summaryrefslogtreecommitdiffstats
path: root/pkgs/populate/default.nix
blob: dcb26b9b12cf96596c8ca1cfd9e45897aceb36a0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
with import ../../lib;
with shell;

{ coreutils, dash, findutils, git, jq, openssh, pass, rsync, writeDash }:

let
  check = { force, target }: let
    sentinelFile = "${target.path}/.populate";
  in shell' target /* sh */ ''
    ${optionalString force /* sh */ ''
      mkdir -vp ${quote (dirOf sentinelFile)} >&2
      touch ${quote sentinelFile}
    ''}
    if ! test -f ${quote sentinelFile}; then
      >&2 printf 'error: missing sentinel file: %s\n' ${quote (
        optionalString (!isLocalTarget target) "${target.host}:" +
        sentinelFile
      )}
      exit 1
    fi
  '';

  pop.derivation = target: source: shell' target /* sh */ ''
    nix-build -E ${quote source.text} -o ${quote target.path}
  '';

  pop.file = target: source: let
    configAttrs = ["useChecksum"];
    config = filterAttrs (name: _: elem name configAttrs) source;
  in
    rsync' target config (quote source.path);

  pop.git = target: source: shell' target /* sh */ ''
    set -efu
    if ! test -e ${quote target.path}; then
      git clone --recurse-submodules ${quote source.url} ${quote target.path}
    fi
    cd ${quote target.path}
    if ! url=$(git config remote.origin.url); then
      git remote add origin ${quote source.url}
    elif test "$url" != ${quote source.url}; then
      git remote set-url origin ${quote source.url}
    fi

    # TODO resolve git_ref to commit hash
    hash=${quote source.ref}

    if ! test "$(git log --format=%H -1)" = "$hash"; then
      if ! git log -1 "$hash" >/dev/null 2>&1; then
        git fetch origin
      fi
      git reset --hard "$hash" >&2
      git submodule update --init --recursive
    fi

    git clean -dfx \
        ${concatMapStringsSep " "
          (pattern: /* sh */ "-e ${quote pattern}")
          source.clean.exclude }
  '';

  pop.pass = target: source: let
    passPrefix = "${source.dir}/${source.name}";
  in /* sh */ ''
    umask 0077

    if test -e ${quote source.dir}/.git; then
      local_pass_info=${quote source.name}\ $(${git}/bin/git -C ${quote source.dir} rev-parse HEAD)
      remote_pass_info=$(${shell' target /* sh */ ''
        cat ${quote target.path}/.pass_info || :
      ''})

      if test "$local_pass_info" = "$remote_pass_info"; then
        exit 0
      fi
    fi

    tmp_dir=$(${coreutils}/bin/mktemp -dt populate-pass.XXXXXXXX)
    trap cleanup EXIT
    cleanup() {
      rm -fR "$tmp_dir"
    }

    ${findutils}/bin/find ${quote passPrefix} -type f |
    while read -r gpg_path; do

      rel_name=''${gpg_path#${quote passPrefix}}
      rel_name=''${rel_name%.gpg}

      pass_date=$(
        ${git}/bin/git -C ${quote source.dir} log -1 --format=%aI "$gpg_path"
      )
      pass_name=${quote source.name}/$rel_name
      tmp_path=$tmp_dir/$rel_name

      ${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")"
      PASSWORD_STORE_DIR=${quote source.dir} ${pass}/bin/pass show "$pass_name" > "$tmp_path"
      ${coreutils}/bin/touch -d "$pass_date" "$tmp_path"
    done

    if test -n "''${local_pass_info-}"; then
      echo "$local_pass_info" > "$tmp_dir"/.pass_info
    fi

    ${rsync' target {} /* sh */ "$tmp_dir"}
  '';

  pop.pipe = target: source: /* sh */ ''
    ${quote source.command} | {
      ${shell' target /* sh */ "cat > ${quote target.path}"}
    }
  '';

  # TODO rm -fR instead of ln -f?
  pop.symlink = target: source: shell' target /* sh */ ''
    ln -fnsT ${quote source.target} ${quote target.path}
  '';

  populate = target: name: source: let
    source' = source.${source.type};
    target' = target // { path = "${target.path}/${name}"; };
  in writeDash "populate.${target'.host}.${name}" ''
    set -efu
    ${pop.${source.type} target' source'}
  '';

  rsync' = target: config: sourcePath: /* sh */ ''
    source_path=${sourcePath}
    if test -d "$source_path"; then
      source_path=$source_path/
    fi
    ${rsync}/bin/rsync \
        ${optionalString (config.useChecksum or false) /* sh */ "--checksum"} \
        -e ${quote (ssh' target)} \
        -vFrlptD \
        --delete-excluded \
        "$source_path" \
        ${quote (
          optionalString (!isLocalTarget target)
                         "${target.user}@${target.host}:" +
          target.path
        )} \
      >&2
  '';

  shell' = target: script:
    if isLocalTarget target
      then script
      else /* sh */ ''
        ${ssh' target} ${quote target.host} ${quote script}
      '';

  ssh' = target: concatMapStringsSep " " quote [
    "${openssh}/bin/ssh"
    "-l" target.user
    "-o" "ControlPersist=no"
    "-p" target.port
    "-T"
  ];

in

{ force ? false, source, target }: writeDash "populate.${target.host}" ''
  set -efu
  ${check { inherit force target; }}
  set -x
  ${concatStringsSep "\n" (mapAttrsToList (populate target) source)}
''