Skip to content

Commit dc3c0ff

Browse files
bogdan-manolebogdan-manole
committed
refactor: move flake docker code to other file
1 parent e5b5430 commit dc3c0ff

File tree

2 files changed

+160
-162
lines changed

2 files changed

+160
-162
lines changed

‎docker-files/docker.nix‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
{ pkgs,flake, ... }: let
2+
pkgsLinux = pkgs // { system = "x86_64-linux"; };
3+
imgAttributes = {
4+
name = "plutus-certification";
5+
tag = "8";
6+
};
7+
nixConfig = ''
8+
trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= iohk.cachix.org-1:DpRUyj7h7V830dp/i6Nti+NEO2/nhblbov/8MW7Rqoo= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
9+
substituters = https://hydra.iohk.io https://cache.nixos.org/ https://cache.iog.io
10+
build-users-group = nixbld
11+
sandbox = false
12+
experimental-features = nix-command flakes
13+
allow-import-from-derivation = true
14+
filter-syscalls = false
15+
'';
16+
entryPoint =
17+
let addParameter = paramName: varName: ''
18+
if [ -n "${"$"}${varName}" ]; then
19+
args="$args --${paramName} ${"$"}${varName}"
20+
fi
21+
'';
22+
in (pkgs.writeShellScript "entryPoint" ''
23+
set -eEo pipefail
24+
args="--local "
25+
${addParameter "wallet-id" "WALLET_ID"} \
26+
${addParameter "wallet-address" "WALLET_ADDRESS"} \
27+
${addParameter "wallet-passphrase" "WALLET_PASSPHRASE"}
28+
${addParameter "wallet-url" "WALLET_URL"}
29+
${addParameter "wallet-certification-price" "WALLET_CERTIFICATION_PRICE"}
30+
${addParameter "gh-access-token" "GH_ACCESS_TOKEN"}
31+
${addParameter "signature-timeout" "SIGNATURE_TIMEOUT"}
32+
${addParameter "use-whitelist" "USE_WHITELIST"}
33+
${addParameter "unsafe-plain-address-auth" "UNSAFE_PLAIN_ADDRESS_AUTH"}
34+
${addParameter "port" "PORT"}
35+
if [ -n "$JWT_SECRET" ];
36+
then
37+
args="$args --jwt-secret $JWT_SECRET"
38+
${addParameter "jwt-expiration-seconds" "JWT_EXPIRATION"}
39+
else
40+
args="$args --unsafe-plain-address-auth"
41+
fi
42+
43+
# create a temporary directory for executing flakes
44+
mkdir -p /tmp
45+
46+
# copy the certificate bundle to the right place
47+
mkdir -p /etc/ssl/certs
48+
script="cp ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt"
49+
50+
#TODO: change this --unsafe-bypass-subscription-validation
51+
args="$args --unsafe-bypass-subscription-validation"
52+
53+
echo $script >&2
54+
eval "$script"
55+
56+
script="${flake.packages."plutus-certification:exe:plutus-certification"}/bin/plutus-certification $args"
57+
echo $script >&2
58+
eval "$script"
59+
'').outPath;
60+
61+
nixImage = pkgs.dockerTools.pullImage {
62+
imageName = "nixos/nix";
63+
imageDigest = "sha256:31b808456afccc2a419507ea112e152cf27e9bd2527517b0b6ca8639cc423501";
64+
sha256 = "0bbw3r0civlcm3inj23fq8f25aw63rnaay09qjbrvfjd7pcfbyqn";
65+
finalImageName = "nixos/nix";
66+
finalImageTag = "2.15.0";
67+
};
68+
genFlake = flake.packages."dapps-certification-helpers:exe:generate-flake";
69+
buildFlake = flake.packages."dapps-certification-helpers:exe:build-flake";
70+
image = pkgs.dockerTools.buildImage (imgAttributes // {
71+
fromImage = nixImage;
72+
diskSize = 5120;
73+
#contents = [ pkgs.hello ];
74+
copyToRoot = pkgs.buildEnv {
75+
name = "image-root";
76+
paths = [ pkgs.curl pkgs.zsh pkgs.coreutils pkgs.nmon pkgs.cacert genFlake buildFlake ];
77+
pathsToLink = [ "/bin" ];
78+
};
79+
runAsRoot = ''
80+
rm -rf /etc/nix/nix.conf
81+
echo "${nixConfig}" > /etc/nix/nix.conf
82+
'';
83+
84+
config = {
85+
Cmd = ["${entryPoint}"];
86+
User = "root";
87+
};
88+
});
89+
loadDockerImage = {
90+
type= "app";
91+
program = (pkgs.writeShellScript "loadDockerImage" ''
92+
set -eEuo pipefail
93+
echo "Loading docker image ${image}" >&2
94+
${pkgs.docker}/bin/docker load -i ${image}
95+
'').outPath;
96+
};
97+
in {
98+
loadDockerImage = loadDockerImage;
99+
runDockerImage =
100+
let addEnvVar = varName: ''
101+
if [ -n "${"$"}${varName}" ]; then
102+
docker_args="$docker_args -e ${varName}=${"$"}${varName}"
103+
fi
104+
'';
105+
in {
106+
type = "app";
107+
program = (pkgs.writeShellScript "runDockerImage" ''
108+
set -eEo pipefail
109+
export PATH="${pkgs.lib.makeBinPath [ pkgs.docker pkgs.coreutils]}"
110+
echo "Executing ${loadDockerImage.program}..." >&2
111+
${loadDockerImage.program}
112+
docker_args="-t --platform linux/amd64 --name ${imgAttributes.name}"
113+
114+
${addEnvVar "WALLET_ID"}
115+
${addEnvVar "WALLET_ADDRESS"}
116+
${addEnvVar "WALLET_PASSPHRASE"}
117+
${addEnvVar "JWT_SECRET"}
118+
${addEnvVar "WALLET_URL"}
119+
${addEnvVar "WALLET_CERTIFICATION_PRICE"}
120+
${addEnvVar "GH_ACCESS_TOKEN"}
121+
${addEnvVar "JWT_EXPIRATION"}
122+
${addEnvVar "SIGNATURE_TIMEOUT"}
123+
${addEnvVar "USE_WHITELIST"}
124+
${addEnvVar "UNSAFE_PLAIN_ADDRESS_AUTH"}
125+
${addEnvVar "PORT"}
126+
127+
if [[ -z "$PORT" ]]; then
128+
export PORT=9671
129+
fi
130+
docker_args="$docker_args -p $PORT:$PORT"
131+
132+
script="docker run --rm $docker_args ${imgAttributes.name}:${imgAttributes.tag}"
133+
echo $script >&2
134+
eval "$script"
135+
'').outPath;
136+
};
137+
pushDockerImage = {
138+
type = "app";
139+
#usage: nix run .\#apps.x86_64-linux.pushDockerImage -- <docker registry>
140+
#E.g. nix run .\#apps.x86_64-linux.pushDockerImage -- ghcr.io/demoiog
141+
program = (pkgs.writeShellScript "pushDockerImage" ''
142+
set -eEuo pipefail
143+
export PATH="${pkgs.lib.makeBinPath [ pkgs.docker pkgs.coreutils]}"
144+
${loadDockerImage.program}
145+
echo "Pushing docker image ${image}" >&2
146+
imageName="${imgAttributes.name}:${imgAttributes.tag}"
147+
148+
script="docker image tag $imageName $1/$imageName"
149+
echo $script >&2
150+
eval "$script"
151+
152+
script="docker push $1/$imageName"
153+
echo $script >&2
154+
eval "$script"
155+
156+
'').outPath;
157+
};
158+
}

‎flake.nix‎

Lines changed: 2 additions & 162 deletions
Original file line numberDiff line numberDiff line change
@@ -12,99 +12,7 @@
1212
in flake-utils.lib.eachSystem supportedSystems (system: let
1313
overlays = [ haskellNix.overlay ];
1414

15-
#***************************************************************************************
16-
# Docker image
17-
1815
pkgs = import nixpkgs { inherit system overlays; inherit (haskellNix) config; };
19-
pkgsLinux = pkgs // { system = "x86_64-linux"; };
20-
21-
imgAttributes = {
22-
name = "plutus-certification";
23-
tag = "8";
24-
};
25-
nixConfig = ''
26-
trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= iohk.cachix.org-1:DpRUyj7h7V830dp/i6Nti+NEO2/nhblbov/8MW7Rqoo= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
27-
substituters = https://hydra.iohk.io https://cache.nixos.org/ https://cache.iog.io
28-
build-users-group = nixbld
29-
sandbox = false
30-
experimental-features = nix-command flakes
31-
allow-import-from-derivation = true
32-
filter-syscalls = false
33-
'';
34-
entryPoint =
35-
let addParameter = paramName: varName: ''
36-
if [ -n "${"$"}${varName}" ]; then
37-
args="$args --${paramName} ${"$"}${varName}"
38-
fi
39-
'';
40-
in (pkgs.writeShellScript "entryPoint" ''
41-
set -eEo pipefail
42-
args="--local "
43-
${addParameter "wallet-id" "WALLET_ID"} \
44-
${addParameter "wallet-address" "WALLET_ADDRESS"} \
45-
${addParameter "wallet-passphrase" "WALLET_PASSPHRASE"}
46-
${addParameter "wallet-url" "WALLET_URL"}
47-
${addParameter "wallet-certification-price" "WALLET_CERTIFICATION_PRICE"}
48-
${addParameter "gh-access-token" "GH_ACCESS_TOKEN"}
49-
${addParameter "signature-timeout" "SIGNATURE_TIMEOUT"}
50-
${addParameter "use-whitelist" "USE_WHITELIST"}
51-
${addParameter "unsafe-plain-address-auth" "UNSAFE_PLAIN_ADDRESS_AUTH"}
52-
${addParameter "port" "PORT"}
53-
if [ -n "$JWT_SECRET" ];
54-
then
55-
args="$args --jwt-secret $JWT_SECRET"
56-
${addParameter "jwt-expiration-seconds" "JWT_EXPIRATION"}
57-
else
58-
args="$args --unsafe-plain-address-auth"
59-
fi
60-
61-
# create a temporary directory for executing flakes
62-
mkdir -p /tmp
63-
64-
# copy the certificate bundle to the right place
65-
mkdir -p /etc/ssl/certs
66-
script="cp ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt"
67-
68-
#TODO: change this --unsafe-bypass-subscription-validation
69-
args="$args --unsafe-bypass-subscription-validation"
70-
71-
echo $script >&2
72-
eval "$script"
73-
74-
script="${flake.packages."plutus-certification:exe:plutus-certification"}/bin/plutus-certification $args"
75-
echo $script >&2
76-
eval "$script"
77-
'').outPath;
78-
79-
nixImage = pkgs.dockerTools.pullImage {
80-
imageName = "nixos/nix";
81-
imageDigest = "sha256:31b808456afccc2a419507ea112e152cf27e9bd2527517b0b6ca8639cc423501";
82-
sha256 = "0bbw3r0civlcm3inj23fq8f25aw63rnaay09qjbrvfjd7pcfbyqn";
83-
finalImageName = "nixos/nix";
84-
finalImageTag = "2.15.0";
85-
};
86-
genFlake = flake.packages."dapps-certification-helpers:exe:generate-flake";
87-
buildFlake = flake.packages."dapps-certification-helpers:exe:build-flake";
88-
89-
image = pkgs.dockerTools.buildImage (imgAttributes // {
90-
fromImage = nixImage;
91-
diskSize = 5120;
92-
#contents = [ pkgs.hello ];
93-
copyToRoot = pkgs.buildEnv {
94-
name = "image-root";
95-
paths = [ pkgs.curl pkgs.zsh pkgs.coreutils pkgs.nmon pkgs.cacert genFlake buildFlake ];
96-
pathsToLink = [ "/bin" ];
97-
};
98-
runAsRoot = ''
99-
rm -rf /etc/nix/nix.conf
100-
echo "${nixConfig}" > /etc/nix/nix.conf
101-
'';
102-
103-
config = {
104-
Cmd = ["${entryPoint}"];
105-
User = "root";
106-
};
107-
});
10816

10917
materializedPath = ./. + "/nix/materialized/${system}";
11018

@@ -121,83 +29,15 @@
12129
};
12230

12331
flake = project.flake {};
124-
loadDockerImage = {
125-
type= "app";
126-
program = (pkgs.writeShellScript "loadDockerImage" ''
127-
set -eEuo pipefail
128-
echo "Loading docker image ${image}" >&2
129-
${pkgs.docker}/bin/docker load -i ${image}
130-
'').outPath;
131-
};
132-
runDockerImage =
133-
let addEnvVar = varName: ''
134-
if [ -n "${"$"}${varName}" ]; then
135-
docker_args="$docker_args -e ${varName}=${"$"}${varName}"
136-
fi
137-
'';
138-
in {
139-
type = "app";
140-
program = (pkgs.writeShellScript "runDockerImage" ''
141-
set -eEo pipefail
142-
export PATH="${pkgs.lib.makeBinPath [ pkgs.docker pkgs.coreutils]}"
143-
echo "Executing ${loadDockerImage.program}..." >&2
144-
${loadDockerImage.program}
145-
docker_args="-t --platform linux/amd64 --name ${imgAttributes.name}"
14632

147-
${addEnvVar "WALLET_ID"}
148-
${addEnvVar "WALLET_ADDRESS"}
149-
${addEnvVar "WALLET_PASSPHRASE"}
150-
${addEnvVar "JWT_SECRET"}
151-
${addEnvVar "WALLET_URL"}
152-
${addEnvVar "WALLET_CERTIFICATION_PRICE"}
153-
${addEnvVar "GH_ACCESS_TOKEN"}
154-
${addEnvVar "JWT_EXPIRATION"}
155-
${addEnvVar "SIGNATURE_TIMEOUT"}
156-
${addEnvVar "USE_WHITELIST"}
157-
${addEnvVar "UNSAFE_PLAIN_ADDRESS_AUTH"}
158-
${addEnvVar "PORT"}
33+
dockerApps = import ./docker-files/docker.nix { pkgs = pkgs; flake = flake; };
15934

160-
if [[ -z "$PORT" ]]; then
161-
export PORT=9671
162-
fi
163-
docker_args="$docker_args -p $PORT:$PORT"
164-
165-
script="docker run --rm $docker_args ${imgAttributes.name}:${imgAttributes.tag}"
166-
echo $script >&2
167-
eval "$script"
168-
'').outPath;
169-
};
170-
pushDockerImage = {
171-
type = "app";
172-
#usage: nix run .\#apps.x86_64-linux.pushDockerImage -- <docker registry>
173-
#E.g. nix run .\#apps.x86_64-linux.pushDockerImage -- ghcr.io/demoiog
174-
program = (pkgs.writeShellScript "pushDockerImage" ''
175-
set -eEuo pipefail
176-
export PATH="${pkgs.lib.makeBinPath [ pkgs.docker pkgs.coreutils]}"
177-
${loadDockerImage.program}
178-
echo "Pushing docker image ${image}" >&2
179-
imageName="${imgAttributes.name}:${imgAttributes.tag}"
180-
181-
script="docker image tag $imageName $1/$imageName"
182-
echo $script >&2
183-
eval "$script"
184-
185-
script="docker push $1/$imageName"
186-
echo $script >&2
187-
eval "$script"
188-
189-
'').outPath;
190-
};
19135
in flake // {
19236
packages = flake.packages // {
19337
inherit (project.plan-nix.passthru) generateMaterialized;
194-
inherit image;
19538
};
19639
defaultPackage = flake.packages."plutus-certification:exe:plutus-certification";
197-
apps = flake.apps // {
198-
inherit loadDockerImage;
199-
inherit runDockerImage;
200-
inherit pushDockerImage;
40+
apps = flake.apps // dockerApps // {
20141
updateAllMaterialized = {
20242
type = "app";
20343
program = (pkgs.writeShellScript "updateAllMaterialized" ''

0 commit comments

Comments
 (0)