flake.nix

   1 {
   2   description = "julm's Nix configurations for hosts (NixOS) and homes (home-manager)";
   3   /*
   4     nixConfig = {
   5     extra-substituters = [
   6       "https://nix-community.cachix.org"
   7     ];
   8     extra-trusted-public-keys = [
   9       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
  10     ];
  11     };
  12   */
  13
  14   nixConfig = {
  15     # Explanation: required due to the applyPatches on nixpkgs below.
  16     allow-import-from-derivation = true;
  17   };
  18
  19   # https://status.nixos.org
  20   # nix flake update nixpkgs --override-flake nixpkgs github:NixOS/nixpkgs/2c3e5ec5df46d3aeee2a1da0bfedd74e21f4bf3a --allow-dirty-locks
  21   inputs = {
  22     azaharPlus = {
  23       url = "github:AzaharPlus/AzaharPlus?submodules=1";
  24       flake = false;
  25     };
  26     flake-compat = {
  27       url = "github:NixOS/flake-compat";
  28       flake = false;
  29     };
  30     jjui = {
  31       url = "github:idursun/jjui";
  32       flake = false;
  33     };
  34     jj-conflict = {
  35       url = "github:larpios/jj-conflict.nvim";
  36       flake = false;
  37     };
  38     /*
  39       doom-emacs.flake = false;
  40       doom-emacs.url = "github:hlissner/doom-emacs";
  41     */
  42     jj-fugitive = {
  43       url = "github:martintrojer/jj-fugitive";
  44       flake = false;
  45     };
  46     sivansh11-jj-nvim = {
  47       url = "github:sivansh11/jj";
  48       flake = false;
  49     };
  50     eagle-nvim = {
  51       url = "github:soulis-1256/eagle.nvim";
  52       flake = false;
  53     };
  54     bufstack = {
  55       url = "github:BibekBhusal0/bufstack.nvim";
  56       flake = false;
  57     };
  58     jj-diffconflicts = {
  59       url = "github:rafikdraoui/jj-diffconflicts";
  60       flake = false;
  61     };
  62     NicolasGB-jj-nvim = {
  63       url = "github:NicolasGB/jj.nvim";
  64       #url = "git+file:///home/julm/src/lua/jj.nvim";
  65       flake = false;
  66     };
  67     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
  68     git-hooks.url = "github:cachix/git-hooks.nix";
  69     home-manager.inputs.nixpkgs.follows = "nixpkgs";
  70     home-manager.url = "github:nix-community/home-manager/release-25.11";
  71     #home-manager.url = "git+file:///home/julm/src/nix/home-manager";
  72     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
  73     #nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
  74     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  75     nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
  76     nixpkgs-unstable-latest.url = "github:NixOS/nixpkgs";
  77     lanzaboote = {
  78       url = "github:nix-community/lanzaboote/v1.0.0";
  79       inputs.nixpkgs.follows = "nixpkgs";
  80       inputs.pre-commit.follows = "git-hooks";
  81     };
  82   };
  83
  84   outputs =
  85     inputs:
  86     let
  87       remoteNixpkgsPatches = import nixpkgs/patches.nix;
  88       localNixpkgsPatches = [
  89         nixpkgs/patches/openvpn/openvpn-netns.patch
  90         nixpkgs/patches/openvpn/0001-nixos-netns-init-module-to-manage-network-namespaces.patch
  91       ];
  92       originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  93       nixpkgsPath = originPkgs.applyPatches {
  94         name = "nixpkgs-patched";
  95         src = inputs.nixpkgs.outPath;
  96         patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  97         postPatch = ''
  98           patch=$(printf '%s\n' ${
  99             builtins.concatStringsSep " " (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)
 100           } |
 101             sort | sha256sum | cut -c -7)
 102           echo "-patch-$patch" >.version-suffix
 103         '';
 104       };
 105       profile = "/nix/var/nix/profiles/system";
 106       inherit (inputs.nixpkgs) lib;
 107       overlays = import nixpkgs/overlays.nix;
 108       #nixosSystem = lib.nixosSystem;
 109       nixosSystem = import (nixpkgsPath + "/nixos/lib/eval-config.nix");
 110       forAllSystems =
 111         f:
 112         lib.genAttrs lib.systems.flakeExposed (
 113           system:
 114           f rec {
 115             inherit system;
 116             #pkgs = inputs.nixpkgs.legacyPackages.${system};
 117             pkgs = import nixpkgsPath {
 118               inherit system;
 119               overlays = overlays { inherit inputs system; };
 120             };
 121           }
 122         );
 123       self =
 124         with lib.fileset;
 125         toSource {
 126           root = ./.;
 127           fileset =
 128             let
 129               exts = [
 130                 "clear"
 131                 "conf"
 132                 "cred"
 133                 "crt"
 134                 "css"
 135                 "el"
 136                 "hs"
 137                 "inc"
 138                 "json"
 139                 "lua"
 140                 "nft"
 141                 "nix"
 142                 "patch"
 143                 "pem"
 144                 "pub"
 145                 "sh"
 146                 "theme"
 147                 "toml"
 148                 "vim"
 149               ];
 150             in
 151             unions [
 152               (fileFilter (file: lib.any file.hasExt exts) ./domains)
 153               (fileFilter (file: lib.any file.hasExt exts) ./home-manager)
 154               (fileFilter (file: lib.any file.hasExt exts) ./homes)
 155               (fileFilter (file: lib.any file.hasExt exts) ./hosts)
 156               (fileFilter (file: lib.any file.hasExt exts) ./nixos)
 157               (fileFilter (file: lib.any file.hasExt exts) ./nixpkgs)
 158               (fileFilter (file: lib.any file.hasExt exts) ./users)
 159               ./shell.nix
 160             ];
 161         };
 162     in
 163     rec {
 164       # nix -L build .#hello
 165       packages = forAllSystems ({ pkgs, ... }: pkgs);
 166
 167       # nix -L build .#nixosConfigurations.oignon.config.system.build.toplevel
 168       # nix -L build .#nixosConfigurations.oignon.config.boot.kernelPackages.kernel.configfile
 169       # nix -L build .#nixosConfigurations.oignon.pkgs.hello
 170       # nix eval --raw .#nixosConfigurations.oignon.config.networking.nftables.ruleset
 171       nixosConfigurations =
 172         lib.genAttrs
 173           (builtins.attrNames (
 174             lib.filterAttrs (_n: v: v == "directory") (builtins.readDir (self + "/hosts"))
 175           ))
 176           (
 177             hostName:
 178             nixosSystem {
 179               system = null;
 180               specialArgs = {
 181                 # Required to avoid infinite recursion
 182                 # when `inputs` is used in `imports`.
 183                 inherit inputs;
 184               };
 185               modules = [
 186                 nixos/default.nix
 187                 ./hosts.nix
 188                 (import (self + "/hosts/${hostName}.nix"))
 189                 inputs.lanzaboote.nixosModules.lanzaboote
 190                 inputs.home-manager.nixosModules.home-manager
 191                 (
 192                   { config, lib, ... }:
 193                   let
 194                     inherit (config.nixpkgs.hostPlatform) system;
 195                     pkgs-unstable = import inputs.nixpkgs-unstable.outPath {
 196                       inherit system;
 197                       overlays = overlays { inherit inputs system; };
 198                     };
 199                     pkgs-unstable-latest = import inputs.nixpkgs-unstable-latest.outPath {
 200                       inherit system;
 201                       overlays = overlays { inherit inputs system; };
 202                     };
 203                   in
 204                   {
 205                     _module.args = {
 206                       inherit hostName pkgs-unstable pkgs-unstable-latest;
 207                       hosts = nixosConfigurations;
 208                       host = nixosConfigurations.${hostName}._module.args;
 209                     };
 210                     nixpkgs = {
 211                       overlays = overlays {
 212                         inherit inputs;
 213                         inherit (config.nixpkgs.hostPlatform) system;
 214                       };
 215                       config.permittedInsecurePackages = [
 216                         # Still needed for chatty
 217                         # See https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802%3E
 218                         # and https://gitlab.gnome.org/World/Chatty/-/issues/932
 219                         "olm-3.2.16"
 220                       ];
 221                       config.allowNonSource = false;
 222                       config.allowNonSourcePredicate =
 223                         pkg:
 224                         # Disallow packages whose sourceProvenance is not isSource, except binaryFirmware.
 225                         !(lib.lists.any (p: !p.isSource && p != lib.sourceTypes.binaryFirmware) pkg.meta.sourceProvenance)
 226                         # Reallow some of them.
 227                         || builtins.elem (lib.getName pkg) [
 228                           "ant"
 229                           "canon-cups-ufr2"
 230                           "cargo-bootstrap"
 231                           "dart"
 232                           "ghc-binary"
 233                           "go"
 234                           "gradle"
 235                           "libreoffice"
 236                           "librusty_v8"
 237                           "pdftk"
 238                           "rustc-bootstrap"
 239                           "rustc-bootstrap-wrapper"
 240                           "saxon"
 241                           "sleuthkit"
 242                           "temurin-bin"
 243                           "wine-wow"
 244                           "zotero"
 245                         ];
 246                       config.allowUnfreePredicate =
 247                         pkg:
 248                         builtins.elem (lib.getName pkg) [
 249                           "anydesk"
 250                           "canon-cups-ufr2"
 251                           "cudatoolkit"
 252                           "geogebra"
 253                           "hplip"
 254                           "memtest86-efi"
 255                           "nvidia-settings"
 256                           "nvidia-x11"
 257                         ];
 258                     };
 259                     home-manager = {
 260                       useGlobalPkgs = true;
 261                       useUserPackages = true;
 262                       verbose = true;
 263                       #force = true;
 264                       backupFileExtension = "old";
 265                       extraSpecialArgs = {
 266                         inherit
 267                           inputs
 268                           hostName
 269                           pkgs-unstable
 270                           pkgs-unstable-latest
 271                           ;
 272                       };
 273                     };
 274                   }
 275                 )
 276               ];
 277             }
 278           );
 279
 280       # nix -L develop  or  direnv allow
 281       devShells = forAllSystems (
 282         { pkgs, system, ... }:
 283         {
 284           default = pkgs.callPackage flake/devShells/default.nix {
 285             inherit
 286               pkgs
 287               inputs
 288               system
 289               nixpkgsPath
 290               ;
 291             inherit (checks.${system}.git-hooks-check) shellHook;
 292           };
 293         }
 294       );
 295
 296       # nix -L run .#oignon.switch
 297       apps = forAllSystems (
 298         { pkgs, system, ... }:
 299         with builtins;
 300         mapAttrs (
 301           hostName:
 302           { config, ... }:
 303           {
 304             # Example: nix run .#aubergine.switch
 305             "switch" = {
 306               type = "app";
 307               program =
 308                 (pkgs.callPackage flake/apps/switch.nix {
 309                   inherit
 310                     config
 311                     hostName
 312                     nixpkgsPath
 313                     profile
 314                     ;
 315                   inherit (config.system) build;
 316                 }).outPath;
 317             };
 318           }
 319         ) nixosConfigurations
 320       );
 321
 322       # nix flake check
 323       checks = forAllSystems (
 324         args: with args; {
 325           git-hooks-check = inputs.git-hooks.lib.${system}.run {
 326             src = self;
 327             hooks = {
 328               nixfmt-rfc-style.enable = true;
 329             };
 330           };
 331         }
 332       );
 333     };
 334 }