dan/liminix
1
0
Fork 5
Code

move some secret-watching stuff from hostapd to secrets

Browse Source
This commit is contained in:
Daniel Barlow 2024-08-20 21:49:11 +01:00
parent 97defc2076
commit 264d83c98d
3 changed files with 25 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
modules/hostapd/service.nix
View File

@ -9,7 +9,7 @@
{ interface, params} : { interface, params} :
let let
inherit (liminix.services) longrun; inherit (liminix.services) longrun;
inherit (lib) concatStringsSep mapAttrsToList; inherit (lib) concatStringsSep mapAttrsToList unique ;
inherit (builtins) map filter attrValues length head typeOf; inherit (builtins) map filter attrValues length head typeOf;
# This is not a friendly interface to configuring a wireless AP: it # This is not a friendly interface to configuring a wireless AP: it
@ -51,19 +51,9 @@ let
exec ${hostapd}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}/hostapd.pid -S /run/${name}/hostapd.conf exec ${hostapd}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}/hostapd.pid -S /run/${name}/hostapd.conf
''; '';
}; };
watched-services = watch = filter (f: typeOf f == "set") (attrValues attrs);
(filter (f: typeOf f == "set") (attrValues attrs));
in svc.secrets.subscriber.build { in svc.secrets.subscriber.build {
watch = { inherit watch;
service = assert (length watched-services == 1); (head watched-services).service;
paths = unique (
map (s: s.path)
(filter
(f: f.service == (head watched-services).service)
watched-services
));
};
inherit service; inherit service;
action = "restart-all"; action = "restart-all";
} }

13
modules/secrets/default.nix
View File

@ -37,16 +37,9 @@ in {
}; };
}; };
subscriber = config.system.callService ./subscriber.nix { subscriber = config.system.callService ./subscriber.nix {
watch = { watch = mkOption {
service = mkOption { description = "secrets paths to subscribe to";
description = "secrets service to subscribe to"; type = types.listOf types.attrs;
type = liminix.lib.types.service;
};
paths = mkOption {
description = "list of output paths we are interested in";
example = ["wan/l2tp" "wifi/wlan5"];
type = types.listOf types.str;
};
}; };
service = mkOption { service = mkOption {
description = "subscribing service that will receive notification"; description = "subscribing service that will receive notification";

24
modules/secrets/subscriber.nix
View File

@ -4,9 +4,21 @@
{ watch, service, action } : { watch, service, action } :
let let
inherit (liminix.services) oneshot longrun; inherit (liminix.services) oneshot longrun;
inherit (builtins) toString; inherit (builtins) length head toString;
inherit (lib) unique optional;
inherit (service) name; inherit (service) name;
watcher = let name' = "check-${name}"; in longrun {
watched-services = unique (map (f: f.service) watch);
paths = unique (map (f: f.path) watch);
watched-service =
if length watched-services == 0
then null
else if length watched-services == 1
then head watched-services
else throw "cannot subscribe to more than one source service for secrets";
watcher = let name' = "restart-${name}"; in longrun {
name = name'; name = name';
run = '' run = ''
dir=/run/service/${name} dir=/run/service/${name}
@ -14,10 +26,12 @@ let
if test -e $dir/notification-fd; then flag="-U"; else flag="-u"; fi if test -e $dir/notification-fd; then flag="-U"; else flag="-u"; fi
${s6}/bin/s6-svwait $flag /run/service/${name} || exit ${s6}/bin/s6-svwait $flag /run/service/${name} || exit
PATH=${s6-rc}/bin:${s6}/bin:$PATH PATH=${s6-rc}/bin:${s6}/bin:$PATH
${watch-outputs}/bin/watch-outputs -r ${name} ${watch.service} ${lib.concatStringsSep " " watch.paths} ${watch-outputs}/bin/watch-outputs -r ${name} ${watched-service.name} ${lib.concatStringsSep " " paths}
''; '';
}; };
in service.overrideAttrs(o: { in service.overrideAttrs(o: {
buildInputs = (lim.orEmpty o.buildInputs) ++ [ watcher ]; buildInputs = (lim.orEmpty o.buildInputs) ++
dependencies = (lim.orEmpty o.dependencies) ++ [ watcher ]; optional (watched-service != null) watcher;
dependencies = (lim.orEmpty o.dependencies) ++
optional (watched-service != null) watcher;
}) })