flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/6625284c397b44bc9518a5a1567c1b5aae455c08";
   4 #inputs.nixpkgs.url = "flake:nixpkgs";
   5 inputs.flake-utils.url = "github:numtide/flake-utils";
   6 inputs.shell = { type = "path"; path = "./shell"; flake = false; };
   7 inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
   8 inputs.pass = { type = "path"; path = "./pass"; flake = false; };
   9 outputs = inputs: let
  10   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  11   localNixpkgsPatches = [
  12     nixpkgs/patches/apparmor.diff
  13
  14     #nixpkgs/patches/public-inbox.diff
  15     #nixpkgs/patches/zerobin.diff
  16     #nixpkgs/patches/gitolite.diff
  17     #nixpkgs/patches/tor.diff
  18     #nixpkgs/patches/fix-ld-nix.diff
  19     #nixpkgs/patches/fix-ld-nix-apparmor.diff
  20   ];
  21   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  22   nixpkgs = originPkgs.applyPatches {
  23     name = "nixpkgs-patched";
  24     src = inputs.nixpkgs;
  25     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  26     postPatch = ''
  27       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  28          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  29         sort | sha256sum | cut -c -7)
  30       echo "+patch-$patch" >.version-suffix
  31     '';
  32   };
  33   lib = originPkgs.lib;
  34   machines = builtins.mapAttrs (machineName: machineConfig:
  35     let cfg = import machineConfig { inherit inputs; }; in
  36     import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
  37       extraArgs = {
  38         inherit machineName inputs;
  39         machines = inputs.self.nixosConfigurations;
  40       } // (cfg.extraArgs or {});
  41       modules = cfg.modules ++ [({pkgs, ...}: {
  42         nix.registry.nixpkgs.flake = nixpkgs;
  43         nix.package = pkgs.nixFlakes;
  44         nix.extraOptions = "experimental-features = nix-command flakes";
  45         nixpkgs.overlays = import nixpkgs/overlays.nix;
  46         system.nixos.versionSuffix = ".${
  47           lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  48           inputs.self.shortRev or "dirty"}";
  49         system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  50         # Let 'nixos-version --json' know about the Git revision of this flake.
  51         system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  52         boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
  53         security.gnupg.store = inputs.pass + "/machines/${machineName}";
  54         /*
  55         system.configurationRevision =
  56           if inputs.self ? rev
  57           then inputs.self.rev
  58           else throw "Refusing to build from a dirty Git tree!";
  59         */
  60         programs.ssh.knownHosts = {
  61           mermet = {
  62             hostNames = [ "mermet" "mermet.sourcephile.fr" ];
  63             publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
  64           };
  65           losurdo = {
  66             hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
  67             publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
  68           };
  69         };
  70       })];
  71     }));
  72   in
  73   {
  74     # nix -L build .#nixosConfigurations.${machineName}.config.system.build.toplevel
  75     nixosConfigurations = machines {
  76       losurdo = machines/losurdo.nix;
  77       mermet  = machines/mermet.nix;
  78     };
  79   }
  80   // inputs.flake-utils.lib.eachDefaultSystem (system:
  81     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
  82     let
  83       pkgs = import nixpkgs {
  84         inherit system;
  85         overlays = import nixpkgs/overlays.nix;
  86       };
  87     in {
  88     legacyPackages = pkgs;
  89     devShell = import ./shell.nix { inherit inputs pkgs; };
  90     apps = builtins.mapAttrs (machineName: { config, ... }: let
  91       system = config.system.build.toplevel;
  92       keygrip = builtins.getAttr machineName {
  93         losurdo = "9AA84E6F6D71F9163C46BF396B141A0806219077";
  94         mermet  = "89F52A879E0019A966503AFFDE72EEA84CDFA3A7";
  95       };
  96       target = "root@${config.networking.hostName}.${config.networking.domain}";
  97       profile = "/nix/var/nix/profiles/system";
  98       in rec {
  99       # Example: nix run .#losurdo.switch
 100       "switch" = {
 101         type = "app";
 102         program = (pkgs.writeShellScript "switch" ''
 103           set -eux
 104           set -o pipefail
 105           nix-store --add-root machines/${machineName}.root --indirect --realise ${system}
 106           nix copy --to ssh://'${target}' --substitute-on-destination ${system}
 107           ${sendkeys.program}
 108           # Send the SSH key of the initrd
 109           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 110           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 111           # Send the Wireguard key of the initrd
 112           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 113           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 114           ssh '${target}' \
 115             nix-env --profile '${profile}' --set '${system}' '&&' \
 116             '${profile}'/bin/switch-to-configuration switch
 117         '').outPath;
 118       };
 119       # Example: nix run .#losurdo.sendkeys
 120       "sendkeys" = {
 121         type = "app";
 122         program = (pkgs.writeShellScript "sendkeys" ''
 123           set -eux
 124           set -o pipefail
 125           ssh '${target}' \
 126             gpg-connect-agent --no-autostart --homedir /var/lib/gnupg "'keyinfo --list'" /bye 2>&1 |
 127           grep -qx -e "gpg-connect-agent: no gpg-agent running in this session" \
 128                    -e "S KEYINFO ${keygrip} . . . 1 .*" || {
 129             # Send the GnuPG root key
 130             gpg --decrypt '${config.security.gnupg.store}/root/key.pass.gpg' |
 131             gpg --batch --pinentry-mode loopback --passphrase-fd 0 --export-secret-subkeys @root@${machineName} |
 132             ssh '${target}' \
 133               gpg --no-autostart --homedir /var/lib/gnupg --no-autostart --batch --pinentry-mode loopback --import
 134
 135             # Send the GnuPG root key's passphrase
 136             gpg --decrypt '${config.security.gnupg.store}/root/key.pass.gpg' |
 137             ssh '${target}' \
 138               gpg-preset-passphrase --homedir /var/lib/gnupg --preset ${keygrip}
 139           }
 140         '').outPath;
 141       };
 142     }) inputs.self.nixosConfigurations;}
 143   );
 144 }