]> Git — Sourcephile - sourcephile-nix.git/blob - flake.nix
syncoid: update PR#98455
[sourcephile-nix.git] / flake.nix
1 {
2 # Pin down nixpkgs from github, instead of using global, system or user registries.
3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/b69f140a8028e4718bde4e5082f8df38e50b7971";
4 #inputs.nixpkgs.url = "flake:nixpkgs";
5 inputs.flake-utils.url = "github:numtide/flake-utils";
6 inputs.shell = { type = "path"; path = "./shell"; flake = false; };
7 inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
8 inputs.pass = { type = "path"; path = "./pass"; flake = false; };
9 outputs = inputs: let
10 remoteNixpkgsPatches = [
11 { meta.description = "syncoid: fix PATH to let it use sudo";
12 url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
13 sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
14 }
15 { meta.description = "sanoid: fix sanoid.conf generation";
16 url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
17 sha256 = "Sy9wPmL+Lfl7hMEeXYOEMk3KlfdL21aL92v6MiGajds=";
18 }
19 { meta.description = "nixos/public-inbox: init";
20 url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
21 sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
22 }
23 { meta.description = "nixos/security.gnupg: provisioning GnuPG-protected secrets through the Nix store";
24 url = "https://github.com/NixOS/nixpkgs/pull/93659.diff";
25 sha256 = "3im5nSrlM32DQUeq0Yp1MHkUcQyLdCGbxfJjgcc9e78=";
26 }
27 { meta.description = "nixos/croc: init";
28 url = "https://github.com/NixOS/nixpkgs/pull/93629.diff";
29 sha256 = "sha256-hzs5Z9cYCo6aNFfylB37W+1neejV4/kVyM1QmqVhVww=";
30 }
31 { meta.description = "dovecot_fts_xapian: 1.3.1 -> 1.3.3";
32 url = "https://github.com/NixOS/nixpkgs/pull/94938.diff";
33 sha256 = "10bjwcwpvq7nnqdpz0n7c61kb3b27v1abyc80pki7d13jmzzjc04";
34 }
35 { meta.description = "transmission: use freeformType on settings";
36 url = "https://github.com/NixOS/nixpkgs/pull/96655.diff";
37 sha256 = "sha256-lRKe8WnGPc8ojaD9W8ZS+NVMhIoGOCOj9njhqQhzaCM";
38 }
39 { meta.description = "tor: improve type-checking and hardening";
40 url = "https://github.com/NixOS/nixpkgs/pull/97740.diff";
41 sha256 = "sha256-ojmDxbGtfsvrUCtjkR7ZynayEGNDLwYl2Ea6yLOQpIk=";
42 }
43 /*
44 { meta.description = "nixos/postfix: add sandbox";
45 url = "https://github.com/NixOS/nixpkgs/pull/93305.diff";
46 sha256 = "sha256-KmoaPj8G4kRlwkBKo/giyST8xQfnjX3OJhh68NKNaRI=";
47 }
48 { meta.description = "nixos/rspamd: add sandbox";
49 url = "https://github.com/NixOS/nixpkgs/pull/93293.diff";
50 sha256 = "sha256-7OfBzJPeGVhHf4ziYLwOpqaYbElCsjLkT4Y/bbCOPx0=";
51 }
52 */
53 { meta.description = "nixos/syncoid: split in multiple systemd services";
54 url = "https://github.com/NixOS/nixpkgs/pull/98455.diff";
55 sha256 = "sha256-xJoUYJGnU/Rb26+FCUTvPyiGdf0cj8mC3s/5cac03YU=";
56 }
57 { meta.description = "zerobin: update to v1.0.5";
58 url = "https://github.com/NixOS/nixpkgs/pull/98734.diff";
59 sha256 = "sha256-mEFvzR0ymwR7V3bJBnr9fR3GxA1jDfXZXQzo+jc5Nxc=";
60 }
61 /*
62 { meta.description = "apparmor";
63 url = "https://github.com/NixOS/nixpkgs/pull/93457.diff";
64 sha256 = "sha256-JzS6/42AS9f0XUuC8ybw1tR8lpFwOC59BNqYN4mmeVI=";
65 }
66 */
67 ];
68 localNixpkgsPatches = [
69 nixpkgs/patches/apparmor.diff
70 #nixpkgs/patches/zerobin.diff
71 #nixpkgs/patches/gitolite.diff
72 #nixpkgs/patches/tor.diff
73 #nixpkgs/patches/fix-ld-nix.diff
74 #nixpkgs/patches/fix-ld-nix-apparmor.diff
75 ];
76 originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
77 nixpkgs = originPkgs.applyPatches {
78 name = "nixpkgs-patched";
79 src = inputs.nixpkgs;
80 patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
81 postPatch = ''
82 patch=$(printf '%s\n' ${builtins.concatStringsSep " "
83 (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
84 sort | sha256sum | cut -c -7)
85 echo "+patch-$patch" >.version-suffix
86 '';
87 };
88 lib = originPkgs.lib;
89 machines = builtins.mapAttrs (machineName: machineConfig:
90 let cfg = import machineConfig { inherit inputs; }; in
91 import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
92 extraArgs = {
93 inherit machineName inputs;
94 machines = inputs.self.nixosConfigurations;
95 } // (cfg.extraArgs or {});
96 modules = cfg.modules ++ [({pkgs, ...}: {
97 nix.registry.nixpkgs.flake = nixpkgs;
98 nix.package = pkgs.nixFlakes;
99 nix.extraOptions = "experimental-features = nix-command flakes";
100 nixpkgs.overlays = import nixpkgs/overlays.nix;
101 system.nixos.versionSuffix = ".${
102 lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
103 inputs.self.shortRev or "dirty"}";
104 system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
105 # Let 'nixos-version --json' know about the Git revision of this flake.
106 system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
107 boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
108 /*
109 system.configurationRevision =
110 if inputs.self ? rev
111 then inputs.self.rev
112 else throw "Refusing to build from a dirty Git tree!";
113 */
114 })];
115 }));
116 in
117 {
118 # nix -L build .#nixosConfigurations.${machineName}.config.system.build.toplevel
119 nixosConfigurations = machines {
120 losurdo = machines/losurdo.nix;
121 mermet = machines/mermet.nix;
122 };
123 }
124 // inputs.flake-utils.lib.eachDefaultSystem (system:
125 #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
126 let
127 pkgs = import nixpkgs {
128 inherit system;
129 overlays = import nixpkgs/overlays.nix;
130 };
131 in {
132 legacyPackages = pkgs;
133 devShell = import ./shell.nix { inherit inputs pkgs; };
134 apps = builtins.mapAttrs (machineName: { config, ... }: let
135 system = config.system.build.toplevel;
136 keygrip = builtins.getAttr machineName {
137 losurdo = "9AA84E6F6D71F9163C46BF396B141A0806219077";
138 mermet = "89F52A879E0019A966503AFFDE72EEA84CDFA3A7";
139 };
140 target = "root@${config.networking.hostName}.${config.networking.domain}";
141 nixCopyFlags = ["--substitute-on-destination"];
142 profile = "/nix/var/nix/profiles/system";
143 in rec {
144 # Example: nix run .#losurdo.switch
145 "switch" = {
146 type = "app";
147 program = (pkgs.writeShellScript "switch" ''
148 set -eux
149 set -o pipefail
150 nix-store --add-root machines/${machineName}.root --indirect --realise ${system}
151 ${pkgs.nixFlakes}/bin/nix copy --to ssh://'${target}' \
152 ${lib.escapeShellArgs nixCopyFlags} ${system}
153 ${sendkeys.program}
154 # Send the SSH key of the initrd
155 gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
156 ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
157 # Send the Wireguard key of the initrd
158 gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
159 ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
160 ssh '${target}' \
161 nix-env --profile '${profile}' --set '${system}' '&&' \
162 '${profile}'/bin/switch-to-configuration switch
163 '').outPath;
164 };
165 # Example: nix run .#losurdo.sendkeys
166 "sendkeys" = {
167 type = "app";
168 program = (pkgs.writeShellScript "sendkeys" ''
169 set -eux
170 set -o pipefail
171 ssh '${target}' \
172 ${pkgs.gnupg}/bin/gpg-connect-agent --no-autostart --homedir /var/lib/gnupg "'keyinfo --list'" /bye 2>&1 |
173 grep -qx -e "gpg-connect-agent: no gpg-agent running in this session" \
174 -e "S KEYINFO ${keygrip} . . . 1 .*" || {
175 # Send the GnuPG root key
176 gpg --decrypt '${config.security.gnupg.store}/root/key.pass.gpg' |
177 gpg --batch --pinentry-mode loopback --passphrase-fd 0 --export-secret-subkeys @root@${machineName} |
178 ssh '${target}' \
179 gpg --no-autostart --homedir /var/lib/gnupg --no-autostart --batch --pinentry-mode loopback --import
180
181 # Send the GnuPG root key's passphrase
182 gpg --decrypt '${config.security.gnupg.store}/root/key.pass.gpg' |
183 ssh '${target}' \
184 gpg-preset-passphrase --homedir /var/lib/gnupg --preset ${keygrip}
185 }
186 '').outPath;
187 };
188 }) inputs.self.nixosConfigurations;}
189 );
190 }