-
Notifications
You must be signed in to change notification settings - Fork 52
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support targeting installs to Determinate Nix Enterprise Edition. (#905)
* Drop riff support * Relocate the darwin diskutil structs to make room for keychain * Clean up a few warnings * Initial support for Determinate Nix Enterprise * Don't create the org.nixos.darwin-store service under enterprise nix. * Only write out systems.determinate.nix-daemon under nix enterprise * Bump the nix crate from 0.27.0 to 0.28.0 for nix-rust/nix#2304 * Fixup the test fixture for macos * Correct ConfigureInitService on Linux * Fixup fixtures for linux * Use Determinate Nix for macOS to perform the mount during installation. * Force-enable encryption for Nix Enterprise on macOS * fixup * drop extraneous comment * Create a separate CreateNixEnterpriseVolume to simplify CreateNixVolume. * fixup * Relocate the nix-enterprise flag down into the macOS planner, since our planning requires no changes on other targets at the moment. * Fail the install if --nix-enterprise is passed but isn't available * fixup nix_enterprise bits * I hate this. * Rename to be Determinate Nix Enterprise Edition, to be more consistent across tools and products. * Note why we match on enterprise edition in the macos planner for the otherwise no-op enterprise_editition encryption case * fixup * Factor out the enterprise init service setup into its own module * Conditionally import / use EE init service * nit * derp * fixup: too many args to plan * ...derp...
- Loading branch information
Showing
18 changed files
with
687 additions
and
99 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
188 changes: 188 additions & 0 deletions
188
src/action/common/configure_enterprise_edition_init_service.rs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,188 @@ | ||
| use std::path::PathBuf; | ||
|
|
||
| #[cfg(target_os = "macos")] | ||
| use serde::{Deserialize, Serialize}; | ||
| #[cfg(target_os = "macos")] | ||
| use tokio::io::AsyncWriteExt; | ||
| use tokio::process::Command; | ||
| use tracing::{span, Span}; | ||
|
|
||
| use crate::action::{ActionError, ActionErrorKind, ActionTag, StatefulAction}; | ||
| use crate::execute_command; | ||
|
|
||
| use crate::action::{Action, ActionDescription}; | ||
|
|
||
| #[cfg(target_os = "macos")] | ||
| const DARWIN_ENTERPRISE_EDITION_DAEMON_DEST: &str = | ||
| "/Library/LaunchDaemons/systems.determinate.nix-daemon.plist"; | ||
| /** | ||
| Configure the init to run the Nix daemon | ||
| */ | ||
| #[derive(Debug, serde::Deserialize, serde::Serialize, Clone)] | ||
| pub struct ConfigureEnterpriseEditionInitService { | ||
| start_daemon: bool, | ||
| } | ||
|
|
||
| impl ConfigureEnterpriseEditionInitService { | ||
| #[tracing::instrument(level = "debug", skip_all)] | ||
| pub async fn plan(start_daemon: bool) -> Result<StatefulAction<Self>, ActionError> { | ||
| Ok(Self { start_daemon }.into()) | ||
| } | ||
| } | ||
|
|
||
| #[async_trait::async_trait] | ||
| #[typetag::serde(name = "configure_enterprise_edition_init_service")] | ||
| impl Action for ConfigureEnterpriseEditionInitService { | ||
| fn action_tag() -> ActionTag { | ||
| ActionTag("configure_enterprise_edition_init_service") | ||
| } | ||
| fn tracing_synopsis(&self) -> String { | ||
| "Configure the Determinate Nix Enterprise Edition daemon related settings with launchctl" | ||
| .to_string() | ||
| } | ||
|
|
||
| fn tracing_span(&self) -> Span { | ||
| span!( | ||
| tracing::Level::DEBUG, | ||
| "configure_enterprise_edition_init_service" | ||
| ) | ||
| } | ||
|
|
||
| fn execute_description(&self) -> Vec<ActionDescription> { | ||
| let mut explanation = vec![format!("Create `{DARWIN_ENTERPRISE_EDITION_DAEMON_DEST}`")]; | ||
| if self.start_daemon { | ||
| explanation.push(format!( | ||
| "Run `launchctl load {DARWIN_ENTERPRISE_EDITION_DAEMON_DEST}`" | ||
| )); | ||
| } | ||
|
|
||
| vec![ActionDescription::new(self.tracing_synopsis(), explanation)] | ||
| } | ||
|
|
||
| #[tracing::instrument(level = "debug", skip_all)] | ||
| async fn execute(&mut self) -> Result<(), ActionError> { | ||
| let Self { start_daemon } = self; | ||
|
|
||
| let daemon_file = DARWIN_ENTERPRISE_EDITION_DAEMON_DEST; | ||
| let domain = "system"; | ||
| let service = "systems.determinate.nix-daemon"; | ||
|
|
||
| let generated_plist = generate_plist(); | ||
|
|
||
| let mut options = tokio::fs::OpenOptions::new(); | ||
| options.create(true).write(true).read(true); | ||
|
|
||
| let mut file = options | ||
| .open(&daemon_file) | ||
| .await | ||
| .map_err(|e| Self::error(ActionErrorKind::Open(PathBuf::from(daemon_file), e)))?; | ||
|
|
||
| let mut buf = Vec::new(); | ||
| plist::to_writer_xml(&mut buf, &generated_plist).map_err(Self::error)?; | ||
| file.write_all(&buf) | ||
| .await | ||
| .map_err(|e| Self::error(ActionErrorKind::Write(PathBuf::from(daemon_file), e)))?; | ||
|
|
||
| execute_command( | ||
| Command::new("launchctl") | ||
| .process_group(0) | ||
| .args(["load", "-w"]) | ||
| .arg(daemon_file) | ||
| .stdin(std::process::Stdio::null()), | ||
| ) | ||
| .await | ||
| .map_err(Self::error)?; | ||
|
|
||
| let is_disabled = crate::action::macos::service_is_disabled(domain, service) | ||
| .await | ||
| .map_err(Self::error)?; | ||
| if is_disabled { | ||
| execute_command( | ||
| Command::new("launchctl") | ||
| .process_group(0) | ||
| .arg("enable") | ||
| .arg(&format!("{domain}/{service}")) | ||
| .stdin(std::process::Stdio::null()), | ||
| ) | ||
| .await | ||
| .map_err(Self::error)?; | ||
| } | ||
|
|
||
| if *start_daemon { | ||
| execute_command( | ||
| Command::new("launchctl") | ||
| .process_group(0) | ||
| .arg("kickstart") | ||
| .arg("-k") | ||
| .arg(&format!("{domain}/{service}")) | ||
| .stdin(std::process::Stdio::null()), | ||
| ) | ||
| .await | ||
| .map_err(Self::error)?; | ||
| } | ||
|
|
||
| Ok(()) | ||
| } | ||
|
|
||
| fn revert_description(&self) -> Vec<ActionDescription> { | ||
| vec![ActionDescription::new( | ||
| "Unconfigure Nix daemon related settings with launchctl".to_string(), | ||
| vec![format!( | ||
| "Run `launchctl unload {DARWIN_ENTERPRISE_EDITION_DAEMON_DEST}`" | ||
| )], | ||
| )] | ||
| } | ||
|
|
||
| #[tracing::instrument(level = "debug", skip_all)] | ||
| async fn revert(&mut self) -> Result<(), ActionError> { | ||
| execute_command( | ||
| Command::new("launchctl") | ||
| .process_group(0) | ||
| .arg("unload") | ||
| .arg(DARWIN_ENTERPRISE_EDITION_DAEMON_DEST), | ||
| ) | ||
| .await | ||
| .map_err(Self::error)?; | ||
|
|
||
| Ok(()) | ||
| } | ||
| } | ||
|
|
||
| #[non_exhaustive] | ||
| #[derive(Debug, thiserror::Error)] | ||
| pub enum ConfigureEnterpriseEditionNixDaemonServiceError {} | ||
|
|
||
| #[cfg(target_os = "macos")] | ||
| #[derive(Deserialize, Clone, Debug, Serialize, PartialEq)] | ||
| #[serde(rename_all = "PascalCase")] | ||
| pub struct DeterminateNixDaemonPlist { | ||
| label: String, | ||
| program: String, | ||
| keep_alive: bool, | ||
| run_at_load: bool, | ||
| standard_error_path: String, | ||
| standard_out_path: String, | ||
| soft_resource_limits: ResourceLimits, | ||
| } | ||
|
|
||
| #[cfg(target_os = "macos")] | ||
| #[derive(Deserialize, Clone, Debug, Serialize, PartialEq)] | ||
| #[serde(rename_all = "PascalCase")] | ||
| pub struct ResourceLimits { | ||
| number_of_files: usize, | ||
| } | ||
|
|
||
| #[cfg(target_os = "macos")] | ||
| fn generate_plist() -> DeterminateNixDaemonPlist { | ||
| DeterminateNixDaemonPlist { | ||
| keep_alive: true, | ||
| run_at_load: true, | ||
| label: "systems.determinate.nix-daemon".into(), | ||
| program: "/usr/local/bin/determinate-nix-ee".into(), | ||
| standard_error_path: "/var/log/determinate-nix-daemon.log".into(), | ||
| standard_out_path: "/var/log/determinate-nix-daemon.log".into(), | ||
| soft_resource_limits: ResourceLimits { | ||
| number_of_files: 1048576, | ||
| }, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.