = lib.shb.replaceSecrets {
inherit userConfig; inherit userConfig;
resultPath = "/var/lib/config.json"; resultPath = "/var/lib/config.json";
generator = shblib.replaceSecretsFormatAdapter (pkgs.formats.json {}); generator = lib.shb.replaceSecretsFormatAdapter (pkgs.formats.json {});
}; };
replaceInTemplateJSONGen = shblib.replaceSecrets { replaceInTemplateJSONGen = lib.shb.replaceSecrets {
inherit userConfig; inherit userConfig;
resultPath = "/var/lib/config_gen.json"; resultPath = "/var/lib/config_gen.json";
generator = shblib.replaceSecretsGeneratorAdapter (lib.generators.toJSON {}); generator = lib.shb.replaceSecretsGeneratorAdapter (lib.generators.toJSON {});
}; };
replaceInTemplateXML = shblib.replaceSecrets { replaceInTemplateXML = lib.shb.replaceSecrets {
inherit userConfig; inherit userConfig;
resultPath = "/var/lib/config.xml"; resultPath = "/var/lib/config.xml";
generator = shblib.replaceSecretsFormatAdapter (shblib.formatXML {enclosingRoot = "Root";}); generator = lib.shb.replaceSecretsFormatAdapter (lib.shb.formatXML {enclosingRoot = "Root";});
}; };
in in
lib.shb.runNixOSTest { lib.shb.runNixOSTest {
@ -64,7 +62,7 @@ in
{ {
options = { options = {
libtest.config = lib.mkOption { libtest.config = lib.mkOption {
type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str shblib.secretFileType ]); type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str lib.secretFileType ]);
}; };
}; };
} }

4
test/contracts/backup.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }: { pkgs, lib, ... }:
let let
contracts = pkgs.callPackage ../../modules/contracts {}; contracts = pkgs.callPackage ../../modules/contracts { inherit lib; };
in in
{ {
restic_root = contracts.test.backup { restic_root = contracts.test.backup {

4
test/contracts/databasebackup.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }: { pkgs, lib, ... }:
let let
contracts = pkgs.callPackage ../../modules/contracts {}; contracts = pkgs.callPackage ../../modules/contracts { inherit lib; };
in in
{ {
restic_postgres = contracts.test.databasebackup { restic_postgres = contracts.test.databasebackup {

4
test/contracts/secret.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }: { pkgs, lib, ... }:
let let
contracts = pkgs.callPackage ../../modules/contracts {}; contracts = pkgs.callPackage ../../modules/contracts { inherit lib; };
in in
{ {
hardcoded_root_root = contracts.test.secret { hardcoded_root_root = contracts.test.secret {

12
test/modules/lib.nix
View file

@ -1,7 +1,5 @@
{ pkgs, lib, ... }: { lib, ... }:
let let
shblib = pkgs.callPackage ../../lib {};
inherit (lib) nameValuePair; inherit (lib) nameValuePair;
in in
{ {
@ -35,7 +33,7 @@ in
c.other = "other"; c.other = "other";
}; };
in in
shblib.withReplacements ( lib.shb.withReplacements (
item // { item // {
nestedAttr = item; nestedAttr = item;
nestedList = [ item ]; nestedList = [ item ];
@ -70,7 +68,7 @@ in
c.other = "other"; c.other = "other";
}; };
in in
shblib.withReplacements [ lib.shb.withReplacements [
item item
item item
[ item ] [ item ]
@ -101,7 +99,7 @@ in
c.other = "other"; c.other = "other";
}; };
in in
map shblib.genReplacement (shblib.getReplacements ( map lib.shb.genReplacement (lib.shb.getReplacements (
item // { item // {
nestedAttr = item; nestedAttr = item;
nestedList = [ item ]; nestedList = [ item ];
@ -120,7 +118,7 @@ in
}; };
}; };
expr = shblib.parseXML '' expr = lib.shb.parseXML ''
<a> <a>
<b>1</b> <b>1</b>
<c><d>1</d></c> <c><d>1</d></c>