nix-required-mounts: nixfmt

This commit is contained in:
Someone Serge 2024-06-20 21:33:51 +00:00
parent ff430d1699
commit ebeb6b9d1d
11 changed files with 183 additions and 178 deletions

View File

@ -1,10 +1,16 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.programs.nix-required-mounts;
package = pkgs.nix-required-mounts;
Mount = with lib;
Mount =
with lib;
types.submodule {
options.host = mkOption {
type = types.str;
@ -15,25 +21,30 @@ let
description = "Location in the sandbox to mount the host path at";
};
};
Pattern = with lib.types;
types.submodule ({ config, name, ... }: {
Pattern =
with lib.types;
types.submodule (
{ config, name, ... }:
{
options.onFeatures = lib.mkOption {
type = listOf types.str;
description =
"Which requiredSystemFeatures should trigger relaxation of the sandbox";
description = "Which requiredSystemFeatures should trigger relaxation of the sandbox";
default = [ name ];
};
options.paths = lib.mkOption {
type = listOf (oneOf [ path Mount ]);
description =
"A list of glob patterns, indicating which paths to expose to the sandbox";
type = listOf (oneOf [
path
Mount
]);
description = "A list of glob patterns, indicating which paths to expose to the sandbox";
};
options.unsafeFollowSymlinks = lib.mkEnableOption ''
Instructs the hook to mount the symlink targets as well, when any of
the `paths` contain symlinks. This may not work correctly with glob
patterns.
'';
});
}
);
driverPaths = [
pkgs.addOpenGLRunpath.driverLink
@ -53,8 +64,7 @@ in
{
meta.maintainers = with lib.maintainers; [ SomeoneSerge ];
options.programs.nix-required-mounts = {
enable = lib.mkEnableOption
"Expose extra paths to the sandbox depending on derivations' requiredSystemFeatures";
enable = lib.mkEnableOption "Expose extra paths to the sandbox depending on derivations' requiredSystemFeatures";
presets.nvidia-gpu.enable = lib.mkEnableOption ''
Declare the support for derivations that require an Nvidia GPU to be
available, e.g. derivations with `requiredSystemFeatures = [ "cuda" ]`.
@ -64,11 +74,11 @@ in
You may extend or override the exposed paths via the
`programs.nix-required-mounts.allowedPatterns.nvidia-gpu.paths` option.
'';
allowedPatterns = with lib.types;
allowedPatterns =
with lib.types;
lib.mkOption rec {
type = attrsOf Pattern;
description =
"The hook config, describing which paths to mount for which system features";
description = "The hook config, describing which paths to mount for which system features";
default = { };
defaultText = lib.literalExpression ''
{
@ -86,22 +96,17 @@ in
extraWrapperArgs = lib.mkOption {
type = with lib.types; listOf str;
default = [ ];
description =
lib.mdDoc
"List of extra arguments (such as `--add-flags -v`) to pass to the hook's wrapper";
description = "List of extra arguments (such as `--add-flags -v`) to pass to the hook's wrapper";
};
package = lib.mkOption {
type = lib.types.package;
default = package.override {
inherit (cfg)
allowedPatterns
extraWrapperArgs;
};
description = lib.mdDoc "The final package with the final config applied";
default = package.override { inherit (cfg) allowedPatterns extraWrapperArgs; };
description = "The final package with the final config applied";
internal = true;
};
};
config = lib.mkIf cfg.enable (lib.mkMerge [
config = lib.mkIf cfg.enable (
lib.mkMerge [
{ nix.settings.pre-build-hook = lib.getExe cfg.package; }
(lib.mkIf cfg.presets.nvidia-gpu.enable {
nix.settings.system-features = cfg.allowedPatterns.nvidia-gpu.onFeatures;
@ -109,5 +114,6 @@ in
inherit (defaults) nvidia-gpu;
};
})
]);
]
);
}

View File

@ -1,6 +1,4 @@
{ pkgs
, ...
}:
{ pkgs, ... }:
let
inherit (pkgs) lib;
@ -9,7 +7,9 @@ in
{
name = "nix-required-mounts";
meta.maintainers = with lib.maintainers; [ SomeoneSerge ];
nodes.machine = { config, pkgs, ... }: {
nodes.machine =
{ config, pkgs, ... }:
{
virtualisation.writableStore = true;
system.extraDependencies = [ (pkgs.runCommand "deps" { } "mkdir $out").inputDerivation ];
nix.nixPath = [ "nixpkgs=${../../..}" ];

View File

@ -1,8 +1,9 @@
{ pkgs ? import <nixpkgs> { }, feature }:
pkgs.runCommandNoCC "${feature}-not-present"
{
} ''
pkgs ? import <nixpkgs> { },
feature,
}:
pkgs.runCommandNoCC "${feature}-not-present" { } ''
if [[ -e /${feature}-files ]]; then
echo "No ${feature} in requiredSystemFeatures, but /${feature}-files was mounted anyway"
exit 1
@ -10,4 +11,3 @@ pkgs.runCommandNoCC "${feature}-not-present"
touch $out
fi
''

View File

@ -1,9 +1,9 @@
{ pkgs ? import <nixpkgs> { }, feature }:
pkgs.runCommandNoCC "${feature}-present"
{
requiredSystemFeatures = [ feature ];
} ''
pkgs ? import <nixpkgs> { },
feature,
}:
pkgs.runCommandNoCC "${feature}-present" { requiredSystemFeatures = [ feature ]; } ''
if [[ ! -e /${feature}-files ]]; then
echo "The host declares ${feature} support, but doesn't expose /${feature}-files" >&2
exit 1

View File

@ -1,10 +1,8 @@
{ pkgs ? import <nixpkgs> { } }:
pkgs.runCommandNoCC "nix-required-mounts-structured-attrs-no-features"
{
__structuredAttrs = true;
} ''
pkgs ? import <nixpkgs> { },
}:
pkgs.runCommandNoCC "nix-required-mounts-structured-attrs-no-features" { __structuredAttrs = true; }
''
touch $out
''

View File

@ -1,10 +1,14 @@
{ pkgs ? import <nixpkgs> { }, feature }:
{
pkgs ? import <nixpkgs> { },
feature,
}:
pkgs.runCommandNoCC "${feature}-present-structured"
{
__structuredAttrs = true;
requiredSystemFeatures = [ feature ];
} ''
}
''
if [[ -e /${feature}-files ]]; then
touch $out
else
@ -12,4 +16,3 @@ pkgs.runCommandNoCC "${feature}-present-structured"
echo "Do we fail to parse __structuredAttrs=true derivations?" >&2
fi
''

View File

@ -16,14 +16,11 @@ let
'';
in
{
cudaAvailable =
runCommand name
{
cudaAvailable = runCommand name {
nativeBuildInputs = [ unwrapped ];
requiredSystemFeatures = [ "cuda" ];
passthru = {
inherit unwrapped;
};
}
"${name}-unwrapped && touch $out";
} "${name}-unwrapped && touch $out";
}

View File

@ -3,28 +3,31 @@
# in the sandbox as well. In practice, things seemed to have worked without
# this as well, but we go with the safe option until we understand why.
{ lib
, runCommand
, python3Packages
, allowedPatterns
{
lib,
runCommand,
python3Packages,
allowedPatterns,
}:
runCommand "allowed-patterns.json"
{
nativeBuildInputs = [ python3Packages.python ];
exportReferencesGraph =
builtins.concatMap
(name:
builtins.concatMap
(path:
exportReferencesGraph = builtins.concatMap (
name:
builtins.concatMap (
path:
let
prefix = "${builtins.storeDir}/";
# Has to start with a letter: https://github.com/NixOS/nix/blob/516e7ddc41f39ff939b5d5b5dc71e590f24890d4/src/libstore/build/local-derivation-goal.cc#L568
exportName = ''references-${lib.strings.removePrefix prefix "${path}"}'';
isStorePath = lib.isStorePath path && (lib.hasPrefix prefix "${path}");
in
lib.optionals isStorePath [ exportName path ])
allowedPatterns.${name}.paths)
(builtins.attrNames allowedPatterns);
lib.optionals isStorePath [
exportName
path
]
) allowedPatterns.${name}.paths
) (builtins.attrNames allowedPatterns);
env.storeDir = "${builtins.storeDir}/";
shallowConfig = builtins.toJSON allowedPatterns;
passAsFile = [ "shallowConfig" ];

View File

@ -1,10 +1,16 @@
{ addOpenGLRunpath
, cmake
, allowedPatternsPath ? callPackage ./closure.nix { inherit allowedPatterns; }
, allowedPatterns ? rec {
{
addOpenGLRunpath,
cmake,
allowedPatternsPath ? callPackage ./closure.nix { inherit allowedPatterns; },
allowedPatterns ? rec {
# This config is just an example.
# When the hook observes either of the following requiredSystemFeatures:
nvidia-gpu.onFeatures = [ "gpu" "nvidia-gpu" "opengl" "cuda" ];
nvidia-gpu.onFeatures = [
"gpu"
"nvidia-gpu"
"opengl"
"cuda"
];
# It exposes these paths in the sandbox:
nvidia-gpu.paths = [
addOpenGLRunpath.driverLink
@ -12,28 +18,26 @@
"/dev/nvidia*"
];
nvidia-gpu.unsafeFollowSymlinks = true;
}
, buildPackages
, callPackage
, extraWrapperArgs ? [ ]
, formats
, lib
, makeWrapper
, nix
, nixosTests
, python3Packages
, runCommand
},
buildPackages,
callPackage,
extraWrapperArgs ? [ ],
formats,
lib,
makeWrapper,
nix,
nixosTests,
python3Packages,
runCommand,
}:
let
attrs = builtins.fromTOML (builtins.readFile ./pyproject.toml);
pname = attrs.project.name;
inherit (attrs.project) version;
in
python3Packages.buildPythonApplication
{
python3Packages.buildPythonApplication {
inherit pname version;
pyproject = true;

View File

@ -1,16 +1,11 @@
{ runCommandNoCC
, python
}:
{ runCommandNoCC, python }:
runCommandNoCC "pynvml-gpu-test"
{
nativeBuildInputs = [
(python.withPackages (ps: [ ps.pynvml ]))
];
requiredSystemFeatures = [
"cuda"
];
} ''
nativeBuildInputs = [ (python.withPackages (ps: [ ps.pynvml ])) ];
requiredSystemFeatures = [ "cuda" ];
}
''
python3 << EOF
import pynvml
from pynvml.smi import nvidia_smi
@ -20,4 +15,3 @@ runCommandNoCC "pynvml-gpu-test"
touch $out
''