nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-11-05 04:10:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Backport release-26.05] nixos/radicle: use cfg.package to check config (#570280)

Browse Source
This commit is contained in:
Felix Bargfeldt
2026-10-04 21:51:49 +00:00
committed by GitHub
parent eea2f4cba1 d90dd7bace
commit dec19f2858
1 changed files with 23 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
nixos/modules/services/misc/radicle.nix
View File

@@ -2,9 +2,9 @@
config,
lib,
pkgs,
utils,
...
}:
let
cfg = config.services.radicle;
@@ -21,6 +21,12 @@ let
privateKeyPassphrase = "dev.radicle.node.passphrase";
};
buildPackage =
if pkgs.stdenv.buildPlatform.canExecute pkgs.stdenv.hostPlatform then
cfg.package
else
pkgs.buildPackages.radicle-node;
# Convenient wrapper to run `rad` in the namespaces of `radicle-node.service`
rad-system = pkgs.writeShellScriptBin "rad-system" ''
set -o allexport
@@ -37,19 +43,13 @@ let
environment = env // {
RUST_LOG = lib.mkDefault "info";
};
path = [
pkgs.gitMinimal
];
documentation = [
"https://radicle.dev/guides/seeder"
];
path = [ pkgs.gitMinimal ];
documentation = [ "https://radicle.dev/guides/seeder" ];
after = [
"network.target"
"network-online.target"
];
requires = [
"network-online.target"
];
requires = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = lib.mkMerge [
{
@@ -132,6 +132,7 @@ let
};
};
in
{
options = {
services.radicle = {
@@ -208,7 +209,7 @@ in
ln -s $out config.json
install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
export RAD_HOME=$PWD
${lib.getExe' pkgs.buildPackages.radicle-node "rad"} config >/dev/null || {
${lib.getExe' buildPackage "rad"} config >/dev/null || {
cat -n config.json
echo "Invalid config.json according to rad."
echo "Please double-check your services.radicle.settings (producing the config.json above),"
@@ -236,9 +237,7 @@ in
];
}
'';
type = lib.types.submodule {
freeformType = json.type;
};
type = lib.types.submodule { freeformType = json.type; };
};
httpd = {
enable = lib.mkEnableOption "Radicle HTTP gateway to radicle-node";
@@ -321,46 +320,30 @@ in
"@timer"
];
};
confinement.packages = [
cfg.package
];
confinement.packages = [ cfg.package ];
}
# Give only access to the private key to radicle-node.
{
serviceConfig =
if cfg.privateKey == null then
{
ImportCredential = [ credentials.privateKey ];
}
{ ImportCredential = [ credentials.privateKey ]; }
else if lib.types.path.check cfg.privateKey then
{
LoadCredential = [ "${credentials.privateKey}:${cfg.privateKey}" ];
}
{ LoadCredential = [ "${credentials.privateKey}:${cfg.privateKey}" ]; }
else
{
ImportCredential = [ "${cfg.privateKey}:${credentials.privateKey}" ];
};
{ ImportCredential = [ "${cfg.privateKey}:${credentials.privateKey}" ]; };
}
{
serviceConfig =
if cfg.privateKeyPassphrase == null then
{
ImportCredential = [ credentials.privateKeyPassphrase ];
}
{ ImportCredential = [ credentials.privateKeyPassphrase ]; }
else
{
ImportCredential = [ "${cfg.privateKeyPassphrase}:${credentials.privateKeyPassphrase}" ];
};
{ ImportCredential = [ "${cfg.privateKeyPassphrase}:${credentials.privateKeyPassphrase}" ]; };
}
];
environment.systemPackages = [
rad-system
];
environment.systemPackages = [ rad-system ];
networking.firewall = lib.mkIf cfg.node.openFirewall {
allowedTCPPorts = [ cfg.node.listenPort ];
};
networking.firewall = lib.mkIf cfg.node.openFirewall { allowedTCPPorts = [ cfg.node.listenPort ]; };
users = {
users.radicle = {
@@ -369,8 +352,7 @@ in
home = env.HOME;
isSystemUser = true;
};
groups.radicle = {
};
groups.radicle = { };
};
}
@@ -405,9 +387,7 @@ in
"@timer"
];
};
confinement.packages = [
cfg.httpd.package
];
confinement.packages = [ cfg.httpd.package ];
}
];
}