Updates over time

lib/fudo/client/dns.nix

@@ -80,11 +80,7 @@ in {
         };
       };
 
-      groups = {
+      groups = { "${cfg.user}" = { members = [ cfg.user ]; }; };
-        "${cfg.user}" = {
-          members = [ cfg.user ];
-        };
-      };
     };
 
     systemd = {
@@ -104,7 +100,7 @@ in {
 
       services.backplane-dns-client-pw-file = {
         enable = true;
-        requiredBy = [ "backplane-dns-client.services" ];
+        requiredBy = [ "backplane-dns-client.service" ];
         reloadIfChanged = true;
         serviceConfig = { Type = "oneshot"; };
         script = ''

lib/fudo/prometheus.nix

@@ -8,6 +8,13 @@ in {
   options.fudo.metrics.prometheus = with types; {
     enable = mkEnableOption "Fudo Prometheus Data-Gathering Server";
 
+    package = mkOption {
+      type = package;
+      default = pkgs.prometheus;
+      defaultText = literalExpression "pkgs.prometheus";
+      description = "The prometheus package that should be used.";
+    };
+
     service-discovery-dns = mkOption {
       type = attrsOf (listOf str);
       description = ''
@@ -119,9 +126,10 @@ in {
     services.prometheus = {
 
       enable = true;
-
       webExternalUrl = "https://${cfg.hostname}";
 
+      package = cfg.package;
+
       listenAddress = "127.0.0.1";
       port = 9090;
 
@@ -131,14 +139,14 @@ in {
           honor_labels = false;
           scheme = if cfg.private-network then "http" else "https";
           metrics_path = "/metrics/${type}";
-          dns_sd_configs = if (hasAttr type cfg.service-discovery-dns) then [{
-            names = cfg.service-discovery-dns.${type};
-          }] else
-            [ ];
           static_configs = if (hasAttr type cfg.static-targets) then [{
             targets = cfg.static-targets.${type};
           }] else
             [ ];
+          dns_sd_configs = if (hasAttr type cfg.service-discovery-dns) then [{
+            names = cfg.service-discovery-dns.${type};
+          }] else
+            [ ];
         };
       in map make-job [ "docker" "node" "dovecot" "postfix" "rspamd" ];
 

lib/fudo/system.nix

@@ -431,11 +431,11 @@ in {
         SecureBits = mkIf ((length opts.requiredCapabilities) > 0) "keep-caps";
 
         DynamicUser = mkIf (opts.user == null) opts.dynamicUser;
+
         Restart = opts.restartWhen;
         WorkingDirectory =
           mkIf (opts.workingDirectory != null) opts.workingDirectory;
-        RestrictAddressFamilies =
+        RestrictAddressFamilies = optionals (opts.addressFamilies != null)
-          optionals (opts.addressFamilies != null)
           (restrict-address-families opts.addressFamilies);
         RestrictNamespaces = opts.restrictNamespaces;
         User = mkIf (opts.user != null) opts.user;

lib/types/host.nix

@@ -1,11 +1,11 @@
 { lib, ... }:
 
 with lib;
-let
+let passwd = import ../passwd.nix { inherit lib; };
-  passwd = import ../passwd.nix { inherit lib; };
 
 in rec {
-  encryptedFSOpts = { ... }: let
+  encryptedFSOpts = { ... }:
+    let
       mountpoint = { mp, ... }: {
         options = with types; {
           mountpoint = mkOption {
@@ -16,7 +16,8 @@ in rec {
 
           options = mkOption {
             type = listOf str;
-          description = "List of filesystem options specific to this mountpoint (eg: subvol).";
+            description =
+              "List of filesystem options specific to this mountpoint (eg: subvol).";
           };
 
           group = mkOption {
@@ -70,7 +71,8 @@ in rec {
 
         mountpoints = mkOption {
           type = attrsOf (submodule mountpoint);
-        description = "A map of mountpoints for this filesystem to fs options. Multiple to support btrfs.";
+          description =
+            "A map of mountpoints for this filesystem to fs options. Multiple to support btrfs.";
           default = { };
         };
       };
@@ -80,23 +82,26 @@ in rec {
     options = with types; {
       key-path = mkOption {
         type = str;
-        description = "Path of the host master key file, used to decrypt secrets.";
+        description =
+          "Path of the host master key file, used to decrypt secrets.";
       };
 
       public-key = mkOption {
         type = str;
-        description = "Public key used during deployment to decrypt secrets for the host.";
+        description =
+          "Public key used during deployment to decrypt secrets for the host.";
       };
     };
   };
 
-  hostOpts = { name, ... }: let
+  hostOpts = { name, ... }:
-    hostname = name;
+    let hostname = name;
     in {
       options = with types; {
         master-key = mkOption {
           type = nullOr (submodule masterKeyOpts);
-        description = "Public key for the host master key, used by the host to decrypt secrets.";
+          description =
+            "Public key for the host master key, used by the host to decrypt secrets.";
         };
 
         domain = mkOption {
@@ -204,8 +209,7 @@ in rec {
 
         ssh-pubkeys = mkOption {
           type = listOf path;
-        description =
+          description = "SSH key files of the host.";
-          "SSH key files of the host.";
           default = [ ];
         };
 
@@ -254,7 +258,8 @@ in rec {
 
         encrypted-filesystems = mkOption {
           type = attrsOf (submodule encryptedFSOpts);
-        description = "List of encrypted filesystems to mount on the local host when the key is available.";
+          description =
+            "List of encrypted filesystems to mount on the local host when the key is available.";
           default = { };
         };
 
@@ -269,7 +274,8 @@ in rec {
             options = {
               ip = mkOption {
                 type = nullOr str;
-              description = "IP address assigned to this host in the WireGuard network.";
+                description =
+                  "IP address assigned to this host in the WireGuard network.";
               };
 
               bound = mkOption {
@@ -322,7 +328,8 @@ in rec {
             options = {
               ip = mkOption {
                 type = str;
-              description = "IP to assign to the initrd image, allowing access to host during bootup.";
+                description =
+                  "IP to assign to the initrd image, allowing access to host during bootup.";
               };
               keypair = mkOption {
                 type = (submodule keypair-type);
@@ -330,20 +337,23 @@ in rec {
               };
               interface = mkOption {
                 type = str;
-              description = "Name of interface on which to listen for connections.";
+                description =
+                  "Name of interface on which to listen for connections.";
               };
             };
           };
 
         in mkOption {
           type = nullOr (submodule initrd-network-config);
-        description = "Configuration parameters to set up initrd SSH network.";
+          description =
+            "Configuration parameters to set up initrd SSH network.";
           default = null;
         };
 
         backplane-password-file = mkOption {
-        options = path;
+          type = path;
-        description = "File containing the password used by this host to connect to the backplane.";
+          description =
+            "File containing the password used by this host to connect to the backplane.";
         };
       };
     };