forked from nix-community/nixos-anywhere
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
DRAFT: terraform: add
var.content, see nix-community#413.
This PR adds a Terraform input variable named `content`. This allows passing in a string from Terraform to expose to NixOS's run-time to make available as a file (default: `/etc/nixos-vars.json`) as suggested by @Mic92 at nix-community#414. This third implementation wraps the original `lib.nixosSystem` call to allow passing info without either use of `--impure` or having to stage to Git. Example usage: ```nix let servers = ...; variable = ...; data = ...; resource = ...; in { inherit variable data resource; module = lib.mapAttrs (server_name: _server_config: let in { # pin module version by nix flake inputs source = "github.com/numtide/nixos-anywhere?ref=${inputs.nixos-anywhere.sourceInfo.rev}/terraform/all-in-one"; ... special_args = lib.tfRef "jsonencode(${lib.strings.toJSON { tf = { inherit server_name; # all variables # var = lib.mapAttrs (k: _: lib.tfRef "jsonencode(var.${k})") variable; # non-sensitive variables var = lib.mapAttrs (k: _: lib.tfRef "var.${k}") (lib.filterAttrs (_k: v: !(v ? sensitive && v.sensitive)) variable); data = lib.mapAttrs (type: instances: lib.mapAttrs (k: _: tfRef "data.${type}.${k}") instances) data; resource = lib.mapAttrs (type: instances: lib.mapAttrs (k: _: tfRef "resource.${type}.${k}") instances) resource; server = lib.tfRef "resource.hcloud_server.${server_name}"; }; }})"; }) servers; } ``` You can then use these in your `nixosConfigurations` thru the `tf` argument. Status: - [ ] resolve occasional NAR hash mismatches - [ ] Test putting the content file into `.gitignore`.
- Loading branch information
1 parent
51d347d
commit f352ca0
Showing
11 changed files
with
152 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,15 +1,40 @@ | ||
| #!/usr/bin/env bash | ||
| set -efu | ||
| set -xefu | ||
|
|
||
| declare file attribute nix_options | ||
| eval "$(jq -r '@sh "attribute=\(.attribute) file=\(.file) nix_options=\(.nix_options)"')" | ||
| options=$(echo "${nix_options}" | jq -r '.options | to_entries | map("--option \(.key) \(.value)") | join(" ")') | ||
| if [[ -n ${file-} ]] && [[ -e ${file-} ]]; then | ||
| declare file attribute nix_options content_file content_nar wrapper_path | ||
| eval "$(jaq -r '@sh "attribute=\(.attribute) file=\(.file) nix_options=\(.nix_options) content_file=\(.content_file) content_nar=\(.content_nar) wrapper_path=\(.wrapper_path)"')" | ||
| if [ "${nix_options}" = '{"options":{}}' ]; then | ||
| options="" | ||
| else | ||
| options=$(echo "${nix_options}" | jaq -r '.options | to_entries | map("--option \(.key) \(.value)") | join(" ")') | ||
| fi | ||
| if [[ -n ${file-} ]] && [[ -e ${file-} ]] && [ "${file}" != "null" ]; then | ||
| # shellcheck disable=SC2086 | ||
| out=$(nix build --no-link --json $options -f "$file" "$attribute") | ||
| printf '%s' "$out" | jq -c '.[].outputs' | ||
| else | ||
| # shellcheck disable=SC2086 | ||
| out=$(nix build --no-link --json $options "$attribute") | ||
| printf '%s' "$out" | jq -c '.[].outputs' | ||
| # flakes want files to be staged to git, which is annoying, so hack around that | ||
| if [[ -n ${content_file-} ]] && [[ -e ${content_file-} ]] && [[ -n ${content_nar-} ]]; then | ||
| # default to saving the content file under the same name | ||
| content_name="$(basename "$content_file")" | ||
| rest="$(echo "${attribute}" | cut -d "#" -f 2)" | ||
| # e.g. config_path=nixosConfigurations.aarch64-linux.combined | ||
| config_path="${rest%.config.*}" | ||
| # e.g. config_attribute=config.system.build.toplevel | ||
| config_attribute="config.${rest#*.config.}" | ||
|
|
||
| # grab flake nar from error message | ||
| flake_rel="$(echo "${attribute}" | cut -d "#" -f 1)" | ||
| flake_dir="$(readlink -f "${flake_rel}")" | ||
| content_file="$(readlink -f "${content_file}")" | ||
| flake_nar="$(nix build --expr "builtins.getFlake ''git+file://${flake_dir}?narHash=sha256-0000000000000000000000000000000000000000000=''" 2>&1 | grep -Po "(?<=got ')sha256-[^']*(?=')")" | ||
| # substitute variables into the template | ||
| nix_expr="$(sed -e "s%\$flake_dir%${flake_dir}%g" -e "s%\$flake_nar%${flake_nar}%g" -e "s%\$content_name%${content_name}%g" -e "s%\$content_file%${content_file}%g" -e "s%\$content_nar%${content_nar}%g" -e "s%\$config_path%${config_path}%g" "${wrapper_path}")" | ||
| # inject content file into nixos config's `/etc/` | ||
| # shellcheck disable=SC2086 | ||
| out=$(nix build --no-link --json ${options} --expr "${nix_expr}" "${config_attribute}") | ||
| else | ||
| # shellcheck disable=SC2086 | ||
| out=$(nix build --no-link --json ${options} "$attribute") | ||
| fi | ||
| fi | ||
| printf '%s' "$out" | jaq -c '.[].outputs' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| let | ||
| cfg = (builtins.getFlake "file://$flake_dir/flake.nix?narHash=$flake_nar").$config_path; | ||
| in cfg.extendModules { | ||
| # pass the content thru fetchTree (over directly passing content) to prevent stack overflows | ||
| specialArgs = builtins.fromJSON (builtins.readFile (builtins.fetchTree { | ||
| type = "file"; | ||
| url = (if (builtins.compareVersions builtins.nixVersion "2.19") == -1 then "" else "file:") + "$content_file"; | ||
| narHash = "$content_nar"; | ||
| }).outPath); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| <!-- BEGIN_TF_DOCS --> | ||
| ## Requirements | ||
|
|
||
| No requirements. | ||
|
|
||
| ## Providers | ||
|
|
||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="provider_external"></a> [external](#provider\_external) | n/a | | ||
|
|
||
| ## Modules | ||
|
|
||
| No modules. | ||
|
|
||
| ## Resources | ||
|
|
||
| | Name | Type | | ||
| |------|------| | ||
| | [external_external.nixos-vars](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external) | data source | | ||
|
|
||
| ## Inputs | ||
|
|
||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | <a name="input_content"></a> [content](#input\_content) | Content to expose to the NixOS build as a file. | `string` | `"{}"` | no | | ||
| | <a name="input_filename"></a> [filename](#input\_filename) | Name of the file to which to dump `content`. Defaults to `nixos-vars.json`. | `string` | `"./nixos-vars.json"` | no | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Name | Description | | ||
| |------|-------------| | ||
| | <a name="output_result"></a> [result](#output\_result) | n/a | | ||
| <!-- END_TF_DOCS --> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| data "external" "nixos-vars" { | ||
| program = [ "${path.module}/nixos-vars.sh" ] | ||
| query = { | ||
| content = var.content | ||
| filename = var.filename | ||
| } | ||
| } | ||
| output "result" { | ||
| value = data.external.nixos-vars.result | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| #!/usr/bin/env bash | ||
| set -efu | ||
|
|
||
| declare content filename | ||
| eval "$(jq -r '@sh "content=\(.content) filename=\(.filename)"')" | ||
|
|
||
| if [ "${content}" != "{}" ]; then | ||
| echo "${content}" > "${filename}" | ||
| nar=$(nix hash path "${filename}") | ||
| else | ||
| nar="" | ||
| fi | ||
| printf "{\"out\":\"%s\"}" "${nar}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| variable "content" { | ||
| type = string | ||
| default = "{}" | ||
| description = "Content to expose to the NixOS build as a file." | ||
| } | ||
|
|
||
| variable "filename" { | ||
| type = string | ||
| default = "./nixos-vars.json" | ||
| description = "Name of the file to which to dump `content`. Defaults to `nixos-vars.json`." | ||
| } |