Refactor rclone-http into a module

hosts/azure/binary-cache/configuration.nix

@@ -2,14 +2,14 @@
 # SPDX-License-Identifier: Apache-2.0
 {
   self,
-  config,
   pkgs,
   lib,
   ...
 }: {
   imports = [
     ../../azure-common.nix
     self.nixosModules.service-openssh
+    self.nixosModules.service-rclone-http
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
@@ -26,38 +26,21 @@
     ];
   };
 
-  # Run a read-only HTTP webserver proxying to the "binary-cache-v1" storage
-  # container at a unix socket.
-  # This relies on IAM to grant access to the storage container.
-  systemd.services.rclone-http = {
-    after = ["network.target"];
-    requires = ["network.target"];
-    wantedBy = ["multi-user.target"];
-    serviceConfig = {
-      Type = "notify";
-      Restart = "always";
-      RestartSec = 2;
-      DynamicUser = true;
-      RuntimeDirectory = "rclone-http";
-      ExecStart =
-        "${pkgs.rclone}/bin/rclone "
-        + "serve http "
-        + "--azureblob-env-auth "
-        + "--read-only "
-        + "--addr unix://%t/rclone-http/socket "
-        + ":azureblob:binary-cache-v1";
-      # On successful startup, grant caddy write permissions to the socket.
-      ExecStartPost = "${pkgs.acl.bin}/bin/setfacl -m u:caddy:rw %t/rclone-http/socket";
-      EnvironmentFile = "/var/lib/rclone-http/env";
-    };
+  services.rclone-http = {
+    enable = true;
+    readOnly = true;
+    remote = ":azureblob:binary-cache-v1";
+    listenAddress = "unix://%t/rclone-http/socket";
   };
 
+  # On successful startup, grant caddy write permissions to the socket.
+  systemd.services.rclone-http.serviceConfig.ExecStartPost = "${pkgs.acl.bin}/bin/setfacl -m u:caddy:rw %t/rclone-http/socket";
+
   # Expose the rclone-http unix socket over a HTTPS, limiting to certain
   # keys only, disallowing listing too.
-  # TODO: use https://caddyserver.com/docs/caddyfile-tutorial#environment-variables for domain
   services.caddy = {
     enable = true;
-    configFile = pkgs.writeTextDir "Caddyfile" ''
+    configFile = pkgs.writeText "Caddyfile" ''
       # Disable the admin API, we don't want to reconfigure Caddy at runtime.
       {
         admin off
@@ -81,13 +64,6 @@
     '';
   };
 
-  # workaround for https://github.com/NixOS/nixpkgs/issues/272532
-  # FUTUREWORK: rebase once https://github.com/NixOS/nixpkgs/pull/272617 landed
-  services.caddy.enableReload = false;
-  systemd.services.caddy.serviceConfig.ExecStart = lib.mkForce [
-    ""
-    "${pkgs.caddy}/bin/caddy run --environ --config ${config.services.caddy.configFile}/Caddyfile"
-  ];
   systemd.services.caddy.serviceConfig.EnvironmentFile = "/var/lib/caddy/caddy.env";
 
   # Configure Nix to use the bucket (through rclone-http) as a substitutor.

hosts/azure/builder/configuration.nix

@@ -2,40 +2,22 @@
 # SPDX-License-Identifier: Apache-2.0
 {
   self,
-  pkgs,
   lib,
   ...
 }: {
   imports = [
     ../../azure-common.nix
     self.nixosModules.service-openssh
     self.nixosModules.service-remote-build
+    self.nixosModules.service-rclone-http
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
-  # Run a read-only HTTP webserver proxying to the "binary-cache-v1" storage
-  # container via http://localhost:8080.
-  # This relies on IAM to grant access to the storage container.
-  systemd.services.rclone-http = {
-    after = ["network.target"];
-    requires = ["network.target"];
-    wantedBy = ["multi-user.target"];
-    serviceConfig = {
-      Type = "notify";
-      Restart = "always";
-      RestartSec = 2;
-      DynamicUser = true;
-      RuntimeDirectory = "rclone-http";
-      ExecStart =
-        "${pkgs.rclone}/bin/rclone "
-        + "serve http "
-        + "--azureblob-env-auth "
-        + "--read-only "
-        + "--addr localhost:8080 "
-        + ":azureblob:binary-cache-v1";
-      EnvironmentFile = "/var/lib/rclone-http/env";
-    };
+  services.rclone-http = {
+    enable = true;
+    readOnly = true;
+    remote = ":azureblob:binary-cache-v1";
   };
 
   # Configure Nix to use this as a substitutor, and the public key used for signing.

hosts/azure/jenkins-controller/configuration.nix

@@ -2,7 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 {
   pkgs,
-  config,
   self,
   lib,
   ...
@@ -76,6 +75,7 @@ in {
   imports = [
     ../../azure-common.nix
     self.nixosModules.service-openssh
+    self.nixosModules.service-rclone-http
   ];
 
   # Configure /var/lib/jenkins in /etc/fstab.
@@ -268,29 +268,6 @@ in {
     '';
   };
 
-  # Run a read-write HTTP webserver proxying to the "binary-cache-v1" storage
-  # This is used by the post-build-hook to upload to the binary cache.
-  # This relies on IAM to grant access to the storage container.
-  systemd.services.rclone-http = {
-    after = ["network.target"];
-    requires = ["network.target"];
-    wantedBy = ["multi-user.target"];
-    serviceConfig = {
-      Type = "notify";
-      Restart = "always";
-      RestartSec = 2;
-      DynamicUser = true;
-      RuntimeDirectory = "rclone-http";
-      ExecStart =
-        "${pkgs.rclone}/bin/rclone "
-        + "serve webdav "
-        + "--azureblob-env-auth "
-        + "--addr localhost:8080 "
-        + ":azureblob:binary-cache-v1";
-      EnvironmentFile = "/var/lib/rclone-http/env";
-    };
-  };
-
   # Enable early out-of-memory killing.
   # Make nix builds more likely to be killed over more important services.
   services.earlyoom = {
@@ -318,10 +295,15 @@ in {
     post-build-hook = ${post-build-hook}
   '';
 
-  # TODO: use https://caddyserver.com/docs/caddyfile-tutorial#environment-variables for domain
+  services.rclone-http = {
+    enable = true;
+    protocol = "webdav";
+    remote = ":azureblob:binary-cache-v1";
+  };
+
   services.caddy = {
     enable = true;
-    configFile = pkgs.writeTextDir "Caddyfile" ''
+    configFile = pkgs.writeText "Caddyfile" ''
       # Disable the admin API, we don't want to reconfigure Caddy at runtime.
       {
         admin off
@@ -334,13 +316,6 @@ in {
     '';
   };
 
-  # workaround for https://github.com/NixOS/nixpkgs/issues/272532
-  # FUTUREWORK: rebase once https://github.com/NixOS/nixpkgs/pull/272617 landed
-  services.caddy.enableReload = false;
-  systemd.services.caddy.serviceConfig.ExecStart = lib.mkForce [
-    ""
-    "${pkgs.caddy}/bin/caddy run --environ --config ${config.services.caddy.configFile}/Caddyfile"
-  ];
   systemd.services.caddy.serviceConfig.EnvironmentFile = "/var/lib/caddy/caddy.env";
 
   # Configure Nix to use the bucket (through rclone-http) as a substitutor.

services/default.nix

@@ -8,5 +8,6 @@
     service-node-exporter = import ./node-exporter;
     service-openssh = import ./openssh;
     service-remote-build = import ./remote-build;
+    service-rclone-http = import ./rclone-http;
   };
 }

services/rclone-http/default.nix

@@ -0,0 +1,64 @@
+# SPDX-FileCopyrightText: 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.services.rclone-http;
+in {
+  options.services.rclone-http = {
+    enable = mkEnableOption "rclone-http service";
+
+    listenAddress = mkOption {
+      type = types.str;
+      default = "localhost:8080";
+      description = "IPaddress:Port, :Port or unix:///path/to/socket to bind server to";
+    };
+
+    readOnly = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Only allow read-only access";
+    };
+
+    protocol = mkOption {
+      type = types.enum ["http" "webdav"];
+      default = "http";
+      description = "The protocol to serve the remote over";
+    };
+
+    remote = mkOption {
+      type = types.str;
+      description = "The remote to serve";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Run a read-only HTTP webserver proxying to an rclone remote at the configured address
+    # This relies on IAM to grant access to the storage container.
+    systemd.services.rclone-http = {
+      after = ["network.target"];
+      requires = ["network.target"];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        RestartSec = 2;
+        DynamicUser = true;
+        RuntimeDirectory = "rclone-http";
+        EnvironmentFile = "/var/lib/rclone-http/env";
+
+        ExecStart =
+          "${pkgs.rclone}/bin/rclone "
+          + "serve ${cfg.protocol} "
+          + "--azureblob-env-auth "
+          + "${optionalString cfg.readOnly "--read-only "}"
+          + "--addr ${cfg.listenAddress} "
+          + "${cfg.remote}";
+      };
+    };
+  };
+}