jackos1998
5171a10079
Rebase the fork branches and refresh nixpkgs, home-manager, and the approved ancillary inputs. Update kernel and release metadata, adapt removed package and Home Assistant options, and keep Determinate Nix on its tested nixpkgs revision to avoid duplicate Boost patches. Retire Sharry and its public endpoint because copyparty replaces it. Document the GitHub mirror gate and require real devshell and system builds in the upgrade validation workflow.
291 lines
11 KiB
Nix
291 lines
11 KiB
Nix
{
|
|
description = "System configs";
|
|
|
|
# Offer our Harmonia cache when building the flake itself, so `nix develop` / `nix build` don't
|
|
# rebuild from source. Nix reads `nixConfig` before the flake evaluates and rejects any computed
|
|
# value (imports/thunks), so these must stay literal — keep them in sync with `lib.my.c.nix.cache`.
|
|
# Consumers must trust these (accept-flake-config / a trusted user) for them to take effect.
|
|
nixConfig = {
|
|
extra-substituters = [
|
|
"https://nix-cache.nul.ie"
|
|
];
|
|
extra-trusted-public-keys = [
|
|
"nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
|
|
];
|
|
};
|
|
|
|
inputs = {
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
# libnet.url = "github:reo101/nix-lib-net";
|
|
libnetRepo = {
|
|
url = "github:oddlama/nixos-extra-modules";
|
|
flake = false;
|
|
};
|
|
devshell.url = "github:numtide/devshell";
|
|
devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
|
nixpkgs-stable.url = "nixpkgs/nixos-26.05";
|
|
nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
|
|
nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";
|
|
|
|
home-manager-unstable.url = "home-manager";
|
|
home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
home-manager-stable.url = "home-manager/release-26.05";
|
|
home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
|
|
|
|
# Determinate Nix, used as the common Nix implementation across systems, homes, the devshell and
|
|
# CI (see lib.my.c.nix). We build it ourselves (FlakeHub's cache needs auth), so it flows through
|
|
# our own Harmonia cache like everything else. Keep its tested nixpkgs pin: its packaging carries
|
|
# compatibility patches that can conflict with newer nixpkgs patches.
|
|
determinate-nix.url = "https://flakehub.com/f/DeterminateSystems/nix-src/*";
|
|
determinate-nix.inputs.nixpkgs.url = "github:NixOS/nixpkgs/4382ed2b7a6839d4280a9b386db49cbc5907414d";
|
|
|
|
# Stuff used by the flake for build / deployment
|
|
# ragenix.url = "github:yaxitech/ragenix";
|
|
ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
|
|
ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
deploy-rs.url = "github:serokell/deploy-rs";
|
|
deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Stuff used by systems
|
|
impermanence.url = "github:nix-community/impermanence";
|
|
impermanence.inputs.home-manager.follows = "home-manager-unstable";
|
|
boardie.url = "github:devplayer0/boardie";
|
|
boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
nixGL.url = "github:nix-community/nixGL";
|
|
nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
harmonia.url = "github:nix-community/harmonia";
|
|
# harmonia.url = "github:devplayer0/harmonia/cache-config-daemon-store";
|
|
harmonia.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Firmware building for the OpenWrt boxes, which aren't managed by this flake otherwise.
|
|
# `openwrt-feeds` pins the package feeds; without it, evaluation would reach the OpenWrt
|
|
# download server over import-from-derivation and break on hashes that upstream rotates daily.
|
|
openwrt-imagebuilder.url = "github:astro/nix-openwrt-imagebuilder";
|
|
openwrt-imagebuilder.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
openwrt-feeds.url = "github:devplayer0/openwrt-feeds";
|
|
openwrt-feeds.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
openwrt-feeds.inputs.openwrt-imagebuilder.follows = "openwrt-imagebuilder";
|
|
|
|
# Packages not in nixpkgs
|
|
borgthin.url = "github:devplayer0/borg";
|
|
# TODO: Update borgthin so this works
|
|
# borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
|
|
copyparty.url = "github:9001/copyparty";
|
|
copyparty.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
hass-west-wood.url = "github:devplayer0/hass-west-wood";
|
|
hass-west-wood.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
# Disabled: `pi-coding-agent-bun` breaks `nix flake check` in CI. Its bun2nix `fetchBunDeps`
|
|
# calls `builtins.filterSource` on subpaths of the pi.nix flake source (coding-agent/bun.nix),
|
|
# which requires that source derivation to be realised in the local store. On a fresh CI runner
|
|
# it isn't, so eval aborts with `path '…-source.drv' is not valid`. Works locally only because
|
|
# the source is already realised there. Re-enable (and revisit upstream) if we start using pi.
|
|
# pi-agent.url = "github:lukasl-dev/pi.nix";
|
|
# pi-agent.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
};
|
|
|
|
outputs =
|
|
inputs@{
|
|
self,
|
|
|
|
flake-utils,
|
|
|
|
nixpkgs-unstable, nixpkgs-stable, nixpkgs-mine, nixpkgs-mine-stable,
|
|
home-manager-unstable, home-manager-stable,
|
|
|
|
...
|
|
}:
|
|
let
|
|
inherit (builtins) mapAttrs replaceStrings elem;
|
|
inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
|
|
inherit (lib.flake) flattenTree eachDefaultSystem;
|
|
inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
|
|
|
|
# Extend a lib with extras that _must not_ internally reference private nixpkgs. flake-utils doesn't, but many
|
|
# other flakes (e.g. home-manager) probably do internally.
|
|
libOverlay = final: prev: {
|
|
my = import ./lib { inherit inputs; lib = final; };
|
|
flake = flake-utils.lib;
|
|
};
|
|
pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
|
|
myPkgsOverlay = final: prev: import ./pkgs { lib = final.lib; pkgs = prev; };
|
|
# Exposes Determinate Nix under a stable attr name so systems, homes and the devshell all
|
|
# resolve the exact same package (referenced as `pkgs'.mine.determinate-nix` in configs).
|
|
# `nix-util`'s `readLinkAt.works` unit test creates PATH_MAX-length symlinks, which our CI
|
|
# runner's XFS-backed build filesystem rejects (XFS hard-caps symlink targets at 1024 bytes).
|
|
# Skip just that test via gtest's GTEST_FILTER so the rest of the suite still gates the build.
|
|
determinateOverlay = final: prev: {
|
|
determinate-nix =
|
|
(inputs.determinate-nix.packages.${prev.stdenv.hostPlatform.system}.default).overrideAttrs (o: {
|
|
checkInputs = map
|
|
(drv:
|
|
if (drv.name or "") == "nix-util-tests-run"
|
|
then drv.overrideAttrs (_: { GTEST_FILTER = "-readLinkAt.*"; })
|
|
else drv)
|
|
o.checkInputs;
|
|
});
|
|
};
|
|
|
|
# Override the flake-level lib since we're going to use it for non-config specific stuff
|
|
pkgsFlakes = mapAttrs (_: pkgsFlake: pkgsFlake // { lib = pkgsFlake.lib.extend libOverlay; }) {
|
|
unstable = nixpkgs-unstable;
|
|
stable = nixpkgs-stable;
|
|
mine = nixpkgs-mine;
|
|
mine-stable = nixpkgs-mine-stable;
|
|
};
|
|
hmFlakes = rec {
|
|
unstable = home-manager-unstable;
|
|
stable = home-manager-stable;
|
|
|
|
# Don't actually have a fork right now...
|
|
mine = unstable;
|
|
mine-stable = stable;
|
|
};
|
|
|
|
# Should only be used for platform-independent flake stuff! This should never leak into a NixOS or home-manager
|
|
# config - they'll get their own.
|
|
lib = pkgsFlakes.unstable.lib;
|
|
|
|
# pkgs for dev shell etc
|
|
pkgs' = mapAttrs
|
|
(_: path: mkDefaultSystemsPkgs path (system: {
|
|
overlays = [
|
|
pkgsLibOverlay
|
|
|
|
myPkgsOverlay
|
|
determinateOverlay
|
|
inputs.devshell.overlays.default
|
|
inputs.ragenix.overlays.default
|
|
inputs.deploy-rs.overlays.default
|
|
(flakePackageOverlay inputs.home-manager-unstable system)
|
|
];
|
|
}))
|
|
pkgsFlakes;
|
|
|
|
# Easiest to build the basic pkgs here (with our lib overlay too)
|
|
configPkgs' = mapAttrs
|
|
(_: path: mkDefaultSystemsPkgs path (_: {
|
|
overlays = [
|
|
pkgsLibOverlay
|
|
|
|
myPkgsOverlay
|
|
determinateOverlay
|
|
];
|
|
|
|
config = {
|
|
# RMS forgive me...
|
|
# Normally this is set modularly, but sometimes we need to use other pkgs
|
|
allowUnfreePredicate = p: elem (lib.getName p) [
|
|
"widevine-cdm"
|
|
"chromium-unwrapped"
|
|
"chromium"
|
|
];
|
|
};
|
|
}))
|
|
pkgsFlakes;
|
|
|
|
configs = [
|
|
# Systems
|
|
nixos/installer.nix
|
|
nixos/boxes/colony
|
|
nixos/boxes/colony/portcullis
|
|
nixos/boxes/tower
|
|
nixos/boxes/home/stream.nix
|
|
nixos/boxes/home/palace
|
|
nixos/boxes/home/castle
|
|
nixos/boxes/britway
|
|
nixos/boxes/britnet.nix
|
|
nixos/boxes/kelder
|
|
|
|
# Homes
|
|
# home-manager/configs/macsimum.nix
|
|
];
|
|
|
|
nixfiles = evalModules {
|
|
modules = [
|
|
{
|
|
_module.args = {
|
|
inherit lib pkgsFlakes hmFlakes self inputs;
|
|
pkgs' = configPkgs';
|
|
};
|
|
|
|
nixos.secretsPath = ./secrets;
|
|
deploy-rs.deploy.sshOpts = [ "-i" ".keys/deploy.key" ];
|
|
}
|
|
|
|
# Not an internal part of the module system apparently, but it doesn't have any dependencies other than lib
|
|
"${pkgsFlakes.unstable}/nixos/modules/misc/assertions.nix"
|
|
|
|
./nixos
|
|
./home-manager
|
|
./deploy-rs.nix
|
|
] ++ configs;
|
|
};
|
|
in
|
|
# Platform independent stuff
|
|
{
|
|
nixpkgs = pkgs';
|
|
inherit inputs lib nixfiles;
|
|
|
|
overlays.default = myPkgsOverlay;
|
|
|
|
nixosModules = nixfiles.config.nixos.modules;
|
|
homeModules = nixfiles.config.home-manager.modules;
|
|
|
|
# Containers and the installer override `rendered` with a bare `extendModules` config
|
|
# (`my.asContainer` / `my.asISO`) that lacks the `pkgs`/`lib` attrs `eval-config` exposes on a
|
|
# normal system. Determinate Nix's flake schemas read `machine.pkgs.stdenv.system` for every
|
|
# `nixosConfigurations` entry, so re-attach them from the full system eval (`configuration`).
|
|
nixosConfigurations = mapAttrs
|
|
(_: s: s.rendered // { inherit (s.configuration) pkgs lib; })
|
|
nixfiles.config.nixos.systems;
|
|
homeConfigurations = mapAttrs (_: s: s.configuration) nixfiles.config.home-manager.homes;
|
|
|
|
deploy = nixfiles.config.deploy-rs.rendered;
|
|
} //
|
|
(eachDefaultSystem (system:
|
|
let
|
|
pkgs = pkgs'.mine.${system};
|
|
lib = pkgs.lib;
|
|
|
|
filterSystem = filterAttrs (_: c: c.config.nixpkgs.system == system);
|
|
homes =
|
|
mapAttrs
|
|
(_: h: h.activationPackage)
|
|
(filterSystem self.homeConfigurations);
|
|
systems =
|
|
mapAttrs
|
|
(_: h: h.config.system.build.toplevel)
|
|
(filterSystem self.nixosConfigurations);
|
|
shell = pkgs.devshell.mkShell ./devshell;
|
|
in
|
|
# Stuff for each platform
|
|
rec {
|
|
checks = flattenTree {
|
|
homeConfigurations = recurseIntoAttrs homes;
|
|
deploy = recurseIntoAttrs (pkgs.deploy-rs.lib.deployChecks self.deploy);
|
|
};
|
|
|
|
packages = flattenTree (
|
|
(import ./pkgs { inherit lib pkgs; }) //
|
|
(import ./openwrt { inherit pkgs inputs; }));
|
|
|
|
devShells.default = shell;
|
|
|
|
ci =
|
|
let
|
|
homes' =
|
|
mapAttrs'
|
|
(n: v: nameValuePair ''home-${replaceStrings ["@"] ["-at-"] n}'' v)
|
|
homes;
|
|
systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
|
|
packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
|
|
in
|
|
homes' // systems' // packages' // {
|
|
inherit shell;
|
|
};
|
|
ciDrv = pkgs.linkFarm "ci" ci;
|
|
}));
|
|
}
|