Skip to content

Commit 7ecceb0

Browse files
diamondburneddiamondburned
committed
wip
1 parent 2ac42ca commit 7ecceb0

File tree

11 files changed

+96
-118
lines changed

11 files changed

+96
-118
lines changed

‎default.nix‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎flake.nix‎

Lines changed: 77 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,23 +29,64 @@
2929

3030
flake-utils.lib.eachDefaultSystem (system:
3131
let
32-
pkgs = nixpkgs.legacyPackages.${system};
3332
overlays = self.overlays.${system};
3433
in
3534
{
35+
devShells = let
36+
pkgs = import nixpkgs {
37+
inherit system;
38+
overlays = [
39+
overlays.buildTools
40+
];
41+
config = {
42+
# Allow unfree packages for Terraform.
43+
allowUnfree = true;
44+
};
45+
};
46+
in
47+
{
48+
default = pkgs.mkShell {
49+
name = "acm-aws-shell";
50+
51+
packages = with pkgs; [
52+
terraform
53+
awscli2
54+
nix-update
55+
jq
56+
niv
57+
git
58+
git-crypt
59+
openssl
60+
yamllint
61+
expect
62+
shellcheck
63+
] ++ [
64+
# Fix Nix Flake's weird scoping issue.
65+
pkgs.gomod2nix
66+
];
67+
68+
# Enforce purity by unsetting NIX_PATH.
69+
# This messes up any code that uses Nix channels.
70+
NIX_PATH = "";
71+
};
72+
};
73+
3674
overlays = {
3775
# Overlay for the build tools that our packages use.
3876
buildTools = final: prev: {
3977
#
4078
# Build tools
4179
#
4280
inherit (gomod2nix.legacyPackages.${system})
43-
mkGoEnv buildGoApplication;
81+
mkGoEnv buildGoApplication gomod2nix;
82+
4483
inherit (poetry2nix.lib.mkPoetry2Nix { pkgs = prev; })
4584
mkPoetryApplication;
85+
4686
inherit (nix-npm-buildpackage.legacyPackages.${system})
4787
buildNpmPackage
4888
buildYarnPackage;
89+
4990
buildDenoPackage = final.callPackage ./nix/packaging/deno.nix { };
5091
buildJavaPackage = final.callPackage ./nix/packaging/java.nix { };
5192
buildGradlePackage = final.callPackage ./nix/packaging/gradle.nix { };
@@ -74,8 +115,40 @@
74115
};
75116

76117
nixosConfigurations = {
77-
cirno = import ./servers/cirno inputs;
78-
cs306 = import ./servers/cs306 inputs;
118+
cirno = self.lib.nixosSystem {
119+
system = "x86_64-linux";
120+
configuration = ./servers/cirno/configuration.nix;
121+
};
122+
cs306 = self.lib.nixosSystem {
123+
system = "x86_64-linux";
124+
configuration = ./servers/cs306/configuration.nix;
125+
};
126+
};
127+
128+
lib = {
129+
# All nixosConfigurations should have this in their specialArgs.
130+
nixosArgs = { system }: inputs // {
131+
# Import Niv sources directly into the arguments for convenience.
132+
sources = import ./nix/sources.nix {
133+
inherit system;
134+
pkgs = nixpkgs.legacyPackages.${system};
135+
};
136+
# TODO: migrate away from Nix store-based secrets.
137+
# See https://github.com/acmcsufoss/acm-aws/issues/34.
138+
secretsPath = secret: self + "/secrets/" + secret;
139+
};
140+
141+
mkNixosSystem = { system, configurationFile }:
142+
nixpkgs.lib.nixosSystem {
143+
inherit system;
144+
modules = [
145+
./servers/base.nix
146+
configurationFile
147+
];
148+
specialArgs = self.lib.nixosArgs {
149+
inherit system;
150+
};
151+
};
79152
};
80153
}
81154
);

‎nix/sources.json‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -157,19 +157,6 @@
157157
"url": "https://github.com/serokell/nix-npm-buildpackage/archive/200e47aabd2b55993561c47e8390c89bdeb18b8a.tar.gz",
158158
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
159159
},
160-
"nixpkgs": {
161-
"branch": "nixos-23.11",
162-
"description": "Nix Packages collection",
163-
"homepage": "",
164-
"owner": "NixOS",
165-
"repo": "nixpkgs",
166-
"rev": "b94a96839afcc56de3551aa7472b8d9a3e77e05d",
167-
"sha256": "1j5vs24bgy2arl342lrh3znc1pdz68kcjp2rpgy3sccpd9sibqqn",
168-
"type": "tarball",
169-
"url": "https://github.com/NixOS/nixpkgs/archive/b94a96839afcc56de3551aa7472b8d9a3e77e05d.tar.gz",
170-
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz",
171-
"version": "nixos-unstable"
172-
},
173160
"nixpkgs_newer": {
174161
"branch": "nixpkgs-unstable",
175162
"description": "Nix Packages collection",

‎servers/cirno/default.nix‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎servers/cirno/services.nix‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
1-
{ config, lib, pkgs, ... }:
2-
3-
let
4-
sources = import <acm-aws/nix/sources.nix>;
5-
in
1+
{ config, lib, pkgs, self, ... }:
62

73
{
84
services.diamondburned.caddy = {
95
enable = true;
106
configFile = ./Caddyfile;
11-
environment = import <acm-aws/secrets/caddy-env.nix>;
7+
environment = import (self + "/secrets/caddy-env.nix");
128
};
139

1410
systemd.services.acmregister = {
1511
enable = true;
1612
description = "ACM member registration Discord bot";
1713
after = [ "network-online.target" ];
1814
wantedBy = [ "multi-user.target" ];
19-
environment = import ./secrets/acmregister-env.nix;
15+
environment = import (self + "/secrets/acmregister-env.nix");
2016
serviceConfig = {
2117
Type = "simple";
2218
ExecStart = "${pkgs.acmregister}/bin/acmregister";

‎servers/cirno/telemetry.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{ config, lib, pkgs, ... }:
1+
{ config, lib, pkgs, self, ... }:
22

33
{
44
# Enable netdata, which is a lightweight alternative to Grafana.
@@ -21,7 +21,7 @@
2121
"stream.conf" = pkgs.writeText "stream.conf" ''
2222
[stream]
2323
enabled = yes
24-
api key = ${builtins.readFile <acm-aws/secrets/netdata-key>}
24+
api key = ${builtins.readFile (self + "/secrets/netdata-key")}
2525
destination = cs306:19999
2626
'';
2727
};

‎servers/cs306/caddy/default.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
{ config, lib, pkgs, ... }:
1+
{ config, lib, pkgs, secretsPath, ... }:
22

33
let
4-
environment = import <acm-aws/secrets/caddy-env.nix>;
4+
environment = import (secretsPath "caddy-env.nix");
55

66
preprocessedCaddyfile = pkgs.runCommandLocal "Caddyfile-preprocessed" {} ''
77
cp ${./Caddyfile} $out

‎servers/cs306/default.nix‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎servers/cs306/services.nix‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,23 @@
1-
{ config, lib, pkgs, ... }:
2-
3-
let
4-
sources = import <acm-aws/nix/sources.nix>;
5-
in
1+
{ config, lib, pkgs, self, sources, ... }:
62

73
{
84
services.managed.enable = true;
95

106
services.managed.services = with lib; {
117
triggers = {
128
command = getExe pkgs.triggers;
13-
environment = import <acm-aws/secrets/triggers-env.nix>;
9+
environment = import (self + "/secrets/triggers-env.nix");
1410
};
1511

1612
pomo = {
1713
command = getExe pkgs.pomo;
18-
environment = import <acm-aws/secrets/pomo.nix>;
14+
environment = import (self + "/secrets/pomo.nix");
1915
serviceConfig.StartLimitInterval = "0"; # Permit unlimited restarts.
2016
};
2117

2218
acm-nixie = {
2319
command = getExe pkgs.acm-nixie;
24-
environment = import <acm-aws/secrets/acm-nixie-env.nix>;
20+
environment = import (self + "/secrets/acm-nixie-env.nix");
2521
};
2622

2723
crying-counter = {
@@ -40,22 +36,22 @@ in
4036
4137
${getExe pkgs.crying-counter}
4238
'';
43-
environment = import <acm-aws/secrets/crying-counter-env.nix>;
39+
environment = import (self + "/secrets/crying-counter-env.nix");
4440
};
4541

4642
discord-conversation-summary-bot = {
4743
command = getExe pkgs.discord_conversation_summary_bot;
4844
workingDirectory = pkgs.writeTextDir
4945
"config.json"
50-
(builtins.readFile <acm-aws/secrets/discord_conversation_summary_bot.json>);
46+
(builtins.readFile (self + "/secrets/discord_conversation_summary_bot.json"));
5147
};
5248

5349
discord-ical-srv = {
5450
command = [
5551
(getExe pkgs.discord-ical-srv)
5652
"-l" "unix:///run/discord-ical-srv/http.sock"
5753
];
58-
environment = import <acm-aws/secrets/discord-ical-srv-env.nix>;
54+
environment = import (self + "/secrets/discord-ical-srv-env.nix");
5955
};
6056

6157
discord-ical-reminder = {
@@ -64,7 +60,7 @@ in
6460
"-c"
6561
"${pkgs.writeText
6662
"discord-ical-reminder.json"
67-
(builtins.toJSON (import <acm-aws/secrets/ical-reminders.nix>))}"
63+
(builtins.toJSON (import (self + "/secrets/ical-reminders.nix")))}"
6864
];
6965
};
7066

@@ -107,7 +103,7 @@ in
107103
systemd.services.sendlimiter =
108104
let
109105
extraArgs = [];
110-
secrets = import <acm-aws/secrets/sendlimiter.nix>;
106+
secrets = import (self + "/secrets/sendlimiter.nix");
111107
args = lib.concatStringsSep
112108
" "
113109
(map lib.escapeShellArg (extraArgs ++ secrets.channelIDs));
@@ -129,6 +125,6 @@ in
129125

130126
services.dischord = {
131127
enable = true;
132-
config = builtins.readFile <acm-aws/secrets/dischord-config.toml>;
128+
config = builtins.readFile (self + "/secrets/dischord-config.toml");
133129
};
134130
}

‎servers/cs306/telemetry.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{ config, lib, pkgs, ... }:
1+
{ config, lib, pkgs, self, secretsPath, ... }:
22

33
let
44
tailnet = builtins.getEnv "TAILNET_NAME";
@@ -39,7 +39,7 @@ assert lib.assertMsg
3939
enabled = yes
4040
enable compression = yes
4141
42-
[${builtins.readFile <acm-aws/secrets/netdata-key>}]
42+
[${builtins.readFile (secretsPath "netdata-key")}]
4343
enabled = yes
4444
allow from = 100.*
4545
default memory mode = dbengine

0 commit comments

Comments
 (0)