Merge master into staging-next
This commit is contained in:
nixpkgs-ci[bot]
@@ -1185,6 +1185,12 @@
|
||||
"module-services-gitlab-maintenance-rake": [
|
||||
"index.html#module-services-gitlab-maintenance-rake"
|
||||
],
|
||||
"module-services-gitlab-runner": [
|
||||
"index.html#module-services-gitlab-runner"
|
||||
],
|
||||
"ex-gitlab-runner-podman": [
|
||||
"index.html#ex-gitlab-runner-podman"
|
||||
],
|
||||
"module-forgejo": [
|
||||
"index.html#module-forgejo"
|
||||
],
|
||||
|
||||
@@ -502,7 +502,7 @@
|
||||
./services/continuous-integration/buildkite-agents.nix
|
||||
./services/continuous-integration/gitea-actions-runner.nix
|
||||
./services/continuous-integration/github-runners.nix
|
||||
./services/continuous-integration/gitlab-runner.nix
|
||||
./services/continuous-integration/gitlab-runner/runner.nix
|
||||
./services/continuous-integration/gocd-agent/default.nix
|
||||
./services/continuous-integration/gocd-server/default.nix
|
||||
./services/continuous-integration/hercules-ci-agent/default.nix
|
||||
|
||||
@@ -10,6 +10,7 @@ configure a webserver to proxy HTTP requests to the socket.
|
||||
|
||||
For instance, the following configuration could be used to use nginx as
|
||||
frontend proxy:
|
||||
|
||||
```nix
|
||||
{
|
||||
services.nginx = {
|
||||
@@ -40,6 +41,7 @@ The default state dir is `/var/gitlab/state`. This is where
|
||||
all data like the repositories and uploads will be stored.
|
||||
|
||||
A basic configuration with some custom settings could look like this:
|
||||
|
||||
```nix
|
||||
{
|
||||
services.gitlab = {
|
||||
@@ -104,6 +106,7 @@ the [services.gitlab.backup.startAt](#opt-services.gitlab.backup.startAt)
|
||||
option to configure regular backups.
|
||||
|
||||
To run a manual backup, start the `gitlab-backup` service:
|
||||
|
||||
```ShellSession
|
||||
$ systemctl start gitlab-backup.service
|
||||
```
|
||||
@@ -116,6 +119,116 @@ will have to run the command as the user that you configured to run
|
||||
GitLab with.
|
||||
|
||||
A list of all available rake tasks can be obtained by running:
|
||||
|
||||
```ShellSession
|
||||
$ sudo -u git -H gitlab-rake -T
|
||||
```
|
||||
|
||||
## Runner {#module-services-gitlab-runner}
|
||||
|
||||
GitLab Runner is a CI runner which is an executable which you can host yourself.
|
||||
A Gitlab pipeline runs operations over a Gitlab Runner. These can include
|
||||
building an executable, running a test suite, pushing a docker image, etc. The
|
||||
Gitlab Runner receives jobs from Gitlab which it then dispatches to the
|
||||
configured executors
|
||||
([`docker` (`podman`), or `shell` or `kubernetes`](https://docs.gitlab.com/runner/executors)).
|
||||
|
||||
The
|
||||
[services.gitlab-runner.services](https://search.nixos.org/options?query=services.gitlab-runner.services)
|
||||
documents a number of typical setups to configure multiple runners with
|
||||
different executors.
|
||||
|
||||
The [below example](#ex-gitlab-runner-podman) gives a **more elaborate** example how to
|
||||
configure a Gitlab Runner with caching and reasonably good security practices.
|
||||
|
||||
::: {#ex-gitlab-runner-podman .example}
|
||||
|
||||
## Example: Gitlab Runner with `podman` and Nix Store Caching
|
||||
|
||||
The [VM tested `podman-runner`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/gitlab/runner/podman-runner/default.nix)
|
||||
(a NixOS module for reuse) configures an advanced Gitlab runner with the following features:
|
||||
|
||||
- The executor is `podman` which gives you better additional safety than
|
||||
`docker`. That means every job is run in a `podman` container.
|
||||
|
||||
- The following container **images** are built with Nix:
|
||||
|
||||
**Container Images for Gitlab Jobs**:
|
||||
- `local/alpine`: An image based on Alpine with a Nix installation
|
||||
(attribute `jobImages.alpine`).
|
||||
- `local/ubuntu`: An image based on Ubuntu with a Nix installation
|
||||
(attribute `jobImages.ubuntu`).
|
||||
- `local/nix`: An image based on Nix which only comes with `nix`
|
||||
installed (attribute `jobImages.nix`).
|
||||
|
||||
**Images for VM Setup**:
|
||||
- `local/nix-daemon-image`: An image with a Nix daemon which is
|
||||
used to share the `/nix/store` across jobs (variable `nixDaemonImage`) setup with some essentials derivations `bootstrapPkgs`.
|
||||
- `local/podman-daemon-image`: An image with `podman` running as a daemon which is
|
||||
used to run `podman` inside the above job containers images
|
||||
(variable `podmanDaemonImage`).
|
||||
|
||||
- Every job container runs in a `podman` container instance based by default on
|
||||
`jobImage.ubuntu`. A pipeline job can override this with `image: local/alpine`.
|
||||
- Each job container will have the `/nix/store` mounted from the container
|
||||
`nix-daemon-container` (see registration flags
|
||||
`--docker-volumes-from "nix-daemon-container:ro"`).
|
||||
|
||||
The `nix-daemon-container` is a single container instance of a
|
||||
`nixDaemonImage`. This enables caching of `/nix/store` paths across all jobs
|
||||
in **all** runners. This makes **the host VM's `/nix/store` independent of the
|
||||
Nix store used in the jobs**, which is good.
|
||||
|
||||
::: {.note}
|
||||
**Security:** If you don't want this you need multiple `nixDaemonImage`
|
||||
containers for each registered runner (`gitlab-runner.services.<name>`).
|
||||
:::
|
||||
|
||||
- Each job container will have the `/run/podman/podman.sock` socket mounted from the
|
||||
`podman-daemon-container`.
|
||||
|
||||
The `podman-daemon-container` is a single container of a `podmanDaemonImage` which runs
|
||||
`podman` as a daemon. Job containers can use this daemon to spawn nested containers as well (podman-in-podman).
|
||||
**Keep in mind that `bind` mounts are local to the `podman-daemon-container`**
|
||||
and can be be worked around with a `podman volume create <vol>` and manual copy-to/copy-from this volume `<vol>`.
|
||||
|
||||
If you only need to build containers you don't need this feature (`podman-daemon-container`), see below point.
|
||||
|
||||
Container configuration files (`auxRootFiles`) are copied to all containers to
|
||||
ensure `podman` works consistently inside the job containers.
|
||||
|
||||
- The job containers do **not** mount the `podman` socket from the host (NixOS
|
||||
VM) mounted for security reasons.
|
||||
|
||||
::: {.note}
|
||||
Building container images with `buildah` (stripped
|
||||
`podman` for building images) inside a job which runs `jobImage.alpine`
|
||||
is still possible.
|
||||
:::
|
||||
|
||||
- **Cleanup Disk Space**:
|
||||
|
||||
With this setup its really easy to clean the `nix-daemon-container`
|
||||
(e.g. if you run out of disk space), then reboot and have the runner in a clean state.
|
||||
You can do the following to effectively clean everything and start with fresh volumes safely:
|
||||
|
||||
```bash
|
||||
# Stop the Gitlab runner.
|
||||
systemctl stop gitlab-runner.service
|
||||
# Stop `systemd`-managed containers, such that they get not recreated
|
||||
# when deleting below.
|
||||
systemctl stop podman-podman-daemon-container.service \
|
||||
podman-nix-daemon-container.service \
|
||||
podman-nix-container.service \
|
||||
podman-alpine-container.service \
|
||||
podman-ubuntu-container.service || true
|
||||
|
||||
podman container rm -f --all
|
||||
podman image rm -f --all
|
||||
podman volumes rm -f --all
|
||||
|
||||
reboot
|
||||
# Systemd will restart all containers and create volumes etc.
|
||||
```
|
||||
|
||||
:::
|
||||
|
||||
@@ -907,13 +907,17 @@ in
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
PIDFile = cfg.qemu.pidFile;
|
||||
ExecStart = ''
|
||||
${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386} \
|
||||
-xen-domid 0 -xen-attach -name dom0 -nographic -M xenpv \
|
||||
-daemonize -monitor /dev/null -serial /dev/null -parallel \
|
||||
/dev/null -nodefaults -no-user-config -pidfile \
|
||||
${cfg.qemu.pidFile}
|
||||
'';
|
||||
overrideStrategy = "asDropin";
|
||||
ExecStart = [
|
||||
""
|
||||
''
|
||||
${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386} \
|
||||
-xen-domid 0 -xen-attach -name dom0 -nographic -M xenpv \
|
||||
-daemonize -monitor /dev/null -serial /dev/null -parallel \
|
||||
/dev/null -nodefaults -no-user-config -pidfile \
|
||||
${cfg.qemu.pidFile}
|
||||
''
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -98,7 +98,8 @@ rec {
|
||||
|
||||
(onFullSupported "nixos.tests.firewall")
|
||||
(onFullSupported "nixos.tests.fontconfig-default-fonts")
|
||||
(onFullSupported "nixos.tests.gitlab")
|
||||
(onFullSupported "nixos.tests.gitlab.gitlab")
|
||||
(onFullSupported "nixos.tests.gitlab.runner")
|
||||
(onFullSupported "nixos.tests.gnome")
|
||||
(onSystems [ "x86_64-linux" ] "nixos.tests.hibernate")
|
||||
(onFullSupported "nixos.tests.i3wm")
|
||||
|
||||
@@ -642,7 +642,9 @@ in
|
||||
gitdaemon = runTest ./gitdaemon.nix;
|
||||
gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
|
||||
github-runner = runTest ./github-runner.nix;
|
||||
gitlab = runTest ./gitlab.nix;
|
||||
gitlab = import ./gitlab {
|
||||
inherit runTest;
|
||||
};
|
||||
gitolite = runTest ./gitolite.nix;
|
||||
gitolite-fcgiwrap = runTest ./gitolite-fcgiwrap.nix;
|
||||
glance = runTest ./glance.nix;
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
{ runTest }:
|
||||
{
|
||||
gitlab = runTest ./gitlab.nix;
|
||||
runner = runTest ./runner.nix;
|
||||
}
|
||||
@@ -7,12 +7,12 @@
|
||||
# - Opening and closing issues.
|
||||
# - Downloading repository archives as tar.gz and tar.bz2
|
||||
# Run with
|
||||
# [nixpkgs]$ nix-build -A nixosTests.gitlab
|
||||
# [nixpkgs]$ nix-build -A nixosTests.gitlab.gitlab
|
||||
|
||||
{ pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
|
||||
inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
|
||||
initialRootPassword = "notproduction";
|
||||
rootProjectId = "2";
|
||||
|
||||
@@ -37,7 +37,7 @@ in
|
||||
gitlab =
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ common/user-account.nix ];
|
||||
imports = [ ../common/user-account.nix ];
|
||||
|
||||
environment.systemPackages = with pkgs; [ git ];
|
||||
|
||||
@@ -0,0 +1,178 @@
|
||||
# This test runs a gitlab-runner and performs the following tests in
|
||||
# two machines `gitlab` and `gitlab-runner`:
|
||||
# - Create runners in the `gitlab` machine for all runners in `./runner`.
|
||||
# - Inject the runner tokens into the `gitlab-runner.service` (machine `gitlab-runner`)
|
||||
# which runs all runners:
|
||||
# - Shell runner in `./runner/shell-runner`.
|
||||
# - Start the `gitlab-runner.service`.
|
||||
# - Check that all runners in `gitlab` are `active`.
|
||||
#
|
||||
# Run with
|
||||
# [nixpkgs]$ nix-build -A nixosTests.gitlab.runner
|
||||
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
initialRootPassword = "notproduction";
|
||||
|
||||
runnerTokenDir = "/run/secrets/gitlab-runner";
|
||||
|
||||
runnerConfigs = {
|
||||
# The Gitlab runner where each job runs
|
||||
# on the host (not containerized and very insecure).
|
||||
shell = {
|
||||
desc = "Shell runner (host NixOS shell, host Nix store)";
|
||||
name = "shell";
|
||||
tokenFile = "${runnerTokenDir}/token-shell.env";
|
||||
};
|
||||
|
||||
# The Gitlab runner which uses the Docker runner (we use podman).
|
||||
# Features:
|
||||
# - Daemonizes the Nix store into a container.
|
||||
# - All jobs run in an unprivileged container, e.g. with image
|
||||
# (`local/nix`, `local/alpine`, `local/ubuntu`)
|
||||
podman = {
|
||||
desc = "Podman runner (containers, shared containerized Nix store)";
|
||||
name = "podman";
|
||||
tokenFile = "${runnerTokenDir}/token-podman.env";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
name = "gitlab-runner";
|
||||
meta.maintainers = with lib.maintainers; [
|
||||
gabyx
|
||||
];
|
||||
|
||||
nodes = {
|
||||
gitlab-runner =
|
||||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
../common/user-account.nix
|
||||
(import ./runner/shell-runner.nix {
|
||||
runnerConfig = runnerConfigs.shell;
|
||||
})
|
||||
]
|
||||
# Only enable the podman runner on x86_64
|
||||
# cause of built images.
|
||||
++ (lib.optional pkgs.stdenv.buildPlatform.isx86_64 (
|
||||
import ./runner/podman-runner {
|
||||
runnerConfig = runnerConfigs.podman;
|
||||
}
|
||||
));
|
||||
|
||||
virtualisation = {
|
||||
diskSize = 10000;
|
||||
};
|
||||
|
||||
# Define the Gitlab Runner.
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
log_level = "info";
|
||||
};
|
||||
|
||||
gracefulTermination = false;
|
||||
};
|
||||
};
|
||||
gitlab =
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [ ../common/user-account.nix ];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
config.services.nginx.defaultHTTPListenPort
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [ git ];
|
||||
|
||||
virtualisation.memorySize = 6144;
|
||||
virtualisation.cores = 4;
|
||||
|
||||
systemd.services.gitlab.serviceConfig.Restart = lib.mkForce "no";
|
||||
systemd.services.gitlab-workhorse.serviceConfig.Restart = lib.mkForce "no";
|
||||
systemd.services.gitaly.serviceConfig.Restart = lib.mkForce "no";
|
||||
systemd.services.gitlab-sidekiq.serviceConfig.Restart = lib.mkForce "no";
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts = {
|
||||
localhost = {
|
||||
locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.gitlab = {
|
||||
enable = true;
|
||||
databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4";
|
||||
initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
|
||||
secrets = {
|
||||
secretFile = pkgs.writeText "secret" "Aig5zaic";
|
||||
otpFile = pkgs.writeText "otpsecret" "Riew9mue";
|
||||
dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
|
||||
jwsFile = pkgs.runCommand "oidcKeyBase" { } "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
|
||||
activeRecordPrimaryKeyFile = pkgs.writeText "arprimary" "vsaYPZjTRxcbG7W6gNr95AwBmzFUd4Eu";
|
||||
activeRecordDeterministicKeyFile = pkgs.writeText "ardeterministic" "kQarv9wb2JVP7XzLTh5f6DFcMHms4nEC";
|
||||
activeRecordSaltFile = pkgs.writeText "arsalt" "QkgR9CfFU3MXEWGqa7LbP24AntK5ZeYw";
|
||||
};
|
||||
|
||||
# reduce memory usage
|
||||
sidekiq.concurrency = 1;
|
||||
puma.workers = 2;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript =
|
||||
{ nodes, ... }:
|
||||
let
|
||||
authPayload = pkgs.writeText "auth.json" (
|
||||
builtins.toJSON {
|
||||
grant_type = "password";
|
||||
username = "root";
|
||||
password = initialRootPassword;
|
||||
}
|
||||
);
|
||||
|
||||
runnerTokenEnv = pkgs.writeText "runner-token.env" ''
|
||||
CI_SERVER_URL=http://gitlab
|
||||
CI_SERVER_TOKEN=$token
|
||||
'';
|
||||
|
||||
createRunnerPayload = pkgs.writeText "create-runner.json" (
|
||||
builtins.toJSON {
|
||||
runner_type = "instance_type";
|
||||
}
|
||||
);
|
||||
in
|
||||
# python
|
||||
''
|
||||
# Define some globals for the python script below.
|
||||
JQ_BINARY="${pkgs.jq}/bin/jq"
|
||||
GITLAB_STATE_PATH="${nodes.gitlab.services.gitlab.statePath}"
|
||||
RUNNER_TOKEN_ENV_FILE="${runnerTokenEnv}"
|
||||
AUTH_PAYLOAD_FILE="${authPayload}"
|
||||
CREATE_RUNNER_PAYLOAD_FILE="${createRunnerPayload}"
|
||||
|
||||
${lib.readFile ./runner_test.py}
|
||||
|
||||
start_all()
|
||||
wait_for_services()
|
||||
|
||||
# Run all tests.
|
||||
test_connection()
|
||||
test_register_runner(name="shell", tokenFile="${runnerConfigs.shell.tokenFile}")
|
||||
test_register_runner(name="podman", tokenFile="${runnerConfigs.podman.tokenFile}")
|
||||
restart_gitlab_runner_service(runnerConfigs)
|
||||
test_runner_registered(runnerConfigs["shell"])
|
||||
test_runner_registered(runnerConfigs["podman"])
|
||||
'';
|
||||
}
|
||||
@@ -0,0 +1,425 @@
|
||||
{ runnerConfig }:
|
||||
# Gitlab Runner Module
|
||||
#
|
||||
# This module will add a Gitlab-Runner
|
||||
# with a nix-daemon running in a podman container `nix-daemon-container`.
|
||||
# Check the documentation in the NixOS Manual.
|
||||
#
|
||||
# Debugging on the VM:
|
||||
#
|
||||
# - You can use `journalctl -u gitlab-runner.service`.
|
||||
#
|
||||
# - To run a job container inside the VM use:
|
||||
# ```bash
|
||||
# podman run --rm -it
|
||||
# --volumes-from 'nix-daemon-container'
|
||||
# -v "podman-daemon-socket:/run/podman"
|
||||
# "local/alpine" \
|
||||
# bash -c "export CI_PIPELINE_ID=123456 && gitlab-runner-pre-build-script; echo hello"
|
||||
# ```
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
# Switch to not use IFD in nixpkgs test.
|
||||
# NOTE: When reusing this runner, you can set this to `true`.
|
||||
useIFD = false;
|
||||
|
||||
# Either we use a Nix as the base image or Alpine.
|
||||
imageNames = {
|
||||
default = imageNames.alpine;
|
||||
|
||||
alpine = "local/alpine";
|
||||
nix = "local/nix";
|
||||
ubuntu = "local/ubuntu";
|
||||
|
||||
all = with imageNames; [
|
||||
alpine
|
||||
nix
|
||||
ubuntu
|
||||
];
|
||||
};
|
||||
|
||||
noPruneLabels = {
|
||||
no-prune = "true";
|
||||
};
|
||||
|
||||
# This derivation will contain a folder `/etc`
|
||||
files = pkgs.callPackage ./files { };
|
||||
preBuildScript = pkgs.callPackage ./scripts/prebuild.nix { };
|
||||
|
||||
# These derivations are Linked into the job images root dir.
|
||||
bootstrapPkgs = [
|
||||
pkgs.nix
|
||||
# Runtime dependencies of nix.
|
||||
pkgs.gnutar
|
||||
pkgs.gzip
|
||||
pkgs.openssh
|
||||
pkgs.xz
|
||||
pkgs.cacert
|
||||
|
||||
# Other stuff.
|
||||
(lib.hiPrio pkgs.coreutils)
|
||||
(lib.hiPrio pkgs.findutils)
|
||||
pkgs.openssh
|
||||
pkgs.bashInteractive
|
||||
(lib.hiPrio pkgs.git)
|
||||
pkgs.cachix
|
||||
|
||||
pkgs.just
|
||||
pkgs.podman # For nested containers.
|
||||
|
||||
preBuildScript
|
||||
|
||||
files.containers
|
||||
files.nixConfig
|
||||
];
|
||||
|
||||
# All these packages are added to the Nix daemon.
|
||||
nixStorePkgs = bootstrapPkgs ++ [
|
||||
# These files
|
||||
files.basicRoot
|
||||
files.fakeNixpkgs
|
||||
];
|
||||
|
||||
toEnvList = envs: lib.mapAttrsToList (k: v: "${k}=${v}") envs;
|
||||
|
||||
# This is the Nix base image used for the Nix Daemon.
|
||||
# The build script for the nixos/nix image is vendored due to Hydra limitations.
|
||||
# cause it is IFD (Import from Derivation) which is not allowed.
|
||||
# NOTE: When reusing this runner you can set `useIFD` to true:
|
||||
nixImageBaseFn =
|
||||
if !useIFD then
|
||||
import ./nix-image.nix
|
||||
else
|
||||
import (
|
||||
(pkgs.fetchFromGitHub {
|
||||
owner = "NixOS";
|
||||
repo = "nix";
|
||||
rev = "2.32.4";
|
||||
hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY=";
|
||||
})
|
||||
+ "/docker.nix"
|
||||
);
|
||||
|
||||
nixImageBase = pkgs.callPackage nixImageBaseFn {
|
||||
name = "local/nix-base";
|
||||
tag = "latest";
|
||||
|
||||
bundleNixpkgs = false;
|
||||
maxLayers = 2;
|
||||
|
||||
# You can add here a user with uid,gid,uname,gname etc.
|
||||
# We are using root.
|
||||
|
||||
extraPkgs = nixStorePkgs;
|
||||
|
||||
nixConf = {
|
||||
cores = "0";
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# This is the daemon image which provides the store
|
||||
# as volumes.
|
||||
nixDaemonImage = pkgs.dockerTools.buildLayeredImage {
|
||||
fromImage = nixImageBase;
|
||||
name = "local/nix-daemon";
|
||||
tag = "latest";
|
||||
|
||||
config = {
|
||||
Volumes = {
|
||||
"/nix/store" = { };
|
||||
"/nix/var/nix/db" = { };
|
||||
"/nix/var/nix/daemon-socket" = { };
|
||||
};
|
||||
Labels = noPruneLabels;
|
||||
};
|
||||
maxLayers = 4;
|
||||
};
|
||||
|
||||
# This is the podman daemon image which enables
|
||||
# a job image to use `podman` internally.
|
||||
podmanDaemonImage =
|
||||
let
|
||||
# Update with:
|
||||
# ```shell
|
||||
# nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- \
|
||||
# --image-name quay.io/podman/stable --image-tag v5.6.0
|
||||
# ```
|
||||
base = pkgs.dockerTools.pullImage {
|
||||
imageName = "quay.io/podman/stable";
|
||||
imageDigest = "sha256:7c9381b9af167cf2218831c3af3135856c99f488b543b78435c8f18e19ad739a";
|
||||
hash = "sha256-pXXCu13fB/RN9qx8iLhE5Kko6glTrFrRhR7fo2OS7V0=";
|
||||
finalImageName = "quay.io/podman/stable";
|
||||
finalImageTag = "v5.6.0";
|
||||
};
|
||||
in
|
||||
pkgs.dockerTools.buildLayeredImage {
|
||||
fromImage = base;
|
||||
name = "local/podman-daemon";
|
||||
tag = "latest";
|
||||
|
||||
config = {
|
||||
Labels = noPruneLabels;
|
||||
};
|
||||
};
|
||||
|
||||
jobImages =
|
||||
let
|
||||
extraCommands = ''
|
||||
set -eu
|
||||
# Set missing Nix directories.
|
||||
mkdir -p -m 0755 nix/var/log/nix/drvs
|
||||
mkdir -p -m 0755 nix/var/nix/{gcroots,profiles,temproots,userpool}
|
||||
mkdir -p -m 1777 nix/var/nix/{gcroots,profiles}/per-user
|
||||
mkdir -p -m 0755 nix/var/nix/profiles/per-user/root
|
||||
|
||||
# Need a HOME.
|
||||
mkdir -vp root
|
||||
mkdir -p -m 0700 root/.nix-defexpr
|
||||
'';
|
||||
in
|
||||
{
|
||||
# The Nix image.
|
||||
# Similar to https://github.com/nix-community/docker-nixpkgs/blob/main/images/nix/default.nix.
|
||||
nix = pkgs.dockerTools.buildLayeredImage {
|
||||
name = imageNames.nix;
|
||||
tag = "latest";
|
||||
|
||||
extraCommands = extraCommands + ''
|
||||
set -eu
|
||||
# For `/usr/bin/env`.
|
||||
mkdir -p usr && ln -s ../bin usr/bin
|
||||
'';
|
||||
|
||||
contents = bootstrapPkgs ++ [ files.basicRoot ];
|
||||
# No store paths are copied into. We provide them by mounting the
|
||||
# /nix/store.
|
||||
includeStorePaths = false;
|
||||
|
||||
config = {
|
||||
Labels = noPruneLabels;
|
||||
Env = toEnvList envs.nix;
|
||||
};
|
||||
maxLayers = 2;
|
||||
};
|
||||
|
||||
# This is the analog image to `local/nix` but Alpine based.
|
||||
alpine =
|
||||
let
|
||||
# Update with:
|
||||
# ```shell
|
||||
# nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- --image-name alpine --image-tag latest
|
||||
# ```
|
||||
alpineBase = pkgs.dockerTools.pullImage {
|
||||
imageName = "alpine";
|
||||
imageDigest = "sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d";
|
||||
sha256 = "0gf7wbjp37zbni3pz8vdgq1mss6mz69wynms0gqhq7lsxfmg9xj9";
|
||||
finalImageName = "alpine";
|
||||
finalImageTag = "latest";
|
||||
};
|
||||
in
|
||||
(pkgs.dockerTools.buildLayeredImage {
|
||||
fromImage = alpineBase;
|
||||
name = imageNames.alpine;
|
||||
tag = "latest";
|
||||
|
||||
inherit extraCommands;
|
||||
|
||||
contents = bootstrapPkgs;
|
||||
# No store paths are copied into. We provide them by mounting the
|
||||
# /nix/store.
|
||||
includeStorePaths = false;
|
||||
|
||||
config = {
|
||||
Labels = noPruneLabels;
|
||||
Env = toEnvList envs.nix;
|
||||
};
|
||||
|
||||
# Only if `build buildLayeredImage`.
|
||||
maxLayers = 3;
|
||||
});
|
||||
|
||||
# This is the analog image to `local/nix` but Ubuntu based.
|
||||
ubuntu =
|
||||
let
|
||||
# Update with:
|
||||
# ```shell
|
||||
# nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- \
|
||||
# --image-name ubuntu --image-tag latest
|
||||
# ```
|
||||
ubuntuBase = pkgs.dockerTools.pullImage {
|
||||
imageName = "ubuntu";
|
||||
imageDigest = "sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02";
|
||||
hash = "sha256-aC8SgxdcMSaaU89YMr/uwE022Yqey2frmeZqr+L1xEU=";
|
||||
finalImageName = "ubuntu";
|
||||
finalImageTag = "latest";
|
||||
};
|
||||
in
|
||||
(pkgs.dockerTools.buildLayeredImage {
|
||||
fromImage = ubuntuBase;
|
||||
name = imageNames.ubuntu;
|
||||
tag = "latest";
|
||||
|
||||
inherit extraCommands;
|
||||
|
||||
contents = bootstrapPkgs;
|
||||
# No store paths are copied into. We provide them by mounting the
|
||||
# /nix/store.
|
||||
includeStorePaths = false;
|
||||
|
||||
config = {
|
||||
Labels = noPruneLabels;
|
||||
Env = toEnvList envs.ubuntu;
|
||||
};
|
||||
|
||||
# Only if `build buildLayeredImage`.
|
||||
maxLayers = 3;
|
||||
});
|
||||
};
|
||||
|
||||
nixDaemonContainer = {
|
||||
imageFile = nixDaemonImage;
|
||||
image = "local/nix-daemon:latest";
|
||||
|
||||
volumes = [
|
||||
"nix-daemon-store:/nix/store"
|
||||
"nix-daemon-db:/nix/var/nix/db"
|
||||
"nix-daemon-socket:/nix/var/nix/daemon-socket"
|
||||
];
|
||||
cmd = [
|
||||
"nix"
|
||||
"daemon"
|
||||
];
|
||||
};
|
||||
|
||||
podmanDaemonContainer = {
|
||||
imageFile = podmanDaemonImage;
|
||||
image = "local/podman-daemon:latest";
|
||||
volumes = [
|
||||
"podman-daemon-socket:/run/podman"
|
||||
"podman-cache:/var/lib/container"
|
||||
# Shared images, currently not needed.
|
||||
"podman-shared:/var/lib/shared:ro"
|
||||
];
|
||||
privileged = true;
|
||||
cmd = [
|
||||
"podman"
|
||||
"system"
|
||||
"service"
|
||||
"--time=0"
|
||||
"unix:///run/podman/podman.sock"
|
||||
"--log-level"
|
||||
"info"
|
||||
];
|
||||
};
|
||||
|
||||
# Environment variables for all job containers.
|
||||
envs = rec {
|
||||
common = {
|
||||
# Access to the nix daemon.
|
||||
NIX_REMOTE = "daemon";
|
||||
# Access to podman.
|
||||
CONTAINER_HOST = "unix:///run/podman/podman.sock";
|
||||
|
||||
USER = "root";
|
||||
PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
|
||||
|
||||
SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
||||
NIX_SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
||||
|
||||
# For shells, source this file.
|
||||
ENV = "${pkgs.nix}/etc/profile.d/nix-daemon.sh";
|
||||
BASH_ENV = "${pkgs.nix}/etc/profile.d/nix-daemon.sh";
|
||||
|
||||
# Make a fake nixpkgs which throws when using
|
||||
# `nix repl -f <nixpkgs>` for example.
|
||||
NIX_PATH = "nixpkgs=${files.fakeNixpkgs}";
|
||||
};
|
||||
|
||||
nix = common // {
|
||||
IMAGE_OS_DIST = "nix";
|
||||
};
|
||||
|
||||
alpine = common // {
|
||||
IMAGE_OS_DIST = "alpine";
|
||||
};
|
||||
|
||||
ubuntu = common // {
|
||||
IMAGE_OS_DIST = "ubuntu";
|
||||
};
|
||||
};
|
||||
|
||||
registrationFlags = [
|
||||
"--docker-volumes"
|
||||
"gitlab-runner-scratch:/scratch"
|
||||
|
||||
"--docker-volumes"
|
||||
"podman-daemon-socket:/run/podman"
|
||||
|
||||
"--docker-volumes-from"
|
||||
"nix-daemon-container:ro"
|
||||
|
||||
"--docker-pull-policy"
|
||||
"if-not-present"
|
||||
|
||||
"--docker-allowed-pull-policies"
|
||||
"if-not-present"
|
||||
|
||||
"--docker-host"
|
||||
"unix:///var/run/podman/podman.sock"
|
||||
|
||||
"--docker-network-mode"
|
||||
"host"
|
||||
];
|
||||
|
||||
in
|
||||
{
|
||||
imports = [ ./virtualization.nix ];
|
||||
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
|
||||
containers = {
|
||||
nix-daemon-container = nixDaemonContainer;
|
||||
podman-daemon-container = podmanDaemonContainer;
|
||||
}
|
||||
//
|
||||
# Workaround to add the job images to the registry.
|
||||
(lib.concatMapAttrs (name: image: {
|
||||
"${name}-container" = {
|
||||
imageFile = jobImages.${name};
|
||||
image = "${imageNames.${name}}:latest";
|
||||
extraOptions = [
|
||||
"--volumes-from"
|
||||
"nix-daemon-container:ro"
|
||||
];
|
||||
dependsOn = [ "nix-daemon-container" ];
|
||||
cmd = [ "true" ];
|
||||
};
|
||||
}) jobImages);
|
||||
};
|
||||
|
||||
# Define the Gitlab Runner.
|
||||
services.gitlab-runner.services.podman-runner = {
|
||||
description = runnerConfig.desc;
|
||||
|
||||
inherit registrationFlags;
|
||||
|
||||
authenticationTokenConfigFile = runnerConfig.tokenFile;
|
||||
|
||||
executor = "docker";
|
||||
dockerImage = imageNames.default;
|
||||
dockerAllowedImages = [ ];
|
||||
dockerPrivileged = false;
|
||||
requestConcurrency = 4;
|
||||
|
||||
preBuildScript = "${preBuildScript}/bin/gitlab-runner-pre-build-script";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
root:x:0:
|
||||
wheel:x:1:
|
||||
kmem:x:2:
|
||||
tty:x:3:
|
||||
messagebus:x:4:
|
||||
disk:x:6:
|
||||
audio:x:17:
|
||||
floppy:x:18:
|
||||
uucp:x:19:
|
||||
lp:x:20:
|
||||
cdrom:x:24:
|
||||
tape:x:25:
|
||||
video:x:26:
|
||||
dialout:x:27:
|
||||
utmp:x:29:
|
||||
adm:x:55:
|
||||
keys:x:96:
|
||||
users:x:100:
|
||||
input:x:174:
|
||||
nixbld:x:30000:nixbld1,nixbld10,nixbld11,nixbld12,nixbld13,nixbld14,nixbld15,nixbld16,nixbld17,nixbld18,nixbld19,nixbld2,nixbld20,nixbld21,nixbld22,nixbld23,nixbld24,nixbld25,nixbld26,nixbld27,nixbld28,nixbld29,nixbld3,nixbld30,nixbld31,nixbld32,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9
|
||||
nogroup:x:65534:
|
||||
@@ -0,0 +1,11 @@
|
||||
passwd: files mymachines systemd
|
||||
group: files mymachines systemd
|
||||
shadow: files
|
||||
|
||||
hosts: files mymachines dns myhostname
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
@@ -0,0 +1,34 @@
|
||||
root:x:0:0:System administrator:/root:/bin/bash
|
||||
nixbld1:x:30001:30000:Nix build user 1:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld2:x:30002:30000:Nix build user 2:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld3:x:30003:30000:Nix build user 3:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld4:x:30004:30000:Nix build user 4:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld5:x:30005:30000:Nix build user 5:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld6:x:30006:30000:Nix build user 6:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld7:x:30007:30000:Nix build user 7:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld8:x:30008:30000:Nix build user 8:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld9:x:30009:30000:Nix build user 9:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld10:x:30010:30000:Nix build user 10:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld11:x:30011:30000:Nix build user 11:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld12:x:30012:30000:Nix build user 12:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld13:x:30013:30000:Nix build user 13:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld14:x:30014:30000:Nix build user 14:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld15:x:30015:30000:Nix build user 15:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld16:x:30016:30000:Nix build user 16:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld17:x:30017:30000:Nix build user 17:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld18:x:30018:30000:Nix build user 18:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld19:x:30019:30000:Nix build user 19:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld20:x:30020:30000:Nix build user 20:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld21:x:30021:30000:Nix build user 21:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld22:x:30022:30000:Nix build user 22:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld23:x:30023:30000:Nix build user 23:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld24:x:30024:30000:Nix build user 24:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld25:x:30025:30000:Nix build user 25:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld26:x:30026:30000:Nix build user 26:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld27:x:30027:30000:Nix build user 27:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld28:x:30028:30000:Nix build user 28:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld29:x:30029:30000:Nix build user 29:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld30:x:30030:30000:Nix build user 30:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld31:x:30031:30000:Nix build user 31:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nixbld32:x:30032:30000:Nix build user 32:/var/empty:/run/current-system/sw/bin/nologin
|
||||
nobody:x:65534:65534:Unprivileged account (don't use!):/var/empty:/run/current-system/sw/bin/nologin
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
[engine]
|
||||
cgroup_manager = "cgroupfs"
|
||||
@@ -0,0 +1,2 @@
|
||||
/run/secrets/etc-pki-entitlement:/run/secrets/etc-pki-entitlement
|
||||
/run/secrets/rhsm:/run/secrets/rhsm
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"default": [
|
||||
{
|
||||
"type": "insecureAcceptAnything"
|
||||
}
|
||||
],
|
||||
"transports": {
|
||||
"docker-daemon": {
|
||||
"": [{ "type": "insecureAcceptAnything" }]
|
||||
}
|
||||
}
|
||||
}
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"]
|
||||
short-name-mode = "enforcing"
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
[aliases]
|
||||
"buildah" = "quay.io/buildah/stable"
|
||||
"podman" = "quay.io/podman/stable"
|
||||
"alpine" = "docker.io/library/alpine"
|
||||
"ubuntu" = "docker.io/library/ubuntu"
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
# This is a default registries.d configuration file. You may
|
||||
# add to this file or create additional files in registries.d/.
|
||||
#
|
||||
# lookaside: for reading/writing simple signing signatures
|
||||
# lookaside-staging: for writing simple signing signatures, preferred over lookaside
|
||||
#
|
||||
# lookaside and lookaside-staging take a value of the following:
|
||||
# lookaside: {schema}://location
|
||||
#
|
||||
# For reading signatures, schema may be http, https, or file.
|
||||
# For writing signatures, schema may only be file.
|
||||
|
||||
# The default locations are built-in, for both reading and writing:
|
||||
# /var/lib/containers/sigstore for root, or
|
||||
# ~/.local/share/containers/sigstore for non-root users.
|
||||
default-docker:
|
||||
# lookaside: https://…
|
||||
# lookaside-staging: file:///…
|
||||
|
||||
# The 'docker' indicator here is the start of the configuration
|
||||
# for docker registries.
|
||||
#
|
||||
# docker:
|
||||
#
|
||||
# privateregistry.com:
|
||||
# lookaside: https://privateregistry.com/sigstore/
|
||||
# lookaside-staging: /mnt/nfs/privateregistry/sigstore
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
docker:
|
||||
registry.access.redhat.com:
|
||||
lookaside: https://access.redhat.com/webassets/docker/content/sigstore
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
docker:
|
||||
registry.redhat.io:
|
||||
lookaside: https://registry.redhat.io/containers/sigstore
|
||||
@@ -0,0 +1,15 @@
|
||||
[storage]
|
||||
driver = "overlay"
|
||||
runroot = "/run/containers/storage"
|
||||
graphroot = "/var/lib/containers/storage"
|
||||
|
||||
[storage.options]
|
||||
additionalimagestores = [
|
||||
"/var/lib/shared",
|
||||
"/usr/lib/containers/storage",
|
||||
]
|
||||
pull_options = {enable_partial_images = "true", use_hard_links = "false", ostree_repos=""}
|
||||
|
||||
[storage.options.overlay]
|
||||
mount_program = "/usr/bin/fuse-overlayfs"
|
||||
mountopt = "nodev,fsync=0"
|
||||
@@ -0,0 +1,46 @@
|
||||
# Specific files for the job images.
|
||||
#
|
||||
# - `basicRoot`: Some basic root files for the `jobImages.nix`.
|
||||
# - `fakeNixpkgs`: A fake Nixpkg directory which is set as `NIX_PATH=nixpkgs:<path>`
|
||||
# which throws on load.
|
||||
# - `nixConfig`: The Nix config with some options.
|
||||
# - `containers`:
|
||||
# These are some files which are copied to the job images needed for
|
||||
# `buildah` (`podman`):
|
||||
#
|
||||
# ```bash
|
||||
# podman create --name temp-buildah quay.io/buildah/stable:latest
|
||||
# podman cp temp-buildah:/etc/containers ./etc/
|
||||
# find ./etc -type d -empty -delete
|
||||
# podman container rm temp-buildah
|
||||
#```
|
||||
#
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
|
||||
# We need proper derivations to add it to the nixImageBase.
|
||||
mkDrv =
|
||||
name: src:
|
||||
pkgs.stdenv.mkDerivation {
|
||||
inherit name src;
|
||||
installPhase = ''
|
||||
mkdir -p $out
|
||||
cp -r $src/* $out/
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
basicRoot = mkDrv "basic-root-files" ./basicRoot;
|
||||
containers = mkDrv "containers-files" ./containers;
|
||||
fakeNixpkgs = mkDrv "fake-nixpkgs" ./fake-nixpkgs;
|
||||
|
||||
nixConfig = pkgs.writeTextFile {
|
||||
name = "nix.conf";
|
||||
destination = "/etc/nix/nix.conf";
|
||||
text = ''
|
||||
accept-flake-config = true
|
||||
experimental-features = nix-command flakes
|
||||
max-jobs = auto
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
_:
|
||||
throw ''
|
||||
This container doesn't include nixpkgs.
|
||||
|
||||
The best way to work around that is to pin your dependencies. See
|
||||
https://nix.dev/tutorials/first-steps/towards-reproducibility-pinning-nixpkgs.html
|
||||
|
||||
Or if you must, override the NIX_PATH environment variable with eg:
|
||||
"NIX_PATH=nixpkgs=channel:nixos-unstable"
|
||||
''
|
||||
@@ -0,0 +1,400 @@
|
||||
# This is the vendored build script from
|
||||
# https://raw.githubusercontent.com/NixOS/nix/refs/heads/master/docker.nix
|
||||
# which builds the Nix image.
|
||||
# This is only here to please Hydra which is not beeing able to build IFDs.
|
||||
# `import (nixRepo + "./docker.nix")`.
|
||||
{
|
||||
# Core dependencies
|
||||
pkgs ? import <nixpkgs> { },
|
||||
lib ? pkgs.lib,
|
||||
dockerTools ? pkgs.dockerTools,
|
||||
runCommand ? pkgs.runCommand,
|
||||
buildPackages ? pkgs.buildPackages,
|
||||
# Image configuration
|
||||
name ? "nix",
|
||||
tag ? "latest",
|
||||
bundleNixpkgs ? true,
|
||||
channelName ? "nixpkgs",
|
||||
channelURL ? "https://channels.nixos.org/nixpkgs-unstable",
|
||||
extraPkgs ? [ ],
|
||||
maxLayers ? 70,
|
||||
nixConf ? { },
|
||||
flake-registry ? null,
|
||||
uid ? 0,
|
||||
gid ? 0,
|
||||
uname ? "root",
|
||||
gname ? "root",
|
||||
Labels ? {
|
||||
"org.opencontainers.image.title" = "Nix";
|
||||
"org.opencontainers.image.source" = "https://github.com/NixOS/nix";
|
||||
"org.opencontainers.image.vendor" = "Nix project";
|
||||
"org.opencontainers.image.version" = nix.version;
|
||||
"org.opencontainers.image.description" = "Nix container image";
|
||||
},
|
||||
Cmd ? [ (lib.getExe bashInteractive) ],
|
||||
# Default Packages
|
||||
nix ? pkgs.nix,
|
||||
bashInteractive ? pkgs.bashInteractive,
|
||||
coreutils-full ? pkgs.coreutils-full,
|
||||
gnutar ? pkgs.gnutar,
|
||||
gzip ? pkgs.gzip,
|
||||
gnugrep ? pkgs.gnugrep,
|
||||
which ? pkgs.which,
|
||||
curl ? pkgs.curl,
|
||||
less ? pkgs.less,
|
||||
wget ? pkgs.wget,
|
||||
man ? pkgs.man,
|
||||
cacert ? pkgs.cacert,
|
||||
findutils ? pkgs.findutils,
|
||||
iana-etc ? pkgs.iana-etc,
|
||||
gitMinimal ? pkgs.gitMinimal,
|
||||
openssh ? pkgs.openssh,
|
||||
# Other dependencies
|
||||
shadow ? pkgs.shadow,
|
||||
}:
|
||||
let
|
||||
defaultPkgs = [
|
||||
nix
|
||||
bashInteractive
|
||||
coreutils-full
|
||||
gnutar
|
||||
gzip
|
||||
gnugrep
|
||||
which
|
||||
curl
|
||||
less
|
||||
wget
|
||||
man
|
||||
cacert.out
|
||||
findutils
|
||||
iana-etc
|
||||
gitMinimal
|
||||
openssh
|
||||
]
|
||||
++ extraPkgs;
|
||||
|
||||
users = {
|
||||
|
||||
root = {
|
||||
uid = 0;
|
||||
shell = lib.getExe bashInteractive;
|
||||
home = "/root";
|
||||
gid = 0;
|
||||
groups = [ "root" ];
|
||||
description = "System administrator";
|
||||
};
|
||||
|
||||
nobody = {
|
||||
uid = 65534;
|
||||
shell = lib.getExe' shadow "nologin";
|
||||
home = "/var/empty";
|
||||
gid = 65534;
|
||||
groups = [ "nobody" ];
|
||||
description = "Unprivileged account (don't use!)";
|
||||
};
|
||||
|
||||
}
|
||||
// lib.optionalAttrs (uid != 0) {
|
||||
"${uname}" = {
|
||||
uid = uid;
|
||||
shell = lib.getExe bashInteractive;
|
||||
home = "/home/${uname}";
|
||||
gid = gid;
|
||||
groups = [ "${gname}" ];
|
||||
description = "Nix user";
|
||||
};
|
||||
}
|
||||
// lib.listToAttrs (
|
||||
map (n: {
|
||||
name = "nixbld${toString n}";
|
||||
value = {
|
||||
uid = 30000 + n;
|
||||
gid = 30000;
|
||||
groups = [ "nixbld" ];
|
||||
description = "Nix build user ${toString n}";
|
||||
};
|
||||
}) (lib.lists.range 1 32)
|
||||
);
|
||||
|
||||
groups = {
|
||||
root.gid = 0;
|
||||
nixbld.gid = 30000;
|
||||
nobody.gid = 65534;
|
||||
}
|
||||
// lib.optionalAttrs (gid != 0) {
|
||||
"${gname}".gid = gid;
|
||||
};
|
||||
|
||||
userToPasswd = (
|
||||
k:
|
||||
{
|
||||
uid,
|
||||
gid ? 65534,
|
||||
home ? "/var/empty",
|
||||
description ? "",
|
||||
shell ? "/bin/false",
|
||||
groups ? [ ],
|
||||
}:
|
||||
"${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
|
||||
);
|
||||
passwdContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToPasswd users)));
|
||||
|
||||
userToShadow = k: { ... }: "${k}:!:1::::::";
|
||||
shadowContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToShadow users)));
|
||||
|
||||
# Map groups to members
|
||||
# {
|
||||
# group = [ "user1" "user2" ];
|
||||
# }
|
||||
groupMemberMap = (
|
||||
let
|
||||
# Create a flat list of user/group mappings
|
||||
mappings = (
|
||||
builtins.foldl' (
|
||||
acc: user:
|
||||
let
|
||||
groups = users.${user}.groups or [ ];
|
||||
in
|
||||
acc
|
||||
++ map (group: {
|
||||
inherit user group;
|
||||
}) groups
|
||||
) [ ] (lib.attrNames users)
|
||||
);
|
||||
in
|
||||
(builtins.foldl' (
|
||||
acc: v:
|
||||
acc
|
||||
// {
|
||||
${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
|
||||
}
|
||||
) { } mappings)
|
||||
);
|
||||
|
||||
groupToGroup =
|
||||
k:
|
||||
{ gid }:
|
||||
let
|
||||
members = groupMemberMap.${k} or [ ];
|
||||
in
|
||||
"${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
|
||||
groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups)));
|
||||
|
||||
toConf =
|
||||
with pkgs.lib.generators;
|
||||
toKeyValue {
|
||||
mkKeyValue = mkKeyValueDefault {
|
||||
mkValueString = v: if lib.isList v then lib.concatStringsSep " " v else mkValueStringDefault { } v;
|
||||
} " = ";
|
||||
};
|
||||
|
||||
nixConfContents = toConf (
|
||||
{
|
||||
sandbox = false;
|
||||
build-users-group = "nixbld";
|
||||
trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
|
||||
}
|
||||
// nixConf
|
||||
);
|
||||
|
||||
userHome = if uid == 0 then "/root" else "/home/${uname}";
|
||||
|
||||
baseSystem =
|
||||
let
|
||||
nixpkgs = pkgs.path;
|
||||
channel = runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
|
||||
mkdir $out
|
||||
if [ "$bundleNixpkgs" ]; then
|
||||
ln -s ${
|
||||
builtins.path {
|
||||
path = nixpkgs;
|
||||
name = "source";
|
||||
}
|
||||
} $out/nixpkgs
|
||||
echo "[]" > $out/manifest.nix
|
||||
fi
|
||||
'';
|
||||
# doc/manual/source/command-ref/files/manifest.nix.md
|
||||
manifest = buildPackages.runCommand "manifest.nix" { } ''
|
||||
cat > $out <<EOF
|
||||
[
|
||||
${lib.concatStringsSep "\n" (
|
||||
builtins.map (
|
||||
drv:
|
||||
let
|
||||
outputs = drv.outputsToInstall or [ "out" ];
|
||||
in
|
||||
''
|
||||
{
|
||||
${lib.concatStringsSep "\n" (
|
||||
builtins.map (output: ''
|
||||
${output} = { outPath = "${lib.getOutput output drv}"; };
|
||||
'') outputs
|
||||
)}
|
||||
outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
|
||||
name = "${drv.name}";
|
||||
outPath = "${drv}";
|
||||
system = "${drv.system}";
|
||||
type = "derivation";
|
||||
meta = { };
|
||||
}
|
||||
''
|
||||
) defaultPkgs
|
||||
)}
|
||||
]
|
||||
EOF
|
||||
'';
|
||||
profile = buildPackages.buildEnv {
|
||||
name = "root-profile-env";
|
||||
paths = defaultPkgs;
|
||||
|
||||
postBuild = ''
|
||||
mv $out/manifest $out/manifest.nix
|
||||
'';
|
||||
inherit manifest;
|
||||
};
|
||||
flake-registry-path =
|
||||
if (flake-registry == null) then
|
||||
null
|
||||
else if (builtins.readFileType (toString flake-registry)) == "directory" then
|
||||
"${flake-registry}/flake-registry.json"
|
||||
else
|
||||
flake-registry;
|
||||
in
|
||||
runCommand "base-system"
|
||||
{
|
||||
inherit
|
||||
passwdContents
|
||||
groupContents
|
||||
shadowContents
|
||||
nixConfContents
|
||||
;
|
||||
passAsFile = [
|
||||
"passwdContents"
|
||||
"groupContents"
|
||||
"shadowContents"
|
||||
"nixConfContents"
|
||||
];
|
||||
allowSubstitutes = false;
|
||||
preferLocalBuild = true;
|
||||
}
|
||||
(
|
||||
''
|
||||
env
|
||||
set -x
|
||||
mkdir -p $out/etc
|
||||
|
||||
# may get replaced by pkgs.dockerTools.caCertificates
|
||||
mkdir -p $out/etc/ssl/certs
|
||||
# Old NixOS compatibility.
|
||||
ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
|
||||
# NixOS canonical location
|
||||
ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
cat $passwdContentsPath > $out/etc/passwd
|
||||
echo "" >> $out/etc/passwd
|
||||
|
||||
cat $groupContentsPath > $out/etc/group
|
||||
echo "" >> $out/etc/group
|
||||
|
||||
cat $shadowContentsPath > $out/etc/shadow
|
||||
echo "" >> $out/etc/shadow
|
||||
|
||||
mkdir -p $out/usr
|
||||
ln -s /nix/var/nix/profiles/share $out/usr/
|
||||
|
||||
mkdir -p $out/nix/var/nix/gcroots
|
||||
|
||||
mkdir $out/tmp
|
||||
|
||||
mkdir -p $out/var/tmp
|
||||
|
||||
mkdir -p $out/etc/nix
|
||||
cat $nixConfContentsPath > $out/etc/nix/nix.conf
|
||||
|
||||
mkdir -p $out${userHome}
|
||||
mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
|
||||
|
||||
# see doc/manual/source/command-ref/files/profiles.md
|
||||
ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
|
||||
ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
|
||||
ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
|
||||
|
||||
# see doc/manual/source/command-ref/files/channels.md
|
||||
ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
|
||||
ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
|
||||
|
||||
# see doc/manual/source/command-ref/files/default-nix-expression.md
|
||||
mkdir -p $out${userHome}/.nix-defexpr
|
||||
ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
|
||||
echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
|
||||
|
||||
# may get replaced by pkgs.dockerTools.binSh & pkgs.dockerTools.usrBinEnv
|
||||
mkdir -p $out/bin $out/usr/bin
|
||||
ln -s ${lib.getExe' coreutils-full "env"} $out/usr/bin/env
|
||||
ln -s ${lib.getExe bashInteractive} $out/bin/sh
|
||||
|
||||
''
|
||||
+ (lib.optionalString (flake-registry-path != null) ''
|
||||
nixCacheDir="${userHome}/.cache/nix"
|
||||
mkdir -p $out$nixCacheDir
|
||||
globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
|
||||
ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
|
||||
mkdir -p $out/nix/var/nix/gcroots/auto
|
||||
rootName=$(${lib.getExe' nix "nix"} --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
|
||||
ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
|
||||
'')
|
||||
);
|
||||
|
||||
in
|
||||
dockerTools.buildLayeredImageWithNixDb {
|
||||
|
||||
inherit
|
||||
name
|
||||
tag
|
||||
maxLayers
|
||||
uid
|
||||
gid
|
||||
uname
|
||||
gname
|
||||
;
|
||||
|
||||
contents = [ baseSystem ];
|
||||
|
||||
extraCommands = ''
|
||||
rm -rf nix-support
|
||||
ln -s /nix/var/nix/profiles nix/var/nix/gcroots/profiles
|
||||
'';
|
||||
fakeRootCommands = ''
|
||||
chmod 1777 tmp
|
||||
chmod 1777 var/tmp
|
||||
chown -R ${toString uid}:${toString gid} .${userHome}
|
||||
chown -R ${toString uid}:${toString gid} nix
|
||||
'';
|
||||
|
||||
config = {
|
||||
inherit Cmd Labels;
|
||||
User = "${toString uid}:${toString gid}";
|
||||
Env = [
|
||||
"USER=${uname}"
|
||||
"PATH=${
|
||||
lib.concatStringsSep ":" [
|
||||
"${userHome}/.nix-profile/bin"
|
||||
"/nix/var/nix/profiles/default/bin"
|
||||
"/nix/var/nix/profiles/default/sbin"
|
||||
]
|
||||
}"
|
||||
"MANPATH=${
|
||||
lib.concatStringsSep ":" [
|
||||
"${userHome}/.nix-profile/share/man"
|
||||
"/nix/var/nix/profiles/default/share/man"
|
||||
]
|
||||
}"
|
||||
"SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
|
||||
"GIT_SSL_CAINFO=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
|
||||
"NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
|
||||
"NIX_PATH=/nix/var/nix/profiles/per-user/${uname}/channels:${userHome}/.nix-defexpr/channels"
|
||||
];
|
||||
};
|
||||
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
{ writeShellScriptBin, nix }:
|
||||
writeShellScriptBin "gitlab-runner-pre-build-script"
|
||||
# bash
|
||||
''
|
||||
set -e
|
||||
set -u
|
||||
|
||||
function section_start() {
|
||||
local name="$1"
|
||||
shift
|
||||
echo -e "\e[0Ksection_start:$(date +%s):$name[collapsed=true]\r\e[0K$*"
|
||||
}
|
||||
|
||||
function section_end() {
|
||||
local name="$1"
|
||||
echo -e "\e[0Ksection_end:$(date +%s):$name\r\e[0K"
|
||||
}
|
||||
|
||||
function setup() {
|
||||
# We need to allow modification of nix config for cachix as
|
||||
# otherwise it is link to the read only file in the store.
|
||||
cp --remove-destination \
|
||||
"$(readlink -f /etc/nix/nix.conf)" /etc/nix/nix.conf
|
||||
|
||||
# shellcheck disable=SC1091
|
||||
. "${nix}/etc/profile.d/nix-daemon.sh"
|
||||
}
|
||||
|
||||
function setup_pipeline_scratch_dir() {
|
||||
scratch_dir="/scratch/$CI_PIPELINE_ID"
|
||||
|
||||
echo "Create scratch directory for pipeline: $scratch_dir"
|
||||
mkdir -p "$scratch_dir" || {
|
||||
echo "Could not create scratch dir '$scratch_dir'." >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
export CI_CUSTOM_SCRATCH_DIR="$scratch_dir"
|
||||
}
|
||||
|
||||
function print_info() {
|
||||
echo "Nix version:"
|
||||
nix --version
|
||||
}
|
||||
|
||||
function main() {
|
||||
print_info
|
||||
setup
|
||||
setup_pipeline_scratch_dir
|
||||
}
|
||||
|
||||
section_start gitlab-runner-prebuild "Gitlab-Runner PreBuild Script"
|
||||
main "$@"
|
||||
section_end gitlab-runner-prebuild
|
||||
''
|
||||
@@ -0,0 +1,43 @@
|
||||
{ lib, ... }:
|
||||
{
|
||||
virtualisation.docker = {
|
||||
enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
|
||||
# Create a `docker` alias for podman, to use it as a drop-in replacement
|
||||
# dockerCompat = true;
|
||||
dockerSocket = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# Required for containers under podman-compose to be able to talk to each other.
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
|
||||
autoPrune = {
|
||||
dates = "weekly";
|
||||
flags = [
|
||||
"--filter"
|
||||
"label!=no-prune"
|
||||
"--volumes"
|
||||
"--log-level"
|
||||
"debug"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.containers.storage.settings = {
|
||||
storage = {
|
||||
driver = "overlay";
|
||||
graphroot = "/var/lib/containers/storage";
|
||||
runroot = "/run/containers/storage";
|
||||
|
||||
# Does not work currently.
|
||||
options.overlay = {
|
||||
mountopt = "nodev,metacopy=on";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
runnerConfig,
|
||||
}:
|
||||
# This is the runner config for the `nixosConfiguration.services.gitlab-runner.services.X`
|
||||
{
|
||||
services.gitlab-runner.services.shell-runner = {
|
||||
description = runnerConfig.desc;
|
||||
authenticationTokenConfigFile = runnerConfig.tokenFile;
|
||||
|
||||
executor = "shell";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
import json
|
||||
import os
|
||||
from dataclasses import dataclass
|
||||
from pathlib import Path
|
||||
from string import Template
|
||||
from typing import Any
|
||||
|
||||
|
||||
@dataclass
|
||||
class Runner:
|
||||
name: str
|
||||
tokenFile: str
|
||||
|
||||
id: str
|
||||
token: str
|
||||
|
||||
|
||||
@dataclass
|
||||
class Machines:
|
||||
gitlab: Any
|
||||
gitlab_runner: Any
|
||||
|
||||
|
||||
@dataclass
|
||||
class Nix:
|
||||
jq: str
|
||||
gitlab_state_path: str
|
||||
create_runner_payload_file: str
|
||||
auth_payload_file: str
|
||||
runner_token_env_file: str
|
||||
|
||||
|
||||
# Some global variables to work in the tests.
|
||||
out_dir = os.environ.get("out", os.getcwd())
|
||||
nix = Nix(
|
||||
jq=JQ_BINARY,
|
||||
gitlab_state_path=GITLAB_STATE_PATH,
|
||||
auth_payload_file=AUTH_PAYLOAD_FILE,
|
||||
create_runner_payload_file=CREATE_RUNNER_PAYLOAD_FILE,
|
||||
runner_token_env_file=RUNNER_TOKEN_ENV_FILE,
|
||||
)
|
||||
vms = Machines(gitlab, gitlab_runner)
|
||||
runnerConfigs: dict[str, Runner] = {}
|
||||
|
||||
|
||||
def wait_for_services():
|
||||
vms.gitlab.wait_for_unit("gitaly.service")
|
||||
vms.gitlab.wait_for_unit("gitlab-workhorse.service")
|
||||
vms.gitlab.wait_for_unit("gitlab.service")
|
||||
vms.gitlab.wait_for_unit("gitlab-sidekiq.service")
|
||||
vms.gitlab.wait_for_file(f"{nix.gitlab_state_path}/tmp/sockets/gitlab.socket")
|
||||
vms.gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in")
|
||||
|
||||
|
||||
def test_connection():
|
||||
"""
|
||||
Test the connection to Gitlab and check if it is reachable from the runner VM.
|
||||
"""
|
||||
|
||||
print("==> Getting secrets and headers.")
|
||||
vms.gitlab.succeed(
|
||||
"cp /var/gitlab/state/config/secrets.yml /root/gitlab-secrets.yml"
|
||||
)
|
||||
|
||||
vms.gitlab.succeed(
|
||||
f"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @{nix.auth_payload_file} http://gitlab/oauth/token | {nix.jq} -r '.access_token')\" >/tmp/headers"
|
||||
)
|
||||
|
||||
vms.gitlab.copy_from_vm("/tmp/headers")
|
||||
out_dir = os.environ.get("out", os.getcwd())
|
||||
vms.gitlab_runner.copy_from_host(str(Path(out_dir, "headers")), "/tmp/headers")
|
||||
|
||||
print("==> Testing connection.")
|
||||
vms.gitlab_runner.succeed("curl -v -H @/tmp/headers http://gitlab/api/v4/version")
|
||||
|
||||
|
||||
def test_register_runner(name: str, tokenFile: str):
|
||||
"""
|
||||
Register the runner in Gitlab and write the token file to be picked up by
|
||||
the gitlab-runner service on the other VM.
|
||||
"""
|
||||
|
||||
r = Runner(
|
||||
name=name,
|
||||
tokenFile=tokenFile,
|
||||
token="",
|
||||
id="",
|
||||
)
|
||||
runnerConfigs[r.name] = r
|
||||
|
||||
print(f"==> Create Runner '{r.name}'")
|
||||
resp = vms.gitlab.execute(
|
||||
f"""
|
||||
curl -s -X POST \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H @/tmp/headers \
|
||||
-d @{nix.create_runner_payload_file} \
|
||||
http://gitlab/api/v4/user/runners
|
||||
"""
|
||||
)[1]
|
||||
obj = json.loads(resp)
|
||||
r.id = obj["id"]
|
||||
r.token = obj["token"]
|
||||
print(f"==> Registered runner '{r.id}' with token '{r.token}'.")
|
||||
|
||||
# Push the token to the runner machine.
|
||||
print("==> Push runner token to machine.")
|
||||
tokenF = Path(out_dir, f"token-{r.name}.env")
|
||||
with open(nix.runner_token_env_file, "r") as f:
|
||||
tokenData = Template(f.read()).substitute({"token": r.token})
|
||||
with open(tokenF, "w") as w:
|
||||
w.write(tokenData)
|
||||
vms.gitlab_runner.copy_from_host(str(tokenF), r.tokenFile)
|
||||
|
||||
|
||||
def restart_gitlab_runner_service(runnerConfigs):
|
||||
print("==> Restart Gitlab Runner")
|
||||
|
||||
if any([n == "podman" for n in runnerConfigs.keys()]):
|
||||
vms.gitlab_runner.wait_for_unit("podman-nix-daemon-container.service")
|
||||
vms.gitlab_runner.wait_for_unit("podman-podman-daemon-container.service")
|
||||
|
||||
vms.gitlab_runner.systemctl("restart gitlab-runner.service")
|
||||
vms.gitlab_runner.wait_for_unit("gitlab-runner.service")
|
||||
|
||||
|
||||
def test_runner_registered(r: Runner):
|
||||
"""
|
||||
Test that the runner `r` is registered in Gitlab and its status is active.
|
||||
"""
|
||||
|
||||
print(f"==> Check that runner '{r.name}' is registered.")
|
||||
|
||||
resp = vms.gitlab.execute(
|
||||
f"""
|
||||
curl -s -X GET \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H @/tmp/headers \
|
||||
http://gitlab/api/v4/runners/{r.id}"""
|
||||
)[1]
|
||||
runnerStatus = json.loads(resp)
|
||||
|
||||
if not runnerStatus["active"]:
|
||||
raise Exception(
|
||||
f"Runner '{r.name}' [id: '{r.id}'] status is not active: {resp}"
|
||||
)
|
||||
@@ -1005,8 +1005,8 @@ let
|
||||
mktplcRef = {
|
||||
name = "coder-remote";
|
||||
publisher = "coder";
|
||||
version = "1.11.5";
|
||||
hash = "sha256-p2mAm6bY2lNocQLQ/8ZW+JcDFlwhMytoQtXNMeJq+CE=";
|
||||
version = "1.11.6";
|
||||
hash = "sha256-yMhbOnG7jVO0oPzLa+El5i7KlD1GCYTOcfF0cOUf5hQ=";
|
||||
};
|
||||
meta = {
|
||||
description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";
|
||||
@@ -1953,8 +1953,8 @@ let
|
||||
mktplcRef = {
|
||||
publisher = "github";
|
||||
name = "vscode-pull-request-github";
|
||||
version = "0.122.0";
|
||||
hash = "sha256-U7BpKnkk7l4+dmgam6OP3Dl6ySX9e+wHmUELGpAjOss=";
|
||||
version = "0.124.1";
|
||||
hash = "sha256-+ooxmm3OiNuQigApqkQV9hzw18yUGPEjKFEgn7MjpJA=";
|
||||
};
|
||||
meta = {
|
||||
license = lib.licenses.mit;
|
||||
@@ -1965,8 +1965,8 @@ let
|
||||
mktplcRef = {
|
||||
name = "gitlab-workflow";
|
||||
publisher = "gitlab";
|
||||
version = "6.60.2";
|
||||
hash = "sha256-X3ZOrEkcFDlB4pYqEvO3gACAOET1kjF56FkHLmNKRrI=";
|
||||
version = "6.61.2";
|
||||
hash = "sha256-NLWu/4QgG/vbhTVjV57bt6J7AX2kC59/2xNkj8PMdtc=";
|
||||
};
|
||||
meta = {
|
||||
description = "GitLab extension for Visual Studio Code";
|
||||
@@ -3828,8 +3828,8 @@ let
|
||||
mktplcRef = {
|
||||
name = "ansible";
|
||||
publisher = "redhat";
|
||||
version = "25.12.2";
|
||||
hash = "sha256-mglzlRBGD09RDwzfJvWaTt3btgEF/G818prJcQC8/Is=";
|
||||
version = "25.12.3";
|
||||
hash = "sha256-6G/CpzSSrRzwtay4+t46gz8aBF7qgu79NUhBypTJMrc=";
|
||||
};
|
||||
meta = {
|
||||
description = "Ansible language support";
|
||||
|
||||
@@ -40,13 +40,13 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "86Box";
|
||||
version = "5.2";
|
||||
version = "5.3";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "86Box";
|
||||
repo = "86Box";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-JcKLtREGSNA0IOGM5kqFjAya155KeYV/nqynG4dVv4w=";
|
||||
hash = "sha256-n68Ghhsv15TzpOMH4dBTNxa6AYwqN5s2C5pyO9VVaco=";
|
||||
};
|
||||
|
||||
patches = [ ./darwin.patch ];
|
||||
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
owner = "86Box";
|
||||
repo = "roms";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-DmOxQ+E7bHF5St70YqPbIzMoADS8dtp2nDXvrhcAVw4=";
|
||||
hash = "sha256-7/xhhT29ijGNVlW7oJXdyJuhUwVs0b4dIUjc3lVtNEY=";
|
||||
};
|
||||
updateScript = ./update.sh;
|
||||
};
|
||||
|
||||
@@ -82,13 +82,13 @@ let
|
||||
in
|
||||
stdenv.mkDerivation {
|
||||
pname = "ansel";
|
||||
version = "0-unstable-2025-12-08";
|
||||
version = "0-unstable-2025-12-15";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "aurelienpierreeng";
|
||||
repo = "ansel";
|
||||
rev = "06961da4b03abff051c4abff32eeb6356894809e";
|
||||
hash = "sha256-UJC1TBGga52/d1uRkZzCJtNcivql7zjGEUP7mav56wk=";
|
||||
rev = "c2c49aee68ca256bffbd01da7a67ff57791948a0";
|
||||
hash = "sha256-wHzUJE2QxcGt+IuOgJNXonJ97BctNmmZyyCoahjZb90=";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -41,7 +41,7 @@ buildGoModule rec {
|
||||
];
|
||||
|
||||
postInstall = ''
|
||||
for shell in bash zsh; do
|
||||
for shell in bash zsh fish; do
|
||||
${
|
||||
if (stdenv.buildPlatform == stdenv.hostPlatform) then
|
||||
"$out/bin/argo"
|
||||
|
||||
@@ -6,12 +6,12 @@
|
||||
|
||||
python3Packages.buildPythonApplication rec {
|
||||
pname = "bikeshed";
|
||||
version = "7.0.0";
|
||||
version = "7.0.5";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchPypi {
|
||||
inherit pname version;
|
||||
hash = "sha256-KDa751bPpyu++7N5rTN1XvOXZ2qOFSaajw7dIe7CAWw=";
|
||||
hash = "sha256-D0PP+NnLREJr0F6M/KG8O9HTz3FOaN0GkWLo96PaU/E=";
|
||||
};
|
||||
|
||||
patches = [ ./remove-install-check.patch ];
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
commit 0c7159ed66e28b4da4275cd79e01b2d0669808a3 (HEAD -> fix-hip-path-syntax-error, amarshall/fix-hip-path-syntax-error)
|
||||
Author: Andrew Marshall <andrew@johnandrewmarshall.com>
|
||||
Date: Thu Nov 20 20:24:20 2025 -0500
|
||||
|
||||
Fix: Incorrect HIP load path on Linux
|
||||
|
||||
Missing comma meant the following line was concatenated with this one,
|
||||
causing the path to be
|
||||
"/opt/rocm/hip/lib/libamdhip64.so.6libamdhip64.so.7".
|
||||
|
||||
Broken in 14bd7a531feddb81a0e522b7db76288639f1ad05.
|
||||
|
||||
diff --git a/extern/hipew/src/hipew.c b/extern/hipew/src/hipew.c
|
||||
index 3ce13ef7c32..e72ccde69ef 100644
|
||||
--- a/extern/hipew/src/hipew.c
|
||||
+++ b/extern/hipew/src/hipew.c
|
||||
@@ -244,7 +244,7 @@ static int hipewHipInit(void) {
|
||||
const char* hip_paths[] = { "libamdhip64.so",
|
||||
"libamdhip64.so.6",
|
||||
"/opt/rocm/lib/libamdhip64.so.6",
|
||||
- "/opt/rocm/hip/lib/libamdhip64.so.6"
|
||||
+ "/opt/rocm/hip/lib/libamdhip64.so.6",
|
||||
"libamdhip64.so.7",
|
||||
"/opt/rocm/lib/libamdhip64.so.7",
|
||||
"/opt/rocm/hip/lib/libamdhip64.so.7",
|
||||
@@ -117,18 +117,14 @@ in
|
||||
|
||||
stdenv'.mkDerivation (finalAttrs: {
|
||||
pname = "blender";
|
||||
version = "5.0.0";
|
||||
version = "5.0.1";
|
||||
|
||||
src = fetchzip {
|
||||
name = "source";
|
||||
url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
|
||||
hash = "sha256-UUHsylDmMWRcr1gGiXuYnno7D6uMjLqTYd9ak4FnZis=";
|
||||
hash = "sha256-fNnQRfGfNc7rbk8npkcYtoAqRjJc6MaV4mqtSJxd0EM=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
./fix-hip-path.patch # https://projects.blender.org/blender/blender/pulls/150321
|
||||
];
|
||||
|
||||
postPatch =
|
||||
(lib.optionalString stdenv.hostPlatform.isDarwin ''
|
||||
: > build_files/cmake/platform/platform_apple_xcode.cmake
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
{
|
||||
fetchFromGitHub,
|
||||
lib,
|
||||
rustPlatform,
|
||||
pkg-config,
|
||||
autoPatchelfHook,
|
||||
stdenv,
|
||||
wayland,
|
||||
vulkan-loader,
|
||||
libxkbcommon,
|
||||
nix-update-script,
|
||||
}:
|
||||
rustPlatform.buildRustPackage rec {
|
||||
pname = "cantus";
|
||||
version = "0.4.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "CodedNil";
|
||||
repo = "cantus";
|
||||
tag = version;
|
||||
hash = "sha256-Mox8OGJFbQd3dy/I1O6OjqDa4FAFcZWiS+zOuTwV6js=";
|
||||
};
|
||||
|
||||
cargoHash = "sha256-9+2+PkUA+s6v/Mrpo8M1lLemxClVONbbeHtric2z/Jw=";
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkg-config
|
||||
autoPatchelfHook
|
||||
];
|
||||
|
||||
runtimeDependencies = [
|
||||
libxkbcommon
|
||||
vulkan-loader
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
stdenv.cc.cc.lib
|
||||
wayland
|
||||
];
|
||||
|
||||
passthru.updateScript = nix-update-script { };
|
||||
|
||||
meta = {
|
||||
description = "Beautiful interactive music widget for Wayland";
|
||||
homepage = "https://github.com/CodedNil/cantus";
|
||||
license = lib.licenses.mit;
|
||||
mainProgram = "cantus";
|
||||
maintainers = with lib.maintainers; [ CodedNil ];
|
||||
platforms = lib.platforms.linux;
|
||||
};
|
||||
}
|
||||
@@ -49,14 +49,14 @@ let
|
||||
in
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "gamescope";
|
||||
version = "3.16.18";
|
||||
version = "3.16.19";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "ValveSoftware";
|
||||
repo = "gamescope";
|
||||
tag = finalAttrs.version;
|
||||
fetchSubmodules = true;
|
||||
hash = "sha256-/5n1ZpZYg2KzlON7cgde96sTCO/jvvmr0AkWYF8IBGU=";
|
||||
hash = "sha256-Bwj781MVeQexjYnHfDArgjVjl7eQW+CzbdKrLdcAKkg=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
|
||||
@@ -19,14 +19,14 @@
|
||||
|
||||
stdenvNoCC.mkDerivation (finalAttrs: {
|
||||
pname = "home-manager";
|
||||
version = "0-unstable-2025-12-13";
|
||||
version = "0-unstable-2025-12-19";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
name = "home-manager-source";
|
||||
owner = "nix-community";
|
||||
repo = "home-manager";
|
||||
rev = "d787ec69c3216ea33be1c0424fe65cb23aa8fb31";
|
||||
hash = "sha256-KOP4QnkiRwiD5KEOr6ceF67rfTP1OqPmCCft6xDC3k4=";
|
||||
rev = "bb35f07cc95a73aacbaf1f7f46bb8a3f40f265b5";
|
||||
hash = "sha256-47Ee0bTidhF/3/sHuYnWRuxcCrrm0mBNDxBkOTd3wWQ=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
|
||||
@@ -1,22 +1,25 @@
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
fetchzip,
|
||||
fetchFromSourcehut,
|
||||
autoreconfHook,
|
||||
bison,
|
||||
flex,
|
||||
help2man,
|
||||
perl,
|
||||
tk,
|
||||
python3,
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation {
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "ifm";
|
||||
version = "2015-11-08";
|
||||
version = "5.5";
|
||||
|
||||
src = fetchzip {
|
||||
url = "https://bitbucket.org/zondo/ifm/get/dca0774e4d3a.zip";
|
||||
sha256 = "14af21qjd5jvsscm6vxpsdrnipdr33g6niagzmykrhyfhwcbjahi";
|
||||
src = fetchFromSourcehut {
|
||||
owner = "~zondo";
|
||||
repo = "ifm";
|
||||
tag = finalAttrs.version;
|
||||
hash = "sha256-RA0F8hccVJTq/F4l27CwhxynTqVuLJaYBiUfd/UfvPc=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
@@ -24,6 +27,7 @@ stdenv.mkDerivation {
|
||||
bison
|
||||
flex
|
||||
help2man
|
||||
python3
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
@@ -45,4 +49,4 @@ stdenv.mkDerivation {
|
||||
platforms = lib.platforms.linux;
|
||||
maintainers = [ ];
|
||||
};
|
||||
}
|
||||
})
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
|
||||
}:
|
||||
let
|
||||
version = "1.43.1";
|
||||
version = "1.45.0";
|
||||
in
|
||||
rustPlatform.buildRustPackage {
|
||||
inherit version;
|
||||
@@ -34,10 +34,10 @@ rustPlatform.buildRustPackage {
|
||||
owner = "casey";
|
||||
repo = "just";
|
||||
tag = version;
|
||||
hash = "sha256-ma1P8mcSnU/G/B/pN2tDEVokP+fGShGFodS2TG4wyQY=";
|
||||
hash = "sha256-D+xMPpn8JLX88eIO9zY051K81KPGBhcFvhBIwuTDymk=";
|
||||
};
|
||||
|
||||
cargoHash = "sha256-nT5GTAvj2+ytbOpRNNVardchK1aXPCiJGSUp5ZoBCVA=";
|
||||
cargoHash = "sha256-zokI+mWyI/HmzP7GuO59usEsscl3tpeyhNT2tXmLny8=";
|
||||
|
||||
nativeBuildInputs =
|
||||
lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
|
||||
@@ -91,8 +91,8 @@ rustPlatform.buildRustPackage {
|
||||
# No linkcheck in sandbox
|
||||
echo 'optional = true' >> book/en/book.toml
|
||||
mdbook build book/en
|
||||
mkdir -p $doc/share/doc/$name
|
||||
mv ./book/en/build/html $doc/share/doc/$name
|
||||
mkdir -p $doc/share/doc/$name/html
|
||||
mv ./book/en/build/* $doc/share/doc/$name/html
|
||||
''
|
||||
+ lib.optionalString installManPages ''
|
||||
$out/bin/just --man > ./just.1
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Label</key>
|
||||
<string>org.nixos.kwm</string>
|
||||
<key>ProgramArguments</key>
|
||||
<array>
|
||||
<string>@out@/kwm</string>
|
||||
</array>
|
||||
<key>KeepAlive</key>
|
||||
<true/>
|
||||
<key>Sockets</key>
|
||||
<dict>
|
||||
<key>Listeners</key>
|
||||
<dict>
|
||||
<key>SockServiceName</key>
|
||||
<string>3020</string>
|
||||
<key>SockType</key>
|
||||
<string>dgram</string>
|
||||
<key>SockFamily</key>
|
||||
<string>IPv4</string>
|
||||
</dict>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
fetchzip,
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "kwm";
|
||||
version = "4.0.5";
|
||||
|
||||
src = fetchzip {
|
||||
stripRoot = false;
|
||||
url = "https://github.com/koekeishiya/kwm/releases/download/v${version}/Kwm-${version}.zip";
|
||||
sha256 = "1ld1vblg3hmc6lpb8p2ljvisbkijjkijf4y87z5y1ia4k8pk7mxb";
|
||||
};
|
||||
|
||||
# TODO: Build this properly once we have swiftc.
|
||||
dontBuild = true;
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/bin
|
||||
cp kwmc $out/bin/kwmc
|
||||
cp kwm overlaylib.dylib $out
|
||||
|
||||
mkdir -p $out/Library/LaunchDaemons
|
||||
cp ${./org.nixos.kwm.plist} $out/Library/LaunchDaemons/org.nixos.kwm.plist
|
||||
substituteInPlace $out/Library/LaunchDaemons/org.nixos.kwm.plist --subst-var out
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "Tiling window manager with focus follows mouse for OSX";
|
||||
homepage = "https://github.com/koekeishiya/kwm";
|
||||
downloadPage = "https://github.com/koekeishiya/kwm/releases";
|
||||
platforms = lib.platforms.darwin;
|
||||
maintainers = with lib.maintainers; [ lnl7 ];
|
||||
mainProgram = "kwmc";
|
||||
license = lib.licenses.mit;
|
||||
};
|
||||
}
|
||||
@@ -9,7 +9,7 @@
|
||||
|
||||
buildGoModule rec {
|
||||
pname = "litmusctl";
|
||||
version = "1.20.0";
|
||||
version = "1.21.0";
|
||||
|
||||
nativeBuildInputs = [
|
||||
installShellFiles
|
||||
@@ -23,7 +23,7 @@ buildGoModule rec {
|
||||
owner = "litmuschaos";
|
||||
repo = "litmusctl";
|
||||
rev = "${version}";
|
||||
hash = "sha256-AXfBUwDBekNmsAXaDKMmgTTu0sCIHaVDfrFrRyx7Bl8=";
|
||||
hash = "sha256-Re9NBGKJK7FKCVtOg3BTuH4PXSmkvEtf+yYD75u5Lgg=";
|
||||
};
|
||||
|
||||
vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";
|
||||
|
||||
@@ -8,18 +8,18 @@
|
||||
|
||||
rustPlatform.buildRustPackage (finalAttrs: {
|
||||
pname = "meilisearch";
|
||||
version = "1.30.1";
|
||||
version = "1.31.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "meilisearch";
|
||||
repo = "meilisearch";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-Q2K4ojWrPI0XGVKnzS4DUz0y0G+DQdIGSGlbEEm/iEA=";
|
||||
hash = "sha256-xwQxvyOaldcSyJBjQKLXTayvr3r9EwnXovkqs13XrUY=";
|
||||
};
|
||||
|
||||
cargoBuildFlags = [ "--package=meilisearch" ];
|
||||
|
||||
cargoHash = "sha256-GoGarEEXAGgpTRMyRr+E6szIekf5AU+BAwtt+g/WZas=";
|
||||
cargoHash = "sha256-gvXViWVgu3mAE29Qmk7U2wMV96JYCm3CDcEKLoLwNqg=";
|
||||
|
||||
# Default features include mini dashboard which downloads something from the internet.
|
||||
buildNoDefaultFeatures = true;
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
libkrun,
|
||||
passt,
|
||||
dhcpcd,
|
||||
socat,
|
||||
systemd,
|
||||
udev,
|
||||
pkg-config,
|
||||
@@ -40,6 +41,7 @@ let
|
||||
[
|
||||
dhcpcd
|
||||
passt
|
||||
socat
|
||||
(placeholder "out")
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isAarch64 [ fex ]
|
||||
|
||||
@@ -22,14 +22,14 @@
|
||||
|
||||
python3Packages.buildPythonApplication rec {
|
||||
pname = "nixpkgs-review";
|
||||
version = "3.5.1";
|
||||
version = "3.6.0";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "Mic92";
|
||||
repo = "nixpkgs-review";
|
||||
tag = version;
|
||||
hash = "sha256-43+H68OPABAqg9GQZJ+XehyWmUWk+EWiHzSxyc55luY=";
|
||||
hash = "sha256-SGykze7xkurdrqwMvXZU4E7VAuEcHCKqtlXAdaQrr1M=";
|
||||
};
|
||||
|
||||
build-system = [
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{ stdenv, nixpkgs-review }:
|
||||
|
||||
# nixpkgs-update: no auto update
|
||||
nixpkgs-review.override {
|
||||
withSandboxSupport = stdenv.hostPlatform.isLinux;
|
||||
withNom = true;
|
||||
|
||||
@@ -10,13 +10,13 @@ let
|
||||
in
|
||||
buildGoModule (finalAttrs: {
|
||||
pname = "process-compose";
|
||||
version = "1.78.0";
|
||||
version = "1.85.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "F1bonacc1";
|
||||
repo = "process-compose";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-phWrEqDdyXYvxWhToV8j01nDeX9ZV12DichiYDOPaLw=";
|
||||
hash = "sha256-8nNvlTl4qUtlNV2ebsObssYRPepPL//fe26y/wY93l4=";
|
||||
|
||||
# populate values that require us to use git. By doing this in postFetch we
|
||||
# can delete .git afterwards and maintain better reproducibility of the src.
|
||||
@@ -46,13 +46,11 @@ buildGoModule (finalAttrs: {
|
||||
installShellFiles
|
||||
];
|
||||
|
||||
vendorHash = "sha256-TsfZtq8L/FD0DsOW4T2i8BSYNq4jvqLJyOSPdrWGPq8=";
|
||||
vendorHash = "sha256-uZFwiYTkx9TE6T0UJ+EUF8zqP4/8vWYoN+frD6KvQC0=";
|
||||
|
||||
doCheck = false;
|
||||
|
||||
postInstall = ''
|
||||
mv $out/bin/{src,process-compose}
|
||||
|
||||
installShellCompletion --cmd process-compose \
|
||||
--bash <($out/bin/process-compose completion bash) \
|
||||
--zsh <($out/bin/process-compose completion zsh) \
|
||||
|
||||
@@ -54,11 +54,11 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "qmmp";
|
||||
version = "2.3.0";
|
||||
version = "2.3.1";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://qmmp.ylsoftware.com/files/qmmp/2.3/qmmp-${finalAttrs.version}.tar.bz2";
|
||||
hash = "sha256-AcPjA2fIhReM0RVZTSD2lKR6NS/X5l/PVyLhKsgzMGM=";
|
||||
hash = "sha256-ph0cH6qcQRx1KSpXEJmRgrkYgxuPDyAMhxSeP/NTvqk=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
|
||||
@@ -8,11 +8,11 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "quarkus-cli";
|
||||
version = "3.30.2";
|
||||
version = "3.30.4";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
|
||||
hash = "sha256-1iHzvgw4xSJPldeRI50rLO/b1YVk8NuSdnU9atG0VRA=";
|
||||
hash = "sha256-0EDFWcv3IujCxmBbqPTgFOGdv977pWgx8ujO2NZ5EJQ=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
{
|
||||
lib,
|
||||
blueprint-compiler,
|
||||
meson,
|
||||
ninja,
|
||||
fetchFromGitHub,
|
||||
python3Packages,
|
||||
wrapGAppsHook4,
|
||||
gobject-introspection,
|
||||
pkg-config,
|
||||
gtk4,
|
||||
webkitgtk_6_0,
|
||||
glib,
|
||||
libadwaita,
|
||||
libzim,
|
||||
}:
|
||||
|
||||
python3Packages.buildPythonApplication rec {
|
||||
pname = "slobdict";
|
||||
version = "1.0.0";
|
||||
|
||||
pyproject = false; # built with meson
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "MuntashirAkon";
|
||||
repo = "SlobDict";
|
||||
tag = version;
|
||||
hash = "sha256-V6EmEpxUMZUN9lHSNs4nZBZI2QNxUUWWODukm01lYxY=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
blueprint-compiler
|
||||
gobject-introspection
|
||||
meson
|
||||
ninja
|
||||
pkg-config
|
||||
wrapGAppsHook4
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
gtk4
|
||||
glib
|
||||
libadwaita
|
||||
libzim
|
||||
webkitgtk_6_0
|
||||
];
|
||||
|
||||
dependencies = with python3Packages; [
|
||||
pygobject3
|
||||
pyglossary
|
||||
|
||||
# Optional deps of pyglossary
|
||||
pyyaml
|
||||
beautifulsoup4
|
||||
biplist
|
||||
# colorize-pinyin not packaged
|
||||
html5lib
|
||||
marisa-trie
|
||||
mistune
|
||||
polib
|
||||
prompt-toolkit
|
||||
pymorphy3
|
||||
# python-romkan-ng not packaged
|
||||
xxhash
|
||||
];
|
||||
|
||||
# Prevent double wrapping, let the Python wrapper use the args in preFixup.
|
||||
dontWrapGApps = true;
|
||||
|
||||
postInstall = ''
|
||||
chmod +x $out/bin/slobdict
|
||||
'';
|
||||
|
||||
preFixup = ''
|
||||
makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
|
||||
'';
|
||||
|
||||
strictDeps = true;
|
||||
|
||||
meta = {
|
||||
homepage = "https://github.com/MuntashirAkon/SlobDict";
|
||||
description = "Modern, lightweight GTK 4 dictionary app";
|
||||
mainProgram = "slobdict";
|
||||
maintainers = with lib.maintainers; [ linsui ];
|
||||
license = lib.licenses.agpl3Plus;
|
||||
platforms = lib.platforms.linux;
|
||||
};
|
||||
}
|
||||
@@ -2,6 +2,7 @@
|
||||
lib,
|
||||
stdenv,
|
||||
fetchurl,
|
||||
fetchpatch,
|
||||
fetchDebianPatch,
|
||||
glib,
|
||||
pkg-config,
|
||||
@@ -34,6 +35,13 @@ stdenv.mkDerivation rec {
|
||||
patch = "873964-http";
|
||||
hash = "sha256-D6koUCbnJHtRuq2zZy9VrxymuGXN1COacbQhphgB8qo=";
|
||||
})
|
||||
# fix SR_ERROR_INVALID_METADATA caused by HTTP chunking
|
||||
# (https://sourceforge.net/p/streamripper/bugs/193/#6a82)
|
||||
(fetchpatch {
|
||||
name = "streamripper-http-1.0.patch";
|
||||
url = "https://sourceforge.net/p/streamripper/bugs/_discuss/thread/df13e77a/6a82/attachment/streamripper-http-1.0.patch";
|
||||
hash = "sha256-EhkxAqMcRJ4IJ6BLrpSQu6FomfEbxvgAu12vaDdNqEU=";
|
||||
})
|
||||
];
|
||||
|
||||
nativeBuildInputs = [ pkg-config ];
|
||||
|
||||
@@ -8,14 +8,14 @@
|
||||
|
||||
python3Packages.buildPythonApplication rec {
|
||||
pname = "tclint";
|
||||
version = "0.6.2";
|
||||
version = "0.7.0";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "nmoroze";
|
||||
repo = "tclint";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-z0ytMK3xxqXZJTMuY2wiBFo8LXAUZZBb13kr/kXtyjI=";
|
||||
hash = "sha256-GkWQlOmPh/IpkdcNKkaHJoVDD2r5wCSFeMZA96dxiXM=";
|
||||
};
|
||||
|
||||
build-system = with python3Packages; [
|
||||
|
||||
@@ -7,13 +7,13 @@
|
||||
}:
|
||||
buildDotnetModule rec {
|
||||
pname = "technitium-dns-server-library";
|
||||
version = "dns-server-v14.2.0";
|
||||
version = "14.3.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "TechnitiumSoftware";
|
||||
repo = "TechnitiumLibrary";
|
||||
tag = version;
|
||||
hash = "sha256-a5gCwOxBlp+MzcxrYWY56ihb2ayC/l9G3SQ31ZVpBZc=";
|
||||
tag = "dns-server-v${version}";
|
||||
hash = "sha256-Z8qGp9zMsmPNroO2cS7t7A4lwQ7pnGdzCAcCCEYoXrE=";
|
||||
name = "${pname}-${version}";
|
||||
};
|
||||
|
||||
|
||||
@@ -10,13 +10,13 @@
|
||||
}:
|
||||
buildDotnetModule rec {
|
||||
pname = "technitium-dns-server";
|
||||
version = "14.2.0";
|
||||
version = "14.3.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "TechnitiumSoftware";
|
||||
repo = "DnsServer";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-zLm6uEC8BoaDfyzmLErJTOzzSKxrmb0j3VhEcsyizI4=";
|
||||
hash = "sha256-NUH1gn8kdtMBKC5+XEqqTGySNMCDFGF5yy6NbGeRvvY=";
|
||||
name = "${pname}-${version}";
|
||||
};
|
||||
|
||||
|
||||
@@ -69,18 +69,20 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
--set UCM_WEB_UI "$out/ui"
|
||||
'';
|
||||
|
||||
passthru.updateScript = ./update.sh;
|
||||
|
||||
meta = {
|
||||
description = "Modern, statically-typed purely functional language";
|
||||
homepage = "https://unisonweb.org/";
|
||||
license = with lib.licenses; [
|
||||
mit
|
||||
bsd3
|
||||
license = [
|
||||
lib.licenses.mit
|
||||
lib.licenses.bsd3
|
||||
];
|
||||
mainProgram = "ucm";
|
||||
maintainers = with lib.maintainers; [
|
||||
ceedubs
|
||||
sellout
|
||||
virusdave
|
||||
maintainers = [
|
||||
lib.maintainers.ceedubs
|
||||
lib.maintainers.sellout
|
||||
lib.maintainers.virusdave
|
||||
];
|
||||
platforms = [
|
||||
"x86_64-darwin"
|
||||
@@ -88,6 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
"aarch64-darwin"
|
||||
"aarch64-linux"
|
||||
];
|
||||
sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
|
||||
sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
|
||||
};
|
||||
})
|
||||
|
||||
Executable
+49
@@ -0,0 +1,49 @@
|
||||
#!/usr/bin/env nix-shell
|
||||
#!nix-shell -i bash -p curl jq gnused nix
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "${BASH_SOURCE[0]}")"
|
||||
|
||||
owner="unisonweb"
|
||||
repo="unison"
|
||||
pname="unison-ucm"
|
||||
|
||||
# Fetch latest version
|
||||
latest_tag=$(curl -s "https://api.github.com/repos/$owner/$repo/releases/latest" | jq -r .tag_name)
|
||||
version=${latest_tag#release/}
|
||||
|
||||
current_version=$(sed -nE 's/\s*version = "(.*)";/\1/p' package.nix)
|
||||
|
||||
if [[ "$version" == "$current_version" ]]; then
|
||||
echo "$pname is already up-to-date"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Updating $pname from $current_version to $version"
|
||||
|
||||
# Update version in the file
|
||||
sed -i "s/version = \"$current_version\";/version = \"$version\";/" package.nix
|
||||
|
||||
# Define platforms and their corresponding URL suffixes
|
||||
declare -A platforms=(
|
||||
["aarch64-darwin"]="ucm-macos-arm64.tar.gz"
|
||||
["x86_64-darwin"]="ucm-macos-x64.tar.gz"
|
||||
["aarch64-linux"]="ucm-linux-arm64.tar.gz"
|
||||
["x86_64-linux"]="ucm-linux-x64.tar.gz"
|
||||
)
|
||||
|
||||
for platform in "${!platforms[@]}"; do
|
||||
filename="${platforms[$platform]}"
|
||||
url="https://github.com/$owner/$repo/releases/download/release/$version/$filename"
|
||||
|
||||
echo "Prefetching $url for $platform..."
|
||||
hash=$(nix-prefetch-url "$url" --type sha256)
|
||||
sri_hash=$(nix hash convert --hash-algo sha256 --to sri "$hash")
|
||||
|
||||
# Replace the hash for the specific platform
|
||||
# We look for the platform key, then the next hash line
|
||||
sed -i "/$platform = fetchurl/,/hash =/ s|hash = \".*\";|hash = \"$sri_hash\";|" package.nix
|
||||
done
|
||||
|
||||
echo "Update complete."
|
||||
@@ -5,7 +5,7 @@
|
||||
}:
|
||||
|
||||
let
|
||||
version = "0.12.0";
|
||||
version = "0.12.1";
|
||||
in
|
||||
python3Packages.buildPythonApplication {
|
||||
pname = "whatsapp-chat-exporter";
|
||||
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication {
|
||||
owner = "KnugiHK";
|
||||
repo = "Whatsapp-Chat-Exporter";
|
||||
tag = version;
|
||||
hash = "sha256-0FJZqqmuSA+te5lzi1okkmuT3s2JNX7uHoYl9ayNt/Q=";
|
||||
hash = "sha256-AyxRIjcAGjxCe0m2cSESQWd75v5tzpsCmb+3wChbH7c=";
|
||||
};
|
||||
|
||||
propagatedBuildInputs = with python3Packages; [
|
||||
|
||||
@@ -67,9 +67,10 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
cp -r $src/docs/* $out/usr/share/docs
|
||||
|
||||
mkdir -p $out/usr/share/zapret/{common,ipset}
|
||||
mkdir -p $out/usr/share/zapret/{common,files/fake,ipset}
|
||||
|
||||
cp $src/common/* $out/usr/share/zapret/common
|
||||
cp $src/files/fake/* $out/usr/share/zapret/files/fake
|
||||
cp $src/ipset/* $out/usr/share/zapret/ipset
|
||||
|
||||
rm -f $out/usr/share/zapret/ipset/zapret-hosts-user-exclude.txt.default
|
||||
|
||||
@@ -8,13 +8,13 @@
|
||||
|
||||
buildPecl rec {
|
||||
pname = "luasandbox";
|
||||
version = "4.1.2";
|
||||
version = "4.1.3";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "wikimedia";
|
||||
repo = "mediawiki-php-luasandbox";
|
||||
tag = version;
|
||||
hash = "sha256-HWObytoHBvxF9+QC62yJfi6MuHOOXFbSNkhuz5zWPCY=";
|
||||
hash = "sha256-YQ7mxrAjtpYCThy0UPHlB0bkf86qpKqXxH4XV0hB+YU=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ pkg-config ];
|
||||
|
||||
@@ -8,14 +8,14 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "iamdata";
|
||||
version = "0.1.202512211";
|
||||
version = "0.1.202512221";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "cloud-copilot";
|
||||
repo = "iam-data-python";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-1gJoVSRbSjUOcRBKlW59S79aNYvuP6dy6377XT/wlFA=";
|
||||
hash = "sha256-IEFEynR5gLS9kdIMlytK1XKOawsnxsT+vWvLGZ6yd5g=";
|
||||
};
|
||||
|
||||
__darwinAllowLocalNetworking = true;
|
||||
|
||||
@@ -23,14 +23,14 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "jupyter-collaboration";
|
||||
version = "4.1.2";
|
||||
version = "4.2.0";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "jupyterlab";
|
||||
repo = "jupyter-collaboration";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-/NFx76jqByPhzFKYFIcVctJv9+WQeuoUQaqNt+tUs8o=";
|
||||
hash = "sha256-KXD5RRRh8cwZWZUpJrkS7RAfaeTjAHajKLl8c5MuhrA=";
|
||||
};
|
||||
|
||||
sourceRoot = "${src.name}/projects/jupyter-collaboration";
|
||||
|
||||
@@ -8,14 +8,14 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "oelint-data";
|
||||
version = "1.2.9";
|
||||
version = "1.2.10";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "priv-kweihmann";
|
||||
repo = "oelint-data";
|
||||
tag = version;
|
||||
hash = "sha256-1BIW76qK4w1B5yAhmi3OJxLr+ctOAmjqBKuh6UKyCXM=";
|
||||
hash = "sha256-9SxIslA/gfIe1lboWuK5/Ya7trMhVJokf7X3P0XyELE=";
|
||||
};
|
||||
|
||||
build-system = [
|
||||
|
||||
@@ -27,7 +27,7 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "pypdf";
|
||||
version = "6.4.0";
|
||||
version = "6.4.2";
|
||||
pyproject = true;
|
||||
|
||||
disabled = pythonOlder "3.8";
|
||||
@@ -38,7 +38,7 @@ buildPythonPackage rec {
|
||||
tag = version;
|
||||
# fetch sample files used in tests
|
||||
fetchSubmodules = true;
|
||||
hash = "sha256-QCMOB0qnxVPo8fGcf+TsEcBYYINXVbDCowrLUqNjojw=";
|
||||
hash = "sha256-GkCNw7XvDPvLIiIUAgXsTLQ2OBbqhpf3xHQZpB/f2ys=";
|
||||
};
|
||||
|
||||
outputs = [
|
||||
|
||||
@@ -19,14 +19,14 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "renault-api";
|
||||
version = "0.5.1";
|
||||
version = "0.5.2";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "hacf-fr";
|
||||
repo = "renault-api";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-FH6x+hknNGgrSHaOt7RTYeuVLqb/DNy7X3065VvcFwA=";
|
||||
hash = "sha256-7ZvUg2Dgu9hSG1VXDT+YC6PBbylsR4d12ZR66UrPlyE=";
|
||||
};
|
||||
|
||||
build-system = [ poetry-core ];
|
||||
|
||||
@@ -9,14 +9,14 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "tencentcloud-sdk-python";
|
||||
version = "3.1.15";
|
||||
version = "3.1.16";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "TencentCloud";
|
||||
repo = "tencentcloud-sdk-python";
|
||||
tag = version;
|
||||
hash = "sha256-Q8AwLuS9+5j0EDQCHNpBJBaM3leHynwFGkBPOkzAh/g=";
|
||||
hash = "sha256-DtYEBRKd3qH+ZJMWTALcVlRPBMs6mhr5fgxyTvdOofo=";
|
||||
};
|
||||
|
||||
build-system = [ setuptools ];
|
||||
|
||||
@@ -16,14 +16,14 @@
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "velbus-aio";
|
||||
version = "2025.11.0";
|
||||
version = "2025.12.0";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "Cereal2nd";
|
||||
repo = "velbus-aio";
|
||||
tag = version;
|
||||
hash = "sha256-/sceaihRNMebcdQzNuZdH9uPibaG7UjvSP50kJ85L+Q=";
|
||||
hash = "sha256-DmS5XvYUXGYLQWoXNlqsQ4tFsdWMqiJhHYokbuZT67c=";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -4,25 +4,25 @@
|
||||
fetchFromGitHub,
|
||||
pytest-asyncio,
|
||||
pytestCheckHook,
|
||||
pythonOlder,
|
||||
httpx,
|
||||
setuptools,
|
||||
}:
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "whodap";
|
||||
version = "0.1.13";
|
||||
format = "setuptools";
|
||||
|
||||
disabled = pythonOlder "3.8";
|
||||
version = "0.1.14";
|
||||
pyproject = true;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "pogzyb";
|
||||
repo = "whodap";
|
||||
tag = version;
|
||||
tag = "v${version}";
|
||||
hash = "sha256-VSFtHjdG9pJAryGUgwI0NxxaW0JiXEHU7aVvXYxymtc=";
|
||||
};
|
||||
|
||||
propagatedBuildInputs = [ httpx ];
|
||||
build-system = [ setuptools ];
|
||||
|
||||
dependencies = [ httpx ];
|
||||
|
||||
nativeCheckInputs = [
|
||||
pytest-asyncio
|
||||
@@ -40,7 +40,7 @@ buildPythonPackage rec {
|
||||
description = "Python RDAP utility for querying and parsing information about domain names";
|
||||
homepage = "https://github.com/pogzyb/whodap";
|
||||
changelog = "https://github.com/pogzyb/whodap/releases/tag/${src.tag}";
|
||||
license = with lib.licenses; [ mit ];
|
||||
license = lib.licenses.mit;
|
||||
maintainers = with lib.maintainers; [ fab ];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -17,13 +17,13 @@ let
|
||||
in
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "evdi";
|
||||
version = "1.14.11";
|
||||
version = "1.14.12";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "DisplayLink";
|
||||
repo = "evdi";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-SxYUhu76vwgCQgjOYVpvdWsFpNcyzuSjZe3x/v566VU=";
|
||||
hash = "sha256-J5unC9KTnbwTlBMi/sCAyxD3R18vb9bHK1NPU/0NHwM=";
|
||||
};
|
||||
|
||||
prePatch = ''
|
||||
|
||||
+3
-3
@@ -6,18 +6,18 @@
|
||||
|
||||
buildNpmPackage rec {
|
||||
pname = "universal-remote-card";
|
||||
version = "4.9.2";
|
||||
version = "4.9.3";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "Nerwyn";
|
||||
repo = "android-tv-card";
|
||||
rev = version;
|
||||
hash = "sha256-ifFs+C42i8Iq1CLJIgJ1MRyNzVczDSAur2NJNWMjQSc=";
|
||||
hash = "sha256-Xy2qtck1ZrB5y4SPkWC/JrSsoZciBdI7rm2HdakHu3I=";
|
||||
};
|
||||
|
||||
patches = [ ./dont-call-git.patch ];
|
||||
|
||||
npmDepsHash = "sha256-4RpBYUBlKqogaiibbiUGK1pS3ZN5h9teKjqFJPMJiIY=";
|
||||
npmDepsHash = "sha256-Js9HlQOQUFDU2wIe9JdXqkcKlsAgoE8/d74Zw+9iyN4=";
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
@@ -814,6 +814,7 @@ mapAliases {
|
||||
kube3d = throw "'kube3d' has been renamed to/replaced by 'k3d'"; # Converted to throw 2025-10-27
|
||||
kubei = throw "'kubei' has been renamed to/replaced by 'kubeclarity'"; # Converted to throw 2025-10-27
|
||||
kubo-migrator-all-fs-repo-migrations = throw "'kubo-migrator-all-fs-repo-migrations' has been renamed to/replaced by 'kubo-fs-repo-migrations'"; # Converted to throw 2025-10-27
|
||||
kwm = throw "'kwm' has been removed since upstream is a 404"; # Added 2025-12-21
|
||||
languageMachines.frog = frog; # Added 2025-10-7
|
||||
languageMachines.frogdata = frogdata; # Added 2025-10-7
|
||||
languageMachines.libfolia = libfolia; # Added 2025-10-7
|
||||
|
||||
Reference in New Issue
Block a user