jackos1998
7fe3c8186c
Use Determinate Nix as `nix.package` for systems, homes and the devshell, for its parallel evaluation and lazy trees. We only take the package, not `determinate-nixd`: the daemon and `nix.conf` model are unchanged and the Determinate NixOS module is not imported. - Add the `determinate-nix` (`nix-src`) input, following our `nixpkgs-unstable`. FlakeHub's cache needs auth, so we build it ourselves and let it flow through Harmonia like everything else. - `determinateOverlay` exposes it as `pkgs'.mine.determinate-nix`; `lib.my.c.nix.determinateSettings` (`lazy-trees`, `eval-cores = 0`) is merged into `nix.settings` and the devshell `nix.conf`. - Switch CI to `DeterminateSystems/determinate-nix-action` so the runner itself evaluates with Determinate. - Advertise the Harmonia cache via the flake's `nixConfig`, trusted without a prompt via `accept-flake-config` in the devshell, `.envrc` and CI only (boxes already trust it through `nix.settings`). - Re-attach `pkgs`/`lib` to container and installer `nixosConfigurations` so Determinate's flake schemas can evaluate them (`nix flake check` otherwise fails with `attribute 'pkgs' missing`). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
269 lines
10 KiB
Nix
269 lines
10 KiB
Nix
{
|
|
description = "System configs";
|
|
|
|
# Offer our Harmonia cache when building the flake itself, so `nix develop` / `nix build` don't
|
|
# rebuild from source. Nix reads `nixConfig` before the flake evaluates and rejects any computed
|
|
# value (imports/thunks), so these must stay literal — keep them in sync with `lib.my.c.nix.cache`.
|
|
# Consumers must trust these (accept-flake-config / a trusted user) for them to take effect.
|
|
nixConfig = {
|
|
extra-substituters = [
|
|
"https://nix-cache.nul.ie"
|
|
];
|
|
extra-trusted-public-keys = [
|
|
"nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
|
|
];
|
|
};
|
|
|
|
inputs = {
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
# libnet.url = "github:reo101/nix-lib-net";
|
|
libnetRepo = {
|
|
url = "github:oddlama/nixos-extra-modules";
|
|
flake = false;
|
|
};
|
|
devshell.url = "github:numtide/devshell";
|
|
devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
|
nixpkgs-stable.url = "nixpkgs/nixos-26.05";
|
|
nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
|
|
nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";
|
|
|
|
home-manager-unstable.url = "home-manager";
|
|
home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
home-manager-stable.url = "home-manager/release-26.05";
|
|
home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
|
|
|
|
# Determinate Nix, used as the common Nix implementation across systems, homes, the devshell and
|
|
# CI (see lib.my.c.nix). We build it ourselves against our pinned nixpkgs (FlakeHub's cache needs
|
|
# auth), so it flows through our own Harmonia cache like everything else.
|
|
determinate-nix.url = "https://flakehub.com/f/DeterminateSystems/nix-src/*";
|
|
determinate-nix.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Stuff used by the flake for build / deployment
|
|
# ragenix.url = "github:yaxitech/ragenix";
|
|
ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
|
|
ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
deploy-rs.url = "github:serokell/deploy-rs";
|
|
deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Stuff used by systems
|
|
impermanence.url = "github:nix-community/impermanence";
|
|
impermanence.inputs.home-manager.follows = "home-manager-unstable";
|
|
boardie.url = "github:devplayer0/boardie";
|
|
boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
nixGL.url = "github:nix-community/nixGL";
|
|
nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
harmonia.url = "github:nix-community/harmonia";
|
|
# harmonia.url = "github:devplayer0/harmonia/cache-config-daemon-store";
|
|
harmonia.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
|
|
# Packages not in nixpkgs
|
|
sharry.url = "github:eikek/sharry";
|
|
sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
borgthin.url = "github:devplayer0/borg";
|
|
# TODO: Update borgthin so this works
|
|
# borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
|
|
copyparty.url = "github:9001/copyparty";
|
|
copyparty.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
hass-west-wood.url = "github:devplayer0/hass-west-wood";
|
|
hass-west-wood.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
# Disabled: `pi-coding-agent-bun` breaks `nix flake check` in CI. Its bun2nix `fetchBunDeps`
|
|
# calls `builtins.filterSource` on subpaths of the pi.nix flake source (coding-agent/bun.nix),
|
|
# which requires that source derivation to be realised in the local store. On a fresh CI runner
|
|
# it isn't, so eval aborts with `path '…-source.drv' is not valid`. Works locally only because
|
|
# the source is already realised there. Re-enable (and revisit upstream) if we start using pi.
|
|
# pi-agent.url = "github:lukasl-dev/pi.nix";
|
|
# pi-agent.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
};
|
|
|
|
outputs =
|
|
inputs@{
|
|
self,
|
|
|
|
flake-utils,
|
|
|
|
nixpkgs-unstable, nixpkgs-stable, nixpkgs-mine, nixpkgs-mine-stable,
|
|
home-manager-unstable, home-manager-stable,
|
|
|
|
...
|
|
}:
|
|
let
|
|
inherit (builtins) mapAttrs replaceStrings elem;
|
|
inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
|
|
inherit (lib.flake) flattenTree eachDefaultSystem;
|
|
inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
|
|
|
|
# Extend a lib with extras that _must not_ internally reference private nixpkgs. flake-utils doesn't, but many
|
|
# other flakes (e.g. home-manager) probably do internally.
|
|
libOverlay = final: prev: {
|
|
my = import ./lib { inherit inputs; lib = final; };
|
|
flake = flake-utils.lib;
|
|
};
|
|
pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
|
|
myPkgsOverlay = final: prev: import ./pkgs { lib = final.lib; pkgs = prev; };
|
|
# Exposes Determinate Nix under a stable attr name so systems, homes and the devshell all
|
|
# resolve the exact same package (referenced as `pkgs'.mine.determinate-nix` in configs).
|
|
determinateOverlay = final: prev: {
|
|
determinate-nix = inputs.determinate-nix.packages.${prev.stdenv.hostPlatform.system}.default;
|
|
};
|
|
|
|
# Override the flake-level lib since we're going to use it for non-config specific stuff
|
|
pkgsFlakes = mapAttrs (_: pkgsFlake: pkgsFlake // { lib = pkgsFlake.lib.extend libOverlay; }) {
|
|
unstable = nixpkgs-unstable;
|
|
stable = nixpkgs-stable;
|
|
mine = nixpkgs-mine;
|
|
mine-stable = nixpkgs-mine-stable;
|
|
};
|
|
hmFlakes = rec {
|
|
unstable = home-manager-unstable;
|
|
stable = home-manager-stable;
|
|
|
|
# Don't actually have a fork right now...
|
|
mine = unstable;
|
|
mine-stable = stable;
|
|
};
|
|
|
|
# Should only be used for platform-independent flake stuff! This should never leak into a NixOS or home-manager
|
|
# config - they'll get their own.
|
|
lib = pkgsFlakes.unstable.lib;
|
|
|
|
# pkgs for dev shell etc
|
|
pkgs' = mapAttrs
|
|
(_: path: mkDefaultSystemsPkgs path (system: {
|
|
overlays = [
|
|
pkgsLibOverlay
|
|
|
|
myPkgsOverlay
|
|
determinateOverlay
|
|
inputs.devshell.overlays.default
|
|
inputs.ragenix.overlays.default
|
|
inputs.deploy-rs.overlays.default
|
|
(flakePackageOverlay inputs.home-manager-unstable system)
|
|
];
|
|
}))
|
|
pkgsFlakes;
|
|
|
|
# Easiest to build the basic pkgs here (with our lib overlay too)
|
|
configPkgs' = mapAttrs
|
|
(_: path: mkDefaultSystemsPkgs path (_: {
|
|
overlays = [
|
|
pkgsLibOverlay
|
|
|
|
myPkgsOverlay
|
|
determinateOverlay
|
|
];
|
|
|
|
config = {
|
|
# RMS forgive me...
|
|
# Normally this is set modularly, but sometimes we need to use other pkgs
|
|
allowUnfreePredicate = p: elem (lib.getName p) [
|
|
"widevine-cdm"
|
|
"chromium-unwrapped"
|
|
"chromium"
|
|
];
|
|
};
|
|
}))
|
|
pkgsFlakes;
|
|
|
|
configs = [
|
|
# Systems
|
|
nixos/installer.nix
|
|
nixos/boxes/colony
|
|
nixos/boxes/tower
|
|
nixos/boxes/home/stream.nix
|
|
nixos/boxes/home/palace
|
|
nixos/boxes/home/castle
|
|
nixos/boxes/britway
|
|
nixos/boxes/britnet.nix
|
|
nixos/boxes/kelder
|
|
|
|
# Homes
|
|
# home-manager/configs/macsimum.nix
|
|
];
|
|
|
|
nixfiles = evalModules {
|
|
modules = [
|
|
{
|
|
_module.args = {
|
|
inherit lib pkgsFlakes hmFlakes self inputs;
|
|
pkgs' = configPkgs';
|
|
};
|
|
|
|
nixos.secretsPath = ./secrets;
|
|
deploy-rs.deploy.sshOpts = [ "-i" ".keys/deploy.key" ];
|
|
}
|
|
|
|
# Not an internal part of the module system apparently, but it doesn't have any dependencies other than lib
|
|
"${pkgsFlakes.unstable}/nixos/modules/misc/assertions.nix"
|
|
|
|
./nixos
|
|
./home-manager
|
|
./deploy-rs.nix
|
|
] ++ configs;
|
|
};
|
|
in
|
|
# Platform independent stuff
|
|
{
|
|
nixpkgs = pkgs';
|
|
inherit inputs lib nixfiles;
|
|
|
|
overlays.default = myPkgsOverlay;
|
|
|
|
nixosModules = nixfiles.config.nixos.modules;
|
|
homeModules = nixfiles.config.home-manager.modules;
|
|
|
|
# Containers and the installer override `rendered` with a bare `extendModules` config
|
|
# (`my.asContainer` / `my.asISO`) that lacks the `pkgs`/`lib` attrs `eval-config` exposes on a
|
|
# normal system. Determinate Nix's flake schemas read `machine.pkgs.stdenv.system` for every
|
|
# `nixosConfigurations` entry, so re-attach them from the full system eval (`configuration`).
|
|
nixosConfigurations = mapAttrs
|
|
(_: s: s.rendered // { inherit (s.configuration) pkgs lib; })
|
|
nixfiles.config.nixos.systems;
|
|
homeConfigurations = mapAttrs (_: s: s.configuration) nixfiles.config.home-manager.homes;
|
|
|
|
deploy = nixfiles.config.deploy-rs.rendered;
|
|
} //
|
|
(eachDefaultSystem (system:
|
|
let
|
|
pkgs = pkgs'.mine.${system};
|
|
lib = pkgs.lib;
|
|
|
|
filterSystem = filterAttrs (_: c: c.config.nixpkgs.system == system);
|
|
homes =
|
|
mapAttrs
|
|
(_: h: h.activationPackage)
|
|
(filterSystem self.homeConfigurations);
|
|
systems =
|
|
mapAttrs
|
|
(_: h: h.config.system.build.toplevel)
|
|
(filterSystem self.nixosConfigurations);
|
|
shell = pkgs.devshell.mkShell ./devshell;
|
|
in
|
|
# Stuff for each platform
|
|
rec {
|
|
checks = flattenTree {
|
|
homeConfigurations = recurseIntoAttrs homes;
|
|
deploy = recurseIntoAttrs (pkgs.deploy-rs.lib.deployChecks self.deploy);
|
|
};
|
|
|
|
packages = flattenTree (import ./pkgs { inherit lib pkgs; });
|
|
|
|
devShells.default = shell;
|
|
|
|
ci =
|
|
let
|
|
homes' =
|
|
mapAttrs'
|
|
(n: v: nameValuePair ''home-${replaceStrings ["@"] ["-at-"] n}'' v)
|
|
homes;
|
|
systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
|
|
packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
|
|
in
|
|
homes' // systems' // packages' // {
|
|
inherit shell;
|
|
};
|
|
ciDrv = pkgs.linkFarm "ci" ci;
|
|
}));
|
|
}
|