From c4cea7980790f3a09f38d222bbf78e0b45fab7f8 Mon Sep 17 00:00:00 2001 From: Lilac Date: Thu, 15 Oct 2026 01:40:00 -0400 Subject: [PATCH] move everything into own nix files --- flake.nix | 27 ++++++++-- hooks.nix | 5 +- init.sh | 31 ------------ kernel.nix | 4 +- rootfs.nix | 4 +- run.sh | 5 -- vm.nix | 138 +++++++-------------------------------------------- vmconfig.nix | 9 ++-- webhook.nix | 54 +++++--------------- 9 files changed, 64 insertions(+), 213 deletions(-) delete mode 100644 init.sh delete mode 100644 run.sh diff --git a/flake.nix b/flake.nix index 4ba0e0d..6c8c1f9 100644 --- a/flake.nix +++ b/flake.nix @@ -3,11 +3,28 @@ outputs = { self, nixpkgs }: let - pkgs = import nixpkgs { system = "x86_64-linux"; }; + system = "x86_64-linux"; + pkgs = nixpkgs.legacyPackages.${system}; + scope = pkgs.lib.makeScope pkgs.newScope (final: { + pigeon-toolchain = pkgs.buildEnv { + name = "pigeon-toolchain"; + paths = with pkgs; [ bash coreutils gcc gnumake util-linux ]; + }; + pigeon-init = final.callPackage ./init.nix { }; + pigeon-run = final.callPackage ./run.nix { }; + pigeon-rootfs = final.callPackage ./rootfs.nix { }; + pigeon-kernel = final.callPackage ./kernel.nix { }; + pigeon-vmconfig = final.callPackage ./vmconfig.nix { }; + pigeon-vm = final.callPackage ./vm.nix { }; + pigeon-hooks = final.callPackage ./hooks.nix { }; + pigeon-webhook = final.callPackage ./webhook.nix { }; + }); in { - packages.x86_64-linux.pigeon-kernel = pkgs.callPackage ./kernel/kernel.nix { }; - packages.x86_64-linux.pigeon-rootfs = pkgs.callPackage ./rootfs/rootfs.nix { - pigeon-toolchain = with pkgs; [ bash coreutils gcc gnumake util-linux ]; + packages.${system} = { + inherit (scope) + pigeon-toolchain + pigeon-init pigeon-run pigeon-rootfs pigeon-kernel pigeon-vmconfig pigeon-vm + pigeon-hooks pigeon-webhook; }; }; -} +} diff --git a/hooks.nix b/hooks.nix index fd94c65..d4e7481 100644 --- a/hooks.nix +++ b/hooks.nix @@ -1,6 +1,5 @@ { writeText, - pigeon }: @@ -21,11 +20,15 @@ writeText "pigeon-hooks.json" (builtins.toJSON [{ parameter = { source = "header"; name = "X-Gitlab-Event"; }; value = "Release Hook"; }; + } + { match = { type = "value"; parameter = { source = "payload"; name = "action"; }; value = "create"; }; + } + { match = { type = "value"; parameter = { source = "header"; name = "X-Gitlab-Token"; }; diff --git a/init.sh b/init.sh deleted file mode 100644 index 1cdbd8a..0000000 --- a/init.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/sh - -trap 'sync ; echo 1 >/proc/sys/kernel/sysrq ; echo b >/proc/sysrq-trigger' EXIT -export PATH=/bin:/usr/bin HOME=/tmp/build TMPDIR=/tmp - -mount -t proc proc /proc -mount -t devtmpfs devtmpfs /dev -mount -t tmpfs -o mode=1777,size=64m tmp /tmp -mount -t ext4 -r /dev/vdb /root/student -mount -t ext4 -r /dev/vdc /root/grader -mount -t ext4 /dev/vdd /root/results - -mkdir -p /tmp/build -cp -a /root/student/. /tmp/build/ -cp -a --remove-destination /root/grader/build/. /tmp/build/ -chown -R 65534:65534 /tmp/build - -( - cd /tmp/build - ulimit -t 30 -u 256 -n 256 -f 2048 - setpriv --reuid=65534 --regid=65534 --clear-groups \ - timeout -s 9 30 make >/root/results/build.log 2>&1 - echo $? >/root/results/build.status -) - -[ "$(cat /root/results/build.status)" != 0 ] && exit - -for TEST in /root/grader/tests/*.sh ; do - NAME="$(basename "$TEST" .sh)" - timeout -s 9 10 "$TEST" 2>/dev/null >"/root/results/$NAME" -done diff --git a/kernel.nix b/kernel.nix index c11f38a..a5831a4 100644 --- a/kernel.nix +++ b/kernel.nix @@ -1,5 +1,5 @@ { - mkDerivation, + stdenv, linux_6_1, bc, bison, elfutils, flex, perl, pigeon-kernel-params ? [ "64BIT" "TTY" "SERIAL_8250" "SERIAL_8250_CONSOLE" "PRINTK" @@ -17,7 +17,7 @@ ] }: -mkDerivation { +stdenv.mkDerivation { inherit (linux_6_1) src version; pname = "pigeon-kernel"; diff --git a/rootfs.nix b/rootfs.nix index c328393..68c6746 100644 --- a/rootfs.nix +++ b/rootfs.nix @@ -1,14 +1,14 @@ { closureInfo, runCommand, e2fsprogs, - pigeon-toolchain, pigeon-disc-size ? "1G", + pigeon-toolchain, pigeon-init, pigeon-run }: let - closure = closureInfo { rootPaths = [ toolchain ]; }; + closure = closureInfo { rootPaths = [ pigeon-toolchain ]; }; in runCommand "pigeon-rootfs" { nativeBuildInputs = [ e2fsprogs ]; } '' mkdir -p rootfs && cd rootfs diff --git a/run.sh b/run.sh deleted file mode 100644 index fe0ba90..0000000 --- a/run.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/sh - -cd /tmp/build -ulimit -t 1 -u 256 -n 256 -f 2048 -exec setpriv --reuid=65534 --regid=65534 --clear-groups timeout -s 9 2 ./program "$@" diff --git a/vm.nix b/vm.nix index 5c25c17..bbff3fb 100644 --- a/vm.nix +++ b/vm.nix @@ -1,128 +1,24 @@ { - pkgs, - pigeon-toolchain, - pigeon-vcpu-count ? 1, - pigeon-memory-size ? 512, - pigeon-disc-size ? "1G", - pigeon-kernel-params ? [ - "64BIT" "TTY" "SERIAL_8250" "SERIAL_8250_CONSOLE" "PRINTK" - - "HYPERVISOR_GUEST" "PARAVIRT" "KVM_GUEST" - - "BLOCK" "VIRTIO_MENU" "VIRTIO" "VIRTIO_PCI" "VIRTIO_MMIO" "VIRTIO_BLK" - "EXT4_FS" "SHMEM" "TMPFS" "PROC_FS" "PROC_SYSCTL" "SYSFS" "DEVTMPFS" - - "ACPI" "PCI" "PCI_MSI" "MAGIC_SYSRQ" - - "BINFMT_ELF" "BINFMT_SCRIPT" "MULTIUSER" "FUTEX" "EPOLL" "EVENTFD" - "SIGNALFD" "TIMERFD" "POSIX_TIMERS" "FILE_LOCKING" "ADVISE_SYSCALLS" - "NET" "UNIX" - ] + writeShellApplication, + coreutils, firecracker, jq, + pigeon-vmconfig }: -let - kernel = pkgs.stdenv.mkDerivation { - inherit (pkgs.linux_6_1) src version; - pname = "pigeon-kernel"; +writeShellApplication { + name = "pigeon-vm"; + runtimeInputs = [ coreutils firecracker jq ]; + text = '' + [ "$#" -ne 3 ] && exit 1 - nativeBuildInputs = with pkgs; [ bc bison elfutils flex perl ]; - hardeningDisable = [ "all" ]; - enableParallelBuilding = true; + CONFIG="$(mktemp)" + trap 'rm -rf "$CONFIG"' EXIT - configurePhase = '' - runHook preConfigure - patchShebangs scripts tools - make tinyconfig - for OPTION in ${toString pigeon-kernel-params}; do - scripts/config --enable $OPTION - done - make olddefconfig - for OPTION in ${toString pigeon-kernel-config}; do - grep -qx "CONFIG_$OPTION=y" .config || exit 1 - done - runHook postConfigure - ''; + jq --arg s "$1" --arg g "$2" --arg r "$3" ' + (.drives[] | select(.drive_id == "student").path_on_host) = $s | + (.drives[] | select(.drive_id == "grader").path_on_host) = $g | + (.drives[] | select(.drive_id == "results").path_on_host) = $r + ' ${pigeon-vmconfig} >"$CONFIG" - buildFlags = [ "vmlinux" ]; - - installPhase = '' - runHook preInstall - cp vmlinux "$out" - runHook postInstall - ''; - }; - - toolchain = pkgs.buildEnv { name = "pigeon-toolchain"; paths = pigeon-toolchain; }; - closure = pkgs.closureInfo { rootPaths = [ toolchain ]; }; - rootfs = pkgs.runCommand "pigeon-rootfs" { nativeBuildInputs = [ pkgs.e2fsprogs ]; } '' - mkdir -p rootfs && cd rootfs - mkdir -p dev proc sys tmp usr nix/store root/student root/grader root/results - chmod 700 root - - for FILE in $(cat ${closure}/store-paths); do - cp -a "$FILE" nix/store - done - ln -s ${toolchain}/bin bin - ln -s ${toolchain}/bin usr/bin - install -m 755 ${./init.sh} init - install -m 755 ${./run.sh} run - - cd .. - mkfs.ext4 -q -F -d rootfs $out ${pigeon-disc-size} + firecracker --no-api --config-file "$CONFIG" ''; - - vmconfig = pkgs.writeText "pigeon-vm.json" (builtins.toJSON { - boot-source = { - kernel_image_path = "${kernel}"; - boot_args = "reboot=k panic=1 quiet init=/init nomodule 8250.nr_uarts=0 i8042.noaux i8042.nomux i8042.dumbkbd swiotlb=noforce"; - }; - drives = [ - { - drive_id = "rootfs"; - path_on_host = "${rootfs}"; - is_root_device = true; - is_read_only = true; - } - { - drive_id = "student"; - path_on_host = ""; - is_root_device = false; - is_read_only = true; - } - { - drive_id = "grader"; - path_on_host = ""; - is_root_device = false; - is_read_only = true; - } - { - drive_id = "results"; - path_on_host = ""; - is_root_device = false; - is_read_only = false; - } - ]; - machine-config = { - vcpu_count = pigeon-vcpu-count; - mem_size_mib = pigeon-memory-size; - }; - }); -in - pkgs.writeShellApplication { - name = "pigeon-vm"; - runtimeInputs = with pkgs; [ coreutils firecracker jq ]; - text = '' - [ "$#" -ne 3 ] && exit 1 - - CONFIG="$(mktemp)" - trap 'rm -rf "$CONFIG"' EXIT - - jq --arg s "$1" --arg g "$2" --arg r "$3" ' - (.drives[] | select(.drive_id == "student").path_on_host) = $s | - (.drives[] | select(.drive_id == "grader").path_on_host) = $g | - (.drives[] | select(.drive_id == "result").path_on_host) = $r - ' ${vmconfig} >"$CONFIG" - - firecracker --no-api --config-file "$CONFIG" - ''; - } +} diff --git a/vmconfig.nix b/vmconfig.nix index 4ab9979..7c26a6e 100644 --- a/vmconfig.nix +++ b/vmconfig.nix @@ -1,10 +1,9 @@ { writeText, - - pigeon-vcpu-count ? 1, - pigeon-memory-size-mb ? 512, pigeon-kernel, - pigeon-rootfs + pigeon-rootfs, + pigeon-vcpu-count ? 1, + pigeon-memory-size-mb ? 512 }: writeText "pigeon-vm.json" (builtins.toJSON { @@ -40,6 +39,6 @@ writeText "pigeon-vm.json" (builtins.toJSON { ]; machine-config = { vcpu_count = pigeon-vcpu-count; - mem_size_mib = pigeon-memory-size; + mem_size_mib = pigeon-memory-size-mb; }; }) diff --git a/webhook.nix b/webhook.nix index 5f2bb88..32d64ad 100644 --- a/webhook.nix +++ b/webhook.nix @@ -1,42 +1,14 @@ -{ pkgs }: +{ + writeShellApplication, + webhook, + pigeon-hooks +}: -let - hooks = pkgs.writeText "pigeon-hooks.json" (builtins.toJSON [{ - id = "release"; - execute-command = "{./pigeon.sh}"; - include-command-output-in-response = false; - pass-arguments-to-command = [ - { source = "payload"; name = "project.git_http_url"; } - { source = "payload"; name = "project.id"; } - { source = "payload"; name = "tag"; } - { source = "payload"; name = "commit.id"; } - ]; - trigger-rule.and = [ - { - match = { - type = "value"; - parameter = { source = "header"; name = "X-Gitlab-Event"; }; - value = "Release Hook"; - }; - match = { - type = "value"; - parameter = { source = "payload"; name = "action"; }; - value = "create"; - }; - match = { - type = "value"; - parameter = { source = "header"; name = "X-Gitlab-Token"; }; - value = "{{ getenv `PIGEON_GITLAB_TOKEN` | js }}"; - }; - } - ]; - }]); -in - pkgs.writeShellApplication { - name = "pigeon"; - runtimeInputs = [ pkgs.webhook ]; - text = '' - : ''${PIGEON_GITLAB_TOKEN:?} - exec webhook -hooks ${hooks} -template -port "''${PIGEON_PORT:-9000}" -verbose - ''; - } +writeShellApplication { + name = "pigeon-webhook"; + runtimeInputs = [ webhook ]; + text = '' + : "''${PIGEON_GITLAB_SECRET:?}" + exec webhook -hooks ${pigeon-hooks} -template -port "''${PIGEON_PORT:-3000}" -verbose + ''; +}