Add profiles

`flake.lock`: Update

.envrc

@@ -0,0 +1,7 @@
+HOST_XDG_DATA_DIRS="${XDG_DATA_DIRS:-}"
+eval "$(lorri direnv)"
+export XDG_DATA_DIRS="${XDG_DATA_DIRS}:${HOST_XDG_DATA_DIRS}"
+
+# Use system PKI
+unset SSL_CERT_FILE
+unset NIX_SSL_CERT_FILE

.gitignore

@@ -1,2 +1,9 @@
 result
 result-*
+
+dist/
+dist-newstyle/
+cabal.project.local
+
+*.swp
+

CHANGELOG.md

@@ -0,0 +1,100 @@
+# Revision history for Arion
+
+## 0.2.1.0 -- 2023-07-26
+
+### Added
+
+* `service.networks` now supports attribute set values with various options, thanks to @pedorich-n.
+* `docker-compose.volumes` can now be specified in multiple modules, thanks to @qaifshaikh.
+* `image.fakeRootCommands` for making modifications to the image that aren't "add a link farm".
+
+### Fixed
+
+* Regular maintenance fixes, including one by olebedev
+
+
+## 0.2.0.0 -- 2022-12-02
+
+### BREAKING
+
+* The `project.name` option is now mandatory for projects that aren't deployed with the NixOS module.
+
+* The NixOS module now sets the default network name to the project name (commonly referred to as `<name>` in the option path).
+  If this is not desired, for instance if you need the projects to be on the same network, set `networks.default.name` in each of them.
+
+* The NixOS module now sets the default project name. You can still set your own value with the `project.name` option.
+  If you did not set one, docker compose heuristically determined the name to be `store`, so you may want to set `project.name = "store"` or prepare to rename the network manually.
+
+### Removed
+
+ - NixOS 20.09 support. Its docker-compose does not support the
+   `networks.<name>.name` option, which is important in later versions.
+   A newer, bundled docker compose may work there, but for now the decision
+   is to drop this legacy version.
+
+### Changed
+
+* Healthcheck-based dependencies in `service.depends_on`.
+
+### Added
+
+* Support `service.healthcheck` for defining custom healthchecks.
+* Arion now declares a `networks.default` by default, with `name` set to
+  `project.name`. This improves compatibility with container runtimes by
+  copying pre-existing behavior. Most users will want to keep using this
+  behavior, but it can be disabled with `enableDefaultNetwork`.
+
+## 0.1.3.0 -- 2020-05-03
+
+### Changed
+
+* `useHostStore` now uses an image derived from the `image.*` options. You may
+  need to enable `enableRecommendedContents` because with this change, files
+  like `/bin/sh` aren't added by default anymore.
+
+* Drop obsolete NixOS 19.03, 19.09 and 20.03 from CI.
+
+### Added
+
+* NixOS-based containers can now run on Podman when it is configured to provide a docker socket. See the [installation docs](https://docs.hercules-ci.com/arion/#_nixos).
+
+* Support `service.dns`, for overriding the DNS servers used by containers.
+
+* Support `service.labels`, which is useful for autodiscovery among other things.
+
+* Add a tested example for Traefik with label-based routing.
+
+* Add a `flake.nix` and an experimental flake example
+
+* Add a warning when systemd `DynamicUser` is used but not available to the
+  container.
+
+* CI with NixOS 21.05
+
+## 0.1.2.0 -- 2020-03-05
+
+* Support use of prebuilt `docker-compose.yaml`.
+  Separates build and execution without duplicating evaluation.
+
+* Avoid storing tarballs (wasting store space) by using
+  `dockerTools.streamLayeredImage` if available.
+
+* Project name is now configurable via the `project.name` option
+
+* Support --no-ansi, --compatibility, --log-level options
+
+## 0.1.1.1 -- 2020-03-20
+
+* Fix ambiguous import of `lines`
+* Improve base version constraint
+* Fix warnings
+
+## 0.1.1.0 -- 2020-03-19
+
+* Support Nixpkgs 20.03
+* Fixes for macOS
+
+## 0.1.0.0 -- 2019-10-04
+
+* First released version. Released on an unsuspecting world.
+

HACKING.md

@@ -0,0 +1,31 @@
+
+# Hacking on the modules
+
+## Easiest option
+
+The module system does not distinguish between modules and configurations.
+This mean you can prototype any feature by factoring out functionality in a real-world project.
+
+## Changing the built-in modules
+
+If your change is not just an addition or if it's better implemented by refactoring, you'll want to fork and edit arion sources directly.
+
+For a fast iteration cycle (but possibly outdated arion command logic):
+
+    ~/src/arion/run-arion-quick up -d
+
+To update the arion command logic on the next run
+
+    rm ~/src/arion/result-run-arion-quick
+
+
+# Hacking on the arion command
+
+The arion command is written in Haskell. Anyone can make small changes to the code.
+Experience with Haskell tooling is not required. You can use the nixified scripts in the root of the repo for common tasks.
+ - `build` or `live-check` for typechecking
+ - `live-unit-tests` (only the test suite is "live" though)
+ - `repl` for a Haskell REPL
+ - `run-arion` to run an incrementally built arion
+ - `run-arion-via-nix` to run a nix-built arion
+ - ~~`run-arion-quick`~~ *not for command hacking;* use stale command. See previous section.

LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2019 Hercules Labs OÜ
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.asciidoc

@@ -0,0 +1,7 @@
+Arion is a tool for building and running applications that
+consist of multiple docker containers using NixOS modules.
+It has special support for docker images that are built with Nix,
+for a smooth development experience and improved performance.
+
+
+# https://docs.hercules-ci.com/arion/[Intro and Documentation]

README.md

@@ -1,139 +0,0 @@
-
-# Run docker-compose without images with Nix
-
-*Wait, what?*
-
-With Arion you can fire up containers without creating images for each
-service. Instead, it uses a mostly empty image, sort of like a base
-image, and makes the host's Nix store available in the container,
-allowing the container to run programs without having to re-package
-them into a docker image.
-
-Arion is configured using Nix with modules, like those in
-NixOS. Similar to `docker-compose` it can therefore combine
-configuration from multiple files. For managing the network and
-containers it delegates to the `docker-compose` command.
-
-# Project Status
-
-This project was born out of a process supervision need for local
-development environments while working
-on [Hercules CI](https://www.hercules-ci.com). (It was also born out
-of ancient Greek deities disguised as horses. More on that later.)
-
-We don't use it to deploy to 'real' environments and we have no plans
-to do so in the future.
-
-If you do want to use Arion for 'real' environments, you'll probably
-want to either build images or manage garbage collection roots if you
-control the deployment host. Either of these has yet to be
-implemented.
-
-Support for other Linux than NixOS is untested.
-
-# Install
-
-Have [Nix](https://nixos.org/nix/) and Docker installed. Ubuntu users:
-make sure you've installed via `apt-get install docker.io`. The Docker snap
-is broken and apparently unsupported by Canonical.
-
-    git clone git@github.com:hercules-ci/arion.git
-    cd arion
-    nix-env -iA arion -f .
-
-# Example `arion-compose.nix`
-
-This Nix expression serves the Nix manual at host port 8000 when launched with `arion up`. It is a function from a package set (`pkgs`) to a configuration.
-
-```nix
-{ pkgs, ... }:
-{
-  config.docker-compose.services = {
-
-    webserver = {
-      service.useHostStore = true;
-      # service.depends_on = [ "backend" ];
-      service.command = [ "sh" "-c" ''
-                  cd "$$WEB_ROOT"
-                  ${pkgs.python3}/bin/python -m http.server
-                '' ];
-      service.ports = [
-        "8000:8000" # host:container
-      ];
-      service.environment.WEB_ROOT = "${pkgs.nix.doc}/share/doc/nix/manual";
-    };
-
-    # backend = { ... }
-  };
-}
-```
-
-The `pkgs` argument comes from a file called `arion-pkgs.nix`. It can be as simple as `import <nixpkgs> {}` to use the Nixpkgs from your `$NIX_PATH`.
-
-# A full featured example
-
-To see how Arion can be used in a project, have a look at [todomvc-nix](https://github.com/nix-community/todomvc-nix/tree/master/deploy/arion).
-
-    git clone git@github.com:nix-community/todomvc-nix.git
-    cd todomvc-nix/deploy/arion
-    arion up
-
-# How it works
-
-Arion is essentially a thin wrapper around Nix and docker-compose.
-When it runs, it does the following:
-
- - Evaluate the configuration using Nix, producing a `docker-compose.yaml` and a garbage collection root
- - Invoke `docker-compose`
- - Clean up the garbage collection root
-
-Most of the interesting stuff happens in Arion's Nix expressions,
-where it runs the module system (known from NixOS) and provides the configuration that makes the Docker Compose file do the things it needs to do.
-
-The interesting part is of course the [service-host-store.nix module](src/nix/service-host-store.nix) which performs the bind mounts to make the host Nix store available in the container.
-
-# FAQ
-
-### Do I need to use Hercules CI?
-
-Nope, it's just Nix and Docker Compose under the hood.
-
-
-### Does Arion support Docker images?
-
-Yes, you can still specify a docker image. For example:
-
-    postgres = {
-      service.image = "postgres:10";
-      service.volumes = [ "${toString ./.}/postgres-data:/var/lib/postgresql/data" ];
-      service.environment.POSTGRES_PASSWORD = "mydefaultpass";
-    };
-
-### What about garbage collection?
-
-Arion removes the need for garbage collecting docker images,
-delegating this task to Nix.
-
-Arion creates a garbage collection root and cleans it up after
-completing the command. This means that `arion up` without `-d` is
-safe with respect to garbage collection. A deployment that is more
-serious than local development must leave a GC root on the deployment
-host. This use case is not supported as of now.
-
-### What is messing with my environment variables?
-
-Docker Compose performs its own environment variable
-substitution. This can be a little annoying in `services.command` for
-example. Either reference a script from `pkgs.writeScript` or escape
-the dollar sign as `$$`.
-
-### Why "Arion"?
-
-Arion comes from Greek mythology. Poseidon, the god of ~Docker~ the
-seas had his eye on Demeter. Demeter tried to trick him by disguising
-as a horse, but Poseidon saw through the deception and they had Arion.
-
-So Arion is a super fast divine horse; the result of some weird
-mixing. Also it talks.
-
-(And we feel morally obliged to name our stuff after Greek mythology)

Setup.hs

@@ -0,0 +1,2 @@
+import Distribution.Simple
+main = defaultMain

antora-playbook.yml

@@ -0,0 +1,13 @@
+# This is not used when the docs are imported into the docs site.
+# It is only here for development preview.
+content:
+  sources:
+  - url: .
+    start_path: docs
+    branches: HEAD
+ui:
+  bundle:
+    url: ./docs/ui-bundle.zip
+output:
+  dir: ./public
+

arion-compose.cabal

@@ -0,0 +1,90 @@
+cabal-version:       2.4
+
+name:                arion-compose
+version: 0.2.1.0
+synopsis:            Run docker-compose with help from Nix/NixOS
+description:         Arion is a tool for building and running applications that consist of multiple docker containers using NixOS modules. It has special support for docker images that are built with Nix, for a smooth development experience and improved performance.
+homepage:            https://github.com/hercules-ci/arion#readme
+-- bug-reports:
+license:             Apache-2.0
+license-file:        LICENSE
+author:              Robert Hensing
+maintainer:          robert@hercules-ci.com
+-- copyright:
+category:            Distribution, Network, Cloud, Distributed Computing
+extra-source-files:  CHANGELOG.md, README.asciidoc,
+                     src/haskell/testdata/**/*.nix
+                     src/haskell/testdata/**/*.json
+data-files:          nix/*.nix
+                   , nix/modules/composition/*.nix
+                   , nix/modules/networks/*.nix
+                   , nix/modules/nixos/*.nix
+                   , nix/modules/service/*.nix
+                   , nix/modules/lib/*.nix
+
+-- all data is verbatim from some sources
+data-dir:            src
+
+source-repository head
+  type: git
+  location: https://github.com/hercules-ci/arion
+
+common common
+  build-depends:     base >=4.12.0.0 && <4.99
+                   , aeson >=2
+                   , aeson-pretty
+                   , async
+                   , bytestring
+                   , directory
+                   , lens
+                   , lens-aeson
+                   , process
+                   , temporary
+                   , text
+                   , protolude >= 0.2
+                   , unix
+  ghc-options:     -Wall
+
+flag ghci
+  default: False
+  manual: True
+
+library
+  import:              common
+  exposed-modules:     Arion.Nix
+                       Arion.Aeson
+                       Arion.DockerCompose
+                       Arion.ExtendedInfo
+                       Arion.Images
+                       Arion.Services
+  other-modules:       Paths_arion_compose
+  autogen-modules:     Paths_arion_compose
+  -- other-extensions:
+  hs-source-dirs:      src/haskell/lib
+  default-language:    Haskell2010
+
+executable arion
+  import:              common
+  main-is:             Main.hs
+  -- other-modules:
+  -- other-extensions:
+  build-depends:       optparse-applicative
+                     , arion-compose
+  hs-source-dirs:      src/haskell/exe
+  default-language:    Haskell2010
+
+test-suite arion-unit-tests
+  import:              common
+  if flag(ghci)
+    hs-source-dirs:      src/haskell/lib
+    ghc-options:       -Wno-missing-home-modules
+  type:                exitcode-stdio-1.0
+  main-is:             TestMain.hs
+  other-modules:       Spec
+                     , Arion.NixSpec
+  -- other-extensions:
+  build-depends:       arion-compose
+                     , hspec
+                     , QuickCheck
+  hs-source-dirs:      src/haskell/test
+  default-language:    Haskell2010

arion.nix

@@ -1,21 +0,0 @@
-{ stdenv, lib
-, coreutils, docker_compose, jq
-}:
-
-stdenv.mkDerivation {
-    name = "arion";
-    src = ./src;
-    unpackPhase = "";
-    buildPhase = "";
-    installPhase = ''
-      mkdir -p $out/bin $out/share/arion
-      cp -a nix $out/share/arion/
-      cp -a arion-image $out/share/arion/
-      tar -czf $out/share/arion/arion-image/tarball.tar.gz -C arion-image/tarball .
-      substitute arion $out/bin/arion \
-        --subst-var-by path ${lib.makeBinPath [jq coreutils docker_compose]} \
-        --subst-var-by nix_dir $out/share/arion/nix \
-        ;
-      chmod a+x $out/bin/arion
-    '';
-}

bors.toml

@@ -0,0 +1,5 @@
+status = [
+  "ci/hercules/onPush/default",
+  "ci/hercules/evaluation",
+]
+delete_merged_branches = true

build

@@ -0,0 +1,6 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+
+# Build the Haskell package via cabal, outside Nix
+
+cabal new-build --write-ghc-environment-files=never

cabal.project

@@ -0,0 +1 @@
+packages: .

default.nix

@@ -1,5 +1,11 @@
-args@{ pkgs ? import ./nix args, ... }:
-
+let flake = import ./nix/compat.nix;
+in
+{ pkgs ? import flake.inputs.nixpkgs { }
+, haskellPackages ? pkgs.haskellPackages
+}:
+let
+  pkgsWithArion = pkgs.extend flake.overlays.default;
+in
 {
-  inherit (pkgs) arion tests;
+  inherit (pkgsWithArion) arion;
 }

docs/README.md

@@ -0,0 +1,4 @@
+
+# Documentation
+
+Please refer to the [**rendered documentation**](https://docs.hercules-ci.com/arion), which includes the [**options.**](https://docs.hercules-ci.com/arion/options/)

docs/antora.yml

@@ -0,0 +1,7 @@
+name: arion
+title: Arion Documentation
+version: 'master'
+nav:
+- modules/ROOT/nav.adoc
+- modules/reference/nav.adoc
+nix: true

docs/flake-module.nix

@@ -0,0 +1,31 @@
+{
+  perSystem = { config, pkgs, lib, ... }: {
+    packages.generated-option-doc-arion =
+      # TODO: use the render pipeline in flake-parts,
+      #       which has support for things like {options}`foo`.
+      let
+        eval = lib.evalModules {
+          modules = import ../src/nix/modules.nix;
+        };
+      in
+      (pkgs.nixosOptionsDoc
+        {
+          options = eval.options;
+        }).optionsCommonMark;
+
+    packages.generated-antora-files =
+      pkgs.runCommand "generated-antora-files"
+        {
+          nativeBuildInputs = [ pkgs.pandoc ];
+          doc_arion = config.packages.generated-option-doc-arion;
+        }
+        # TODO: use the render pipeline in flake-parts,
+        #       which has support for things like {options}`foo`.
+        ''
+          mkdir -p $out/modules/ROOT/partials
+          pandoc --from=markdown --to=asciidoc \
+            < $doc_arion \
+            > $out/modules/ROOT/partials/arion-options.adoc
+        '';
+  };
+}

docs/modules/ROOT/examples/full-nixos/arion-compose.nix

@@ -0,0 +1 @@
+../../../../../examples/full-nixos/arion-compose.nix

docs/modules/ROOT/examples/minimal/arion-compose.nix

@@ -0,0 +1 @@
+../../../../../examples/minimal/arion-compose.nix

docs/modules/ROOT/examples/nixos-unit/arion-compose.nix

@@ -0,0 +1 @@
+../../../../../examples/nixos-unit/arion-compose.nix

docs/modules/ROOT/nav.adoc

@@ -0,0 +1,3 @@
+* xref:index.adoc[Getting Started]
+* xref:options.adoc[Arion Options]
+* xref:deployment.adoc[Deployment]

docs/modules/ROOT/pages/deployment.adoc

@@ -0,0 +1,71 @@
+= Deployment with Arion
+
+Arion projects can be deployed in Nix-like or Docker-like ways.
+
+== Docker images
+
+When you disable `useHostStore`, arion will build images, which can be deployed
+to any Docker host, including non-NixOS hosts.
+
+=== Remote Docker socket
+
+NOTE: Access to a Docker socket is equivalent to root access on the host.
+
+Docker supports authentication via TLS client certificates.
+
+The xref:hercules-ci-effects:ROOT:reference/nix-functions/runArion.adoc[runArion Effect] uses this technique.
+
+Because this technique works with a single Docker host, it does not need a registry.
+
+=== Upload to registry
+
+You can either use `arion push` or write custom push logic using the `arion cat`
+command, the `eval` function on the `arion` package, or the `lib.eval` function
+on the flake to retrieve the images defined in a project.
+
+== NixOS module
+
+Arion projects can be deployed as part of a NixOS configuration. This ties the
+project revision to the system configuration revision, which can be good or bad
+thing, depending on your deployment strategy. At a low level, a benefit is that
+no store paths need to be copied locally and remote NixOS deployments can use
+Nix's copy-closure algorithm for efficient transfers, and transparent binary
+caches rather than an inherently stateful Docker registry solution.
+
+Extend your NixOS configuration by adding the configuration elements to an
+existing configuration. You could create a new module file for it, if your
+choice of `imports` allows it.
+
+NOTE: This deployment method does NOT use an `arion-pkgs.nix` file, but reuses
+      the host `pkgs`.
+
+```nix
+{
+  imports = [
+    # Pick one of:
+    #  - niv
+    ((import ./nix/sources.nix).arion + "/nixos-module.nix")
+    #  - or flakes (where arion is a flake input)
+    arion.nixosModules.arion
+    #  - or other: copy commit hash of arion and replace HASH in:
+    (builtins.fetchTarball "https://github.com/hercules-ci/arion/archive/HASH.tar.gz") + "/nixos-module.nix")
+  ];
+
+  virtualisation.arion = {
+    backend = "podman-socket"; # or "docker"
+    projects.example = {
+      serviceName = "example"; # optional systemd service name, defaults to arion-example in this case
+      settings = {
+        # Specify you project here, or import it from a file.
+        # NOTE: This does NOT use ./arion-pkgs.nix, but defaults to NixOS' pkgs.
+        imports = [ ./arion-compose.nix ];
+      };
+    };
+  };
+}
+```
+
+See also:
+
+ - xref:hercules-ci-effects:ROOT:reference/nix-functions/runNixOS.adoc[runNixOS Effect]
+ - xref:hercules-ci-effects:ROOT:reference/nix-functions/runNixOps2.adoc[runNixOps2 Effect]

docs/modules/ROOT/pages/index.adoc

@@ -0,0 +1,312 @@
+= Welcome to Arion documentation
+
+== Introduction
+
+Arion is a tool for building and running applications that
+consist of multiple docker containers using NixOS modules.
+It has special support for docker images that are built with Nix,
+for a smooth development experience and improved performance.
+
+It is built on top of https://docs.docker.com/compose/overview/[Docker
+Compose], which implements the container orchestration functionality.
+
+Instead of configuring the compositions in YAML files like
+`docker-compose.yaml`, Arion uses the https://nixos.org/nix/[Nix]
+language to declare the compositions. Because of this, Arion gives you
+the ability to declare your deployments, configuration and packaging
+in the same language. By replacing multiple tools with a single
+language, you decrease your mental load and you can more easily
+refactor and maintain your configurations.
+
+Although Arion can be used as a Docker Compose with an improved
+configuration front end, there is more to be gained from integrating
+with Nix. In particular, the more structured approach of Nix compared
+to Dockerfiles allows the following:
+
+ * Build components of your image in *parallel, automatically*
+ * *Share packages between images*, regardless of the order they were
+   added
+ * Improve performance by *skipping container
+   image creation*
+ * Work with *structured data instead of strings*,
+   templates and a multitude of expression languages
+ * Refactor across deployments, configuration and packaging
+
+Arion allows to compose containers with different granularity:
+
+  * <<Minimal: Plain command using nixpkgs>>
+  * <<NixOS: run only one systemd service>>
+  * <<NixOS: run full OS>>
+  * <<Docker image from DockerHub>>
+
+Full NixOS is supported on
+
+ * docker-compose + podman with docker socket (NixOS >= 21.05)
+ * docker-compose + docker, before cgroupsv2 (NixOS < 21.05)
+
+`podman-compose` support is currently WIP on a separate branch.
+
+== Installation
+
+=== Nix
+
+```bash
+$ nix-env -iA arion -f https://github.com/hercules-ci/arion/tarball/master
+```
+
+=== NixOS
+
+Add this module to your NixOS configuration:
+
+```nix
+{ pkgs, ... }: {
+  environment.systemPackages = [
+    pkgs.arion
+
+     # Do install the docker CLI to talk to podman.
+     # Not needed when virtualisation.docker.enable = true;
+    pkgs.docker-client
+  ];
+
+  # Arion works with Docker, but for NixOS-based containers, you need Podman
+  # since NixOS 21.05.
+  virtualisation.docker.enable = false;
+  virtualisation.podman.enable = true;
+  virtualisation.podman.dockerSocket.enable = true;
+  virtualisation.podman.defaultNetwork.dnsname.enable = true;
+
+  # Use your username instead of `myuser`
+  users.extraUsers.myuser.extraGroups = ["podman"];
+}
+```
+
+////
+
+== Not installing: use it in a project
+
+TODO: describe: using nix-shell or in a script, building images as
+      part of nix-build, pinning, see also todomvc-nix.
+
+TODO: exposed Nix functions: arion.build, arion.eval (a bit of IFD)
+
+
+////
+
+
+== Usage
+
+Arion is configured declaratively with two files:
+
+=== arion-pkgs.nix
+
+Arion needs `arion-pkgs.nix` to import nixpkgs, for example:
+
+```nix
+import <nixpkgs> { system = "x86_64-linux"; }
+```
+
+or more sophisticated (recommended) setup with https://github.com/nmattia/niv[Niv].
+
+=== arion-compose.nix
+
+Describe containers using NixOS-style modules. There are a few options:
+
+==== Minimal: Plain command using nixpkgs
+
+`examples/minimal/arion-compose.nix`
+[,nix]
+----
+{ pkgs, ... }:
+{
+  project.name = "webapp";
+  services = {
+
+    webserver = {
+      image.enableRecommendedContents = true;
+      service.useHostStore = true;
+      service.command = [ "sh" "-c" ''
+                  cd "$$WEB_ROOT"
+                  ${pkgs.python3}/bin/python -m http.server
+                '' ];
+      service.ports = [
+        "8000:8000" # host:container
+      ];
+      service.environment.WEB_ROOT = "${pkgs.nix.doc}/share/doc/nix/manual";
+      service.stop_signal = "SIGINT";
+    };
+  };
+}
+----
+
+==== NixOS: run full OS
+
+`examples/full-nixos/arion-compose.nix`:
+
+[,nix]
+----
+{
+  project.name = "full-nixos";
+  services.webserver = { pkgs, lib, ... }: {
+    nixos.useSystemd = true;
+    nixos.configuration.boot.tmp.useTmpfs = true;
+    nixos.configuration.services.nginx.enable = true;
+    nixos.configuration.services.nginx.virtualHosts.localhost.root = "${pkgs.nix.doc}/share/doc/nix/manual";
+    nixos.configuration.services.nscd.enable = false;
+    nixos.configuration.system.nssModules = lib.mkForce [];
+    nixos.configuration.systemd.services.nginx.serviceConfig.AmbientCapabilities = 
+      lib.mkForce [ "CAP_NET_BIND_SERVICE" ];
+    service.useHostStore = true;
+    service.ports = [
+      "8000:80" # host:container
+    ];
+  };
+}
+----
+
+==== Docker image from DockerHub
+
+```nix
+{
+  services.postgres = {
+    service.image = "postgres:10";
+    service.volumes = [ "${toString ./.}/postgres-data:/var/lib/postgresql/data" ];
+    service.environment.POSTGRES_PASSWORD = "mydefaultpass";
+  };
+}
+```
+
+==== NixOS: run only one systemd service
+
+Running individual units from NixOS is possible using an experimental script.
+See `examples/nixos-unit/arion-compose.nix`.
+
+=== Run
+
+Start containers and watch their logs:
+
+```bash
+$ arion up -d
+$ arion logs -f
+```
+
+You can go to `examples/*/` and run these commands to give it a quick try.
+
+=== Inspect the config
+
+While developing an arion project, you can make use of `arion repl`, which launches
+a `nix repl` on the project configuration.
+
+```
+$ arion repl
+Launching a repl for you. To get started:
+
+To see deployment-wide configuration
+  type config. and use tab completion
+To bring the top-level Nixpkgs attributes into scope
+  type :a (config._module.args.pkgs) // { inherit config; }
+
+Welcome to Nix. Type :? for help.
+
+Loading '../../src/nix/eval-composition.nix'...
+Added 5 variables.
+
+nix-repl> config.services.webserver.service.command
+[ "sh" "-c" "cd \"$$WEB_ROOT\"\n/nix/store/66fbv9mmx1j4hrn9y06kcp73c3yb196r-python3-3.8.9/bin/python -m http.server\n" ]
+
+nix-repl>
+
+```
+
+== Build with Nix
+
+You can build a project with `nix-build` using an expression like
+
+```nix
+arion.build { modules = [ ./arion-compose.nix ]; pkgs = import ./arion-pkgs.nix; }
+```
+
+If you deploy with xref:hercules-ci-effects:ROOT:reference/nix-functions/runArion.adoc[runArion],
+and your `pkgs` variable is equivalent to `import ./arion-pkgs.nix`, you can use:
+
+```nix
+let
+  deployment = pkgs.effects.runArion { /* ... */ });
+in deployment.prebuilt
+```
+
+== Project Status
+
+This project was born out of a process supervision need for local
+development environments while working on
+https://www.hercules-ci.com[Hercules CI]. (It was also born out of
+ancient Greek deities disguised as horses. More on that later.)
+
+Arion can be used for simple single host deployments, using Docker's TLS
+client verification, or https://search.nixos.org/options?channel=unstable&show=virtualisation.podman.networkSocket.enable&query=virtualisation.podman[`virtualisation.podman.networkSocket` options].
+Remote deployments do not support `useHostStore`, although an SSH-based deployment method could support this.
+Docker Swarm is not currently supported.
+
+Arion has run successfully on Linux distributions other than NixOS, but we only perform CI for Arion on NixOS.
+
+
+== How it works
+
+Arion is essentially a thin wrapper around Nix and docker-compose. When
+it runs, it does the following:
+
+* Evaluate the configuration using Nix, producing a
+`docker-compose.yaml` and a garbage collection root
+* Invoke `docker-compose`
+* Clean up the garbage collection root
+
+Most of the interesting stuff happens in Arion’s Nix expressions, where
+it runs the module system (known from NixOS) and provides the
+configuration that makes the Docker Compose file do the things it needs
+to do.
+
+One of the more interesting built-in modules is the
+https://github.com/hercules-ci/arion/blob/master/src/nix/modules/service/host-store.nix[host-store.nix module] which
+performs the bind mounts to make the host Nix store available in the
+container.
+
+== FAQ
+
+=== Do I need to use Hercules CI?
+
+Nope, it’s just Nix and Docker Compose under the hood.
+
+It does xref:hercules-ci-effects:ROOT:reference/nix-functions/runArion.adoc[integrate] nicely though.
+
+=== What about garbage collection?
+
+Arion removes the need for garbage collecting docker images, delegating
+this task to Nix when using `service.useHostStore`.
+
+Arion creates a garbage collection root that it cleans up after completing
+the command. This means that `arion up -d` should not be used with `useHostStore`
+in production. Instead, disable `useHostStore`, which will use `dockerTools` to
+generate images that can be used in production.
+
+=== Why is my container not running latest code?
+
+Rebuild the image using `arion up -d --always-recreate-deps <name>` or simply `arion up -d`.
+
+Like `docker-compose restart`, `arion restart` does not update the image before starting.
+
+=== What is messing with my environment variables?
+
+Docker Compose performs its own environment variable substitution. This
+can be a little annoying in `services.command` for example. Either
+reference a script from `pkgs.writeScript` or escape the dollar sign as
+`$$`.
+
+=== Why name it ``Arion``?
+
+Arion comes from Greek mythology. Poseidon, the god of Docker -- I mean the seas --
+had his eye on Demeter. Demeter tried to trick him by disguising as a
+horse, but Poseidon saw through the deception and they had Arion.
+
+So Arion is a super fast divine horse; the result of some weird mixing.
+Also it talks.
+
+(And we felt morally obliged to name our stuff after Greek mythology)

docs/modules/ROOT/pages/options.adoc

@@ -0,0 +1,3 @@
+# Arion Options
+
+include::partial$arion-options.adoc[]

docs/options.nix

@@ -0,0 +1,20 @@
+{ pkgs ? import ../nix {} }:
+
+let
+  eval = pkgs.lib.evalModules {
+    modules = import ../src/nix/modules.nix;
+  };
+  options = pkgs.nixosOptionsDoc {
+    options = eval.options;
+  };
+
+in (pkgs.runCommand "agent-options.adoc" { } ''
+  cat >$out <<EOF
+  = Arion options
+
+  EOF
+  cat ${options.optionsAsciiDoc} >>$out
+'').overrideAttrs (o: {
+  # Work around https://github.com/hercules-ci/hercules-ci-agent/issues/168
+  allowSubstitutes = true;
+})

examples/flake/arion-compose.nix

@@ -0,0 +1,30 @@
+{ pkgs, ... }:
+let 
+    sh = pkgs.stdenv.mkDerivation {
+        name = "sh";
+        phases = [ "installPhase" ];
+
+        installPhase = ''
+            mkdir -p "$out"/bin
+            ln -s ${pkgs.bash}/bin/sh "$out"/bin/sh
+        '';
+    };
+in{
+  config.project.name = "webapp";
+  config.services = {
+
+    webserver = {
+      image.contents = [ sh ];
+      service.useHostStore = true;
+      service.command = [ "sh" "-c" ''
+                  cd "$$WEB_ROOT"
+                  ${pkgs.python3}/bin/python -m http.server
+                '' ];
+      service.ports = [
+        "8000:8000" # host:container
+      ];
+      service.environment.WEB_ROOT = "${pkgs.nix.doc}/share/doc/nix/manual";
+      service.stop_signal = "SIGINT";
+    };
+  };
+}

examples/flake/arion-pkgs.nix

@@ -0,0 +1,13 @@
+let
+  flake = if builtins ? getFlake
+    then (builtins.getFlake (toString ./.)).pkgs
+    else (import flake-compat { src = ./.; }).defaultNix;
+  # NB: this is lazy
+  lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  inherit (lock.nodes.flake-compat.locked) owner repo rev narHash;
+  flake-compat = builtins.fetchTarball {
+    url = "https://github.com/${owner}/${repo}/archive/${rev}.tar.gz";
+    sha256 = narHash;
+  };
+in
+  flake.pkgs

examples/flake/flake.lock

@@ -0,0 +1,44 @@
+{
+  "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1606424373,
+        "narHash": "sha256-oq8d4//CJOrVj+EcOaSXvMebvuTkmBJuT5tzlfewUnQ=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "99f1c2157fba4bfe6211a321fd0ee43199025dbf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1618853290,
+        "narHash": "sha256-K4fddnrGOcKL+6CEchRrVmepiwvwvHxB87goqBTI5Bs=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9a1672105db0eebe8ef59f310397435f2d0298d0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-20.09",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

examples/flake/flake.nix

@@ -0,0 +1,19 @@
+{
+  description = "A very basic flake";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-20.09";
+  inputs.flake-compat.url = "github:edolstra/flake-compat";
+  inputs.flake-compat.flake = false;
+
+  outputs = { self, nixpkgs, ... }: {
+
+    pkgs = nixpkgs.legacyPackages.x86_64-linux;
+    # # alternative:
+    # pkgs = import nixpkgs { config = { }; overlays = [ ]; system = "x86_64-linux"; };
+
+    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;
+
+    defaultPackage.x86_64-linux = self.packages.x86_64-linux.hello;
+
+  };
+}

examples/full-nixos/arion-compose.nix

@@ -0,0 +1,18 @@
+{
+  project.name = "full-nixos";
+  services.webserver = { pkgs, lib, ... }: {
+    nixos.useSystemd = true;
+    nixos.configuration.boot.tmp.useTmpfs = true;
+    nixos.configuration.networking.useDHCP = false;
+    nixos.configuration.services.nginx.enable = true;
+    nixos.configuration.services.nginx.virtualHosts.localhost.root = "${pkgs.nix.doc}/share/doc/nix/manual";
+    nixos.configuration.services.nscd.enable = false;
+    nixos.configuration.system.nssModules = lib.mkForce [];
+    nixos.configuration.systemd.services.nginx.serviceConfig.AmbientCapabilities = 
+      lib.mkForce [ "CAP_NET_BIND_SERVICE" ];
+    service.useHostStore = true;
+    service.ports = [
+      "8000:80" # host:container
+    ];
+  };
+}

examples/full-nixos/arion-pkgs.nix

@@ -0,0 +1,6 @@
+# Instead of pinning Nixpkgs, we can opt to use the one in NIX_PATH
+import <nixpkgs> {
+  # We specify the architecture explicitly. Use a Linux remote builder when
+  # calling arion from other platforms.
+  system = "x86_64-linux";
+}

examples/minimal/arion-compose.nix

@@ -1,10 +1,11 @@
 { pkgs, ... }:
 {
-  config.docker-compose.services = {
+  project.name = "webapp";
+  services = {
 
     webserver = {
+      image.enableRecommendedContents = true;
       service.useHostStore = true;
-      # service.depends_on = [ "backend" ];
       service.command = [ "sh" "-c" ''
                   cd "$$WEB_ROOT"
                   ${pkgs.python3}/bin/python -m http.server
@@ -13,9 +14,7 @@
         "8000:8000" # host:container
       ];
       service.environment.WEB_ROOT = "${pkgs.nix.doc}/share/doc/nix/manual";
+      service.stop_signal = "SIGINT";
     };
-
-    # backend = { ... }
   };
 }
-    

examples/minimal/arion-pkgs.nix

@@ -1,2 +1,6 @@
 # Instead of pinning Nixpkgs, we can opt to use the one in NIX_PATH
-import <nixpkgs> {}
+import <nixpkgs> {
+  # We specify the architecture explicitly. Use a Linux remote builder when
+  # calling arion from other platforms.
+  system = "x86_64-linux";
+}

examples/nixos-unit/arion-compose.nix

@@ -0,0 +1,50 @@
+
+/*
+
+  DISCLAIMER
+
+  This uses a somewhat hidden feature in NixOS, which is the
+  "runner". It's a script that's available on systemd services
+  that lets you run the service independently from systemd.
+  However, it was clearly not intended for public consumption
+  so please use it with care.
+  It does not support all features of systemd so you are on
+  your own if you use it in production.
+
+  One known issue is that the script does not respond to docker's
+  SIGTERM shutdown signal.
+
+ */
+
+{
+  project.name = "nixos-unit";
+  services.webserver = { config, pkgs, ... }: {
+
+    nixos.configuration = {config, lib, options, pkgs, ...}: {
+      boot.isContainer = true;
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost.root = "${pkgs.nix.doc}/share/doc/nix/manual";
+      } // lib.optionalAttrs (options?services.nginx.stateDir) {
+        # Work around a problem in NixOS 20.03
+        stateDir = "/var/lib/nginx";
+      };
+      system.build.run-nginx = pkgs.writeScript "run-nginx" ''
+        #!${pkgs.bash}/bin/bash
+        PATH='${config.systemd.services.nginx.environment.PATH}'
+        echo nginx:x:${toString config.users.users.nginx.uid}:${toString config.users.groups.nginx.gid}:nginx web server user:/var/empty:/bin/sh >>/etc/passwd
+        echo nginx:x:${toString config.users.groups.nginx.gid}:nginx >>/etc/group
+        echo 'nobody:x:65534:65534:Unprivileged account do not use:/var/empty:/run/current-system/sw/bin/nologin' >>/etc/passwd
+        echo 'nogroup:x:65534:' >>/etc/group
+        mkdir -p /var/log/nginx /run/nginx/ /var/cache/nginx /var/lib/nginx/{,logs,proxy_temp,client_body_temp,fastcgi_temp,scgi_temp,uwsgi_temp} /tmp/nginx_client_body
+        chown nginx /var/log/nginx /run/nginx/ /var/cache/nginx /var/lib/nginx/{,logs,proxy_temp,client_body_temp,fastcgi_temp,scgi_temp,uwsgi_temp} /tmp/nginx_client_body
+        ${config.systemd.services.nginx.runner}
+      '';
+    };
+    service.command = [ config.nixos.build.run-nginx ];
+    service.useHostStore = true;
+    service.ports = [
+      "8000:80" # host:container
+    ];
+  };
+}

examples/nixos-unit/arion-pkgs.nix

@@ -0,0 +1,6 @@
+# Instead of pinning Nixpkgs, we can opt to use the one in NIX_PATH
+import <nixpkgs> {
+  # We specify the architecture explicitly. Use a Linux remote builder when
+  # calling arion from other platforms.
+  system = "x86_64-linux";
+}

examples/traefik/arion-compose.nix

@@ -0,0 +1,64 @@
+/*
+ 
+  An example of
+   - traefik HTTP reverse proxy
+   - minimal images
+   - routing via docker labels
+
+  Run `arion up -d` and open http://nix-docs.localhost/
+
+ */
+{ lib, pkgs, ... }: {
+  config.project.name = "traefik";
+  config.networks = {
+    traefik-custom = {
+      name = "traefik-custom";
+      ipam = {
+        config = [{
+          subnet = "172.32.0.0/16";
+          gateway = "172.32.0.1";
+        }];
+      };
+    };
+  };
+  config.services = {
+    traefik = {
+      image.command = [
+        "${pkgs.traefik}/bin/traefik"
+        "--api.insecure=true"
+        "--providers.docker=true"
+        "--providers.docker.exposedbydefault=false"
+        "--entrypoints.web.address=:80"
+      ];
+      service = {
+        container_name = "traefik";
+        stop_signal = "SIGINT";
+        ports = [ "80:80" "8080:8080" ];
+        volumes = [ "/var/run/docker.sock:/var/run/docker.sock:ro" ];
+        networks = [ "traefik-custom" ];
+      };
+    };
+
+    nix-docs = {
+      image.command = ["${pkgs.writeScript "entrypoint" ''
+        #!${pkgs.bash}/bin/bash
+        cd ${pkgs.nix.doc}/share/doc/nix/manual
+        ${pkgs.python3}/bin/python -m http.server
+      ''}"];
+      service.container_name = "simple-service";
+      service.stop_signal = "SIGINT";
+      service.labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.nix-docs.rule" = "Host(`nix-docs.localhost`)";
+        "traefik.http.routers.nix-docs.entrypoints" = "web";
+        "traefik.http.services.nix-docs.loadBalancer.server.port" = "8000";
+      };
+      service.networks = {
+        traefik-custom = {
+          ipv4_address = "172.32.0.5";
+        };
+      };
+    };
+  };
+}
+

examples/traefik/arion-pkgs.nix

@@ -0,0 +1,6 @@
+# Instead of pinning Nixpkgs, we can opt to use the one in NIX_PATH
+import <nixpkgs> {
+  # We specify the architecture explicitly. Use a Linux remote builder when
+  # calling arion from other platforms.
+  system = "x86_64-linux";
+}

flake.lock

@@ -0,0 +1,107 @@
+{
+  "nodes": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1722555600,
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "hercules-ci-effects",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-parts",
+        "type": "indirect"
+      }
+    },
+    "haskell-flake": {
+      "locked": {
+        "lastModified": 1675296942,
+        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "ref": "0.1.0",
+        "repo": "haskell-flake",
+        "type": "github"
+      }
+    },
+    "hercules-ci-effects": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1719226092,
+        "narHash": "sha256-YNkUMcCUCpnULp40g+svYsaH1RbSEj6s4WdZY/SHe38=",
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "rev": "11e4b8dc112e2f485d7c97e1cee77f9958f498f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1722630782,
+        "narHash": "sha256-hMyG9/WlUi0Ho9VkRrrez7SeNlDzLxalm9FwY7n/Noo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d04953086551086b44b6f3c6b7eeb26294f207da",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "haskell-flake": "haskell-flake",
+        "hercules-ci-effects": "hercules-ci-effects",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,98 @@
+{
+  description = "Arion - use Docker Compose via Nix";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    haskell-flake.url = "github:srid/haskell-flake/0.1.0";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
+    hercules-ci-effects.url = "github:hercules-ci/hercules-ci-effects";
+    hercules-ci-effects.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = inputs@{ self, flake-parts, ... }:
+    flake-parts.lib.mkFlake { inherit inputs; } ({ config, lib, extendModules, ... }: {
+      imports = [
+        inputs.haskell-flake.flakeModule
+        inputs.hercules-ci-effects.flakeModule
+        inputs.flake-parts.flakeModules.easyOverlay
+        ./docs/flake-module.nix
+        ./tests/flake-module.nix
+      ];
+      systems = inputs.nixpkgs.lib.systems.flakeExposed;
+      perSystem = { config, self', inputs', pkgs, system, final, ... }:
+        let h = pkgs.haskell.lib.compose; in
+        {
+          overlayAttrs = {
+            inherit (config.packages) arion;
+            arionTestingFlags = {
+              dockerSupportsSystemd = false;
+            };
+          };
+          packages.default = config.packages.arion;
+          packages.overlay-test = final.arion;
+          packages.arion = import ./nix/arion.nix { inherit pkgs; };
+          haskellProjects.haskell-package = {
+            # not autodetected: https://github.com/srid/haskell-flake/issues/49
+            packages.arion-compose.root = ./.;
+
+            overrides =
+              self: super: {
+                arion-compose =
+                  lib.pipe super.arion-compose [
+                    (h.addBuildTools [ pkgs.nix ])
+                    (h.overrideCabal (o: {
+                      src = pkgs.lib.sourceByRegex ./. [
+                        ".*[.]cabal"
+                        "LICENSE"
+                        "src/?.*"
+                        "README.asciidoc"
+                        "CHANGELOG.md"
+                      ];
+                      preCheck = ''
+                        export NIX_LOG_DIR=$TMPDIR
+                        export NIX_STATE_DIR=$TMPDIR
+                        export NIX_PATH=nixpkgs=${pkgs.path}
+                      '';
+                    }))
+                  ];
+              };
+          };
+          devShells.default = config.devShells.haskell-package.overrideAttrs (o: {
+            nativeBuildInputs = o.nativeBuildInputs or [ ] ++ [
+              pkgs.docker-compose
+              pkgs.nixpkgs-fmt
+              config.haskellProjects.haskell-package.haskellPackages.releaser
+            ];
+          });
+        };
+
+      hercules-ci.flake-update = {
+        enable = true;
+        autoMergeMethod = "merge";
+        when = {
+          hour = [ 2 ];
+          dayOfMonth = [ 5 ];
+        };
+      };
+
+      herculesCI.ciSystems = [
+        # "aarch64-darwin"
+        # "aarch64-linux"
+        "x86_64-darwin"
+        "x86_64-linux"
+      ];
+
+      flake = {
+        debug = { inherit inputs config lib; };
+
+        lib = {
+          eval = import ./src/nix/eval-composition.nix;
+          build = args@{ ... }:
+            let composition = self.lib.eval args;
+            in composition.config.out.dockerComposeYaml;
+        };
+        nixosModules.arion = ./nixos-module.nix;
+      };
+    });
+}

live-unit-tests

@@ -0,0 +1,13 @@
+#!/usr/bin/env nix-shell
+#!nix-shell ./shell.nix
+#!nix-shell -i bash
+set -eux -o pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+ghcid \
+  --command 'cabal v2-repl arion-compose:arion-unit-tests --flags ghci --write-ghc-environment-files=never' \
+  --test=Main.main \
+  --reload=src/haskell \
+  --restart=arion-compose.cabal \
+  ;

nix/arion.nix

@@ -0,0 +1,13 @@
+# Like the upstreamable expression but wired up for the local arion.
+{ pkgs ? import ./. {}
+, lib ? pkgs.lib
+, haskell ? pkgs.haskell
+, haskellPackages ? pkgs.haskellPackages
+, arion-compose ? import ./haskell-arion-compose.nix { inherit pkgs haskellPackages; }
+, runCommand ? pkgs.runCommand
+}:
+import ./upstreamable/default.nix {
+  inherit pkgs lib haskell runCommand;
+  haskellPackages = haskellPackages // { inherit arion-compose; };
+  evalSrc = ./..;
+}

nix/compat.nix

@@ -0,0 +1,10 @@
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/009399224d5e398d03b22badca40a37ac85412a1.tar.gz";
+      sha256 = "sha256:0xcr9fibnapa12ywzcnlf54wrmbqqb96fmmv8043zhsycws7bpqy";
+    }
+  )
+  { src = ../.; }
+).defaultNix

nix/default.nix

@@ -1,13 +0,0 @@
-/**
- * This is the entry-point for all nix execution in this project.
- */
-{ nixpkgsSrc ? ./nixpkgs.nix, ... }:
-import (import ./nixpkgs.nix) {
-  # Makes the config pure as well. See <nixpkgs>/top-level/impure.nix:
-  config = {
-  };
-  overlays = [
-    # all the packages are defined there:
-    (import ./overlay.nix)
-  ];
-}

nix/haskell-arion-compose.nix

@@ -0,0 +1,20 @@
+
+# NOTE: This file produces a haskell library, not the arion package!
+
+{ pkgs ? import ./default.nix {}, haskellPackages ? pkgs.haskellPackages }:
+let
+  inherit (pkgs.haskell.lib) overrideCabal addBuildTools;
+in
+  overrideCabal (addBuildTools (haskellPackages.callCabal2nix "arion-compose" ./.. {}) [pkgs.nix]) (o: o // {
+    src = pkgs.lib.sourceByRegex ../. [
+      ".*[.]cabal"
+      "LICENSE"
+      "src/?.*"
+      "README.asciidoc"
+    ];
+    preCheck = ''
+      export NIX_LOG_DIR=$TMPDIR
+      export NIX_STATE_DIR=$TMPDIR
+      export NIX_PATH=nixpkgs=${pkgs.path}
+    '';
+  })

nix/nixpkgs.nix

@@ -1,5 +0,0 @@
-# to update: $ nix-prefetch-url --unpack url
-builtins.fetchTarball {
-  url = "https://github.com/NixOS/nixpkgs/archive/be445a9074f139d63e704fa82610d25456562c3d.tar.gz";
-  sha256 = "15dc7gdspimavcwyw9nif4s59v79gk18rwsafylffs9m1ld2dxwa";
-}

nix/overlay.nix

@@ -1,4 +0,0 @@
-self: super: {
-  arion = super.callPackage ../arion.nix {};
-  tests = super.callPackage ../tests {};
-}

nix/upstreamable/default.nix

@@ -0,0 +1,88 @@
+args@
+{ pkgs
+, lib
+, haskellPackages
+, haskell
+, runCommand
+
+  # Allow this expression file to be used more efficiently in situations where
+  # the sources are more readily available. Unpacking haskellPackages.arion-compose.src
+  # is not always the best choice for arion.eval.
+, evalSrc ? null
+}:
+
+let
+
+  /* This derivation builds the arion tool.
+
+     It is based on the arion-compose Haskell package, but adapted and extended to
+       - have the correct name
+       - have a smaller closure size
+       - have functions to use Arion from inside Nix: arion.eval and arion.build
+       - make it self-contained by including docker-compose
+   */
+  arion =
+    justStaticExecutables (
+      overrideCabal
+        arion-compose
+        cabalOverrides
+      );
+
+  inherit (haskell.lib) justStaticExecutables overrideCabal;
+
+  inherit (haskellPackages) arion-compose;
+
+  cabalOverrides = o: {
+    buildTools = (o.buildTools or []) ++ [pkgs.makeWrapper];
+    passthru = (o.passthru or {}) // {
+      inherit eval build;
+    };
+    # Patch away the arion-compose name. Unlike the Haskell library, the program
+    # is called arion (arion was already taken on hackage).
+    pname = "arion";
+    src = arion-compose.src;
+
+    # PYTHONPATH
+    #
+    # We close off the python module search path!
+    #
+    # Accepting directories from the environment into the search path
+    # tends to break things. Docker Compose does not have a plugin
+    # system as far as I can tell, so I don't expect this to break a
+    # feature, but rather to make the program more robustly self-
+    # contained.
+
+    postInstall = ''${o.postInstall or ""}
+      mkdir -p $out/libexec
+      mv $out/bin/arion $out/libexec
+      makeWrapper $out/libexec/arion $out/bin/arion \
+        --unset PYTHONPATH \
+        --prefix PATH : ${lib.makeBinPath [ pkgs.docker-compose ]} \
+        ;
+    '';
+  };
+
+  # Unpacked sources for evaluation by `eval`
+  evalSrc' = args.evalSrc or (runCommand "arion-src" {}
+    "mkdir $out; tar -C $out --strip-components=1 -xf ${arion-compose.src}");
+
+  /* Function for evaluating a composition
+
+     Re-uses this Nixpkgs evaluation instead of `arion-pkgs.nix`.
+
+     Returns the module system's `config` and `options` variables.
+   */
+  eval = args@{...}:
+    import (evalSrc' + "/src/nix/eval-composition.nix")
+      ({ inherit pkgs; } // args);
+
+  /* Function to derivation of the docker compose yaml file
+     NOTE: The output will change: https://github.com/hercules-ci/arion/issues/82
+
+     This function is particularly useful on CI.
+   */
+  build = args@{...}:
+    let composition = eval args;
+    in composition.config.out.dockerComposeYaml;
+
+in arion

nixos-module.nix

@@ -0,0 +1,118 @@
+{ config, lib, options, pkgs, ... }:
+let
+  inherit (lib)
+    attrValues
+    mkIf
+    mkOption
+    mkMerge
+    types
+    ;
+
+  cfg = config.virtualisation.arion;
+
+  projectType = types.submoduleWith {
+    modules = [ projectModule ];
+  };
+
+  projectModule = { config, name, ... }: {
+    options = {
+      settings = mkOption {
+        description = ''
+          Arion project definition, otherwise known as arion-compose.nix contents.
+
+          See <link xlink:href="https://docs.hercules-ci.com/arion/options/">https://docs.hercules-ci.com/arion/options/</link>.
+        '';
+        type = arionSettingsType name;
+        visible = "shallow";
+      };
+      _systemd = mkOption { internal = true; };
+      serviceName = mkOption {
+        description = "The name of the Arion project's systemd service";
+        type = types.str;
+        default = "arion-${name}";
+      };
+    };
+    config = {
+      _systemd.services.${config.serviceName} = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "sockets.target" ];
+
+        path = [
+          cfg.package
+          cfg.docker.client.package
+        ];
+        environment.ARION_PREBUILT = config.settings.out.dockerComposeYaml;
+        script = ''
+          echo 1>&2 "docker compose file: $ARION_PREBUILT"
+          arion --prebuilt-file "$ARION_PREBUILT" up
+        '';
+      };
+    };
+  };
+
+  arionSettingsType = name:
+    (cfg.package.eval { modules = [{ project.name = lib.mkDefault name; }]; }).type or (
+      throw "lib.evalModules did not produce a type. Please upgrade Nixpkgs to nixos-unstable or >=nixos-21.11"
+    );
+
+in
+{
+  disabledModules = [ "virtualisation/arion.nix" ];
+
+  options = {
+    virtualisation.arion = {
+      backend = mkOption {
+        type = types.enum [ "podman-socket" "docker" ];
+        description = ''
+          Which container implementation to use.
+        '';
+      };
+      package = mkOption {
+        type = types.package;
+
+        default = (import ./. { inherit pkgs; }).arion;
+        description = ''
+          Arion package to use. This will provide <literal>arion</literal>
+          executable that starts the project.
+
+          It also must provide the arion <literal>eval</literal> function as
+          an attribute.
+        '';
+      };
+      docker.client.package = mkOption {
+        type = types.package;
+        internal = true;
+      };
+      projects = mkOption {
+        type = types.attrsOf projectType;
+        default = { };
+        description = ''
+          Arion projects to be run as a service.
+        '';
+      };
+    };
+  };
+
+  config = mkIf (cfg.projects != { }) (
+    mkMerge [
+      {
+        systemd = mkMerge (map (p: p._systemd) (attrValues cfg.projects));
+      }
+      (mkIf (cfg.backend == "podman-socket") {
+        virtualisation.docker.enable = false;
+        virtualisation.podman.enable = true;
+        virtualisation.podman.dockerSocket.enable = true;
+        virtualisation.podman.defaultNetwork = 
+          if options?virtualisation.podman.defaultNetwork.settings
+          then { settings.dns_enabled = true; } # since 2023-01 https://github.com/NixOS/nixpkgs/pull/199965
+          else { dnsname.enable = true; }; # compat <2023
+
+        virtualisation.arion.docker.client.package = pkgs.docker-client;
+      })
+      (mkIf (cfg.backend == "docker") {
+        virtualisation.docker.enable = true;
+        virtualisation.arion.docker.client.package = pkgs.docker;
+      })
+    ]
+  );
+}

repl

@@ -0,0 +1,6 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+
+# A Haskell REPL for hacking on the Haskell code
+
+cabal new-repl --write-ghc-environment-files=never

run-arion

@@ -0,0 +1,15 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell ./shell.nix
+
+# For quick manual testing of a hacked arion
+
+# NB: Only works inside the project directory
+
+cabal \
+  new-run \
+  --write-ghc-environment-files=never \
+  :pkg:arion-compose:exe:arion \
+  -- \
+  "$@" \
+  ;

run-arion-quick

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+projectRoot="$(dirname ${BASH_SOURCE[0]})"
+resultLink="$projectRoot/result-run-arion-quick"
+
+[[ -e "$resultLink" ]] || {
+  echo 1>&2 "You don't have a prebuilt arion yet; building it."
+  nix-build "$projectRoot" -A arion --out-link "$resultLink"
+}
+
+echo 1>&2 "Note that you will need to rm '$resultLink' to rebuild the arion executable when needed."
+
+export arion_compose_datadir="$projectRoot/src"
+
+exec "$resultLink/bin/arion" "$@"

run-arion-via-nix

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# For manual testing of a hacked arion built via Nix.
+# Works when called from outside the project directory.
+
+exec nix run -f "$(dirname ${BASH_SOURCE[0]})" arion "$@"

shell.nix

@@ -0,0 +1 @@
+(builtins.getFlake ("git+file://" + toString ./.)).devShells.${builtins.currentSystem}.default

src/arion

@@ -1,235 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-export PATH="@path@:$PATH"
-
-nix_dir="@nix_dir@"
-docker_compose_args=()
-files=()
-command="docker-compose"
-pkgs_argument="./arion-pkgs.nix"
-
-debug() {
-    # echo "$@"
-    :
-}
-
-while test $# != 0; do
-    case "$1" in
-        -f|--file)
-            shift
-            files+=("$1")
-            ;;
-        -f*)
-            files+=("${1/#-f/}")
-            ;;
-        --file=*)
-            files+=("${1/#--file=}")
-            ;;
-        --pkgs)
-            shift
-            pkgs_argument="$1"
-            ;;
-        -h|--help|help)
-            command="help"
-            shift
-            break
-            ;;
-        cat)
-            command="$1"
-            shift
-            break
-            ;;
-        repl)
-            command="$1"
-            shift
-            break
-            ;;
-        docker-compose)
-            command="docker-compose"
-            shift
-            break
-            ;;
-        *)
-            break
-            ;;
-    esac
-    shift
-done
-
-while test $# != 0; do
-    docker_compose_args+=("$1")
-    shift
-done
-
-case "$command" in
-    help)
-        cat <<EOF
-
-Arion wraps your system's docker-compose, providing a NixOps-like
-experience for simple container deployments.
-
-Usage:
-  arion up|logs|...     - execute docker-compose commands
-  arion cat             - display raw docker-compose.yaml
-  arion config          - validate and display the config file
-  arion repl            - explore the config interactively
-  arion help
-  arion docker-compose help
-  arion docker-compose help up|logs|...
-
-Top-level arion options
-
-  These must be provided before the command.
-
-  --file FILE       Use FILE instead of the default ./arion-compose.nix
-                    Can be specified multiple times for a merged configuration.
-  --pkgs EXPR       Use EXPR instead of ./arion-pkgs.nix to get the
-                    Nixpkgs attrset used for bootstrapping and evaluating
-                    the configuration.
-
-EOF
-        exit 0
-        ;;
-    *)
-        ;;
-esac
-
-if [[ ${#files[@]} == 0 ]]; then
-    files=("./arion-compose.nix")
-fi
-
-
-debug docker_compose_args: "${docker_compose_args[@]}"
-debug files: "${files[@]}"
-
-docker_compose_yaml=.tmp-nix-docker-compose-$$-$RANDOM.yaml
-cleanup() {
-  rm -f $docker_compose_yaml
-}
-trap cleanup EXIT
-
-modules="["
-
-for file in "${files[@]}"; do
-    case "$file" in
-        /*)
-            modules="$modules (/. + $(printf '"%q"' "$file"))"
-            ;;
-        *)
-            modules="$modules (./. + $(printf '"/%q"' "$file"))"
-            ;;
-    esac
-done
-
-modules="$modules ]"
-
-debug modules: "$modules"
-
-old_IFS="$IFS"
-IFS=""
-args=(
-     )
-IFS="$old_IFS"
-for arg in "${args[@]}"; do
-    echo "arg: $arg"
-done
-
-do_eval() {
-  echo 1>&2 "Evaluating configuration..."
-  # read-write-mode is required for import from derivation
-  nix-instantiate \
-    "$nix_dir/eval-composition.nix" \
-    --eval \
-    --read-write-mode \
-    --json \
-    --argstr uid "$UID" \
-    --arg modules "$modules" \
-    --arg pkgs "$pkgs_argument" \
-    --show-trace \
-    --attr 'config.build.dockerComposeYamlText' \
-    | jq -r . >$docker_compose_yaml;
-}
-
-do_build() {
-  echo 1>&2 "Building configuration..."
-  nix-build \
-    "$nix_dir/eval-composition.nix" \
-    --out-link $docker_compose_yaml \
-    --argstr uid "$UID" \
-    --arg modules "$modules" \
-    --arg pkgs "$pkgs_argument" \
-    --show-trace \
-    --attr 'config.build.dockerComposeYaml' \
-    >/dev/null ;
-}
-
-
-do_repl() {
-    # nix repl doesn't autocall its <FILES> arguments
-    # so we improvise. We need a file in this directory
-    # to make sure that all paths are as expected :(
-    trap do_repl_cleanup EXIT;
-
-    REPL_TMP=.tmp-repl-$$-$RANDOM
-    cat <<EOF
-Launch a repl for you, using a temporary file: $REPL_TMP.
-
-This loads the configuration from the modules
-  ${files[*]}
-
-To get started:
-
-To see deployment-wide configuration
-  type config. and hit TAB
-To see the services
-  type config.docker-compose.services TAB or ENTER
-To bring the top-level Nixpkgs attributes into scope
-  type :a (config._module.args.pkgs) // { inherit config; }
-
-EOF
-    cat >"$REPL_TMP" <<EOF
-import $nix_dir/eval-composition.nix {
-  uid = "$UID";
-  modules = $modules;
-  pkgs = $pkgs_argument;
-}
-EOF
-
-    nix repl \
-        "$REPL_TMP" \
-        ;
-}
-do_repl_cleanup() {
-    rm -f $REPL_TMP
-}
-
-case "$command" in
-    cat)
-        do_eval
-        jq . < "$docker_compose_yaml"
-        ;;
-    repl)
-        do_repl
-        ;;
-    docker-compose)
-        if [[ ${#docker_compose_args[@]} != 0
-           && ${docker_compose_args[0]} != "help"
-           && ${docker_compose_args[0]} != "version"
-            ]]; then
-            case "${docker_compose_args[0]}" in
-                help|version)
-                    :
-                    ;;
-                config|down|events|exec|images|kill|logs|pause|port|ps|rm|stop|top|unpause)
-                    do_eval
-                    ;;
-                *)
-                    do_build
-                    ;;
-            esac
-        fi
-        docker-compose -f $docker_compose_yaml "${docker_compose_args[@]}"
-        ;;
-esac

src/arion-image/Dockerfile

@@ -1,3 +1,5 @@
 FROM scratch
-COPY passwd /etc/passwd
-ADD tarball.tar.gz /
+# scratch itself can't be run.
+
+# This seems like a no-op:
+CMD []

src/arion-image/passwd

@@ -1,2 +0,0 @@
-root:x:0:0:System administrator:/root:/bin/sh
-nobody:x:65534:65534:Unprivileged account (don't use!):/var/empty:/run/current-system/sw/bin/nologin

src/arion-image/tarball/bin/sh

@@ -1 +0,0 @@
-/run/system/bin/sh

src/arion-image/tarball/usr/bin/env

@@ -1 +0,0 @@
-/run/system/usr/bin/env

src/haskell/exe/Main.hs

@@ -0,0 +1,324 @@
+{-# LANGUAGE NoImplicitPrelude #-}
+{-# LANGUAGE RecordWildCards #-}
+{-# LANGUAGE ApplicativeDo #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+import Protolude hiding (Down, option)
+
+import           Arion.Nix
+import           Arion.Aeson
+import           Arion.Images (loadImages)
+import qualified Arion.DockerCompose as DockerCompose
+import           Arion.Services (getDefaultExec)
+import           Arion.ExtendedInfo (loadExtendedInfoFromPath, ExtendedInfo(images, projectName))
+
+import Options.Applicative
+import Control.Monad.Fail
+
+import qualified Data.Text as T
+import qualified Data.Text.IO as T
+
+import Data.Aeson(Value)
+
+import System.Posix.User (getRealUserID)
+
+data CommonOptions =
+  CommonOptions
+    { files :: NonEmpty FilePath
+    , pkgs :: Text
+    , nixArgs :: [Text]
+    , prebuiltComposeFile :: Maybe FilePath
+    , noAnsi :: Bool
+    , compatibility :: Bool
+    , logLevel :: Maybe Text
+    }
+  deriving (Show)
+
+newtype DockerComposeArgs =
+  DockerComposeArgs { unDockerComposeArgs :: [Text] }
+
+ensureConfigFile :: [FilePath] -> NonEmpty FilePath
+ensureConfigFile []     = "./arion-compose.nix" :| []
+ensureConfigFile (x:xs) = x :| xs
+
+parseOptions :: Parser CommonOptions
+parseOptions = do
+    files <-
+      ensureConfigFile <$>
+        many (strOption
+               (  short 'f'
+               <> long "file"
+               <> metavar "FILE"
+               <> help "Use FILE instead of the default ./arion-compose.nix. \
+                        \Can be specified multiple times for a merged configuration" ))
+    pkgs <- T.pack <$> strOption
+          (  short 'p'
+          <> long "pkgs"
+          <> metavar "EXPR"
+          <> showDefault
+          <> value "./arion-pkgs.nix"
+          <> help "Use Nix expression EXPR to get the Nixpkgs attrset used for bootstrapping \
+                   \and evaluating the configuration." )
+    showTrace <- flag False True (long "show-trace"
+                    <> help "Causes Nix to print out a stack trace in case of Nix expression evaluation errors. Specify before command.")
+    -- TODO --option support (https://github.com/pcapriotti/optparse-applicative/issues/284)
+    userNixArgs <- many (T.pack <$> strOption (long "nix-arg" <> metavar "ARG" <> help "Pass an extra argument to nix. Example: --nix-arg --option --nix-arg substitute --nix-arg false"))
+    prebuiltComposeFile <- optional $ strOption
+               (  long "prebuilt-file"
+               <> metavar "JSONFILE"
+               <> help "Do not evaluate and use the prebuilt JSONFILE instead. Causes other evaluation-related options to be ignored." )
+    noAnsi <- flag False True (long "no-ansi"
+                    <> help "Avoid ANSI control sequences")
+    compatibility <- flag False True (long "no-ansi"
+                    <> help "If set, Docker Compose will attempt to convert deploy keys in v3 files to their non-Swarm equivalent")
+    logLevel <- optional $ fmap T.pack $ strOption (long "log-level" <> metavar "LEVEL" <> help "Set log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)")
+    pure $
+      let nixArgs = userNixArgs <|> "--show-trace" <$ guard showTrace
+      in CommonOptions{..}
+
+textArgument :: Mod ArgumentFields [Char] -> Parser Text
+textArgument = fmap T.pack . strArgument
+
+parseCommand :: Parser (CommonOptions -> IO ())
+parseCommand =
+  hsubparser
+    (    command "cat" (info (pure runCat) (progDesc "Spit out the docker compose file as JSON" <> fullDesc))
+      <> command "repl" (info (pure runRepl) (progDesc "Start a nix repl for the whole composition" <> fullDesc))
+      <> command "exec" (info (parseExecCommand) (progDesc "Execute a command in a running container" <> fullDesc))
+    )
+  <|>
+  hsubparser
+    (    commandDC runBuildAndDC "build" "Build or rebuild services"
+      <> commandDC runBuildAndDC "bundle" "Generate a Docker bundle from the Compose file"
+      <> commandDC runEvalAndDC "config" "Validate and view the Compose file"
+      <> commandDC runBuildAndDC "create" "Create services"
+      <> commandDC runEvalAndDC "down" "Stop and remove containers, networks, images, and volumes"
+      <> commandDC runEvalAndDC "events" "Receive real time events from containers"
+      <> commandDC runDC "help" "Get help on a command"
+      <> commandDC runEvalAndDC "images" "List images"
+      <> commandDC runEvalAndDC "kill" "Kill containers"
+      <> commandDC runEvalAndDC "logs" "View output from containers"
+      <> commandDC runEvalAndDC "pause" "Pause services"
+      <> commandDC runEvalAndDC "port" "Print the public port for a port binding"
+      <> commandDC runEvalAndDC "ps" "List containers"
+      <> commandDC runBuildAndDC "pull" "Pull service images"
+      <> commandDC runBuildAndDC "push" "Push service images"
+      <> commandDC runBuildAndDC "restart" "Restart services"
+      <> commandDC runEvalAndDC "rm" "Remove stopped containers"
+      <> commandDC runBuildAndDC "run" "Run a one-off command"
+      <> commandDC runBuildAndDC "scale" "Set number of containers for a service"
+      <> commandDC runBuildAndDC "start" "Start services"
+      <> commandDC runEvalAndDC "stop" "Stop services"
+      <> commandDC runEvalAndDC "top" "Display the running processes"
+      <> commandDC runEvalAndDC "unpause" "Unpause services"
+      <> commandDC runBuildAndDC "up" "Create and start containers"
+      <> commandDC runDC "version" "Show the Docker-Compose version information"
+
+      <> metavar "DOCKER-COMPOSE-COMMAND"
+      <> commandGroup "Docker Compose Commands:"
+    )
+
+parseAll :: Parser (IO ())
+parseAll =
+  flip ($) <$> parseOptions <*> parseCommand
+
+parseDockerComposeArgs :: Parser DockerComposeArgs
+parseDockerComposeArgs =
+  DockerComposeArgs <$>
+    many (argument (T.pack <$> str) (metavar "DOCKER-COMPOSE ARGS..."))
+
+commandDC
+  :: (Text -> DockerComposeArgs -> CommonOptions -> IO ())
+  -> Text
+  -> Text
+  -> Mod CommandFields (CommonOptions -> IO ())
+commandDC run cmdStr helpText =
+  command
+    (T.unpack cmdStr)
+    (info
+      (run cmdStr <$> parseDockerComposeArgs)
+      (progDesc (T.unpack helpText) <> fullDesc <> forwardOptions))
+
+
+--------------------------------------------------------------------------------
+
+runDC :: Text -> DockerComposeArgs -> CommonOptions -> IO ()
+runDC cmd (DockerComposeArgs args) _opts = do
+  DockerCompose.run DockerCompose.Args
+    { files = []
+    , otherArgs = [cmd] ++ args
+    }
+
+runBuildAndDC :: Text -> DockerComposeArgs -> CommonOptions -> IO ()
+runBuildAndDC cmd dopts opts = do
+  withBuiltComposeFile opts $ callDC cmd dopts opts True
+
+runEvalAndDC :: Text -> DockerComposeArgs -> CommonOptions -> IO ()
+runEvalAndDC cmd dopts opts = do
+  withComposeFile opts $ callDC cmd dopts opts False
+
+callDC :: Text -> DockerComposeArgs -> CommonOptions -> Bool -> FilePath -> IO ()
+callDC cmd dopts opts shouldLoadImages path = do
+  extendedInfo <- loadExtendedInfoFromPath path
+  when shouldLoadImages $ loadImages (images extendedInfo)
+  let firstOpts = projectArgs extendedInfo <> commonArgs opts
+  DockerCompose.run DockerCompose.Args
+    { files = [path]
+    , otherArgs = firstOpts ++ [cmd] ++ unDockerComposeArgs dopts
+    }
+
+projectArgs :: ExtendedInfo -> [Text]
+projectArgs extendedInfo =
+  do
+    n <- toList (projectName extendedInfo)
+    ["--project-name", n]
+
+commonArgs :: CommonOptions -> [Text]
+commonArgs opts = do
+    guard (noAnsi opts)
+    ["--no-ansi"]
+  <> do
+    guard (compatibility opts)
+    ["--compatibility"]
+  <> do
+    l <- toList (logLevel opts)
+    ["--log-level", l]
+
+withBuiltComposeFile :: CommonOptions -> (FilePath -> IO r) -> IO r
+withBuiltComposeFile opts cont = case prebuiltComposeFile opts of
+  Just prebuilt -> do
+    cont prebuilt
+  Nothing -> do
+    args <- defaultEvaluationArgs opts
+    Arion.Nix.withBuiltComposition args cont
+
+withComposeFile :: CommonOptions -> (FilePath -> IO r) -> IO r
+withComposeFile opts cont = case prebuiltComposeFile opts of
+  Just prebuilt -> do
+    cont prebuilt
+  Nothing -> do
+    args <- defaultEvaluationArgs opts
+    Arion.Nix.withEvaluatedComposition args cont
+
+getComposeValue :: CommonOptions -> IO Value
+getComposeValue opts = case prebuiltComposeFile opts of
+  Just prebuilt -> do
+    decodeFile prebuilt
+  Nothing -> do
+    args <- defaultEvaluationArgs opts
+    Arion.Nix.evaluateComposition args
+
+defaultEvaluationArgs :: CommonOptions -> IO EvaluationArgs
+defaultEvaluationArgs co = do
+  uid <- getRealUserID
+  pure EvaluationArgs
+    { evalUid = fromIntegral uid
+    , evalModules = files co
+    , evalPkgs = pkgs co
+    , evalWorkDir = Nothing
+    , evalMode = ReadWrite
+    , evalUserArgs = nixArgs co
+    }
+
+runCat :: CommonOptions -> IO ()
+runCat co = do
+  v <- getComposeValue co
+  T.hPutStrLn stdout (pretty v)
+
+runRepl :: CommonOptions -> IO ()
+runRepl co = do
+  putErrText
+    "Launching a repl for you. To get started:\n\
+    \\n\
+    \To see deployment-wide configuration\n\
+    \  type config. and use tab completion\n\
+    \To bring the top-level Nixpkgs attributes into scope\n\
+    \  type :a (config._module.args.pkgs) // { inherit config; }\n\
+    \"
+  Arion.Nix.replForComposition =<< defaultEvaluationArgs co
+
+detachFlag :: Parser Bool
+detachFlag = flag False True (long "detach" <> short 'd' <> help "Detached mode: Run command in the background.")
+
+privilegedFlag :: Parser Bool
+privilegedFlag = flag False True (long "privileged" <> help "Give extended privileges to the process.")
+
+userOption :: Parser Text
+userOption = strOption (long "user" <> short 'u' <> help "Run the command as this user.")
+
+noTTYFlag :: Parser Bool
+noTTYFlag = flag False True (short 'T' <> help "Disable pseudo-tty allocation. By default `exec` allocates a TTY.")
+
+indexOption :: Parser Int
+indexOption = option
+  (auto >>= \i -> i <$ unless (i >= 1) (fail "container index must be >= 1"))
+  (long "index" <> value 1 <> help "Index of the container if there are multiple instances of a service.")
+
+envOption :: Parser (Text, Text)
+envOption = option (auto >>= spl) (long "env" <> short 'e' <> help "Set environment variables (can be used multiple times, not supported in Docker API < 1.25)")
+  where spl s = case T.break (== '=') s of
+          (_, "") -> fail "--env parameter needs to combine key and value with = sign"
+          (k, ev) -> pure (k, T.drop 1 ev)
+
+workdirOption :: Parser Text
+workdirOption = strOption (long "workdir" <> short 'w' <> metavar "DIR" <> help "Working directory in which to start the command in the container.")
+
+parseExecCommand :: Parser (CommonOptions -> IO ())
+parseExecCommand = runExec
+  <$> detachFlag
+  <*> privilegedFlag
+  <*> optional userOption
+  <*> noTTYFlag
+  <*> indexOption
+  <*> many envOption
+  <*> optional workdirOption
+  <*> textArgument (metavar "SERVICE")
+  <*> orEmpty' (
+      (:) <$> argument (T.pack <$> str) (metavar "COMMAND")
+          <*> many (argument (T.pack <$> str) (metavar "ARG"))
+  )
+
+orEmpty' :: (Alternative f, Monoid a) => f a -> f a
+orEmpty' m = fromMaybe mempty <$> optional m
+
+runExec :: Bool -> Bool -> Maybe Text -> Bool -> Int -> [(Text, Text)] -> Maybe Text -> Text -> [Text] -> CommonOptions -> IO ()
+runExec detach privileged user noTTY index envs workDir service commandAndArgs opts =
+  withComposeFile opts $ \path -> do
+    extendedInfo <- loadExtendedInfoFromPath path
+    commandAndArgs'' <- case commandAndArgs of
+      [] -> do
+        cmd <- getDefaultExec path service
+        case cmd of
+          [] -> do
+            putErrText "You must provide a command via service.defaultExec or on the command line."
+            exitFailure
+          _ ->
+            pure cmd
+      x -> pure x
+    let commandAndArgs' = case commandAndArgs'' of
+          [] -> ["/bin/sh"]
+          x -> x
+  
+    let args = concat
+          [ ["exec"]
+          , ("--detach" <$ guard detach :: [Text])
+          , "--privileged" <$ guard privileged
+          , "-T" <$ guard noTTY
+          , (\(k, v) -> ["--env", k <> "=" <> v]) =<< envs
+          , join $ toList (user <&> \u -> ["--user", u])
+          , ["--index", show index]
+          , join $ toList (workDir <&> \w -> ["--workdir", w])
+          , [service]
+          , commandAndArgs'
+          ]
+    DockerCompose.run DockerCompose.Args
+      { files = [path]
+      , otherArgs = projectArgs extendedInfo <> commonArgs opts <> args
+      }
+
+main :: IO ()
+main = 
+  (join . arionExecParser) (info (parseAll <**> helper) fullDesc)
+  where
+    arionExecParser = customExecParser (prefs showHelpOnEmpty)
+

src/haskell/lib/Arion/Aeson.hs

@@ -0,0 +1,27 @@
+module Arion.Aeson where
+
+import Prelude ()
+import           Data.Aeson
+import qualified Data.ByteString.Lazy          as BL
+import qualified Data.Text.Lazy                as TL
+import qualified Data.Text.Lazy.Builder        as TB
+import qualified Data.Aeson.Encode.Pretty
+import           Data.Aeson.Encode.Pretty       ( defConfig
+                                                , confCompare
+                                                , confTrailingNewline
+                                                )
+import           Protolude
+
+pretty :: ToJSON a => a -> Text
+pretty =
+  TL.toStrict
+    . TB.toLazyText
+    . Data.Aeson.Encode.Pretty.encodePrettyToTextBuilder' config
+  where config = defConfig { confCompare = compare, confTrailingNewline = True }
+
+decodeFile :: FromJSON a => FilePath -> IO a
+decodeFile fp = do
+  b <- BL.readFile fp
+  case eitherDecode b of
+    Left e -> panic (toS e)
+    Right v -> pure v

src/haskell/lib/Arion/DockerCompose.hs

@@ -0,0 +1,30 @@
+{-# LANGUAGE OverloadedStrings #-}
+module Arion.DockerCompose where
+
+import           Prelude                        ( )
+import           Protolude
+import           System.Process
+
+data Args = Args
+  { files :: [FilePath]
+  , otherArgs :: [Text]
+  }
+
+run :: Args -> IO ()
+run args = do
+  let fileArgs = files args >>= \f -> ["--file", f]
+      allArgs  = fileArgs ++ map toS (otherArgs args)
+
+      procSpec = proc "docker-compose" allArgs
+
+  -- hPutStrLn stderr ("Running docker-compose with " <> show allArgs :: Text)
+
+  withCreateProcess procSpec $ \_in _out _err procHandle -> do
+
+    exitCode <- waitForProcess procHandle
+
+    case exitCode of
+      ExitSuccess -> pass
+      ExitFailure 1 -> exitFailure
+      ExitFailure {} -> do
+        throwIO $ FatalError $ "docker-compose failed with " <> show exitCode

src/haskell/lib/Arion/ExtendedInfo.hs

@@ -0,0 +1,37 @@
+{-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE DeriveGeneric #-}
+{-# LANGUAGE OverloadedStrings #-}
+{-
+
+Parses the x-arion field in the generated compose file.
+
+-}
+module Arion.ExtendedInfo where
+
+import Prelude()
+import Protolude
+import Data.Aeson as Aeson
+import Arion.Aeson
+import Control.Lens
+import Data.Aeson.Lens
+
+data Image = Image
+  { image :: Maybe Text -- ^ image tar.gz file path
+  , imageExe :: Maybe Text -- ^ path to exe producing image tar
+  , imageName :: Text
+  , imageTag :: Text
+  } deriving (Eq, Show, Generic, Aeson.ToJSON, Aeson.FromJSON)
+
+data ExtendedInfo = ExtendedInfo {
+    projectName :: Maybe Text,
+    images :: [Image]
+  } deriving (Eq, Show)
+
+loadExtendedInfoFromPath :: FilePath -> IO ExtendedInfo
+loadExtendedInfoFromPath fp = do
+  v <- decodeFile fp
+  pure ExtendedInfo {
+    -- TODO: use aeson derived instance?
+    projectName = v ^? key "x-arion" . key "project" . key "name" . _String,
+    images = (v :: Aeson.Value) ^.. key "x-arion" . key "images" . _Array . traverse . _JSON
+  }

src/haskell/lib/Arion/Images.hs

@@ -0,0 +1,72 @@
+{-# LANGUAGE DeriveGeneric #-}
+{-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE OverloadedStrings #-}
+module Arion.Images
+  ( loadImages
+  ) where
+
+import Prelude()
+import Protolude hiding (to)
+
+import qualified System.Process as Process
+import qualified Data.Text as T
+
+import Arion.ExtendedInfo (Image(..))
+
+type TaggedImage = Text
+
+-- | Subject to change
+loadImages :: [Image] -> IO ()
+loadImages requestedImages = do
+
+  loaded <- getDockerImages
+
+  let
+    isNew i =
+      -- On docker, the image name is unmodified
+      (imageName i <> ":" <> imageTag i) `notElem` loaded
+      -- On podman, you used to automatically get a localhost prefix
+      -- however, since NixOS 22.05, this expected to be part of the name instead
+        && ("localhost/" <> imageName i <> ":" <> imageTag i) `notElem` loaded
+
+  traverse_ loadImage . filter isNew $ requestedImages
+
+loadImage :: Image -> IO ()
+loadImage Image { image = Just imgPath, imageName = name } =
+  withFile (toS imgPath) ReadMode $ \fileHandle -> do
+  let procSpec = (Process.proc "docker" [ "load" ]) {
+          Process.std_in = Process.UseHandle fileHandle
+        }
+  Process.withCreateProcess procSpec $ \_in _out _err procHandle -> do
+    e <- Process.waitForProcess procHandle
+    case e of
+      ExitSuccess -> pass
+      ExitFailure code ->
+        panic $ "docker load failed with exit code " <> show code <> " for image " <> name <> " from path " <> imgPath
+
+loadImage Image { imageExe = Just imgExe, imageName = name } = do
+  let loadSpec = (Process.proc "docker" [ "load" ]) { Process.std_in = Process.CreatePipe }
+  Process.withCreateProcess loadSpec $ \(Just inHandle) _out _err loadProcHandle -> do
+    let streamSpec = Process.proc (toS imgExe) []
+    Process.withCreateProcess streamSpec { Process.std_out = Process.UseHandle inHandle } $ \_ _ _ streamProcHandle ->
+      withAsync (Process.waitForProcess loadProcHandle) $ \loadExitAsync ->
+        withAsync (Process.waitForProcess streamProcHandle) $ \streamExitAsync -> do
+          r <- waitEither loadExitAsync streamExitAsync
+          case r of
+            Right (ExitFailure code) -> panic $ "image producer for image " <> name <> " failed with exit code " <> show code <> " from executable " <> imgExe
+            Right ExitSuccess -> pass
+            Left _ -> pass
+          loadExit <- wait loadExitAsync
+          case loadExit of
+            ExitFailure code -> panic $ "docker load failed with exit code " <> show code <> " for image " <> name <> " produced by executable " <> imgExe
+            _ -> pass
+          pass
+
+loadImage Image { imageName = name } = do
+  panic $ "image " <> name <> " doesn't specify an image file or imageExe executable"
+
+
+getDockerImages :: IO [TaggedImage]
+getDockerImages = do
+  let procSpec = Process.proc "docker" [ "images",  "--filter", "dangling=false", "--format", "{{.Repository}}:{{.Tag}}" ]
+  map toS . T.lines . toS <$> Process.readCreateProcess procSpec ""

src/haskell/lib/Arion/Nix.hs

@@ -0,0 +1,183 @@
+{-# LANGUAGE OverloadedStrings #-}
+module Arion.Nix
+  ( evaluateComposition
+  , withEvaluatedComposition
+  , buildComposition
+  , withBuiltComposition
+  , replForComposition
+  , EvaluationArgs(..)
+  , EvaluationMode(..)
+  ) where
+
+import           Prelude                        ( )
+import           Protolude
+import           Arion.Aeson                    ( pretty )
+import           Data.Aeson
+import qualified Data.String
+import qualified System.Directory              as Directory
+import           System.Process
+import qualified Data.ByteString.Lazy          as BL
+import           Paths_arion_compose
+
+import qualified Data.Text.IO                  as T
+
+import qualified Data.List.NonEmpty            as NE
+
+import           Control.Arrow                  ( (>>>) )
+import           System.IO.Temp                 ( withTempFile )
+import           System.IO                      ( hClose )
+
+data EvaluationMode =
+  ReadWrite | ReadOnly
+
+data EvaluationArgs = EvaluationArgs
+ { evalUid :: Int
+ , evalModules :: NonEmpty FilePath
+ , evalPkgs :: Text
+ , evalWorkDir :: Maybe FilePath
+ , evalMode :: EvaluationMode
+ , evalUserArgs :: [Text]
+ }
+
+evaluateComposition :: EvaluationArgs -> IO Value
+evaluateComposition ea = do
+  evalComposition <- getEvalCompositionFile
+  let commandArgs =
+        [ "--eval"
+        , "--strict"
+        , "--json"
+        , "--attr"
+        , "config.out.dockerComposeYamlAttrs"
+        ]
+      args =
+        [ evalComposition ]
+        ++ commandArgs
+        ++ modeArguments (evalMode ea)
+        ++ argArgs ea
+        ++ map toS (evalUserArgs ea)
+      procSpec = (proc "nix-instantiate" args)
+        { cwd = evalWorkDir ea
+        , std_out = CreatePipe
+        }
+  
+  withCreateProcess procSpec $ \_in outHM _err procHandle -> do
+    let outHandle = fromMaybe (panic "stdout missing") outHM
+
+    out <- BL.hGetContents outHandle
+
+    v <- Protolude.evaluate (eitherDecode out)
+
+    exitCode <- waitForProcess procHandle
+
+    case exitCode of
+      ExitSuccess -> pass
+      ExitFailure 1 -> exitFailure
+      ExitFailure {} -> do
+        throwIO $ FatalError $ "evaluation failed with " <> show exitCode
+
+    case v of
+      Right r -> pure r
+      Left  e -> throwIO $ FatalError ("Couldn't parse nix-instantiate output" <> show e)
+
+-- | Run with docker-compose.yaml tmpfile
+withEvaluatedComposition :: EvaluationArgs -> (FilePath -> IO r) -> IO r
+withEvaluatedComposition ea f = do
+  v <- evaluateComposition ea
+  withTempFile "." ".tmp-arion-docker-compose.yaml" $ \path yamlHandle -> do
+    T.hPutStrLn yamlHandle (pretty v)
+    hClose yamlHandle
+    f path
+
+
+buildComposition :: FilePath -> EvaluationArgs -> IO ()
+buildComposition outLink ea = do
+  evalComposition <- getEvalCompositionFile
+  let commandArgs =
+        [ "--attr"
+        , "config.out.dockerComposeYaml"
+        , "--out-link"
+        , outLink
+        ]
+      args =
+        [ evalComposition ]
+        ++ commandArgs
+        ++ argArgs ea
+        ++ map toS (evalUserArgs ea)
+      procSpec = (proc "nix-build" args) { cwd = evalWorkDir ea }
+  
+  withCreateProcess procSpec $ \_in _out _err procHandle -> do
+
+    exitCode <- waitForProcess procHandle
+
+    case exitCode of
+      ExitSuccess -> pass
+      ExitFailure 1 -> exitFailure
+      ExitFailure {} -> do
+        throwIO $ FatalError $ "nix-build failed with " <> show exitCode
+
+-- | Do something with a docker-compose.yaml.
+withBuiltComposition :: EvaluationArgs -> (FilePath -> IO r) -> IO r
+withBuiltComposition ea f = do
+  withTempFile "." ".tmp-arion-docker-compose.yaml" $ \path emptyYamlHandle -> do
+    hClose emptyYamlHandle
+    -- Known problem: kills atomicity of withTempFile; won't fix because we should manage gc roots,
+    -- impl of which will probably avoid this "problem". It seems unlikely to cause issues.
+    Directory.removeFile path
+    buildComposition path ea
+    f path
+
+
+replForComposition :: EvaluationArgs -> IO ()
+replForComposition ea = do
+    evalComposition <- getEvalCompositionFile
+    let args =
+          [ "repl", evalComposition ]
+          ++ argArgs ea
+          ++ map toS (evalUserArgs ea)
+        procSpec = (proc "nix" args) { cwd = evalWorkDir ea }
+    
+    withCreateProcess procSpec $ \_in _out _err procHandle -> do
+
+      exitCode <- waitForProcess procHandle
+
+      case exitCode of
+        ExitSuccess -> pass
+        ExitFailure 1 -> exitFailure
+        ExitFailure {} -> do
+          throwIO $ FatalError $ "nix repl failed with " <> show exitCode
+
+argArgs :: EvaluationArgs -> [[Char]]
+argArgs ea =
+      [ "--argstr"
+      , "uid"
+      , show $ evalUid ea
+      , "--arg"
+      , "modules"
+      , modulesNixExpr $ evalModules ea
+      , "--arg"
+      , "pkgs"
+      , toS $ evalPkgs ea
+      ]
+
+getEvalCompositionFile :: IO FilePath
+getEvalCompositionFile = getDataFileName "nix/eval-composition.nix"
+
+modeArguments :: EvaluationMode -> [[Char]]
+modeArguments ReadWrite = [ "--read-write-mode" ]
+modeArguments ReadOnly = [ "--readonly-mode" ]
+
+modulesNixExpr :: NonEmpty FilePath -> [Char]
+modulesNixExpr =
+  NE.toList >>> fmap pathExpr >>> Data.String.unwords >>> wrapList
+ where
+  pathExpr :: FilePath -> [Char]
+  pathExpr path | isAbsolute path = "(/. + \"/${" <> toNixStringLiteral path <> "}\")"
+                | otherwise       = "(./. + \"/${" <> toNixStringLiteral path <> "}\")"
+
+  isAbsolute ('/' : _) = True
+  isAbsolute _         = False
+
+  wrapList s = "[ " <> s <> " ]"
+
+toNixStringLiteral :: [Char] -> [Char]
+toNixStringLiteral = show -- FIXME: custom escaping including '$'

src/haskell/lib/Arion/Services.hs

@@ -0,0 +1,37 @@
+{-# LANGUAGE DeriveGeneric #-}
+{-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE CPP #-}
+module Arion.Services
+  ( getDefaultExec
+  ) where
+
+import Prelude()
+import Protolude hiding (to)
+
+import qualified Data.Aeson as Aeson
+#if MIN_VERSION_lens_aeson(1,2,0)
+import qualified Data.Aeson.Key as AK
+#endif
+import           Arion.Aeson (decodeFile)
+
+import Control.Lens
+import Data.Aeson.Lens
+
+#if MIN_VERSION_lens_aeson(1,2,0)
+type Key = AK.Key
+mkKey :: Text -> Key
+mkKey = AK.fromText
+#else
+type Key = Text
+mkKey :: Text -> Key
+mkKey = identity
+#endif
+
+-- | Subject to change
+getDefaultExec :: FilePath -> Text -> IO [Text]
+getDefaultExec fp service = do
+
+  v <- decodeFile fp
+
+  pure ((v :: Aeson.Value) ^.. key "x-arion" . key "serviceInfo" . key (mkKey service) . key "defaultExec" . _Array . traverse . _String)

src/haskell/test/Arion/NixSpec.hs

@@ -0,0 +1,74 @@
+{-# LANGUAGE OverloadedStrings #-}
+module Arion.NixSpec
+  ( spec
+  )
+where
+
+import           Protolude
+import           Test.Hspec
+import qualified Data.List.NonEmpty            as NEL
+import           Arion.Aeson
+import           Arion.Nix
+import qualified Data.Text                     as T
+import qualified Data.Text.IO                  as T
+
+spec :: Spec
+spec = describe "evaluateComposition" $ do
+  it "matches an example" $ do
+    x <- Arion.Nix.evaluateComposition EvaluationArgs
+      { evalUid      = 123
+      , evalModules  = NEL.fromList
+                         ["src/haskell/testdata/Arion/NixSpec/arion-compose.nix"]
+      , evalPkgs     = "import <nixpkgs> { system = \"x86_64-linux\"; }"
+      , evalWorkDir  = Nothing
+      , evalMode     = ReadOnly
+      , evalUserArgs = ["--show-trace"]
+      }
+    let actual = pretty x
+    expected <- T.readFile "src/haskell/testdata/Arion/NixSpec/arion-compose.json"
+    censorPaths actual `shouldBe` censorPaths expected
+
+  it "matches an build.context example" $ do
+    x <- Arion.Nix.evaluateComposition EvaluationArgs
+      { evalUid      = 1234
+      , evalModules  = NEL.fromList
+                         ["src/haskell/testdata/Arion/NixSpec/arion-context-compose.nix"]
+      , evalPkgs     = "import <nixpkgs> { system = \"x86_64-linux\"; }"
+      , evalWorkDir  = Nothing
+      , evalMode     = ReadOnly
+      , evalUserArgs = ["--show-trace"]
+      }
+    let actual = pretty x
+    expected <- T.readFile "src/haskell/testdata/Arion/NixSpec/arion-context-compose.json"
+    censorPaths actual `shouldBe` censorPaths expected
+
+censorPaths :: Text -> Text
+censorPaths = censorImages . censorStorePaths
+
+censorStorePaths :: Text -> Text
+censorStorePaths x = case T.breakOn "/nix/store/" x of
+  (prefix, tl) | (tl :: Text) == "" -> prefix
+  (prefix, tl) -> prefix <> "<STOREPATH>" <> censorPaths
+    (T.dropWhile isNixNameChar $ T.drop (T.length "/nix/store/") tl)
+
+-- Probably slow, due to not O(1) <>
+censorImages :: Text -> Text
+censorImages x = case T.break (\c -> c == ':' || c == '"') x of
+  (prefix, tl) | tl == "" -> prefix
+  (prefix, tl) | let imageId = T.take 33 (T.drop 1 tl)
+               , T.last imageId == '\"'
+                 -- Approximation of nix hash validation
+               , T.all (\c -> (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z')) (T.take 32 imageId)
+               -> prefix <> T.take 1 tl <> "<HASH>" <> censorImages (T.drop 33 tl)
+  (prefix, tl) -> prefix <> T.take 1 tl <> censorImages (T.drop 1 tl)
+
+
+-- | WARNING: THIS IS LIKELY WRONG: DON'T REUSE
+isNixNameChar :: Char -> Bool
+isNixNameChar c | c >= '0' && c <= '9' = True
+isNixNameChar c | c >= 'a' && c <= 'z' = True
+isNixNameChar c | c >= 'A' && c <= 'Z' = True
+isNixNameChar c | c == '-' = True
+isNixNameChar c | c == '.' = True
+isNixNameChar c | c == '_' = True -- WRONG?
+isNixNameChar _ = False -- WRONG?

src/haskell/test/Spec.hs

@@ -0,0 +1,12 @@
+module Spec
+  ( spec
+  )
+where
+
+import           Test.Hspec
+import qualified Arion.NixSpec
+
+spec :: Spec
+spec = do
+  describe "Arion.Nix" Arion.NixSpec.spec
+

src/haskell/test/TestMain.hs

@@ -0,0 +1,10 @@
+module Main where
+
+import           Prelude()
+import           Protolude
+import           Test.Hspec.Runner
+import qualified Spec
+
+main :: IO ()
+main = hspecWith config Spec.spec
+  where config = defaultConfig { configColorMode = ColorAlways }

src/haskell/testdata/Arion/NixSpec/arion-compose.json

@@ -0,0 +1,57 @@
+{
+    "networks": {
+        "default": {
+            "name": "unit-test-data"
+        }
+    },
+    "services": {
+        "webserver": {
+            "command": [
+                "/usr/sbin/init"
+            ],
+            "environment": {
+                "NIX_REMOTE": "",
+                "PATH": "/usr/bin:/run/current-system/sw/bin/",
+                "container": "docker"
+            },
+            "image": "localhost/webserver:<HASH>",
+            "ports": [
+                "8000:80"
+            ],
+            "stop_signal": "SIGRTMIN+3",
+            "sysctls": {},
+            "tmpfs": [
+                "/run",
+                "/run/wrappers",
+                "/tmp:exec,mode=777"
+            ],
+            "tty": true,
+            "volumes": [
+                "/sys/fs/cgroup:/sys/fs/cgroup:ro",
+                "/nix/store:/nix/store:ro"
+            ]
+        }
+    },
+    "version": "3.4",
+    "volumes": {},
+    "x-arion": {
+        "images": [
+            {
+                "imageExe": "<STOREPATH>",
+                "imageName": "localhost/webserver",
+                "imageTag": "<HASH>"
+            }
+        ],
+        "project": {
+            "name": "unit-test-data"
+        },
+        "serviceInfo": {
+            "webserver": {
+                "defaultExec": [
+                    "/run/current-system/sw/bin/bash",
+                    "-l"
+                ]
+            }
+        }
+    }
+}

src/haskell/testdata/Arion/NixSpec/arion-compose.nix

@@ -0,0 +1,13 @@
+{
+  project.name = "unit-test-data";
+  services.webserver = { pkgs, ... }: {
+    nixos.useSystemd = true;
+    nixos.configuration.boot.tmp.useTmpfs = true;
+    nixos.configuration.services.nginx.enable = true;
+    nixos.configuration.services.nginx.virtualHosts.localhost.root = "${pkgs.nix.doc}/share/doc/nix/manual";
+    service.useHostStore = true;
+    service.ports = [
+      "8000:80" # host:container
+    ];
+  };
+}

src/haskell/testdata/Arion/NixSpec/arion-context-compose.json

@@ -0,0 +1,41 @@
+{
+    "networks": {
+        "default": {
+            "name": "unit-test-data"
+        }
+    },
+    "services": {
+        "webserver": {
+            "build": {
+                "context": "<STOREPATH>"
+            },
+            "environment": {},
+            "ports": [
+                "8080:80"
+            ],
+            "sysctls": {},
+            "volumes": []
+        }
+    },
+    "version": "3.4",
+    "volumes": {},
+    "x-arion": {
+        "images": [
+            {
+                "imageExe": "<STOREPATH>",
+                "imageName": "localhost/webserver",
+                "imageTag": "<HASH>"
+            }
+        ],
+        "project": {
+            "name": "unit-test-data"
+        },
+        "serviceInfo": {
+            "webserver": {
+                "defaultExec": [
+                    "/bin/sh"
+                ]
+            }
+        }
+    }
+}

src/haskell/testdata/Arion/NixSpec/arion-context-compose.nix

@@ -0,0 +1,9 @@
+{
+  project.name = "unit-test-data";
+  services.webserver.service = {
+    build.context = "${./build-context}";
+    ports = [
+      "8080:80"
+    ];
+  };
+}

src/haskell/testdata/Arion/NixSpec/build-context/Dockerfile

@@ -0,0 +1,4 @@
+FROM nginx
+
+RUN echo this is a dockerfile to be built
+

src/haskell/testdata/docker-compose-example.json

@@ -0,0 +1,45 @@
+{
+  "services": {
+    "webserver": {
+      "environment": {
+        "container": "docker"
+      },
+      "image": "webserver:xr4ljmz3qfcwlq9rl4mr4qdrzw93rl70",
+      "ports": [
+        "8000:80"
+      ],
+      "stop_signal": "SIGRTMIN+3",
+      "sysctls": {},
+      "tmpfs": [
+        "/run",
+        "/run/wrappers",
+        "/tmp:exec,mode=777"
+      ],
+      "tty": true,
+      "volumes": [
+        "/sys/fs/cgroup:/sys/fs/cgroup:ro"
+      ]
+    }
+  },
+  "version": "3.4",
+  "x-arion": {
+    "images": [
+      {
+        "image": "/nix/store/xr4ljmz3qfcwlq9rl4mr4qdrzw93rl70-docker-image-webserver.tar.gz",
+        "imageName": "webserver",
+        "imageTag": "xr4ljmz3qfcwlq9rl4mr4qdrzw93rl70"
+      }
+    ],
+    "project": {
+      "name": null
+    },
+    "serviceInfo": {
+      "webserver": {
+        "defaultExec": [
+          "/run/current-system/sw/bin/bash",
+          "-l"
+        ]
+      }
+    }
+  }
+}

src/nix/docker-compose-module.nix

@@ -1,64 +0,0 @@
-/*
-
-   This is a composition-level module.
-
-   It defines the low-level options that are read by arion, like
-    - build.dockerComposeYaml
-
-   It declares options like
-    - docker-compose.services
-
- */
-{ pkgs, uid, lib, config, ... }:
-
-let
-  evalService = name: modules:
-    let
-      composite = lib.evalModules {
-        check = true;
-        modules = builtinModules ++ modules;
-      };
-
-      builtinModules = [
-        argsModule
-        ./service.nix
-        ./service-host-store.nix
-      ];
-
-      argsModule = {
-        _file = ./docker-compose-module.nix;
-        key = ./docker-compose-module.nix;
-        config._module.args.pkgs = lib.mkForce pkgs;
-        config._module.args.uid = uid;
-      };
-
-    in
-      composite.config.build.service;
-
-in
-{
-  options = {
-    build.dockerComposeYaml = lib.mkOption {
-      type = lib.types.package;
-    };
-    build.dockerComposeYamlText = lib.mkOption {
-      type = lib.types.string;
-    };
-    docker-compose.raw = lib.mkOption {
-      type = lib.types.attrs;
-    };
-    docker-compose.services = lib.mkOption {
-      default = {};
-      type = with lib.types; attrsOf (coercedTo unspecified (a: [a]) (listOf unspecified));
-    };
-  };
-  config = {
-    build.dockerComposeYaml = pkgs.writeText "docker-compose.yaml" config.build.dockerComposeYamlText;
-    build.dockerComposeYamlText = builtins.toJSON (config.docker-compose.raw);
-
-    docker-compose.raw = {
-      version = "3";
-      services = lib.mapAttrs evalService config.docker-compose.services;
-    };
-  };
-}

src/nix/eval-composition.nix

@@ -1,4 +1,4 @@
-{ modules ? [], uid ? 0, pkgs }:
+{ modules ? [], uid ? "0", pkgs, hostNixStorePrefix ? "", }:
 
 let _pkgs = pkgs;
 in
@@ -12,22 +12,26 @@ let
   inherit (pkgs) lib;
 
   composition = lib.evalModules {
-    check = true;
     modules = builtinModules ++ modules;
   };
 
   builtinModules = [
     argsModule
-    ./docker-compose-module.nix
-  ];
+  ] ++ import ./modules.nix;
 
   argsModule = {
     _file = ./eval-composition.nix;
     key = ./eval-composition.nix;
     config._module.args.pkgs = lib.mkIf (pkgs != null) (lib.mkForce pkgs);
-    config._module.args.uid = uid;
+    config._module.args.check = true;
+    config.host.nixStorePrefix = hostNixStorePrefix;
+    config.host.uid = lib.toInt uid;
   };
 
 in
-  # Typically you need composition.config.build.dockerComposeYaml
-  composition
+  # Typically you need composition.config.out.dockerComposeYaml
+  composition // {
+    # throw in lib and pkgs for repl convenience
+    inherit lib;
+    inherit (composition._module.args) pkgs;
+  }

src/nix/lib.nix

@@ -0,0 +1,21 @@
+{ lib }:
+let
+
+  link = url: text: ''[${text}](${url})'';
+
+  composeSpecRev = "55b450aee50799a2f33cc99e1d714518babe305e";
+
+  serviceRef = fragment:
+    ''See ${link "https://github.com/compose-spec/compose-spec/blob/${composeSpecRev}/05-services.md#${fragment}" "Compose Spec Services #${fragment}"}'';
+
+  networkRef = fragment:
+    ''See ${link "https://github.com/compose-spec/compose-spec/blob/${composeSpecRev}/06-networks.md#${fragment}" "Compose Spec Networks #${fragment}"}'';
+
+in
+{
+  inherit
+    link
+    networkRef
+    serviceRef
+    ;
+}

src/nix/modules.nix

@@ -0,0 +1,8 @@
+[
+    ./modules/composition/docker-compose.nix
+    ./modules/composition/host-environment.nix
+    ./modules/composition/images.nix
+    ./modules/composition/networks.nix
+    ./modules/composition/service-info.nix
+    ./modules/composition/composition.nix
+]

src/nix/modules/composition/composition.nix

@@ -0,0 +1,28 @@
+{ config, lib, ... }:
+let
+  inherit (lib) types mkOption;
+
+  link = url: text:
+    ''[${text}](${url})'';
+
+in
+{
+  options = {
+    _module.args = mkOption {
+      internal = true;
+    };
+    project.name = mkOption {
+      description = ''
+        Name of the project.
+
+        See ${link "https://docs.docker.com/compose/reference/envvars/#compose_project_name" "COMPOSE_PROJECT_NAME"}
+
+        This is not optional, because getting the project name from a directory name tends to produce different results for different repo checkout location names.
+      '';
+      type = types.str;
+    };
+  };
+  config = {
+    docker-compose.extended.project.name = config.project.name;
+  };
+}

src/nix/modules/composition/docker-compose.nix

@@ -0,0 +1,84 @@
+/*
+
+   This is a composition-level module.
+
+   It defines the low-level options that are read by arion, like
+    - out.dockerComposeYaml
+
+   It declares options like
+    - services
+
+ */
+compositionArgs@{ lib, config, options, pkgs, ... }:
+let
+  inherit (lib) types;
+
+  service = {
+    imports = [ argsModule ] ++ import ../service/all-modules.nix;
+  };
+  argsModule =
+    { name, # injected by types.submodule
+      ...
+    }: {
+      _file = ./docker-compose.nix;
+      key = ./docker-compose.nix;
+
+      config._module.args.pkgs = lib.mkDefault compositionArgs.pkgs;
+      config.host = compositionArgs.config.host;
+      config.composition = compositionArgs.config;
+      config.service.name = name;
+    };
+
+in
+{
+  imports = [
+    ../lib/assert.nix
+    (lib.mkRenamedOptionModule ["docker-compose" "services"] ["services"])
+  ];
+  options = {
+    out.dockerComposeYaml = lib.mkOption {
+      type = lib.types.package;
+      description = "A derivation that produces a docker-compose.yaml file for this composition.";
+      readOnly = true;
+    };
+    out.dockerComposeYamlText = lib.mkOption {
+      type = lib.types.str;
+      description = "The text of out.dockerComposeYaml.";
+      readOnly = true;
+    };
+    out.dockerComposeYamlAttrs = lib.mkOption {
+      type = lib.types.attrsOf lib.types.unspecified;
+      description = "The text of out.dockerComposeYaml.";
+      readOnly = true;
+    };
+    docker-compose.raw = lib.mkOption {
+      type = lib.types.attrs;
+      description = "Attribute set that will be turned into the docker-compose.yaml file, using Nix's toJSON builtin.";
+    };
+    docker-compose.extended = lib.mkOption {
+      type = lib.types.attrs;
+      description = "Attribute set that will be turned into the x-arion section of the docker-compose.yaml file.";
+    };
+    services = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule service);
+      description = "An attribute set of service configurations. A service specifies how to run an image as a container.";
+    };
+    docker-compose.volumes = lib.mkOption {
+      type = lib.types.attrsOf lib.types.unspecified;
+      description = "A attribute set of volume configurations.";
+      default = {};
+    };
+  };
+  config = {
+    out.dockerComposeYaml = pkgs.writeText "docker-compose.yaml" config.out.dockerComposeYamlText;
+    out.dockerComposeYamlText = builtins.toJSON (config.out.dockerComposeYamlAttrs);
+    out.dockerComposeYamlAttrs = config.assertWarn config.docker-compose.raw;
+
+    docker-compose.raw = {
+      version = "3.4";
+      services = lib.mapAttrs (k: c: c.out.service) config.services;
+      x-arion = config.docker-compose.extended;
+      volumes = config.docker-compose.volumes;
+    };
+  };
+}

src/nix/modules/composition/host-environment.nix

@@ -0,0 +1,33 @@
+{ lib, ... }:
+
+{
+  options = {
+
+    host.uid = lib.mkOption {
+      type = lib.types.int;
+      description = ''
+        The numeric user id (UID) of the user running arion.
+
+        This lets you to write modules that interact with the host
+        user's files, which is helpful for local development, but not
+        intended for production-like deployment scenarios.
+      '';
+    };
+
+    host.nixStorePrefix = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      example = "/mnt/foo";
+      description = ''
+        Prefixes store paths on the host, allowing the Nix store to be
+        stored at an alternate location without altering the format of
+        store paths.
+
+        For example: instead of mounting the host's `/nix/store` as the
+        container's `/nix/store`, this will mount `/mnt/foo/nix/store`
+        as the container's `/nix/store`.
+      '';
+    };
+
+  };
+}

src/nix/modules/composition/images.nix

@@ -0,0 +1,46 @@
+{ pkgs, lib, config, ... }:
+let
+  inherit (lib.types) listOf package unspecified;
+
+  serviceImages =
+    lib.mapAttrs addDetails (
+      lib.filterAttrs filterFunction config.services
+    );
+
+  filterFunction = serviceName: service:
+    builtins.addErrorContext "while evaluating whether the service ${serviceName} defines an image"
+      service.image.nixBuild;
+
+  addDetails = serviceName: service:
+    builtins.addErrorContext "while evaluating the image for service ${serviceName}"
+    (let
+      inherit (service) build;
+    in {
+      imageName = build.imageName or service.image.name;
+      imageTag =
+                 if build.image.imageTag != ""
+                 then build.image.imageTag
+                 else lib.head (lib.strings.splitString "-" (baseNameOf build.image.outPath));
+    } // (if build.image.isExe or false
+        then {
+          imageExe = build.image.outPath;
+        }
+        else {
+          image = build.image.outPath;
+        }
+      )
+    );
+in
+{
+  options = {
+    build.imagesToLoad = lib.mkOption {
+      type = listOf unspecified;
+      internal = true;
+      description = "List of `dockerTools` image derivations.";
+    };
+  };
+  config = {
+    build.imagesToLoad = lib.attrValues serviceImages;
+    docker-compose.extended.images = config.build.imagesToLoad;
+  };
+}

src/nix/modules/composition/networks.nix

@@ -0,0 +1,53 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib)
+    mkOption
+    optionalAttrs
+    types
+    ;
+  inherit (import ../../lib.nix { inherit lib; })
+    link
+    ;
+in
+{
+  options = {
+    networks = mkOption {
+      type = types.lazyAttrsOf (types.submoduleWith {
+        modules = [
+          ../networks/network.nix
+        ];
+      });
+      description = ''
+        See ${link "https://docs.docker.com/compose/compose-file/06-networks/" "Docker Compose Networks"}
+      '';
+    };
+    enableDefaultNetwork = mkOption {
+      type = types.bool;
+      description = ''
+        Whether to define the default network:
+
+        ```nix
+        networks.default = {
+          name = config.project.name;
+        };
+        ```
+      '';
+      default = true;
+    };
+  };
+
+
+  config = {
+
+    networks = optionalAttrs config.enableDefaultNetwork {
+      default = {
+        name = config.project.name;
+      };
+    };
+
+    docker-compose.raw.networks =
+      lib.mapAttrs (k: v: v.out) config.networks;
+
+  };
+}

src/nix/modules/composition/service-info.nix

@@ -0,0 +1,21 @@
+/*
+   Adds extendedInfo from services to the Docker Compose file.
+
+   This contains fields that are not in Docker Compose schema.
+ */
+{ config, lib, ... }:
+let
+  inherit (lib) mapAttrs filterAttrs;
+
+  serviceInfo =
+    filterAttrs (_k: v: v != {})
+      (mapAttrs (_serviceName: service: service.out.extendedInfo)
+        config.services
+      );
+
+in
+{
+  config = {
+    docker-compose.extended.serviceInfo = serviceInfo;
+  };
+}

src/nix/modules/lib/README.md

@@ -0,0 +1,2 @@
+`assertions.nix`: Nixpkgs
+`assert.nix`: extracted from Nixpkgs, adapted

src/nix/modules/lib/assert.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+# based on nixpkgs/nixos/modules/system/activation/top-level.nix
+
+let
+  inherit (lib)
+    concatStringsSep
+    filter
+    mkOption
+    showWarnings
+    types
+    ;
+
+  # Handle assertions and warnings
+  failedAssertions = map (x: x.message) (filter (x: !x.assertion) config.assertions);
+
+  assertWarn = if failedAssertions != []
+    then throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
+    else showWarnings config.warnings;
+
+in
+
+{
+  imports = [ ./assertions.nix ];
+  options.assertWarn = mkOption {
+    type = types.unspecified; # a function
+    # It's for the wrapping program to know about this. User need not care.
+    internal = true;
+    readOnly = true;
+  };
+  config = { inherit assertWarn; };
+}
+

src/nix/modules/lib/assertions.nix

@@ -0,0 +1,34 @@
+{ lib, ... }:
+
+with lib;
+
+{
+
+  options = {
+
+    assertions = mkOption {
+      type = types.listOf types.unspecified;
+      internal = true;
+      default = [];
+      example = [ { assertion = false; message = "you can't enable this for that reason"; } ];
+      description = ''
+        This option allows modules to express conditions that must
+        hold for the evaluation of the system configuration to
+        succeed, along with associated error messages for the user.
+      '';
+    };
+
+    warnings = mkOption {
+      internal = true;
+      default = [];
+      type = types.listOf types.str;
+      example = [ "The `foo' service is deprecated and will go away soon!" ];
+      description = ''
+        This option allows modules to show warnings to users during
+        the evaluation of the system configuration.
+      '';
+    };
+
+  };
+  # impl of assertions is in <nixpkgs/nixos/modules/system/activation/top-level.nix>
+}

src/nix/modules/networks/network.nix

@@ -0,0 +1,131 @@
+{ config, lib, options, ... }:
+
+let
+  inherit (lib)
+    mkOption
+    optionalAttrs
+    types
+    ;
+  inherit (import ../../lib.nix { inherit lib; })
+    networkRef
+    ;
+in
+{
+  options = {
+    driver = mkOption {
+      description = ''
+        `"none"`, `"host"`, or a platform-specific value.
+        ${networkRef "driver"}
+      '';
+      type = types.str;
+    };
+
+    driver_opts = mkOption {
+      description = ''
+        ${networkRef "driver_opts"}
+      '';
+      type = types.lazyAttrsOf types.raw or types.unspecified;
+    };
+
+    attachable = mkOption {
+      description = ''
+        ${networkRef "attachable"}
+      '';
+      type = types.bool;
+      example = true;
+    };
+
+    enable_ipv6 = mkOption {
+      description = ''
+        Whether we've entered the 21st century yet.
+        
+        ${networkRef "enable_ipv6"}
+      '';
+      type = types.bool;
+    };
+
+    ipam = mkOption {
+      # TODO model sub-options
+      description = ''
+        Manage IP addresses.
+
+        ${networkRef "ipam"}
+      '';
+      type = types.raw or types.unspecified;
+    };
+
+    internal = mkOption {
+      description = ''
+        Achieves "external isolation".
+
+        ${networkRef "internal"}
+      '';
+      defaultText = false;
+      type = types.bool;
+    };
+
+    labels = mkOption {
+      description = ''
+        Metadata.
+
+        ${networkRef "labels"}
+      '';
+      # no list support, because less expressive wrt overriding
+      type = types.attrsOf types.str;
+    };
+
+    external = mkOption {
+      description = ''
+        When `true`, don't create or destroy the network, but assume that it
+        exists.
+
+        ${networkRef "external"}
+      '';
+      type = types.bool;
+    };
+
+    name = mkOption {
+      description = ''
+        Set a custom name for the network.
+
+        It shares a namespace with other projects' networks. `name` is used as-is.
+
+        Note the `default` network's default `name` is set to `project.name` by Arion.
+
+        ${networkRef "name"}
+      '';
+      type = types.str;
+    };
+
+    out = mkOption {
+      internal = true;
+      description = ''
+        This network's contribution to the docker compose yaml file
+        under the `networks.''${name}` key.
+      '';
+      type = lib.types.attrsOf lib.types.raw or lib.types.unspecified;
+    };
+  };
+
+  config = {
+    out =
+      lib.mapAttrs
+        (k: opt: opt.value)
+        (lib.filterAttrs
+          (k: opt: opt.isDefined)
+          {
+            inherit (options)
+              driver
+              driver_opts
+              attachable
+              enable_ipv6
+              ipam
+              internal
+              labels
+              external
+              name
+              ;
+          }
+        );
+  };
+}

src/nix/modules/nixos/container-systemd.nix

@@ -0,0 +1,24 @@
+/*
+  NixOS configuration to for running a mostly normal systemd-based
+  NixOS in Docker.
+ */
+{ pkgs, lib, ...}: {
+
+  # imports = [
+  #   # This profile doesn't seem to work well.
+  #   (pkgs.path + "/nixos/modules/profiles/docker-container.nix")
+  #   This one works, but can not be imported here due because imports can not depend on pkgs.
+  #   (pkgs.path + "/nixos/modules/profiles/minimal.nix")
+  # ];
+  boot.isContainer = true;
+  boot.specialFileSystems = lib.mkForce {};
+  networking.hostName = "";
+
+  services.journald.console = "/dev/console";
+
+  systemd.services.systemd-logind.enable = false;
+  systemd.services.console-getty.enable = false;
+
+  systemd.sockets.nix-daemon.enable = lib.mkDefault false;
+  systemd.services.nix-daemon.enable = lib.mkDefault false;
+}

src/nix/modules/nixos/default-shell.nix

@@ -0,0 +1,4 @@
+{ config, utils, ... }:
+{
+  config.system.build.x-arion-defaultShell = utils.toShellPath config.users.defaultUserShell;
+}

src/nix/modules/service/all-modules.nix

@@ -0,0 +1,13 @@
+[
+  ./default-exec.nix
+  ./docker-compose-service.nix
+  ./extended-info.nix
+  ./host-store.nix
+  ./context.nix
+  ./image.nix
+  ./image-recommended.nix
+  ./nixos.nix
+  ./nixos-init.nix
+  ../lib/assert.nix
+  ./check-sys_admin.nix
+]

src/nix/modules/service/check-sys_admin.nix

@@ -0,0 +1,30 @@
+{ config, lib, name, ... }:
+let
+  inherit (lib)
+    concatStringsSep
+    optional
+    ;
+
+  dynamicUserServices = lib.attrNames (
+    lib.filterAttrs
+      (k: v:
+        v.enable &&
+        v.serviceConfig.DynamicUser or false)
+      config.nixos.evaluatedConfig.systemd.services
+    );
+
+  
+in
+{
+  config = {
+    warnings = 
+      optional (config.nixos.useSystemd && !(config.service.capabilities.SYS_ADMIN or false) && dynamicUserServices != []) (
+        ''In service ${name}, the following units require `SYS_ADMIN` capability
+          because of DynamicUser.
+          ${concatStringsSep "\n" (map (srv: "    - services.${name}.nixos.configuration.systemd.services.${srv}") dynamicUserServices)}
+          You can avoid DynamicUser or use
+              services.${name}.service.capabilities.SYS_ADMIN = true;
+        ''
+      );
+  };
+}

src/nix/modules/service/context.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+{
+  options = {
+    host = lib.mkOption {
+      type = lib.types.attrs;
+      readOnly = true;
+      description = ''
+        The composition-level host option values.
+      '';
+    };
+    composition = lib.mkOption {
+      type = lib.types.attrs;
+      readOnly = true;
+      description = ''
+        The composition configuration.
+      '';
+    };
+  };
+}

src/nix/modules/service/default-exec.nix

@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+let
+  inherit (lib) types mkOption;
+in
+{
+  options = {
+    service.defaultExec = mkOption {
+      type = types.listOf types.str;
+      default = ["/bin/sh"];
+      description = ''
+        Container program and arguments to invoke when calling
+        `arion exec <service.name>` without further arguments.
+      '';
+    };
+  };
+  config = {
+    out.extendedInfo.defaultExec = config.service.defaultExec;
+  };
+}

src/nix/modules/service/docker-compose-service.nix

@@ -0,0 +1,422 @@
+/*
+
+   This service-level module defines the out.service option, using
+   the user-facing options service.image, service.volumes, etc.
+
+ */
+{ pkgs, lib, config, options, ... }:
+
+let
+  inherit (lib) mkOption types;
+  inherit (types) listOf nullOr attrsOf str either int bool submodule enum;
+
+  inherit (import ../../lib.nix { inherit lib; })
+    link
+    serviceRef
+    ;
+
+  cap_add = lib.attrNames (lib.filterAttrs (name: value: value == true) config.service.capabilities);
+  cap_drop = lib.attrNames (lib.filterAttrs (name: value: value == false) config.service.capabilities);
+
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule ["build" "service"] ["out" "service"])
+  ];
+
+  options = {
+    out.service = mkOption {
+      type = attrsOf types.unspecified;
+      description = ''
+        Raw input for the service in `docker-compose.yaml`.
+
+        You should not need to use this option. If anything is
+        missing, please contribute the missing option.
+
+        This option is user accessible because it may serve as an
+        escape hatch for some.
+      '';
+      apply = config.assertWarn;
+    };
+
+    service.name = mkOption {
+      type = str;
+      description = ''
+        The name of the service - `<name>` in the composition-level `services.<name>`
+      '';
+      readOnly = true;
+    };
+
+    service.volumes = mkOption {
+      type = listOf types.unspecified;
+      default = [];
+      description = serviceRef "volumes";
+    };
+    service.tmpfs = mkOption {
+      type = listOf types.str;
+      default = [];
+      description = serviceRef "tmpfs";
+    };
+    service.build.context = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        Locates a Dockerfile to use for creating an image to use in this service.
+
+        https://docs.docker.com/compose/compose-file/build/#context
+      '';
+    };
+    service.build.dockerfile = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        Sets an alternate Dockerfile. A relative path is resolved from the build context.
+        https://docs.docker.com/compose/compose-file/build/#dockerfile
+      '';
+    };
+    service.build.target = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        Defines the stage to build as defined inside a multi-stage Dockerfile.
+        https://docs.docker.com/compose/compose-file/build/#target
+      '';
+    };
+    service.hostname = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        ${serviceRef "hostname"}
+      '';
+    };
+    service.tty = mkOption {
+      type = nullOr bool;
+      default = null;
+      description = ''
+        ${serviceRef "tty"}
+      '';
+    };
+    service.environment = mkOption {
+      type = attrsOf (either str int);
+      default = {};
+      description = serviceRef "environment";
+    };
+    service.image = mkOption {
+      type = nullOr str;
+      default = null;
+      description = serviceRef "image";
+    };
+    service.command = mkOption {
+      type = nullOr types.unspecified;
+      default = null;
+      description = serviceRef "command";
+    };
+    service.container_name = mkOption {
+      type = nullOr types.str;
+      default = null;
+      description = serviceRef "container_name";
+    };
+    service.depends_on =
+      let conditionsModule = {
+            options = {
+              condition = mkOption {
+                type = enum ["service_started" "service_healthy" "service_completed_successfully"];
+                description = serviceRef "depends_on";
+                default = "service_started";
+              };
+            };
+          };
+       in mkOption {
+         type = either (listOf str) (attrsOf (submodule conditionsModule));
+         default = [];
+         description = serviceRef "depends_on";
+       };
+    service.healthcheck = mkOption {
+      description = serviceRef "healthcheck";
+      type = submodule ({ config, options, ...}: {
+        options = {
+          _out = mkOption {
+            internal = true;
+            default = lib.optionalAttrs (options.test.highestPrio < 1500) {
+              inherit (config) test interval timeout start_period retries;
+            };
+          };
+          test = mkOption {
+            type = nullOr (listOf str);
+            default = null;
+            example = [ "CMD" "pg_isready" ];
+            description = serviceRef "healthcheck";
+          };
+          interval = mkOption {
+            type = str;
+            default = "30s";
+            example = "1m";
+            description = serviceRef "healthcheck";
+          };
+          timeout = mkOption {
+            type = str;
+            default = "30s";
+            example = "10s";
+            description = serviceRef "healthcheck";
+          };
+          start_period = mkOption {
+            type = str;
+            default = "0s";
+            example = "30s";
+            description = serviceRef "healthcheck";
+          };
+          retries = mkOption {
+            type = int;
+            default = 3;
+            description = serviceRef "healthcheck";
+          };
+        };
+      });
+    };
+    service.devices = mkOption {
+      type = listOf str;
+      default = [];
+      description = ''
+        See ${link "https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities"
+        "`docker run --device` documentation"}
+
+        ${serviceRef "devices"}
+      '';
+    };
+    service.dns = mkOption {
+      type = listOf str;
+      default = [];
+      example = [ "8.8.8.8" "8.8.4.4" ];
+      description = serviceRef "dns";
+    };
+    service.labels = mkOption {
+      type = attrsOf str;
+      default = {};
+      example = {
+        "com.example.foo" = "bar";
+        "traefik.enable" = "true";
+        "traefik.http.routers.my-service.rule" = "Host(`my-service.localhost`)";
+        "traefik.http.routers.my-service.entrypoints" = "web";
+      };
+      description = serviceRef "labels";
+    };
+    service.links = mkOption {
+      type = listOf str;
+      default = [];
+      description = serviceRef "links";
+    };
+    service.external_links = mkOption {
+      type = listOf str;
+      default = [];
+      description = serviceRef "external_links";
+    };
+    service.profiles = mkOption {
+      type = listOf str;
+      default = [];
+      description = serviceRef "profiles";
+    };
+    service.extra_hosts = mkOption {
+      type = listOf str;
+      default = [];
+      description = serviceRef "extra_hosts";
+    };
+    service.working_dir = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        ${serviceRef "working_dir"}
+      '';
+    };
+    service.privileged = mkOption {
+      type = nullOr bool;
+      default = null;
+      description = ''
+        ${serviceRef "privileged"}
+      '';
+    };
+    service.entrypoint = mkOption {
+      type = nullOr str;
+      default = null;
+      description = serviceRef "entrypoint";
+    };
+    service.restart = mkOption {
+      type = nullOr str;
+      default = null;
+      description = serviceRef "restart";
+    };
+    service.user = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        ${serviceRef "user"}
+      '';
+    };
+    service.ports = mkOption {
+      type = listOf types.unspecified;
+      default = [];
+      description = ''
+        Expose ports on host. "host:container" or structured.
+
+        ${serviceRef "ports"}
+      '';
+    };
+    service.expose = mkOption {
+      type = listOf str;
+      default = [];
+      description = serviceRef "expose";
+    };
+    service.env_file = mkOption {
+      type = listOf str;
+      default = [];
+      description = serviceRef "env_file";
+    };
+    service.network_mode = mkOption {
+      type = nullOr str;
+      default = null;
+      description = serviceRef "network_mode";
+    };
+    service.networks =
+      let
+        networksModule = submodule ({ config, options, ...}: {
+          options = {
+            _out = mkOption {
+              internal = true;
+              readOnly = true;
+              default = lib.mapAttrs (k: opt: opt.value) (lib.filterAttrs (_: opt: opt.isDefined) { inherit (options) aliases ipv4_address ipv6_address link_local_ips priority; });
+            };
+            aliases = mkOption {
+              type = listOf str;
+              description = serviceRef "aliases";
+              default = [ ];
+            };
+            ipv4_address = mkOption {
+              type = str;
+              description = serviceRef "ipv4_address-ipv6_address";
+            };
+            ipv6_address = mkOption {
+              type = str;
+              description = serviceRef "ipv4_address-ipv6_address";
+            };
+            link_local_ips = mkOption {
+              type = listOf str;
+              description = serviceRef "link_local_ips";
+            };
+            priority = mkOption {
+              type = int;
+              description = serviceRef "priority";
+            };
+          };
+        });
+      in
+      mkOption {
+        type = either (listOf str) (attrsOf networksModule);
+        default = [];
+        description = serviceRef "networks";
+      };
+    service.stop_signal = mkOption {
+      type = nullOr str;
+      default = null;
+      description = serviceRef "stop_signal";
+    };
+    service.stop_grace_period = mkOption {
+      type = nullOr str;
+      default = null;
+      description = serviceRef "stop_grace_period";
+    };
+    service.sysctls = mkOption {
+      type = attrsOf (either str int);
+      default = {};
+      description = serviceRef "sysctls";
+    };
+    service.capabilities = mkOption {
+      type = attrsOf (nullOr bool);
+      default = {};
+      example = { ALL = true; SYS_ADMIN = false; NET_ADMIN = false; };
+      description = ''
+        Enable/disable linux capabilities, or pick Docker's default.
+
+        Setting a capability to `true` means that it will be
+        "added". Setting it to `false` means that it will be "dropped".
+
+        Omitted and `null` capabilities will therefore be set
+        according to Docker's ${
+          link "https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities"
+               "default list of capabilities."
+        }
+
+        ${serviceRef "cap_add"}
+        ${serviceRef "cap_drop"}
+      '';
+    };
+  };
+
+  config.out.service = {
+    inherit (config.service)
+      volumes
+      environment
+      sysctls
+      ;
+  } // lib.optionalAttrs (config.service.image != null) {
+    inherit (config.service) image;
+  } // lib.optionalAttrs (config.service.build.context != null ) {
+    build = lib.filterAttrs (n: v: v != null)  config.service.build;
+  } // lib.optionalAttrs (cap_add != []) {
+    inherit cap_add;
+  } // lib.optionalAttrs (cap_drop != []) {
+    inherit cap_drop;
+  } // lib.optionalAttrs (config.service.command != null) {
+    inherit (config.service) command;
+  } // lib.optionalAttrs (config.service.container_name != null) {
+    inherit (config.service) container_name;
+  } // lib.optionalAttrs (config.service.depends_on != []) {
+    inherit (config.service) depends_on;
+  } // lib.optionalAttrs (options.service.healthcheck.highestPrio < 1500) {
+    healthcheck = config.service.healthcheck._out;
+  } // lib.optionalAttrs (config.service.devices != []) {
+    inherit (config.service) devices;
+  } // lib.optionalAttrs (config.service.entrypoint != null) {
+    inherit (config.service) entrypoint;
+  } // lib.optionalAttrs (config.service.env_file != []) {
+    inherit (config.service) env_file;
+  } // lib.optionalAttrs (config.service.expose != []) {
+    inherit (config.service) expose;
+  } // lib.optionalAttrs (config.service.external_links != []) {
+    inherit (config.service) external_links;
+  } // lib.optionalAttrs (config.service.extra_hosts != []) {
+    inherit (config.service) extra_hosts;
+  } // lib.optionalAttrs (config.service.hostname != null) {
+    inherit (config.service) hostname;
+  } // lib.optionalAttrs (config.service.dns != []) {
+    inherit (config.service) dns;
+  } // lib.optionalAttrs (config.service.labels != {}) {
+    inherit (config.service) labels;
+  } // lib.optionalAttrs (config.service.links != []) {
+    inherit (config.service) links;
+  } // lib.optionalAttrs (config.service.ports != []) {
+    inherit (config.service) ports;
+  } // lib.optionalAttrs (config.service.privileged != null) {
+    inherit (config.service) privileged;
+  } // lib.optionalAttrs (config.service.network_mode != null) {
+    inherit (config.service) network_mode;
+  } // lib.optionalAttrs (config.service.networks != [] && config.service.networks != {}) {
+    networks =
+      if (builtins.isAttrs config.service.networks) then builtins.mapAttrs (_: v: v._out) config.service.networks
+      else config.service.networks;
+  } // lib.optionalAttrs (config.service.restart != null) {
+    inherit (config.service) restart;
+  } // lib.optionalAttrs (config.service.stop_signal != null) {
+    inherit (config.service) stop_signal;
+  } // lib.optionalAttrs (config.service.stop_grace_period != null) {
+    inherit (config.service) stop_grace_period;
+  } // lib.optionalAttrs (config.service.tmpfs != []) {
+    inherit (config.service) tmpfs;
+  } // lib.optionalAttrs (config.service.tty != null) {
+    inherit (config.service) tty;
+  } // lib.optionalAttrs (config.service.working_dir != null) {
+    inherit (config.service) working_dir;
+  } // lib.optionalAttrs (config.service.user != null) {
+    inherit (config.service) user;
+  } // lib.optionalAttrs (config.service.profiles != []) {
+    inherit (config.service) profiles;
+  };
+}

src/nix/modules/service/extended-info.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+let
+  inherit (lib) mkOption;
+  inherit (lib.types) attrsOf unspecified;
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule ["build" "extendedInfo"] ["out" "extendedInfo"])
+  ];
+  options = {
+    out.extendedInfo = mkOption {
+      type = attrsOf unspecified;
+      description = ''
+        Information about a service to include in the Docker Compose file,
+        but that will not be used by the `docker-compose` command
+        itself.
+
+        It will be inserted in `x-arion.serviceInfo.<service.name>`.
+      '';
+      default = {};
+    };
+  };
+}

src/nix/modules/service/host-store.nix

@@ -0,0 +1,39 @@
+/*
+
+   This service-level module bind mounts the host store into the container
+   when the service.useHostStore option is set to true.
+
+ */
+{ lib, config, pkgs, ... }:
+
+let
+  inherit (lib) mkOption types mkIf;
+  escape = s: lib.replaceStrings ["$"] ["$$"] s;
+in
+{
+  options = {
+    service.useHostStore = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Bind mounts the host store if enabled, avoiding copying.";
+    };
+    service.hostStoreAsReadOnly = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Adds a `:ro` (read-only) access mode to the host nix store bind mount.";
+    };
+    service.useHostNixDaemon = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Make the host Nix daemon available.";
+    };
+  };
+  config = mkIf config.service.useHostStore {
+    image.includeStorePaths = false;
+    service.environment.NIX_REMOTE = lib.optionalString config.service.useHostNixDaemon "daemon";
+    service.volumes = [
+      "${config.host.nixStorePrefix}/nix/store:/nix/store${lib.optionalString config.service.hostStoreAsReadOnly ":ro"}"
+      ] ++ lib.optional config.service.useHostNixDaemon "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket";
+    service.command = lib.mkDefault (map escape (config.image.rawConfig.Cmd or []));
+  };
+}

src/nix/modules/service/image-recommended.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    ;
+  inherit (types)
+    bool
+    ;
+
+  recommendedContents = { runCommand, bash, coreutils }:
+    runCommand "recommended-contents" {} ''
+      mkdir -p $out/bin $out/usr/bin $out/var/empty
+      ln -s ${bash}/bin/sh $out/bin/sh
+      ln -s ${coreutils}/bin/env $out/usr/bin/env
+    '';
+in
+{
+  options = {
+    image.enableRecommendedContents = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Add the `/bin/sh` and `/usr/bin/env` symlinks and some lightweight
+        files.
+      '';
+    };
+  };
+
+  config = {
+    image.contents = mkIf config.image.enableRecommendedContents [
+      (pkgs.callPackage recommendedContents {})
+    ];
+  };
+}