/programs/workerbee/src/incus_config.zig at d602dcf71782b7286ce2d8314e9eed69ea329504

// Copyright 2025 Shota FUJI <pockawoooh@gmail.com>
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0

const std = @import("std");

const exit = @import("./exit.zig");

const incus = struct {
    const ProxyDevice = struct {
        type: []const u8 = "proxy",
        bind: enum { host, instance } = .instance,
        connect: []const u8,
        gid: []const u8,
        listen: []const u8,
        mode: []const u8,
        @"security.gid": []const u8,
        @"security.uid": []const u8,
        uid: []const u8,
    };

    const DiskDevice = struct {
        type: []const u8 = "disk",
        shift: bool = true,
        source: []const u8,
        path: []const u8,
        readonly: bool = false,
    };
};

const WaylandSocket = struct {
    host_location: []const u8,
    uid: std.posix.uid_t,
    gid: std.posix.gid_t,
};

const Options = struct {
    /// Project directory to bind mount.
    project_dir: ?[]const u8 = null,

    /// Flake directory to readonly mount.
    flake_dir: ?[]const u8 = null,

    /// Enable container nesting (only container).
    nesting: bool = true,

    /// Enable idmap inside container, for example rootless podman.
    /// Ignored when "nesting" is disabled.
    nested_idmap: bool = false,

    /// Wayland socket to bind.
    wayland_socket: ?WaylandSocket = null,

    /// Git directory to bind mount.
    git_dir: ?[]const u8 = null,

    /// Enable writes to "git_dir".
    mutable_git_dir: bool = false,

    /// JJ directory to bind mount.
    jj_dir: ?[]const u8 = null,

    /// Enable writes to "jj_dir".
    mutable_jj_dir: bool = false,

    const WriteError = std.Io.Writer.Error || std.mem.Allocator.Error;

    fn writeJson(self: *const Options, allocator: std.mem.Allocator, writer: *std.Io.Writer) WriteError!void {
        var json: std.json.Stringify = .{ .writer = writer };

        try json.beginObject();

        try self.writeInstanceConfig(&json);

        try self.writeDevices(allocator, &json);

        try json.endObject();
    }

    fn writeInstanceConfig(self: *const Options, json: *std.json.Stringify) WriteError!void {
        try json.objectField("config");
        try json.beginObject();

        try json.objectField("security.idmap.isolated");
        try json.write(true);

        if (self.nesting) {
            try json.objectField("security.nesting");
            try json.write(true);

            if (self.nested_idmap) {
                // Give extra id range for nested idmap.
                try json.objectField("security.idmap.size");
                try json.write(165536);
            }
        }

        try json.endObject();
    }

    fn writeDevices(self: *const Options, allocator: std.mem.Allocator, json: *std.json.Stringify) WriteError!void {
        try json.objectField("devices");
        try json.beginObject();

        if (self.wayland_socket) |wayland_socket| {
            try json.objectField("wayland-socket");

            const host_address = try std.fmt.allocPrint(allocator, "unix:{s}", .{wayland_socket.host_location});

            try json.write(incus.ProxyDevice{
                .connect = host_address,
                .gid = try std.fmt.allocPrint(allocator, "{d}", .{wayland_socket.gid}),
                .listen = "unix:/mnt/wayland-0",
                .mode = "0700",
                .@"security.gid" = "1000",
                .@"security.uid" = "1000",
                .uid = try std.fmt.allocPrint(allocator, "{d}", .{wayland_socket.uid}),
            });
        }

        if (self.project_dir) |project_dir| {
            try json.objectField("project");
            try json.write(incus.DiskDevice{
                .source = project_dir,
                .path = "/home/workerbee/project",
            });

            if (self.git_dir) |git_dir| {
                if (!self.mutable_git_dir) {
                    try json.objectField("git");
                    try json.write(incus.DiskDevice{
                        .source = git_dir,
                        .path = "/home/workerbee/project/.git",
                        .readonly = true,
                    });
                }
            }

            if (self.jj_dir) |jj_dir| {
                if (!self.mutable_jj_dir) {
                    try json.objectField("jj");
                    try json.write(incus.DiskDevice{
                        .source = jj_dir,
                        .path = "/home/workerbee/project/.jj",
                        .readonly = true,
                    });
                }
            }
        }

        if (self.flake_dir) |flake_dir| {
            try json.objectField("flake");
            try json.write(incus.DiskDevice{
                .source = flake_dir,
                .path = "/home/workerbee/flake",
                .readonly = true,
            });
        }

        try json.endObject();
    }
};

const help =
    \\,workerbee incus config - Print Incus instance configuration to stdout
    \\
    \\[USAGE]
    \\,workerbee incus config <OPTIONS>
    \\
    \\[OPTIONS]
    \\--help             Print this message to stdout and exits.
    \\
    \\--disable-nesting  Disable container features inside the container.
    \\                   Non-Incus sandbox technologies such as Nix and podman
    \\                   won't work when disabled.
    \\
    \\--nested-idmap     Allows the container to create idmap. Enable this option
    \\                   to use rootless podman inside the container.
    \\
    \\--wayland          Proxy host's Wayland socket to the container,
    \\                   at "/mnt/wayland-0". As this command Wayland socket
    \\                   path and UID of local machine (where the command runs
    \\                   on,) host and local machine MUST be the same.
    \\
    \\--project <PATH>, -p <PATH>
    \\                   Project directory to bind mount. To use this option,
    \\                   host and local machine MUST be the same.
    \\
    \\--flake-dir <PATH>
    \\                   Bind a directory containing "flake.nix" and "flake.lock".
    \\                   The bind is readonly, so "flake.lock" has to be generated
    \\                   on the host beforehand, for example by running:
    \\
    \\                       $ nix flake update
    \\
    \\                   The directory will be available as "~/flake" inside
    \\                   a container. Files other than "flake.nix" and
    \\                   "flake.lock" will be also exposed to the container.
    \\
    \\--mutable <VALUE>[,<VALUE>...]
    \\                   Comma-separated list of directories to disable readonly
    \\                   mount. To prevent unintentional command execution on
    \\                   container host, certain directories are mounted in
    \\                   readonly mode. You can allow writes certain directories
    \\                   using this option. Available values are:
    \\                   * git ... $PROJECT/.git
    \\                   * jj  ... $PROJECT/.jj
    \\
;

pub fn run(allocator: std.mem.Allocator, args: *std.process.ArgIterator) !exit.Code {
    var options: Options = .{};

    while (args.next()) |arg| {
        if (std.mem.eql(u8, arg, "--help")) {
            var buf: [1024]u8 = undefined;
            var stdout = std.fs.File.stdout().writer(&buf);
            const writer = &stdout.interface;

            writer.writeAll(help) catch return .stdout_write_error;
            writer.flush() catch return .stdout_write_error;
            return .ok;
        }

        if (std.mem.eql(u8, arg, "--disable-nesting")) {
            options.nesting = false;
            continue;
        }

        if (std.mem.eql(u8, arg, "--nested-idmap")) {
            options.nested_idmap = true;
            continue;
        }

        if (std.mem.eql(u8, arg, "--wayland")) {
            // The current Zig stdlib misses `std.posix.getgid`.
            const gid = std.os.linux.getgid();
            const uid = std.posix.getuid();

            const wayland_display = std.posix.getenv("WAYLAND_DISPLAY") orelse {
                std.log.err("$WAYLAND_DISPLAY is not set", .{});
                return .incorrect_usage;
            };

            if (std.fs.path.isAbsolute(wayland_display)) {
                options.wayland_socket = .{
                    .host_location = wayland_display,
                    .uid = uid,
                    .gid = gid,
                };
                continue;
            }

            const xdg_runtime_dir = std.posix.getenv("XDG_RUNTIME_DIR") orelse {
                std.log.err("$WAYLAND_DISPLAY set to non-absolute path, but $XDG_RUNTIME_DIR is not set", .{});
                return .incorrect_usage;
            };

            const resolved_path = std.fs.path.join(allocator, &.{ xdg_runtime_dir, wayland_display }) catch {
                return .out_of_memory;
            };

            options.wayland_socket = .{
                .host_location = resolved_path,
                .uid = uid,
                .gid = gid,
            };
            continue;
        }

        if (std.mem.eql(u8, arg, "--project") or std.mem.eql(u8, arg, "-p")) {
            const path = args.next() orelse {
                std.log.err("{s} option requires a value", .{arg});
                return .incorrect_usage;
            };

            const realpath = std.fs.cwd().realpathAlloc(allocator, path) catch |err| switch (err) {
                std.mem.Allocator.Error.OutOfMemory => return .out_of_memory,
                else => {
                    std.log.err("Failed to resolve path \"{s}\": {t}", .{ path, err });
                    return .filename_error;
                },
            };

            var dir = std.fs.cwd().openDir(path, .{}) catch |err| {
                std.log.err("Unable to open project directory: {t}", .{err});
                return .dir_open_error;
            };
            defer dir.close();

            configure_git_dir: {
                var git_dir = dir.openDir(".git", .{}) catch |err| switch (err) {
                    std.fs.Dir.OpenError.FileNotFound => break :configure_git_dir,
                    else => {
                        std.log.err("Unable to open .git at {s}: {t}", .{ realpath, err });
                        return .dir_open_error;
                    },
                };
                defer git_dir.close();

                options.git_dir = dir.realpathAlloc(allocator, ".git") catch {
                    return .out_of_memory;
                };
            }

            configure_jj_dir: {
                var jj_dir = dir.openDir(".jj", .{}) catch |err| switch (err) {
                    std.fs.Dir.OpenError.FileNotFound => break :configure_jj_dir,
                    else => {
                        std.log.err("Unable to open .jj at {s}: {t}", .{ realpath, err });
                        return .dir_open_error;
                    },
                };
                defer jj_dir.close();

                options.jj_dir = dir.realpathAlloc(allocator, ".jj") catch {
                    return .out_of_memory;
                };
            }

            options.project_dir = realpath;
            continue;
        }

        if (std.mem.eql(u8, arg, "--flake-dir")) {
            const path = args.next() orelse {
                std.log.err("{s} option requires a value", .{arg});
                return .incorrect_usage;
            };

            const realpath = std.fs.cwd().realpathAlloc(allocator, path) catch |err| switch (err) {
                std.mem.Allocator.Error.OutOfMemory => return .out_of_memory,
                else => {
                    std.log.err("Failed to resolve path \"{s}\": {t}", .{ path, err });
                    return .filename_error;
                },
            };

            var dir = std.fs.cwd().openDir(path, .{}) catch |err| {
                std.log.err("Unable to open flake directory: {t}", .{err});
                return .dir_open_error;
            };
            defer dir.close();

            inline for (&.{ "flake.nix", "flake.lock" }) |filename| {
                const file = dir.openFile(filename, .{ .mode = .read_only }) catch |err| {
                    std.log.err("Unable to open {s}: {t}", .{ filename, err });
                    return .incorrect_usage;
                };
                defer file.close();
            }

            options.flake_dir = realpath;
            continue;
        }

        if (std.mem.eql(u8, arg, "--mutable")) {
            const values = args.next() orelse {
                std.log.err("{s} option requires a value", .{arg});
                return .incorrect_usage;
            };

            var values_iter = std.mem.splitScalar(u8, values, ',');
            while (values_iter.next()) |value| {
                if (std.mem.eql(u8, value, "git")) {
                    options.mutable_git_dir = true;
                    continue;
                }

                if (std.mem.eql(u8, value, "jj")) {
                    options.mutable_jj_dir = true;
                    continue;
                }

                std.log.err("Unknown value {s} at {s} option", .{ value, arg });
                return .incorrect_usage;
            }

            continue;
        }

        std.log.err("Unknown option value: {s}", .{arg});
        return .incorrect_usage;
    }

    if (options.mutable_git_dir and options.git_dir == null) {
        std.log.err("--mutable=git requires .git directory inside --project directory", .{});
        return .incorrect_usage;
    }

    if (options.mutable_jj_dir and options.jj_dir == null) {
        std.log.err("--mutable=jj requires .jj directory inside --project directory", .{});
        return .incorrect_usage;
    }

    var output_buffer: [1024]u8 = undefined;
    var output_writer = std.fs.File.stdout().writer(&output_buffer);
    const writer = &output_writer.interface;

    options.writeJson(allocator, writer) catch |err| {
        std.log.err("Failed to write to stdout: {t}", .{err});
        return .stdout_write_error;
    };

    writer.writeByte('\n') catch |err| {
        std.log.err("Failed to write to stdout: {t}", .{err});
        return .stdout_write_error;
    };

    writer.flush() catch |err| {
        std.log.err("Failed to flush write buffer: {t}", .{err});
        return .stdout_write_error;
    };

    return .ok;
}