cachix-agent: add module

(cherry picked from commit 939731b8cb)

modules/misc/news.nix

@@ -843,6 +843,14 @@ in
             export MOZ_ALLOW_DOWNGRADE=1
         '';
       }
+
+      {
+        time = "2022-12-28T16:20:51+00:00";
+        condition = hostPlatform.isLinux;
+        message = ''
+          A new module is available: 'services.cachix-agent'.
+        '';
+      }
     ];
   };
 }

modules/modules.nix

@@ -204,6 +204,7 @@ let
     ./services/betterlockscreen.nix
     ./services/blueman-applet.nix
     ./services/borgmatic.nix
+    ./services/cachix-agent.nix
     ./services/caffeine.nix
     ./services/cbatticon.nix
     ./services/clipmenu.nix

modules/services/cachix-agent.nix

@@ -0,0 +1,84 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.cachix-agent;
+
+in {
+  meta.maintainers = [ maintainers.rycee ];
+
+  options.services.cachix-agent = {
+    enable = mkEnableOption ''
+      Cachix Deploy Agent: <link xlink:href="https://docs.cachix.org/deploy/"/>'';
+
+    name = mkOption {
+      type = types.str;
+      description = "The unique agent name.";
+    };
+
+    verbose = mkEnableOption "verbose output";
+
+    profile = mkOption {
+      type = types.str;
+      default = "home-manager";
+      description = ''
+        The Nix profile name.
+      '';
+    };
+
+    host = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Cachix URI to use.";
+    };
+
+    package = mkPackageOption pkgs "cachix" { };
+
+    credentialsFile = mkOption {
+      type = types.path;
+      default = "${config.xdg.configHome}/cachix-agent.token";
+      defaultText =
+        literalExpression ''"''${config.xdg.configHome}/cachix-agent.token"'';
+      description = ''
+        Required file that needs to contain
+        <literal>CACHIX_AGENT_TOKEN=...</literal>.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      (lib.hm.assertions.assertPlatform "services.cachix-agent" pkgs
+        lib.platforms.linux)
+    ];
+
+    systemd.user.services.cachix-agent = {
+      Unit.Description = "Cachix Deploy Agent";
+
+      Service = {
+        Environment = [
+          "PATH=${
+            if config.nix.enable && config.nix.package != null then
+              config.nix.package
+            else
+              pkgs.nix
+          }/bin"
+        ];
+        EnvironmentFile = cfg.credentialsFile;
+
+        # We don't want to kill children processes as those are deployments.
+        KillMode = "process";
+        Restart = "on-failure";
+        ExecStart = escapeShellArgs ([ "${cfg.package}/bin/cachix" ]
+          ++ optional cfg.verbose "--verbose"
+          ++ optional (cfg.host != null) "--host ${cfg.host}"
+          ++ [ "deploy" "agent" cfg.name ]
+          ++ optional (cfg.profile != null) cfg.profile);
+      };
+
+      Install.WantedBy = [ "default.target" ];
+    };
+  };
+}

tests/default.nix

@@ -166,6 +166,7 @@ import nmt {
     ./modules/programs/yt-dlp
     ./modules/services/barrier
     ./modules/services/borgmatic
+    ./modules/services/cachix-agent
     ./modules/services/devilspie2
     ./modules/services/dropbox
     ./modules/services/emacs

tests/modules/services/cachix-agent/basic-setup.nix

@@ -0,0 +1,32 @@
+{ config, ... }:
+
+{
+  services.cachix-agent = {
+    enable = true;
+    package = config.lib.test.mkStubPackage { outPath = "@cachix-agent@"; };
+    name = "test-agent";
+  };
+
+  test.stubs.nix = { };
+
+  nmt.script = ''
+    assertFileContent \
+      home-files/.config/systemd/user/cachix-agent.service \
+      ${
+        builtins.toFile "cachix-agent.service" ''
+          [Install]
+          WantedBy=default.target
+
+          [Service]
+          Environment=PATH=@nix@/bin
+          EnvironmentFile=/home/hm-user/.config/cachix-agent.token
+          ExecStart='@cachix-agent@/bin/cachix' 'deploy' 'agent' 'test-agent' 'home-manager'
+          KillMode=process
+          Restart=on-failure
+
+          [Unit]
+          Description=Cachix Deploy Agent
+        ''
+      }
+  '';
+}

tests/modules/services/cachix-agent/default.nix

@@ -0,0 +1 @@
+{ cachix = ./basic-setup.nix; }