feat(ops/modules): Add module for running Nixery r/2721

This sets up a very simple Nixery instance with some things lacking:

* no support for garbage-collecting image fragments (yet)
* no popularity setup

The plan is to use this to get the ball rolling on a separate
domain (e.g. images.tvl.fyi), iron things out and then look into
flipping over nixery.dev

Change-Id: Ic594809f9d487fec7a0f632d608752a3f9c61315
Reviewed-on: https://cl.tvl.fyi/c/depot/+/3280
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: sterni <sternenseemann@systemli.org>

3 files changed, 47 insertions, 1 deletions

diff --git a/.nixery/default.nix b/.nixery/default.nix
index 71f1dfb5c413..19da286ee345 100644
--- a/.nixery/default.nix
+++ b/.nixery/default.nix
@@ -1,5 +1,5 @@
 # See README.md
-{ depot ? import ../. {} }:
+{ depot ? import ../. {}, ... }:
 
 depot.third_party.nixpkgs.extend(_: _: {
   tvl = depot;
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index 6d338c369fc0..a7aeaa677c65 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -11,6 +11,7 @@ in {
     "${depot.path}/ops/modules/clbot.nix"
     "${depot.path}/ops/modules/irccat.nix"
     "${depot.path}/ops/modules/monorepo-gerrit.nix"
+    "${depot.path}/ops/modules/nixery.nix"
     "${depot.path}/ops/modules/owothia.nix"
     "${depot.path}/ops/modules/panettone.nix"
     "${depot.path}/ops/modules/paroxysm.nix"
@@ -313,6 +314,9 @@ in {
 
     # Run atward, the search engine redirection thing.
     atward.enable = true;
+
+    # Run a Nixery instance
+    nixery.enable = true;
   };
 
   services.postgresql = {
diff --git a/ops/modules/nixery.nix b/ops/modules/nixery.nix
new file mode 100644
index 000000000000..58c975815eac
--- /dev/null
+++ b/ops/modules/nixery.nix
@@ -0,0 +1,42 @@
+# NixOS module to run Nixery, currently with local-storage as the
+# backend for storing/serving image layers.
+{ depot, config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.depot.nixery;
+  description = "Nixery - container images on-demand";
+  storagePath = "/var/lib/nixery/${pkgs.nixpkgsCommits.unstable}";
+in {
+  options.services.depot.nixery = {
+    enable = lib.mkEnableOption description;
+
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 45243; # "image"
+      description = "Port on which Nixery should listen";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.nixery = {
+      inherit description;
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "nixery";
+        Restart = "always";
+        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${storagePath}";
+        ExecStart = "${depot.third_party.nixery.nixery-bin}/bin/nixery";
+      };
+
+      environment = {
+        PORT = toString cfg.port;
+        NIXERY_PKGS_PATH = "${depot.path}/.nixery";
+        NIXERY_STORAGE_BACKEND = "filesystem";
+        NIX_TIMEOUT = "60"; # seconds
+        STORAGE_PATH = storagePath;
+      };
+    };
+  };
+}