move everything into own nix files

flake.nix

@@ -3,13 +3,28 @@
 
   outputs = { self, nixpkgs }:
   let
-    pkgs = import nixpkgs {
     system = "x86_64-linux";
+    pkgs = nixpkgs.legacyPackages.${system};
+    scope = pkgs.lib.makeScope pkgs.newScope (final: {
+      pigeon-toolchain = pkgs.buildEnv {
+        name = "pigeon-toolchain";
+        paths = with pkgs; [ bash coreutils gcc gnumake util-linux ];
       };
+      pigeon-init     = final.callPackage ./init.nix { };
+      pigeon-run      = final.callPackage ./run.nix { };
+      pigeon-rootfs   = final.callPackage ./rootfs.nix { };
+      pigeon-kernel   = final.callPackage ./kernel.nix { };
+      pigeon-vmconfig = final.callPackage ./vmconfig.nix { };
+      pigeon-vm       = final.callPackage ./vm.nix { };
+      pigeon-hooks    = final.callPackage ./hooks.nix { };
+      pigeon-webhook  = final.callPackage ./webhook.nix { };
+    });
   in {
-    packages.x86_64-linux.pigeon-kernel = pkgs.callPackage ./kernel/kernel.nix { };
-    packages.x86_64-linux.pigeon-rootfs = pkgs.callPackage ./rootfs/rootfs.nix {
-      pigeon-toolchain = with pkgs; [ bash coreutils gcc gnumake util-linux ];
+    packages.${system} = {
+      inherit (scope)
+        pigeon-toolchain
+        pigeon-init pigeon-run pigeon-rootfs pigeon-kernel pigeon-vmconfig pigeon-vm
+        pigeon-hooks pigeon-webhook;
     };
   };
 }

hooks.nix

@@ -0,0 +1,39 @@
+{
+  writeText,
+  pigeon
+}:
+
+writeText "pigeon-hooks.json" (builtins.toJSON [{
+  id = "release";
+  execute-command = "${pigeon}";
+  include-command-output-in-response = false;
+  pass-arguments-to-command = [
+    { source = "payload"; name = "project.git_http_url"; }
+    { source = "payload"; name = "project.id"; }
+    { source = "payload"; name = "tag"; }
+    { source = "payload"; name = "commit.id"; }
+  ];
+  trigger-rule.and = [
+    {
+      match = {
+        type = "value";
+        parameter = { source = "header"; name = "X-Gitlab-Event"; };
+        value = "Release Hook";
+      };
+    }
+    {
+      match = {
+        type = "value";
+        parameter = { source = "payload"; name = "action"; };
+        value = "create";
+      };
+    }
+    {
+      match = {
+        type = "value";
+        parameter = { source = "header"; name = "X-Gitlab-Token"; };
+        value = "{{ getenv `PIGEON_GITLAB_TOKEN` | js }}";
+      };
+    }
+  ];
+}])

init.nix

@@ -0,0 +1,45 @@
+{
+  writeShellApplication,
+  pigeon-toolchain
+}:
+
+writeShellApplication {
+  name = "pigeon-init";
+  runtimeInputs = [ pigeon-toolchain ];
+  text = ''
+    finish() {
+      umount /root/results || true
+      sync
+      echo 1 >/proc/sys/kernel/sysrq
+      echo b >/proc/sysrq-trigger
+    }
+    trap 'finish' EXIT
+
+    mount -t proc proc /proc
+    mount -t devtmpfs devtmpfs /dev
+    mount -t tmpfs -o mode=1777,size=64m tmp /tmp
+    mount -t ext4 -r /dev/vdb /root/student
+    mount -t ext4 -r /dev/vdc /root/grader
+    mount -t ext4 /dev/vdd /root/results
+
+    mkdir -p /tmp/build
+    cp -a /root/student/. /tmp/build/
+    cp -a --remove-destination /root/grader/build/. /tmp/build/
+    chown -R 65534:65534 /tmp/build
+
+    (
+      cd /tmp/build
+      ulimit -t 30 -u 256 -n 256 -f 2048
+      setpriv --reuid=65534 --regid=65534 --clear-groups \
+        timeout -s 9 30 make >/root/results/build.log 2>&1
+      echo $? >/root/results/build.status
+    ) || true
+
+    [ "$(cat /root/results/build.status || true)" != 0 ] && exit
+
+    for TEST in /root/grader/tests/*.sh ; do
+      NAME="$(basename "$TEST" .sh)"
+      timeout -s 9 10 "$TEST" 2>/dev/null >"/root/results/$NAME" || true
+    done
+  '';
+}

init.sh

@@ -1,31 +0,0 @@
-#!/bin/sh
-
-trap 'sync ; echo 1 >/proc/sys/kernel/sysrq ; echo b >/proc/sysrq-trigger' EXIT
-export PATH=/bin:/usr/bin HOME=/tmp/build TMPDIR=/tmp
-
-mount -t proc proc /proc
-mount -t devtmpfs devtmpfs /dev
-mount -t tmpfs -o mode=1777,size=64m tmp /tmp
-mount -t ext4 -r /dev/vdb /root/student
-mount -t ext4 -r /dev/vdc /root/grader
-mount -t ext4 /dev/vdd /root/results
-
-mkdir -p /tmp/build
-cp -a /root/student/. /tmp/build/
-cp -a --remove-destination /root/grader/build/. /tmp/build/
-chown -R 65534:65534 /tmp/build
-
-(
-  cd /tmp/build
-  ulimit -t 30 -u 256 -n 256 -f 2048
-  setpriv --reuid=65534 --regid=65534 --clear-groups \
-    timeout -s 9 30 make >/root/results/build.log 2>&1
-  echo $? >/root/results/build.status
-)
-
-[ "$(cat /root/results/build.status)" != 0 ] && exit
-
-for TEST in /root/grader/tests/*.sh ; do
-  NAME="$(basename "$TEST" .sh)"
-  timeout -s 9 10 "$TEST" 2>/dev/null >"/root/results/$NAME"
-done

kernel.nix

@@ -0,0 +1,49 @@
+{
+  stdenv,
+  linux_6_1, bc, bison, elfutils, flex, perl,
+  pigeon-kernel-params ? [
+    "64BIT" "TTY" "SERIAL_8250" "SERIAL_8250_CONSOLE" "PRINTK"
+
+    "HYPERVISOR_GUEST" "PARAVIRT" "KVM_GUEST"
+
+    "BLOCK" "VIRTIO_MENU" "VIRTIO" "VIRTIO_PCI" "VIRTIO_MMIO" "VIRTIO_BLK"
+    "EXT4_FS" "SHMEM" "TMPFS" "PROC_FS" "PROC_SYSCTL" "SYSFS" "DEVTMPFS"
+
+    "ACPI" "PCI" "PCI_MSI" "MAGIC_SYSRQ"
+
+    "BINFMT_ELF" "BINFMT_SCRIPT" "MULTIUSER" "FUTEX" "EPOLL" "EVENTFD"
+    "SIGNALFD" "TIMERFD" "POSIX_TIMERS" "FILE_LOCKING" "ADVISE_SYSCALLS"
+    "NET" "UNIX"
+  ]
+}:
+
+stdenv.mkDerivation {
+  inherit (linux_6_1) src version;
+  pname = "pigeon-kernel";
+
+  nativeBuildInputs = [ bc bison elfutils flex perl ];
+  hardeningDisable = [ "all" ];
+  enableParallelBuilding = true;
+
+  configurePhase = ''
+    runHook preConfigure
+    patchShebangs scripts tools
+    make tinyconfig
+    for OPTION in ${toString pigeon-kernel-params}; do
+      scripts/config --enable $OPTION
+    done
+    make olddefconfig
+    for OPTION in ${toString pigeon-kernel-params}; do
+      grep -qx "CONFIG_$OPTION=y" .config || exit 1
+    done
+    runHook postConfigure
+  '';
+
+  buildFlags = [ "vmlinux" ];
+
+  installPhase = ''
+    runHook preInstall
+    cp vmlinux "$out"
+    runHook postInstall
+  '';
+}

rootfs.nix

@@ -0,0 +1,28 @@
+{
+  closureInfo, runCommand,
+  e2fsprogs,
+  pigeon-disc-size ? "1G",
+  pigeon-toolchain,
+  pigeon-init,
+  pigeon-run
+}:
+
+let
+  closure = closureInfo { rootPaths = [ pigeon-toolchain ]; };
+in
+  runCommand "pigeon-rootfs" { nativeBuildInputs = [ e2fsprogs ]; } ''
+    mkdir -p rootfs && cd rootfs
+    mkdir -p dev proc sys tmp usr nix/store root/student root/grader root/results
+    chmod 700 root
+
+    for FILE in $(cat ${closure}/store-paths); do
+      cp -a "$FILE" nix/store
+    done
+    ln -s ${pigeon-toolchain}/bin bin
+    ln -s ${pigeon-toolchain}/bin usr/bin
+    install -m 755 ${pigeon-init}/bin/pigeon-init init
+    install -m 755 ${pigeon-run}/bin/pigeon-run run
+
+    cd ..
+    mkfs.ext4 -q -F -d rootfs $out ${pigeon-disc-size}
+  ''

run.nix

@@ -0,0 +1,14 @@
+{
+  writeShellApplication,
+  pigeon-toolchain
+}:
+
+writeShellApplication {
+  name = "pigeon-run";
+  runtimeInputs = [ pigeon-toolchain ];
+  text = ''
+    cd /tmp/build
+    ulimit -t 1 -u 256 -n 256 -f 2048
+    exec setpriv --reuid=65534 --regid=65534 --clear-groups timeout -s 9 2 ./program "$@"
+  '';
+}

run.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-cd /tmp/build
-ulimit -t 1 -u 256 -n 256 -f 2048
-exec setpriv --reuid=65534 --regid=65534 --clear-groups timeout -s 9 2 ./program "$@"

vm.nix

@@ -1,116 +1,12 @@
 {
-  pkgs,
-  pigeon-toolchain,
-  pigeon-vcpu-count ? 1,
-  pigeon-memory-size ? 512,
-  pigeon-disc-size ? "1G",
-  pigeon-kernel-params ? [
-    "64BIT" "TTY" "SERIAL_8250" "SERIAL_8250_CONSOLE" "PRINTK"
-
-    "HYPERVISOR_GUEST" "PARAVIRT" "KVM_GUEST"
-
-    "BLOCK" "VIRTIO_MENU" "VIRTIO" "VIRTIO_PCI" "VIRTIO_MMIO" "VIRTIO_BLK"
-    "EXT4_FS" "SHMEM" "TMPFS" "PROC_FS" "PROC_SYSCTL" "SYSFS" "DEVTMPFS"
-
-    "ACPI" "PCI" "PCI_MSI" "MAGIC_SYSRQ"
-
-    "BINFMT_ELF" "BINFMT_SCRIPT" "MULTIUSER" "FUTEX" "EPOLL" "EVENTFD"
-    "SIGNALFD" "TIMERFD" "POSIX_TIMERS" "FILE_LOCKING" "ADVISE_SYSCALLS"
-    "NET" "UNIX"
-  ]
+  writeShellApplication,
+  coreutils, firecracker, jq,
+  pigeon-vmconfig
 }:
 
-let
-  kernel = pkgs.stdenv.mkDerivation {
-    inherit (pkgs.linux_6_1) src version;
-    pname = "pigeon-kernel";
-
-    nativeBuildInputs = with pkgs; [ bc bison elfutils flex perl ];
-    hardeningDisable = [ "all" ];
-    enableParallelBuilding = true;
-
-    configurePhase = ''
-      runHook preConfigure
-      patchShebangs scripts tools
-      make tinyconfig
-      for OPTION in ${toString pigeon-kernel-params}; do
-        scripts/config --enable $OPTION
-      done
-      make olddefconfig
-      for OPTION in ${toString pigeon-kernel-config}; do
-        grep -qx "CONFIG_$OPTION=y" .config || exit 1
-      done
-      runHook postConfigure
-    '';
-
-    buildFlags = [ "vmlinux" ];
-
-    installPhase = ''
-      runHook preInstall
-      cp vmlinux "$out"
-      runHook postInstall
-    '';
-  };
-
-  toolchain = pkgs.buildEnv { name = "pigeon-toolchain"; paths = pigeon-toolchain; };
-  closure = pkgs.closureInfo { rootPaths = [ toolchain ]; };
-  rootfs = pkgs.runCommand "pigeon-rootfs" { nativeBuildInputs = [ pkgs.e2fsprogs ]; } ''
-    mkdir -p rootfs && cd rootfs
-    mkdir -p dev proc sys tmp usr nix/store root/student root/grader root/results
-    chmod 700 root
-
-    for FILE in $(cat ${closure}/store-paths); do
-      cp -a "$FILE" nix/store
-    done
-    ln -s ${toolchain}/bin bin
-    ln -s ${toolchain}/bin usr/bin
-    install -m 755 ${./init.sh} init
-    install -m 755 ${./run.sh} run
-
-    cd ..
-    mkfs.ext4 -q -F -d rootfs $out ${pigeon-disc-size}
-  '';
-  
-  vmconfig = pkgs.writeText "pigeon-vm.json" (builtins.toJSON {
-    boot-source = {
-      kernel_image_path = "${kernel}";
-      boot_args = "reboot=k panic=1 quiet init=/init nomodule 8250.nr_uarts=0 i8042.noaux i8042.nomux i8042.dumbkbd swiotlb=noforce";
-    };
-    drives = [
-      {
-        drive_id = "rootfs";
-        path_on_host = "${rootfs}";
-        is_root_device = true;
-        is_read_only = true;
-      }
-      {
-        drive_id = "student";
-        path_on_host = "";
-        is_root_device = false;
-        is_read_only = true;
-      }
-      {
-        drive_id = "grader";
-        path_on_host = "";
-        is_root_device = false;
-        is_read_only = true;
-      }
-      {
-        drive_id = "results";
-        path_on_host = "";
-        is_root_device = false;
-        is_read_only = false;
-      }
-    ];
-    machine-config = {
-      vcpu_count = pigeon-vcpu-count;
-      mem_size_mib = pigeon-memory-size;
-    };
-  });
-in
-  pkgs.writeShellApplication {
+writeShellApplication {
   name = "pigeon-vm";
-    runtimeInputs = with pkgs; [ coreutils firecracker jq ];
+  runtimeInputs = [ coreutils firecracker jq ];
   text = ''
     [ "$#" -ne 3 ] && exit 1
 
@@ -120,9 +16,9 @@ in
     jq --arg s "$1" --arg g "$2" --arg r "$3" '
       (.drives[] | select(.drive_id == "student").path_on_host) = $s |
       (.drives[] | select(.drive_id == "grader").path_on_host) = $g |
-        (.drives[] | select(.drive_id == "result").path_on_host) = $r
-      ' ${vmconfig} >"$CONFIG"
+      (.drives[] | select(.drive_id == "results").path_on_host) = $r
+    ' ${pigeon-vmconfig} >"$CONFIG"
 
     firecracker --no-api --config-file "$CONFIG"
   '';
-  }
+}

vmconfig.nix

@@ -0,0 +1,44 @@
+{
+  writeText,
+  pigeon-kernel,
+  pigeon-rootfs,
+  pigeon-vcpu-count ? 1,
+  pigeon-memory-size-mb ? 512
+}:
+
+writeText "pigeon-vm.json" (builtins.toJSON {
+  boot-source = {
+    kernel_image_path = "${pigeon-kernel}";
+    boot_args = "reboot=k panic=1 quiet init=/init nomodule 8250.nr_uarts=0 i8042.noaux i8042.nomux i8042.dumbkbd swiotlb=noforce";
+  };
+  drives = [
+    {
+      drive_id = "rootfs";
+      path_on_host = "${pigeon-rootfs}";
+      is_root_device = true;
+      is_read_only = true;
+    }
+    {
+      drive_id = "student";
+      path_on_host = "";
+      is_root_device = false;
+      is_read_only = true;
+    }
+    {
+      drive_id = "grader";
+      path_on_host = "";
+      is_root_device = false;
+      is_read_only = true;
+    }
+    {
+      drive_id = "results";
+      path_on_host = "";
+      is_root_device = false;
+      is_read_only = false;
+    }
+  ];
+  machine-config = {
+    vcpu_count = pigeon-vcpu-count;
+    mem_size_mib = pigeon-memory-size-mb;
+  };
+})

webhook.nix

@@ -1,42 +1,14 @@
-{ pkgs }:
+{
+  writeShellApplication,
+  webhook,
+  pigeon-hooks
+}:
 
-let
-  hooks = pkgs.writeText "pigeon-hooks.json" (builtins.toJSON [{
-    id = "release";
-    execute-command = "{./pigeon.sh}";
-    include-command-output-in-response = false;
-    pass-arguments-to-command = [
-      { source = "payload"; name = "project.git_http_url"; }
-      { source = "payload"; name = "project.id"; }
-      { source = "payload"; name = "tag"; }
-      { source = "payload"; name = "commit.id"; }
-    ];
-    trigger-rule.and = [
-      {
-        match = {
-          type = "value";
-          parameter = { source = "header"; name = "X-Gitlab-Event"; };
-          value = "Release Hook";
-        };
-        match = {
-          type = "value";
-          parameter = { source = "payload"; name = "action"; };
-          value = "create";
-        };
-        match = {
-          type = "value";
-          parameter = { source = "header"; name = "X-Gitlab-Token"; };
-          value = "{{ getenv `PIGEON_GITLAB_TOKEN` | js }}";
-        };
-      }
-    ];
-  }]);
-in
-  pkgs.writeShellApplication {
-    name = "pigeon";
-    runtimeInputs = [ pkgs.webhook ];
+writeShellApplication {
+  name = "pigeon-webhook";
+  runtimeInputs = [ webhook ];
   text = ''
-      : ''${PIGEON_GITLAB_TOKEN:?}
-      exec webhook -hooks ${hooks} -template -port "''${PIGEON_PORT:-9000}" -verbose
+    : "''${PIGEON_GITLAB_SECRET:?}"
+    exec webhook -hooks ${pigeon-hooks} -template -port "''${PIGEON_PORT:-3000}" -verbose
   '';
-  }
+}