1
0
Fork 0
forked from pub-solar/infra
pub-solar-infra-new/flake.nix

159 lines
5.2 KiB
Nix
Raw Normal View History

2023-07-30 14:50:11 +00:00
{
inputs = {
# Track channels with commits tested and built by hydra
2023-10-28 11:27:24 +00:00
nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
unstable.url = "github:nixos/nixpkgs/nixos-unstable";
mastodon-fork.url = "github:teutat3s/nixpkgs/mastodon-4.2.1";
2023-07-30 14:50:11 +00:00
nix-darwin.url = "github:lnl7/nix-darwin/master";
nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
2023-10-28 11:27:24 +00:00
home-manager.url = "github:nix-community/home-manager/release-23.05";
2023-07-30 14:50:11 +00:00
home-manager.inputs.nixpkgs.follows = "nixpkgs";
flake-parts.url = "github:hercules-ci/flake-parts";
nixos-flake.url = "github:srid/nixos-flake";
terranix.url = "github:terranix/terranix";
terranix.inputs.nixpkgs.follows = "nixpkgs";
2023-10-27 21:06:55 +00:00
deploy-rs.url = "github:serokell/deploy-rs";
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
2023-10-28 10:38:14 +00:00
agenix.url = "github:ryantm/agenix";
agenix.inputs.nixpkgs.follows = "nixpkgs";
agenix.inputs.darwin.follows = "nix-darwin";
agenix.inputs.home-manager.follows = "home-manager";
2023-10-28 13:05:30 +00:00
keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixpkgs";
2023-07-30 14:50:11 +00:00
};
outputs = inputs@{ self, terranix, ... }:
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
2023-10-28 11:48:56 +00:00
systems = [ "x86_64-linux" "aarch64-linux" ];
2023-07-30 14:50:11 +00:00
imports = [
inputs.nixos-flake.flakeModule
2023-10-27 21:06:55 +00:00
# ./terraform.nix
./public-keys
./lib
./overlays
2023-07-30 14:50:11 +00:00
];
2023-10-28 10:38:14 +00:00
perSystem = { system, pkgs, config, ... }: {
_module.args = {
inherit inputs;
pkgs = import inputs.nixpkgs {
inherit system;
overlays = [
inputs.agenix.overlays.default
];
};
unstable = import inputs.unstable { inherit system; };
master = import inputs.master { inherit system; };
};
devShells.default = pkgs.mkShell {
buildInputs = with pkgs; [
deploy-rs
nixpkgs-fmt
agenix
cachix
editorconfig-checker
nix
nodePackages.prettier
nvfetcher
shellcheck
shfmt
treefmt
nixos-generators
];
};
};
2023-07-30 14:50:11 +00:00
flake =
let
2023-10-27 21:06:55 +00:00
username = "barkeeper";
2023-07-30 14:50:11 +00:00
system = "x86_64-linux";
2023-10-27 21:06:55 +00:00
in {
2023-07-30 14:50:11 +00:00
nixosConfigurations = {
2023-10-28 11:48:56 +00:00
nachtigall = self.nixos-flake.lib.mkLinuxSystem {
2023-07-30 14:50:11 +00:00
imports = [
2023-10-27 21:06:55 +00:00
self.nixosModules.common
./hosts/nachtigall
self.pub-solar.lib.linux.unlockZFSOnBoot
2023-07-30 14:50:11 +00:00
self.nixosModules.home-manager
2023-10-27 21:06:55 +00:00
self.nixosModules.linux
self.nixosModules.overlays
inputs.agenix.nixosModules.default
2023-07-30 14:50:11 +00:00
{
2023-10-27 21:06:55 +00:00
home-manager.users.${username} = {
2023-07-30 14:50:11 +00:00
imports = [
2023-10-27 21:06:55 +00:00
self.homeModules.common
2023-07-30 14:50:11 +00:00
];
2023-10-27 21:06:55 +00:00
home.stateVersion = "23.05";
2023-07-30 14:50:11 +00:00
};
}
];
};
};
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
2023-07-30 14:50:11 +00:00
nixosModules = {
# Common nixos/nix-darwin configuration shared between Linux and macOS.
common = { pkgs, ... }: {
2023-10-27 21:06:55 +00:00
virtualisation.docker.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
2023-10-28 10:01:48 +00:00
services.openssh.settings.PasswordAuthentication = false;
2023-07-30 14:50:11 +00:00
};
2023-10-27 21:06:55 +00:00
2023-07-30 14:50:11 +00:00
# NixOS specific configuration
linux = { pkgs, ... }: {
2023-10-27 21:06:55 +00:00
users.users.${username} = {
name = username;
group = username;
extraGroups = ["wheel"];
isNormalUser = true;
openssh.authorizedKeys.keys = self.publicKeys.allAdmins;
};
users.groups.${username} = {};
security.sudo.wheelNeedsPassword = false;
nix.settings.trusted-users = [ "root" username ];
# TODO: Remove when we stop locking ourselves out.
users.users.root.openssh.authorizedKeys.keys = self.publicKeys.allAdmins;
2023-07-30 14:50:11 +00:00
};
};
# All home-manager configurations are kept here.
homeModules = {
# Common home-manager configuration shared between Linux and macOS.
common = { pkgs, ... }: {
programs.git.enable = true;
programs.starship.enable = true;
programs.bash.enable = true;
2023-10-27 21:06:55 +00:00
programs.neovim = {
enable = true;
vimAlias = true;
viAlias = true;
defaultEditor = true;
# configure = {
# packages.myVimPackages = with pkgs.vimPlugins; {
# start = [vim-nix vim-surrund rainbow];
# };
# };
};
2023-07-30 14:50:11 +00:00
};
2023-10-27 21:06:55 +00:00
};
deploy.nodes = self.pub-solar.lib.deploy.mkDeployNodes self.nixosConfigurations {
nachtigall = {
sshUser = username;
2023-07-30 14:50:11 +00:00
};
};
};
};
}