flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/6b342809b1b66dce758364f763b64c6a1a9e6211";
   4 #inputs.nixpkgs.url = "github:NixOS/nixpkgs/aee78d463e826ea5c144cff9c8e9e8c02a6ea4a0";
   5 #inputs.nixpkgs.url = "flake:nixpkgs";
   6 inputs.flake-utils.url = "github:numtide/flake-utils";
   7 inputs.shell = { type = "path"; path = "./shell"; flake = false; };
   8 inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
   9 inputs.pass = { type = "path"; path = "./pass"; flake = false; };
  10 outputs = inputs: let
  11   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  12   localNixpkgsPatches = [
  13     nixpkgs/patches/apparmor.diff
  14     #nixpkgs/patches/public-inbox.diff
  15     #nixpkgs/patches/zerobin.diff
  16     #nixpkgs/patches/gitolite.diff
  17     #nixpkgs/patches/tor.diff
  18     #nixpkgs/patches/freeciv.diff
  19     #nixpkgs/patches/fix-ld-nix.diff
  20     #nixpkgs/patches/fix-ld-nix-apparmor.diff
  21   ];
  22   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  23   nixpkgs = originPkgs.applyPatches {
  24     name = "nixpkgs-patched";
  25     src = inputs.nixpkgs;
  26     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  27     postPatch = ''
  28       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  29          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  30         sort | sha256sum | cut -c -7)
  31       echo "+patch-$patch" >.version-suffix
  32     '';
  33   };
  34   lib = originPkgs.lib;
  35   machines = builtins.mapAttrs (machineName: machineConfig:
  36     let cfg = import machineConfig { inherit inputs; }; in
  37     import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
  38       extraArgs = {
  39         inherit machineName inputs;
  40         machines = inputs.self.nixosConfigurations;
  41       } // (cfg.extraArgs or {});
  42       modules = cfg.modules ++ [({pkgs, ...}: {
  43         nix.registry.nixpkgs.flake = nixpkgs;
  44         nix.package = pkgs.nixUnstable;
  45         nix.extraOptions = "experimental-features = nix-command flakes";
  46         nixpkgs.overlays = import nixpkgs/overlays.nix;
  47         system.nixos.versionSuffix = ".${
  48           lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  49           inputs.self.shortRev or "dirty"}";
  50         system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  51         # Let 'nixos-version --json' know about the Git revision of this flake.
  52         system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  53         boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
  54         security.gnupg.agent.enable = true;
  55         security.gnupg.store = inputs.pass + "/machines/${machineName}";
  56         /*
  57         system.configurationRevision =
  58           if inputs.self ? rev
  59           then inputs.self.rev
  60           else throw "Refusing to build from a dirty Git tree!";
  61         */
  62         programs.ssh.knownHosts = {
  63           mermet = {
  64             hostNames = [ "mermet" "mermet.sourcephile.fr" ];
  65             publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
  66           };
  67           losurdo = {
  68             hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
  69             publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
  70           };
  71         };
  72       })];
  73     }));
  74   in
  75   {
  76     # nix -L build .#nixosConfigurations.${machineName}.config.system.build.toplevel
  77     nixosConfigurations = machines {
  78       losurdo = machines/losurdo.nix;
  79       mermet  = machines/mermet.nix;
  80     };
  81     #nixosModule = import nixos/modules.nix;
  82   }
  83   // inputs.flake-utils.lib.eachDefaultSystem (system:
  84     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
  85     let
  86       pkgs = import nixpkgs {
  87         inherit system;
  88         overlays = import nixpkgs/overlays.nix;
  89       };
  90     in {
  91     legacyPackages = pkgs;
  92     devShell = import ./shell.nix { inherit inputs pkgs; };
  93     apps = builtins.mapAttrs (machineName: { config, ... }: let
  94       system = config.system.build.toplevel;
  95       target = "root@${config.networking.hostName}.${config.networking.domain}";
  96       profile = "/nix/var/nix/profiles/system";
  97       in rec {
  98       # Example: nix run .#losurdo.switch
  99       "switch" = {
 100         type = "app";
 101         program = (pkgs.writeShellScript "switch" ''
 102           set -eux
 103           set -o pipefail
 104           nix-store --add-root machines/${machineName}.root --indirect --realise ${system}
 105           nix copy --to ssh://'${target}' --substitute-on-destination ${system}
 106           ${sendkeys.program}
 107           # Send the SSH key of the initrd
 108           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 109           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 110           # Send the Wireguard key of the initrd
 111           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 112           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 113           ssh '${target}' \
 114             nix-env --profile '${profile}' --set '${system}' '&&' \
 115             '${profile}'/bin/switch-to-configuration switch
 116         '').outPath;
 117       };
 118       # Example: nix run .#losurdo.sendkeys
 119       "sendkeys" = {
 120         type = "app";
 121         program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
 122       };
 123     }) inputs.self.nixosConfigurations;}
 124   );
 125 }