fix: Move ragenix to externally managed, and ask for env file references
This commit is contained in:
82
flake.nix
82
flake.nix
@@ -4,15 +4,9 @@
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
|
||||
# For secrets management
|
||||
ragenix = {
|
||||
url = "github:yaxitech/ragenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, flake-utils, ragenix }:
|
||||
outputs = { self, nixpkgs, flake-utils }:
|
||||
flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
pkgs = import nixpkgs {
|
||||
@@ -63,11 +57,6 @@
|
||||
# Camera SDK
|
||||
camera-sdk
|
||||
|
||||
# Secrets management
|
||||
ragenix.packages.${system}.default
|
||||
age
|
||||
ssh-to-age
|
||||
|
||||
# Utilities
|
||||
jq
|
||||
yq
|
||||
@@ -94,83 +83,18 @@
|
||||
echo "Available commands:"
|
||||
echo " - docker-compose: Manage containers"
|
||||
echo " - supabase: Supabase CLI"
|
||||
echo " - ragenix: Manage encrypted secrets"
|
||||
echo " - age: Encrypt/decrypt files"
|
||||
echo ""
|
||||
echo "To activate Python venv: source .venv/bin/activate"
|
||||
echo "To edit secrets: ragenix -e secrets/env.age"
|
||||
echo ""
|
||||
echo "NOTE: Secrets should be managed by ragenix in athenix for production deployments"
|
||||
echo ""
|
||||
'';
|
||||
|
||||
# Additional environment configuration
|
||||
DOCKER_BUILDKIT = "1";
|
||||
COMPOSE_DOCKER_CLI_BUILD = "1";
|
||||
};
|
||||
|
||||
# NixOS module for easy integration
|
||||
nixosModules.default = { config, lib, ... }: {
|
||||
options.services.usda-vision = {
|
||||
enable = lib.mkEnableOption "USDA Vision camera management system";
|
||||
|
||||
secretsFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "Path to the ragenix-managed secrets file";
|
||||
};
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/usda-vision";
|
||||
description = "Directory for USDA Vision application data";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.services.usda-vision.enable {
|
||||
environment.systemPackages = [
|
||||
usda-vision-package
|
||||
camera-sdk
|
||||
pkgs.docker-compose
|
||||
];
|
||||
|
||||
environment.variables.LD_LIBRARY_PATH = "${camera-sdk}/lib";
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.usda-vision = {
|
||||
description = "USDA Vision Docker Compose Stack";
|
||||
after = [ "docker.service" "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
preStart = ''
|
||||
# Sync application code
|
||||
${pkgs.rsync}/bin/rsync -av --delete \
|
||||
--checksum \
|
||||
--exclude='node_modules' \
|
||||
--exclude='.env' \
|
||||
--exclude='__pycache__' \
|
||||
--exclude='.venv' \
|
||||
${usda-vision-package}/opt/usda-vision/ ${config.services.usda-vision.dataDir}/
|
||||
|
||||
# Copy secrets if managed by ragenix
|
||||
if [ -f "${config.services.usda-vision.secretsFile}" ]; then
|
||||
cp "${config.services.usda-vision.secretsFile}" ${config.services.usda-vision.dataDir}/.env
|
||||
fi
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
WorkingDirectory = config.services.usda-vision.dataDir;
|
||||
ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build";
|
||||
ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
|
||||
TimeoutStartSec = 300;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user