about summary refs log tree commit diff
path: root/tools/nixery/default.nix
blob: 6a0c19d9a72e53b4aa389bae96c9e5b9c969527a (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# Copyright 2022 The TVL Contributors
# SPDX-License-Identifier: Apache-2.0

# This function header aims to provide compatibility between builds of
# Nixery taking place inside/outside of the TVL depot.
#
# In the future, Nixery will transition to using //nix/buildGo for its
# build system and this will need some major adaptations to support
# that.
{ depot ? { nix.readTree.drvTargets = x: x; }
, pkgs ? import <nixpkgs> { }
, preLaunch ? ""
, extraPackages ? [ ]
, maxLayers ? 20
, commitHash ? null
, ...
}@args:

with pkgs;

let
  inherit (pkgs) buildGoModule lib;

  # Avoid extracting this from git until we have a way to plumb
  # through revision numbers.
  nixery-commit-hash = "depot";
in
depot.nix.readTree.drvTargets rec {
  # Implementation of the Nix image building logic
  nixery-prepare-image = import ./prepare-image { inherit pkgs; };

  # Include the Nixery website into the Nix store, unless its being
  # overridden to something else. Nixery will serve this as its front
  # page when visited from a browser.
  nixery-web = ./web;

  nixery-popcount = callPackage ./popcount { };

  # Build Nixery's Go code, resulting in the binaries used for various
  # bits of functionality.
  #
  # The server binary is wrapped to ensure that required environment
  # variables are set at runtime.
  nixery = buildGoModule rec {
    name = "nixery";
    src = ./.;
    doCheck = true;

    # Needs to be updated after every modification of go.mod/go.sum
    vendorHash = "sha256-io9NCeZmjCZPLmII3ajXIsBWbT40XiW8ncXOuUDabbo=";

    ldflags = [
      "-s"
      "-w"
      "-X"
      "main.version=${nixery-commit-hash}"
    ];

    nativeBuildInputs = [ makeWrapper ];
    postInstall = ''
      wrapProgram $out/bin/server \
        --set-default WEB_DIR "${nixery-web}" \
        --prefix PATH : ${nixery-prepare-image}/bin
    '';

    # Nixery is mirrored to Github at tazjin/nixery; this is
    # automatically updated from CI for canon builds.
    passthru.meta.ci.extraSteps.github = depot.tools.releases.filteredGitPush {
      filter = ":/tools/nixery";
      remote = "git@github.com:tazjin/nixery.git";
      ref = "refs/heads/master";
    };
  };

  # Container image containing Nixery and Nix itself. This image can
  # be run on Kubernetes, published on AppEngine or whatever else is
  # desired.
  nixery-image =
    let
      # Wrapper script for the wrapper script (meta!) which configures
      # the container environment appropriately.
      #
      # Most importantly, sandboxing is disabled to avoid privilege
      # issues in containers.
      nixery-launch-script = writeShellScriptBin "nixery" ''
        set -e
        export PATH=${coreutils}/bin:$PATH
        export NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
        mkdir -p /tmp

        # Create the build user/group required by Nix
        echo 'nixbld:x:30000:nixbld' >> /etc/group
        echo 'nixbld:x:30000:30000:nixbld:/tmp:/bin/bash' >> /etc/passwd
        echo 'root:x:0:0:root:/root:/bin/bash' >> /etc/passwd
        echo 'root:x:0:' >> /etc/group

        # Disable sandboxing to avoid running into privilege issues
        mkdir -p /etc/nix
        echo 'sandbox = false' >> /etc/nix/nix.conf

        # In some cases users building their own image might want to
        # customise something on the inside (e.g. set up an environment
        # for keys or whatever).
        #
        # This can be achieved by setting a 'preLaunch' script.
        ${preLaunch}

        exec ${nixery}/bin/server
      '';
    in
    dockerTools.buildLayeredImage {
      name = "nixery";
      config.Cmd = [ "${nixery-launch-script}/bin/nixery" ];

      inherit maxLayers;
      contents = [
        bashInteractive
        cacert
        coreutils
        git
        gnutar
        gzip
        iana-etc
        nix
        nixery-prepare-image
        nixery-launch-script
        openssh
        zlib
      ] ++ extraPackages;
    };
}