flake.nix

   1 {
   2   description = "julm's Nix configurations for hosts (NixOS) and homes (home-manager)";
   3   /*
   4     nixConfig = {
   5     extra-substituters = [
   6       "https://nix-community.cachix.org"
   7     ];
   8     extra-trusted-public-keys = [
   9       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
  10     ];
  11     };
  12   */
  13
  14   nixConfig = {
  15     # Explanation: required due to the applyPatches on nixpkgs below.
  16     allow-import-from-derivation = true;
  17   };
  18
  19   # https://status.nixos.org
  20   # nix flake update nixpkgs --override-flake nixpkgs github:NixOS/nixpkgs/2c3e5ec5df46d3aeee2a1da0bfedd74e21f4bf3a --allow-dirty-locks
  21   inputs = {
  22     azaharPlus = {
  23       url = "github:AzaharPlus/AzaharPlus?submodules=1";
  24       flake = false;
  25     };
  26     flake-compat = {
  27       url = "github:NixOS/flake-compat";
  28       flake = false;
  29     };
  30     jjui = {
  31       url = "github:idursun/jjui";
  32       flake = false;
  33     };
  34     /*
  35       doom-emacs.flake = false;
  36       doom-emacs.url = "github:hlissner/doom-emacs";
  37     */
  38     jj-fugitive = {
  39       url = "github:martintrojer/jj-fugitive";
  40       flake = false;
  41     };
  42     sivansh11-jj-nvim = {
  43       url = "github:sivansh11/jj";
  44       flake = false;
  45     };
  46     eagle-nvim = {
  47       url = "github:soulis-1256/eagle.nvim";
  48       flake = false;
  49     };
  50     bufstack = {
  51       url = "github:BibekBhusal0/bufstack.nvim";
  52       flake = false;
  53     };
  54     jj-diffconflicts = {
  55       url = "github:rafikdraoui/jj-diffconflicts";
  56       flake = false;
  57     };
  58     NicolasGB-jj-nvim = {
  59       url = "github:NicolasGB/jj.nvim";
  60       #url = "git+file:///home/julm/src/lua/jj.nvim";
  61       flake = false;
  62     };
  63     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
  64     git-hooks.url = "github:cachix/git-hooks.nix";
  65     home-manager.inputs.nixpkgs.follows = "nixpkgs";
  66     home-manager.url = "github:nix-community/home-manager/release-25.11";
  67     #home-manager.url = "git+file:///home/julm/src/nix/home-manager";
  68     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
  69     #nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
  70     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  71     nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
  72     nixpkgs-unstable-latest.url = "github:NixOS/nixpkgs";
  73     lanzaboote = {
  74       url = "github:nix-community/lanzaboote/v1.0.0";
  75       inputs.nixpkgs.follows = "nixpkgs";
  76       inputs.pre-commit.follows = "git-hooks";
  77     };
  78   };
  79
  80   outputs =
  81     inputs:
  82     let
  83       remoteNixpkgsPatches = import nixpkgs/patches.nix;
  84       localNixpkgsPatches = [
  85         nixpkgs/patches/openvpn/openvpn-netns.patch
  86         nixpkgs/patches/openvpn/0001-nixos-netns-init-module-to-manage-network-namespaces.patch
  87       ];
  88       originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  89       nixpkgsPath = originPkgs.applyPatches {
  90         name = "nixpkgs-patched";
  91         src = inputs.nixpkgs.outPath;
  92         patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  93         postPatch = ''
  94           patch=$(printf '%s\n' ${
  95             builtins.concatStringsSep " " (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)
  96           } |
  97             sort | sha256sum | cut -c -7)
  98           echo "-patch-$patch" >.version-suffix
  99         '';
 100       };
 101       profile = "/nix/var/nix/profiles/system";
 102       inherit (inputs.nixpkgs) lib;
 103       overlays = import nixpkgs/overlays.nix;
 104       #nixosSystem = lib.nixosSystem;
 105       nixosSystem = import (nixpkgsPath + "/nixos/lib/eval-config.nix");
 106       forAllSystems =
 107         f:
 108         lib.genAttrs lib.systems.flakeExposed (
 109           system:
 110           f rec {
 111             inherit system;
 112             #pkgs = inputs.nixpkgs.legacyPackages.${system};
 113             pkgs = import nixpkgsPath {
 114               inherit system;
 115               overlays = overlays { inherit inputs system; };
 116             };
 117           }
 118         );
 119       self =
 120         with lib.fileset;
 121         toSource {
 122           root = ./.;
 123           fileset =
 124             let
 125               exts = [
 126                 "clear"
 127                 "conf"
 128                 "cred"
 129                 "crt"
 130                 "css"
 131                 "el"
 132                 "hs"
 133                 "inc"
 134                 "json"
 135                 "lua"
 136                 "nft"
 137                 "nix"
 138                 "patch"
 139                 "pem"
 140                 "pub"
 141                 "sh"
 142                 "theme"
 143                 "toml"
 144                 "vim"
 145               ];
 146             in
 147             unions [
 148               (fileFilter (file: lib.any file.hasExt exts) ./domains)
 149               (fileFilter (file: lib.any file.hasExt exts) ./home-manager)
 150               (fileFilter (file: lib.any file.hasExt exts) ./homes)
 151               (fileFilter (file: lib.any file.hasExt exts) ./hosts)
 152               (fileFilter (file: lib.any file.hasExt exts) ./nixos)
 153               (fileFilter (file: lib.any file.hasExt exts) ./nixpkgs)
 154               (fileFilter (file: lib.any file.hasExt exts) ./users)
 155               ./shell.nix
 156             ];
 157         };
 158     in
 159     rec {
 160       # nix -L build .#hello
 161       packages = forAllSystems ({ pkgs, ... }: pkgs);
 162
 163       # nix -L build .#nixosConfigurations.oignon.config.system.build.toplevel
 164       # nix -L build .#nixosConfigurations.oignon.config.boot.kernelPackages.kernel.configfile
 165       # nix -L build .#nixosConfigurations.oignon.pkgs.hello
 166       # nix eval --raw .#nixosConfigurations.oignon.config.networking.nftables.ruleset
 167       nixosConfigurations =
 168         lib.genAttrs
 169           (builtins.attrNames (
 170             lib.filterAttrs (_n: v: v == "directory") (builtins.readDir (self + "/hosts"))
 171           ))
 172           (
 173             hostName:
 174             nixosSystem {
 175               system = null;
 176               specialArgs = {
 177                 # Required to avoid infinite recursion
 178                 # when `inputs` is used in `imports`.
 179                 inherit inputs;
 180               };
 181               modules = [
 182                 nixos/default.nix
 183                 ./hosts.nix
 184                 (import (self + "/hosts/${hostName}.nix"))
 185                 inputs.lanzaboote.nixosModules.lanzaboote
 186                 inputs.home-manager.nixosModules.home-manager
 187                 (
 188                   { config, lib, ... }:
 189                   let
 190                     inherit (config.nixpkgs.hostPlatform) system;
 191                     pkgs-unstable = import inputs.nixpkgs-unstable.outPath {
 192                       inherit system;
 193                       overlays = overlays { inherit inputs system; };
 194                     };
 195                     pkgs-unstable-latest = import inputs.nixpkgs-unstable-latest.outPath {
 196                       inherit system;
 197                       overlays = overlays { inherit inputs system; };
 198                     };
 199                   in
 200                   {
 201                     _module.args = {
 202                       inherit hostName pkgs-unstable pkgs-unstable-latest;
 203                       hosts = nixosConfigurations;
 204                       host = nixosConfigurations.${hostName}._module.args;
 205                     };
 206                     nixpkgs = {
 207                       overlays = overlays {
 208                         inherit inputs;
 209                         inherit (config.nixpkgs.hostPlatform) system;
 210                       };
 211                       config.permittedInsecurePackages = [
 212                         # Still needed for chatty
 213                         # See https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802%3E
 214                         # and https://gitlab.gnome.org/World/Chatty/-/issues/932
 215                         "olm-3.2.16"
 216                       ];
 217                       config.allowNonSource = false;
 218                       config.allowNonSourcePredicate =
 219                         pkg:
 220                         # Disallow packages whose sourceProvenance is not isSource, except binaryFirmware.
 221                         !(lib.lists.any (p: !p.isSource && p != lib.sourceTypes.binaryFirmware) pkg.meta.sourceProvenance)
 222                         # Reallow some of them.
 223                         || builtins.elem (lib.getName pkg) [
 224                           "ant"
 225                           "canon-cups-ufr2"
 226                           "cargo-bootstrap"
 227                           "dart"
 228                           "ghc-binary"
 229                           "go"
 230                           "gradle"
 231                           "libreoffice"
 232                           "librusty_v8"
 233                           "pdftk"
 234                           "rustc-bootstrap"
 235                           "rustc-bootstrap-wrapper"
 236                           "saxon"
 237                           "sleuthkit"
 238                           "temurin-bin"
 239                           "wine-wow"
 240                           "zotero"
 241                         ];
 242                       config.allowUnfreePredicate =
 243                         pkg:
 244                         builtins.elem (lib.getName pkg) [
 245                           "anydesk"
 246                           "canon-cups-ufr2"
 247                           "cudatoolkit"
 248                           "geogebra"
 249                           "hplip"
 250                           "memtest86-efi"
 251                           "nvidia-settings"
 252                           "nvidia-x11"
 253                         ];
 254                     };
 255                     home-manager = {
 256                       useGlobalPkgs = true;
 257                       useUserPackages = true;
 258                       verbose = true;
 259                       #force = true;
 260                       backupFileExtension = "old";
 261                       extraSpecialArgs = {
 262                         inherit
 263                           inputs
 264                           hostName
 265                           pkgs-unstable
 266                           pkgs-unstable-latest
 267                           ;
 268                       };
 269                     };
 270                   }
 271                 )
 272               ];
 273             }
 274           );
 275
 276       # nix -L develop  or  direnv allow
 277       devShells = forAllSystems (
 278         { pkgs, system, ... }:
 279         {
 280           default = pkgs.callPackage flake/devShells/default.nix {
 281             inherit
 282               pkgs
 283               inputs
 284               system
 285               nixpkgsPath
 286               ;
 287             inherit (checks.${system}.git-hooks-check) shellHook;
 288           };
 289         }
 290       );
 291
 292       # nix -L run .#oignon.switch
 293       apps = forAllSystems (
 294         { pkgs, system, ... }:
 295         with builtins;
 296         mapAttrs (
 297           hostName:
 298           { config, ... }:
 299           {
 300             # Example: nix run .#aubergine.switch
 301             "switch" = {
 302               type = "app";
 303               program =
 304                 (pkgs.callPackage flake/apps/switch.nix {
 305                   inherit
 306                     config
 307                     hostName
 308                     nixpkgsPath
 309                     profile
 310                     ;
 311                   inherit (config.system) build;
 312                 }).outPath;
 313             };
 314           }
 315         ) nixosConfigurations
 316       );
 317
 318       # nix flake check
 319       checks = forAllSystems (
 320         args: with args; {
 321           git-hooks-check = inputs.git-hooks.lib.${system}.run {
 322             src = self;
 323             hooks = {
 324               nixfmt-rfc-style.enable = true;
 325             };
 326           };
 327         }
 328       );
 329     };
 330 }