diff options
| -rw-r--r-- | lib/modules.nix | 21 | ||||
| -rwxr-xr-x | run | 134 |
2 files changed, 155 insertions, 0 deletions
diff --git a/lib/modules.nix b/lib/modules.nix new file mode 100644 index 00000000..248e638e --- /dev/null +++ b/lib/modules.nix @@ -0,0 +1,21 @@ +let + pkgs = import <nixpkgs> {}; + inherit (pkgs.lib) concatMap hasAttr; +in rec { + + no-touch-args = { + config = throw "no-touch-args: can't touch config!"; + lib = throw "no-touch-args: can't touch lib!"; + pkgs = throw "no-touch-args: can't touch pkgs!"; + }; + + # list-imports : path -> [path] + # Return a module's transitive list of imports. + # XXX duplicates won't get eliminated from the result. + list-imports = path: + let module = import path no-touch-args; + imports = if hasAttr "imports" module + then concatMap list-imports module.imports + else []; + in [path] ++ imports; +} @@ -0,0 +1,134 @@ +#! /bin/sh +set -euf + +main() { + case "$1" in + (deploy) + "$@" + ;; + (*) + echo "$0: unknown command: $1" >&2 + exit 23 + esac +} + +# deploy : nix-file x hostname -> () +deploy() {( + main=$1 + target=$2 + + hosts=$(list_hosts) + imports=$(set -euf; list_imports "$main") + secrets=$(echo "$imports" | xargs cat | quoted_strings | filter_secrets) + + abs_deps=$( + echo "$hosts" + echo "$imports" + echo "$secrets" + ) + + rel_deps=$(echo "$abs_deps" | make_relative_to "$PWD") + filter=$(echo "$rel_deps" | make_rsync_whitelist) + + echo "$filter" \ + | rsync -f '. -' -zvrlptD --delete-excluded ./ "$target":/etc/nixos/ + ssh "$target" nixos-rebuild switch -I nixos-config=/etc/nixos/"$main" +)} + +# list_imports : nix-file -> lines nix-file +list_imports() { + if echo "$1" | grep -q ^/; then + : + else + set -- "./$1" + fi + imports=$(nix-instantiate \ + --strict \ + --json \ + --eval \ + -E \ + "with builtins; with import ./lib/modules.nix; map toString (list-imports $1)") + echo "$imports" \ + | jq -r .[] +} + +# list_hosts : lines tinc-host-file +# Precondition: $PWD/hosts is the correct repository :) +list_hosts() { + git -C hosts ls-tree --name-only HEAD \ + | awk '{print ENVIRON["PWD"]"/hosts/"$$0}' +} + +# filter_secrets : lines string |> lines secrets-file-candidate +# Notice how false positives are possible. +filter_secrets() { + sed -n 's:^\(.*/\)\?\(secrets/.*\):'"${PWD//:/\\:}"'/\2:p' +} + + +# quoted_strings : lines string |> lines string +# Extract all (double-) quoted strings from stdin. +# +# 0. find begin of string or skip line +# 1. find end of string or skip line +# 2. print string and continue after string +quoted_strings() { + sed ' + s:[^"]*":: ;t1;d + :1; s:\(\([^"]\|\\"\)*\)":\1\n: ;t2;d + :2; P;D + ' \ + | sed 's:\\":":g' +} + +# bre_escape : lines string |> lines bre-escaped-string +bre_escape() { + sed 's:[\.\[\\\*\^\$]:\\&:g' +} + +# ls_bre : directory -> BRE +# Create a BRE from the files in a directory. +ls_bre() { + ls "$1" \ + | tr \\n / \ + | sed ' + s:[\.\[\\\*\^\$]:\\&:g + s:/$:: + s:/:\\|:g + ' +} + +# make_relative_to : lines path |> directory -> lines path +# Non-matching paths won't get altered. +make_relative_to() { + sed "s:^$(echo "$1/" | bre_escape | sed 's/:/\\:/g')::" +} + +# make_rsync_whitelist : lines rel-path |> liens rsync-filter +make_rsync_whitelist() { + set -- "$(cat)" + + # include all files in stdin and their directories + { + echo "$1" + echo "$1" | make_parent_dirs | sort | uniq + } \ + | sed 's|^|+ /|' + + # exclude everything else + echo '- *' +} + +# make_parent_dirs : lines path |> lines directory +# List all parent directories of a path. +make_parent_dirs() { + set -- "$(sed -n 's|/[^/]*$||p' | grep . | sort | uniq)" + if echo "$1" | grep -q .; then + echo "$1" + echo "$1" | make_parent_dirs + fi +} + +if [ "${noexec-}" != 1 ]; then + main "$@" +fi |