2 # Pin down nixpkgs from github, instead of using global, system or user registries.
3 #inputs.nixpkgs.url = "github:NixOS/nixpkgs/168d1c578909dc143ba52dbed661c36e76b12b36";
4 inputs.nixpkgs.url = "github:NixOS/nixpkgs/c06d5fa9c605d143b15cafdbbb61c7c95388d76e";
5 #inputs.nixpkgs.url = "flake:nixpkgs";
6 inputs.flake-utils.url = "github:numtide/flake-utils";
7 inputs.home-manager.follows = "julm-nix/home-manager";
8 #inputs.julm-nix.url = "git+https://git.hut.sourcephile.fr/~julm/julm-nix?ref=main";
9 inputs.julm-nix.url = "git+file:///home/julm/work/sourcephile/nix/julm-nix?ref=main";
10 #inputs.julm-nix.type = "path";
11 #inputs.julm-nix.path = "/home/julm/work/sourcephile/nix/julm-nix";
12 inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
13 inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
14 inputs.doom-emacs.follows = "julm-nix/doom-emacs";
15 inputs.nix-doom-emacs.follows = "julm-nix/nix-doom-emacs";
16 inputs.nix-doom-emacs.inputs.doom-emacs.follows = "julm-nix/doom-emacs";
17 inputs.emacs-overlay.follows = "julm-nix/emacs-overlay";
18 #inputs.shell = { type = "path"; path = "./shell"; flake = false; };
19 #inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
20 #inputs.pass = { type = "path"; path = "./pass"; flake = false; };
21 inputs.shell.url = "path:./shell";
22 inputs.shell.flake = false;
23 inputs.secrets.type = "path";
24 inputs.secrets.path = "/home/julm/work/sourcephile/nix/sec";
25 inputs.secrets.flake = false;
26 inputs.pass.type = "path";
27 inputs.pass.path = "/home/julm/work/sourcephile/nix/pass";
28 inputs.pass.flake = false;
31 remoteNixpkgsPatches = import nixpkgs/patches.nix;
32 localNixpkgsPatches = [
33 nixpkgs/patches/sourcehut.diff
34 #nixpkgs/patches/bitmask.diff
35 #nixpkgs/patches/systemd-coredump.diff
37 originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
38 nixpkgsPath = originPkgs.applyPatches {
39 name = "nixpkgs-patched";
41 patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
43 patch=$(printf '%s\n' ${builtins.concatStringsSep " "
44 (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
45 sort | sha256sum | cut -c -7)
46 echo "+patch-$patch" >.version-suffix
50 hosts = builtins.mapAttrs (hostName: hostConfig:
51 let cfg = import hostConfig { inherit inputs hostName nixpkgsPath; }; in
52 import (nixpkgsPath + "/nixos/lib/eval-config.nix") (lib.recursiveUpdate cfg {
54 inherit hostName inputs;
55 # Encrypted using git-crypt, hence kept out of /nix/store
56 private = "/root/private";
57 # Encrypted using systemd-creds, hence can go into the /nix/store
58 credentials = private/hosts + "/${hostName}/credentials";
60 modules = cfg.modules ++ [
62 config._module.args = {
63 hosts = inputs.self.nixosConfigurations;
64 host = inputs.self.nixosConfigurations.${hostName}._module.args;
67 inputs.home-manager.nixosModules.home-manager
69 home-manager.useGlobalPkgs = true;
70 home-manager.useUserPackages = true;
71 home-manager.verbose = true;
72 home-manager.backupFileExtension = null;
73 home-manager.extraSpecialArgs = {
74 inherit hostName inputs;
78 nix.package = pkgs.nixUnstable;
80 import nixpkgs/overlays.nix ++
81 import (inputs.julm-nix + "/nixpkgs/overlays.nix");
82 system.nixos.versionSuffix = ".${
83 lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
84 inputs.self.shortRev or "dirty"}";
85 system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
86 # Let 'nixos-version --json' know about the Git revision of this flake.
87 system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
88 security.gnupg.agent.enable = true;
89 security.gnupg.store = inputs.pass + "/hosts/${hostName}";
91 system.configurationRevision =
94 else throw "Refusing to build from a dirty Git tree!";
96 programs.ssh.knownHosts = {
98 extraHostNames = [ "carotte" "carotte.sourcephile.fr" ];
99 publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnnS0w9zm5KuWwlfJu+qEXC0asESQySPp76szyMTE3J";
102 extraHostNames = [ "mermet" "mermet.sourcephile.fr" ];
103 publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
106 extraHostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
107 publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
115 # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
116 # Example: nix -L build .#nixosConfigurations.losurdo.config.boot.kernelPackages.kernel.configfile
117 # Example: nix -L build .#nixosConfigurations.losurdo.pkgs.hello
118 # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
119 nixosConfigurations = hosts {
120 carotte = hosts/carotte.nix;
121 losurdo = hosts/losurdo.nix;
122 mermet = hosts/mermet.nix;
124 #nixosModule = import nixos/modules.nix;
126 // inputs.flake-utils.lib.eachDefaultSystem (system:
127 #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
129 pkgs = import nixpkgsPath {
132 import nixpkgs/overlays.nix ++
133 import (inputs.julm-nix + "/nixpkgs/overlays.nix");
136 legacyPackages = pkgs;
137 devShell = import ./shell.nix { inherit inputs pkgs; };
138 apps = builtins.mapAttrs (hostName: { config, ... }: let
139 build = config.system.build;
140 target = "\"\${TARGET:-root@${config.networking.hostName}.${config.networking.domain}}\"";
141 profile = "/nix/var/nix/profiles/system";
143 # Example: nix run .#losurdo.switch
146 program = (pkgs.writeShellScript "switch" (''
149 nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
150 nix copy --to ssh://${target}${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}
152 '' + lib.optionalString config.boot.initrd.network.ssh.enable ''
153 # Send the SSH key of the initrd
154 gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
155 ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
156 # Send the Wireguard key of the initrd
157 gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
158 ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
161 nix-env --profile '${profile}' --set '${build.toplevel}' '&&' \
162 '${profile}'/bin/switch-to-configuration switch
166 # Example: nix run .#carotte.install-sd
169 program = (pkgs.writeShellScript "install-sd" ''
170 export PATH="$PATH:${with pkgs; lib.makeBinPath [coreutils zstd]}"
173 nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
174 unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
175 sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
178 # Example: nix run .#losurdo.sendkeys
181 #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
182 program = (pkgs.writeShellScript "sendkeys" ''
184 chmod -R g-rwx,o-rwx "$PWD/secrets/hosts"
185 rsync -ai --no-times --numeric-ids --usermap=:root --groupmap=:root --chmod=Du+rwx,Fu=r,go-rwx --delete "$PWD/secrets/hosts/${hostName}/root/" ${target}:/root/secrets
186 trap 'git reset secrets/hosts' EXIT
187 git rm -rf --cached --ignore-unmatch secrets/hosts # prevent copying to /nix/store
188 ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
191 }) inputs.self.nixosConfigurations;}