git.iko.soy/obelisk
on master help sign in
Merge branch 'develop' into fix-selftest
commitdf8e5dcec8d5a23ab4d70a7f49f03d805743b226 authorAli Abrar <aliabrar@gmail.com> dateWed 2 Oct 2019, 12:51 (7 years ago) parent258c48922bfe36
6 files changed+20−14
compare with master
unifiedsplit
README.md+10−6 lib/command/src/Obelisk/Command/Deploy.hs+1−1 lib/command/src/Obelisk/Command/Project.hs+1 lib/selftest/src/Obelisk/SelfTest.hs+1−1 skeleton/default.nix+6−6 skeleton/shell.nix+1
README.md+10−6
@@ -128,14 +128,16 @@ For further information see [the Haskell section](https://nixos.org/nixpkgs/manu
128128Build everything:
129129
130130```
131−nix-build -A exe -o result-exe
131+nix-build -A exe --no-out-link
132132```
133133
134−Run the server:
134+Copy the result to a new directory, add configuration, and run!
135135
136136```
137−cd result-exe
138−./backend
137+mkdir test-app
138+ln -s $(nix-build -A exe --no-out-link)/* test-app/
139+cp -r config test-app
140+(cd test-app && ./backend)
139141```
140142
141143### EC2
@@ -167,9 +169,11 @@ ob deploy init \
167169 ~/code/myapp-deploy
168170```
169171
170−NOTE: HTTPS is enabled by default; to disable https, pass `--disable-https` to the `ob deploy init` command above.
172+HTTPS is enabled by default; to disable https, pass `--disable-https` to the `ob deploy init` command above.
171173
172−Then go to that created deployment configuration directory, and initiate the deployment:
174+This step will also require that you manually verify the authenticity of the host `$SERVER`. Obelisk will save the fingerprint in a deployment-specific configuration. **Obelisk deployments do *not* rely on the `known_hosts` of your local machine.** This is because, in the event that you need to switch from one deploy machine / bastion host to another, you want to be absolutely sure that you're still connecting to the machines you think you are, even if that deploy machine / bastion host has never connected to them before. Obelisk explicitly avoids a workflow that encourages people to accept host keys without checking them, since that could result in leaking production secrets to anyone who manages to MITM you, e.g. via DNS spoofing or cache poisoning. (Note that an active attack is a circumstance where you may need to quickly switch bastion hosts, e.g. because the attacker has taken one down or you have taken it down in case it was compromised. In this circumstance you might need to deploy to production to fix an exploit or rotate keys, etc.) When you run `ob deploy` later it will rely on the saved verification in this step.
175+
176+Next, go to the deployment directory that you just initialized and deploy!
173177
174178```
175179cd ~/code/myapp-deploy
lib/command/src/Obelisk/Command/Deploy.hs+1−1
@@ -275,7 +275,7 @@ instance ToJSON KeytoolConfig
275275createKeystore :: MonadObelisk m => FilePath -> KeytoolConfig -> m ()
276276createKeystore root config = do
277277 let expr = "with (import " <> toImplDir root <> ").reflex-platform.nixpkgs; pkgs.mkShell { buildInputs = [ pkgs.jdk ]; }"
278− callProcessAndLogOutput (Notice,Notice) $ (proc "nix-shell" ["-E" , expr, "--run" , keytoolCmd]) { cwd = Just root }
278+ callProcessAndLogOutput (Notice,Notice) $ (proc "nix-shell" ["default.nix", "-E" , expr, "--run" , keytoolCmd]) { cwd = Just root }
279279 where
280280 keytoolCmd = processToShellString "keytool"
281281 [ "-genkeypair", "-noprompt"
lib/command/src/Obelisk/Command/Project.hs+1
@@ -205,6 +205,7 @@ inImpureProjectShell shellName command = withProjectRoot "." $ \root ->
205205projectShell :: MonadObelisk m => FilePath -> Bool -> String -> Maybe String -> m ()
206206projectShell root isPure shellName command = do
207207 (_, _, _, ph) <- createProcess_ "runNixShellAttr" $ setCtlc $ setCwd (Just root) $ proc "nix-shell" $
208+ [ "default.nix"] <>
208209 [ "--pure" | isPure ] <>
209210 [ "-A"
210211 , "shells." <> shellName
lib/selftest/src/Obelisk/SelfTest.hs+1−1
@@ -161,7 +161,7 @@ main = do
161161 forM_ ["ghc", "ghcjs"] $ \compiler -> do
162162 let
163163 shell = "shells." <> compiler
164− inShell cmd' = run "nix-shell" ["-A", fromString shell, "--run", cmd']
164+ inShell cmd' = run "nix-shell" ["default.nix", "-A", fromString shell, "--run", cmd']
165165 it ("can enter " <> shell) $ inTmpObInit $ \_ -> inShell "exit"
166166 it ("can build in " <> shell) $ inTmpObInit $ \_ -> inShell $ "cabal new-build --" <> fromString compiler <> " all"
167167
skeleton/default.nix+6−6
@@ -1,10 +1,10 @@
11{ obelisk ? import ./.obelisk/impl {
2− system = builtins.currentSystem;
3− iosSdkVersion = "10.2";
4− # You must accept the Android Software Development Kit License Agreement at
5− # https://developer.android.com/studio/terms in order to build Android apps.
6− # Uncomment and set this to `true` to indicate your acceptance:
7− # config.android_sdk.accept_license = false;
2+ system = builtins.currentSystem;
3+ iosSdkVersion = "10.2";
4+ # You must accept the Android Software Development Kit License Agreement at
5+ # https://developer.android.com/studio/terms in order to build Android apps.
6+ # Uncomment and set this to `true` to indicate your acceptance:
7+ # config.android_sdk.accept_license = false;
88 }
99}:
1010with obelisk;
skeleton/shell.nixnew file+1
@@ -0,0 +1 @@
1+(import ./. {}).shells.ghc