From 35cba8b6c2ce080d06af2197b279784bb5244ca5 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Tue, 24 Dec 2024 04:56:21 +0100
Subject: Add module

---
 modules/packages/redpanda-connect.nix         | 43 --------------
 modules/packages/redpanda-connect/module.nix  | 81 +++++++++++++++++++++++++++
 modules/packages/redpanda-connect/package.nix | 43 ++++++++++++++
 3 files changed, 124 insertions(+), 43 deletions(-)
 delete mode 100644 modules/packages/redpanda-connect.nix
 create mode 100644 modules/packages/redpanda-connect/module.nix
 create mode 100644 modules/packages/redpanda-connect/package.nix

(limited to 'modules')

diff --git a/modules/packages/redpanda-connect.nix b/modules/packages/redpanda-connect.nix
deleted file mode 100644
index 2f9a6d9..0000000
--- a/modules/packages/redpanda-connect.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-buildGoModule rec {
-  pname = "redpanda-connect";
-  version = "4.44.0";
-
-  src = fetchFromGitHub {
-    owner = "redpanda-data";
-    repo = "connect";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-pwtP1zybMvq1wQ50Ob20MVR3/v1yd7BjWe1nPFLO6mU=";
-  };
-
-  proxyVendor = true;
-
-  subPackages = [
-    "cmd/redpanda-connect"
-  ];
-
-  vendorHash = "sha256-5KXJiInuEX7fEl7y3iGvxQHptoM5z3TMmg6KZ2lx/fw=";
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/redpanda-data/connect/v4/internal/cli.Version=${version}"
-  ];
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Fancy stream processing made operationally mundane";
-    mainProgram = "redpanda-connect";
-    homepage = "https://www.redpanda.com/connect";
-    changelog = "https://github.com/redpanda-data/connect/blob/v${version}/CHANGELOG.md";
-    # license = lib.licenses.mixed;
-    maintainers = with lib.maintainers; [ ];
-  };
-}
diff --git a/modules/packages/redpanda-connect/module.nix b/modules/packages/redpanda-connect/module.nix
new file mode 100644
index 0000000..1fdeb6d
--- /dev/null
+++ b/modules/packages/redpanda-connect/module.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.redpanda-connect;
+in
+{
+  options.services.redpanda-connect = {
+    enable = lib.mkEnableOption "Enable Redpanda Connect";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = (pkgs.callPackage ./package.nix { });
+      description = "The Redpanda Connect package";
+    };
+    pipelines = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            enable = lib.mkEnableOption "Enable the pipeline";
+            allowSudo = lib.mkEnableOption "Allow sudo";
+            config = lib.mkOption {
+              type = lib.types.attrs;
+              description = "The configuration for the pipeline";
+            };
+          };
+        }
+      );
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services = builtins.listToAttrs (
+      lib.mapAttrsToList (name: pipeline: {
+        name = "redpanda-connect-${name}";
+        value = {
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart =
+              let
+                configFile = pkgs.writeText "redpanda-connect-${name}.json" (builtins.toJSON pipeline.config);
+              in
+              "${cfg.package}/bin/redpanda-connect run ${configFile}";
+            Restart = "always";
+            RestartSec = "5";
+            DynamicUser = true;
+          };
+        };
+      }) cfg.pipelines
+    );
+
+    # Allow sudo access to allowed services:
+    #security.polkit.extraConfig = ''
+    #  polkit.addRule(function(action, subject) {
+    #    if (action.id == "org.freedesktop.systemd1.manage-units" &&
+    #        action.lookup("unit").startsWith("botcore.") &&
+    #        subject.user == "botcore") {
+    #      return polkit.Result.YES;
+    #    }
+    #  });
+    #'';
+
+    security.polkit.extraConfig =
+      let
+        allowedServices = builtins.filter (pipeline: pipeline.value.allowSudo) (lib.attrsToList cfg.pipelines);
+      in
+      builtins.concatStringsSep "\n" (
+        builtins.map (value: ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" &&
+                action.lookup("unit") == "redpanda-connect-${value.name}") {
+              return polkit.Result.YES;
+            }
+          });
+        '') allowedServices
+      );
+  };
+}
diff --git a/modules/packages/redpanda-connect/package.nix b/modules/packages/redpanda-connect/package.nix
new file mode 100644
index 0000000..2f9a6d9
--- /dev/null
+++ b/modules/packages/redpanda-connect/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "redpanda-connect";
+  version = "4.44.0";
+
+  src = fetchFromGitHub {
+    owner = "redpanda-data";
+    repo = "connect";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-pwtP1zybMvq1wQ50Ob20MVR3/v1yd7BjWe1nPFLO6mU=";
+  };
+
+  proxyVendor = true;
+
+  subPackages = [
+    "cmd/redpanda-connect"
+  ];
+
+  vendorHash = "sha256-5KXJiInuEX7fEl7y3iGvxQHptoM5z3TMmg6KZ2lx/fw=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/redpanda-data/connect/v4/internal/cli.Version=${version}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fancy stream processing made operationally mundane";
+    mainProgram = "redpanda-connect";
+    homepage = "https://www.redpanda.com/connect";
+    changelog = "https://github.com/redpanda-data/connect/blob/v${version}/CHANGELOG.md";
+    # license = lib.licenses.mixed;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
-- 
cgit 1.5.1