difftreelog
refactor nix secret module
in: trunk
17 files changed
Cargo.tomldiffbeforeafterboth--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,7 @@
[workspace]
members = ["crates/*", "cmds/*"]
resolver = "2"
+package.version = "0.1.0"
[workspace.dependencies]
nixlike = { path = "./crates/nixlike" }
cmds/fleet/src/cmds/secrets/mod.rsdiffbeforeafterboth1use crate::{1use crate::{2 better_nix_eval::Field,2 better_nix_eval::Field,3 command::MyCommand,4 fleetdata::{FleetSecret, FleetSharedSecret, SecretData},3 fleetdata::{FleetSecret, FleetSharedSecret, SecretData},5 host::Config,4 host::Config,6 nix_go, nix_go_json,5 nix_go, nix_go_json,9use chrono::{DateTime, Utc};8use chrono::{DateTime, Utc};10use clap::Parser;9use clap::Parser;11use owo_colors::OwoColorize;10use owo_colors::OwoColorize;12use serde::{de::DeserializeOwned, Deserialize};11use serde::Deserialize;13use std::{12use std::{14 collections::{BTreeSet, HashSet},13 collections::{BTreeSet, HashSet},15 io::{self, Cursor, Read},14 io::{self, Cursor, Read},16 path::{Path, PathBuf},15 path::PathBuf,17 str::FromStr,18};16};19use tabled::{Table, Tabled};17use tabled::{Table, Tabled};20use tempfile::tempdir;21use tokio::fs::{self, read_to_string};18use tokio::fs::read_to_string;22use tracing::{error, info, info_span, warn, Instrument};19use tracing::{error, info, info_span, warn, Instrument};232024#[derive(Parser)]21#[derive(Parser)]162}159}163160164async fn generate_pure(161async fn generate_pure(165 config: &Config,162 _config: &Config,166 _display_name: &str,163 _display_name: &str,167 secret: Field,164 _secret: Field,168 default_generator: Field,165 _default_generator: Field,169 owners: &[String],166 _owners: &[String],170) -> Result<FleetSecret> {167) -> Result<FleetSecret> {171 // TODO: pure secrets are supposed to be generated by nix daemon itself,172 // inside of a sandbox... But we aren't here yet.173 let config_field = &config.config_unchecked_field;174 let generator = nix_go!(secret.generator);175 let default_pkgs = &config.default_pkgs;176177 let call_package = nix_go!(default_pkgs.callPackage);178179 let generator = nix_go!(call_package(generator)(Obj {}));180 let generator = generator.build().await?;181 let generator = generator182 .get("out")183 .ok_or_else(|| anyhow!("missing generate out"))?;184185 let mut recipients = String::new();186 for owner in owners {187 let key = config.key(owner).await?;188 recipients.push_str(&format!("-r \"{key}\" "));189 }190 recipients.push_str("-e");191192 let out = tempdir()?;193194 let mut gen = MyCommand::new(generator);195 gen.env("rageArgs", recipients);196 gen.env(197 "out",198 out.path().to_str().expect("sane tempdir should be utf-8"),199 );200 gen.run().await.context("impure generator")?;201202 {203 let mut marker_path = out.path().to_owned();204 marker_path.push("marker");205 let marker = fs::read_to_string(&marker_path).await?;206 ensure!(marker == "SUCCESS", "generation not succeeded");168 bail!("pure generators are broken for now")207 }208209 let mut public_path = out.path().to_owned();210 public_path.push("public");211 let mut secret_path = out.path().to_owned();212 secret_path.push("secret");213 let public = fs::read_to_string(&public_path).await.ok();214 let secret = fs::read(&secret_path).await.ok();215 if let Some(secret) = &secret {216 ensure!(217 age::Decryptor::new(Cursor::new(&secret)).is_ok(),218 "builder produced non-encrypted value as secret, this is highly insecure, and not allowed."219 );220 }221222 let mut created_at_path = out.path().to_owned();223 created_at_path.push("created_at");224 let mut expires_at_path = out.path().to_owned();225 expires_at_path.push("expires_at");226227 async fn read_value<T: FromStr>(path: &Path) -> Result<T> {228 dbg!(path);229 let raw = fs::read(path).await?;230 let raw = String::from_utf8(raw)?;231 raw.parse().map_err(|_| anyhow!("fromStr failed"))232 }233234 let created_at = read_value(&created_at_path).await?;235 let expires_at = read_value(&expires_at_path).await.ok();236237 Ok(FleetSecret {238 created_at,239 expires_at,240 public,241 secret: secret.map(SecretData),242 })243}169}244async fn generate_impure(170async fn generate_impure(245 config: &Config,171 config: &Config,248 default_generator: Field,174 default_generator: Field,249 owners: &[String],175 owners: &[String],250) -> Result<FleetSecret> {176) -> Result<FleetSecret> {251 let config_field = &config.config_unchecked_field;252 let generator = nix_go!(secret.generator);177 let generator = nix_go!(secret.generator);253254 let on: String = nix_go_json!(default_generator.impureOn);178 let on: Option<String> = nix_go_json!(default_generator.impureOn);179180 let host = if let Some(on) = &on {181 config.host(on).await?182 } else {183 config.local_host()184 };185 let on_pkgs = host.pkgs().await?;255 let call_package = nix_go!(186 let call_package = nix_go!(on_pkgs.callPackage);256 config_field.hosts[{ on }]187 let mk_encrypt_secret = nix_go!(on_pkgs.mkEncryptSecret);257 .nixosSystem188258 .config189 let mut recipients = Vec::new();259 .nixpkgs190 for owner in owners {260 .resolvedPkgs261 .callPackage262 );263264 let host = config.host(&on).await?;191 let key = config.key(owner).await?;192 recipients.push(key);193 }194 let encrypt = nix_go!(mk_encrypt_secret(Obj {195 recipients: { recipients },196 }));265197266 let generator = nix_go!(call_package(generator)(Obj {}));198 let generator = nix_go!(call_package(generator)(Obj {199 encrypt,200 rustfmt_please_newline: { true },201 }));202267 let generator = generator.build().await?;203 let generator = generator.build().await?;268 let generator = generator204 let generator = generator269 .get("out")205 .get("out")270 .ok_or_else(|| anyhow!("missing generateImpure out"))?;206 .ok_or_else(|| anyhow!("missing generateImpure out"))?;271 let generator = host.remote_derivation(generator).await?;207 let generator = host.remote_derivation(generator).await?;272208273 let mut recipients = String::new();274 for owner in owners {275 let key = config.key(owner).await?;209 let out_parent = host.mktemp_dir().await?;276 recipients.push_str(&format!("-r \"{key}\" "));277 }278 recipients.push_str("-e");279280 let out = host.mktemp_dir().await?;210 let out = format!("{out_parent}/out");281211282 let mut gen = host.cmd(generator).await?;212 let mut gen = host.cmd(generator).await?;283 gen.env("rageArgs", recipients).env("out", &out);213 gen.env("out", &out);214 if on.is_none() {215 // This path is local, thus we can feed `OsString` directly to env var... But I don't think that's necessary to handle.216 let project_path: String = config217 .directory218 .clone()219 .into_os_string()220 .into_string()221 .map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;222 gen.env("FLEET_PROJECT", project_path);223 }284 gen.run().await.context("impure generator")?;224 gen.run().await.context("impure generator")?;285225286 {226 {551 }491 }552 Secret::ReadPublic {492 Secret::ReadPublic { name, machine } => {553 name,554 machine,555 } => {556 let secret = config.host_secret(&machine, &name)?;493 let secret = config.host_secret(&machine, &name)?;557 let Some(public) = secret.public else {494 let Some(public) = secret.public else {cmds/fleet/src/host.rsdiffbeforeafterboth--- a/cmds/fleet/src/host.rs
+++ b/cmds/fleet/src/host.rs
@@ -54,7 +54,7 @@
pub local: bool,
pub session: OnceLock<Arc<openssh::Session>>,
- pub nixos_config: Field,
+ pub nixos_config: Option<Field>,
}
impl ConfigHost {
async fn open_session(&self) -> Result<Arc<openssh::Session>> {
@@ -169,7 +169,9 @@
}
pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {
- let nixos = &self.nixos_config;
+ let Some(nixos) = &self.nixos_config else {
+ return Ok(vec![]);
+ };
let secrets = nix_go!(nixos.secrets);
let mut out = Vec::new();
for name in secrets.list_fields().await? {
@@ -183,9 +185,19 @@
Ok(out)
}
pub async fn secret_field(&self, name: &str) -> Result<Field> {
- let nixos = &self.nixos_config;
+ let Some(nixos) = &self.nixos_config else {
+ bail!("host is virtual and has no secrets");
+ };
Ok(nix_go!(nixos.secrets[{ name }]))
}
+
+ /// Packages for this host, resolved with nixpkgs overlays
+ pub async fn pkgs(&self) -> Result<Field> {
+ let Some(nixos) = &self.nixos_config else {
+ return Ok(self.config.default_pkgs.clone());
+ };
+ Ok(nix_go!(nixos.nixpkgs.resolvedPkgs))
+ }
}
impl Config {
@@ -202,6 +214,16 @@
self.opts.localhost.as_ref().map(|s| s as &str) == Some(host)
}
+ pub fn local_host(&self) -> ConfigHost {
+ ConfigHost {
+ config: self.clone(),
+ name: "<virtual localhost>".to_owned(),
+ local: true,
+ session: OnceLock::new(),
+ nixos_config: None,
+ }
+ }
+
pub async fn host(&self, name: &str) -> Result<ConfigHost> {
let config = &self.config_unchecked_field;
let nixos_config = nix_go!(config.hosts[{ name }].nixosSystem.config);
@@ -210,7 +232,7 @@
name: name.to_owned(),
local: self.is_local(name),
session: OnceLock::new(),
- nixos_config,
+ nixos_config: Some(nixos_config),
})
}
pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {
cmds/fleet/src/main.rsdiffbeforeafterboth--- a/cmds/fleet/src/main.rs
+++ b/cmds/fleet/src/main.rs
@@ -11,7 +11,6 @@
mod fleetdata;
-use std::time::Duration;
use std::{ffi::OsString, process::ExitCode};
use anyhow::{bail, Result};
@@ -158,7 +157,7 @@
let reg = tracing_subscriber::registry().with({
let sub = tracing_subscriber::fmt::layer()
.without_time()
- .with_target(true);
+ .with_target(false);
#[cfg(feature = "indicatif")]
let sub = sub.with_writer(indicatif_layer.get_stdout_writer());
sub.with_filter(filter) // .withou,
cmds/install-secrets/src/main.rsdiffbeforeafterboth--- a/cmds/install-secrets/src/main.rs
+++ b/cmds/install-secrets/src/main.rs
@@ -13,7 +13,7 @@
use std::path::Path;
use std::str::{from_utf8, FromStr};
use std::{collections::HashMap, path::PathBuf};
-use tracing::{error, info, warn};
+use tracing::{error, info, info_span, warn};
use tracing_subscriber::filter::LevelFilter;
use tracing_subscriber::EnvFilter;
@@ -213,12 +213,9 @@
let mut failed = false;
for (name, value) in data {
- info!("initializing secret {name}");
+ let _span = info_span!("init", name = name);
if let Err(e) = init_secret(&identity, value) {
- error!(
- "{:?}",
- e.context(format!("failed to initialize secret {}", name))
- );
+ error!("{e}");
failed = true;
}
}
@@ -237,6 +234,7 @@
.from_env_lossy(),
)
.without_time()
+ .with_target(false)
.init();
let opts = Opts::parse();
crates/better-command/src/handler.rsdiffbeforeafterboth--- a/crates/better-command/src/handler.rs
+++ b/crates/better-command/src/handler.rs
@@ -274,7 +274,10 @@
#[cfg(feature = "indicatif")]
span.pb_set_message(&process_message(s.trim()));
#[cfg(not(feature = "indicatif"))]
- info!("{}", process_message(s));
+ {
+ let _span = span.enter();
+ info!("{}", process_message(s));
+ }
} else {
warn!("bad fields: {fields:?}");
}
crates/better-command/src/lib.rsdiffbeforeafterboth--- a/crates/better-command/src/lib.rs
+++ b/crates/better-command/src/lib.rs
@@ -1,5 +1,5 @@
mod handler;
-pub use handler::{Handler, PlainHandler, NoopHandler, NixHandler, ClonableHandler};
+pub use handler::{ClonableHandler, Handler, NixHandler, NoopHandler, PlainHandler};
pub fn add(left: usize, right: usize) -> usize {
left + right
flake.lockdiffbeforeafterboth--- a/flake.lock
+++ b/flake.lock
@@ -1,26 +1,28 @@
{
"nodes": {
- "flake-utils": {
+ "crane": {
"inputs": {
- "systems": "systems"
+ "nixpkgs": [
+ "nixpkgs"
+ ]
},
"locked": {
- "lastModified": 1705309234,
- "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
- "owner": "numtide",
- "repo": "flake-utils",
- "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+ "lastModified": 1712681629,
+ "narHash": "sha256-bMDXn4AkTXLCpoZbII6pDGoSeSe9gI87jxPsHRXgu/E=",
+ "owner": "ipetkov",
+ "repo": "crane",
+ "rev": "220387ac8e99cbee0ca4c95b621c4bc782b6a235",
"type": "github"
},
"original": {
- "owner": "numtide",
- "repo": "flake-utils",
+ "owner": "ipetkov",
+ "repo": "crane",
"type": "github"
}
},
- "flake-utils_2": {
+ "flake-utils": {
"inputs": {
- "systems": "systems_2"
+ "systems": "systems"
},
"locked": {
"lastModified": 1705309234,
@@ -54,6 +56,7 @@
},
"root": {
"inputs": {
+ "crane": "crane",
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs",
"rust-overlay": "rust-overlay"
@@ -61,7 +64,9 @@
},
"rust-overlay": {
"inputs": {
- "flake-utils": "flake-utils_2",
+ "flake-utils": [
+ "flake-utils"
+ ],
"nixpkgs": [
"nixpkgs"
]
@@ -81,21 +86,6 @@
}
},
"systems": {
- "locked": {
- "lastModified": 1681028828,
- "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
- "owner": "nix-systems",
- "repo": "default",
- "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
- "type": "github"
- },
- "original": {
- "owner": "nix-systems",
- "repo": "default",
- "type": "github"
- }
- },
- "systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
flake.nixdiffbeforeafterboth--- a/flake.nix
+++ b/flake.nix
@@ -5,15 +5,23 @@
nixpkgs.url = "github:nixos/nixpkgs/master";
rust-overlay = {
url = "github:oxalica/rust-overlay";
+ inputs = {
+ nixpkgs.follows = "nixpkgs";
+ flake-utils.follows = "flake-utils";
+ };
+ };
+ flake-utils.url = "github:numtide/flake-utils";
+ crane = {
+ url = "github:ipetkov/crane";
inputs.nixpkgs.follows = "nixpkgs";
};
- flake-utils = {url = "github:numtide/flake-utils";};
};
outputs = {
self,
rust-overlay,
flake-utils,
nixpkgs,
+ crane,
}:
with nixpkgs.lib;
{
@@ -26,20 +34,16 @@
inherit system;
overlays = [(import rust-overlay)];
};
- llvmPkgs = pkgs.buildPackages.llvmPackages_11;
- rust =
- (pkgs.rustChannelOf {
- date = "2024-02-10";
- channel = "nightly";
- })
- .default
- .override {extensions = ["rust-src" "rust-analyzer"];};
+ rust = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+ craneLib = (crane.mkLib pkgs).overrideToolchain rust;
in {
- packages = (import ./pkgs) pkgs pkgs;
- devShell = (pkgs.mkShell.override {stdenv = llvmPkgs.stdenv;}) {
+ packages = import ./pkgs {
+ inherit (pkgs) callPackage;
+ inherit craneLib;
+ };
+ devShell = craneLib.devShell {
nativeBuildInputs = with pkgs; [
alejandra
- rust
lld
cargo-edit
cargo-udeps
lib/default.nixdiffbeforeafterboth--- a/lib/default.nix
+++ b/lib/default.nix
@@ -10,11 +10,14 @@
hosts,
modules,
globalModules ? [],
+ extraFleetLib ? {},
}: let
hostNames = nixpkgs.lib.attrNames hosts;
- fleetLib = import ./fleetLib.nix {
- inherit nixpkgs hostNames;
- };
+ fleetLib =
+ (import ./fleetLib.nix {
+ inherit nixpkgs hostNames;
+ })
+ // extraFleetLib;
in let
root = nixpkgs.lib.evalModules {
modules =
lib/fleetLib.nixdiffbeforeafterboth--- a/lib/fleetLib.nix
+++ b/lib/fleetLib.nix
@@ -39,4 +39,32 @@
mkFleetDefault = mkOverride 999;
# Some generators use mkDefault, but optionDefault is set by nixpkgs.
mkFleetGeneratorDefault = mkOverride 1001;
+
+ mkPassword = {size ? 32}: {
+ coreutils,
+ encrypt,
+ mkSecretGenerator,
+ }:
+ mkSecretGenerator {
+ script = ''
+ ${coreutils}/bin/tr -dc 'A-Za-z0-9!?%=' < /dev/random \
+ | ${coreutils}/bin/head -c ${toString size} \
+ | ${encrypt} > $out/secret
+ '';
+ };
+
+ mkRsa = {size ? 4096}: {
+ openssl,
+ encrypt,
+ mkSecretGenerator,
+ }:
+ mkSecretGenerator {
+ script = ''
+ ${openssl}/bin/openssl genrsa -out rsa_private.key ${toString size}
+ ${openssl}/bin/openssl rsa -in rsa_private.key -pubout -out rsa_public.key
+
+ sudo cat rsa_private.key | ${encrypt} > $out/secret
+ sudo cat rsa_public.key > $out/public
+ '';
+ };
}
modules/fleet/secrets.nixdiffbeforeafterboth--- a/modules/fleet/secrets.nix
+++ b/modules/fleet/secrets.nix
@@ -8,6 +8,13 @@
with fleetLib; let
sharedSecret = with types; ({config, ...}: {
options = {
+ managed = mkOption {
+ type = bool;
+ description = ''
+ Is this secret managed by configuration (I.e will work with reencrypt/etc), or it is configured by user
+ '';
+ };
+
expectedOwners = mkOption {
type = nullOr (listOf str);
description = ''
@@ -146,77 +153,81 @@
overlays = [
(final: prev: let
lib = final.lib;
+ inherit (lib) strings;
+ inherit (strings) escapeShellArgs;
in {
- mkPassword = {size ? 32}:
- final.mkSecretGenerator ''
- ${final.coreutils}/bin/tr -dc 'A-Za-z0-9!?%=' < /dev/random \
- | ${final.coreutils}/bin/head -c ${toString size} \
- | encrypt > $out/secret
- '';
- mkRsa = {size ? 4096}:
- final.mkSecretGenerator ''
- ${final.openssl}/bin/openssl genrsa -out rsa_private.key ${toString size}
- ${final.openssl}/bin/openssl rsa -in rsa_private.key -pubout -out rsa_public.key
-
- sudo cat rsa_private.key | encrypt > $out/secret
- sudo cat rsa_public.key > $out/public
+ mkEncryptSecret = {
+ rage ? prev.rage,
+ recipients,
+ }:
+ prev.writeShellScript "encryptor" ''
+ #!/bin/sh
+ exec ${rage}/bin/rage ${escapeShellArgs recipients} -e "$@"
'';
# TODO: Move to fleet
# TODO: Merge both generators to one with consistent options syntax?
# Impure generator is built on local machine, then built closure is copied to remote machine,
# and then it is ran in inpure context, so that this generator may access HSMs and other things.
- mkImpureSecretGenerator = generatorText: machine:
+ mkImpureSecretGenerator = {
+ script,
+ # If set - script will be run on remote machine, otherwise it will be run with fleet project in CWD
+ # (Some secrets-encryption-in-git/managed PKI solution is expected)
+ impureOn ? null,
+ }:
(prev.writeShellScript "impureGenerator.sh" ''
#!/bin/sh
set -eu
-
- # TODO: Provide encryption function as script passed to `callPackage generator {encrypt = ...;}`
- function encrypt() {
- eval ${final.rage}/bin/rage $rageArgs
- }
+ cd /var/empty
created_at=$(date -u +"%Y-%m-%dT%H:%M:%S.%NZ")
- echo -n $created_at > $out/created_at
- ${generatorText}
+ ${script}
+ if ! test -d $out; then
+ echo "impure generator script did not produce expected \$out output"
+ exit 1
+ fi
+
+ echo -n $created_at > $out/created_at
echo -n SUCCESS > $out/marker
'')
.overrideAttrs (old: {
passthru = {
+ inherit impureOn;
generatorKind = "impure";
- impureOn = machine;
};
});
+ # Pure generators are disabled for now
+ mkSecretGenerator = {script}: final.mkImpureSecretGenerator {inherit script;};
+
# TODO: Implement consistent naming
# Pure secret generator is supposed to be run entirely by nix, using `__impure` derivation type...
# But for now, it is ran the same way as `impureSecretGenerator`, but on the local machine.
- mkSecretGenerator = generatorText:
- (prev.writeShellScript "generator.sh" ''
- #!/bin/sh
- set -eu
- # TODO: User should create output directory by themselves.
- cd $out
-
- # TODO: Provide encryption function as script passed to `callPackage generator {encrypt = ...;}`
- function encrypt() {
- eval ${final.rage}/bin/rage $rageArgs
- }
-
- created_at=$(date -u +"%Y-%m-%dT%H:%M:%S.%NZ")
- echo -n $created_at > $out/created_at
-
- ${generatorText}
-
- echo -n SUCCESS > $out/marker
- '')
- .overrideAttrs (old: {
- passthru = {
- generatorKind = "pure";
- };
- # TODO: make nix daemon build secret, not just the script.
- # __impure = true;
- });
+ # mkSecretGenerator = {script}:
+ # (prev.writeShellScript "generator.sh" ''
+ # #!/bin/sh
+ # set -eu
+ # # TODO: make nix daemon build secret, not just the script.
+ # cd /var/empty
+ #
+ # created_at=$(date -u +"%Y-%m-%dT%H:%M:%S.%NZ")
+ #
+ # ${script}
+ # if ! test -d $out; then
+ # echo "impure generator script did not produce expected \$out output"
+ # exit 1
+ # fi
+ #
+ # echo -n $created_at > $out/created_at
+ # echo -n SUCCESS > $out/marker
+ # '')
+ # .overrideAttrs (old: {
+ # passthru = {
+ # generatorKind = "pure";
+ # };
+ # # TODO: make nix daemon build secret, not just the script.
+ # # __impure = true;
+ # });
})
];
};
nixos/fleetPkgs.nixdiffbeforeafterboth--- a/nixos/fleetPkgs.nix
+++ b/nixos/fleetPkgs.nix
@@ -1,3 +1,24 @@
-{ ... }: {
- nixpkgs.overlays = [ (import ../pkgs) ];
+{...}: {
+ nixpkgs.overlays = [
+ # Not using craneLib here, because we don't want to have two different rust versions for some platforms.
+ (final: prev: {
+ fleet-install-secrets = prev.callPackage ({rustPlatform}:
+ rustPlatform.buildRustPackage rec {
+ pname = "fleet-install-secrets";
+ name = "${pname}";
+
+ src = ../.;
+ strictDeps = true;
+
+ buildAndTestSubdir = "cmds/install-secrets";
+
+ cargoLock = {
+ lockFile = ../Cargo.lock;
+ outputHashes = {
+ "alejandra-3.0.0" = "sha256-lStDIPizbJipd1JpNKX1olBKzyIosyC2U/mVFwJPcZE=";
+ };
+ };
+ }) {};
+ })
+ ];
}
pkgs/default.nixdiffbeforeafterboth--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,6 +1,9 @@
-pkgs: super:
-with pkgs;
{
- fleet-install-secrets = callPackage ./fleet-install-secrets.nix { };
- fleet = callPackage ./fleet.nix { };
+ callPackage,
+ craneLib,
+}: rec {
+ default = fleet;
+
+ fleet-install-secrets = callPackage ./fleet-install-secrets.nix {inherit craneLib;};
+ fleet = callPackage ./fleet.nix {inherit craneLib;};
}
pkgs/fleet-install-secrets.nixdiffbeforeafterboth--- a/pkgs/fleet-install-secrets.nix
+++ b/pkgs/fleet-install-secrets.nix
@@ -1,16 +1,9 @@
-{ rustPlatform, lib }:
-
-rustPlatform.buildRustPackage rec {
+{craneLib}:
+craneLib.buildPackage rec {
pname = "fleet-install-secrets";
- version = "0.0.1";
- name = "${pname}-${version}";
- src = ../.;
- buildAndTestSubdir = "cmds/install-secrets";
- cargoLock = {
- lockFile = ../Cargo.lock;
- outputHashes = {
- "alejandra-3.0.0" = "sha256-lStDIPizbJipd1JpNKX1olBKzyIosyC2U/mVFwJPcZE=";
- };
- };
+ src = craneLib.cleanCargoSource (craneLib.path ../.);
+ strictDeps = true;
+
+ cargoExtraArgs = "--locked -p ${pname}";
}
pkgs/fleet.nixdiffbeforeafterboth--- a/pkgs/fleet.nix
+++ b/pkgs/fleet.nix
@@ -1,16 +1,9 @@
-{ rustPlatform }:
-
-rustPlatform.buildRustPackage rec {
+{craneLib}:
+craneLib.buildPackage rec {
pname = "fleet";
- version = "0.0.1";
- name = "${pname}-${version}";
- src = ../.;
- cargoBuildFlags = "-p ${pname}";
- cargoLock = {
- lockFile = ../Cargo.lock;
- outputHashes = {
- "alejandra-3.0.0" = "sha256-YSdHsJ73G7TEFzbmpZ2peuMefIa9/vNB2g+xdiyma3U=";
- };
- };
+ src = craneLib.cleanCargoSource (craneLib.path ../.);
+ strictDeps = true;
+
+ cargoExtraArgs = "--locked -p ${pname}";
}
rust-toolchain.tomldiffbeforeafterboth--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "nightly-2024-02-10"
+components = ["rustfmt", "clippy", "rust-analyzer", "rust-src"]