pinpox / lollypops

Lollypop Operations - NixOS Deployment Tool
https://pinpox.github.io/lollypops/
GNU General Public License v3.0
118 stars 17 forks source link

Cannot use machine's pkgs for secrets commands / custom tasks #39

Open GeoffreyFrogeye opened 4 months ago

GeoffreyFrogeye commented 4 months ago

If you want to use an executable in lollypops.deployment.ssh.command, lollypops.extraTasks.<name>.cmds or lollypops.secrets.files.<name>.cmd, you have two options:

  1. Simply use the name of the executable, e.g. ssh. This requires the executable to be in the PATH of the local machine.
  2. Use the pkgs of the remote machine, e.g. ${pkgs.openssh}/bin/ssh. This requires the pkgs of the remote machine to be similarly configured to the one of the local machine. Notably, the local and remote machine needs to be the same system.

Example use case where it's not convinient: some of the secret files I have are generated with ${pkgs.bind}/bin/tsig-keygen. Unlike ssh, bind isn't a package I have available on all the machines I'm deploying from, so I set the full path, but now I can't create secrets on my aarch64 laptop (nor my phone... theorically, I'm I haven't gone in this rabbit hole yet).

I'm thinking a way to fix that would be to make those option accept an other type from string: a function, that take the pkgs of the local machine (passed with the lollypops app) as an argument (probably a dict, so we can add more things if needed later). I would be fine with implementing that myself, but first, does it make sense?