From 9d67824f28f79306bfd0d8e07af3e7c6f083ef91 Mon Sep 17 00:00:00 2001 From: Alois Date: Mon, 20 Jul 2026 18:56:49 +0200 Subject: [PATCH] [Clean] Remove legacy TTP flake configuration --- flake.lock | 19 +-- flake.nix | 483 +++++++++++++++++++++++++++-------------------------- 2 files changed, 251 insertions(+), 251 deletions(-) diff --git a/flake.lock b/flake.lock index 0d30539..4c197a5 100644 --- a/flake.lock +++ b/flake.lock @@ -53,8 +53,7 @@ "inputs": { "flake-parts": "flake-parts", "nixpkgs": "nixpkgs", - "rust-overlay": "rust-overlay", - "ttp": "ttp" + "rust-overlay": "rust-overlay" } }, "rust-overlay": { @@ -76,22 +75,6 @@ "repo": "rust-overlay", "type": "github" } - }, - "ttp": { - "flake": false, - "locked": { - "lastModified": 1780494955, - "narHash": "sha256-i2VRRF6yNips3c4JHgfvmvMxb0HTkTCn69lmsKZLHRw=", - "ref": "refs/heads/main", - "rev": "23438fa8f884e6ad0d32ca1004c0dedcce0cc8d2", - "revCount": 125, - "type": "git", - "url": "https://git.methanium.net/tensamin/ttp.git" - }, - "original": { - "type": "git", - "url": "https://git.methanium.net/tensamin/ttp.git" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 8cf53d7..f8036f5 100644 --- a/flake.nix +++ b/flake.nix @@ -8,21 +8,17 @@ url = "github:oxalica/rust-overlay"; inputs.nixpkgs.follows = "nixpkgs"; }; - ttp = { - url = "git+https://git.methanium.net/tensamin/ttp.git"; - flake = false; - }; }; - outputs = inputs @ { - self, - nixpkgs, - flake-parts, - rust-overlay, - ttp, - ... - }: - flake-parts.lib.mkFlake {inherit inputs;} { + outputs = + inputs@{ + self, + nixpkgs, + flake-parts, + rust-overlay, + ... + }: + flake-parts.lib.mkFlake { inherit inputs; } { systems = [ "x86_64-linux" "aarch64-linux" @@ -30,253 +26,274 @@ "aarch64-darwin" ]; - perSystem = { - self', - pkgs, - system, - ... - }: let - rustPkgs = import nixpkgs { - inherit system; - overlays = [(import rust-overlay)]; - }; - rustToolchain = rustPkgs.rust-bin.stable.latest.default.override { - extensions = ["rust-src" "rust-analyzer" "clippy" "rustfmt"]; - }; - in { - packages = { - default = self'.packages.iota; - iota = pkgs.rustPlatform.buildRustPackage { - pname = "iota"; - version = "0.1.0"; - src = ./.; - cargoLock = { - lockFile = ./Cargo.lock; - allowBuiltinFetchGit = true; + perSystem = + { + self', + pkgs, + system, + ... + }: + let + rustPkgs = import nixpkgs { + inherit system; + overlays = [ (import rust-overlay) ]; + }; + rustToolchain = rustPkgs.rust-bin.stable.latest.default.override { + extensions = [ + "rust-src" + "rust-analyzer" + "clippy" + "rustfmt" + ]; + }; + in + { + packages = { + default = self'.packages.iota; + iota = pkgs.rustPlatform.buildRustPackage { + pname = "iota"; + version = "0.1.0"; + src = ./.; + cargoLock = { + lockFile = ./Cargo.lock; + allowBuiltinFetchGit = true; + }; + nativeBuildInputs = with pkgs; [ + cmake + perl + pkg-config + ]; + buildInputs = with pkgs; [ + openssl + sqlite + ]; + dontUseCmakeConfigure = true; + postInstall = '' + mv $out/bin/iota-core $out/bin/iota + for f in $out/bin/*; do + if [ "$(basename "$f")" != "iota" ]; then + rm "$f" + fi + done + ''; + passthru.dataDir = "/var/lib/iota"; }; - nativeBuildInputs = with pkgs; [cmake perl pkg-config]; - buildInputs = with pkgs; [openssl sqlite]; - dontUseCmakeConfigure = true; - preConfigure = '' - if [ -d ../cargo-vendor-dir/ttp-core-0.1.0 ]; then - cp ${ttp}/ttp-codec.json ../cargo-vendor-dir/ttp-codec.json - fi - ''; - postInstall = '' - mv $out/bin/iota-core $out/bin/iota - for f in $out/bin/*; do - if [ "$(basename "$f")" != "iota" ]; then - rm "$f" - fi - done - ''; - passthru.dataDir = "/var/lib/iota"; + }; + + devShells.default = pkgs.mkShell { + nativeBuildInputs = with pkgs; [ + rustToolchain + git + cmake + perl + pkg-config + ]; + buildInputs = with pkgs; [ + openssl + sqlite + ]; }; }; - devShells.default = pkgs.mkShell { - nativeBuildInputs = with pkgs; [rustToolchain git cmake perl pkg-config]; - buildInputs = with pkgs; [openssl sqlite]; - }; - }; - flake = { - nixosModules.default = { - config, - pkgs, - lib, - ... - }: let - cfg = config.services.iota; - defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}"); + nixosModules.default = + { + config, + pkgs, + lib, + ... + }: + let + cfg = config.services.iota; + defaultPackage = + self.packages.${pkgs.stdenv.hostPlatform.system}.default + or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}"); - configFile = - if cfg.settingsFile != null - then cfg.settingsFile - else pkgs.writeText "iota-config.json" (builtins.toJSON cfg.settings); + configFile = + if cfg.settingsFile != null then + cfg.settingsFile + else + pkgs.writeText "iota-config.json" (builtins.toJSON cfg.settings); - descriptionText = "Tensamin Iota"; - #+ lib.optionalString cfg.useTmux " (attach TUI: tmux -S ${cfg.dataDir}/tmux.sock attach -t iota)"; - in { - options.services.iota = { - enable = lib.mkEnableOption "Enable the Iota service."; + descriptionText = "Tensamin Iota"; + #+ lib.optionalString cfg.useTmux " (attach TUI: tmux -S ${cfg.dataDir}/tmux.sock attach -t iota)"; + in + { + options.services.iota = { + enable = lib.mkEnableOption "Enable the Iota service."; - dataDir = lib.mkOption { - type = lib.types.str; - default = cfg.package.passthru.dataDir or "/var/lib/iota"; - defaultText = lib.literalExpression ''config.services.iota.package.passthru.dataDir or "/var/lib/iota"''; - description = "Directory where Iota stores its data, config, and certificates."; + dataDir = lib.mkOption { + type = lib.types.str; + default = cfg.package.passthru.dataDir or "/var/lib/iota"; + defaultText = lib.literalExpression ''config.services.iota.package.passthru.dataDir or "/var/lib/iota"''; + description = "Directory where Iota stores its data, config, and certificates."; + }; + + certFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + description = "Path to the SSL certificate file (cert.pem)."; + }; + + keyFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + description = "Path to the SSL private key file (cert.key)."; + }; + + environmentFiles = lib.mkOption { + type = lib.types.listOf lib.types.path; + default = [ ]; + description = "Environment files to load for the Iota service."; + }; + + openFirewall = lib.mkOption { + type = lib.types.bool; + default = true; + description = "Whether to open the firewall for ports used by Iota."; + }; + + bindAddress = lib.mkOption { + type = lib.types.str; + default = "0.0.0.0"; + description = "IP address to bind the HTTP server to."; + }; + + package = lib.mkOption { + type = lib.types.package; + default = defaultPackage; + description = "The Iota package to use."; + }; + + useTmux = lib.mkOption { + type = lib.types.bool; + default = true; + description = "Whether to run Iota inside a tmux session for shared TUI access."; + }; + + settings = lib.mkOption { + type = lib.types.attrs; + default = { }; + description = "Configuration attributes for Iota, written to config.json."; + }; + + settingsFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + description = "Path to an existing config.json file to use instead of generating from settings."; + }; }; - certFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - description = "Path to the SSL certificate file (cert.pem)."; - }; + config = lib.mkIf cfg.enable { + users.users.iota = { + isSystemUser = true; + group = "iota"; + home = cfg.dataDir; + createHome = true; + description = "Iota service user"; + shell = pkgs.bash; + }; - keyFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - description = "Path to the SSL private key file (cert.key)."; - }; + users.groups.iota = { }; - environmentFiles = lib.mkOption { - type = lib.types.listOf lib.types.path; - default = []; - description = "Environment files to load for the Iota service."; - }; - - openFirewall = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Whether to open the firewall for ports used by Iota."; - }; - - ttpBind = lib.mkOption { - type = lib.types.str; - default = "0.0.0.0"; - description = "IP address to bind the TTP/QUIC server to."; - }; - - bindAddress = lib.mkOption { - type = lib.types.str; - default = "0.0.0.0"; - description = "IP address to bind the HTTP server to."; - }; - - package = lib.mkOption { - type = lib.types.package; - default = defaultPackage; - description = "The Iota package to use."; - }; - - useTmux = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Whether to run Iota inside a tmux session for shared TUI access."; - }; - - settings = lib.mkOption { - type = lib.types.attrs; - default = {}; - description = "Configuration attributes for Iota, written to config.json."; - }; - - settingsFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - description = "Path to an existing config.json file to use instead of generating from settings."; - }; - }; - - config = lib.mkIf cfg.enable { - users.users.iota = { - isSystemUser = true; - group = "iota"; - home = cfg.dataDir; - createHome = true; - description = "Iota service user"; - shell = pkgs.bash; - }; - - users.groups.iota = {}; - - systemd.services.iota = let - iotaTmuxCmd = pkgs.writeShellScript "iota-tmux-cmd" '' - mkdir -p ${cfg.dataDir} - echo "[$(date)] Running Iota..." - ${cfg.package}/bin/iota - status=$? - echo "" - echo "[$(date)] Iota exited with status: $status" - echo "Press any key to exit..." - read -r -n 1 - exit $status - ''; - in { - description = descriptionText; - wantedBy = ["multi-user.target"]; - after = ["network.target"]; - - serviceConfig = + systemd.services.iota = + let + iotaTmuxCmd = pkgs.writeShellScript "iota-tmux-cmd" '' + mkdir -p ${cfg.dataDir} + echo "[$(date)] Running Iota..." + ${cfg.package}/bin/iota + status=$? + echo "" + echo "[$(date)] Iota exited with status: $status" + echo "Press any key to exit..." + read -r -n 1 + exit $status + ''; + in { - Type = "simple"; - User = "iota"; - Group = "iota"; - WorkingDirectory = cfg.dataDir; + description = descriptionText; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; - ExecStart = - if cfg.useTmux - then - pkgs.writeShellScript "iota-start" '' - set -e - export TMUX_TMPDIR=${cfg.dataDir} - ${pkgs.coreutils}/bin/mkdir -p ${cfg.dataDir} - ${pkgs.coreutils}/bin/chown iota:iota ${cfg.dataDir} + serviceConfig = { + Type = "simple"; + User = "iota"; + Group = "iota"; + WorkingDirectory = cfg.dataDir; - echo "[iota-start] Creating tmux session..." - if ! ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock new-session -d -s iota "${iotaTmuxCmd}"; then - echo "[iota-start] ERROR: tmux new-session failed" - exit 1 - fi - echo "[iota-start] tmux session created, waiting..." - echo "[iota-start] Run 'tmux -S ${cfg.dataDir}/tmux.sock attach -t iota' to attach to the tmux session." + ExecStart = + if cfg.useTmux then + pkgs.writeShellScript "iota-start" '' + set -e + export TMUX_TMPDIR=${cfg.dataDir} + ${pkgs.coreutils}/bin/mkdir -p ${cfg.dataDir} + ${pkgs.coreutils}/bin/chown iota:iota ${cfg.dataDir} - while ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock has-session -t iota 2>/dev/null; do - sleep 2 - done - echo "[iota-start] tmux session ended" - '' - else "${cfg.package}/bin/iota"; + echo "[iota-start] Creating tmux session..." + if ! ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock new-session -d -s iota "${iotaTmuxCmd}"; then + echo "[iota-start] ERROR: tmux new-session failed" + exit 1 + fi + echo "[iota-start] tmux session created, waiting..." + echo "[iota-start] Run 'tmux -S ${cfg.dataDir}/tmux.sock attach -t iota' to attach to the tmux session." - ExecStartPre = [ - ("+" - + pkgs.writeShellScript "iota-setup" '' - mkdir -p ${cfg.dataDir}/certs + while ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock has-session -t iota 2>/dev/null; do + sleep 2 + done + echo "[iota-start] tmux session ended" + '' + else + "${cfg.package}/bin/iota"; - ${lib.optionalString (cfg.certFile != null) "ln -sf ${cfg.certFile} ${cfg.dataDir}/certs/cert.pem"} - ${lib.optionalString (cfg.keyFile != null) "ln -sf ${cfg.keyFile} ${cfg.dataDir}/certs/cert.key"} + ExecStartPre = [ + ( + "+" + + pkgs.writeShellScript "iota-setup" '' + mkdir -p ${cfg.dataDir}/certs - install -m 644 ${configFile} ${cfg.dataDir}/config.json + ${lib.optionalString (cfg.certFile != null) "ln -sf ${cfg.certFile} ${cfg.dataDir}/certs/cert.pem"} + ${lib.optionalString (cfg.keyFile != null) "ln -sf ${cfg.keyFile} ${cfg.dataDir}/certs/cert.key"} - chown -R iota:iota ${cfg.dataDir} - '') - ]; + install -m 644 ${configFile} ${cfg.dataDir}/config.json - Restart = "always"; - RestartSec = "5s"; + chown -R iota:iota ${cfg.dataDir} + '' + ) + ]; - AmbientCapabilities = ["CAP_NET_BIND_SERVICE"]; - CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"]; + Restart = "always"; + RestartSec = "5s"; - ProtectSystem = "strict"; - ProtectHome = true; - PrivateTmp = true; - NoNewPrivileges = true; - ReadWritePaths = [cfg.dataDir]; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectControlGroups = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - LockPersonality = true; - MemoryDenyWriteExecute = true; - Environment = [ - "TTP_BIND=${cfg.ttpBind}" - "BIND_ADDRESS=${cfg.bindAddress}" - ]; - } - // lib.optionalAttrs (cfg.environmentFiles != []) { - EnvironmentFile = cfg.environmentFiles; + AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; + CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; + + ProtectSystem = "strict"; + ProtectHome = true; + PrivateTmp = true; + NoNewPrivileges = true; + ReadWritePaths = [ cfg.dataDir ]; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + Environment = [ + "BIND_ADDRESS=${cfg.bindAddress}" + ]; + } + // lib.optionalAttrs (cfg.environmentFiles != [ ]) { + EnvironmentFile = cfg.environmentFiles; + }; }; - }; - networking.firewall = lib.mkIf cfg.openFirewall { - allowedTCPPorts = [1984]; - allowedUDPPorts = [1984]; + networking.firewall = lib.mkIf cfg.openFirewall { + allowedTCPPorts = [ 1984 ]; + allowedUDPPorts = [ 1984 ]; + }; }; }; - }; }; }; }