flake.nix

{
  description = "Build a cargo project";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";

    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    crane.url = "github:ipetkov/crane";
    advisory-db = {
      url = "github:rustsec/advisory-db";
      flake = false;
    };
  };

  outputs =
    inputs:
    inputs.flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = inputs.nixpkgs.legacyPackages.${system};

        inherit (pkgs) lib;

        craneLib = inputs.crane.mkLib pkgs;
        src = lib.fileset.toSource rec {
          root = ./.;
          fileset = lib.fileset.unions [
            # Default files from crane (Rust and cargo files)
            (craneLib.fileset.commonCargoSources root)
            # Include all the goldenfile test jsons as well
            ./golden
          ];
        };
        githubSha = builtins.getEnv "GITHUB_SHA";
        commitSha =
          if inputs.self ? "shortRev" then
            inputs.self.shortRev
          else if githubSha != "" then
            builtins.substring 0 7 githubSha
          else
            "";
        dockerTag = if commitSha != "" then commitSha else "dev";

        crateVersion = crateData.package.version;
        releaseTag = "v${crateVersion}-${dockerTag}";

        commonArgs = {
          inherit src;
          strictDeps = true;

          nativeBuildInputs =
            [
              # Add additional build inputs here
            ]
            ++ lib.optionals pkgs.stdenv.isDarwin [
              # Additional darwin specific inputs can be set here
              pkgs.libiconv
            ];

          # Additional environment variables can be set directly
          # MY_CUSTOM_VAR = "some value";
        };

        crateData = lib.importTOML ./Cargo.toml;

        # Build *just* the cargo dependencies, so we can reuse
        # all of that work (e.g. via cachix) when running in CI
        cargoArtifacts = craneLib.buildDepsOnly commonArgs;

        # Build the actual crate itself, reusing the dependency
        # artifacts from above.
        aacw = craneLib.buildPackage (
          commonArgs
          // {
            inherit cargoArtifacts;
            version = crateVersion;
            meta.mainProgram = crateData.package.name;
          }
        );
        sbom = craneLib.mkCargoDerivation (
          commonArgs
          // {
            # Require the caller to specify cargoArtifacts we can use
            inherit cargoArtifacts;

            # A suffix name used by the derivation, useful for logging
            pnameSuffix = "-sbom";

            # Set the cargo command we will use and pass through the flags
            installPhase = # bash
              ''mv bom.json $out'';
            buildPhaseCargoCommand = # bash
              ''cargo cyclonedx -f json --all --override-filename bom'';
            nativeBuildInputs = (commonArgs.nativeBuildInputs or [ ]) ++ [ pkgs.cargo-cyclonedx ];
          }
        );

        certGenerator = lib.getExe (
          pkgs.writeShellApplication {
            name = "generate-self-signed-certs";
            text = ''
              set -euo pipefail
              cd /app
              step certificate create localhost tls.crt tls.key --profile self-signed --subtle --no-password --insecure
            '';
            runtimeInputs = [ pkgs.step-cli ];
          }
        );

        serverRunner = lib.getExe (
          pkgs.writeShellApplication {
            name = "run-aacw-server";
            text = ''
              set -euo pipefail
              cd /app
              TLS_CERT_FILE=/app/tls.crt TLS_KEY_FILE=/app/tls.key ${lib.getExe aacw}
            '';
            runtimeInputs = [ aacw ];
          }
        );

        nixos-vm-test = pkgs.testers.nixosTest {
          name = "certificates-integrationtest";
          nodes.machine =
            { pkgs, ... }:
            {
              environment.systemPackages = [
                pkgs.curl
                pkgs.jq
                pkgs.step-cli
                aacw
              ];

              systemd.services.aacw = {
                description = "AivenApp conversion webhook test server";
                wantedBy = [ ];
                serviceConfig = {
                  ExecStart = "${serverRunner}";
                  Restart = "on-failure";
                  Environment = "RUST_LOG=info";
                };
              };
            };
          testScript = # python
            ''
              cert_cmd = "${certGenerator}"

              machine.start()
              machine.wait_for_unit("multi-user.target")
              machine.succeed("mkdir -p /app")
              machine.succeed(cert_cmd)

              machine.succeed("systemctl start aacw.service")
              machine.wait_for_open_port(3000)

              def get(path: str) -> str:
                  return machine.succeed(f"curl -skf https://localhost:3000/{path}")

              assert get("health").strip() == "ok"
              assert get("ready").strip() == "ok"

              machine.succeed("""cat >/tmp/payload.json <<'EOF'
              {"apiVersion":"apiextensions.k8s.io/v1","kind":"ConversionReview","request":{"uid":"123","desiredAPIVersion":"aiven.nais.io/v2","objects":[{"apiVersion":"aiven.nais.io/v1","kind":"AivenApp","spec":{"secretName":"supersecret","kafka":{}}}]}}
              EOF
              """)
              resp = machine.succeed("curl -skf https://localhost:3000/convert -H 'content-type: application/json' --data @/tmp/payload.json")
              import json
              obj = json.loads(resp)
              converted = obj["response"]["convertedObjects"][0]
              assert obj["response"]["uid"] == "123"
              assert converted["apiVersion"] == "aiven.nais.io/v2"
              assert converted["spec"]["kafka"]["secretName"] == "supersecret"
              assert "secretName" not in converted["spec"]

              # No common secretName: spec.secretName is absent,
              # so the converter should not add any nested secretName.
              machine.succeed("""cat >/tmp/payload-no-common.json <<'EOF'
              {"apiVersion":"apiextensions.k8s.io/v1","kind":"ConversionReview","request":{"uid":"456","desiredAPIVersion":"aiven.nais.io/v2","objects":[{"apiVersion":"aiven.nais.io/v1","kind":"AivenApp","spec":{"kafka":{}}}]}}
              EOF
              """)
              resp_no_common = machine.succeed("curl -skf https://localhost:3000/convert -H 'content-type: application/json' --data @/tmp/payload-no-common.json")
              obj_no_common = json.loads(resp_no_common)
              converted_no_common = obj_no_common["response"]["convertedObjects"][0]
              assert "secretName" not in converted_no_common["spec"]
              assert "secretName" not in converted_no_common["spec"]["kafka"]

              # v2 -> v2 should be a no-op for the object contents.
              machine.succeed("""cat >/tmp/payload-v2.json <<'EOF'
              {"apiVersion":"apiextensions.k8s.io/v1","kind":"ConversionReview","request":{"uid":"789","desiredAPIVersion":"aiven.nais.io/v2","objects":[{"apiVersion":"aiven.nais.io/v2","kind":"AivenApp","spec":{"kafka":{"secretName":"keepme"}}}]}}
              EOF
              """)
              resp_v2 = machine.succeed("curl -skf https://localhost:3000/convert -H 'content-type: application/json' --data @/tmp/payload-v2.json")
              obj_v2 = json.loads(resp_v2)
              converted_v2 = obj_v2["response"]["convertedObjects"][0]
              assert obj_v2["response"]["uid"] == "789"
              assert converted_v2["apiVersion"] == "aiven.nais.io/v2"
              assert converted_v2["spec"]["kafka"]["secretName"] == "keepme"

              machine.shutdown()
            '';
        };
      in
      {
        checks =
          {
            inherit aacw sbom;
          }
          // lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
            inherit nixos-vm-test;
          }
          // {

          # Run clippy (and deny all warnings) on the crate source,
          # again, reusing the dependency artifacts from above.
          #
          # Note that this is done as a separate derivation so that
          # we can block the CI if there are issues here, but not
          # prevent downstream consumers from building our crate by itself.
          my-crate-clippy = craneLib.cargoClippy (
            commonArgs
            // {
              inherit cargoArtifacts;
              cargoClippyExtraArgs = "--all-targets -- -D warnings -W clippy::pedantic -W clippy::nursery -W clippy::cargo -A clippy::multiple_crate_versions";
            }
          );

          my-crate-doc = craneLib.cargoDoc (
            commonArgs
            // {
              inherit cargoArtifacts;
              # This can be commented out or tweaked as necessary, e.g. set to
              # `--deny rustdoc::broken-intra-doc-links` to only enforce that lint
              env.RUSTDOCFLAGS = "--deny warnings";
            }
          );

          # Check formatting
          # my-crate-fmt = craneLib.cargoFmt {
          #   inherit src;
          # };

          # # Audit dependencies
          my-crate-audit = craneLib.cargoAudit {
            inherit src;
            inherit (inputs) advisory-db;
          };

          # # Audit licenses
          # my-crate-deny = craneLib.cargoDeny {
          #   inherit src;
          # };

          # Run tests with cargo-nextest
          # Consider setting `doCheck = false` on `my-crate` if you do not want
          # the tests to run twice
          my-crate-nextest = craneLib.cargoNextest (
            commonArgs
            // {
              inherit cargoArtifacts;
              partitions = 1;
              partitionType = "count";
              cargoNextestPartitionsExtraArgs = "--no-tests=pass";
            }
          );
        };

        formatter = inputs.treefmt-nix.lib.mkWrapper pkgs {
          programs.nixfmt.enable = true;
          programs.rustfmt.enable = true;
        };

        packages =
          {
            inherit aacw sbom;
            default = aacw;

            version = pkgs.writeText "version" releaseTag;
            fasit-feature =
            let
              release = {
                inherit (crateData.package) name;
                imageTag = releaseTag;
                namespace = "nais-system";
              };
            in
            lib.pipe
              {
                chart = import ./fasit-chart/Chart.nix { version = releaseTag; };
                feature = import ./fasit-chart/Feature.nix { };
                issuer = import ./fasit-chart/certissuer.nix {
                  inherit lib release;
                  extraConfig = { };
                };
                deployment = import ./fasit-chart/deployment.nix {
                  inherit lib aacw release;
                  extraConfig = { };
                };
                service = import ./fasit-chart/service.nix {
                  inherit lib release;
                  extraConfig = { };
                };
                certificate = import ./fasit-chart/certificate.nix {
                  inherit lib release;
                  extraConfig = { };
                };
              }
              [
                (lib.mapAttrs (
                  name: data:
                  pkgs.writeTextFile {
                    inherit name;
                    text = builtins.toJSON data;
                  }
                ))
                (
                  files:
                  pkgs.stdenv.mkDerivation {
                    name = "helm-chart";
                    dontUnpack = true;
                    buildPhase = ''
                      mkdir -p $out/templates
                      touch $out/values.yaml
                      cp ${files.chart} $out/Chart.yaml
                      cp ${files.feature} $out/Feature.yaml
                      cp ${files.issuer} $out/templates/Issuer.yaml
                      cp ${files.deployment} $out/templates/Deployment.yaml
                      cp ${files.service} $out/templates/Service.yaml
                      cp ${files.certificate} $out/templates/Certificate.yaml
                    '';
                  }
                )
              ];
          }
          // lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
            vm-test = nixos-vm-test;
            image =
              (pkgs.dockerTools.buildImage {
                name = "aacw";
                tag = releaseTag;
                copyToRoot = pkgs.buildEnv {
                  name = "aacw-image";
                  pathsToLink = [ "/bin" ];
                  paths = [ aacw ];
                };
                config = {
                  User = "1069:1069";
                  ExposedPorts = {
                    "3000/tcp" = { };
                  };
                  Entrypoint = [ (lib.getExe aacw) ];
                  Env = [ "RUST_LOG=info" ];
                };
              }).overrideAttrs
                (old: {
                  imageName = "aacw";
                  imageTag = releaseTag;
                });
          };

        apps.default =
          inputs.flake-utils.lib.mkApp {
            drv = aacw;
          }
          // {
            meta.description = "Run aivenapp-conversion-webhooks binary";
          };

        apps.version =
          inputs.flake-utils.lib.mkApp {
            drv = pkgs.writeShellApplication {
              name = "print-version";
              text = ''
                printf %s "${releaseTag}"
              '';
            };
          }
          // {
            meta.description = "Print release tag for aivenapp-conversion-webhooks";
          };

        apps.mk-cert =
          inputs.flake-utils.lib.mkApp {
            drv = pkgs.writeShellApplication {
              name = "mk-cert";
              text = "step certificate create localhost cert.pem key.pem --profile self-signed --subtle --no-password --insecure";
              runtimeInputs = [ pkgs.step-cli ];
            };
          }
          // {
            meta.description = "Generate self-signed localhost TLS certificate";
          };

        devShells.default = craneLib.devShell {
          # Inherit inputs from checks.
          checks = inputs.self.checks.${system};

          # Additional dev-shell environment variables can be set directly
          # MY_CUSTOM_DEVELOPMENT_VAR = "something else";

          packages = [
            pkgs.rust-analyzer
            pkgs.step-cli
            pkgs.kubernetes-helm
          ];
        };
      }
    );
}