v0.21.0

New Features

Object Transforms: declarative rule engine for Kubernetes objects - @sini #100

A new objectTransforms option (environment-wide and per-application) lets you match and modify rendered objects across your entire environment. Each rule selects objects with match and applies exactly one of:

• rewrite: an eval-time function resource -> resource that transforms (or drops by returning null) objects while nixidy is evaluating.
• postProcess: an activation-time stdin → stdout filter that runs when the environment is applied, after the object has been rendered to its file. Supports a bare command string or a full form with runtimeInputs and a function resolved per matched object.

{
  nixidy.objectTransforms = [
    # Add a managed-by label to every object in the environment.
    {
      rewrite =
        resource:
        resource
        // {
          metadata = resource.metadata // {
            labels = (resource.metadata.labels or { }) // {
              "app.kubernetes.io/managed-by" = "nixidy";
            };
          };
        };
    }

    # Drop every HorizontalPodAutoscaler.
    {
      match.kind = "HorizontalPodAutoscaler";
      rewrite = _: null;
    }

    # Encrypt secrets at activation time
    {
      match.kind = "SopsSecret";
      postProcess = {
        runtimeInputs = [ pkgs.sops ];
        command =
          { resource, ... }:
          "sops --encrypt --input-type yaml --output-type yaml /dev/stdin";
      };
    }
  ];
}

postProcess commands run outside the Nix sandbox (so they can reach secrets, hardware keys, etc.). For visibility, nixidy switch prints every command it is about to run and, when attached to a terminal, pauses for confirmation. Two environment variables tune the behaviour:

• NIXIDY_POST_PROCESS_APPROVE=1: skips the prompt for trusted interactive use
• NIXIDY_SKIP_POST_PROCESS=1: reuses the already-rendered target files without running anything

See the new Object Transforms documentation for full details.

devenv support in the CLI - #94

The nixidy CLI now supports devenv as an alternative build backend. When a devenv.nix file is detected (and neither flake.nix nor default.nix is present), the CLI automatically uses devenv. Pass --devenv on any command to force it:

nixidy build --devenv dev

Set up devenv with nixidy:

devenv init
devenv inputs add nixidy github:arnarg/nixidy/latest

Then create devenv.nix:

{
  inputs,
  pkgs,
  ...
}: {
  outputs = {
    nixidyEnvs = inputs.nixidy.lib.mkEnvs {
      inherit pkgs;

      envs = {
        dev.modules = [ ./env/dev.nix ];
      };
    };
  };

  packages = [
    inputs.nixidy.packages.${pkgs.stdenv.system}.default
  ];
}