Skip to content

Commit e3cfe7c

Browse files
zimbatmzimbatm
authored
Merge pull request #45 from awakesecurity/parnell/custom-configuration
Add support for hermetic nixos configurations
2 parents 1d85672 + 26a589f commit e3cfe7c

File tree

4 files changed

+112
-7
lines changed

4 files changed

+112
-7
lines changed

‎deploy_nixos/main.tf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,12 @@ variable "target_system" {
9393
default = "x86_64-linux"
9494
}
9595

96+
variable "hermetic" {
97+
type = bool
98+
description = "Treat the provided nixos configuration as a hermetic expression and do not evaluate using the ambient system nixpkgs. Useful if you customize eval-modules or use a pinned nixpkgs."
99+
default = false
100+
}
101+
96102
# --------------------------------------------------------------------------
97103

98104
locals {
@@ -122,7 +128,8 @@ data "external" "nixos-instantiate" {
122128
var.config_pwd == "" ? "." : var.config_pwd,
123129
# end of positional arguments
124130
# start of pass-through arguments
125-
"--argstr", "system", var.target_system
131+
"--argstr", "system", var.target_system,
132+
"--arg", "hermetic", var.hermetic
126133
],
127134
var.extra_eval_args,
128135
)

‎deploy_nixos/nixos-instantiate.sh‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,28 @@ config_pwd=$3
88
shift 3
99

1010
# Building the command
11+
nixExpression=<<EOF
12+
13+
EOF
14+
1115
command=(nix-instantiate --show-trace --expr '
12-
{ system, configuration, ... }:
16+
{ system, configuration, hermetic ? false, ... }:
1317
let
14-
os = import <nixpkgs/nixos> { inherit system configuration; };
15-
inherit (import <nixpkgs/lib>) concatStringsSep;
18+
os =
19+
if hermetic
20+
then import configuration
21+
else import <nixpkgs/nixos> { inherit system configuration; };
1622
in {
17-
substituters = concatStringsSep " " os.config.nix.binaryCaches;
18-
trusted-public-keys = concatStringsSep " " os.config.nix.binaryCachePublicKeys;
23+
inherit (builtins) currentSystem;
24+
25+
substituters =
26+
builtins.concatStringsSep " " os.config.nix.binaryCaches;
27+
28+
trusted-public-keys =
29+
builtins.concatStringsSep " " os.config.nix.binaryCachePublicKeys;
30+
1931
drv_path = os.system.drvPath;
2032
out_path = os.system;
21-
inherit (builtins) currentSystem;
2233
}')
2334

2435
if readlink --version | grep GNU; then

‎examples/hermetic_config/configuration.nix‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# A simple, hermetic NixOS configuration for an AWS EC2 instance that
2+
# uses a nixpkgs pinned to a specific Git revision with an integrity
3+
# hash to ensure that we construct a NixOS system as purely as
4+
# possible.
5+
#
6+
# i.e. we explicitly specify which nixpkgs to use instead of relying
7+
# on the nixpkgs supplied on the NIX_PATH.
8+
#
9+
# The primary benefit of this is that it removes deployment surprises
10+
# when other developers supply a different nix-channel in the NIX_PATH
11+
# of their environment (even if you only add the 20.09 channel,
12+
# nix-channel --update can mutate that channel to a 20.09 with
13+
# backported changes).
14+
#
15+
# The secondary benefit is that you guard the `nixpkgs` you use, with
16+
# an integrity hash.
17+
let
18+
nixpkgs =
19+
let
20+
rev = "cd63096d6d887d689543a0b97743d28995bc9bc3";
21+
sha256 = "1wg61h4gndm3vcprdcg7rc4s1v3jkm5xd7lw8r2f67w502y94gcy";
22+
in
23+
builtins.fetchTarball {
24+
url = "https://github.com/NixOS/nixpkgs/archive/${rev}.tar.gz";
25+
inherit sha256;
26+
};
27+
28+
system = "x86_64-linux";
29+
30+
configuration = { config, pkgs, ... }: {
31+
imports = [
32+
"${nixpkgs}/nixos/modules/virtualisation/amazon-image.nix"
33+
];
34+
35+
ec2.hvm = true;
36+
37+
networking.firewall.allowedTCPPorts = [ 22 80 ];
38+
39+
environment.systemPackages = [
40+
pkgs.cloud-utils
41+
];
42+
43+
services.nginx = {
44+
enable = true;
45+
virtualHosts = {
46+
"_" = {
47+
root = pkgs.writeTextDir "html/index.html" ''
48+
<html>
49+
<body>
50+
<h1>This is a hermetic NixOS configuration!</h1>
51+
</body>
52+
</html>
53+
'';
54+
};
55+
};
56+
};
57+
};
58+
59+
in
60+
import "${nixpkgs}/nixos" { inherit system configuration; }

‎examples/hermetic_config/default.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
profile = "yourprofile"
4+
}
5+
6+
resource "aws_instance" "hermetic-nixos-system" {
7+
count = 1
8+
ami = "ami-068a62d478710462d" # NixOS 20.09 AMI
9+
10+
instance_type = "t2.micro"
11+
12+
key_name = "yourkeyname"
13+
14+
tags = {
15+
Name = "hermetic-nixos-system-example"
16+
Description = "An example of a hermetic NixOS system deployed by Terraform"
17+
}
18+
}
19+
20+
module "deploy_nixos" {
21+
source = "github.com/awakesecurity/terraform-nixos//deploy_nixos?ref=c4b1ee6d24b54e92fa3439a12bce349a6805bcdd"
22+
nixos_config = "${path.module}/configuration.nix"
23+
hermetic = true
24+
target_user = "root"
25+
target_host = aws_instance.hermetic-nixos-system[0].public_ip
26+
ssh_private_key_file = pathexpand("~/.ssh/yourkeyname.pem")
27+
}

0 commit comments

Comments
 (0)