From 67bb1368ec0854635900d7f0b30895d8b1a0a910 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sat, 13 Dec 2025 10:52:46 +0100 Subject: [PATCH 1/3] knot-resolver*_6: simplify path overrides --- .../by-name/kn/knot-resolver-manager_6/package.nix | 1 - pkgs/by-name/kn/knot-resolver_6/package.nix | 12 ++---------- pkgs/by-name/kn/knot-resolver_6/paths.patch | 14 ++++++++++++++ 3 files changed, 16 insertions(+), 11 deletions(-) create mode 100644 pkgs/by-name/kn/knot-resolver_6/paths.patch diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix index c7c6f7d7f493..3d3b4c89d326 100644 --- a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix +++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix @@ -23,7 +23,6 @@ python3Packages.buildPythonPackage { # But the install-time etc differs from a sensible run-time etc. postPatch = '' substitute '${knot-resolver.unwrapped.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \ - --replace-fail '${knot-resolver.unwrapped.out}/etc' '/etc' \ --replace-fail '${knot-resolver.unwrapped.out}/sbin' '${knot-resolver}/bin' '' # On non-Linux let's simplify construction of the knot-resolver command line, diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix index f961f28e4209..b49175965034 100644 --- a/pkgs/by-name/kn/knot-resolver_6/package.nix +++ b/pkgs/by-name/kn/knot-resolver_6/package.nix @@ -56,20 +56,12 @@ let excludes = [ "NEWS" ]; hash = "sha256-3w33v8UfhGdA50BlkfHpQLFxg+5ELk0lp7RzgvkSzK8="; }) + # Install-time paths sometimes differ from run-time paths in nixpkgs. + ./paths.patch ]; - # Path fixups for the NixOS service. # systemd Exec* options are difficult to override in NixOS *if present*, so we drop them. postPatch = '' - patch meson.build < Date: Sat, 13 Dec 2025 11:11:28 +0100 Subject: [PATCH 2/3] knot-resolver*_6: move extraFeatures to the -manager part - reduces one layer of wrapper scripts - reduces one layer of derivation in case of `extraFeatures = true` - consequently overriding `extraFeatures = true` is simpler, and the nix code itself got simpler as well --- .../services/networking/knot-resolver.nix | 4 +- .../kn/knot-resolver-manager_6/package.nix | 45 ++++++++++++++---- pkgs/by-name/kn/knot-resolver_6/package.nix | 46 ++----------------- 3 files changed, 42 insertions(+), 53 deletions(-) diff --git a/nixos/modules/services/networking/knot-resolver.nix b/nixos/modules/services/networking/knot-resolver.nix index acf3a74cd937..09a57a692cdc 100644 --- a/nixos/modules/services/networking/knot-resolver.nix +++ b/nixos/modules/services/networking/knot-resolver.nix @@ -36,10 +36,10 @@ in If you want to use knot-resolver 5, please use services.kresd. ''; }; - package = lib.mkPackageOption pkgs "knot-resolver-manager_6.knot-resolver" { + package = lib.mkPackageOption pkgs "knot-resolver-manager_6.kresd" { }; + managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" { example = "knot-resolver_6.override { extraFeatures = true; }"; }; - managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" { }; settings = lib.mkOption { type = lib.types.submodule { freeformType = (pkgs.formats.yaml { }).type; diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix index 3d3b4c89d326..52ce78356b56 100644 --- a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix +++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix @@ -1,15 +1,15 @@ { + lib, knot-resolver_6, python3Packages, - extraFeatures ? false, + extraFeatures ? false, # catch-all if defaults aren't enough }: let - knot-resolver = knot-resolver_6.override { inherit extraFeatures; }; + kresd = knot-resolver_6.finalPackage; # TODO: does the finalPackage help us? in python3Packages.buildPythonPackage { pname = "knot-resolver-manager_6"; - inherit (knot-resolver) version; - inherit (knot-resolver.unwrapped) src; + inherit (kresd) version src; pyproject = true; patches = [ @@ -20,10 +20,8 @@ python3Packages.buildPythonPackage { ]; # Propagate meson config from the C part to the python part. - # But the install-time etc differs from a sensible run-time etc. postPatch = '' - substitute '${knot-resolver.unwrapped.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \ - --replace-fail '${knot-resolver.unwrapped.out}/sbin' '${knot-resolver}/bin' + cp '${kresd.config_py}'/knot_resolver/constants.py ./python/knot_resolver/ '' # On non-Linux let's simplify construction of the knot-resolver command line, # as it would break because of nixpkgs-specific wrapping of python packages. @@ -47,6 +45,34 @@ python3Packages.buildPythonPackage { typing-extensions ]; + # set up (additional) Lua dependencies + buildInputs = + with kresd.lua; + lib.optionals extraFeatures [ + # For http module, prefill module, trust anchor bootstrap. + # It brings lots of deps; some are useful elsewhere (e.g. cqueues). + http + # used by policy.slice_randomize_psl() + psl + ]; + makeWrapperArgs = [ + "--set" + "LUA_PATH" + ''"$LUA_PATH"'' + "--set" + "LUA_CPATH" + ''"$LUA_CPATH"'' + ]; + # basic test that the wrapping works + postCheck = lib.optionalString extraFeatures '' + makeWrapper '${kresd}/bin/kresd' ./kresd \ + --set LUA_PATH "$LUA_PATH" \ + --set LUA_CPATH "$LUA_CPATH" + echo "Checking that 'http' module loads, i.e. lua search paths work:" + echo "modules.load('http')" > test-http.lua + echo -e 'quit()' | env -i ./kresd -a 127.0.0.1#53535 -c test-http.lua + ''; + doCheck = python3Packages.stdenv.isLinux; # maybe in future nativeCheckInputs = with python3Packages; [ augeas @@ -78,10 +104,11 @@ python3Packages.buildPythonPackage { ]; passthru = { - inherit knot-resolver; + inherit kresd; }; - meta = knot-resolver.meta // { + meta = kresd.meta // { mainProgram = "knot-resolver"; + inherit (kresd.meta) description; # explicit to make e.g. `nix edit` point here }; } diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix index b49175965034..6c571faaee84 100644 --- a/pkgs/by-name/kn/knot-resolver_6/package.nix +++ b/pkgs/by-name/kn/knot-resolver_6/package.nix @@ -26,14 +26,12 @@ cmocka, which, cacert, - extraFeatures ? false, # catch-all if defaults aren't enough }: let - result = if extraFeatures then wrapped-full else unwrapped; - inherit (lib) optional optionals optionalString; lua = luajitPackages; + # TODO: we could cut the `let` short here, but it would de-indent everything. unwrapped = stdenv.mkDerivation (finalAttrs: { pname = "knot-resolver_6"; version = "6.0.17"; @@ -139,7 +137,8 @@ let ''; passthru = { - unwrapped = finalAttrs.finalPackage; + inherit lua; + inherit (finalAttrs) finalPackage; }; meta = { @@ -155,42 +154,5 @@ let }; }); - wrapped-full = - runCommand unwrapped.name - { - nativeBuildInputs = [ makeWrapper ]; - buildInputs = with luajitPackages; [ - # For http module, prefill module, trust anchor bootstrap. - # It brings lots of deps; some are useful elsewhere (e.g. cqueues). - http - # used by policy.slice_randomize_psl() - psl - ]; - preferLocalBuild = true; - allowSubstitutes = false; - inherit (unwrapped) version meta; - passthru = { - inherit unwrapped; - }; - } - ( - '' - mkdir -p "$out"/bin - makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \ - --set LUA_PATH "$LUA_PATH" \ - --set LUA_CPATH "$LUA_CPATH" - - ln -sr '${unwrapped}/bin/kres-cache-gc' "$out"/bin/ - ln -sr '${unwrapped}/share' "$out"/ - ln -sr '${unwrapped}/lib' "$out"/ # useful in NixOS service - ln -sr "$out"/{bin,sbin} - '' - + lib.optionalString unwrapped.doInstallCheck '' - echo "Checking that 'http' module loads, i.e. lua search paths work:" - echo "modules.load('http')" > test-http.lua - echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua - '' - ); - in -result +unwrapped From bbebb813bf490ffbc5972614bfbc91ab2938386c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sun, 14 Dec 2025 08:15:12 +0100 Subject: [PATCH 3/3] nixos/knot-resolver: remove separate .package option It was confusing, as you couldn't just pass anything, because the path to kresd binary is hard-coded in the manager package already. --- .../services/networking/knot-resolver.nix | 16 ++-------------- .../kn/knot-resolver-manager_6/package.nix | 1 + 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/nixos/modules/services/networking/knot-resolver.nix b/nixos/modules/services/networking/knot-resolver.nix index 09a57a692cdc..96b39745a02f 100644 --- a/nixos/modules/services/networking/knot-resolver.nix +++ b/nixos/modules/services/networking/knot-resolver.nix @@ -36,9 +36,8 @@ in If you want to use knot-resolver 5, please use services.kresd. ''; }; - package = lib.mkPackageOption pkgs "knot-resolver-manager_6.kresd" { }; managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" { - example = "knot-resolver_6.override { extraFeatures = true; }"; + example = "pkgs.knot-resolver-manager_6.override { extraFeatures = true; }"; }; settings = lib.mkOption { type = lib.types.submodule { @@ -113,16 +112,6 @@ in users.groups.knot-resolver = { }; networking.resolvconf.useLocalResolver = lib.mkDefault true; - assertions = [ - { - assertion = lib.versionAtLeast cfg.package.version "6.0.0"; - message = '' - services.knot-resolver only works with knot-resolver 6 or later. - Please use services.kresd for knot-resolver 5. - ''; - } - ]; - environment = { etc."knot-resolver/config.yaml".source = configFile; systemPackages = [ @@ -134,10 +123,9 @@ in ]; }; - systemd.packages = [ cfg.package ]; # the unit gets patched a bit just below + systemd.packages = [ cfg.managerPackage.kresd ]; # the unit gets patched a bit just below systemd.services."knot-resolver" = { wantedBy = [ "multi-user.target" ]; - path = [ (lib.getBin cfg.package) ]; stopIfChanged = false; reloadTriggers = [ configFile diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix index 52ce78356b56..890e71fdb362 100644 --- a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix +++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix @@ -7,6 +7,7 @@ let kresd = knot-resolver_6.finalPackage; # TODO: does the finalPackage help us? in +assert lib.versionAtLeast kresd.version "6.0.0"; python3Packages.buildPythonPackage { pname = "knot-resolver-manager_6"; inherit (kresd) version src;