lyrathorpeandEmma Thorpe
f1e1373fd3
Build and publish container / build (push) Successful in 6m4s
## What - `pyproject.toml` — setuptools metadata with a `legacy-email-proxy` console script. Runtime dependencies are read dynamically from `requirements.txt`, so the Docker build and the package cannot drift apart. - `proxy_server.run()` — a synchronous entry point for that console script; `main` is a coroutine and cannot be referenced by one. The `__main__` path behaves as before. - `flake.nix` / `package.nix` — the package, `overlays.default`, a dev shell, and `checks`. The pytest suite runs as part of the build. - `module.nix` — a NixOS module: `services.legacy-email-proxy` with freeform `settings` (environment variables) and a separate `environmentFile` for credentials, so secrets stay out of the Nix store. Runs under `DynamicUser`, takes `CAP_NET_BIND_SERVICE` only while a listener is on a privileged port, and opens no firewall ports. - README: pip install, Nix usage, and a NixOS service example. ## Why The proxy could only be consumed as a container. Anyone deploying it on NixOS had to vendor a package definition into their own configuration — which is exactly what happened downstream, and is now deleted there in favour of this. ## Not in scope - The `Dockerfile` and its CI workflow are untouched. - No Nix job in CI; the runner has no Nix. The build is reproducible locally with `nix flake check`. - `version` is static and tracks the latest tag (`0.3.0`); bump it with the tag. ## Verification - `nix flake check` — package builds, 14 tests pass inside the build. - Consumed from a downstream NixOS host with `--override-input`: the unit's `ExecStart` resolves to the module's own build, and that flake's checks pass too. --------- Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com> Reviewed-on: #16
55 lines
1.7 KiB
Nix
55 lines
1.7 KiB
Nix
{
|
|
description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends";
|
|
|
|
inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
|
|
|
outputs =
|
|
{ self, nixpkgs }:
|
|
let
|
|
systems = [
|
|
"x86_64-linux"
|
|
"aarch64-linux"
|
|
"x86_64-darwin"
|
|
"aarch64-darwin"
|
|
];
|
|
forAllSystems = fn: nixpkgs.lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
|
|
in
|
|
{
|
|
overlays.default = final: _prev: {
|
|
legacy-email-proxy = final.callPackage ./package.nix { };
|
|
};
|
|
|
|
packages = forAllSystems (pkgs: rec {
|
|
legacy-email-proxy = pkgs.callPackage ./package.nix { };
|
|
default = legacy-email-proxy;
|
|
});
|
|
|
|
# The NixOS module with its package option pointed at this flake's build,
|
|
# so consumers need no overlay. Use nixosModules.legacy-email-proxy
|
|
# instead if you would rather apply overlays.default yourself.
|
|
nixosModules.default =
|
|
{ lib, pkgs, ... }:
|
|
{
|
|
imports = [ ./module.nix ];
|
|
services.legacy-email-proxy.package =
|
|
lib.mkDefault
|
|
self.packages.${pkgs.stdenv.hostPlatform.system}.legacy-email-proxy;
|
|
};
|
|
nixosModules.legacy-email-proxy = ./module.nix;
|
|
|
|
# The package builds only if the test suite passes, so this covers both.
|
|
checks = forAllSystems (pkgs: {
|
|
inherit (self.packages.${pkgs.system}) legacy-email-proxy;
|
|
});
|
|
|
|
devShells = forAllSystems (pkgs: {
|
|
default = pkgs.mkShellNoCC {
|
|
inputsFrom = [ self.packages.${pkgs.system}.legacy-email-proxy ];
|
|
packages = [ pkgs.python3Packages.pytest ];
|
|
};
|
|
});
|
|
|
|
formatter = forAllSystems (pkgs: pkgs.nixfmt-tree);
|
|
};
|
|
}
|