Nixos adapters

modules/list.nix

@@ -50,4 +50,6 @@
   ./services/dnsmasq.nix
   ./services/attic.nix
   ./services/ntfy-sh.nix
+
+  ./nixos
 ]

modules/nixos/assertions.nix

@@ -0,0 +1,6 @@
+{ config, lib, ... }:
+{
+  options.nixos = lib.mkOption { type = lib.types.submodule { imports = [ ../assertions.nix ]; }; };
+
+  config.assertions = config.nixos.assertions;
+}

modules/nixos/default.nix

@@ -0,0 +1,24 @@
+{ lib, pkgs, ... }:
+{
+  imports = [
+    ./systemd.nix
+    ./nginx.nix
+    ./users.nix
+    ./postgresql.nix
+    ./assertions.nix
+    ./oauth2-proxy.nix
+    ./nix.nix
+    ./meta.nix
+    ./networking.nix
+    ./buildbot.nix
+  ];
+
+  options.nixos = lib.mkOption {
+    type = lib.types.submodule {
+      _module.args = {
+        inherit pkgs;
+      };
+    };
+    default = { };
+  };
+}

modules/nixos/meta.nix

@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  options = {
+    nixos.meta = lib.mkOption { type = lib.types.unspecified; };
+  };
+}

modules/nixos/networking.nix

@@ -0,0 +1,10 @@
+{ lib, config, ... }:
+{
+  options = {
+    nixos.networking.hostName = lib.mkOption { type = lib.types.str; };
+  };
+
+  config = {
+    nixos.networking.hostName = "buildbot";
+  };
+}

modules/nixos/nginx.nix

@@ -0,0 +1,196 @@
+{
+  lib,
+  config,
+  pkgs,
+  options,
+  ...
+}:
+let
+  cfg = config.nixos.services.nginx;
+
+  nixosOptions = options.nixos.type.getSubOptions ["nixos"];
+
+  evalSubmoduleOption = path: options:
+    let
+      option = lib.getAttrFromPath path options;
+    in
+      lib.evalModules {
+        modules = option.type.getSubModules ++ option.definitions;
+        inherit
+          (option.type.functor.payload)
+          class
+          specialArgs
+          ;
+      };
+
+  extractWithPriority = options: submodulePath: optionPath:
+    let
+      submoduleOptions = evalSubmoduleOption submodulePath options;
+      option = lib.getAttrFromPath optionPath submoduleOptions.options;
+    in
+      lib.mkOverride (option.highestPrio) (option.value);
+
+  recommendedProxyConfig = {
+    proxy_set_header = [
+      ["Host" "$$host"]
+      ["X-Real-IP" "$$remote_addr"]
+      ["X-Forwarded-For" "$$proxy_add_x_forwarded_for"]
+      ["X-Forwarded-Proto" "$$scheme"]
+      ["X-Forwarded-Host" "$$host"]
+      ["X-Forwarded-Server" "$$host"]
+    ];
+  };
+in
+{
+  options = {
+    nixos.services.nginx = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+      };
+
+      recommendedProxySettings = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+      };
+
+      proxyTimeout = lib.mkOption {
+        type = lib.types.str;
+        default = "60s";
+        example = "20s";
+        description = ''
+          Change the proxy related timeouts in recommendedProxySettings.
+        '';
+      };
+
+      virtualHosts = lib.mkOption {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
+            options = {
+              locations = lib.mkOption {
+                type = lib.types.attrsOf (
+                  lib.types.submodule {
+                    options.proxyPass = lib.mkOption {
+                      type = lib.types.nullOr lib.types.str;
+                      default = null;
+                    };
+
+                    options.proxyWebsockets = lib.mkOption {
+                      type = lib.types.bool;
+                      default = false;
+                    };
+
+                    options.extraConfig = lib.mkOption {
+                      type = lib.types.lines;
+                      default = "";
+                    };
+                  }
+                );
+                default = { };
+              };
+
+              forceSSL = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+
+              addSSL = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+
+              useHTTPS = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+            };
+          }
+        );
+        default = { };
+      };
+    };
+  };
+
+  config = {
+    services.nginx = {
+      enable = extractWithPriority options [ "nixos" ] [ "services" "nginx" "enable" ];
+      envsubst = extractWithPriority options [ "nixos" ] [ "services" "nginx" "enable" ];
+      configuration = lib.mkIf config.nixos.services.nginx.enable (lib.singleton {
+        daemon = "off";
+        worker_processes = 8;
+        user = "nginx";
+
+        events."" = {
+          use = "epoll";
+          worker_connections = 512;
+        };
+
+        error_log = [
+          "/dev/stderr"
+          "warn"
+        ];
+
+        pid = "/nginx.pid";
+
+        http."" =
+          [
+            {
+              server_tokens = "off";
+              include = [ [ "${pkgs.nginx}/conf/mime.types" ] ];
+              charset = "utf-8";
+              access_log = [
+                "/dev/stdout"
+                "combined"
+              ];
+
+              # $connection_upgrade is used for websocket proxying
+              map."$$http_upgrade $$connection_upgrade" = {
+                default = "upgrade";
+                "''"     = "close";
+              };
+            }
+          ]
+          ++ (lib.optionals cfg.recommendedProxySettings [
+              {
+                proxy_redirect          = "off";
+                proxy_connect_timeout   = cfg.proxyTimeout;
+                proxy_send_timeout      = cfg.proxyTimeout;
+                proxy_read_timeout      = cfg.proxyTimeout;
+                proxy_http_version      = "1.1";
+                # don't let clients close the keep-alive connection to upstream. See the nginx blog for details:
+                # https://www.nginx.com/blog/avoiding-top-10-nginx-configuration-mistakes/#no-keepalives
+                proxy_set_header        = ["Connection" "''"];
+              }
+              recommendedProxyConfig
+            ])
+          ++ (lib.flip lib.mapAttrsToList cfg.virtualHosts (
+            server_name: server: {
+              server."" = {
+                listen = [
+                  "80"
+                  "http2"
+                ];
+                inherit server_name;
+
+                location = lib.flip lib.mapAttrs server.locations (
+                  location: settings: [
+                    (lib.optionalAttrs (settings.proxyPass != null && cfg.recommendedProxySettings)
+                      recommendedProxyConfig)
+                    (lib.optionalAttrs settings.proxyWebsockets {
+                      proxy_http_version = "1.1";
+                      proxy_set_header = [
+                        [ "Upgrade""$$http_upgrade" ]
+                        [ "Connection" "$$connection_upgrade" ]
+                      ];
+                    })
+                    settings.extraConfig
+                    (lib.optionalAttrs (settings.proxyPass != null) { proxy_pass = settings.proxyPass; })
+                  ]
+                );
+              };
+            }
+          ));
+      });
+    };
+  };
+}

modules/nixos/nix.nix

@@ -0,0 +1,15 @@
+{ lib, config, ... }:
+{
+  options = {
+    nixos.nix = {
+      settings = lib.mkOption {
+        type = lib.types.unspecified;
+        default = { };
+      };
+    };
+  };
+
+  config = {
+    nix.config = config.nixos.nix.settings;
+  };
+}

modules/nixos/oauth2-proxy.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+{
+  options = {
+    nixos.services.oauth2-proxy = lib.mkOption {
+      type = lib.types.unspecified;
+      default = { };
+    };
+  };
+}

modules/nixos/postgresql.nix

@@ -0,0 +1,13 @@
+{ lib, config, ... }:
+{
+  options = {
+    nixos.services.postgresql = lib.mkOption {
+      type = lib.types.unspecified;
+      default = { };
+    };
+  };
+
+  config = {
+    services.postgresql = config.nixos.services.postgresql;
+  };
+}