flake.nix

   1 {
   2   description = "julm's Nix configurations for hosts (NixOS) and homes (home-manager)";
   3   /*
   4     nixConfig = {
   5     extra-substituters = [
   6       "https://nix-community.cachix.org"
   7     ];
   8     extra-trusted-public-keys = [
   9       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
  10     ];
  11     };
  12   */
  13
  14   inputs = {
  15     /*
  16       doom-emacs.flake = false;
  17       doom-emacs.url = "github:hlissner/doom-emacs";
  18     */
  19     bufstack = {
  20       url = "github:BibekBhusal0/bufstack.nvim";
  21       flake = false;
  22     };
  23     jj-diffconflicts = {
  24       url = "github:rafikdraoui/jj-diffconflicts";
  25       flake = false;
  26     };
  27     jj-nvim = {
  28       url = "github:NicolasGB/jj.nvim";
  29       #url = "git+file:///home/julm/src/lua/jj.nvim";
  30       flake = false;
  31     };
  32     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
  33     git-hooks.url = "github:cachix/git-hooks.nix";
  34     home-manager.inputs.nixpkgs.follows = "nixpkgs";
  35     home-manager.url = "github:nix-community/home-manager/release-25.11";
  36     #home-manager.url = "git+file:///home/julm/src/nix/home-manager";
  37     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
  38     #nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
  39     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  40     nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
  41     nixpkgs-unstable-latest.url = "github:NixOS/nixpkgs/a3a2ddee4adfb361bdfe2e915c7e85c2e71cfc5f";
  42     lanzaboote = {
  43       url = "github:nix-community/lanzaboote/v0.4.2";
  44       inputs.nixpkgs.follows = "nixpkgs";
  45       inputs.pre-commit-hooks-nix.follows = "git-hooks";
  46     };
  47   };
  48
  49   outputs =
  50     inputs:
  51     let
  52       remoteNixpkgsPatches = import nixpkgs/patches.nix;
  53       localNixpkgsPatches = [
  54         nixpkgs/patches/openvpn/openvpn-netns.patch
  55         nixpkgs/patches/openvpn/0001-nixos-netns-init-module-to-manage-network-namespaces.patch
  56       ];
  57       originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  58       nixpkgsPath = originPkgs.applyPatches {
  59         name = "nixpkgs-patched";
  60         src = inputs.nixpkgs.outPath;
  61         patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  62         postPatch = ''
  63           patch=$(printf '%s\n' ${
  64             builtins.concatStringsSep " " (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)
  65           } |
  66             sort | sha256sum | cut -c -7)
  67           echo "-patch-$patch" >.version-suffix
  68         '';
  69       };
  70       profile = "/nix/var/nix/profiles/system";
  71       inherit (inputs.nixpkgs) lib;
  72       overlays = _system: import nixpkgs/overlays.nix;
  73       #nixosSystem = lib.nixosSystem;
  74       nixosSystem = import (nixpkgsPath + "/nixos/lib/eval-config.nix");
  75       forAllSystems =
  76         f:
  77         lib.genAttrs lib.systems.flakeExposed (
  78           system:
  79           f rec {
  80             inherit system;
  81             #pkgs = inputs.nixpkgs.legacyPackages.${system};
  82             pkgs = import nixpkgsPath {
  83               inherit system;
  84               overlays = overlays system;
  85             };
  86           }
  87         );
  88       self =
  89         with lib.fileset;
  90         toSource {
  91           root = ./.;
  92           fileset =
  93             let
  94               exts = [
  95                 "clear"
  96                 "conf"
  97                 "cred"
  98                 "crt"
  99                 "css"
 100                 "el"
 101                 "hs"
 102                 "inc"
 103                 "json"
 104                 "lua"
 105                 "nft"
 106                 "nix"
 107                 "patch"
 108                 "pem"
 109                 "pub"
 110                 "sh"
 111                 "theme"
 112                 "toml"
 113                 "vim"
 114               ];
 115             in
 116             unions [
 117               (fileFilter (file: lib.any file.hasExt exts) ./domains)
 118               (fileFilter (file: lib.any file.hasExt exts) ./home-manager)
 119               (fileFilter (file: lib.any file.hasExt exts) ./homes)
 120               (fileFilter (file: lib.any file.hasExt exts) ./hosts)
 121               (fileFilter (file: lib.any file.hasExt exts) ./nixos)
 122               (fileFilter (file: lib.any file.hasExt exts) ./nixpkgs)
 123               (fileFilter (file: lib.any file.hasExt exts) ./users)
 124               ./shell.nix
 125             ];
 126         };
 127     in
 128     rec {
 129       # nix -L build .#hello
 130       packages = forAllSystems ({ pkgs, ... }: pkgs);
 131
 132       # nix -L build .#nixosConfigurations.oignon.config.system.build.toplevel
 133       # nix -L build .#nixosConfigurations.oignon.config.boot.kernelPackages.kernel.configfile
 134       # nix -L build .#nixosConfigurations.oignon.pkgs.hello
 135       # nix eval --raw .#nixosConfigurations.oignon.config.networking.nftables.ruleset
 136       nixosConfigurations =
 137         lib.genAttrs
 138           (builtins.attrNames (
 139             lib.filterAttrs (_n: v: v == "directory") (builtins.readDir (self + "/hosts"))
 140           ))
 141           (
 142             hostName:
 143             nixosSystem {
 144               system = null;
 145               specialArgs = {
 146                 # Required to avoid infinite recursion
 147                 # when `inputs` is used in `imports`.
 148                 inherit inputs;
 149               };
 150               modules = [
 151                 nixos/default.nix
 152                 (import (self + "/hosts/${hostName}.nix"))
 153                 inputs.lanzaboote.nixosModules.lanzaboote
 154                 inputs.home-manager.nixosModules.home-manager
 155                 (
 156                   { config, ... }:
 157                   let
 158                     inherit (config.nixpkgs.hostPlatform) system;
 159                     pkgs-unstable = import inputs.nixpkgs-unstable.outPath {
 160                       inherit system;
 161                       overlays = overlays system;
 162                     };
 163                     pkgs-unstable-latest = import inputs.nixpkgs-unstable-latest.outPath {
 164                       inherit system;
 165                       overlays = overlays system;
 166                     };
 167                   in
 168                   {
 169                     _module.args = {
 170                       inherit hostName pkgs-unstable pkgs-unstable-latest;
 171                       hosts = nixosConfigurations;
 172                       host = nixosConfigurations.${hostName}._module.args;
 173                     };
 174                     nixpkgs = {
 175                       overlays = overlays config.nixpkgs.hostPlatform.system;
 176                       config.permittedInsecurePackages = [
 177                         # Still needed for chatty
 178                         # See https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802%3E
 179                         # and https://gitlab.gnome.org/World/Chatty/-/issues/932
 180                         "olm-3.2.16"
 181                       ];
 182                       config.allowUnfreePredicate =
 183                         pkg:
 184                         builtins.elem (lib.getName pkg) [
 185                           "anydesk"
 186                           "canon-cups-ufr2"
 187                           "cudatoolkit"
 188                           "geogebra"
 189                           "hplip"
 190                           "memtest86-efi"
 191                           "nvidia-settings"
 192                           "nvidia-x11"
 193                         ];
 194                     };
 195                     home-manager = {
 196                       useGlobalPkgs = true;
 197                       useUserPackages = true;
 198                       verbose = true;
 199                       #force = true;
 200                       backupFileExtension = "old";
 201                       extraSpecialArgs = {
 202                         inherit
 203                           inputs
 204                           hostName
 205                           pkgs-unstable
 206                           pkgs-unstable-latest
 207                           ;
 208                       };
 209                     };
 210                   }
 211                 )
 212               ];
 213             }
 214           );
 215
 216       # nix -L develop  or  direnv allow
 217       devShells = forAllSystems (
 218         { pkgs, system, ... }:
 219         {
 220           default = pkgs.callPackage (self + "/shell.nix") {
 221             inherit
 222               pkgs
 223               inputs
 224               system
 225               nixpkgsPath
 226               ;
 227             inherit (checks.${system}.git-hooks-check) shellHook;
 228           };
 229         }
 230       );
 231
 232       # nix -L run .#oignon.switch
 233       apps = forAllSystems (
 234         { pkgs, system, ... }:
 235         with builtins;
 236         mapAttrs (
 237           hostName:
 238           { config, ... }:
 239           let
 240             inherit (config.system) build;
 241             scriptApp = scriptName: ps: script: {
 242               type = "app";
 243               program =
 244                 (pkgs.writeShellScript "${hostName}-${scriptName}" ''
 245                   export PATH="${lib.makeBinPath ([ pkgs.coreutils ] ++ ps)}:$PATH"
 246                   set -eux
 247                   ${script}
 248                 '').outPath;
 249             };
 250           in
 251           {
 252             # Example: nix run .#aubergine.switch
 253             "switch" = scriptApp "switch" [ ] ''
 254               shopt -s globstar
 255
 256               chmod -R g-rwx,o-rwx **/*.gpg
 257               trap 'git reset **/*.gpg' EXIT
 258               git rm -rf --cached --ignore-unmatch **/*.gpg # prevent copying to /nix/store
 259
 260               nix-store --add-root hosts/${hostName}.nixpkgs --indirect --realise ${nixpkgsPath}
 261               nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
 262
 263               nix copy --to "ssh://${config.install.target}?''${targetStore-}"${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}
 264
 265               if ssh ${config.install.target} set -x ';' \
 266                 systemctl reset-failed nixos-fallback '2>/dev/null' ';' \
 267                 test "''${NO_NIXOS_FALLBACK:+set}" '||' \
 268                 systemd-run -u nixos-fallback --description=nixos-fallback /bin/sh -xc '''\'''
 269                   PATH=${
 270                     with pkgs;
 271                     lib.makeBinPath [
 272                       coreutils
 273                       nix
 274                       systemd
 275                     ]
 276                   }
 277                   sleep $((10 * 60))
 278                   ${profile}/bin/switch-to-configuration switch
 279                   systemctl reboot
 280                 '\'''' '&&' \
 281                 ${build.toplevel}/bin/switch-to-configuration test
 282               then
 283                 ssh ${config.install.target} -o ControlPath=none set -x ';' \
 284                   systemctl stop nixos-fallback.service ';' \
 285                   nix-env --profile ${profile} --set '${build.toplevel}' ';' \
 286                   ${build.toplevel}/bin/switch-to-configuration boot '&&' \
 287                   nix-env --delete-generations 7d --profile ${profile}
 288               else
 289                 tput rev
 290                 echo WARNING: switch-to-configuration was not registered at boot
 291                 tput sgr0
 292                 ssh ${config.install.target} -o ControlPath=none set -x ';' \
 293                   systemctl stop nixos-fallback.service
 294                 false
 295               fi
 296             '';
 297           }
 298         ) nixosConfigurations
 299       );
 300
 301       # nix flake check
 302       checks = forAllSystems (
 303         args: with args; {
 304           git-hooks-check = inputs.git-hooks.lib.${system}.run {
 305             src = self;
 306             hooks = {
 307               nixfmt-rfc-style.enable = true;
 308             };
 309           };
 310         }
 311       );
 312     };
 313 }