danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mod: make imports explicit and remove system

Browse source
This commit is contained in:
ibizaman 2025-10-10 07:18:21 +02:00 committed by Pierre Penninckx
parent bd0bd713fd
commit 9892f55ae2
27 changed files with 201 additions and 144 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
demo/homeassistant/flake.nix
View file

@ -15,7 +15,10 @@
basic = { config, ... }: {
imports = [
./configuration.nix
selfhostblocks.nixosModules.x86_64-linux.default
selfhostblocks.nixosModules.authelia
selfhostblocks.nixosModules.home-assistant
selfhostblocks.nixosModules.sops
selfhostblocks.nixosModules.ssl
sops-nix.nixosModules.default
];

6
demo/nextcloud/flake.nix
View file

@ -15,7 +15,11 @@
basic = { config, ... }: {
imports = [
./configuration.nix
selfhostblocks.nixosModules.x86_64-linux.default
selfhostblocks.nixosModules.authelia
selfhostblocks.nixosModules.nextcloud-server
selfhostblocks.nixosModules.nginx
selfhostblocks.nixosModules.sops
selfhostblocks.nixosModules.ssl
sops-nix.nixosModules.default
];

39
docs/default.nix
View file

@ -30,7 +30,7 @@ let
ghRoot = (gitHubDeclaration "ibizaman" "selfhostblocks" "").url;
buildOptionsDocs = args@{ modules, ... }:
buildOptionsDocs = { modules, filterOptionPath ? null }: args:
let
config = {
_module.check = false;
@ -51,7 +51,7 @@ let
};
};
options = lib.filterAttrs (name: v: name == "shb") eval.options;
options = lib.setAttrByPath filterOptionPath (lib.getAttrFromPath filterOptionPath eval.options);
in buildPackages.nixosOptionsDoc ({
inherit options;
@ -63,22 +63,30 @@ let
gitHubDeclaration "ibizaman" "selfhostblocks"
(lib.removePrefix "/" (lib.removePrefix shbPath (toString decl)))) opt.declarations;
};
} // builtins.removeAttrs args [ "modules" "includeModuleSystemOptions" ]);
} // builtins.removeAttrs args [ "includeModuleSystemOptions" ]);
scrubbedModule = {
_module.args.pkgs = lib.mkForce (nmd.scrubDerivations "pkgs" pkgs);
_module.check = false;
};
allOptionsDocs = paths: (buildOptionsDocs {
modules = paths ++ allModules ++ [ scrubbedModule ];
variablelistId = "selfhostblocks-options";
}).optionsJSON;
allOptionsDocs = paths: (buildOptionsDocs
{
modules = paths ++ allModules ++ [ scrubbedModule ];
filterOptionPath = [ "shb" ];
}
{
variablelistId = "selfhostblocks-options";
}).optionsJSON;
individualModuleOptionsDocs = paths: (buildOptionsDocs {
modules = paths ++ [ scrubbedModule ];
variablelistId = "selfhostblocks-options";
}).optionsJSON;
individualModuleOptionsDocs = filterOptionPath: paths: (buildOptionsDocs
{
modules = paths ++ [ scrubbedModule ];
inherit filterOptionPath;
}
{
variablelistId = "selfhostblocks-options";
}).optionsJSON;
nmd = import nmdsrc {
inherit lib;
@ -138,11 +146,16 @@ in stdenv.mkDerivation {
(pkgs.path + "/nixos/modules/services/misc/forgejo.nix")
]}/share/doc/nixos/options.json
''
+ lib.concatStringsSep "\n" (lib.mapAttrsToList (name: path: ''
+ lib.concatStringsSep "\n" (lib.mapAttrsToList (name: cfg':
let
cfg = if builtins.isAttrs cfg' then cfg' else { module = cfg'; };
module = if builtins.isList cfg.module then cfg.module else [ cfg.module ];
optionRoot = cfg.optionRoot or [ "shb" (lib.last (lib.splitString "/" name)) ];
in ''
substituteInPlace ./modules/${name}/docs/default.md \
--replace-fail \
'@OPTIONS_JSON@' \
${individualModuleOptionsDocs (if builtins.isList path then path else [ path ])}/share/doc/nixos/options.json
${individualModuleOptionsDocs optionRoot module}/share/doc/nixos/options.json
'') modules)
+ ''
find . -name "*.md" -print0 | \

22
docs/usage.md
View file

@ -13,7 +13,7 @@ Then, in your `nixosConfigurations`, you can import all modules with:
```nix
imports = [
inputs.selfhostblocks.nixosModules.x86_64-linux.default
inputs.selfhostblocks.default
];
```
@ -21,9 +21,9 @@ or selectively import some with, for example:
```nix
imports = [
inputs.selfhostblocks.nixosModules.x86_64-linux.authelia
inputs.selfhostblocks.nixosModules.x86_64-linux.lldap
inputs.selfhostblocks.nixosModules.x86_64-linux.nextcloud
inputs.selfhostblocks.authelia
inputs.selfhostblocks.lldap
inputs.selfhostblocks.nextcloud
];
```
@ -133,7 +133,7 @@ The following snippets show how to deploy Self Host Blocks using the standard de
machine = nixosSystem' {
inherit system;
modules = [
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
];
};
};
@ -172,7 +172,7 @@ some not using Self Host Blocks, then you can do the following:
machine2 = shbNixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
];
};
};
@ -212,7 +212,7 @@ The following snippets show how to deploy Self Host Blocks using the deployment
machine = { selfhostblocks, ... }: {
imports = [
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
];
};
};
@ -258,7 +258,7 @@ in this case you can use the `colmena.meta.nodeNixpkgs` option:
machine2 = { selfhostblocks, ... }: {
imports = [
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
];
# Machine specific configuration goes here.
@ -307,7 +307,7 @@ The following snippets show how to deploy Self Host Blocks using the deployment
in
nixosModules.machine = {
imports = [
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
];
};
@ -378,7 +378,7 @@ in this case you can do:
nixosModules.machine2 = {
imports = [
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
];
};
@ -578,7 +578,7 @@ as well as [Skarabox][], my sibling project used to bootstrap a server.
nixosModules.skarabox = {
imports = [
skarabox.nixosModules.skarabox
selfhostblocks.nixosModules.${system}.default
selfhostblocks.nixosModules.default
sops-nix.nixosModules.default
({ config, ... }: {
skarabox.hostname = "skarabox";

169
flake.nix
View file

@ -51,81 +51,9 @@
];
in
{
nixosModules.default = self.nixosModules.${system}.all;
nixosModules.all = {
imports = [
self.nixosModules.${system}.insecure
# blocks
self.nixosModules.${system}.authelia
self.nixosModules.${system}.davfs
self.nixosModules.${system}.hardcodedsecret
self.nixosModules.${system}.lldap
self.nixosModules.${system}.mitmdump
self.nixosModules.${system}.monitoring
self.nixosModules.${system}.nginx
self.nixosModules.${system}.postgresql
self.nixosModules.${system}.restic
self.nixosModules.${system}.ssl
self.nixosModules.${system}.sops
self.nixosModules.${system}.tinyproxy
self.nixosModules.${system}.vpn
self.nixosModules.${system}.zfs
# services
self.nixosModules.${system}.arr
self.nixosModules.${system}.audiobookshelf
self.nixosModules.${system}.deluge
self.nixosModules.${system}.forgejo
self.nixosModules.${system}.grocy
self.nixosModules.${system}.hledger
self.nixosModules.${system}.immich
self.nixosModules.${system}.home-assistant
self.nixosModules.${system}.jellyfin
self.nixosModules.${system}.nextcloud-server
self.nixosModules.${system}.open-webui
self.nixosModules.${system}.pinchflat
self.nixosModules.${system}.vaultwarden
];
};
nixosModules.insecure = {
nixpkgs.config.permittedInsecurePackages = [
];
};
nixosModules.authelia = modules/blocks/authelia.nix;
nixosModules.davfs = modules/blocks/davfs.nix;
nixosModules.hardcodedsecret = modules/blocks/hardcodedsecret.nix;
nixosModules.lldap = modules/blocks/lldap.nix;
nixosModules.mitmdump = modules/blocks/mitmdump.nix;
nixosModules.monitoring = modules/blocks/monitoring.nix;
nixosModules.nginx = modules/blocks/nginx.nix;
nixosModules.postgresql = modules/blocks/postgresql.nix;
nixosModules.restic = modules/blocks/restic.nix;
nixosModules.ssl = modules/blocks/ssl.nix;
nixosModules.sops = modules/blocks/sops.nix;
nixosModules.tinyproxy = modules/blocks/tinyproxy.nix;
nixosModules.vpn = modules/blocks/vpn.nix;
nixosModules.zfs = modules/blocks/zfs.nix;
nixosModules.arr = modules/services/arr.nix;
nixosModules.audiobookshelf = modules/services/audiobookshelf.nix;
nixosModules.deluge = modules/services/deluge.nix;
nixosModules.forgejo = modules/services/forgejo.nix;
nixosModules.grocy = modules/services/grocy.nix;
nixosModules.hledger = modules/services/hledger.nix;
nixosModules.immich = modules/services/immich.nix;
nixosModules.home-assistant = modules/services/home-assistant.nix;
nixosModules.jellyfin = modules/services/jellyfin.nix;
nixosModules.nextcloud-server = modules/services/nextcloud-server.nix;
nixosModules.open-webui = modules/services/open-webui.nix;
nixosModules.pinchflat = modules/services/pinchflat.nix;
nixosModules.vaultwarden = modules/services/vaultwarden.nix;
packages.manualHtml = pkgs.callPackage ./docs {
inherit nmdsrc;
allModules = self.nixosModules.${system}.all.imports ++ contractDummyModules;
allModules = self.nixosModules.all.imports ++ contractDummyModules;
release = builtins.readFile ./VERSION;
substituteVersionIn = [
@ -135,7 +63,10 @@
modules = {
"blocks/authelia" = ./modules/blocks/authelia.nix;
"blocks/lldap" = ./modules/blocks/lldap.nix;
"blocks/ssl" = ./modules/blocks/ssl.nix;
"blocks/ssl" = {
module = ./modules/blocks/ssl.nix;
optionRoot = [ "shb" "certs" ];
};
"blocks/mitmdump" = ./modules/blocks/mitmdump.nix;
"blocks/monitoring" = ./modules/blocks/monitoring.nix;
"blocks/postgresql" = ./modules/blocks/postgresql.nix;
@ -148,14 +79,29 @@
];
"services/home-assistant" = ./modules/services/home-assistant.nix;
"services/jellyfin" = ./modules/services/jellyfin.nix;
"services/nextcloud-server" = ./modules/services/nextcloud-server.nix;
"services/nextcloud-server" = {
module = ./modules/services/nextcloud-server.nix;
optionRoot = [ "shb" "nextcloud" ];
};
"services/open-webui" = ./modules/services/open-webui.nix;
"services/pinchflat" = ./modules/services/pinchflat.nix;
"services/vaultwarden" = ./modules/services/vaultwarden.nix;
"contracts/backup" = ./modules/contracts/backup/dummyModule.nix;
"contracts/databasebackup" = ./modules/contracts/databasebackup/dummyModule.nix;
"contracts/secret" = ./modules/contracts/secret/dummyModule.nix;
"contracts/ssl" = ./modules/contracts/ssl/dummyModule.nix;
"contracts/backup" = {
module = ./modules/contracts/backup/dummyModule.nix;
optionRoot = [ "shb" "contracts" "backup" ];
};
"contracts/databasebackup" = {
module = ./modules/contracts/databasebackup/dummyModule.nix;
optionRoot = [ "shb" "contracts" "databasebackup" ];
};
"contracts/secret" = {
module = ./modules/contracts/secret/dummyModule.nix;
optionRoot = [ "shb" "contracts" "secret" ];
};
"contracts/ssl" = {
module = ./modules/contracts/ssl/dummyModule.nix;
optionRoot = [ "shb" "contracts" "ssl" ];
};
};
};
@ -327,5 +273,70 @@
}
) // {
herculesCI.ciSystems = [ "x86_64-linux" ];
nixosModules.default = self.nixosModules.all;
nixosModules.all = {
imports = [
# blocks
self.nixosModules.authelia
self.nixosModules.davfs
self.nixosModules.hardcodedsecret
self.nixosModules.lldap
self.nixosModules.mitmdump
self.nixosModules.monitoring
self.nixosModules.nginx
self.nixosModules.postgresql
self.nixosModules.restic
self.nixosModules.ssl
self.nixosModules.sops
self.nixosModules.tinyproxy
self.nixosModules.vpn
self.nixosModules.zfs
# services
self.nixosModules.arr
self.nixosModules.audiobookshelf
self.nixosModules.deluge
self.nixosModules.forgejo
self.nixosModules.grocy
self.nixosModules.hledger
self.nixosModules.immich
self.nixosModules.home-assistant
self.nixosModules.jellyfin
self.nixosModules.nextcloud-server
self.nixosModules.open-webui
self.nixosModules.pinchflat
self.nixosModules.vaultwarden
];
};
nixosModules.authelia = modules/blocks/authelia.nix;
nixosModules.davfs = modules/blocks/davfs.nix;
nixosModules.hardcodedsecret = modules/blocks/hardcodedsecret.nix;
nixosModules.lldap = modules/blocks/lldap.nix;
nixosModules.mitmdump = modules/blocks/mitmdump.nix;
nixosModules.monitoring = modules/blocks/monitoring.nix;
nixosModules.nginx = modules/blocks/nginx.nix;
nixosModules.postgresql = modules/blocks/postgresql.nix;
nixosModules.restic = modules/blocks/restic.nix;
nixosModules.ssl = modules/blocks/ssl.nix;
nixosModules.sops = modules/blocks/sops.nix;
nixosModules.tinyproxy = modules/blocks/tinyproxy.nix;
nixosModules.vpn = modules/blocks/vpn.nix;
nixosModules.zfs = modules/blocks/zfs.nix;
nixosModules.arr = modules/services/arr.nix;
nixosModules.audiobookshelf = modules/services/audiobookshelf.nix;
nixosModules.deluge = modules/services/deluge.nix;
nixosModules.forgejo = modules/services/forgejo.nix;
nixosModules.grocy = modules/services/grocy.nix;
nixosModules.hledger = modules/services/hledger.nix;
nixosModules.immich = modules/services/immich.nix;
nixosModules.home-assistant = modules/services/home-assistant.nix;
nixosModules.jellyfin = modules/services/jellyfin.nix;
nixosModules.nextcloud-server = modules/services/nextcloud-server.nix;
nixosModules.open-webui = modules/services/open-webui.nix;
nixosModules.pinchflat = modules/services/pinchflat.nix;
nixosModules.vaultwarden = modules/services/vaultwarden.nix;
};
}

6
modules/blocks/authelia.nix
View file

@ -17,6 +17,12 @@ let
listenPort = if cfg.debug then 9090 else 9091;
in
{
imports = [
./lldap.nix
./mitmdump.nix
./postgresql.nix
];
options.shb.authelia = {
enable = lib.mkEnableOption "selfhostblocks.authelia";

11
modules/blocks/lldap.nix
View file

@ -48,6 +48,13 @@ let
};
in
{
imports = [
./hardcodedsecret.nix
./mitmdump.nix
(lib.mkRenamedOptionModule [ "shb" "ldap" ] [ "shb" "lldap" ])
];
options.shb.lldap = {
enable = lib.mkEnableOption "the LDAP service";
@ -321,10 +328,6 @@ in
default = true;
};
};
imports = [
(lib.mkRenamedOptionModule [ "shb" "ldap" ] [ "shb" "lldap" ])
];
config = lib.mkIf cfg.enable {

6
modules/blocks/restic.nix
View file

@ -7,7 +7,7 @@ let
contracts = pkgs.callPackage ../contracts {};
inherit (lib) concatStringsSep filterAttrs flatten literalExpression optionals listToAttrs mapAttrsToList mkEnableOption mkOption mkMerge;
inherit (lib) generators hasPrefix mkIf nameValuePair optionalAttrs removePrefix;
inherit (lib) hasPrefix mkIf nameValuePair optionalAttrs removePrefix;
inherit (lib.types) attrsOf enum int ints oneOf nonEmptyStr nullOr str submodule;
commonOptions = { name, prefix, config, ... }: {
@ -106,6 +106,10 @@ let
fullName = name: repository: "restic-backups-${name}_${repoSlugName repository.path}";
in
{
imports = [
./hardcodedsecret.nix
];
options.shb.restic = {
instances = mkOption {
description = "Files to backup following the [backup contract](./contracts-backup.html).";

6
modules/blocks/ssl.nix
View file

@ -38,7 +38,7 @@ in
This option implements the SSL Generator contract.
'';
type = contracts.ssl.certs-paths;
default = rec {
default = {
key = "/var/lib/certs/cas/${config._module.args.name}.key";
cert = "/var/lib/certs/cas/${config._module.args.name}.cert";
};
@ -110,7 +110,7 @@ in
This option implements the SSL Generator contract.
'';
type = contracts.ssl.certs-paths;
default = rec {
default = {
key = "/var/lib/certs/selfsigned/${config._module.args.name}.key";
cert = "/var/lib/certs/selfsigned/${config._module.args.name}.cert";
};
@ -306,8 +306,6 @@ in
config =
let
filterProvider = provider: lib.attrsets.filterAttrs (k: i: i.provider == provider);
serviceName = lib.strings.removeSuffix ".service";
in
lib.mkMerge [

2
modules/blocks/tinyproxy.nix
View file

@ -25,8 +25,6 @@ let
});
configFile = name: cfg: settingsFormat.generate "tinyproxy-${name}.conf" cfg.settings;
someEnabled = any (mapAttrsToList (name: c: c.enable) cfg);
in
{
options =

2
modules/blocks/vpn.nix
View file

@ -197,8 +197,6 @@ let
echo "Running route-down DONE"
'';
};
someEnabled = lib.any (lib.mapAttrsToList (name: c: c.enable) cfg);
in
{
options =

4
modules/services/arr.nix
View file

@ -336,6 +336,10 @@ let
});
in
{
imports = [
../blocks/nginx.nix
];
options.shb.arr = lib.listToAttrs (lib.mapAttrsToList appOption apps);
config = lib.mkMerge [

4
modules/services/deluge.nix
View file

@ -18,6 +18,10 @@ let
lib.concatStringsSep "\n" lines;
in
{
imports = [
../blocks/nginx.nix
];
options.shb.deluge = {
enable = lib.mkEnableOption "selfhostblocks.deluge";

26
modules/services/forgejo.nix
View file

@ -9,6 +9,20 @@ let
inherit (lib.types) attrsOf bool enum listOf nullOr package port submodule str;
in
{
imports = [
../blocks/nginx.nix
(lib.mkRemovedOptionModule [ "shb" "forgejo" "adminPassword" ] ''Instead, define an admin user in shb.forgejo.users and give it the same password, like so:
shb.forgejo.users = {
"forgejoadmin" = {
isAdmin = true;
email = "forgejoadmin@example.com";
password.result = <path/to/password>;
};
};
'')
];
options.shb.forgejo = {
enable = mkEnableOption "selfhostblocks.forgejo";
@ -346,18 +360,6 @@ in
};
};
imports = [
(lib.mkRemovedOptionModule [ "shb" "forgejo" "adminPassword" ] ''Instead, define an admin user in shb.forgejo.users and give it the same password, like so:
shb.forgejo.users = {
"forgejoadmin" = {
isAdmin = true;
email = "forgejoadmin@example.com";
password.result = <path/to/password>;
};
};
'')
];
config = mkMerge [
(mkIf cfg.enable {
services.forgejo = {

4
modules/services/hledger.nix
View file

@ -8,6 +8,10 @@ let
fqdn = "${cfg.subdomain}.${cfg.domain}";
in
{
imports = [
../blocks/nginx.nix
];
options.shb.hledger = {
enable = lib.mkEnableOption "selfhostblocks.hledger";

4
modules/services/immich.nix
View file

@ -74,6 +74,10 @@ let
inherit (lib.types) attrs attrsOf bool enum listOf nullOr port submodule str path;
in
{
imports = [
../blocks/nginx.nix
];
options.shb.immich = {
enable = mkEnableOption "selfhostblocks.immich";

4
modules/services/open-webui.nix
View file

@ -9,6 +9,10 @@ let
oauthScopes = [ "openid" "email" "profile" "groups" "${roleClaim}" ];
in
{
imports = [
../blocks/nginx.nix
];
options.shb.open-webui = {
enable = lib.mkEnableOption "the Open-WebUI service";

4
modules/services/pinchflat.nix
View file

@ -8,6 +8,10 @@ let
shblib = pkgs.callPackage ../../lib {};
in
{
imports = [
../blocks/nginx.nix
];
options.shb.pinchflat = {
enable = lib.mkEnableOption "the Pinchflat service.";

4
modules/services/vaultwarden.nix
View file

@ -11,6 +11,10 @@ let
dataFolder = if lib.versionOlder (config.system.stateVersion or "24.11") "24.11" then "/var/lib/bitwarden_rs" else "/var/lib/vaultwarden";
in
{
imports = [
../blocks/nginx.nix
];
options.shb.vaultwarden = {
enable = lib.mkEnableOption "selfhostblocks.vaultwarden";

5
test/blocks/authelia.nix
View file

@ -1,4 +1,4 @@
{ pkgs, lib, ... }:
{ pkgs, ... }:
let
pkgs' = pkgs;
@ -14,9 +14,6 @@ in
(pkgs'.path + "/nixos/modules/profiles/qemu-guest.nix")
../../modules/blocks/authelia.nix
../../modules/blocks/hardcodedsecret.nix
../../modules/blocks/lldap.nix
../../modules/blocks/mitmdump.nix
../../modules/blocks/postgresql.nix
];
networking.hosts = {

2
test/blocks/lldap.nix
View file

@ -18,9 +18,7 @@ in
shb.ssl.enable = lib.mkEnableOption "ssl";
};
}
../../modules/blocks/hardcodedsecret.nix
../../modules/blocks/lldap.nix
../../modules/blocks/mitmdump.nix
];
shb.lldap = {

1
test/blocks/restic.nix
View file

@ -8,7 +8,6 @@ let
nodes.machine = { config, ... }: {
imports = [
testLib.baseImports
../../modules/blocks/hardcodedsecret.nix
../../modules/blocks/restic.nix
];

3
test/blocks/ssl.nix
View file

@ -1,4 +1,4 @@
{ pkgs, lib, ... }:
{ pkgs, ... }:
let
pkgs' = pkgs;
in
@ -130,7 +130,6 @@ in
multi = nodes.server.shb.certs.certs.selfsigned.multi;
cert1 = nodes.server.shb.certs.certs.selfsigned.cert1;
cert2 = nodes.server.shb.certs.certs.selfsigned.cert2;
cert3 = nodes.server.shb.certs.certs.selfsigned.cert3;
in
''
start_all()

2
test/services/hledger.nix
View file

@ -2,8 +2,6 @@
let
testLib = pkgs.callPackage ../common.nix {};
adminPassword = "AdminPassword";
commonTestScript = testLib.mkScripts {
hasSSL = { node, ... }: !(isNull node.config.shb.hledger.ssl);
waitForServices = { ... }: [

1
test/services/open-webui.nix
View file

@ -19,7 +19,6 @@ let
imports = [
testLib.baseModule
../../modules/blocks/hardcodedsecret.nix
../../modules/blocks/lldap.nix
../../modules/services/open-webui.nix
];

1
test/services/pinchflat.nix
View file

@ -17,7 +17,6 @@ let
imports = [
testLib.baseModule
../../modules/blocks/hardcodedsecret.nix
../../modules/blocks/lldap.nix
../../modules/services/pinchflat.nix
];

2
test/services/vaultwarden.nix
View file

@ -1,4 +1,4 @@
{ pkgs, lib, ... }:
{ pkgs, ... }:
let
testLib = pkgs.callPackage ../common.nix {};