modules/hostapd/service.nix

@@ -50,8 +50,9 @@ let
       exec ${hostapd}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}/hostapd.pid -S /run/${name}/hostapd.conf
     '';
   };
-  watch = filter (f: typeOf f == "lambda") (attrValues attrs);
+  watch = filter (f: typeOf f == "set") (attrValues attrs);
 in svc.secrets.subscriber.build {
-  inherit service watch;
+  inherit watch;
+  inherit service;
   action = "restart-all";
 }

modules/ppp/l2tp.nix

@@ -1,7 +1,6 @@
 {
   liminix
 , lib
-, svc
 , output-template
 , writeAshScript
 , writeText
@@ -79,19 +78,16 @@ let
     max redials = 2 # this gives 1 actual retry, as xl2tpd can't count
   '';
   control = "/run/${name}/control";
-  service = longrun {
-    inherit name;
-    run = ''
-      mkdir -p /run/${name}
-      chmod 0700 /run/${name}
-      touch ${control}
-      in_outputs ${name}
-      echo ${escapeShellArgs ppp-options'} | ${output-template}/bin/output-template '{{' '}}' > /run/${name}/ppp-options
-      exec ${xl2tpd}/bin/xl2tpd -D -p /run/${name}/${name}.pid -c ${conf} -C ${control} 
-    '';
-    notification-fd = 10;
-  };
-in svc.secrets.subscriber.build {
-  watch = [ username password ];
-  inherit service;
+in
+longrun {
+  inherit name;
+  run = ''
+    mkdir -p /run/${name}
+    chmod 0700 /run/${name}
+    touch ${control}
+    in_outputs ${name}
+    echo ${escapeShellArgs ppp-options'} | ${output-template}/bin/output-template '{{' '}}' > /run/${name}/ppp-options
+    exec ${xl2tpd}/bin/xl2tpd -D -p /run/${name}/${name}.pid -c ${conf} -C ${control} 
+  '';
+  notification-fd = 10;
 }

modules/ppp/pppoe.nix

@@ -1,6 +1,5 @@
 {
   liminix
-, svc
 , lib
 , output-template
 , ppp
@@ -67,23 +66,19 @@ let
         "logfd" "2"
        ];
   timeoutOpt = if lcpEcho.interval != null then "-T ${builtins.toString (4 * lcpEcho.interval)}" else "";
-  service = longrun {
-    inherit name;
-    run = ''
-      mkdir -p /run/${name}
-      chmod 0700 /run/${name}
-      in_outputs ${name}
-      echo ${escapeShellArgs ppp-options'} | ${output-template}/bin/output-template '{{' '}}' > /run/${name}/ppp-options
-      exec ${ppp}/bin/pppd pty "${pppoe}/bin/pppoe ${timeoutOpt}  -I $(output ${interface} ifname)" file /run/${name}/ppp-options
-    '';
-    notification-fd = 10;
-    timeout-up = if lcpEcho.failure != null
-                 then (10 + lcpEcho.failure * lcpEcho.interval) * 1000
-                 else 60 * 1000;
-    dependencies = [ interface ];
-  };
-in svc.secrets.subscriber.build {
-  watch = [ username password ];
-  inherit service;
-  action = "restart-all";
+in
+longrun {
+  inherit name;
+  run = ''
+    mkdir -p /run/${name}
+    chmod 0700 /run/${name}
+    in_outputs ${name}
+    echo ${escapeShellArgs ppp-options'} | ${output-template}/bin/output-template '{{' '}}' > /run/${name}/ppp-options
+    exec ${ppp}/bin/pppd pty "${pppoe}/bin/pppoe ${timeoutOpt}  -I $(output ${interface} ifname)" file /run/${name}/ppp-options
+  '';
+  notification-fd = 10;
+  timeout-up = if lcpEcho.failure != null
+               then (10 + lcpEcho.failure * lcpEcho.interval) * 1000
+               else 60 * 1000;
+  dependencies = [ interface ];
 }

modules/secrets/default.nix

@@ -66,7 +66,7 @@ in {
     subscriber = config.system.callService ./subscriber.nix {
       watch = mkOption {
         description = "secrets paths to subscribe to";
-        type = types.listOf (types.functionTo types.anything);
+        type = types.listOf types.attrs;
       };
       service = mkOption {
         description = "subscribing service that will receive notification";

modules/secrets/subscriber.nix

@@ -8,8 +8,8 @@ let
   inherit (lib) unique optional;
   inherit (service) name;
 
-  watched-services = unique (map (f: f "service") watch);
-  paths = unique (map (f: f "path") watch);
+  watched-services = unique (map (f: f.service) watch);
+  paths = unique (map (f: f.path) watch);
 
   restart-flag = {
     restart = "-r";

pkgs/default.nix

@@ -127,4 +127,5 @@ in {
   writeAshScript = callPackage ./write-ash-script { };
   writeAshScriptBin = callPackage ./write-ash-script/bin.nix { };
   writeFennel = callPackage ./write-fennel { };
+  writeFennelScript = callPackage ./write-fennel-script { };
 }

pkgs/ifwait/default.nix

@@ -1,14 +1,15 @@
 {
   netlink-lua,
-  writeFennel,
+  writeFennelScript,
   runCommand,
   anoia,
 }:
 runCommand "ifwait" { } ''
   mkdir -p $out/bin
   cp -p ${
-    writeFennel "ifwait" {
-      packages = [ anoia netlink-lua ];
-    } ./ifwait.fnl
+    writeFennelScript "ifwait" [
+      anoia
+      netlink-lua
+    ] ./ifwait.fnl
   } $out/bin/ifwait
 ''

pkgs/odhcp-script/default.nix

@@ -1,8 +1,6 @@
 {
-  writeFennel,
+  writeFennelScript,
   anoia,
   lualinux,
 }:
-writeFennel  "odhcpc-script" {
-  packages = [anoia lualinux];
-} ./odhcp6-script.fnl
+writeFennelScript  "odhcpc-script" [anoia lualinux] ./odhcp6-script.fnl

pkgs/systemconfig/default.nix

@@ -6,7 +6,7 @@
 
 {
   writeText,
-  writeFennel,
+  writeFennelScript,
   lib,
   s6-init-bin,
   closureInfo,
@@ -81,7 +81,7 @@ in attrset:
       cp $closure/store-paths $out/etc/nix-store-paths
       $STRIP --remove-section=.note  --remove-section=.comment --strip-all makedevs -o $out/bin/activate
       ln -s ${s6-init-bin}/bin/init $out/bin/init
-      cp -p ${writeFennel "restart-services" {} ./restart-services.fnl} $out/bin/restart-services
+      cp -p ${writeFennelScript "restart-services" [] ./restart-services.fnl} $out/bin/restart-services
       cat > $out/bin/install <<EOF
       #!/bin/sh -e
       prefix=\''${1-/}

pkgs/tangc/tangc.fnl

@@ -90,20 +90,11 @@
    }))
 
 (fn http-post [url body]
-  (match
+  (json.decode
    (http.request "POST" url
                  "" 0
                  "application/x-www-form-urlencoded"
-                 body)
-   s (json.decode s)
-   (nil err) (error err)))
-
-
-(fn http-get [url body]
-  (match
-   (http.fetch url)
-   s (json.decode s)
-   (nil code msg) (error (.. "Error: " code ": " msg))))
+                 body)))
 
 (fn decrypt []
   (let [b64 (base64 :url)
@@ -121,7 +112,7 @@
           jwk (jwk-exc-noi rep tmp)]
       (print (jwe-dec jwk ph undigested)))))
 
-(fn perform-encryption [jwks url input]
+(fn perform-encryption [jwks url]
   (let [enc (jose! [:jwk :use "-i-" "-r" "-u" "deriveKey" "-o-"]
                    (json.encode jwks))
         ;; adding a -s to jwk use will "Always output a JWKSet" which
@@ -140,7 +131,8 @@
                            :clevis {:pin "tang"
                                     :tang {:url url :adv jwks }}}}]
       (josep! [:jwe :enc "-i-" "-k-" "-I-" "-c"]
-              (.. (json.encode jwe) (json.encode jwk) input)))))
+              (.. (json.encode jwe) (json.encode jwk)
+                  (: (io.input) :read "*a"))))))
 
 (fn usage []
   (print "tangc\n=====\n")
@@ -149,30 +141,23 @@
              (json.encode {:url "http://tang.local"})))
   (print (%% "tangc encrypt %q < plaintext > filename.enc # encrypt"
              (json.encode {:thp "idGFpbiBhIHByZWJ1aWx0IGRhdGFiYXNlIGZyb20gaH"
-                           :url "http://tang.local"})))
-  (os.exit 1))
+                           :url "http://tang.local"}))))
 
 
 (fn encrypt [cfg]
   (let [{ : url : thp : adv } cfg
-        _  (or url (usage))
-        raw-input (: (io.input) :read "*a")
         b64 (base64 :url)
-        adv (or adv (http-get (.. url "/adv/" (or thp ""))))]
+        adv (or adv (json.decode (http.fetch (.. url "/adv/" (or thp "")))))]
     (assert adv.payload  "advertisement is malformed")
     (let [jwks (json.decode (b64:decode adv.payload))
           ver (jose! [:jwk :use "-i-" "-r" "-u" "verify" "-o-"]
                      (json.encode jwks))]
-      (match
-          (josep! [:jws :ver "-i" (json.encode adv) "-k-" "-a"] (json.encode ver))
-        "" nil
-        str (error "jws verify of advertised keys failed: " str))
+      (print (josep! [:jws :ver "-i" (json.encode adv) "-k-" "-a"]
+                     (json.encode ver)))
 
       (if (and thp (search-key ver thp))
-          (: (io.output) :write (perform-encryption jwks url raw-input))
-          ;; the command line options are currently the same as clevis
-          ;; but unless I can greatly improve this wording, that's gonna change
-          (print (.. "\ntangc: Thumbprints of advertised keys are listed below. Rerun this command\nproviding the thp attribute to specify the preferred key\n\n"
+          (print (perform-encryption jwks url))
+          (print (.. "Thumbrints of advertised keys are listed below. Set the thp attribute to preferred key\n"
                      (josep! [:jwk :thp "-i-" "-a" (. thumbprint-algs 1)] (json.encode ver))))))))
 
 
@@ -180,6 +165,6 @@
   (case arg
     ["decrypt"] (decrypt)
     ["encrypt" cfg] (encrypt (json.decode cfg))
-    _ (usage)))
+    _ (error "usage: tangc [decrypt] | [encrypt cfg]")))
 
 { : run }

tests/fennel/test.nix

@@ -5,10 +5,10 @@
 let
   overlay = import "${liminix}/overlay.nix";
   pkgs = import <nixpkgs> { overlays = [overlay]; };
-  script = pkgs.writeFennel "foo" {} ./hello.fnl;
+  script = pkgs.writeFennelScript "foo" [] ./hello.fnl;
   inherit (pkgs.lua.pkgs) fifo;
   netlink = pkgs.netlink-lua;
-  script2 = pkgs.writeFennel "foo2" { packages = [fifo netlink];} ./hello.fnl;
+  script2 = pkgs.writeFennelScript "foo2" [fifo netlink] ./hello.fnl;
 in pkgs.runCommand "check" {
   } ''
 set -e