services: Add cuirass-worker-container-service-type.

* modules/rosenthal/services/cuirass.scm: New file.

etc/manifests/all-packages.scm

@@ -3,6 +3,6 @@
 ;; SPDX-License-Identifier: CC0-1.0
 
 (use-modules (guix profiles)
-             (rosenthal packages))
+             (rosenthal utils packages))
 
 (manifest (map package->manifest-entry (all-rosenthal-packages)))

etc/manifests/auto-update.scm

@@ -3,7 +3,7 @@
 ;; SPDX-License-Identifier: CC0-1.0
 
 (use-modules (guix profiles)
-             (rosenthal packages))
+             (rosenthal utils packages))
 
 (manifest (map package->manifest-entry
                (filter (negate rosenthal-disable-updater?)

etc/manifests/manual-update.scm

@@ -3,7 +3,7 @@
 ;; SPDX-License-Identifier: CC0-1.0
 
 (use-modules (guix profiles)
-             (rosenthal packages))
+             (rosenthal utils packages))
 
 (manifest (map package->manifest-entry
                (filter rosenthal-disable-updater?

modules/rosenthal/packages/ci.scm

@@ -0,0 +1,29 @@
+;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
+;;
+;; SPDX-License-Identifier: GPL-3.0-or-later
+
+(define-module (rosenthal packages ci)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix gexp)
+  #:use-module (guix packages)
+  #:use-module (guix git-download)
+  #:use-module (gnu packages ci))
+
+(define-public cuirass/hako
+  (let ((commit "dfbc024c7d4865c1d7f91017bcdb6c1b3e8dffd9")
+        (revision "0"))
+    (package
+      (inherit cuirass)
+      (name "cuirass-hako")
+      (version (git-version "1.2.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://codeberg.org/guix/cuirass.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "0n713faaz8qbi4c3k7y6iz494jya8pbjysqgxiww4wr3y7vhhx9n"))))
+      (properties '((disable-updater? . #t))))))

modules/rosenthal/services/cuirass.scm

@@ -0,0 +1,162 @@
+;;; SPDX-FileCopyrightText: 2025 Hilton Chain <hako@ultrarare.space>
+;;;
+;;; SPDX-License-Identifier: GPL-3.0-or-later
+
+(define-module (rosenthal services cuirass)
+  #:use-module (srfi srfi-1)
+  #:use-module (guix gexp)
+  #:use-module (guix modules)
+  #:use-module (guix records)
+  #:use-module (guix store)
+  #:use-module (rosenthal utils packages)
+  #:use-module (gnu system)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu bootloader grub)
+  #:use-module (gnu system linux-container)
+  #:use-module (gnu system file-systems)
+  #:use-module (gnu system shadow)
+  #:use-module (gnu services)
+  #:use-module (gnu services admin)
+  #:use-module (gnu services base)
+  #:use-module (gnu services cuirass)
+  #:use-module (gnu services shepherd)
+  #:use-module (gnu packages linux)
+  #:export (cuirass-worker-container-configuration
+            cuirass-worker-container-configuration?
+            this-cuirass-worker-container-configuration
+            cuirass-worker-container-host-name
+            cuirass-worker-container-server
+            cuirass-worker-container-supported-systems
+            cuirass-worker-container-substitute-urls
+            cuirass-worker-container-script
+            cuirass-worker-container-activation
+            cuirass-worker-container-shepherd
+            cuirass-worker-container-service-type))
+
+;;;
+;;; Run Cuirass remote worker in container.
+;;;
+
+(define-record-type* <cuirass-worker-container-configuration>
+  cuirass-worker-container-configuration
+  make-cuirass-worker-container-configuration
+  cuirass-worker-container-configuration?
+  this-cuirass-worker-container-configuration
+  (host-name         cuirass-worker-container-host-name)
+  (server            cuirass-worker-container-server)
+  (supported-systems cuirass-worker-container-supported-systems
+                     (default (list (%current-system)))
+                     (thunked))
+  (substitute-urls   cuirass-worker-container-substitute-urls
+                     (default %default-substitute-urls))
+  ;; Internal.
+  (container-script  cuirass-worker-container-script
+                     (default (%cuirass-worker-container-script
+                               this-cuirass-worker-container-configuration))
+                     (thunked))
+  ;; Extensions.
+  (activation        cuirass-worker-container-activation
+                     (default (%cuirass-worker-container-activation
+                               this-cuirass-worker-container-configuration))
+                     (thunked))
+  (shepherd          cuirass-worker-container-shepherd
+                     (default (%cuirass-worker-container-shepherd
+                               this-cuirass-worker-container-configuration))
+                     (thunked)))
+
+(define %cuirass-worker-container-script
+  (match-record-lambda <cuirass-worker-container-configuration>
+      (host-name server supported-systems substitute-urls)
+    (define cuirass-remote-worker-for-container
+      (service-type
+       (name 'cuirass-remote-worker)
+       (extensions
+        (list (service-extension shepherd-root-service-type
+                                 (compose
+                                  (lambda (services)
+                                    (map
+                                     (lambda (s)
+                                       (if (member 'cuirass-remote-worker
+                                                   (shepherd-service-provision s))
+                                           (shepherd-service
+                                             (inherit s)
+                                             (requirement
+                                              (lset-difference
+                                               eqv?
+                                               (shepherd-service-requirement s)
+                                               '(avahi-daemon guix-daemon))))
+                                           s))
+                                     services))
+                                  (@@ (gnu services cuirass)
+                                      cuirass-remote-worker-shepherd-service)))
+              (service-extension account-service-type
+                                 (const
+                                  (@@ (gnu services cuirass)
+                                      %cuirass-remote-worker-accounts)))))
+       (description
+        "Run the Cuirass remote build worker service.")))
+    (define os
+      (operating-system
+        (bootloader
+         (bootloader-configuration
+           (bootloader grub-bootloader)
+           (targets '("/dev/sda"))))
+        (file-systems
+         (cons (file-system
+                 (mount-point "/")
+                 (device "nothing")
+                 (type "dummy"))
+               %base-file-systems))
+        (kernel linux-libre-lts)
+
+        (host-name host-name)
+        (services
+         (cons (service cuirass-remote-worker-for-container
+                 (cuirass-remote-worker-configuration
+                   (cuirass (pkg "cuirass-hako"))
+                   (server server)
+                   (systems supported-systems)
+                   (publish-port 5558)
+                   (substitute-urls substitute-urls)))
+               %base-services))))
+    (with-store store
+      (run-with-store store
+        (container-script os #:shared-network? #t)))))
+
+(define (%cuirass-worker-container-activation _)
+  (with-imported-modules (source-module-closure '((guix build utils)))
+    #~(begin
+        (use-modules (guix build utils))
+        (let ((log-file "/var/log/cuirass-worker-container.log"))
+          (mkdir-p (dirname log-file))
+          ;; Clear log on start.
+          (call-with-output-file log-file (const #t))))))
+
+(define %cuirass-worker-container-shepherd
+  (match-record-lambda <cuirass-worker-container-configuration>
+      (container-script)
+    (list (shepherd-service
+            (provision '(cuirass-worker-container))
+            (requirement '(guix-daemon user-processes))
+            (start
+             #~(make-forkexec-constructor
+                (list #$container-script
+                      "--expose=/etc/guix"
+                      "--share=/var/guix/daemon-socket/socket"
+                      (string-append
+                       "--share=" (string-join
+                                   '("/var/log/cuirass-worker-container.log"
+                                     "/var/log/cuirass-remote-worker.log")
+                                   "=")))))
+            (stop
+             #~(make-kill-destructor))))))
+
+(define cuirass-worker-container-service-type
+  (service-type
+   (name 'cuirass-worker-container)
+   (extensions
+    (list (service-extension activation-service-type
+                             cuirass-worker-container-activation)
+          (service-extension shepherd-root-service-type
+                             cuirass-worker-container-shepherd)))
+   (description "")))

modules/rosenthal/utils/file.scm

@@ -0,0 +1,22 @@
+;;; SPDX-License-Identifier: GPL-3.0-or-later
+;;; Copyright © 2025 Hilton Chain <hako@ultrarare.space>
+
+(define-module (rosenthal utils file)
+  #:use-module (ice-9 textual-ports)
+  #:use-module (guix gexp)
+  #:export (computed-substitution-with-inputs
+            file-content))
+
+(define (computed-substitution-with-inputs name file inputs)
+  (with-imported-modules '((guix build utils))
+    (computed-file
+     name
+     #~(begin
+         (use-modules (guix build utils))
+         (copy-file #$file #$output)
+         (substitute* #$output
+           (("\\$\\$([^\\$]+)\\$\\$" _ path)
+            (search-path '#$inputs path)))))))
+
+(define (file-content file)
+  (call-with-input-file (canonicalize-path file) get-string-all))

modules/rosenthal/utils/packages.scm

@@ -1,8 +1,9 @@
 ;;; SPDX-License-Identifier: GPL-3.0-or-later
 ;;; Copyright © 2015, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2025 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2025 Hilton Chain <hako@ultrarare.space>
 
-(define-module (rosenthal packages)
+(define-module (rosenthal utils packages)
   #:use-module (gnu packages)
   #:use-module (guix diagnostics)
   #:use-module (guix discovery)
@@ -17,15 +18,13 @@
   #:export (rosenthal-patches
             %rosenthal-package-module-path
             all-rosenthal-packages
-            rosenthal-disable-updater?))
 
-;;; Commentary:
-;;;
-;;; This module refines the default value of some parameters from (gnu
-;;; packages) and the syntax/procedures using those.  This allows
-;;; 'search-paths' and friends to work without any user intervention.
-;;;
-;;; Code:
+            rosenthal-disable-updater?
+            delete-package-from-list
+            pkg
+            pkg+out
+            pkgs
+            pkgs+out))
 
 (define %rosenthal-root-directory
   ;; This is like %distro-root-directory from (gnu packages), with adjusted
@@ -101,5 +100,25 @@ packages, excluding superseded packages."
                    ;; Dismiss deprecated packages but keep hidden packages.
                    #:select? (negate package-superseded))))
 
+
+
 (define (rosenthal-disable-updater? p)
   (assq-ref (package-properties p) 'disable-updater?))
+
+(define (delete-package-from-list name lst)
+  "Return a copy of package list LST, removing packages named NAME."
+  (filter (lambda (pkg)
+            (not (string=? name (package-name pkg))))
+          lst))
+
+(define (pkg spec)
+  (specification->package spec))
+
+(define (pkg+out spec)
+  (specification->package+output spec))
+
+(define (pkgs . specs)
+  (map pkg specs))
+
+(define (pkgs+out . specs)
+  (map pkg+out specs))