Add module

2 files changed, 81 insertions, 0 deletions

diff --git a/modules/packages/redpanda-connect/module.nix b/modules/packages/redpanda-connect/module.nix
new file mode 100644

index 0000000..1fdeb6d
--- /dev/null
+++ b/modules/packages/redpanda-connect/module.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.redpanda-connect;
+in
+{
+  options.services.redpanda-connect = {
+    enable = lib.mkEnableOption "Enable Redpanda Connect";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = (pkgs.callPackage ./package.nix { });
+      description = "The Redpanda Connect package";
+    };
+    pipelines = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            enable = lib.mkEnableOption "Enable the pipeline";
+            allowSudo = lib.mkEnableOption "Allow sudo";
+            config = lib.mkOption {
+              type = lib.types.attrs;
+              description = "The configuration for the pipeline";
+            };
+          };
+        }
+      );
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services = builtins.listToAttrs (
+      lib.mapAttrsToList (name: pipeline: {
+        name = "redpanda-connect-${name}";
+        value = {
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart =
+              let
+                configFile = pkgs.writeText "redpanda-connect-${name}.json" (builtins.toJSON pipeline.config);
+              in
+              "${cfg.package}/bin/redpanda-connect run ${configFile}";
+            Restart = "always";
+            RestartSec = "5";
+            DynamicUser = true;
+          };
+        };
+      }) cfg.pipelines
+    );
+
+    # Allow sudo access to allowed services:
+    #security.polkit.extraConfig = ''
+    #  polkit.addRule(function(action, subject) {
+    #    if (action.id == "org.freedesktop.systemd1.manage-units" &&
+    #        action.lookup("unit").startsWith("botcore.") &&
+    #        subject.user == "botcore") {
+    #      return polkit.Result.YES;
+    #    }
+    #  });
+    #'';
+
+    security.polkit.extraConfig =
+      let
+        allowedServices = builtins.filter (pipeline: pipeline.value.allowSudo) (lib.attrsToList cfg.pipelines);
+      in
+      builtins.concatStringsSep "\n" (
+        builtins.map (value: ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" &&
+                action.lookup("unit") == "redpanda-connect-${value.name}") {
+              return polkit.Result.YES;
+            }
+          });
+        '') allowedServices
+      );
+  };
+}
diff --git a/modules/packages/redpanda-connect.nix b/modules/packages/redpanda-connect/package.nix

index 2f9a6d9..2f9a6d9 100644
--- a/modules/packages/redpanda-connect.nix
+++ b/modules/packages/redpanda-connect/package.nix