search

ruimarinho / gsts

Obtain and store AWS STS credentials to interact with Amazon services by authenticating via G Suite SAML.
MIT License
212 stars 37 forks source link

Add nix flake #75

Open kczulko opened 1 year ago

kczulko commented 1 year ago

Hello,

I was having some problems with aws-google-auth (constantly returning Invalid username or password) and one of its github issues pointed me to this project. Since aws-google-auth got nixified some time ago and gsts wasn't, I decided to write some nix expr for gsts (I'm a nixos user) and publish it to the upstream. Not sure how good is it but it works.

Notes:

  1. playwright installation script wants to download browser (?) so I had to disable this step via env variable. More details here.
  2. User has to explicitly put browser path while running gsts (see the devShell setup - chromium was added there and its path is accessible via env variable).

Best regards, Karol

ruimarinho commented 1 year ago

@kczulko why wouldn't the browser download component work automatically?

kczulko commented 1 year ago

@ruimarinho I think that's because the buildPhase in nix is pure, in the meaning that downloading something at this stage is considered as a jailbrake. If this would be allowed than the build would become unpredictable (e.g. no clear way howto calculate artifact hash etc.).

ruimarinho commented 1 year ago

Is there an easy to test this via https://github.com/LnL7/nix-docker or similar on macOS?

kczulko commented 1 year ago

Is there an easy to test this via https://github.com/LnL7/nix-docker or similar on macOS?

Basically, in such case I was using cachix/install-nix-action like e.g. here. However, this slows down the build a little bit. For this case, I would suggest moving this to separate workflow (e.g. not required to be "green" for ongoing PRs), or just leave it without testing. The latter, in case of failures would get fixed by someone from community who wants to use this installation/build recipe.