Compare commits

..
2 changed files with 181 additions and 215 deletions

141
flake.nix
View file

@ -14,15 +14,8 @@
}; };
}; };
outputs = inputs @ { outputs = inputs@{ self, nixpkgs, flake-parts, rust-overlay, ttp, ... }:
self, flake-parts.lib.mkFlake { inherit inputs; } {
nixpkgs,
flake-parts,
rust-overlay,
ttp,
...
}:
flake-parts.lib.mkFlake {inherit inputs;} {
systems = [ systems = [
"x86_64-linux" "x86_64-linux"
"aarch64-linux" "aarch64-linux"
@ -30,20 +23,17 @@
"aarch64-darwin" "aarch64-darwin"
]; ];
perSystem = { perSystem = { self', pkgs, system, ... }:
self', let
pkgs,
system,
...
}: let
rustPkgs = import nixpkgs { rustPkgs = import nixpkgs {
inherit system; inherit system;
overlays = [(import rust-overlay)]; overlays = [ (import rust-overlay) ];
}; };
rustToolchain = rustPkgs.rust-bin.stable.latest.default.override { rustToolchain = rustPkgs.rust-bin.stable.latest.default.override {
extensions = ["rust-src" "rust-analyzer" "clippy" "rustfmt"]; extensions = [ "rust-src" "rust-analyzer" "clippy" "rustfmt" ];
}; };
in { in
{
packages = { packages = {
default = self'.packages.iota; default = self'.packages.iota;
iota = pkgs.rustPlatform.buildRustPackage { iota = pkgs.rustPlatform.buildRustPackage {
@ -54,8 +44,8 @@
lockFile = ./Cargo.lock; lockFile = ./Cargo.lock;
allowBuiltinFetchGit = true; allowBuiltinFetchGit = true;
}; };
nativeBuildInputs = with pkgs; [cmake perl pkg-config]; nativeBuildInputs = with pkgs; [ cmake perl pkg-config ];
buildInputs = with pkgs; [openssl sqlite]; buildInputs = with pkgs; [ openssl sqlite ];
dontUseCmakeConfigure = true; dontUseCmakeConfigure = true;
preConfigure = '' preConfigure = ''
if [ -d ../cargo-vendor-dir/ttp-core-0.1.0 ]; then if [ -d ../cargo-vendor-dir/ttp-core-0.1.0 ]; then
@ -75,31 +65,26 @@
}; };
devShells.default = pkgs.mkShell { devShells.default = pkgs.mkShell {
nativeBuildInputs = with pkgs; [rustToolchain git cmake perl pkg-config]; nativeBuildInputs = with pkgs; [ rustToolchain git cmake perl pkg-config ];
buildInputs = with pkgs; [openssl sqlite]; buildInputs = with pkgs; [ openssl sqlite ];
}; };
}; };
flake = { flake = {
nixosModules.default = { nixosModules.default = { config, pkgs, lib, ... }:
config, let
pkgs,
lib,
...
}: let
cfg = config.services.iota; cfg = config.services.iota;
defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}"); defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}");
configFile = configFile = if cfg.settingsFile != null then cfg.settingsFile else
if cfg.settingsFile != null pkgs.writeText "iota-config.json" (builtins.toJSON cfg.settings);
then cfg.settingsFile
else pkgs.writeText "iota-config.json" (builtins.toJSON cfg.settings);
descriptionText = "Tensamin Iota"; descriptionText = "Iota Service"
#+ lib.optionalString cfg.useTmux " (attach TUI: tmux -S ${cfg.dataDir}/tmux.sock attach -t iota)"; + lib.optionalString cfg.useTmux " (attach TUI: tmux -S ${cfg.dataDir}/tmux.sock attach -t iota)";
in { in
{
options.services.iota = { options.services.iota = {
enable = lib.mkEnableOption "Enable the Iota service."; enable = lib.mkEnableOption "the Iota service";
dataDir = lib.mkOption { dataDir = lib.mkOption {
type = lib.types.str; type = lib.types.str;
@ -122,7 +107,7 @@
environmentFiles = lib.mkOption { environmentFiles = lib.mkOption {
type = lib.types.listOf lib.types.path; type = lib.types.listOf lib.types.path;
default = []; default = [ ];
description = "Environment files to load for the Iota service."; description = "Environment files to load for the Iota service.";
}; };
@ -158,7 +143,7 @@
settings = lib.mkOption { settings = lib.mkOption {
type = lib.types.attrs; type = lib.types.attrs;
default = {}; default = { };
description = "Configuration attributes for Iota, written to config.json."; description = "Configuration attributes for Iota, written to config.json.";
}; };
@ -176,62 +161,39 @@
home = cfg.dataDir; home = cfg.dataDir;
createHome = true; createHome = true;
description = "Iota service user"; description = "Iota service user";
shell = pkgs.bash;
}; };
users.groups.iota = {}; users.groups.iota = { };
systemd.services.iota = let systemd.services.iota = {
iotaTmuxCmd = pkgs.writeShellScript "iota-tmux-cmd" ''
mkdir -p ${cfg.dataDir}
echo "[$(date)] Running Iota..."
${cfg.package}/bin/iota
status=$?
echo ""
echo "[$(date)] Iota exited with status: $status"
echo "Press any key to exit..."
read -r -n 1
exit $status
'';
in {
description = descriptionText; description = descriptionText;
wantedBy = ["multi-user.target"]; wantedBy = [ "multi-user.target" ];
after = ["network.target"]; after = [ "network.target" ];
path = [ pkgs.tmux pkgs.bash pkgs.coreutils pkgs.systemd ];
serviceConfig = serviceConfig = {
{ Type = if cfg.useTmux then "forking" else "simple";
Type = "simple";
User = "iota"; User = "iota";
Group = "iota"; Group = "iota";
WorkingDirectory = cfg.dataDir; WorkingDirectory = cfg.dataDir;
ExecStart = ExecStart = if cfg.useTmux then
if cfg.useTmux
then
pkgs.writeShellScript "iota-start" '' pkgs.writeShellScript "iota-start" ''
set -e ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock new-session -d -s iota \
export TMUX_TMPDIR=${cfg.dataDir} "${pkgs.bash}/bin/bash -lc 'exec > >(${pkgs.coreutils}/bin/tee -a ${cfg.dataDir}/iota-output.log >(${pkgs.systemd}/bin/systemd-cat -t iota-daemon)) 2>&1; ${cfg.package}/bin/iota; status=$?; printf \"\nProcess exited with status %s. Press any key to close this tmux session...\" \"\$status\"; read -r -n 1; exit \"\$status\"'"
${pkgs.coreutils}/bin/mkdir -p ${cfg.dataDir}
${pkgs.coreutils}/bin/chown iota:iota ${cfg.dataDir}
echo "[iota-start] Creating tmux session..."
if ! ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock new-session -d -s iota "${iotaTmuxCmd}"; then
echo "[iota-start] ERROR: tmux new-session failed"
exit 1
fi
echo "[iota-start] tmux session created, waiting..."
echo "[iota-start] Run 'tmux -S ${cfg.dataDir}/tmux.sock attach -t iota' to attach to the tmux session."
while ${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock has-session -t iota 2>/dev/null; do
sleep 2
done
echo "[iota-start] tmux session ended"
'' ''
else "${cfg.package}/bin/iota"; else
"${cfg.package}/bin/iota";
ExecStop = if cfg.useTmux then
(pkgs.writeShellScript "iota-stop" ''
${pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/tmux.sock kill-session -t iota 2>/dev/null || true
'')
else
null;
ExecStartPre = [ ExecStartPre = [
("+" ("+" + pkgs.writeShellScript "iota-setup" ''
+ pkgs.writeShellScript "iota-setup" ''
mkdir -p ${cfg.dataDir}/certs mkdir -p ${cfg.dataDir}/certs
${lib.optionalString (cfg.certFile != null) "ln -sf ${cfg.certFile} ${cfg.dataDir}/certs/cert.pem"} ${lib.optionalString (cfg.certFile != null) "ln -sf ${cfg.certFile} ${cfg.dataDir}/certs/cert.pem"}
@ -240,20 +202,24 @@
install -m 644 ${configFile} ${cfg.dataDir}/config.json install -m 644 ${configFile} ${cfg.dataDir}/config.json
chown -R iota:iota ${cfg.dataDir} chown -R iota:iota ${cfg.dataDir}
${lib.optionalString cfg.useTmux ''
echo "Iota started under tmux. Attach with: tmux -S ${cfg.dataDir}/tmux.sock attach -t iota" >&2
''}
'') '')
]; ];
Restart = "always"; Restart = "always";
RestartSec = "5s"; RestartSec = "5s";
AmbientCapabilities = ["CAP_NET_BIND_SERVICE"]; AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"]; CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
PrivateTmp = true; PrivateTmp = true;
NoNewPrivileges = true; NoNewPrivileges = true;
ReadWritePaths = [cfg.dataDir]; ReadWritePaths = [ cfg.dataDir ];
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectControlGroups = true; ProtectControlGroups = true;
@ -265,15 +231,14 @@
"TTP_BIND=${cfg.ttpBind}" "TTP_BIND=${cfg.ttpBind}"
"BIND_ADDRESS=${cfg.bindAddress}" "BIND_ADDRESS=${cfg.bindAddress}"
]; ];
} } // lib.optionalAttrs (cfg.environmentFiles != [ ]) {
// lib.optionalAttrs (cfg.environmentFiles != []) {
EnvironmentFile = cfg.environmentFiles; EnvironmentFile = cfg.environmentFiles;
}; };
}; };
networking.firewall = lib.mkIf cfg.openFirewall { networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [1984]; allowedTCPPorts = [ 1984 ];
allowedUDPPorts = [1984]; allowedUDPPorts = [ 1984 ];
}; };
}; };
}; };

View file

@ -149,8 +149,9 @@ pub fn get_children(path: &str) -> Vec<String> {
} }
pub fn get_directory() -> String { pub fn get_directory() -> String {
std::env::current_dir() let exe = std::env::current_exe().unwrap_or_else(|_| PathBuf::from("."));
.unwrap_or_else(|_| PathBuf::from(".")) exe.parent()
.unwrap_or(Path::new("."))
.to_string_lossy() .to_string_lossy()
.to_string() .to_string()
} }