flake.nix

   1 {
   2 # Pin down nixpkgs from github, instead of using global, system or user registries.
   3 inputs.nixpkgs.url = "github:NixOS/nixpkgs/9031057b0e6642e61c74b3e3c97b4e80a8db1dd6";
   4 #inputs.nixpkgs.url = "flake:nixpkgs";
   5 inputs.flake-utils.url = "github:numtide/flake-utils";
   6 inputs.home-manager.follows = "julm-nix/home-manager";
   7 inputs.julm-nix = { type = "path"; path = "./julm-nix"; flake = true; };
   8 inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
   9 inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
  10 inputs.shell = { type = "path"; path = "./shell"; flake = false; };
  11 inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
  12 inputs.pass = { type = "path"; path = "./pass"; flake = false; };
  13 outputs = inputs: let
  14   remoteNixpkgsPatches = import nixpkgs/patches.nix;
  15   localNixpkgsPatches = [
  16     nixpkgs/patches/apparmor.diff
  17     #nixpkgs/patches/public-inbox.diff
  18     #nixpkgs/patches/zerobin.diff
  19     #nixpkgs/patches/gitolite.diff
  20     #nixpkgs/patches/tor.diff
  21     #nixpkgs/patches/freeciv.diff
  22     #nixpkgs/patches/fix-ld-nix.diff
  23     #nixpkgs/patches/fix-ld-nix-apparmor.diff
  24   ];
  25   originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  26   nixpkgs = originPkgs.applyPatches {
  27     name = "nixpkgs-patched";
  28     src = inputs.nixpkgs;
  29     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  30     postPatch = ''
  31       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  32          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  33         sort | sha256sum | cut -c -7)
  34       echo "+patch-$patch" >.version-suffix
  35     '';
  36   };
  37   lib = originPkgs.lib;
  38   hosts = builtins.mapAttrs (hostName: hostConfig:
  39     let cfg = import hostConfig { inherit inputs; }; in
  40     import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
  41       extraArgs = {
  42         inherit hostName inputs;
  43         hosts = inputs.self.nixosConfigurations;
  44         host = inputs.self.nixosConfigurations.${hostName}.extraArgs;
  45       } // (cfg.extraArgs or {});
  46       modules = cfg.modules ++ [
  47         inputs.home-manager.nixosModules.home-manager
  48         {
  49           home-manager.useGlobalPkgs = true;
  50           home-manager.useUserPackages = true;
  51         }
  52         ({pkgs, ...}: {
  53           nix.registry.nixpkgs.flake = nixpkgs;
  54           nix.package = pkgs.nixUnstable;
  55           nix.extraOptions = "experimental-features = nix-command flakes";
  56           nixpkgs.overlays =
  57             import nixpkgs/overlays.nix ++
  58             import (inputs.julm-nix + "/nixpkgs/overlays.nix");
  59           system.nixos.versionSuffix = ".${
  60             lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  61             inputs.self.shortRev or "dirty"}";
  62           system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  63           # Let 'nixos-version --json' know about the Git revision of this flake.
  64           system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
  65           boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
  66           security.gnupg.agent.enable = true;
  67           security.gnupg.store = inputs.pass + "/hosts/${hostName}";
  68           /*
  69           system.configurationRevision =
  70             if inputs.self ? rev
  71             then inputs.self.rev
  72             else throw "Refusing to build from a dirty Git tree!";
  73           */
  74           programs.ssh.knownHosts = {
  75             mermet = {
  76               hostNames = [ "mermet" "mermet.sourcephile.fr" ];
  77               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
  78             };
  79             losurdo = {
  80               hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
  81               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
  82             };
  83           };
  84         })
  85       ];
  86     }));
  87   in
  88   {
  89     # nix -L build .#nixosConfigurations.${hostName}.config.system.build.toplevel
  90     nixosConfigurations = hosts {
  91       losurdo = hosts/losurdo.nix;
  92       mermet  = hosts/mermet.nix;
  93     };
  94     #nixosModule = import nixos/modules.nix;
  95   }
  96   // inputs.flake-utils.lib.eachDefaultSystem (system:
  97     #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
  98     let
  99       pkgs = import nixpkgs {
 100         inherit system;
 101         overlays =
 102           import nixpkgs/overlays.nix ++
 103           import (inputs.julm-nix + "/nixpkgs/overlays.nix");
 104       };
 105     in {
 106     legacyPackages = pkgs;
 107     devShell = import ./shell.nix { inherit inputs pkgs; };
 108     apps = builtins.mapAttrs (hostName: { config, ... }: let
 109       system = config.system.build.toplevel;
 110       target = "root@${config.networking.hostName}.${config.networking.domain}";
 111       profile = "/nix/var/nix/profiles/system";
 112       in rec {
 113       # Example: nix run .#losurdo.switch
 114       "switch" = {
 115         type = "app";
 116         program = (pkgs.writeShellScript "switch" ''
 117           set -eux
 118           set -o pipefail
 119           nix-store --add-root hosts/${hostName}.root --indirect --realise ${system}
 120           nix copy --to ssh://'${target}' --substitute-on-destination ${system}
 121           ${sendkeys.program}
 122           # Send the SSH key of the initrd
 123           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
 124           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
 125           # Send the Wireguard key of the initrd
 126           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
 127           ssh '${target}' install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
 128           ssh '${target}' \
 129             nix-env --profile '${profile}' --set '${system}' '&&' \
 130             '${profile}'/bin/switch-to-configuration switch
 131         '').outPath;
 132       };
 133       # Example: nix run .#losurdo.sendkeys
 134       "sendkeys" = {
 135         type = "app";
 136         #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
 137         program = (pkgs.writeShellScript "sendkeys" ''
 138           set -eux
 139           ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
 140         '').outPath;
 141       };
 142     }) inputs.self.nixosConfigurations;}
 143   );
 144 }