Repository navigation
Conversation
A caisson-nixops4 configuration, named nixops4 for the output it fills, publishes the root NixOps4 reads: rootFunction and getProviders over the root composite, a deferred caisson-nixops4-composite configuration declared under the name root. NixOps4 evaluates the root when it deploys, so the composite is finalized with the args NixOps4 passes: the output values and the deploying system. A composite holds its members as deferred caisson-nixops4-composite and caisson-nixops4-resource configurations beneath it and finalizes each with its part of those args. Composite and resource are two classes. A composite has NixOps4's providers option and no type; a resource has NixOps4's resource, type and providers options and no members. A component reads the outputs of its composite's members, and nothing else of them, through the members module argument. The NixOS adapter, the module nixos of the resource class, deploys the NixOS configuration declared beneath a resource as nixops4-nixos does, with the same SSH options, and runs the script with bash from the package set caisson selects for the deploying system. The default module of the resource class selects it and gives the NixOS configurations beneath the nixops4-apply NixOS module, which imports the apply module of nixops4-nixos. argsNeeded names the deploying system and the outputs of the members, and a resource lists the outputs a tool may cache in cacheableOutputs. caisson-core is pinned to the head of nix-caisson/caisson-core#57, where a function argsNeeded receives the name and parent of the entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A nixops4 configuration, named nixops4, takes the root modules of a NixOps4 deployment as NixOps4 users write them for mkRoot, and caisson evaluates every component, with NixOps4's class name nixops4Component and NixOps4's resource, type and providers options. A composite collects members.<name> and decides each member's integration by upstream's test, with a probe evaluation over NixOps4's base modules: a member whose resourceType is defined is a caisson-nixops4-resource configuration, any other a caisson-nixops4-composite configuration. A member that sets type and declares members is refused. The members module argument of a composite holds its members' configs, as upstream's does, so every composite sets unsafeCrossChildReferences for the class of its members. A member that imports nixops4-nixos gets its nixos.module evaluated as a caisson NixOS configuration beneath it: the module nixos of the nixops4Component class forces nixpkgs to a value whose lib.nixosSystem returns that configuration, since nixos.configuration is read-only, and takes the shell from caisson's package set. cacheableOutputs is the allow-list of outputs a tool may cache, by member path. The eval-weight baseline is re-measured: the core module of every class declares the configurations of every integration, so the four integrations of the NixOps4 work add to caisson's overhead in every evaluation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A root composite, native or upstream-compatible, takes stateResources, the member paths of the resources that hold the state of the deployment, as nixops4 state dump takes them. It then gives discoverArgs: for each system a package config builds a set for, a program that runs nixops4 state dump for each of them in the working directory and prints the recorded outputs as outputValues, with the deploying system. A finalized composite publishes deferredChildArgs, the args it gives a member, so a tool can finalize a member's entry itself. caisson-core is pinned to the head of nix-caisson/caisson-core#57, where discoverArgs may be derivations by system or a function of the entry's name and parent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
caisson-core now calls discoverArgs with the system of the tool that runs it, so a root composite builds one discovery program, for that system, rather than one for every system its package configs build a set for. caisson-core is pinned to the head of nix-caisson/caisson-core#57, where argsNeeded and discoverArgs are always functions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…teConfiguration and mkResourceConfiguration They return what a mkConfiguration returns, built on mkModuleConfiguration; the With of compositeWith and resourceWith said nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… finalize members with their part of its args The root of a deployment is a deferred caisson-nixops4-composite configuration declared under the name `nixops4`, for the output it fills, and the upstream-compatible nixops4 configuration is such a root of class nixops4Component. The caisson-nixops4 declaration integration is removed. Its helpers are published by the resource integration. A composite evaluates with its args, `outputValues` and `resourceProviderSystem`, finalizes each member once with that member's part of them, and returns the members' manifests as its children. Its manifest names the args it takes in `argsNeeded`: the deploying system and, by member, the outputs each resource names, cacheable where the resource lists them. The root gives `discoverArgs`, which finds the resources that hold state from their `state` option. A native composite's `members` holds each member's outputs and `absoluteMemberPath`, from the args and the declared names. An upstream composite declares `members` again as deferred modules, and reading it gives the members' configs, so `members.x.outputs.y`, `config.members.x.outputs.y` and `state = members.x` work. The integrations builder passes `argsNeeded`, `discoverArgs` and `children` through from an integration's evaluate, publishes the entry of a deferred configuration from the `exportsTo` its record holds, and passes no registries up from an entry. caisson-core is pinned to 2293708 on nix-caisson/caisson-core#57, where `finalize { args, argsSource }` fills the args from the manifest's own `argsNeeded`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d dumps from the root, and name the errors of members and outputs named from outputs The discovery program looped with `for state in <paths>`, which shellcheck refuses (SC2043) when a root has one state resource, so the program did not build. It loops over a bash array now. It also nested the outputs of a state resource inside a composite twice: `nixops4 state dump` keys the resources from the root, and the program prefixed the path of the composite again. The new `nixops4-discovery` check builds the program of two roots against a stand-in for NixOps4 and compares what it prints from recorded dumps with the paths the root names in `argsNeeded`. A composite that decided its members from `members` or their outputs, and a resource that named its outputs from its own outputs, ended in an infinite recursion. A composite now takes the names of its members from an evaluation in which `members` fails with an error naming the composite, and a resource takes the names of its outputs from one in which its outputs fail with an error naming the resource. The pinned-world suite gains probes for nested composites, a machine in a nested composite, these errors, one member under a name, one root per flake, a root inside a machine, entries a parent does not finalize, `getProviders`, and nested upstream composites. The `deferred-errors` check reads the text of the errors, `caisson-deferred: needs <path>` included, with the real evaluator. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ot a set caisson-core b9de3d0 names the path of args given as a non-attrset where argsNeeded declares a set. The deferred-errors check reads that message for output values given as a string. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
caisson-core now passes the sources given to mkLib to every registered file as `closure-sources`. caisson's own registered files, examples and tests take the new name. The context that mkPackagesOverlay and mkPolyfillOverlay pass to a package file that asks for one now carries the same attribute set under `sources`, in place of `inputs`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
clhodapp
force-pushed
the
feat/nixops4
branch
from
October 29, 2026 03:21
eec82eb to
f641163
Compare
Contributor
Author
|
Superseded by #144. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
nix-caisson/caisson-core#58 renames the closure argument
closure-inputstoclosure-sources. That argument carries the sources a flake passed tomkLib, and caisson-core already calls that attribute setsourceseverywhere else. This pull request moves caisson onto the new name and pins caisson-core at that pull request's commit, in bothflake.lockandtests/dependencies/flake.lock.The registered files, the literate-flake example, and the unit and integration tests now take
closure-sources.mkPackagesOverlayandmkPolyfillOverlaypass a context to a package file whose function asks for named arguments. That context now carries the sources undersources, in place ofinputs, and theclosedInputsalias inlib-overlays/nixpkgs/default.nixis gone.Every check of
checks.x86_64-linuxevaluates. Every check except the VM tests (activation-vm,hjem-systemand the twosystem-manager-vm-*checks) also builds locally.This pull request is stacked on #142.
🤖 Generated with Claude Code