flake.nix

   1 {
   2   inputs = {
   3     #doom-emacs.follows = "julm-nix/doom-emacs";
   4     home-manager.follows = "julm-nix/home-manager";
   5     #julm-nix.inputs.nixpkgs.follows = "nixpkgs";
   6     julm-nix.url = "git+file:///home/julm/work/sourcephile/nix/julm-nix?ref=main";
   7     nixpkgs.follows = "julm-nix/nixpkgs";
   8     #nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
   9     git-hooks.follows = "julm-nix/git-hooks";
  10     bufstack.follows = "julm-nix/bufstack";
  11     eagle-nvim.follows = "julm-nix/eagle-nvim";
  12     jj-diffconflicts.follows = "julm-nix/jj-diffconflicts";
  13     jj-fugitive.follows = "julm-nix/jj-fugitive";
  14     NicolasGB-jj-nvim.follows = "julm-nix/NicolasGB-jj-nvim";
  15     sivansh11-jj-nvim.follows = "julm-nix/sivansh11-jj-nvim";
  16   };
  17
  18   outputs =
  19     inputs:
  20     let
  21       remoteNixpkgsPatches = import (inputs.julm-nix + "/nixpkgs/patches.nix");
  22       localNixpkgsPatches = [
  23         #nixpkgs/patches/systemd-coredump.diff
  24         (inputs.julm-nix + "/nixpkgs/patches/openvpn/openvpn-netns.patch")
  25         (
  26           inputs.julm-nix
  27           + "/nixpkgs/patches/openvpn/0001-nixos-netns-init-module-to-manage-network-namespaces.patch"
  28         )
  29       ];
  30       originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  31       nixpkgsPath = originPkgs.applyPatches {
  32         name = "nixpkgs-patched";
  33         src = inputs.nixpkgs;
  34         patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  35         postPatch = ''
  36           patch=$(printf '%s\n' ${
  37             builtins.concatStringsSep " " (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)
  38           } |
  39             sort | sha256sum | cut -c -7)
  40           echo "-patch-$patch" >.version-suffix
  41         '';
  42       };
  43       profile = "/nix/var/nix/profiles/system";
  44       inherit (inputs.nixpkgs) lib;
  45       overlays =
  46         args:
  47         [
  48           (finalPkgs: previousPkgs: { })
  49         ]
  50         ++ import (inputs.julm-nix + "/nixpkgs/overlays.nix") args
  51         ++ import nixpkgs/overlays.nix args;
  52       #nixosSystem = lib.nixosSystem;
  53       nixosSystem = import (nixpkgsPath + "/nixos/lib/eval-config.nix");
  54       forAllSystems =
  55         f:
  56         lib.genAttrs lib.systems.flakeExposed (
  57           system:
  58           f rec {
  59             inherit system;
  60             #pkgs = inputs.nixpkgs.legacyPackages.${system};
  61             pkgs = import nixpkgsPath {
  62               inherit system;
  63               overlays = overlays { inherit inputs system; };
  64             };
  65           }
  66         );
  67     in
  68     {
  69       # nix -L build .#hello
  70       packages = forAllSystems (args: with args; pkgs);
  71
  72       # nix -L build .#nixosConfigurations.mermet.config.system.build.toplevel
  73       # nix -L build .#nixosConfigurations.mermet.config.boot.kernelPackages.kernel.configfile
  74       # nix -L build .#nixosConfigurations.mermet.pkgs.hello
  75       # nix eval --raw .#nixosConfigurations.mermet.config.networking.nftables.ruleset
  76       nixosConfigurations =
  77         lib.genAttrs
  78           (builtins.attrNames (
  79             lib.filterAttrs (_n: v: v == "directory") (builtins.readDir (inputs.self + "/hosts"))
  80           ))
  81           (
  82             hostName:
  83             nixosSystem {
  84               system = null;
  85               specialArgs = {
  86                 # Required to avoid infinite recursion
  87                 # when `inputs` is used in `imports`.
  88                 inherit inputs;
  89               };
  90               modules = [
  91                 nixos/default.nix
  92                 (inputs.julm-nix + "/nixos/default.nix")
  93                 (inputs.self + "/hosts/${hostName}.nix")
  94                 (
  95                   { config, ... }:
  96                   {
  97                     _module.args = {
  98                       inherit hostName;
  99                       hosts = inputs.self.nixosConfigurations;
 100                       host = inputs.self.nixosConfigurations.${hostName}._module.args;
 101                       info = import ./info.nix;
 102                     };
 103                     nixpkgs.overlays = overlays {
 104                       inherit inputs;
 105                       inherit (config.nixpkgs.hostPlatform) system;
 106                     };
 107                     #nixpkgs.buildPlatform = "x86_64-linux";
 108                     nixpkgs.config.allowUnfreePredicate =
 109                       pkg:
 110                       builtins.elem (lib.getName pkg) [
 111                         "canon-cups-ufr2"
 112                         "hplip"
 113                       ];
 114                   }
 115                 )
 116                 inputs.nixpkgs.nixosModules.notDetected
 117                 inputs.home-manager.nixosModules.home-manager
 118                 {
 119                   home-manager.useGlobalPkgs = true;
 120                   home-manager.useUserPackages = true;
 121                   home-manager.verbose = true;
 122                   home-manager.backupFileExtension = null;
 123                   home-manager.extraSpecialArgs = {
 124                     inherit hostName inputs;
 125                   };
 126                 }
 127                 {
 128                   programs.ssh.knownHosts = {
 129                     carotte = {
 130                       extraHostNames = [
 131                         "carotte"
 132                         "carotte.sourcephile.fr"
 133                       ];
 134                       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnnS0w9zm5KuWwlfJu+qEXC0asESQySPp76szyMTE3J";
 135                     };
 136                     mermet = {
 137                       extraHostNames = [
 138                         "mermet"
 139                         "mermet.sourcephile.fr"
 140                       ];
 141                       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
 142                     };
 143                     losurdo = {
 144                       extraHostNames = [
 145                         "losurdo"
 146                         "losurdo.sourcephile.fr"
 147                       ];
 148                       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
 149                     };
 150                   };
 151                 }
 152               ];
 153             }
 154           );
 155
 156       # nix -L develop  or  direnv allow
 157       devShell = forAllSystems (
 158         { pkgs, system, ... }:
 159         pkgs.callPackage ./shell.nix {
 160           inherit
 161             pkgs
 162             inputs
 163             system
 164             nixpkgsPath
 165             ;
 166           inherit (inputs.self.checks.${system}.git-hooks-check) shellHook;
 167         }
 168       );
 169
 170       # nix -L run .#mermet.switch
 171       apps = forAllSystems (
 172         { pkgs, system, ... }:
 173         with builtins;
 174         mapAttrs (
 175           hostName:
 176           { config, pkgs, ... }:
 177           let
 178             inherit (config.system) build;
 179             scriptApp = scriptName: ps: script: {
 180               type = "app";
 181               program =
 182                 (pkgs.writeShellScript "${hostName}-${scriptName}" ''
 183                   export PATH="${lib.makeBinPath ([ pkgs.buildPackages.coreutils ] ++ ps)}:$PATH"
 184                   set -eux
 185                   ${script}
 186                 '').outPath;
 187             };
 188           in
 189           {
 190             # Example: nix run .#mermet.switch
 191             "switch" = scriptApp "switch" [ ] (''
 192               set -o pipefail
 193               shopt -s globstar
 194
 195               chmod -R g-rwx,o-rwx **/*.gpg
 196               trap 'git reset **/*.gpg' EXIT
 197               git rm -rf --cached --ignore-unmatch **/*.gpg # prevent copying to /nix/store
 198
 199               nix-store --add-root hosts/${hostName}.nixpkgs --indirect --realise ${nixpkgsPath}
 200               nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
 201
 202               nix copy --to ssh://${config.install.target}${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}
 203
 204               ${config.security.initrd.install}
 205
 206               if ssh ${config.install.target} set -x ';' \
 207                 systemctl reset-failed nixos-fallback '2>/dev/null' ';' \
 208                 test "''${NO_NIXOS_FALLBACK:+set}" '||' \
 209                 systemd-run -u nixos-fallback --description=nixos-fallback /bin/sh -xc '''\'''
 210                   PATH=${
 211                     with pkgs;
 212                     lib.makeBinPath [
 213                       coreutils
 214                       nix
 215                       systemd
 216                     ]
 217                   }
 218                   sleep $((10 * 60))
 219                   ${profile}/bin/switch-to-configuration switch
 220                   systemctl reboot
 221                 '\'''' '&&' \
 222                 ${build.toplevel}/bin/switch-to-configuration test
 223               then
 224                 ssh ${config.install.target} -o ControlPath=none set -x ';' \
 225                   systemctl stop nixos-fallback.service ';' \
 226                   nix-env --profile ${profile} --set '${build.toplevel}' ';' \
 227                   ${build.toplevel}/bin/switch-to-configuration boot '&&' \
 228                   nix-env --delete-generations 7d --profile ${profile}
 229               else
 230                 tput rev
 231                 echo WARNING: switch-to-configuration was not registered at boot
 232                 tput sgr0
 233                 ssh ${config.install.target} -o ControlPath=none set -x ';' \
 234                   systemctl stop nixos-fallback.service
 235                 false
 236               fi
 237             '');
 238             # Example: nix run .#carotte.install-sd
 239             # DELETEME: quite useless, better to use nixos-install
 240             "install-sd" = scriptApp "install-sd" [ pkgs.zstd ] ''
 241               set -o pipefail
 242               nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
 243               unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
 244               sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
 245             '';
 246           }
 247         ) inputs.self.nixosConfigurations
 248       );
 249
 250       # nix flake check
 251       checks = forAllSystems (
 252         args: with args; {
 253           git-hooks-check = inputs.git-hooks.lib.${system}.run {
 254             src = inputs.self;
 255             hooks = {
 256               nixfmt-rfc-style.enable = true;
 257             };
 258           };
 259         }
 260       );
 261
 262     };
 263 }