tensamin/iota
Watch
6
0
Fork
You've already forked iota
 0
Code Issues Pull requests 3 Projects Releases 1 Packages Wiki Activity Actions

Wire production daemon settings in NixOS module

Browse source
This commit is contained in:
Alois 2026-09-20 12:39:57 +02:00
commit 577660884c
Signed by: alois
SSH key fingerprint: SHA256:GBzT2DXvAuGV9XIV5W3WrzVpjU54FThmxHXdbz95J24
1 changed files with 285 additions and 189 deletions
Download patch file Download diff file Expand all files Collapse all files

468
flake.nix
View file

@ -14,14 +14,15 @@
}; };
}; };
outputs = inputs @ { outputs =
self, inputs@{
nixpkgs, self,
flake-parts, nixpkgs,
rust-overlay, flake-parts,
... rust-overlay,
}: ...
flake-parts.lib.mkFlake {inherit inputs;} { }:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ systems = [
"x86_64-linux" "x86_64-linux"
"aarch64-linux" "aarch64-linux"
@ -29,197 +30,278 @@
"aarch64-darwin" "aarch64-darwin"
]; ];
perSystem = { perSystem =
self', {
pkgs, self',
system, pkgs,
... system,
}: let ...
rustPkgs = import nixpkgs { }:
inherit system; let
overlays = [(import rust-overlay)]; rustPkgs = import nixpkgs {
}; inherit system;
rustToolchain = rustPkgs.rust-bin.stable.latest.default.override { overlays = [ (import rust-overlay) ];
extensions = ["rust-src" "rust-analyzer" "clippy" "rustfmt"]; };
}; rustToolchain = rustPkgs.rust-bin.stable.latest.default.override {
commonBuildInputs = with pkgs; [openssl sqlite]; extensions = [
commonNativeBuildInputs = with pkgs; [cmake perl pkg-config]; "rust-src"
in { "rust-analyzer"
packages = { "clippy"
default = pkgs.rustPlatform.buildRustPackage { "rustfmt"
pname = "iota";
version = "0.1.0";
src = ./.;
cargoBuildFlags = [
"-p"
"iota"
"-p"
"iota-daemon"
"-p"
"iota-updater"
"-p"
"iota-installer"
]; ];
cargoLock = { };
lockFile = ./Cargo.lock; commonBuildInputs = with pkgs; [
allowBuiltinFetchGit = true; openssl
sqlite
];
commonNativeBuildInputs = with pkgs; [
cmake
perl
pkg-config
];
in
{
packages = {
default = pkgs.rustPlatform.buildRustPackage {
pname = "iota";
version = "0.1.0";
src = ./.;
cargoBuildFlags = [
"-p"
"iota"
"-p"
"iota-daemon"
"-p"
"iota-updater"
"-p"
"iota-installer"
];
cargoLock = {
lockFile = ./Cargo.lock;
allowBuiltinFetchGit = true;
};
nativeBuildInputs = commonNativeBuildInputs;
buildInputs = commonBuildInputs;
dontUseCmakeConfigure = true;
MTP_TYPE_MAPS = "${inputs.mtp-type-maps}/type-maps.yaml";
passthru.dataDir = "/var/lib/iota";
}; };
nativeBuildInputs = commonNativeBuildInputs;
buildInputs = commonBuildInputs; iota-daemon = self'.packages.default.overrideAttrs (old: {
dontUseCmakeConfigure = true; pname = "iota-daemon";
MTP_TYPE_MAPS = "${inputs.mtp-type-maps}/type-maps.yaml"; cargoBuildFlags = [
passthru.dataDir = "/var/lib/iota"; "-p"
"iota-daemon"
];
postInstall = ''
for f in $out/bin/*; do
if [ "$(basename "$f")" != "iota-daemon" ]; then
rm "$f"
fi
done
'';
});
iota-ui = self'.packages.default.overrideAttrs (old: {
pname = "iota-ui";
cargoBuildFlags = [
"-p"
"iota"
];
postInstall = ''
for f in $out/bin/*; do
if [ "$(basename "$f")" != "iota" ]; then
rm "$f"
fi
done
if [ -f "$out/bin/iota" ]; then
mv "$out/bin/iota" "$out/bin/iota-ui"
fi
'';
});
}; };
iota-daemon = self'.packages.default.overrideAttrs (old: { devShells.default = pkgs.mkShell {
pname = "iota-daemon"; nativeBuildInputs = with pkgs; [
cargoBuildFlags = ["-p" "iota-daemon"]; rustToolchain
postInstall = '' git
for f in $out/bin/*; do cmake
if [ "$(basename "$f")" != "iota-daemon" ]; then perl
rm "$f" pkg-config
fi ];
done buildInputs = commonBuildInputs;
''; };
});
iota-ui = self'.packages.default.overrideAttrs (old: {
pname = "iota-ui";
cargoBuildFlags = ["-p" "iota"];
postInstall = ''
for f in $out/bin/*; do
if [ "$(basename "$f")" != "iota" ]; then
rm "$f"
fi
done
if [ -f "$out/bin/iota" ]; then
mv "$out/bin/iota" "$out/bin/iota-ui"
fi
'';
});
}; };
devShells.default = pkgs.mkShell {
nativeBuildInputs = with pkgs; [rustToolchain git cmake perl pkg-config];
buildInputs = commonBuildInputs;
};
};
flake = { flake = {
nixosModules.default = { nixosModules.default =
config, {
pkgs, config,
lib, pkgs,
... lib,
}: let ...
cfg = config.services.iota; }:
defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}"); let
cfg = config.services.iota;
defaultPackage =
self.packages.${pkgs.stdenv.hostPlatform.system}.default
or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}");
configFormat = pkgs.formats.yaml {}; configFormat = pkgs.formats.yaml { };
configFile = effectiveSettings = lib.recursiveUpdate {
if cfg.settingsFile != null port = cfg.port;
then cfg.settingsFile web = {
else configFormat.generate "iota-config.yaml" cfg.settings; mode = "network";
bind = cfg.bindAddress;
port = cfg.port;
required = true;
}
// lib.optionalAttrs (cfg.certFile != null) {
certificate = "${cfg.stateDir}/tls/cert.pem";
key = "${cfg.stateDir}/tls/key.pem";
};
} cfg.settings;
configFile =
if cfg.settingsFile != null then
cfg.settingsFile
else
configFormat.generate "iota-config.yaml" effectiveSettings;
descriptionText = "Tensamin Iota daemon"; descriptionText = "Tensamin Iota daemon";
in { in
options.services.iota = { {
enable = lib.mkEnableOption "Enable the Iota service."; options.services.iota = {
enable = lib.mkEnableOption "Enable the Iota service.";
stateDir = lib.mkOption { stateDir = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "/var/lib/iota"; default = "/var/lib/iota";
description = "Persistent mutable Iota state."; description = "Persistent mutable Iota state.";
}; };
cacheDir = lib.mkOption { type = lib.types.str; default = "/var/cache/iota"; }; cacheDir = lib.mkOption {
runtimeDir = lib.mkOption { type = lib.types.str; default = "/run/iota"; }; type = lib.types.str;
logDir = lib.mkOption { type = lib.types.str; default = "/var/log/iota"; }; default = "/var/cache/iota";
assetDir = lib.mkOption { type = lib.types.str; default = "${cfg.package}/share/iota/web"; }; };
runtimeDir = lib.mkOption {
type = lib.types.str;
default = "/run/iota";
};
logDir = lib.mkOption {
type = lib.types.str;
default = "/var/log/iota";
};
assetDir = lib.mkOption {
type = lib.types.str;
default = "${cfg.package}/share/iota/web";
};
certFile = lib.mkOption { certFile = lib.mkOption {
type = lib.types.nullOr lib.types.path; type = lib.types.nullOr lib.types.str;
default = null; default = null;
description = "Path to the SSL certificate file (cert.pem)."; description = "Path to the SSL certificate file (cert.pem).";
}; };
keyFile = lib.mkOption { keyFile = lib.mkOption {
type = lib.types.nullOr lib.types.path; type = lib.types.nullOr lib.types.str;
default = null; default = null;
description = "Path to the SSL private key file (cert.key)."; description = "Path to the SSL private key file (cert.key).";
}; };
environmentFiles = lib.mkOption { environmentFiles = lib.mkOption {
type = lib.types.listOf lib.types.path; type = lib.types.listOf lib.types.str;
default = []; default = [ ];
description = "Environment files to load for the Iota service."; description = "Environment files to load for the Iota service.";
}; };
openFirewall = lib.mkOption { openFirewall = lib.mkOption {
type = lib.types.bool; type = lib.types.bool;
default = true; default = true;
description = "Whether to open the firewall for ports used by Iota."; description = "Whether to open the firewall for ports used by Iota.";
}; };
bindAddress = lib.mkOption { bindAddress = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "0.0.0.0"; default = "0.0.0.0";
description = "IP address to bind the HTTP server to."; description = "IP address to bind the HTTP server to.";
}; };
package = lib.mkOption { port = lib.mkOption {
type = lib.types.package; type = lib.types.port;
default = defaultPackage; default = 1984;
description = "The Iota package to use."; description = "TCP and UDP port for protocol-only Iota.";
}; };
settings = lib.mkOption { omegaApiUrl = lib.mkOption {
type = lib.types.attrs; type = lib.types.str;
default = {}; default = "https://omega.tensamin.net";
description = "Configuration attributes for Iota, written to YAML."; description = "Omega discovery API URL.";
}; };
settingsFile = lib.mkOption { package = lib.mkOption {
type = lib.types.nullOr lib.types.path; type = lib.types.package;
default = null; default = defaultPackage;
description = "Path to an existing YAML file to use instead of generating from settings."; description = "The Iota package to use.";
}; };
};
config = lib.mkIf cfg.enable { settings = lib.mkOption {
users.users.iota = { type = lib.types.attrs;
isSystemUser = true; default = { };
group = "iota"; description = "Configuration attributes for Iota, written to YAML.";
home = cfg.stateDir; };
createHome = true;
description = "Iota service user";
shell = pkgs.bash;
};
users.groups.iota = {}; settingsFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
systemd.sockets.iota = { default = null;
description = "${descriptionText} IPC socket"; description = "Path to an existing YAML file to use instead of generating from settings.";
wantedBy = ["sockets.target"];
socketConfig = {
ListenStream = "/run/iota/iota.sock";
SocketMode = "0660";
SocketUser = "iota";
SocketGroup = "iota";
DirectoryMode = "0750";
Backlog = 5;
RemoveOnStop = "true";
NonBlocking = true;
}; };
}; };
systemd.services.iota = { config = lib.mkIf cfg.enable {
description = descriptionText; assertions = [
wantedBy = ["multi-user.target"];
after = ["network.target" "iota.socket"];
requires = ["iota.socket"];
serviceConfig =
{ {
assertion = (cfg.certFile == null) == (cfg.keyFile == null);
message = "services.iota: certFile and keyFile must be set together.";
}
];
users.users.iota = {
isSystemUser = true;
group = "iota";
home = cfg.stateDir;
createHome = true;
description = "Iota service user";
shell = pkgs.bash;
};
users.groups.iota = { };
systemd.sockets.iota = {
description = "${descriptionText} IPC socket";
wantedBy = [ "sockets.target" ];
socketConfig = {
ListenStream = "/run/iota/iota.sock";
SocketMode = "0660";
SocketUser = "iota";
SocketGroup = "iota";
DirectoryMode = "0750";
Backlog = 5;
RemoveOnStop = "true";
NonBlocking = true;
};
};
systemd.services.iota = {
description = descriptionText;
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"iota.socket"
];
requires = [ "iota.socket" ];
environment.OMEGA_API_URL = cfg.omegaApiUrl;
serviceConfig = {
Type = "simple"; Type = "simple";
User = "iota"; User = "iota";
Group = "iota"; Group = "iota";
@ -244,15 +326,23 @@
KillMode = "mixed"; KillMode = "mixed";
KillSignal = "SIGTERM"; KillSignal = "SIGTERM";
AmbientCapabilities = ["CAP_NET_BIND_SERVICE"]; AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"]; CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
PrivateTmp = true; PrivateTmp = true;
NoNewPrivileges = true; NoNewPrivileges = true;
ReadWritePaths = [cfg.stateDir cfg.cacheDir cfg.runtimeDir cfg.logDir]; ReadWritePaths = [
ReadOnlyPaths = [configFile cfg.assetDir]; cfg.stateDir
cfg.cacheDir
cfg.runtimeDir
cfg.logDir
];
ReadOnlyPaths = [
configFile
cfg.assetDir
];
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectControlGroups = true; ProtectControlGroups = true;
@ -261,7 +351,6 @@
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
Environment = [ Environment = [
"BIND_ADDRESS=${cfg.bindAddress}"
"IOTA_SOCKET=/run/iota/iota.sock" "IOTA_SOCKET=/run/iota/iota.sock"
"IOTA_CONFIG_FILE=${configFile}" "IOTA_CONFIG_FILE=${configFile}"
"IOTA_STATE_DIR=${cfg.stateDir}" "IOTA_STATE_DIR=${cfg.stateDir}"
@ -273,17 +362,24 @@
"IOTA_SUPERVISOR=systemd" "IOTA_SUPERVISOR=systemd"
]; ];
} }
// lib.optionalAttrs (cfg.environmentFiles != []) { // lib.optionalAttrs (cfg.certFile != null) {
ExecStartPre = "+${pkgs.writeShellScript "iota-setup-tls" ''
install -d -m 0700 -o iota -g iota ${cfg.stateDir}/tls
install -m 0644 -o iota -g iota ${cfg.certFile} ${cfg.stateDir}/tls/cert.pem
install -m 0600 -o iota -g iota ${cfg.keyFile} ${cfg.stateDir}/tls/key.pem
''}";
}
// lib.optionalAttrs (cfg.environmentFiles != [ ]) {
EnvironmentFile = cfg.environmentFiles; EnvironmentFile = cfg.environmentFiles;
}; };
}; };
networking.firewall = lib.mkIf cfg.openFirewall { networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [1984]; allowedTCPPorts = [ cfg.port ];
allowedUDPPorts = [1984]; allowedUDPPorts = [ cfg.port ];
};
}; };
}; };
};
}; };
}; };
} }