···204205In Nixpkgs, there are generally three different names associated with a package:
206207-- The `name` attribute of the derivation (excluding the version part). This is what most users see, in particular when using `nix-env`.
208209- The variable name used for the instantiated package in `all-packages.nix`, and when passing it as a dependency to other functions. Typically this is called the _package attribute name_. This is what Nix expression authors see. It can also be used when installing using `nix-env -iA`.
210211- The filename for (the directory containing) the Nix expression.
212213-Most of the time, these are the same. For instance, the package `e2fsprogs` has a `name` attribute `"e2fsprogs-version"`, is bound to the variable name `e2fsprogs` in `all-packages.nix`, and the Nix expression is in `pkgs/os-specific/linux/e2fsprogs/default.nix`.
214215There are a few naming guidelines:
216
···204205In Nixpkgs, there are generally three different names associated with a package:
206207+- The `pname` attribute of the derivation. This is what most users see, in particular when using `nix-env`.
208209- The variable name used for the instantiated package in `all-packages.nix`, and when passing it as a dependency to other functions. Typically this is called the _package attribute name_. This is what Nix expression authors see. It can also be used when installing using `nix-env -iA`.
210211- The filename for (the directory containing) the Nix expression.
212213+Most of the time, these are the same. For instance, the package `e2fsprogs` has a `pname` attribute `"e2fsprogs"`, is bound to the variable name `e2fsprogs` in `all-packages.nix`, and the Nix expression is in `pkgs/os-specific/linux/e2fsprogs/default.nix`.
214215There are a few naming guidelines:
216
+25-10
nixos/doc/manual/default.nix
···21 withManOptDedupPatch = true;
22 };
230024 # We need to strip references to /nix/store/* from options,
25 # including any `extraSources` if some modules came from elsewhere,
26 # or else the build will fail.
···72 nativeBuildInputs = [ pkgs.nixos-render-docs ];
73 } ''
74 nixos-render-docs manual docbook \
75- --manpage-urls ${pkgs.path + "/doc/manpage-urls.json"} \
76 "$out" \
77 --section \
78 --section-id modules \
···255 manpages = runCommand "nixos-manpages"
256 { inherit sources;
257 nativeBuildInputs = [
00258 buildPackages.libxml2.bin
259 buildPackages.libxslt.bin
260- buildPackages.installShellFiles
0261 ];
262 allowedReferences = ["out"];
263 }
···265 # Generate manpages.
266 mkdir -p $out/share/man/man8
267 installManPage ${./manpages}/*
268- xsltproc --nonet \
269- --maxdepth 6000 \
270- --param man.output.in.separate.dir 1 \
271- --param man.output.base.dir "'$out/share/man/'" \
272- --param man.endnotes.are.numbered 0 \
273- --param man.break.after.slash 1 \
274- ${docbook_xsl_ns}/xml/xsl/docbook/manpages/docbook.xsl \
275- ${manual-combined}/man-pages-combined.xml
0000000000276 '';
277278}
···137 - `services.openssh.logLevel` to `services.openssh.settings.LogLevel`
138 - `services.openssh.kexAlgorithms` to `services.openssh.settings.KexAlgorithms`
139 - `services.openssh.macs` to `services.openssh.settings.Macs`
140- - `services.openssh.cyphers` to `services.openssh.settings.Cyphers`
141 - `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts`
142143- `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
···137 - `services.openssh.logLevel` to `services.openssh.settings.LogLevel`
138 - `services.openssh.kexAlgorithms` to `services.openssh.settings.KexAlgorithms`
139 - `services.openssh.macs` to `services.openssh.settings.Macs`
140+ - `services.openssh.ciphers` to `services.openssh.settings.Ciphers`
141 - `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts`
142143- `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
+1-1
nixos/lib/make-options-doc/default.nix
···78 title = args.title or null;
79 name = args.name or (lib.concatStringsSep "." args.path);
80 in ''
81- - [`${lib.optionalString (title != null) "${title} aka "}pkgs.${name}`](
82 https://search.nixos.org/packages?show=${name}&sort=relevance&query=${name}
83 )${
84 lib.optionalString (args ? comment) "\n\n ${args.comment}"
···78 title = args.title or null;
79 name = args.name or (lib.concatStringsSep "." args.path);
80 in ''
81+ - [${lib.optionalString (title != null) "${title} aka "}`pkgs.${name}`](
82 https://search.nixos.org/packages?show=${name}&sort=relevance&query=${name}
83 )${
84 lib.optionalString (args ? comment) "\n\n ${args.comment}"
···86 description = lib.mdDoc "Proxy DNS requests - no leak for DNS data.";
87 };
8889- quietMode = mkEnableOption (lib.mdDoc "Quiet mode (no output from the library).");
9091 remoteDNSSubnet = mkOption {
92 type = types.enum [ 10 127 224 ];
···86 description = lib.mdDoc "Proxy DNS requests - no leak for DNS data.";
87 };
8889+ quietMode = mkEnableOption (lib.mdDoc "Quiet mode (no output from the library)");
9091 remoteDNSSubnet = mkOption {
92 type = types.enum [ 10 127 224 ];
+1-1
nixos/modules/security/polkit.nix
···1415 security.polkit.enable = mkEnableOption (lib.mdDoc "polkit");
1617- security.polkit.debug = mkEnableOption (lib.mdDoc "debug logs from polkit. This is required in order to see log messages from rule definitions.");
1819 security.polkit.extraConfig = mkOption {
20 type = types.lines;
···1415 security.polkit.enable = mkEnableOption (lib.mdDoc "polkit");
1617+ security.polkit.debug = mkEnableOption (lib.mdDoc "debug logs from polkit. This is required in order to see log messages from rule definitions");
1819 security.polkit.extraConfig = mkOption {
20 type = types.lines;
+1-1
nixos/modules/services/backup/zfs-replication.nix
···9in {
10 options = {
11 services.zfs.autoReplication = {
12- enable = mkEnableOption (lib.mdDoc "ZFS snapshot replication.");
1314 followDelete = mkOption {
15 description = lib.mdDoc "Remove remote snapshots that don't have a local correspondent.";
···9in {
10 options = {
11 services.zfs.autoReplication = {
12+ enable = mkEnableOption (lib.mdDoc "ZFS snapshot replication");
1314 followDelete = mkOption {
15 description = lib.mdDoc "Remove remote snapshots that don't have a local correspondent.";
···27 options = {
2829 services.gnome.evolution-data-server = {
30- enable = mkEnableOption (lib.mdDoc "Evolution Data Server, a collection of services for storing addressbooks and calendars.");
31 plugins = mkOption {
32 type = types.listOf types.package;
33 default = [ ];
···35 };
36 };
37 programs.evolution = {
38- enable = mkEnableOption (lib.mdDoc "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality.");
39 plugins = mkOption {
40 type = types.listOf types.package;
41 default = [ ];
···27 options = {
2829 services.gnome.evolution-data-server = {
30+ enable = mkEnableOption (lib.mdDoc "Evolution Data Server, a collection of services for storing addressbooks and calendars");
31 plugins = mkOption {
32 type = types.listOf types.package;
33 default = [ ];
···35 };
36 };
37 programs.evolution = {
38+ enable = mkEnableOption (lib.mdDoc "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality");
39 plugins = mkOption {
40 type = types.listOf types.package;
41 default = [ ];
+1-1
nixos/modules/services/development/zammad.nix
···2829 options = {
30 services.zammad = {
31- enable = mkEnableOption (lib.mdDoc "Zammad, a web-based, open source user support/ticketing solution.");
3233 package = mkOption {
34 type = types.package;
···2829 options = {
30 services.zammad = {
31+ enable = mkEnableOption (lib.mdDoc "Zammad, a web-based, open source user support/ticketing solution");
3233 package = mkOption {
34 type = types.package;
+1-1
nixos/modules/services/games/freeciv.nix
···54 default = 0;
55 description = lib.mdDoc "Set debug log level.";
56 };
57- options.exit-on-end = mkEnableOption (lib.mdDoc "exit instead of restarting when a game ends.");
58 options.Guests = mkEnableOption (lib.mdDoc "guests to login if auth is enabled");
59 options.Newusers = mkEnableOption (lib.mdDoc "new users to login if auth is enabled");
60 options.port = mkOption {
···54 default = 0;
55 description = lib.mdDoc "Set debug log level.";
56 };
57+ options.exit-on-end = mkEnableOption (lib.mdDoc "exit instead of restarting when a game ends");
58 options.Guests = mkEnableOption (lib.mdDoc "guests to login if auth is enabled");
59 options.Newusers = mkEnableOption (lib.mdDoc "new users to login if auth is enabled");
60 options.port = mkOption {
+1-1
nixos/modules/services/hardware/udisks2.nix
···1920 services.udisks2 = {
2122- enable = mkEnableOption (lib.mdDoc "udisks2, a DBus service that allows applications to query and manipulate storage devices.");
2324 settings = mkOption rec {
25 type = types.attrsOf settingsFormat.type;
···1920 services.udisks2 = {
2122+ enable = mkEnableOption (lib.mdDoc "udisks2, a DBus service that allows applications to query and manipulate storage devices");
2324 settings = mkOption rec {
25 type = types.attrsOf settingsFormat.type;
+7-7
nixos/modules/services/mail/dovecot.nix
···171 options.services.dovecot2 = {
172 enable = mkEnableOption (lib.mdDoc "the dovecot 2.x POP3/IMAP server");
173174- enablePop3 = mkEnableOption (lib.mdDoc "starting the POP3 listener (when Dovecot is enabled).");
175176- enableImap = mkEnableOption (lib.mdDoc "starting the IMAP listener (when Dovecot is enabled).") // { default = true; };
177178- enableLmtp = mkEnableOption (lib.mdDoc "starting the LMTP listener (when Dovecot is enabled).");
179180 protocols = mkOption {
181 type = types.listOf types.str;
···300 description = lib.mdDoc "Path to the server's private key.";
301 };
302303- enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins.") // { default = true; };
304305- enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange.") // { default = true; };
306307 sieveScripts = mkOption {
308 type = types.attrsOf types.path;
···310 description = lib.mdDoc "Sieve scripts to be executed. Key is a sequence, e.g. 'before2', 'after' etc.";
311 };
312313- showPAMFailure = mkEnableOption (lib.mdDoc "showing the PAM failure message on authentication error (useful for OTPW).");
314315 mailboxes = mkOption {
316 type = with types; coercedTo
···326 description = lib.mdDoc "Configure mailboxes and auto create or subscribe them.";
327 };
328329- enableQuota = mkEnableOption (lib.mdDoc "the dovecot quota service.");
330331 quotaPort = mkOption {
332 type = types.str;
···171 options.services.dovecot2 = {
172 enable = mkEnableOption (lib.mdDoc "the dovecot 2.x POP3/IMAP server");
173174+ enablePop3 = mkEnableOption (lib.mdDoc "starting the POP3 listener (when Dovecot is enabled)");
175176+ enableImap = mkEnableOption (lib.mdDoc "starting the IMAP listener (when Dovecot is enabled)") // { default = true; };
177178+ enableLmtp = mkEnableOption (lib.mdDoc "starting the LMTP listener (when Dovecot is enabled)");
179180 protocols = mkOption {
181 type = types.listOf types.str;
···300 description = lib.mdDoc "Path to the server's private key.";
301 };
302303+ enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins") // { default = true; };
304305+ enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange") // { default = true; };
306307 sieveScripts = mkOption {
308 type = types.attrsOf types.path;
···310 description = lib.mdDoc "Sieve scripts to be executed. Key is a sequence, e.g. 'before2', 'after' etc.";
311 };
312313+ showPAMFailure = mkEnableOption (lib.mdDoc "showing the PAM failure message on authentication error (useful for OTPW)");
314315 mailboxes = mkOption {
316 type = with types; coercedTo
···326 description = lib.mdDoc "Configure mailboxes and auto create or subscribe them.";
327 };
328329+ enableQuota = mkEnableOption (lib.mdDoc "the dovecot quota service");
330331 quotaPort = mkOption {
332 type = types.str;
+1-1
nixos/modules/services/misc/atuin.nix
···8{
9 options = {
10 services.atuin = {
11- enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin.");
1213 openRegistration = mkOption {
14 type = types.bool;
···8{
9 options = {
10 services.atuin = {
11+ enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin");
1213 openRegistration = mkOption {
14 type = types.bool;
+1-1
nixos/modules/services/misc/input-remapper.nix
···6{
7 options = {
8 services.input-remapper = {
9- enable = mkEnableOption (lib.mdDoc "input-remapper, an easy to use tool to change the mapping of your input device buttons.");
10 package = mkPackageOptionMD pkgs "input-remapper" { };
11 enableUdevRules = mkEnableOption (lib.mdDoc "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140");
12 serviceWantedBy = mkOption {
···6{
7 options = {
8 services.input-remapper = {
9+ enable = mkEnableOption (lib.mdDoc "input-remapper, an easy to use tool to change the mapping of your input device buttons");
10 package = mkPackageOptionMD pkgs "input-remapper" { };
11 enableUdevRules = mkEnableOption (lib.mdDoc "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140");
12 serviceWantedBy = mkOption {
+1-1
nixos/modules/services/misc/sourcehut/default.nix
···438 };
439440 options."lists.sr.ht" = commonServiceSettings "lists" // {
441- allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists.");
442 notify-from = mkOption {
443 description = lib.mdDoc "Outgoing email for notifications generated by users.";
444 type = types.str;
···438 };
439440 options."lists.sr.ht" = commonServiceSettings "lists" // {
441+ allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists");
442 notify-from = mkOption {
443 description = lib.mdDoc "Outgoing email for notifications generated by users.";
444 type = types.str;
···1112 # the upstream package runs as root, but doesn't seem to be strictly
13 # necessary for basic functionality
14- runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root.");
1516 autoRetirement = mkEnableOption (lib.mdDoc ''
17 Whether to automatically retire the host upon OS shutdown.
···1112 # the upstream package runs as root, but doesn't seem to be strictly
13 # necessary for basic functionality
14+ runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root");
1516 autoRetirement = mkEnableOption (lib.mdDoc ''
17 Whether to automatically retire the host upon OS shutdown.
···78 enable = mkEnableOption (lib.mdDoc "hledger-web service");
910- serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI.");
1112 host = mkOption {
13 type = types.str;
···78 enable = mkEnableOption (lib.mdDoc "hledger-web service");
910+ serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI");
1112 host = mkOption {
13 type = types.str;
···106 description = lib.mdDoc ''
107 Extra custom layouts that will be included in the xkb configuration.
108 Information on how to create a new layout can be found here:
109- [](https://www.x.org/releases/current/doc/xorg-docs/input/XKB-Enhancing.html#Defining_New_Layouts).
110 For more examples see
111- [](https://wiki.archlinux.org/index.php/X_KeyBoard_extension#Basic_examples)
112 '';
113 };
114
···106 description = lib.mdDoc ''
107 Extra custom layouts that will be included in the xkb configuration.
108 Information on how to create a new layout can be found here:
109+ <https://www.x.org/releases/current/doc/xorg-docs/input/XKB-Enhancing.html#Defining_New_Layouts>.
110 For more examples see
111+ <https://wiki.archlinux.org/index.php/X_KeyBoard_extension#Basic_examples>
112 '';
113 };
114
···20 ###### interface
2122 options = {
23- boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel.") // {
24 default = true;
25 };
26
···20 ###### interface
2122 options = {
23+ boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel") // {
24 default = true;
25 };
26
···1+{ stdenv
2+, lib
3+, makeWrapper
4+, socat
5+, iptables
6+, iproute2
7+, bridge-utils
8+, btrfs-progs
9+, conntrack-tools
10+, buildGoModule
11+, runc
12+, rsync
13+, kmod
14+, libseccomp
15+, pkg-config
16+, ethtool
17+, util-linux
18+, fetchFromGitHub
19+, fetchurl
20+, fetchzip
21+, fetchgit
22+, zstd
23+, yq-go
24+, nixosTests
25+, k3s
26+, pkgsBuildBuild
27+}:
28+29+with lib;
30+31+# k3s is a kinda weird derivation. One of the main points of k3s is the
32+# simplicity of it being one binary that can perform several tasks.
33+# However, when you have a good package manager (like nix), that doesn't
34+# actually make much of a difference; you don't really care if it's one binary
35+# or 10 since with a good package manager, installing and running it is
36+# identical.
37+# Since upstream k3s packages itself as one large binary with several
38+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
39+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
40+# some exceptions.
41+# K3s also carries patches to some packages (such as containerd and cni
42+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
43+# even if the upstream version of those binaries exist in nixpkgs already. In
44+# the end, that means we have a thick k3s binary that behaves like the upstream
45+# one for the most part.
46+# However, k3s also bundles several pieces of unpatched software, from the
47+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
48+# Those pieces of software we entirely ignore upstream's handling of, and just
49+# make sure they're in the path if desired.
50+let
51+ k3sVersion = "1.23.6+k3s1"; # k3s git tag
52+ k3sCommit = "418c3fa858b69b12b9cefbcff0526f666a6236b9"; # k3s git commit at the above version
53+ k3sRepoSha256 = "0fmw491dn5mpi058mr7sij51i5m4qg2grx30cnl3h2v4s0sdkx2i";
54+ k3sVendorSha256 = "sha256-iHg5ySMaiSWXs98YGmxPwdZr4zdBIFma12dNEuf30Hs=";
55+56+ # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
57+ # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
58+ traefikChartVersion = "10.19.3";
59+ traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
60+61+ # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
62+ k3sRootVersion = "0.11.0";
63+ k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
64+65+ # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
66+ k3sCNIVersion = "1.0.1-k3s1";
67+ k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
68+69+ # taken from go.mod, the 'github.com/containerd/containerd' line
70+ # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
71+ containerdVersion = "1.5.11-k3s2";
72+ containerdSha256 = "16132snvrg8r0vwm6c0lz0q6fx686s2ix53nm3aka9a83xs75vf2";
73+74+ # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
75+ criCtlVersion = "1.22.0-k3s1";
76+77+ baseMeta = k3s.meta;
78+79+ # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
80+ versionldflags = [
81+ "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
82+ "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
83+ "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
84+ "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
85+ "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
86+ "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
87+ "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
88+ "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
89+ "-X k8s.io/component-base/version.gitTreeState=clean"
90+ "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
91+ "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
92+ "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
93+ "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
94+ ];
95+96+ # bundled into the k3s binary
97+ traefikChart = fetchurl {
98+ url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
99+ sha256 = traefikChartSha256;
100+ };
101+ # so, k3s is a complicated thing to package
102+ # This derivation attempts to avoid including any random binaries from the
103+ # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
104+ # we don't care about doing, we can add those as build or runtime
105+ # dependencies using a real package manager).
106+ # In addition to those binaries, it's also configuration though (right now
107+ # mostly strongswan configuration), and k3s does use those files.
108+ # As such, we download it in order to grab 'etc' and bundle it into the final
109+ # k3s binary.
110+ k3sRoot = fetchzip {
111+ # Note: marked as apache 2.0 license
112+ url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
113+ sha256 = k3sRootSha256;
114+ stripRoot = false;
115+ };
116+ k3sCNIPlugins = buildGoModule rec {
117+ pname = "k3s-cni-plugins";
118+ version = k3sCNIVersion;
119+ vendorSha256 = null;
120+121+ subPackages = [ "." ];
122+123+ src = fetchFromGitHub {
124+ owner = "rancher";
125+ repo = "plugins";
126+ rev = "v${version}";
127+ sha256 = k3sCNISha256;
128+ };
129+130+ postInstall = ''
131+ mv $out/bin/plugins $out/bin/cni
132+ '';
133+134+ meta = baseMeta // {
135+ description = "CNI plugins, as patched by rancher for k3s";
136+ };
137+ };
138+ # Grab this separately from a build because it's used by both stages of the
139+ # k3s build.
140+ k3sRepo = fetchgit {
141+ url = "https://github.com/k3s-io/k3s";
142+ rev = "v${k3sVersion}";
143+ sha256 = k3sRepoSha256;
144+ };
145+ # Stage 1 of the k3s build:
146+ # Let's talk about how k3s is structured.
147+ # One of the ideas of k3s is that there's the single "k3s" binary which can
148+ # do everything you need, from running a k3s server, to being a worker node,
149+ # to running kubectl.
150+ # The way that actually works is that k3s is a single go binary that contains
151+ # a bunch of bindata that it unpacks at runtime into directories (either the
152+ # user's home directory or /var/lib/rancher if run as root).
153+ # This bindata includes both binaries and configuration.
154+ # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
155+ # First, we build all the binaries that get packed into the thick k3s binary
156+ # (and output them from one derivation so they'll all be suitably patched up).
157+ # Then, we bundle those binaries into our thick k3s binary and use that as
158+ # the final single output.
159+ # This approach was chosen because it ensures the bundled binaries all are
160+ # correctly built to run with nix (we can lean on the existing buildGoModule
161+ # stuff), and we can again lean on that tooling for the final k3s binary too.
162+ # Other alternatives would be to manually run the
163+ # strip/patchelf/remove-references step ourselves in the installPhase of the
164+ # derivation when we've built all the binaries, but haven't bundled them in
165+ # with generated bindata yet.
166+167+ k3sServer = buildGoModule rec {
168+ pname = "k3s-server";
169+ version = k3sVersion;
170+171+ src = k3sRepo;
172+ vendorSha256 = k3sVendorSha256;
173+174+ nativeBuildInputs = [ pkg-config ];
175+ buildInputs = [ libseccomp ];
176+177+ subPackages = [ "cmd/server" ];
178+ ldflags = versionldflags;
179+180+ # create the multicall symlinks for k3s
181+ postInstall = ''
182+ mv $out/bin/server $out/bin/k3s
183+ pushd $out
184+ # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
185+ ln -s k3s ./bin/k3s-agent
186+ ln -s k3s ./bin/k3s-server
187+ ln -s k3s ./bin/k3s-etcd-snapshot
188+ ln -s k3s ./bin/k3s-secrets-encrypt
189+ ln -s k3s ./bin/k3s-certificate
190+ ln -s k3s ./bin/kubectl
191+ ln -s k3s ./bin/crictl
192+ ln -s k3s ./bin/ctr
193+ popd
194+ '';
195+196+ meta = baseMeta // {
197+ description = "The various binaries that get packaged into the final k3s binary";
198+ };
199+ };
200+ k3sContainerd = buildGoModule {
201+ pname = "k3s-containerd";
202+ version = containerdVersion;
203+ src = fetchFromGitHub {
204+ owner = "k3s-io";
205+ repo = "containerd";
206+ rev = "v${containerdVersion}";
207+ sha256 = containerdSha256;
208+ };
209+ vendorSha256 = null;
210+ buildInputs = [ btrfs-progs ];
211+ subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
212+ ldflags = versionldflags;
213+ };
214+in
215+buildGoModule rec {
216+ pname = "k3s";
217+ version = k3sVersion;
218+219+ src = k3sRepo;
220+ vendorSha256 = k3sVendorSha256;
221+222+ patches = [
223+ ./0001-script-download-strip-downloading-just-package-CRD.patch
224+ ];
225+226+ postPatch = ''
227+ # Nix prefers dynamically linked binaries over static binary.
228+229+ substituteInPlace scripts/package-cli \
230+ --replace '"$LDFLAGS $STATIC" -o' \
231+ '"$LDFLAGS" -o' \
232+ --replace "STATIC=\"-extldflags \'-static\'\"" \
233+ ""
234+235+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
236+237+ substituteInPlace scripts/package-cli \
238+ --replace '"''${GO}" generate' \
239+ 'GOFLAGS="" \
240+ GOOS="${pkgsBuildBuild.go.GOOS}" \
241+ GOARCH="${pkgsBuildBuild.go.GOARCH}" \
242+ CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
243+ "''${GO}" generate'
244+ '';
245+246+ # Important utilities used by the kubelet, see
247+ # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
248+ # Note the list in that issue is stale and some aren't relevant for k3s.
249+ k3sRuntimeDeps = [
250+ kmod
251+ socat
252+ iptables
253+ iproute2
254+ bridge-utils
255+ ethtool
256+ util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
257+ conntrack-tools
258+ ];
259+260+ buildInputs = k3sRuntimeDeps;
261+262+ nativeBuildInputs = [
263+ makeWrapper
264+ rsync
265+ yq-go
266+ zstd
267+ ];
268+269+ # embedded in the final k3s cli
270+ propagatedBuildInputs = [
271+ k3sCNIPlugins
272+ k3sContainerd
273+ k3sServer
274+ runc
275+ ];
276+277+ # We override most of buildPhase due to peculiarities in k3s's build.
278+ # Specifically, it has a 'go generate' which runs part of the package. See
279+ # this comment:
280+ # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
281+ # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
282+ buildPhase = ''
283+ patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
284+285+ # copy needed 'go generate' inputs into place
286+ mkdir -p ./bin/aux
287+ rsync -a --no-perms ${k3sServer}/bin/ ./bin/
288+ ln -vsf ${runc}/bin/runc ./bin/runc
289+ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
290+ ln -vsf ${k3sContainerd}/bin/* ./bin/
291+ rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
292+ mkdir -p ./build/static/charts
293+ # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
294+ export TRAEFIK_CHART_FILE=${traefikChart}
295+ # place the traefik chart using their code since it's complicated
296+ # We trim the actual download, see patches
297+ ./scripts/download
298+299+ export ARCH=$GOARCH
300+ export DRONE_TAG="v${k3sVersion}"
301+ export DRONE_COMMIT="${k3sCommit}"
302+ # use ./scripts/package-cli to run 'go generate' + 'go build'
303+304+ ./scripts/package-cli
305+ mkdir -p $out/bin
306+ '';
307+308+ # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
309+ doCheck = false;
310+311+ installPhase = ''
312+ # wildcard to match the arm64 build too
313+ install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
314+ wrapProgram $out/bin/k3s \
315+ --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
316+ --prefix PATH : "$out/bin"
317+ '';
318+319+ doInstallCheck = true;
320+ installCheckPhase = ''
321+ $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
322+ '';
323+324+ # Fix-Me: Needs to be adapted specifically for 1.23
325+ # passthru.updateScript = ./update.sh;
326+327+ # Fix-Me: Needs to be adapted specifically for 1.23
328+ # passthru.tests = { inherit (nixosTests) k3s-single-node k3s-single-node-docker; };
329+330+ meta = baseMeta;
331+}
···1+{ stdenv
2+, lib
3+, makeWrapper
4+, socat
5+, iptables
6+, iproute2
7+, bridge-utils
8+, btrfs-progs
9+, conntrack-tools
10+, buildGoModule
11+, runc
12+, rsync
13+, kmod
14+, libseccomp
15+, pkg-config
16+, ethtool
17+, util-linux
18+, fetchFromGitHub
19+, fetchurl
20+, fetchzip
21+, fetchgit
22+, zstd
23+, yq-go
24+, nixosTests
25+, k3s
26+, pkgsBuildBuild
27+}:
28+29+# k3s is a kinda weird derivation. One of the main points of k3s is the
30+# simplicity of it being one binary that can perform several tasks.
31+# However, when you have a good package manager (like nix), that doesn't
32+# actually make much of a difference; you don't really care if it's one binary
33+# or 10 since with a good package manager, installing and running it is
34+# identical.
35+# Since upstream k3s packages itself as one large binary with several
36+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
37+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
38+# some exceptions.
39+# K3s also carries patches to some packages (such as containerd and cni
40+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
41+# even if the upstream version of those binaries exist in nixpkgs already. In
42+# the end, that means we have a thick k3s binary that behaves like the upstream
43+# one for the most part.
44+# However, k3s also bundles several pieces of unpatched software, from the
45+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
46+# Those pieces of software we entirely ignore upstream's handling of, and just
47+# make sure they're in the path if desired.
48+let
49+ k3sVersion = "1.24.4+k3s1"; # k3s git tag
50+ k3sCommit = "c3f830e9b9ed8a4d9d0e2aa663b4591b923a296e"; # k3s git commit at the above version
51+ k3sRepoSha256 = "00ns6n7jxnacah8ahndhgdb160prgsqhswbb5809kkgvig7k8b27";
52+ k3sVendorSha256 = "sha256-ReZvJCgxqffG2H39JlynGPUBSV5ngPkRtAoZ++OQZZI=";
53+54+ # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
55+ # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
56+ traefikChartVersion = "10.19.3";
57+ traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
58+59+ # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
60+ k3sRootVersion = "0.11.0";
61+ k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
62+63+ # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
64+ k3sCNIVersion = "1.1.1-k3s1";
65+ k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
66+67+ # taken from go.mod, the 'github.com/containerd/containerd' line
68+ # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
69+ containerdVersion = "1.5.13-k3s1";
70+ containerdSha256 = "09bj4ghwbsj9whkv1d5icqs52k64m449j8b73dmak2wz62fbzbvp";
71+72+ # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
73+ criCtlVersion = "1.24.0-k3s1";
74+75+ baseMeta = k3s.meta;
76+77+ # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
78+ versionldflags = [
79+ "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
80+ "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
81+ "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
82+ "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
83+ "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
84+ "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
85+ "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
86+ "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
87+ "-X k8s.io/component-base/version.gitTreeState=clean"
88+ "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
89+ "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
90+ "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
91+ "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
92+ ];
93+94+ # bundled into the k3s binary
95+ traefikChart = fetchurl {
96+ url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
97+ sha256 = traefikChartSha256;
98+ };
99+ # so, k3s is a complicated thing to package
100+ # This derivation attempts to avoid including any random binaries from the
101+ # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
102+ # we don't care about doing, we can add those as build or runtime
103+ # dependencies using a real package manager).
104+ # In addition to those binaries, it's also configuration though (right now
105+ # mostly strongswan configuration), and k3s does use those files.
106+ # As such, we download it in order to grab 'etc' and bundle it into the final
107+ # k3s binary.
108+ k3sRoot = fetchzip {
109+ # Note: marked as apache 2.0 license
110+ url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
111+ sha256 = k3sRootSha256;
112+ stripRoot = false;
113+ };
114+ k3sCNIPlugins = buildGoModule rec {
115+ pname = "k3s-cni-plugins";
116+ version = k3sCNIVersion;
117+ vendorSha256 = null;
118+119+ subPackages = [ "." ];
120+121+ src = fetchFromGitHub {
122+ owner = "rancher";
123+ repo = "plugins";
124+ rev = "v${version}";
125+ sha256 = k3sCNISha256;
126+ };
127+128+ postInstall = ''
129+ mv $out/bin/plugins $out/bin/cni
130+ '';
131+132+ meta = baseMeta // {
133+ description = "CNI plugins, as patched by rancher for k3s";
134+ };
135+ };
136+ # Grab this separately from a build because it's used by both stages of the
137+ # k3s build.
138+ k3sRepo = fetchgit {
139+ url = "https://github.com/k3s-io/k3s";
140+ rev = "v${k3sVersion}";
141+ sha256 = k3sRepoSha256;
142+ };
143+ # Stage 1 of the k3s build:
144+ # Let's talk about how k3s is structured.
145+ # One of the ideas of k3s is that there's the single "k3s" binary which can
146+ # do everything you need, from running a k3s server, to being a worker node,
147+ # to running kubectl.
148+ # The way that actually works is that k3s is a single go binary that contains
149+ # a bunch of bindata that it unpacks at runtime into directories (either the
150+ # user's home directory or /var/lib/rancher if run as root).
151+ # This bindata includes both binaries and configuration.
152+ # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
153+ # First, we build all the binaries that get packed into the thick k3s binary
154+ # (and output them from one derivation so they'll all be suitably patched up).
155+ # Then, we bundle those binaries into our thick k3s binary and use that as
156+ # the final single output.
157+ # This approach was chosen because it ensures the bundled binaries all are
158+ # correctly built to run with nix (we can lean on the existing buildGoModule
159+ # stuff), and we can again lean on that tooling for the final k3s binary too.
160+ # Other alternatives would be to manually run the
161+ # strip/patchelf/remove-references step ourselves in the installPhase of the
162+ # derivation when we've built all the binaries, but haven't bundled them in
163+ # with generated bindata yet.
164+165+ k3sServer = buildGoModule rec {
166+ pname = "k3s-server";
167+ version = k3sVersion;
168+169+ src = k3sRepo;
170+ vendorSha256 = k3sVendorSha256;
171+172+ nativeBuildInputs = [ pkg-config ];
173+ buildInputs = [ libseccomp ];
174+175+ subPackages = [ "cmd/server" ];
176+ ldflags = versionldflags;
177+178+ # create the multicall symlinks for k3s
179+ postInstall = ''
180+ mv $out/bin/server $out/bin/k3s
181+ pushd $out
182+ # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
183+ ln -s k3s ./bin/k3s-agent
184+ ln -s k3s ./bin/k3s-server
185+ ln -s k3s ./bin/k3s-etcd-snapshot
186+ ln -s k3s ./bin/k3s-secrets-encrypt
187+ ln -s k3s ./bin/k3s-certificate
188+ ln -s k3s ./bin/kubectl
189+ ln -s k3s ./bin/crictl
190+ ln -s k3s ./bin/ctr
191+ popd
192+ '';
193+194+ meta = baseMeta // {
195+ description = "The various binaries that get packaged into the final k3s binary";
196+ };
197+ };
198+ k3sContainerd = buildGoModule {
199+ pname = "k3s-containerd";
200+ version = containerdVersion;
201+ src = fetchFromGitHub {
202+ owner = "k3s-io";
203+ repo = "containerd";
204+ rev = "v${containerdVersion}";
205+ sha256 = containerdSha256;
206+ };
207+ vendorSha256 = null;
208+ buildInputs = [ btrfs-progs ];
209+ subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
210+ ldflags = versionldflags;
211+ };
212+in
213+buildGoModule rec {
214+ pname = "k3s";
215+ version = k3sVersion;
216+217+ src = k3sRepo;
218+ vendorSha256 = k3sVendorSha256;
219+220+ patches = [
221+ ./0001-script-download-strip-downloading-just-package-CRD.patch
222+ ];
223+224+ postPatch = ''
225+ # Nix prefers dynamically linked binaries over static binary.
226+227+ substituteInPlace scripts/package-cli \
228+ --replace '"$LDFLAGS $STATIC" -o' \
229+ '"$LDFLAGS" -o' \
230+ --replace "STATIC=\"-extldflags \'-static\'\"" \
231+ ""
232+233+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
234+235+ substituteInPlace scripts/package-cli \
236+ --replace '"''${GO}" generate' \
237+ 'GOFLAGS="" \
238+ GOOS="${pkgsBuildBuild.go.GOOS}" \
239+ GOARCH="${pkgsBuildBuild.go.GOARCH}" \
240+ CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
241+ "''${GO}" generate'
242+ '';
243+244+ # Important utilities used by the kubelet, see
245+ # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
246+ # Note the list in that issue is stale and some aren't relevant for k3s.
247+ k3sRuntimeDeps = [
248+ kmod
249+ socat
250+ iptables
251+ iproute2
252+ bridge-utils
253+ ethtool
254+ util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
255+ conntrack-tools
256+ ];
257+258+ buildInputs = k3sRuntimeDeps;
259+260+ nativeBuildInputs = [
261+ makeWrapper
262+ rsync
263+ yq-go
264+ zstd
265+ ];
266+267+ # embedded in the final k3s cli
268+ propagatedBuildInputs = [
269+ k3sCNIPlugins
270+ k3sContainerd
271+ k3sServer
272+ runc
273+ ];
274+275+ # We override most of buildPhase due to peculiarities in k3s's build.
276+ # Specifically, it has a 'go generate' which runs part of the package. See
277+ # this comment:
278+ # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
279+ # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
280+ buildPhase = ''
281+ patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
282+283+ # copy needed 'go generate' inputs into place
284+ mkdir -p ./bin/aux
285+ rsync -a --no-perms ${k3sServer}/bin/ ./bin/
286+ ln -vsf ${runc}/bin/runc ./bin/runc
287+ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
288+ ln -vsf ${k3sContainerd}/bin/* ./bin/
289+ rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
290+ mkdir -p ./build/static/charts
291+ # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
292+ export TRAEFIK_CHART_FILE=${traefikChart}
293+ # place the traefik chart using their code since it's complicated
294+ # We trim the actual download, see patches
295+ ./scripts/download
296+297+ export ARCH=$GOARCH
298+ export DRONE_TAG="v${k3sVersion}"
299+ export DRONE_COMMIT="${k3sCommit}"
300+ # use ./scripts/package-cli to run 'go generate' + 'go build'
301+302+ ./scripts/package-cli
303+ mkdir -p $out/bin
304+ '';
305+306+ # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
307+ doCheck = false;
308+309+ installPhase = ''
310+ # wildcard to match the arm64 build too
311+ install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
312+ wrapProgram $out/bin/k3s \
313+ --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
314+ --prefix PATH : "$out/bin"
315+ '';
316+317+ doInstallCheck = true;
318+ installCheckPhase = ''
319+ $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
320+ '';
321+322+ # Fix-Me: Needs to be adapted specifically for 1.24
323+ # passthru.updateScript = ./update.sh;
324+325+ # Fix-Me: Needs to be adapted specifically for 1.24
326+ # passthru.tests = nixosTests.k3s;
327+328+ meta = baseMeta;
329+}
···1+{ stdenv
2+, lib
3+, makeWrapper
4+, socat
5+, iptables
6+, iproute2
7+, bridge-utils
8+, btrfs-progs
9+, conntrack-tools
10+, buildGoModule
11+, runc
12+, rsync
13+, kmod
14+, libseccomp
15+, pkg-config
16+, ethtool
17+, util-linux
18+, fetchFromGitHub
19+, fetchurl
20+, fetchzip
21+, fetchgit
22+, zstd
23+, yq-go
24+, nixosTests
25+, pkgsBuildBuild
26+, k3s
27+}:
28+29+# k3s is a kinda weird derivation. One of the main points of k3s is the
30+# simplicity of it being one binary that can perform several tasks.
31+# However, when you have a good package manager (like nix), that doesn't
32+# actually make much of a difference; you don't really care if it's one binary
33+# or 10 since with a good package manager, installing and running it is
34+# identical.
35+# Since upstream k3s packages itself as one large binary with several
36+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
37+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
38+# some exceptions.
39+# K3s also carries patches to some packages (such as containerd and cni
40+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
41+# even if the upstream version of those binaries exist in nixpkgs already. In
42+# the end, that means we have a thick k3s binary that behaves like the upstream
43+# one for the most part.
44+# However, k3s also bundles several pieces of unpatched software, from the
45+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
46+# Those pieces of software we entirely ignore upstream's handling of, and just
47+# make sure they're in the path if desired.
48+let
49+ k3sVersion = "1.25.3+k3s1"; # k3s git tag
50+ k3sCommit = "f2585c1671b31b4b34bddbb3bf4e7d69662b0821"; # k3s git commit at the above version
51+ k3sRepoSha256 = "0zwf3iwjcidx14zw36s1hr0q8wmmbfc0rfqwd7fmpjq597h8zkms";
52+ k3sVendorSha256 = "sha256-U67tJRGqPFk5AfRe7I50zKGC9HJ2oh+iI/C7qF/76BQ=";
53+54+ # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
55+ # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
56+ traefikChartVersion = "12.0.0";
57+ traefikChartSha256 = "1sqmi71fi3ad5dh5fmsp9mv80x6pkgqwi4r9fr8l6i9sdnai6f1a";
58+59+ # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
60+ k3sRootVersion = "0.11.0";
61+ k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
62+63+ # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
64+ k3sCNIVersion = "1.1.1-k3s1";
65+ k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
66+67+ # taken from go.mod, the 'github.com/containerd/containerd' line
68+ # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
69+ containerdVersion = "1.5.13-k3s2";
70+ containerdSha256 = "1pfr2ji4aij9js90gf4a3hqnhyw5hshcjdccm62l700j68gs5z97";
71+72+ # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
73+ criCtlVersion = "1.25.0-k3s1";
74+75+ baseMeta = k3s.meta;
76+77+ # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
78+ versionldflags = [
79+ "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
80+ "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
81+ "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
82+ "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
83+ "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
84+ "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
85+ "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
86+ "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
87+ "-X k8s.io/component-base/version.gitTreeState=clean"
88+ "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
89+ "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
90+ "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
91+ "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
92+ ];
93+94+ # bundled into the k3s binary
95+ traefikChart = fetchurl {
96+ url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
97+ sha256 = traefikChartSha256;
98+ };
99+ # so, k3s is a complicated thing to package
100+ # This derivation attempts to avoid including any random binaries from the
101+ # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
102+ # we don't care about doing, we can add those as build or runtime
103+ # dependencies using a real package manager).
104+ # In addition to those binaries, it's also configuration though (right now
105+ # mostly strongswan configuration), and k3s does use those files.
106+ # As such, we download it in order to grab 'etc' and bundle it into the final
107+ # k3s binary.
108+ k3sRoot = fetchzip {
109+ # Note: marked as apache 2.0 license
110+ url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
111+ sha256 = k3sRootSha256;
112+ stripRoot = false;
113+ };
114+ k3sCNIPlugins = buildGoModule rec {
115+ pname = "k3s-cni-plugins";
116+ version = k3sCNIVersion;
117+ vendorSha256 = null;
118+119+ subPackages = [ "." ];
120+121+ src = fetchFromGitHub {
122+ owner = "rancher";
123+ repo = "plugins";
124+ rev = "v${version}";
125+ sha256 = k3sCNISha256;
126+ };
127+128+ postInstall = ''
129+ mv $out/bin/plugins $out/bin/cni
130+ '';
131+132+ meta = baseMeta // {
133+ description = "CNI plugins, as patched by rancher for k3s";
134+ };
135+ };
136+ # Grab this separately from a build because it's used by both stages of the
137+ # k3s build.
138+ k3sRepo = fetchgit {
139+ url = "https://github.com/k3s-io/k3s";
140+ rev = "v${k3sVersion}";
141+ sha256 = k3sRepoSha256;
142+ };
143+ # Stage 1 of the k3s build:
144+ # Let's talk about how k3s is structured.
145+ # One of the ideas of k3s is that there's the single "k3s" binary which can
146+ # do everything you need, from running a k3s server, to being a worker node,
147+ # to running kubectl.
148+ # The way that actually works is that k3s is a single go binary that contains
149+ # a bunch of bindata that it unpacks at runtime into directories (either the
150+ # user's home directory or /var/lib/rancher if run as root).
151+ # This bindata includes both binaries and configuration.
152+ # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
153+ # First, we build all the binaries that get packed into the thick k3s binary
154+ # (and output them from one derivation so they'll all be suitably patched up).
155+ # Then, we bundle those binaries into our thick k3s binary and use that as
156+ # the final single output.
157+ # This approach was chosen because it ensures the bundled binaries all are
158+ # correctly built to run with nix (we can lean on the existing buildGoModule
159+ # stuff), and we can again lean on that tooling for the final k3s binary too.
160+ # Other alternatives would be to manually run the
161+ # strip/patchelf/remove-references step ourselves in the installPhase of the
162+ # derivation when we've built all the binaries, but haven't bundled them in
163+ # with generated bindata yet.
164+165+ k3sServer = buildGoModule rec {
166+ pname = "k3s-server";
167+ version = k3sVersion;
168+169+ src = k3sRepo;
170+ vendorSha256 = k3sVendorSha256;
171+172+ nativeBuildInputs = [ pkg-config ];
173+ buildInputs = [ libseccomp ];
174+175+ subPackages = [ "cmd/server" ];
176+ ldflags = versionldflags;
177+178+ # create the multicall symlinks for k3s
179+ postInstall = ''
180+ mv $out/bin/server $out/bin/k3s
181+ pushd $out
182+ # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
183+ ln -s k3s ./bin/k3s-agent
184+ ln -s k3s ./bin/k3s-server
185+ ln -s k3s ./bin/k3s-etcd-snapshot
186+ ln -s k3s ./bin/k3s-secrets-encrypt
187+ ln -s k3s ./bin/k3s-certificate
188+ ln -s k3s ./bin/kubectl
189+ ln -s k3s ./bin/crictl
190+ ln -s k3s ./bin/ctr
191+ popd
192+ '';
193+194+ meta = baseMeta // {
195+ description = "The various binaries that get packaged into the final k3s binary";
196+ };
197+ };
198+ k3sContainerd = buildGoModule {
199+ pname = "k3s-containerd";
200+ version = containerdVersion;
201+ src = fetchFromGitHub {
202+ owner = "k3s-io";
203+ repo = "containerd";
204+ rev = "v${containerdVersion}";
205+ sha256 = containerdSha256;
206+ };
207+ vendorSha256 = null;
208+ buildInputs = [ btrfs-progs ];
209+ subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
210+ ldflags = versionldflags;
211+ };
212+in
213+buildGoModule rec {
214+ pname = "k3s";
215+ version = k3sVersion;
216+217+ src = k3sRepo;
218+ vendorSha256 = k3sVendorSha256;
219+220+ patches = [
221+ ./0001-script-download-strip-downloading-just-package-CRD.patch
222+ ];
223+224+ postPatch = ''
225+ # Nix prefers dynamically linked binaries over static binary.
226+227+ substituteInPlace scripts/package-cli \
228+ --replace '"$LDFLAGS $STATIC" -o' \
229+ '"$LDFLAGS" -o' \
230+ --replace "STATIC=\"-extldflags \'-static\'\"" \
231+ ""
232+233+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
234+235+ substituteInPlace scripts/package-cli \
236+ --replace '"''${GO}" generate' \
237+ 'GOFLAGS="" \
238+ GOOS="${pkgsBuildBuild.go.GOOS}" \
239+ GOARCH="${pkgsBuildBuild.go.GOARCH}" \
240+ CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
241+ "''${GO}" generate'
242+ '';
243+244+ # Important utilities used by the kubelet, see
245+ # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
246+ # Note the list in that issue is stale and some aren't relevant for k3s.
247+ k3sRuntimeDeps = [
248+ kmod
249+ socat
250+ iptables
251+ iproute2
252+ bridge-utils
253+ ethtool
254+ util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
255+ conntrack-tools
256+ ];
257+258+ buildInputs = k3sRuntimeDeps;
259+260+ nativeBuildInputs = [
261+ makeWrapper
262+ rsync
263+ yq-go
264+ zstd
265+ ];
266+267+ # embedded in the final k3s cli
268+ propagatedBuildInputs = [
269+ k3sCNIPlugins
270+ k3sContainerd
271+ k3sServer
272+ runc
273+ ];
274+275+ # We override most of buildPhase due to peculiarities in k3s's build.
276+ # Specifically, it has a 'go generate' which runs part of the package. See
277+ # this comment:
278+ # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
279+ # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
280+ buildPhase = ''
281+ patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
282+283+ # copy needed 'go generate' inputs into place
284+ mkdir -p ./bin/aux
285+ rsync -a --no-perms ${k3sServer}/bin/ ./bin/
286+ ln -vsf ${runc}/bin/runc ./bin/runc
287+ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
288+ ln -vsf ${k3sContainerd}/bin/* ./bin/
289+ rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
290+ mkdir -p ./build/static/charts
291+ # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
292+ export TRAEFIK_CHART_FILE=${traefikChart}
293+ # place the traefik chart using their code since it's complicated
294+ # We trim the actual download, see patches
295+ ./scripts/download
296+297+ export ARCH=$GOARCH
298+ export DRONE_TAG="v${k3sVersion}"
299+ export DRONE_COMMIT="${k3sCommit}"
300+ # use ./scripts/package-cli to run 'go generate' + 'go build'
301+302+ ./scripts/package-cli
303+ mkdir -p $out/bin
304+ '';
305+306+ # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
307+ doCheck = false;
308+309+ installPhase = ''
310+ # wildcard to match the arm64 build too
311+ install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
312+ wrapProgram $out/bin/k3s \
313+ --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
314+ --prefix PATH : "$out/bin"
315+ '';
316+317+ doInstallCheck = true;
318+ installCheckPhase = ''
319+ $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
320+ '';
321+322+ # Fix-Me: Needs to be adapted specifically for 1.25
323+ # passthru.updateScript = ./update.sh;
324+325+ # Fix-Me: Needs to be adapted specifically for 1.25
326+ # passthru.tests = nixosTests.k3s;
327+328+ meta = baseMeta;
329+}
···32 description = "An open source tool for computing automorphism groups and canonical forms of graphs. It has both a command line user interface as well as C++ and C programming language APIs";
33 homepage = "http://www.tcs.hut.fi/Software/bliss/";
34 license = licenses.lgpl3;
35- platforms = [ "i686-linux" "x86_64-linux" ];
36 };
37}
···32 description = "An open source tool for computing automorphism groups and canonical forms of graphs. It has both a command line user interface as well as C++ and C programming language APIs";
33 homepage = "http://www.tcs.hut.fi/Software/bliss/";
34 license = licenses.lgpl3;
35+ platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
36 };
37}
···1+From 64de7911d2938fc3601fec39c08008465b9d4f6f Mon Sep 17 00:00:00 2001
2+From: Nick Cao <nickcao@nichi.co>
3+Date: Tue, 7 Feb 2023 17:12:50 +0800
4+Subject: [PATCH] python: enum: fix build for Python 3.11
5+MIME-Version: 1.0
6+Content-Type: text/plain; charset=UTF-8
7+Content-Transfer-Encoding: 8bit
8+9+Python 3.9 introduced Py_SET_SIZE function to set size instead of
10+relying on Py_SIZE() as a macro [3.9].
11+12+Python 3.10 started to encourage to use Py_SET_SIZE instead of
13+assigning into return value of Py_SIZE [3.10].
14+15+Python 3.11 flips the switch, turn Py_SIZE into a function [3.11],
16+thus Py_SIZE(obj) will be a rvalue. We need to use Py_SET_SIZE
17+to set size now.
18+19+[3.9]: https://docs.python.org/3.9/c-api/structures.html#c.Py_SET_SIZE
20+[3.10]: https://docs.python.org/3.10/c-api/structures.html#c.Py_SIZE
21+[3.11]: https://docs.python.org/3.11/c-api/structures.html#c.Py_SIZE
22+23+Adapted from https://github.com/mchehab/zbar/pull/231
24+25+Signed-off-by: Đoàn Trần Công Danh <congdanhqx@gmail.com>
26+Signed-off-by: Nick Cao <nickcao@nichi.co>
27+---
28+ python/enum.c | 8 ++++++++
29+ 1 file changed, 8 insertions(+)
30+31+diff --git a/python/enum.c b/python/enum.c
32+index dfe1b1e..4833a20 100644
33+--- a/python/enum.c
34++++ b/python/enum.c
35+@@ -52,7 +52,11 @@ enumitem_new (PyTypeObject *type,
36+37+ /* we assume the "fast path" for a single-digit ints (see longobject.c) */
38+ /* this also holds if we get a small_int preallocated long */
39++#if PY_VERSION_HEX >= 0x030900A4
40++ Py_SET_SIZE(&self->val, Py_SIZE(longval));
41++#else
42+ Py_SIZE(&self->val) = Py_SIZE(longval);
43++#endif
44+ self->val.ob_digit[0] = longval->ob_digit[0];
45+ Py_DECREF(longval);
46+ #else
47+@@ -143,7 +147,11 @@ zbarEnumItem_New (PyObject *byname,
48+49+ /* we assume the "fast path" for a single-digit ints (see longobject.c) */
50+ /* this also holds if we get a small_int preallocated long */
51++#if PY_VERSION_HEX >= 0x030900A4
52++ Py_SET_SIZE(&self->val, Py_SIZE(longval));
53++#else
54+ Py_SIZE(&self->val) = Py_SIZE(longval);
55++#endif
56+ self->val.ob_digit[0] = longval->ob_digit[0];
57+ Py_DECREF(longval);
58+59+--
60+2.39.1
61+