flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 #inputs.nixpkgs.url = "github:NixOS/nixpkgs/168d1c578909dc143ba52dbed661c36e76b12b36";
   4 inputs.nixpkgs.url = "github:NixOS/nixpkgs/c06d5fa9c605d143b15cafdbbb61c7c95388d76e";
   5 #inputs.nixpkgs.url = "flake:nixpkgs";
   6 inputs.flake-utils.url = "github:numtide/flake-utils";
   7 inputs.home-manager.follows = "julm-nix/home-manager";
   8 #inputs.julm-nix.url = "git+https://git.hut.sourcephile.fr/~julm/julm-nix?ref=main";
   9 inputs.julm-nix.url = "git+file:///home/julm/work/sourcephile/nix/julm-nix?ref=main";
  10 #inputs.julm-nix.type = "path";
  11 #inputs.julm-nix.path = "/home/julm/work/sourcephile/nix/julm-nix";
  12 inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
  13 inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
  14 inputs.doom-emacs.follows = "julm-nix/doom-emacs";
  15 inputs.nix-doom-emacs.follows = "julm-nix/nix-doom-emacs";
  16 inputs.nix-doom-emacs.inputs.doom-emacs.follows = "julm-nix/doom-emacs";
  17 inputs.emacs-overlay.follows = "julm-nix/emacs-overlay";
  18 #inputs.shell = { type = "path"; path = "./shell"; flake = false; };
  19 #inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
  20 #inputs.pass = { type = "path"; path = "./pass"; flake = false; };
  21 inputs.shell.url = "path:./shell";
  22 inputs.shell.flake = false;
  23 inputs.secrets.type = "path";
  24 inputs.secrets.path = "/home/julm/work/sourcephile/nix/sec";
  25 inputs.secrets.flake = false;
  26 inputs.pass.type = "path";
  27 inputs.pass.path = "/home/julm/work/sourcephile/nix/pass";
  28 inputs.pass.flake = false;
  29
  30 outputs = inputs: let
  31   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  32   localNixpkgsPatches = [
  33     nixpkgs/patches/sourcehut.diff
  34     #nixpkgs/patches/bitmask.diff
  35     #nixpkgs/patches/systemd-coredump.diff
  36   ];
  37   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  38   nixpkgsPath = originPkgs.applyPatches {
  39     name = "nixpkgs-patched";
  40     src = inputs.nixpkgs;
  41     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  42     postPatch = ''
  43       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  44          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  45         sort | sha256sum | cut -c -7)
  46       echo "+patch-$patch" >.version-suffix
  47     '';
  48   };
  49   lib = originPkgs.lib;
  50   hosts = builtins.mapAttrs (hostName: hostConfig:
  51     let cfg = import hostConfig { inherit inputs hostName nixpkgsPath; }; in
  52     import (nixpkgsPath + "/nixos/lib/eval-config.nix") (lib.recursiveUpdate cfg {
  53       specialArgs = {
  54         inherit hostName inputs;
  55         # Encrypted using git-crypt, hence kept out of /nix/store
  56         private = "/root/private";
  57         # Encrypted using systemd-creds, hence can go into the /nix/store
  58         credentials = private/hosts + "/${hostName}/credentials";
  59       };
  60       modules = cfg.modules ++ [
  61         {
  62           config._module.args = {
  63             hosts = inputs.self.nixosConfigurations;
  64             host = inputs.self.nixosConfigurations.${hostName}._module.args;
  65           };
  66         }
  67         inputs.home-manager.nixosModules.home-manager
  68         {
  69           home-manager.useGlobalPkgs = true;
  70           home-manager.useUserPackages = true;
  71           home-manager.verbose = true;
  72           home-manager.backupFileExtension = null;
  73           home-manager.extraSpecialArgs = {
  74             inherit hostName inputs;
  75           };
  76         }
  77         ({ pkgs, ... }: {
  78           nix.package = pkgs.nixUnstable;
  79           nixpkgs.overlays =
  80             import nixpkgs/overlays.nix ++
  81             import (inputs.julm-nix + "/nixpkgs/overlays.nix");
  82           system.nixos.versionSuffix = ".${
  83             lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  84             inputs.self.shortRev or "dirty"}";
  85           system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  86           # Let 'nixos-version --json' know about the Git revision of this flake.
  87           system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  88           security.gnupg.agent.enable = true;
  89           security.gnupg.store = inputs.pass + "/hosts/${hostName}";
  90           /*
  91           system.configurationRevision =
  92             if inputs.self ? rev
  93             then inputs.self.rev
  94             else throw "Refusing to build from a dirty Git tree!";
  95           */
  96           programs.ssh.knownHosts = {
  97             carotte = {
  98               extraHostNames = [ "carotte" "carotte.sourcephile.fr" ];
  99               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnnS0w9zm5KuWwlfJu+qEXC0asESQySPp76szyMTE3J";
 100             };
 101             mermet = {
 102               extraHostNames = [ "mermet" "mermet.sourcephile.fr" ];
 103               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
 104             };
 105             losurdo = {
 106               extraHostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
 107               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
 108             };
 109           };
 110         })
 111       ];
 112     }));
 113   in
 114   {
 115     # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
 116     # Example: nix -L build .#nixosConfigurations.losurdo.config.boot.kernelPackages.kernel.configfile
 117     # Example: nix -L build .#nixosConfigurations.losurdo.pkgs.hello
 118     # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
 119     nixosConfigurations = hosts {
 120       carotte = hosts/carotte.nix;
 121       losurdo = hosts/losurdo.nix;
 122       mermet  = hosts/mermet.nix;
 123     };
 124     #nixosModule = import nixos/modules.nix;
 125   }
 126   // inputs.flake-utils.lib.eachDefaultSystem (system:
 127     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
 128     let
 129       pkgs = import nixpkgsPath {
 130         inherit system;
 131         overlays =
 132           import nixpkgs/overlays.nix ++
 133           import (inputs.julm-nix + "/nixpkgs/overlays.nix");
 134       };
 135     in {
 136     legacyPackages = pkgs;
 137     devShell = import ./shell.nix { inherit inputs pkgs; };
 138     apps = builtins.mapAttrs (hostName: { config, ... }: let
 139       build = config.system.build;
 140       target = "\"\${TARGET:-root@${config.networking.hostName}.${config.networking.domain}}\"";
 141       profile = "/nix/var/nix/profiles/system";
 142       in rec {
 143       # Example: nix run .#losurdo.switch
 144       "switch" = {
 145         type = "app";
 146         program = (pkgs.writeShellScript "switch" (''
 147           set -eux
 148           set -o pipefail
 149           nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
 150           nix copy --to ssh://${target}${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}
 151           ${sendkeys.program}
 152           '' + lib.optionalString config.boot.initrd.network.ssh.enable ''
 153           # Send the SSH key of the initrd
 154           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 155           ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 156           # Send the Wireguard key of the initrd
 157           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 158           ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 159           '' + ''
 160           ssh ${target} \
 161             nix-env --profile '${profile}' --set '${build.toplevel}' '&&' \
 162             '${profile}'/bin/switch-to-configuration switch
 163           ''
 164         )).outPath;
 165       };
 166       # Example: nix run .#carotte.install-sd
 167       "install-sd" = {
 168         type = "app";
 169         program = (pkgs.writeShellScript "install-sd" ''
 170           export PATH="$PATH:${with pkgs; lib.makeBinPath [coreutils zstd]}"
 171           set -eux
 172           set -o pipefail
 173           nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
 174           unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
 175           sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
 176         '').outPath;
 177       };
 178       # Example: nix run .#losurdo.sendkeys
 179       "sendkeys" = {
 180         type = "app";
 181         #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
 182         program = (pkgs.writeShellScript "sendkeys" ''
 183           set -eux
 184           chmod -R g-rwx,o-rwx "$PWD/secrets/hosts"
 185           rsync -ai --no-times --numeric-ids --usermap=:root --groupmap=:root --chmod=Du+rwx,Fu=r,go-rwx --delete "$PWD/secrets/hosts/${hostName}/root/" ${target}:/root/secrets
 186           trap 'git reset secrets/hosts' EXIT
 187           git rm -rf --cached --ignore-unmatch secrets/hosts # prevent copying to /nix/store
 188           ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
 189         '').outPath;
 190       };
 191     }) inputs.self.nixosConfigurations;}
 192   );
 193 }