tgirl.cloud
isabelroses.com
+124
modules/nixos/nixpkgs-prs-bot.nix
+124
modules/nixos/nixpkgs-prs-bot.nix
···
1
+
{ tgirlpkgs }:
2
+
{
3
+
lib,
4
+
pkgs,
5
+
config,
6
+
...
7
+
}:
8
+
let
9
+
inherit (lib)
10
+
getExe
11
+
mkIf
12
+
mkMerge
13
+
mkOption
14
+
mkEnableOption
15
+
;
16
+
17
+
cfg = config.services.nixpkgs-prs-bot;
18
+
in
19
+
{
20
+
_class = "nixos";
21
+
22
+
options.services.nixpkgs-prs-bot = {
23
+
enable = mkEnableOption "nixpkgs prs bot";
24
+
25
+
package = lib.mkOption {
26
+
type = lib.types.package;
27
+
default = tgirlpkgs.packages.${pkgs.stdenv.hostPlatform.system}.nixpkgs-prs;
28
+
description = "The package to use for blahaj";
29
+
};
30
+
31
+
fedi = {
32
+
enable = mkEnableOption "fedi" // {
33
+
default = cfg.enable;
34
+
};
35
+
36
+
environmentFile = mkOption {
37
+
type = lib.types.nullOr lib.types.path;
38
+
default = null;
39
+
};
40
+
};
41
+
42
+
bsky = {
43
+
enable = mkEnableOption "bsky" // {
44
+
default = cfg.enable;
45
+
};
46
+
47
+
environmentFile = mkOption {
48
+
type = lib.types.nullOr lib.types.path;
49
+
default = null;
50
+
};
51
+
};
52
+
};
53
+
54
+
config = mkIf cfg.enable {
55
+
users = {
56
+
users.nixpkgs-prs-bot = {
57
+
isSystemUser = true;
58
+
createHome = false;
59
+
description = "nixpkgs prs bot";
60
+
group = "nixpkgs-prs-bot";
61
+
};
62
+
63
+
groups.nixpkgs-prs-bot = { };
64
+
};
65
+
66
+
systemd = mkMerge (
67
+
lib.map
68
+
(
69
+
attr:
70
+
mkIf cfg.${attr}.enable {
71
+
timers."nixpkgs-prs-${attr}" = {
72
+
description = "post to ${attr} every night";
73
+
wantedBy = [ "timers.target" ];
74
+
timerConfig = {
75
+
OnCalendar = "*-*-* 00:05:00 UTC";
76
+
Persistent = true;
77
+
};
78
+
};
79
+
80
+
services."nixpkgs-prs-${attr}" = {
81
+
description = "nixpkgs prs ${attr} bot";
82
+
after = [ "network.target" ];
83
+
path = [ cfg.package ];
84
+
85
+
serviceConfig = {
86
+
ExecStart = "${getExe cfg.package} ${attr}";
87
+
EnvironmentFile = mkIf (cfg.${attr}.environmentFile != null) cfg.${attr}.environmentFile;
88
+
Type = "oneshot";
89
+
User = "nixpkgs-prs-bot";
90
+
Group = "nixpkgs-prs-bot";
91
+
ReadWritePaths = [ ];
92
+
LockPersonality = true;
93
+
MemoryDenyWriteExecute = true;
94
+
NoNewPrivileges = true;
95
+
PrivateDevices = true;
96
+
PrivateIPC = true;
97
+
PrivateTmp = true;
98
+
PrivateUsers = true;
99
+
ProtectClock = true;
100
+
ProtectControlGroups = true;
101
+
ProtectHome = true;
102
+
ProtectHostname = true;
103
+
ProtectKernelLogs = true;
104
+
ProtectKernelModules = true;
105
+
ProtectKernelTunables = true;
106
+
ProtectProc = "invisible";
107
+
ProtectSystem = "full";
108
+
RestrictNamespaces = "uts ipc pid user cgroup";
109
+
RestrictRealtime = true;
110
+
RestrictSUIDSGID = true;
111
+
SystemCallArchitectures = "native";
112
+
SystemCallFilter = [ "@system-service" ];
113
+
UMask = "0077";
114
+
};
115
+
};
116
+
}
117
+
)
118
+
[
119
+
"fedi"
120
+
"bsky"
121
+
]
122
+
);
123
+
};
124
+
}
+47
nilla.nix
+47
nilla.nix
···
1
+
let
2
+
nilla = import (
3
+
builtins.fetchTarball {
4
+
url = "https://github.com/nilla-nix/nilla/archive/main.tar.gz";
5
+
sha256 = "sha256-8vHPd/vRbylp9C4+PMk+pf63SDzSPgfkuSdAf7VAums=";
6
+
}
7
+
);
8
+
9
+
flakelock = builtins.fromJSON (builtins.readFile ./flake.lock);
10
+
11
+
result = nilla.create (
12
+
{ config }:
13
+
{
14
+
config = {
15
+
inputs = {
16
+
nixpkgs =
17
+
let
18
+
lock = flakelock.nodes.nixpkgs.locked;
19
+
in
20
+
{
21
+
src = builtins.fetchTarball {
22
+
url = "https://github.com/NixOS/nixpkgs/archive/${lock.rev}.tar.gz";
23
+
sha256 = lock.narHash;
24
+
};
25
+
26
+
loader = "flake";
27
+
};
28
+
};
29
+
30
+
packages = builtins.mapAttrs (name: _: {
31
+
systems = [ "aarch64-darwin" ];
32
+
33
+
builder = "nixpkgs";
34
+
35
+
settings = {
36
+
pkgs = config.inputs.nixpkgs.loaded;
37
+
38
+
args = { };
39
+
};
40
+
41
+
package = import ./pkgs/${name}/package.nix;
42
+
}) (builtins.readDir ./pkgs);
43
+
};
44
+
}
45
+
);
46
+
in
47
+
result
+51
pkgs/nixpkgs-prs/package.nix
+51
pkgs/nixpkgs-prs/package.nix
···
1
+
{
2
+
lib,
3
+
rustPlatform,
4
+
fetchFromGitHub,
5
+
openssl,
6
+
pkg-config,
7
+
versionCheckHook,
8
+
nix-update-script,
9
+
}:
10
+
rustPlatform.buildRustPackage {
11
+
pname = "nixpkgs-prs";
12
+
version = "0.3.0";
13
+
14
+
src = fetchFromGitHub {
15
+
owner = "isabelroses";
16
+
repo = "nixpkgs-prs-bot";
17
+
rev = "771a46c84fc48c8bda085593ebfd427d8d7db989";
18
+
hash = "sha256-IwnBqjdBilqeRJvXF8zNzrO7zKkCsN2pHSpf9uHchnU=";
19
+
};
20
+
21
+
useFetchCargoVendor = true;
22
+
cargoHash = "sha256-h4rVyfrjajlsxcWB2WCPuhUdpMlPu1VxfKmEUY5g9ic=";
23
+
24
+
nativeBuildInputs = [
25
+
pkg-config
26
+
versionCheckHook
27
+
];
28
+
29
+
buildInputs = [
30
+
openssl
31
+
];
32
+
33
+
doInstallCheck = true;
34
+
versionCheckProgram = "${placeholder "out"}/bin/nixpkgs-prs";
35
+
versionCheckProgramArg = [ "--version" ];
36
+
37
+
passthru.updateScript = nix-update-script {
38
+
extraArgs = [
39
+
"--version"
40
+
"branch=HEAD"
41
+
];
42
+
};
43
+
44
+
meta = {
45
+
homepage = "https://github.com/isabelroses/nixpkgs-prs-bot";
46
+
description = "check the merged nixpkgs PRs for that day";
47
+
license = lib.licenses.eupl12;
48
+
maintainers = with lib.maintainers; [ isabelroses ];
49
+
mainProgram = "nixpkgs-prs";
50
+
};
51
+
}