jackos1998
4281aa9234
Configure the Numtide substituter and signing key in the shared cache settings and flake configuration so Codex can use prebuilt binaries. Document the cache and retain the input’s tested nixpkgs pin.
295 lines
12 KiB
Nix
295 lines
12 KiB
Nix
{
|
|
description = "System configs";
|
|
|
|
# Offer our Harmonia and Numtide caches when building the flake, so `nix develop` / `nix build` don't
|
|
# rebuild from source. Nix reads `nixConfig` before the flake evaluates and rejects any computed
|
|
# value (imports/thunks), so these must stay literal — keep them in sync with `lib.my.c.nix.cache`.
|
|
# Consumers must trust these (accept-flake-config / a trusted user) for them to take effect.
|
|
nixConfig = {
|
|
extra-substituters = [
|
|
"https://nix-cache.nul.ie"
|
|
"https://cache.numtide.com"
|
|
];
|
|
extra-trusted-public-keys = [
|
|
"nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
|
|
"niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
|
|
];
|
|
};
|
|
|
|
inputs = {
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
# libnet.url = "github:reo101/nix-lib-net";
|
|
libnetRepo = {
|
|
url = "github:oddlama/nixos-extra-modules";
|
|
flake = false;
|
|
};
|
|
devshell.url = "github:numtide/devshell";
|
|
devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
|
nixpkgs-stable.url = "nixpkgs/nixos-26.05";
|
|
nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
|
|
nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";
|
|
|
|
home-manager-unstable.url = "home-manager";
|
|
home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
home-manager-stable.url = "home-manager/release-26.05";
|
|
home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
|
|
|
|
# Determinate Nix, used as the common Nix implementation across systems, homes, the devshell and
|
|
# CI (see lib.my.c.nix). We build it ourselves (FlakeHub's cache needs auth), so it flows through
|
|
# our own Harmonia cache like everything else. Keep its tested nixpkgs pin: its packaging carries
|
|
# compatibility patches that can conflict with newer nixpkgs patches.
|
|
determinate-nix.url = "https://flakehub.com/f/DeterminateSystems/nix-src/*";
|
|
determinate-nix.inputs.nixpkgs.url = "github:NixOS/nixpkgs/4382ed2b7a6839d4280a9b386db49cbc5907414d";
|
|
|
|
# Stuff used by the flake for build / deployment
|
|
# ragenix.url = "github:yaxitech/ragenix";
|
|
ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
|
|
ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
deploy-rs.url = "github:serokell/deploy-rs";
|
|
deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Stuff used by systems
|
|
impermanence.url = "github:nix-community/impermanence";
|
|
impermanence.inputs.home-manager.follows = "home-manager-unstable";
|
|
boardie.url = "github:devplayer0/boardie";
|
|
boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
nixGL.url = "github:nix-community/nixGL";
|
|
nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
harmonia.url = "github:nix-community/harmonia";
|
|
# harmonia.url = "github:devplayer0/harmonia/cache-config-daemon-store";
|
|
harmonia.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Firmware building for the OpenWrt boxes, which aren't managed by this flake otherwise.
|
|
# `openwrt-feeds` pins the package feeds; without it, evaluation would reach the OpenWrt
|
|
# download server over import-from-derivation and break on hashes that upstream rotates daily.
|
|
openwrt-imagebuilder.url = "github:astro/nix-openwrt-imagebuilder";
|
|
openwrt-imagebuilder.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
openwrt-feeds.url = "github:devplayer0/openwrt-feeds";
|
|
openwrt-feeds.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
openwrt-feeds.inputs.openwrt-imagebuilder.follows = "openwrt-imagebuilder";
|
|
|
|
# Packages not in nixpkgs
|
|
# Keep its tested nixpkgs pin so packages can use the upstream binary cache.
|
|
llm-agents.url = "github:numtide/llm-agents.nix";
|
|
borgthin.url = "github:devplayer0/borg";
|
|
# TODO: Update borgthin so this works
|
|
# borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
|
|
copyparty.url = "github:9001/copyparty";
|
|
copyparty.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
hass-west-wood.url = "github:devplayer0/hass-west-wood";
|
|
hass-west-wood.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
# Disabled: `pi-coding-agent-bun` breaks `nix flake check` in CI. Its bun2nix `fetchBunDeps`
|
|
# calls `builtins.filterSource` on subpaths of the pi.nix flake source (coding-agent/bun.nix),
|
|
# which requires that source derivation to be realised in the local store. On a fresh CI runner
|
|
# it isn't, so eval aborts with `path '…-source.drv' is not valid`. Works locally only because
|
|
# the source is already realised there. Re-enable (and revisit upstream) if we start using pi.
|
|
# pi-agent.url = "github:lukasl-dev/pi.nix";
|
|
# pi-agent.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
};
|
|
|
|
outputs =
|
|
inputs@{
|
|
self,
|
|
|
|
flake-utils,
|
|
|
|
nixpkgs-unstable, nixpkgs-stable, nixpkgs-mine, nixpkgs-mine-stable,
|
|
home-manager-unstable, home-manager-stable,
|
|
|
|
...
|
|
}:
|
|
let
|
|
inherit (builtins) mapAttrs replaceStrings elem;
|
|
inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
|
|
inherit (lib.flake) flattenTree eachDefaultSystem;
|
|
inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
|
|
|
|
# Extend a lib with extras that _must not_ internally reference private nixpkgs. flake-utils doesn't, but many
|
|
# other flakes (e.g. home-manager) probably do internally.
|
|
libOverlay = final: prev: {
|
|
my = import ./lib { inherit inputs; lib = final; };
|
|
flake = flake-utils.lib;
|
|
};
|
|
pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
|
|
myPkgsOverlay = final: prev: import ./pkgs { lib = final.lib; pkgs = prev; };
|
|
# Exposes Determinate Nix under a stable attr name so systems, homes and the devshell all
|
|
# resolve the exact same package (referenced as `pkgs'.mine.determinate-nix` in configs).
|
|
# `nix-util`'s `readLinkAt.works` unit test creates PATH_MAX-length symlinks, which our CI
|
|
# runner's XFS-backed build filesystem rejects (XFS hard-caps symlink targets at 1024 bytes).
|
|
# Skip just that test via gtest's GTEST_FILTER so the rest of the suite still gates the build.
|
|
determinateOverlay = final: prev: {
|
|
determinate-nix =
|
|
(inputs.determinate-nix.packages.${prev.stdenv.hostPlatform.system}.default).overrideAttrs (o: {
|
|
checkInputs = map
|
|
(drv:
|
|
if (drv.name or "") == "nix-util-tests-run"
|
|
then drv.overrideAttrs (_: { GTEST_FILTER = "-readLinkAt.*"; })
|
|
else drv)
|
|
o.checkInputs;
|
|
});
|
|
};
|
|
|
|
# Override the flake-level lib since we're going to use it for non-config specific stuff
|
|
pkgsFlakes = mapAttrs (_: pkgsFlake: pkgsFlake // { lib = pkgsFlake.lib.extend libOverlay; }) {
|
|
unstable = nixpkgs-unstable;
|
|
stable = nixpkgs-stable;
|
|
mine = nixpkgs-mine;
|
|
mine-stable = nixpkgs-mine-stable;
|
|
};
|
|
hmFlakes = rec {
|
|
unstable = home-manager-unstable;
|
|
stable = home-manager-stable;
|
|
|
|
# Don't actually have a fork right now...
|
|
mine = unstable;
|
|
mine-stable = stable;
|
|
};
|
|
|
|
# Should only be used for platform-independent flake stuff! This should never leak into a NixOS or home-manager
|
|
# config - they'll get their own.
|
|
lib = pkgsFlakes.unstable.lib;
|
|
|
|
# pkgs for dev shell etc
|
|
pkgs' = mapAttrs
|
|
(_: path: mkDefaultSystemsPkgs path (system: {
|
|
overlays = [
|
|
pkgsLibOverlay
|
|
|
|
myPkgsOverlay
|
|
determinateOverlay
|
|
inputs.devshell.overlays.default
|
|
inputs.ragenix.overlays.default
|
|
inputs.deploy-rs.overlays.default
|
|
(flakePackageOverlay inputs.home-manager-unstable system)
|
|
];
|
|
}))
|
|
pkgsFlakes;
|
|
|
|
# Easiest to build the basic pkgs here (with our lib overlay too)
|
|
configPkgs' = mapAttrs
|
|
(_: path: mkDefaultSystemsPkgs path (_: {
|
|
overlays = [
|
|
pkgsLibOverlay
|
|
|
|
myPkgsOverlay
|
|
determinateOverlay
|
|
];
|
|
|
|
config = {
|
|
# RMS forgive me...
|
|
# Normally this is set modularly, but sometimes we need to use other pkgs
|
|
allowUnfreePredicate = p: elem (lib.getName p) [
|
|
"widevine-cdm"
|
|
"chromium-unwrapped"
|
|
"chromium"
|
|
];
|
|
};
|
|
}))
|
|
pkgsFlakes;
|
|
|
|
configs = [
|
|
# Systems
|
|
nixos/installer.nix
|
|
nixos/boxes/colony
|
|
nixos/boxes/colony/portcullis
|
|
nixos/boxes/tower
|
|
nixos/boxes/home/stream.nix
|
|
nixos/boxes/home/palace
|
|
nixos/boxes/home/castle
|
|
nixos/boxes/britway
|
|
nixos/boxes/britnet.nix
|
|
nixos/boxes/kelder
|
|
|
|
# Homes
|
|
# home-manager/configs/macsimum.nix
|
|
];
|
|
|
|
nixfiles = evalModules {
|
|
modules = [
|
|
{
|
|
_module.args = {
|
|
inherit lib pkgsFlakes hmFlakes self inputs;
|
|
pkgs' = configPkgs';
|
|
};
|
|
|
|
nixos.secretsPath = ./secrets;
|
|
deploy-rs.deploy.sshOpts = [ "-i" ".keys/deploy.key" ];
|
|
}
|
|
|
|
# Not an internal part of the module system apparently, but it doesn't have any dependencies other than lib
|
|
"${pkgsFlakes.unstable}/nixos/modules/misc/assertions.nix"
|
|
|
|
./nixos
|
|
./home-manager
|
|
./deploy-rs.nix
|
|
] ++ configs;
|
|
};
|
|
in
|
|
# Platform independent stuff
|
|
{
|
|
nixpkgs = pkgs';
|
|
inherit inputs lib nixfiles;
|
|
|
|
overlays.default = myPkgsOverlay;
|
|
|
|
nixosModules = nixfiles.config.nixos.modules;
|
|
homeModules = nixfiles.config.home-manager.modules;
|
|
|
|
# Containers and the installer override `rendered` with a bare `extendModules` config
|
|
# (`my.asContainer` / `my.asISO`) that lacks the `pkgs`/`lib` attrs `eval-config` exposes on a
|
|
# normal system. Determinate Nix's flake schemas read `machine.pkgs.stdenv.system` for every
|
|
# `nixosConfigurations` entry, so re-attach them from the full system eval (`configuration`).
|
|
nixosConfigurations = mapAttrs
|
|
(_: s: s.rendered // { inherit (s.configuration) pkgs lib; })
|
|
nixfiles.config.nixos.systems;
|
|
homeConfigurations = mapAttrs (_: s: s.configuration) nixfiles.config.home-manager.homes;
|
|
|
|
deploy = nixfiles.config.deploy-rs.rendered;
|
|
} //
|
|
(eachDefaultSystem (system:
|
|
let
|
|
pkgs = pkgs'.mine.${system};
|
|
lib = pkgs.lib;
|
|
|
|
filterSystem = filterAttrs (_: c: c.config.nixpkgs.system == system);
|
|
homes =
|
|
mapAttrs
|
|
(_: h: h.activationPackage)
|
|
(filterSystem self.homeConfigurations);
|
|
systems =
|
|
mapAttrs
|
|
(_: h: h.config.system.build.toplevel)
|
|
(filterSystem self.nixosConfigurations);
|
|
shell = pkgs.devshell.mkShell ./devshell;
|
|
in
|
|
# Stuff for each platform
|
|
rec {
|
|
checks = flattenTree {
|
|
homeConfigurations = recurseIntoAttrs homes;
|
|
deploy = recurseIntoAttrs (pkgs.deploy-rs.lib.deployChecks self.deploy);
|
|
};
|
|
|
|
packages = flattenTree (
|
|
(import ./pkgs { inherit lib pkgs; }) //
|
|
(import ./openwrt { inherit pkgs inputs; }));
|
|
|
|
devShells.default = shell;
|
|
|
|
ci =
|
|
let
|
|
homes' =
|
|
mapAttrs'
|
|
(n: v: nameValuePair ''home-${replaceStrings ["@"] ["-at-"] n}'' v)
|
|
homes;
|
|
systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
|
|
packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
|
|
in
|
|
homes' // systems' // packages' // {
|
|
inherit shell;
|
|
};
|
|
ciDrv = pkgs.linkFarm "ci" ci;
|
|
}));
|
|
}
|