Something went wrong. Try again.
Something went wrong. Try again.
tailscale-gitops-pusher flake.nix
5.4 kB · 175 lines
Nix
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176{ description = "Tailscale GitOps OCI image";
inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; flake-utils.url = "github:numtide/flake-utils"; };
outputs = { self, nixpkgs, flake-utils, }: (flake-utils.lib.eachDefaultSystem ( system: let pkgs = nixpkgs.legacyPackages.${system};
# Tailscale release to build. tailscaleVersion = "1.104.5"; tailscaleSrc = pkgs.fetchFromGitHub { owner = "tailscale"; repo = "tailscale"; rev = "v${tailscaleVersion}"; hash = "sha256-aq4pBe75wNRFDEa3kSDa/pBLsZws5mOUOjHDUycpmXM="; };
# Static, stripped gitops-pusher. gitops-pusher = pkgs.buildGo127Module { pname = "gitops-pusher"; version = tailscaleVersion; src = tailscaleSrc; vendorHash = "sha256-RvaouD88naVNOPJBVcqMaAn+ovjXI4g83ShCdRiR5/Q="; subPackages = [ "cmd/gitops-pusher" ]; doCheck = false; env.CGO_ENABLED = "0"; ldflags = [ "-s" "-w" ]; # Scrub Go stdlib store references (services, protocols, # mime.types, zoneinfo). The tool does not use them; the # references would add tzdata, iana-etc, and mailcap to the # closure. postFixup = '' ${pkgs.removeReferencesTo}/bin/remove-references-to \ -t ${pkgs.iana-etc} \ -t ${pkgs.mailcap} \ -t ${pkgs.tzdata} \ $out/bin/gitops-pusher ''; };
imageLabels = { "org.opencontainers.image.title" = "gitops-pusher"; "org.opencontainers.image.description" = "Tailscale ACL GitOps helper (apply/test/checksum), statically built with Nix"; "org.opencontainers.image.version" = tailscaleVersion; "org.opencontainers.image.source" = "https://github.com/tailscale/tailscale"; "org.opencontainers.image.licenses" = "BSD-3-Clause"; };
# Minimal static busybox (~300 KB). GitLab Runner executes # mkdir, touch, and a shell before script lines; a shell-only # image fails. busybox-static = pkgs.pkgsStatic.busybox.override { enableMinimal = true; extraConfig = '' # POSIX shell CONFIG_ASH y CONFIG_SH_IS_ASH y CONFIG_ASH_OPTIMIZE_FOR_SIZE y CONFIG_ASH_BASH_COMPAT y CONFIG_ASH_ECHO y CONFIG_ASH_PRINTF y CONFIG_ASH_TEST y CONFIG_ASH_INTERNAL_GLOB y CONFIG_ASH_CMDCMD y CONFIG_FEATURE_SH_STANDALONE y CONFIG_FEATURE_PREFER_APPLETS y CONFIG_FEATURE_FANCY_ECHO y CONFIG_FEATURE_SH_MATH y CONFIG_FEATURE_TEST_64 y
# Applet symlinks for PATH lookup. CONFIG_INSTALL_APPLET_SYMLINKS y
# Commands used by the GitLab Runner wrapper and job scripts. CONFIG_MKDIR y CONFIG_TOUCH y CONFIG_RM y CONFIG_MV y CONFIG_CP y CONFIG_LN y CONFIG_CHMOD y CONFIG_CHOWN y CONFIG_CAT y CONFIG_LS y CONFIG_ECHO y CONFIG_PRINTF y CONFIG_TEST y CONFIG_TRUE y CONFIG_FALSE y CONFIG_SLEEP y CONFIG_DATE y CONFIG_ENV y CONFIG_UNAME y CONFIG_DIRNAME y CONFIG_BASENAME y CONFIG_MKTEMP y CONFIG_ID y CONFIG_WHOAMI y CONFIG_HEAD y CONFIG_TAIL y CONFIG_WHICH y CONFIG_TAR y CONFIG_GZIP y CONFIG_GUNZIP y ''; };
# One image for CI and direct use. No entrypoint, CMD /bin/sh. # Direct runs name the binary. gitops-pusher-image = pkgs.dockerTools.buildLayeredImage { name = "gitops-pusher"; tag = tailscaleVersion; contents = [ (pkgs.buildEnv { name = "gitops-pusher-root"; paths = [ gitops-pusher busybox-static pkgs.cacert ]; pathsToLink = [ "/bin" "/etc" ]; }) ]; fakeRootCommands = '' mkdir -p ./data ./tmp ''; config = { Cmd = [ "/bin/sh" ]; WorkingDir = "/data"; Env = [ "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt" # TLS trust for the static binary "PATH=/bin" # OCI runtimes set no default PATH ]; Labels = imageLabels; }; }; in { packages = { inherit gitops-pusher gitops-pusher-image; default = gitops-pusher; };
devShells.default = pkgs.mkShellNoCC { packages = with pkgs; [ glab # GitLab CLI jq # JSON processing for glab api output podman # run the built images locally skopeo # OCI image inspection crane # OCI image building helpers dive # inspect image layers nixfmt # format the flake ]; }; } ));}