From c619777a4075ca8e2fa94fca0e6acaa51abcfb18 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Sat, 2 May 2026 21:15:08 +0100 Subject: [PATCH] pomerium: migrate to pre-built Envoy binaries Unfortunately, Pomerium has started producing configurations which don't work without building in their custom Envoy extensions, and it's too complex to try to extend the existing Envoy derivation to support this for now. For now, let's just package their binaries. This will likely mean the end of the `envoy` from-source Envoy derivation in nixpkgs until Bazel is more amenable to running under Nix. --- ...low-specification-of-external-binary.patch | 61 -------------- pkgs/by-name/po/pomerium/package.nix | 84 +++++++++++-------- 2 files changed, 47 insertions(+), 98 deletions(-) delete mode 100644 pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch diff --git a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch deleted file mode 100644 index 8356cdc583a2..000000000000 --- a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 640d11fae5bcf1fa8c1a54facbe168a256cacc1b Mon Sep 17 00:00:00 2001 -From: Morgan Helton -Date: Sun, 26 May 2024 12:17:01 -0500 -Subject: [PATCH] envoy: allow specification of external binary - ---- - pkg/envoy/envoy.go | 17 +++++++++++++---- - 1 file changed, 13 insertions(+), 4 deletions(-) - -diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go -index 85c725629..4a726a44b 100644 ---- a/pkg/envoy/envoy.go -+++ b/pkg/envoy/envoy.go -@@ -8,10 +8,10 @@ import ( - "errors" - "fmt" - "io" -+ "io/fs" - "net" - "net/http" - "net/url" - "os" - "os/exec" -- "path" - "path/filepath" -@@ -44,6 +44,11 @@ const ( - configFileName = "envoy-config.yaml" - ) - -+var OverrideEnvoyPath = "" -+ -+const workingDirectoryName = ".pomerium-envoy" -+const embeddedEnvoyPermissions fs.FileMode = 0o700 -+ - // A Server is a pomerium proxy implemented via envoy. - type Server struct { - ServerOptions -@@ -100,14 +105,17 @@ func NewServer( - log.Ctx(ctx).Debug().Err(err).Msg("couldn't preserve RLIMIT_NOFILE before starting Envoy") - } - -- envoyPath, err := Extract() -+ envoyPath := OverrideEnvoyPath -+ wd := filepath.Join(os.TempDir(), workingDirectoryName) -+ -+ err := os.MkdirAll(wd, embeddedEnvoyPermissions) - if err != nil { -- return nil, fmt.Errorf("extracting envoy: %w", err) -+ return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err) - } - - srv := &Server{ - ServerOptions: options, -- wd: path.Dir(envoyPath), -+ wd: wd, - builder: builder, - grpcPort: src.GetConfig().GRPCPort, - httpPort: src.GetConfig().HTTPPort, --- -2.49.0 - diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix index dc67aa519332..a93e9924255a 100644 --- a/pkgs/by-name/po/pomerium/package.nix +++ b/pkgs/by-name/po/pomerium/package.nix @@ -1,9 +1,9 @@ { buildGoModule, buildNpmPackage, + runCommand, fetchFromGitHub, lib, - envoy, nixosTests, pomerium-cli, }: @@ -15,9 +15,7 @@ let id mapAttrsToList ; -in -buildGoModule rec { - pname = "pomerium"; + version = "0.32.6"; src = fetchFromGitHub { owner = "pomerium"; @@ -25,13 +23,50 @@ buildGoModule rec { rev = "v${version}"; hash = "sha256-VwmjuXlYsh2dGKf7ux8DyLZec7xMISuQ7SSb9+LwzfU="; }; - vendorHash = "sha256-b4H7gAMG7DXEbvkZFsoEZrKpuvPW0vkfv1qqBPBaGAM="; + getEnvoy = buildGoModule { + pname = "pomerium-get-envoy"; + inherit src version vendorHash; + + subPackages = [ + "pkg/envoy/get-envoy" + ]; + + # get-envoy's envoy version is pinned via pkg/envoy/envoyversion, which + # relies on a specific version of github.com/pomerium/envoy-custom as a Go module, + # and then fetches that version's release binaries from GHCR. + }; +in +buildGoModule (finalAttrs: { + pname = "pomerium"; + inherit src version vendorHash; + + envoyBinaries = + runCommand "pomerium-envoy-binaries" + { + nativeBuildInputs = [ getEnvoy ]; + + outputHashAlgo = "sha256"; + outputHashMode = "recursive"; + outputHash = "sha256-i2DuOx+fSCwTKavf6zvuRd1AKbk4igrzy2AXinDkyrI="; + + meta = { + homepage = "https://github.com/pomerium/envoy-custom"; + sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; + }; + } + '' + mkdir $out + cd $out + get-envoy + chmod +x envoy-darwin-amd64 envoy-darwin-arm64 envoy-linux-amd64 envoy-linux-arm64 + ''; + ui = buildNpmPackage { pname = "pomerium-ui"; - inherit version; - src = "${src}/ui"; + inherit (finalAttrs) version; + src = "${finalAttrs.src}/ui"; npmDepsHash = "sha256-2fzINp3LBPHPJlzJnUggPWUZHrjuX9TYPD2XvioonSw="; @@ -46,24 +81,16 @@ buildGoModule rec { "cmd/pomerium" ]; - # patch pomerium to allow use of external envoy - patches = [ - ./0001-envoy-allow-specification-of-external-binary.patch - ]; - ldflags = let # Set a variety of useful meta variables for stamping the build with. setVars = { "github.com/pomerium/pomerium/internal/version" = { - Version = "v${version}"; + Version = "v${finalAttrs.version}"; BuildMeta = "nixpkgs"; ProjectName = "pomerium"; ProjectURL = "github.com/pomerium/pomerium"; }; - "github.com/pomerium/pomerium/pkg/envoy" = { - OverrideEnvoyPath = "${envoy}/bin/envoy"; - }; }; concatStringsSpace = list: concatStringsSep " " list; mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list); @@ -79,28 +106,11 @@ buildGoModule rec { ]; preBuild = '' - # Replace embedded envoy with nothing. - # We set OverrideEnvoyPath above, so rawBinary should never get looked at - # but we still need to set a checksum/version. - rm pkg/envoy/files/files_{darwin,linux}*.go - cat <pkg/envoy/files/files_external.go - package files - - import _ "embed" // embed - - var rawBinary []byte - - //go:embed envoy.sha256 - var rawChecksum string - - //go:embed envoy.version - var rawVersion string - EOF - sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256 - echo '${envoy.version}' > pkg/envoy/files/envoy.version + # Insert embedded envoy. + cp -r ${finalAttrs.envoyBinaries}/* pkg/envoy/files # put the built UI files where they will be picked up as part of binary build - cp -r ${ui}/* ui/dist + cp -r ${finalAttrs.ui}/* ui/dist ''; installPhase = '' @@ -129,4 +139,4 @@ buildGoModule rec { "aarch64-linux" ]; }; -} +})