flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/8afc4e543663ca0a6a4f496262cd05233737e732";
   4 #inputs.nixpkgs.url = "flake:nixpkgs";
   5 inputs.flake-utils.url = "github:numtide/flake-utils";
   6 inputs.home-manager.follows = "julm-nix/home-manager";
   7 #inputs.julm-nix.url = "git+https://git.hut.sourcephile.fr/~julm/julm-nix?ref=main";
   8 inputs.julm-nix.url = "git+file:///home/julm/work/sourcephile/nix/julm-nix?ref=main";
   9 inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
  10 inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
  11 inputs.doom-emacs.follows = "julm-nix/doom-emacs";
  12 inputs.nix-doom-emacs.follows = "julm-nix/nix-doom-emacs";
  13 inputs.nix-doom-emacs.inputs.doom-emacs.follows = "julm-nix/doom-emacs";
  14 inputs.emacs-overlay.follows = "julm-nix/emacs-overlay";
  15 #inputs.shell = { type = "path"; path = "./shell"; flake = false; };
  16 #inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
  17 #inputs.pass = { type = "path"; path = "./pass"; flake = false; };
  18 inputs.shell.url = "path:./shell";
  19 inputs.shell.flake = false;
  20 inputs.secrets.type = "path";
  21 inputs.secrets.path = "/home/julm/work/sourcephile/nix/sec";
  22 inputs.secrets.flake = false;
  23 inputs.pass.type = "path";
  24 inputs.pass.path = "/home/julm/work/sourcephile/nix/pass";
  25 inputs.pass.flake = false;
  26
  27 outputs = inputs: let
  28   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  29   localNixpkgsPatches = [
  30     nixpkgs/patches/sourcehut.diff
  31     nixpkgs/patches/systemd-coredump.diff
  32   ];
  33   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  34   nixpkgs = originPkgs.applyPatches {
  35     name = "nixpkgs-patched";
  36     src = inputs.nixpkgs;
  37     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  38     postPatch = ''
  39       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  40          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  41         sort | sha256sum | cut -c -7)
  42       echo "+patch-$patch" >.version-suffix
  43     '';
  44   };
  45   lib = originPkgs.lib;
  46   hosts = builtins.mapAttrs (hostName: hostConfig:
  47     let cfg = import hostConfig { inherit inputs hostName; }; in
  48     import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
  49       specialArgs = {
  50         inherit hostName inputs;
  51         private = "/root/private"; # Kept out of /nix/store
  52       };
  53       extraArgs = {
  54         hosts = inputs.self.nixosConfigurations;
  55         host = inputs.self.nixosConfigurations.${hostName}.extraArgs;
  56       } // (cfg.extraArgs or {});
  57       modules = cfg.modules ++ [
  58         inputs.home-manager.nixosModules.home-manager
  59         {
  60           home-manager.useGlobalPkgs = true;
  61           home-manager.useUserPackages = true;
  62           home-manager.verbose = true;
  63           home-manager.backupFileExtension = null;
  64           home-manager.extraSpecialArgs = {
  65             inherit hostName inputs;
  66           };
  67         }
  68         ({ pkgs, ... }: {
  69           nix.package = pkgs.nixUnstable;
  70           nixpkgs.overlays =
  71             import nixpkgs/overlays.nix ++
  72             import (inputs.julm-nix + "/nixpkgs/overlays.nix");
  73           system.nixos.versionSuffix = ".${
  74             lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  75             inputs.self.shortRev or "dirty"}";
  76           system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  77           # Let 'nixos-version --json' know about the Git revision of this flake.
  78           system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  79           security.gnupg.agent.enable = true;
  80           security.gnupg.store = inputs.pass + "/hosts/${hostName}";
  81           /*
  82           system.configurationRevision =
  83             if inputs.self ? rev
  84             then inputs.self.rev
  85             else throw "Refusing to build from a dirty Git tree!";
  86           */
  87           programs.ssh.knownHosts = {
  88             carotte = {
  89               hostNames = [ "carotte" "carotte.sourcephile.fr" ];
  90               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnnS0w9zm5KuWwlfJu+qEXC0asESQySPp76szyMTE3J";
  91             };
  92             mermet = {
  93               hostNames = [ "mermet" "mermet.sourcephile.fr" ];
  94               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
  95             };
  96             losurdo = {
  97               hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
  98               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
  99             };
 100           };
 101         })
 102       ];
 103     }));
 104   in
 105   {
 106     # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
 107     # Example: nix -L build .#nixosConfigurations.losurdo.config.boot.kernelPackages.kernel.configfile
 108     # Example: nix -L build .#nixosConfigurations.losurdo.pkgs.hello
 109     # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
 110     nixosConfigurations = hosts {
 111       carotte = hosts/carotte.nix;
 112       losurdo = hosts/losurdo.nix;
 113       mermet  = hosts/mermet.nix;
 114     };
 115     #nixosModule = import nixos/modules.nix;
 116   }
 117   // inputs.flake-utils.lib.eachDefaultSystem (system:
 118     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
 119     let
 120       pkgs = import nixpkgs {
 121         inherit system;
 122         overlays =
 123           import nixpkgs/overlays.nix ++
 124           import (inputs.julm-nix + "/nixpkgs/overlays.nix");
 125       };
 126     in {
 127     legacyPackages = pkgs;
 128     devShell = import ./shell.nix { inherit inputs pkgs; };
 129     apps = builtins.mapAttrs (hostName: { config, ... }: let
 130       build = config.system.build;
 131       target = "\"\${TARGET:-root@${config.networking.hostName}.${config.networking.domain}}\"";
 132       profile = "/nix/var/nix/profiles/system";
 133       in rec {
 134       # Example: nix run .#losurdo.switch
 135       "switch" = {
 136         type = "app";
 137         program = (pkgs.writeShellScript "switch" (''
 138           set -eux
 139           set -o pipefail
 140           nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
 141           nix copy --to ssh://${target} --substitute-on-destination ${build.toplevel}
 142           ${sendkeys.program}
 143           '' + lib.optionalString config.boot.initrd.network.ssh.enable ''
 144           # Send the SSH key of the initrd
 145           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 146           ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 147           # Send the Wireguard key of the initrd
 148           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 149           ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 150           '' + ''
 151           ssh ${target} \
 152             nix-env --profile '${profile}' --set '${build.toplevel}' '&&' \
 153             '${profile}'/bin/switch-to-configuration switch
 154           ''
 155         )).outPath;
 156       };
 157       # Example: nix run .#carotte.install-sd
 158       "install-sd" = {
 159         type = "app";
 160         program = (pkgs.writeShellScript "install-sd" ''
 161           export PATH="$PATH:${with pkgs; lib.makeBinPath [coreutils zstd]}"
 162           set -eux
 163           set -o pipefail
 164           nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
 165           unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
 166           sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
 167         '').outPath;
 168       };
 169       # Example: nix run .#losurdo.sendkeys
 170       "sendkeys" = {
 171         type = "app";
 172         #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
 173         program = (pkgs.writeShellScript "sendkeys" ''
 174           set -eux
 175           ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
 176         '').outPath;
 177       };
 178     }) inputs.self.nixosConfigurations;}
 179   );
 180 }