Something went wrong. Try again.
ALPHA: wire is a tool to deploy nixos systems (contribution fork)
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225# SPDX-License-Identifier: AGPL-3.0-or-later# Copyright 2024-2025 wire Contributors
{ lib, name, ...}:let inherit (lib) types;in{ imports = let inherit (lib) mkAliasOptionModule; in [ (mkAliasOptionModule [ "deployment" "targetHost" ] [ "deployment" "target" "hosts" ]) (mkAliasOptionModule [ "deployment" "targetUser" ] [ "deployment" "target" "user" ]) (mkAliasOptionModule [ "deployment" "targetPort" ] [ "deployment" "target" "port" ]) ];
options.deployment = { target = lib.mkOption { type = types.submodule { imports = [ (lib.mkAliasOptionModule [ "host" ] [ "hosts" ]) ]; options = { hosts = lib.mkOption { type = types.coercedTo types.str lib.singleton (types.listOf types.str); description = "IPs or hostnames to attempt to connect to. They are tried in order."; default = lib.singleton name; apply = lib.unique; }; user = lib.mkOption { type = types.str; description = "User to use for SSH. The user must be atleast `wheel` and must use an SSH key or similar non-interactive login method. More information can be found at https://wire.althaea.zone/guides/non-root-user"; default = "root"; }; port = lib.mkOption { type = types.int; default = 22; description = "SSH port to use."; }; }; }; description = "Describes the target for this node"; default = { }; };
rollback = lib.mkOption { type = types.bool; default = true; description = "Attempt to rollback this node if it cannot be contacted after activation."; };
buildOnTarget = lib.mkOption { type = types.bool; default = false; description = "Whether to build the system on the target host or not."; };
allowLocalDeployment = lib.mkOption { type = types.bool; default = true; description = "Whether to allow or deny this node being applied to localhost when the host's hostname matches the node's name."; };
tags = lib.mkOption { type = types.listOf types.str; default = [ ]; description = "Tags for node."; example = [ "arm" "cloud" ]; };
privilegeEscalationCommand = lib.mkOption { type = types.listOf types.str; description = "Command to elevate."; default = [ "sudo" "--" ]; };
replaceUnknownProfiles = lib.mkOption { type = types.bool; description = "No-op, colmena compatibility"; default = true; };
sshOptions = lib.mkOption { type = types.listOf types.str; description = "No-op, colmena compatibility"; default = [ ]; };
_keys = lib.mkOption { internal = true; readOnly = true; };
_hostPlatform = lib.mkOption { internal = true; readOnly = true; };
keys = lib.mkOption { type = types.attrsOf ( types.submodule ( { name, config, ... }: { imports = let inherit (lib) mkAliasOptionModule; in [ (mkAliasOptionModule [ "keyFile" ] [ "source" ]) (mkAliasOptionModule [ "keyCommand" ] [ "source" ]) (mkAliasOptionModule [ "text" ] [ "source" ]) ]; options = { name = lib.mkOption { type = types.str; default = name; description = "Filename of the secret."; }; destDir = lib.mkOption { type = types.path; default = "/run/keys/"; description = "Destination directory for the secret. Change this to something other than `/run/keys/` for keys to persist past reboots."; }; path = lib.mkOption { internal = true; type = types.path; default = if lib.hasSuffix "/" config.destDir then "${config.destDir}${config.name}" else "${config.destDir}/${config.name}"; description = "Path that the key is deployed to."; }; service = lib.mkOption { internal = true; type = types.str; default = "${config.name}-key.service"; description = "Name of the systemd service that represents this key."; }; group = lib.mkOption { type = types.str; default = "root"; description = "Group to own the key. If this group does not exist this will silently fail and the key will be owned by gid 0."; }; user = lib.mkOption { type = types.str; default = "root"; description = "User to own the key. If this user does not exist this will silently fail and the key will be owned by uid 0."; }; permissions = lib.mkOption { type = types.str; default = "0600"; description = "Unix Octal permissions, in string format, for the key."; }; source = lib.mkOption { type = types.oneOf [ types.str types.path (types.listOf types.str) ]; description = "Source of the key. Either a path to a file, a literal string, or a command to generate the key."; }; uploadAt = lib.mkOption { type = types.enum [ "pre-activation" "post-activation" ]; default = "pre-activation"; description = "When to upload the key. Either `pre-activation` or `post-activation`."; }; environment = lib.mkOption { type = types.attrsOf types.str; default = { }; description = "Key-Value environment variables to use when creating the key if the key source is a command."; }; }; } ) ); description = "Secrets to be deployed to the node."; default = { }; example = { "wireless.env" = { source = [ "gpg" "--decrypt" "secrets/wireless.env.gpg" ]; destDir = "/etc/keys/"; };
"arbfile.txt" = { source = ./arbfile.txt; destDir = "/etc/arbs/"; };
"arberfile.txt" = { source = '' Hello World ''; destDir = "/etc/arbs/"; }; }; }; };}