Include contracts via flake-parts

[mainrs]

Hey! I really liked the idea of contracts and wanted to adapt my nixos configuration to it. My config is based on flake-parts and uses perSystem. I couldn\t get the inclusion of contracts to work. I failed to expose the shb properly in such a way that I could use it within my modules as a module parameter.

While this is not a selfhostblocks question, I am hoping that you might have more knowledge about nix and its parts to give me some advice! Thank you for this project and the time you put into it to maintain.

[ibizaman]

Did you intend to use the contracts without importing any of the SHB modules? I must say I didn't think of this use case. That shb argument is exposed through an internal module which is not ideal. But you can still import it with imports = [ (import "${inputs.selfhostblocks}/lib/module.nix") ]. Tell me if that works.

[mainrs]

Sadly, it does not work:

{ flake, ... }:

let
  inherit (flake) inputs;
  inherit (inputs) self;
in
{
  imports = [
    self.nixosModules.default
    inputs.impermanence.nixosModules.impermanence
    inputs.sops-nix.nixosModules.sops
    (import "${inputs.shb}/lib/module.nix") # Contracts import.
    inputs.shb.nixosModules.sops # Contracts SOPS provider import.

    ./configuration.nix
    ./hardware.nix
  ];

I get an error that the option _module.args.shb is defined multiple times, which makes sense. The error originates from your lib/mdule.nix and my system configuration, which imports the sops provider.

… while evaluating the option `system.build.toplevel':

      … while evaluating definitions from `/nix/store/59c65vmrl55gcgqaam9pxrcvqkrgvd9g-source/nixos/modules/system/activation/top-level.nix':

      … while evaluating the option `assertions':

      … while evaluating definitions from `/nix/store/2150cwg0xmi5zf5k10szayiy3wgsnisi-source/modules/sops':

      … while evaluating the option `sops.secrets':

      … while evaluating definitions from `/nix/store/9fv24qg5fp8r72by1ha66b1srw4cak4j-source/modules/blocks/sops.nix':

      … while evaluating the module argument `shb' in "/nix/store/9fv24qg5fp8r72by1ha66b1srw4cak4j-source/modules/blocks/sops.nix":

      … noting that argument `shb` is not externally provided, so querying `_module.args` instead, requiring `config`

      (stack trace truncated; use '--show-trace' to show the full, detailed trace)

      error: The option `_module.args.shb' is defined multiple times while it's expected to be unique.

# configuration.nix
my.services.caddy = {
   enable = true;
   cloudflareApiToken = config.shb.sops.secret."acme/cf".result;
 };
 sops.defaultSopsFile = ./secrets.yaml;
 shb.sops.secret."acme/cf".request = config.my.services.caddy.cloudflareApiToken.request;

# caddy.nix
{ config, shb, ... }:

{
  options.my.services.caddy = {
    cloudflareApiToken = mkOption {
      type = lib.types.submodule {
       options = shb.contracts.secret.mkRequester {
         mode = "0440";
         owner = "caddy";
         group = "caddy";
         restartUnits = [ "caddy.service" ];
       };
     };
    };
  };
  
  config = mkIf cfg.enable {
    systemd.services.caddy.serviceConfig = {
     LoadCredential = [
       "apitoken:${cfg.cloudflareApiToken.result.path}"
     ];
     Environment = [
       "CF_API_TOKEN=%d/apitoken"
     ];
   };
  };
}

On a side note, why did you not make the SSO options a contract in SHB too? That way you could even enforce that all services that register via OIDC have the same nixos option names and types.

[ibizaman]

I tested it on my side and you must not add the import in your case. The following link shows a minimal reproducible example of what you intend to do

selfhostblocks/demo/minimal/flake.nix

Lines 66 to 95 in d8981d4

	sops = nixpkgs'.nixosSystem {
	inherit system;
	modules = [
	selfhostblocks.nixosModules.default
	selfhostblocks.nixosModules.sops
	sops-nix.nixosModules.default
	filesystemModule
	# This modules showcases the use of SHB's lib.
	(
	{
	config,
	lib,
	shb,
	...
	}:
	{
	options.myOption = lib.mkOption {
	# Using provided nixosSystem directly.
	# SHB's lib is available under `shb` thanks to the overlay.
	type = shb.secretFileType;
	};
	config = {
	myOption.source = "/a/path";
	# Use the option.
	environment.etc.myOption.text = config.myOption.source;
	};
	}
	)
	];
	};

What I told you to do would only be necessary if you did not include any SHB module at all but here you import inputs.shb.nixosModules.sops. I added an example with that just to be complete

selfhostblocks/demo/minimal/flake.nix

Lines 187 to 217 in d8981d4

	contractsDirect =
	let
	nixosSystem' = import "${selfhostblocks.inputs.nixpkgs}/nixos/lib/eval-config.nix";
	in
	nixosSystem' {
	inherit system;
	modules = [
	filesystemModule
	(import "${selfhostblocks}/lib/module.nix")
	(
	{
	config,
	lib,
	shb,
	...
	}:
	{
	options.myOption = lib.mkOption {
	# Using provided nixosSystem directly.
	# SHB's lib is available under `shb` thanks to the overlay.
	type = shb.secretFileType;
	};
	config = {
	myOption.source = "/a/path";
	# Use the option.
	environment.etc.myOption.text = config.myOption.source;
	};
	}
	)
	];
	};

.

About SSO being a contract, to be honest I thought about doing it since a long but never had the confidence the contract I would defined was a good one. But that changed recently with all the integrations I added. I'll begin working on that soonish.