flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/0802970566becac6d5123b0b88d093121a0a4080";
   4 #inputs.nixpkgs.url = "flake:nixpkgs";
   5 inputs.flake-utils.url = "github:numtide/flake-utils";
   6 inputs.home-manager.follows = "julm-nix/home-manager";
   7 inputs.julm-nix.url = "git://git.sourcephile.fr/julm/julm-nix?ref=master";
   8 #inputs.julm-nix.url = "path:julm-nix"; # XXX: this puts the whole folder in the Nix store
   9 inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
  10 inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
  11 inputs.nix-doom-emacs.url = "github:vlaci/nix-doom-emacs";
  12 inputs.nix-doom-emacs.inputs.nixpkgs.follows = "nixpkgs";
  13 inputs.nix-doom-emacs.inputs.home-manager.follows = "home-manager";
  14 inputs.nix-doom-emacs.inputs.flake-utils.follows = "flake-utils";
  15 inputs.nix-doom-emacs.inputs.emacs-overlay.follows = "emacs-overlay";
  16 inputs.emacs-overlay.url = "github:nix-community/emacs-overlay/master";
  17 inputs.shell = { type = "path"; path = "./shell"; flake = false; };
  18 inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
  19 inputs.pass = { type = "path"; path = "./pass"; flake = false; };
  20 outputs = inputs: let
  21   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  22   localNixpkgsPatches = [
  23     nixpkgs/patches/sourcehut.diff
  24     #nixpkgs/patches/transmission.diff
  25     #nixpkgs/patches/apparmor.diff
  26     #nixpkgs/patches/ifcopenshell.diff
  27     #nixpkgs/patches/public-inbox.diff
  28     #nixpkgs/patches/zerobin.diff
  29     #nixpkgs/patches/gitolite.diff
  30     #nixpkgs/patches/tor.diff
  31     #nixpkgs/patches/freeciv.diff
  32     #nixpkgs/patches/fix-ld-nix.diff
  33     #nixpkgs/patches/fix-ld-nix-apparmor.diff
  34   ];
  35   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  36   nixpkgs = originPkgs.applyPatches {
  37     name = "nixpkgs-patched";
  38     src = inputs.nixpkgs;
  39     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  40     postPatch = ''
  41       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  42          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  43         sort | sha256sum | cut -c -7)
  44       echo "+patch-$patch" >.version-suffix
  45     '';
  46   };
  47   lib = originPkgs.lib;
  48   hosts = builtins.mapAttrs (hostName: hostConfig:
  49     let cfg = import hostConfig { inherit inputs; }; in
  50     import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
  51       extraArgs = {
  52         inherit hostName inputs;
  53         hosts = inputs.self.nixosConfigurations;
  54         host = inputs.self.nixosConfigurations.${hostName}.extraArgs;
  55       } // (cfg.extraArgs or {});
  56       modules = cfg.modules ++ [
  57         inputs.home-manager.nixosModules.home-manager
  58         {
  59           home-manager.useGlobalPkgs = true;
  60           home-manager.useUserPackages = true;
  61         }
  62         ({pkgs, ...}: {
  63           nix.registry.nixpkgs.flake = nixpkgs;
  64           nix.package = pkgs.nixUnstable;
  65           nix.extraOptions = "experimental-features = nix-command flakes";
  66           nixpkgs.overlays =
  67             import nixpkgs/overlays.nix ++
  68             import (inputs.julm-nix + "/nixpkgs/overlays.nix");
  69           system.nixos.versionSuffix = ".${
  70             lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  71             inputs.self.shortRev or "dirty"}";
  72           system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  73           # Let 'nixos-version --json' know about the Git revision of this flake.
  74           system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  75           boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
  76           security.gnupg.agent.enable = true;
  77           security.gnupg.store = inputs.pass + "/hosts/${hostName}";
  78           /*
  79           system.configurationRevision =
  80             if inputs.self ? rev
  81             then inputs.self.rev
  82             else throw "Refusing to build from a dirty Git tree!";
  83           */
  84           programs.ssh.knownHosts = {
  85             mermet = {
  86               hostNames = [ "mermet" "mermet.sourcephile.fr" ];
  87               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
  88             };
  89             losurdo = {
  90               hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
  91               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
  92             };
  93           };
  94         })
  95       ];
  96     }));
  97   in
  98   {
  99     # nix -L build .#nixosConfigurations.${hostName}.config.system.build.toplevel
 100     nixosConfigurations = hosts {
 101       losurdo = hosts/losurdo.nix;
 102       mermet  = hosts/mermet.nix;
 103     };
 104     #nixosModule = import nixos/modules.nix;
 105   }
 106   // inputs.flake-utils.lib.eachDefaultSystem (system:
 107     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
 108     let
 109       pkgs = import nixpkgs {
 110         inherit system;
 111         overlays =
 112           import nixpkgs/overlays.nix ++
 113           import (inputs.julm-nix + "/nixpkgs/overlays.nix");
 114       };
 115     in {
 116     legacyPackages = pkgs;
 117     devShell = import ./shell.nix { inherit inputs pkgs; };
 118     apps = builtins.mapAttrs (hostName: { config, ... }: let
 119       system = config.system.build.toplevel;
 120       target = "root@${config.networking.hostName}.${config.networking.domain}";
 121       profile = "/nix/var/nix/profiles/system";
 122       in rec {
 123       # Example: nix run .#losurdo.switch
 124       "switch" = {
 125         type = "app";
 126         program = (pkgs.writeShellScript "switch" ''
 127           set -eux
 128           set -o pipefail
 129           nix-store --add-root hosts/${hostName}.root --indirect --realise ${system}
 130           nix copy --to ssh://'${target}' --substitute-on-destination ${system}
 131           ${sendkeys.program}
 132           # Send the SSH key of the initrd
 133           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 134           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 135           # Send the Wireguard key of the initrd
 136           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 137           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 138           ssh '${target}' \
 139             nix-env --profile '${profile}' --set '${system}' '&&' \
 140             '${profile}'/bin/switch-to-configuration switch
 141         '').outPath;
 142       };
 143       # Example: nix run .#losurdo.sendkeys
 144       "sendkeys" = {
 145         type = "app";
 146         #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
 147         program = (pkgs.writeShellScript "sendkeys" ''
 148           set -eux
 149           ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
 150         '').outPath;
 151       };
 152     }) inputs.self.nixosConfigurations;}
 153   );
 154 }