flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/2b24fa4db8e5f4e3b3873d020b9cd2d3111005af";
   4 #inputs.nixpkgs.url = "flake:nixpkgs";
   5 inputs.flake-utils.url = "github:numtide/flake-utils";
   6 inputs.home-manager.follows = "julm-nix/home-manager";
   7 inputs.julm-nix.url = "git+https://git.hut.sourcephile.fr/~julm/julm-nix?ref=main";
   8 #inputs.julm-nix.url = "path:julm-nix"; # XXX: this puts the whole folder in the Nix store
   9 inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
  10 inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
  11 inputs.nix-doom-emacs.follows = "julm-nix/nix-doom-emacs";
  12 inputs.emacs-overlay.follows = "julm-nix/emacs-overlay";
  13 inputs.shell = { type = "path"; path = "./shell"; flake = false; };
  14 inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
  15 inputs.pass = { type = "path"; path = "./pass"; flake = false; };
  16 outputs = inputs: let
  17   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  18   localNixpkgsPatches = [
  19     nixpkgs/patches/sourcehut.diff
  20   ];
  21   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  22   nixpkgs = originPkgs.applyPatches {
  23     name = "nixpkgs-patched";
  24     src = inputs.nixpkgs;
  25     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  26     postPatch = ''
  27       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  28          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  29         sort | sha256sum | cut -c -7)
  30       echo "+patch-$patch" >.version-suffix
  31     '';
  32   };
  33   lib = originPkgs.lib;
  34   hosts = builtins.mapAttrs (hostName: hostConfig:
  35     let cfg = import hostConfig { inherit inputs hostName; }; in
  36     import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
  37       extraArgs = {
  38         inherit hostName inputs;
  39         hosts = inputs.self.nixosConfigurations;
  40         host = inputs.self.nixosConfigurations.${hostName}.extraArgs;
  41         private = "/root/private"; # Kept out of /nix/store
  42       } // (cfg.extraArgs or {});
  43       modules = cfg.modules ++ [
  44         inputs.home-manager.nixosModules.home-manager
  45         {
  46           home-manager.useGlobalPkgs = true;
  47           home-manager.useUserPackages = true;
  48           home-manager.verbose = true;
  49           home-manager.backupFileExtension = null;
  50           home-manager.extraSpecialArgs = {
  51             inherit hostName;
  52           };
  53         }
  54         ({pkgs, ...}: {
  55           nix.registry.nixpkgs.flake = nixpkgs;
  56           nix.package = pkgs.nixUnstable;
  57           nix.extraOptions = "experimental-features = nix-command flakes";
  58           nixpkgs.overlays =
  59             import nixpkgs/overlays.nix ++
  60             import (inputs.julm-nix + "/nixpkgs/overlays.nix");
  61           system.nixos.versionSuffix = ".${
  62             lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  63             inputs.self.shortRev or "dirty"}";
  64           system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  65           # Let 'nixos-version --json' know about the Git revision of this flake.
  66           system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  67           boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
  68           security.gnupg.agent.enable = true;
  69           security.gnupg.store = inputs.pass + "/hosts/${hostName}";
  70           /*
  71           system.configurationRevision =
  72             if inputs.self ? rev
  73             then inputs.self.rev
  74             else throw "Refusing to build from a dirty Git tree!";
  75           */
  76           programs.ssh.knownHosts = {
  77             mermet = {
  78               hostNames = [ "mermet" "mermet.sourcephile.fr" ];
  79               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
  80             };
  81             losurdo = {
  82               hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
  83               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
  84             };
  85           };
  86         })
  87       ];
  88     }));
  89   in
  90   {
  91     # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
  92     # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
  93     nixosConfigurations = hosts {
  94       losurdo = hosts/losurdo.nix;
  95       mermet  = hosts/mermet.nix;
  96     };
  97     #nixosModule = import nixos/modules.nix;
  98   }
  99   // inputs.flake-utils.lib.eachDefaultSystem (system:
 100     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
 101     let
 102       pkgs = import nixpkgs {
 103         inherit system;
 104         overlays =
 105           import nixpkgs/overlays.nix ++
 106           import (inputs.julm-nix + "/nixpkgs/overlays.nix");
 107       };
 108     in {
 109     legacyPackages = pkgs;
 110     devShell = import ./shell.nix { inherit inputs pkgs; };
 111     apps = builtins.mapAttrs (hostName: { config, ... }: let
 112       system = config.system.build.toplevel;
 113       target = "root@${config.networking.hostName}.${config.networking.domain}";
 114       profile = "/nix/var/nix/profiles/system";
 115       in rec {
 116       # Example: nix run .#losurdo.switch
 117       "switch" = {
 118         type = "app";
 119         program = (pkgs.writeShellScript "switch" ''
 120           set -eux
 121           set -o pipefail
 122           nix-store --add-root hosts/${hostName}.root --indirect --realise ${system}
 123           nix copy --to ssh://'${target}' --substitute-on-destination ${system}
 124           ${sendkeys.program}
 125           # Send the SSH key of the initrd
 126           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 127           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 128           # Send the Wireguard key of the initrd
 129           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 130           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 131           ssh '${target}' \
 132             nix-env --profile '${profile}' --set '${system}' '&&' \
 133             '${profile}'/bin/switch-to-configuration switch
 134         '').outPath;
 135       };
 136       # Example: nix run .#losurdo.sendkeys
 137       "sendkeys" = {
 138         type = "app";
 139         #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
 140         program = (pkgs.writeShellScript "sendkeys" ''
 141           set -eux
 142           ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
 143         '').outPath;
 144       };
 145     }) inputs.self.nixosConfigurations;}
 146   );
 147 }