push sheeet

nixos/modules/services/scheduling/atd.nix

@@ -0,0 +1,120 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+
+  cfg = config.services.atd;
+
+  inherit (pkgs) at;
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.atd.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable the {command}`at` daemon, a command scheduler.
+      '';
+    };
+
+    services.atd.allowEveryone = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to make {file}`/var/spool/at{jobs,spool}`
+        writeable by everyone (and sticky).  This is normally not
+        needed since the {command}`at` commands are
+        setuid/setgid `atd`.
+      '';
+    };
+
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    # Not wrapping "batch" because it's a shell script (kernel drops perms
+    # anyway) and it's patched to invoke the "at" setuid wrapper.
+    security.wrappers = builtins.listToAttrs (
+      map
+        (program: {
+          name = "${program}";
+          value = {
+            source = "${at}/bin/${program}";
+            owner = "atd";
+            group = "atd";
+            setuid = true;
+            setgid = true;
+          };
+        })
+        [
+          "at"
+          "atq"
+          "atrm"
+        ]
+    );
+
+    environment.systemPackages = [ at ];
+
+    security.pam.services.atd = { };
+
+    users.users.atd = {
+      uid = config.ids.uids.atd;
+      group = "atd";
+      description = "atd user";
+      home = "/var/empty";
+    };
+
+    users.groups.atd.gid = config.ids.gids.atd;
+
+    systemd.services.atd = {
+      description = "Job Execution Daemon (atd)";
+      documentation = [ "man:atd(8)" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ at ];
+
+      preStart = ''
+        # Snippets taken and adapted from the original `install' rule of
+        # the makefile.
+
+        # We assume these values are those actually used in Nixpkgs for
+        # `at'.
+        spooldir=/var/spool/atspool
+        jobdir=/var/spool/atjobs
+        etcdir=/etc/at
+
+        install -dm755 -o atd -g atd "$etcdir"
+        spool_and_job_dir_perms=${if cfg.allowEveryone then "1777" else "1770"}
+        install -dm"$spool_and_job_dir_perms" -o atd -g atd "$spooldir" "$jobdir"
+        if [ ! -f "$etcdir"/at.deny ]; then
+            touch "$etcdir"/at.deny
+            chown root:atd "$etcdir"/at.deny
+            chmod 640 "$etcdir"/at.deny
+        fi
+        if [ ! -f "$jobdir"/.SEQ ]; then
+            touch "$jobdir"/.SEQ
+            chown atd:atd "$jobdir"/.SEQ
+            chmod 600 "$jobdir"/.SEQ
+        fi
+      '';
+
+      script = "atd";
+
+      serviceConfig.Type = "forking";
+    };
+  };
+}

nixos/modules/services/scheduling/cron.nix

@@ -0,0 +1,146 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+
+  # Put all the system cronjobs together.
+  systemCronJobsFile = pkgs.writeText "system-crontab" ''
+    SHELL=${pkgs.bash}/bin/bash
+    PATH=${config.system.path}/bin:${config.system.path}/sbin
+    ${optionalString (config.services.cron.mailto != null) ''
+      MAILTO="${config.services.cron.mailto}"
+    ''}
+    NIX_CONF_DIR=/etc/nix
+    ${lib.concatStrings (map (job: job + "\n") config.services.cron.systemCronJobs)}
+  '';
+
+  # Vixie cron requires build-time configuration for the sendmail path.
+  cronNixosPkg = pkgs.cron.override {
+    # The mail.nix nixos module, if there is any local mail system enabled,
+    # should have sendmail in this path.
+    sendmailPath = "/run/wrappers/bin/sendmail";
+  };
+
+  allFiles =
+    optional (config.services.cron.systemCronJobs != [ ]) systemCronJobsFile
+    ++ config.services.cron.cronFiles;
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.cron = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable the Vixie cron daemon.";
+      };
+
+      mailto = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Email address to which job output will be mailed.";
+      };
+
+      systemCronJobs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = literalExpression ''
+          [ "* * * * *  test   ls -l / > /tmp/cronout 2>&1"
+            "* * * * *  eelco  echo Hello World > /home/eelco/cronout"
+          ]
+        '';
+        description = ''
+          A list of Cron jobs to be appended to the system-wide
+          crontab.  See the manual page for crontab for the expected
+          format. If you want to get the results mailed you must setuid
+          sendmail. See {option}`security.wrappers`
+
+          If neither /var/cron/cron.deny nor /var/cron/cron.allow exist only root
+          is allowed to have its own crontab file. The /var/cron/cron.deny file
+          is created automatically for you, so every user can use a crontab.
+
+          Many nixos modules set systemCronJobs, so if you decide to disable vixie cron
+          and enable another cron daemon, you may want it to get its system crontab
+          based on systemCronJobs.
+        '';
+      };
+
+      cronFiles = mkOption {
+        type = types.listOf types.path;
+        default = [ ];
+        description = ''
+          A list of extra crontab files that will be read and appended to the main
+          crontab file when the cron service starts.
+        '';
+      };
+
+    };
+
+  };
+
+  ###### implementation
+
+  config = mkMerge [
+
+    { services.cron.enable = mkDefault (allFiles != [ ]); }
+    (mkIf (config.services.cron.enable) {
+      security.wrappers.crontab = {
+        setuid = true;
+        owner = "root";
+        group = "root";
+        source = "${cronNixosPkg}/bin/crontab";
+      };
+      environment.systemPackages = [ cronNixosPkg ];
+      environment.etc.crontab = {
+        source =
+          pkgs.runCommand "crontabs"
+            {
+              inherit allFiles;
+              preferLocalBuild = true;
+            }
+            ''
+              touch $out
+              for i in $allFiles; do
+                cat "$i" >> $out
+              done
+            '';
+        mode = "0600"; # Cron requires this.
+      };
+
+      systemd.services.cron = {
+        description = "Cron Daemon";
+
+        wantedBy = [ "multi-user.target" ];
+
+        preStart = ''
+          (umask 022 && mkdir -p /var)
+          (umask 067 && mkdir -p /var/cron)
+
+          # By default, allow all users to create a crontab.  This
+          # is denoted by the existence of an empty cron.deny file.
+          if ! test -e /var/cron/cron.allow -o -e /var/cron/cron.deny; then
+              touch /var/cron/cron.deny
+          fi
+        '';
+
+        restartTriggers = [ config.time.timeZone ];
+        serviceConfig.ExecStart = "${cronNixosPkg}/bin/cron -n";
+      };
+
+    })
+
+  ];
+
+}

nixos/modules/services/scheduling/fcron.nix

@@ -0,0 +1,178 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+
+  cfg = config.services.fcron;
+
+  queuelen = optionalString (cfg.queuelen != null) "-q ${toString cfg.queuelen}";
+
+  # Duplicate code, also found in cron.nix. Needs deduplication.
+  systemCronJobs = ''
+    SHELL=${pkgs.bash}/bin/bash
+    PATH=${config.system.path}/bin:${config.system.path}/sbin
+    ${optionalString (config.services.cron.mailto != null) ''
+      MAILTO="${config.services.cron.mailto}"
+    ''}
+    NIX_CONF_DIR=/etc/nix
+    ${lib.concatStrings (map (job: job + "\n") config.services.cron.systemCronJobs)}
+  '';
+
+  allowdeny = target: users: {
+    source = pkgs.writeText "fcron.${target}" (concatStringsSep "\n" users);
+    target = "fcron.${target}";
+    mode = "644";
+    gid = config.ids.gids.fcron;
+  };
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.fcron = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable the {command}`fcron` daemon.";
+      };
+
+      allow = mkOption {
+        type = types.listOf types.str;
+        default = [ "all" ];
+        description = ''
+          Users allowed to use fcrontab and fcrondyn (one name per
+          line, `all` for everyone).
+        '';
+      };
+
+      deny = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = "Users forbidden from using fcron.";
+      };
+
+      maxSerialJobs = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Maximum number of serial jobs which can run simultaneously.";
+      };
+
+      queuelen = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = "Number of jobs the serial queue and the lavg queue can contain.";
+      };
+
+      systab = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''The "system" crontab contents.'';
+      };
+    };
+
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    services.fcron.systab = systemCronJobs;
+
+    environment.etc = listToAttrs (
+      map
+        (x: {
+          name = x.target;
+          value = x;
+        })
+        [
+          (allowdeny "allow" (cfg.allow))
+          (allowdeny "deny" cfg.deny)
+          # see man 5 fcron.conf
+          {
+            source =
+              let
+                isSendmailWrapped = lib.hasAttr "sendmail" config.security.wrappers;
+                sendmailPath =
+                  if isSendmailWrapped then "/run/wrappers/bin/sendmail" else "${config.system.path}/bin/sendmail";
+              in
+              pkgs.writeText "fcron.conf" ''
+                fcrontabs   =       /var/spool/fcron
+                pidfile     =       /run/fcron.pid
+                fifofile    =       /run/fcron.fifo
+                fcronallow  =       /etc/fcron.allow
+                fcrondeny   =       /etc/fcron.deny
+                shell       =       /bin/sh
+                sendmail    =       ${sendmailPath}
+                editor      =       ${pkgs.vim}/bin/vim
+              '';
+            target = "fcron.conf";
+            gid = config.ids.gids.fcron;
+            mode = "0644";
+          }
+        ]
+    );
+
+    environment.systemPackages = [ pkgs.fcron ];
+    users.users.fcron = {
+      uid = config.ids.uids.fcron;
+      home = "/var/spool/fcron";
+      group = "fcron";
+    };
+    users.groups.fcron.gid = config.ids.gids.fcron;
+
+    security.wrappers = {
+      fcrontab = {
+        source = "${pkgs.fcron}/bin/fcrontab";
+        owner = "fcron";
+        group = "fcron";
+        setgid = true;
+        setuid = true;
+      };
+      fcrondyn = {
+        source = "${pkgs.fcron}/bin/fcrondyn";
+        owner = "fcron";
+        group = "fcron";
+        setgid = true;
+        setuid = false;
+      };
+      fcronsighup = {
+        source = "${pkgs.fcron}/bin/fcronsighup";
+        owner = "root";
+        group = "fcron";
+        setuid = true;
+      };
+    };
+    systemd.services.fcron = {
+      description = "fcron daemon";
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ pkgs.fcron ];
+
+      preStart = ''
+        install \
+          --mode 0770 \
+          --owner fcron \
+          --group fcron \
+          --directory /var/spool/fcron
+        # load system crontab file
+        /run/wrappers/bin/fcrontab -u systab - < ${pkgs.writeText "systab" cfg.systab}
+      '';
+
+      serviceConfig = {
+        Type = "forking";
+        ExecStart = "${pkgs.fcron}/sbin/fcron -m ${toString cfg.maxSerialJobs} ${queuelen}";
+      };
+    };
+  };
+}

nixos/modules/services/scheduling/prefect.nix

@@ -0,0 +1,231 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  cfg = config.services.prefect;
+  inherit (lib.types)
+    bool
+    str
+    enum
+    path
+    attrsOf
+    nullOr
+    submodule
+    port
+    ;
+
+in
+{
+  options.services.prefect = {
+    enable = lib.mkOption {
+      type = bool;
+      default = false;
+      description = "enable prefect server and worker services";
+    };
+
+    package = lib.mkPackageOption pkgs "prefect" { };
+
+    host = lib.mkOption {
+      type = str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+      description = "Prefect server host";
+    };
+
+    port = lib.mkOption {
+      type = port;
+      default = 4200;
+      description = "Prefect server port";
+    };
+
+    dataDir = lib.mkOption {
+      type = path;
+      default = "/var/lib/prefect-server";
+      description = ''
+        Specify the directory for Prefect.
+      '';
+    };
+
+    database = lib.mkOption {
+      type = enum [
+        "sqlite"
+        "postgres"
+      ];
+      default = "sqlite";
+      description = "which database to use for prefect server: sqlite or postgres";
+    };
+
+    databaseHost = lib.mkOption {
+      type = str;
+      default = "localhost";
+      description = "database host for postgres only";
+    };
+
+    databasePort = lib.mkOption {
+      type = str;
+      default = "5432";
+      description = "database port for postgres only";
+    };
+
+    databaseName = lib.mkOption {
+      type = str;
+      default = "prefect";
+      description = "database name for postgres only";
+    };
+
+    databaseUser = lib.mkOption {
+      type = str;
+      default = "postgres";
+      description = "database user for postgres only";
+    };
+
+    databasePasswordFile = lib.mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        path to a file containing e.g.:
+          DBPASSWORD=supersecret
+
+        stored outside the nix store, read by systemd as EnvironmentFile.
+      '';
+    };
+
+    # now define workerPools as an attribute set of submodules,
+    # each key is the pool name, and the submodule has an installPolicy
+    workerPools = lib.mkOption {
+      type = attrsOf (submodule {
+        options = {
+          installPolicy = lib.mkOption {
+            type = enum [
+              "always"
+              "if-not-present"
+              "never"
+              "prompt"
+            ];
+            default = "always";
+            description = "install policy for the worker (always, if-not-present, never, prompt)";
+          };
+        };
+      });
+      default = { };
+      description = ''
+        define a set of worker pools with submodule config. example:
+        workerPools.my-pool = {
+          installPolicy = "never";
+        };
+      '';
+    };
+
+    baseUrl = lib.mkOption {
+      type = nullOr str;
+      default = null;
+      description = "external url when served by a reverse proxy, e.g. `https://example.com/prefect`";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # define systemd.services as the server plus any worker definitions
+    systemd.services = {
+      "prefect-server" = {
+        description = "prefect server";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+
+        serviceConfig = {
+          DynamicUser = true;
+          StateDirectory = "prefect-server";
+          # TODO all my efforts to setup the database url
+          # have failed with some unable to open file
+          Environment = [
+            "PREFECT_HOME=%S/prefect-server"
+            "PREFECT_UI_STATIC_DIRECTORY=%S/prefect-server"
+            "PREFECT_SERVER_ANALYTICS_ENABLED=off"
+            "PREFECT_UI_API_URL=${cfg.baseUrl}/api"
+            "PREFECT_UI_URL=${cfg.baseUrl}"
+          ];
+          EnvironmentFile =
+            if cfg.database == "postgres" && cfg.databasePasswordFile != null then
+              [ cfg.databasePasswordFile ]
+            else
+              [ ];
+
+          # ReadWritePaths = [ cfg.dataDir ];
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          NoNewPrivileges = true;
+          MemoryDenyWriteExecute = true;
+          LockPersonality = true;
+          CapabilityBoundingSet = [ ];
+          AmbientCapabilities = [ ];
+          RestrictSUIDSGID = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          MemoryAccounting = true;
+          CPUAccounting = true;
+
+          ExecStart = "${pkgs.prefect}/bin/prefect server start --host ${cfg.host} --port ${toString cfg.port}";
+          Restart = "always";
+          WorkingDirectory = cfg.dataDir;
+        };
+      };
+    }
+    // lib.concatMapAttrs (poolName: poolCfg: {
+      # return a partial attr set with one key: "prefect-worker-..."
+      "prefect-worker-${poolName}" = {
+        description = "prefect worker for pool '${poolName}'";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+
+        environment.systemPackages = cfg.package;
+
+        serviceConfig = {
+          DynamicUser = true;
+          StateDirectory = "prefect-worker-${poolName}";
+          Environment = [
+            "PREFECT_HOME=%S/prefect-worker-${poolName}"
+            "PREFECT_API_URL=${cfg.baseUrl}/api"
+          ];
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          NoNewPrivileges = true;
+          MemoryDenyWriteExecute = true;
+          LockPersonality = true;
+          CapabilityBoundingSet = [ ];
+          AmbientCapabilities = [ ];
+          RestrictSUIDSGID = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          MemoryAccounting = true;
+          CPUAccounting = true;
+          ExecStart = ''
+            ${pkgs.prefect}/bin/prefect worker start \
+              --pool ${poolName} \
+              --type process \
+              --install-policy ${poolCfg.installPolicy}
+          '';
+          Restart = "always";
+        };
+      };
+    }) cfg.workerPools;
+  };
+}

nixos/modules/services/scheduling/scx.nix

@@ -0,0 +1,127 @@
+{
+  lib,
+  pkgs,
+  config,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.scx;
+in
+{
+  options.services.scx = {
+    enable = lib.mkEnableOption null // {
+      description = ''
+        Whether to enable SCX service, a daemon to run schedulers from userspace.
+
+        ::: {.note}
+        This service requires a kernel with the Sched-ext feature.
+        Generally, kernel version 6.12 and later are supported.
+        :::
+      '';
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.scx.full;
+      defaultText = lib.literalExpression "pkgs.scx.full";
+      example = lib.literalExpression "pkgs.scx.rustscheds";
+      description = ''
+        `scx` package to use. `scx.full`, which includes all schedulers, is the default.
+        You may choose a minimal package, such as `pkgs.scx.rustscheds`.
+
+        ::: {.note}
+        Overriding this does not change the default scheduler; you should set `services.scx.scheduler` for it.
+        :::
+      '';
+    };
+
+    scheduler = lib.mkOption {
+      type = lib.types.enum [
+        "scx_bpfland"
+        "scx_chaos"
+        "scx_cosmos"
+        "scx_central"
+        "scx_flash"
+        "scx_flatcg"
+        "scx_lavd"
+        "scx_layered"
+        "scx_mitosis"
+        "scx_nest"
+        "scx_p2dq"
+        "scx_pair"
+        "scx_prev"
+        "scx_qmap"
+        "scx_rlfifo"
+        "scx_rustland"
+        "scx_rusty"
+        "scx_sdt"
+        "scx_simple"
+        "scx_tickless"
+        "scx_userland"
+        "scx_wd40"
+      ];
+      default = "scx_rustland";
+      example = "scx_bpfland";
+      description = ''
+        Which scheduler to use. See [SCX documentation](https://github.com/sched-ext/scx/tree/main/scheds)
+        for details on each scheduler and guidance on selecting the most suitable one.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.singleLineStr;
+      default = [ ];
+      example = [
+        "--slice-us 5000"
+        "--verbose"
+      ];
+      description = ''
+        Parameters passed to the chosen scheduler at runtime.
+
+        ::: {.note}
+        Run `chosen-scx-scheduler --help` to see the available options. Generally,
+        each scheduler has its own set of options, and they are incompatible with each other.
+        :::
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.scx = {
+      description = "SCX scheduler daemon";
+
+      # SCX service should be started only if the kernel supports sched-ext
+      unitConfig.ConditionPathIsDirectory = "/sys/kernel/sched_ext";
+
+      startLimitIntervalSec = 30;
+      startLimitBurst = 2;
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.package cfg.scheduler)
+          ]
+          ++ cfg.extraArgs
+        );
+        Restart = "on-failure";
+      };
+
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    assertions = [
+      {
+        assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
+        message = "SCX is only supported on kernel version >= 6.12.";
+      }
+    ];
+  };
+
+  meta = {
+    inherit (pkgs.scx.full.meta) maintainers;
+  };
+}