2023-08-18 20:00:23 +01:00
|
|
|
{self, ...} @ inputs: let
|
|
|
|
nixpkgs = inputs.nixpkgs-unstable;
|
|
|
|
lib = nixpkgs.lib;
|
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
inherit (lib.attrsets) mergeAttrsList;
|
|
|
|
|
2022-12-03 16:40:50 +00:00
|
|
|
hosts = import ./hosts inputs;
|
2023-08-18 20:00:23 +01:00
|
|
|
in
|
|
|
|
{
|
|
|
|
nixosConfigurations = hosts.nixosConfigurations;
|
|
|
|
#darwinConfigurations = hosts.darswinConfigurations;
|
|
|
|
|
|
|
|
deploy.nodes = import ./deployNodes.nix {
|
|
|
|
nixosConfigurations = self.nixosConfigurations;
|
|
|
|
deploy-rs = inputs.deploy-rs;
|
|
|
|
};
|
|
|
|
}
|
2023-09-14 13:54:56 +01:00
|
|
|
// (inputs.flake-utils.lib.eachDefaultSystem (
|
|
|
|
system: let
|
|
|
|
pkgs = import nixpkgs {
|
|
|
|
inherit system;
|
|
|
|
overlays = [
|
|
|
|
(import ./overlay)
|
|
|
|
];
|
|
|
|
};
|
|
|
|
in
|
|
|
|
lib.foldl' lib.recursiveUpdate {} [
|
|
|
|
{
|
|
|
|
formatter = pkgs.alejandra;
|
2023-09-11 23:22:18 +01:00
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
devShell = pkgs.mkShell {
|
|
|
|
VAULT_API_ADDR = "https://vault.owo.monster";
|
|
|
|
packages =
|
|
|
|
(with pkgs; [
|
|
|
|
git
|
|
|
|
nano
|
|
|
|
bat
|
|
|
|
nix
|
|
|
|
vault-bin
|
|
|
|
])
|
|
|
|
++ (with self.packages."${system}"; [
|
|
|
|
mk-enc-usb
|
|
|
|
mk-normal-enc-ssd
|
|
|
|
mk-dual-enc-ssd
|
|
|
|
mk-raspberry-ext-drive
|
|
|
|
]);
|
|
|
|
};
|
2023-09-11 23:22:18 +01:00
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
packages = {
|
|
|
|
inherit (pkgs) comic-code comic-sans;
|
|
|
|
inherit (pkgs) mk-enc-usb mk-normal-enc-ssd mk-dual-enc-ssd mk-raspberry-ext-drive;
|
|
|
|
inherit (pkgs) gotosocial;
|
|
|
|
};
|
|
|
|
}
|
2023-09-11 23:22:18 +01:00
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
# secrets-init, secrets-check and vault-policy for machines and containers
|
|
|
|
(let
|
|
|
|
secretsLib = import ./modules/nixos/secrets-lib/lib.nix {
|
|
|
|
inherit (nixpkgs) lib;
|
|
|
|
inherit pkgs;
|
|
|
|
};
|
2023-09-11 23:22:18 +01:00
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
systemConfigForSystem = system_name: self.nixosConfigurations.${system_name}.config;
|
|
|
|
secretsConfigForSystem = system_name: let
|
|
|
|
systemConfig = systemConfigForSystem system_name;
|
|
|
|
in
|
|
|
|
systemConfig.services.secrets;
|
2021-12-26 15:43:53 +00:00
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
systemConfigForContainer = system_name: container_name: let
|
|
|
|
systemConfig = systemConfigForSystem system_name;
|
|
|
|
in
|
|
|
|
systemConfig.containers.${container_name}.config;
|
2022-03-02 17:55:44 +00:00
|
|
|
|
2023-09-14 13:54:56 +01:00
|
|
|
secretsConfigForContainer = system_name: container_name: let
|
|
|
|
systemConfig = systemConfigForContainer system_name container_name;
|
|
|
|
in
|
|
|
|
systemConfig.services.secrets;
|
|
|
|
|
|
|
|
secretsInitScriptForSystem = system_name: let
|
|
|
|
secretsConfig = secretsConfigForSystem system_name;
|
|
|
|
in
|
|
|
|
secretsLib.mkSecretsInitScript secretsConfig "${system_name}";
|
|
|
|
|
|
|
|
secretsInitScriptForContainer = system_name: container_name: let
|
|
|
|
secretsConfig = secretsConfigForContainer system_name container_name;
|
|
|
|
in
|
|
|
|
secretsLib.mkSecretsInitScript secretsConfig "${system_name}-container-${container_name}";
|
|
|
|
|
|
|
|
vaultPolicyForSystem = system_name: let
|
|
|
|
secretsConfig = secretsConfigForSystem system_name;
|
|
|
|
in
|
|
|
|
secretsLib.genVaultPolicy secretsConfig "${system_name}";
|
|
|
|
|
|
|
|
vaultPolicyForContainer = system_name: container_name: let
|
|
|
|
secretsConfig = secretsConfigForContainer system_name container_name;
|
|
|
|
in
|
|
|
|
secretsLib.genVaultPolicy secretsConfig "${system_name}-container-${container_name}";
|
|
|
|
|
|
|
|
# All machines/containers with secrets.nix
|
|
|
|
machines = let
|
|
|
|
defaults = {
|
|
|
|
hasHostSecrets = true;
|
|
|
|
containers = [];
|
|
|
|
};
|
|
|
|
in {
|
|
|
|
"hetzner-vm" = {
|
|
|
|
inherit (defaults) hasHostSecrets;
|
|
|
|
containers = ["storage"];
|
|
|
|
};
|
|
|
|
"vault" = {
|
|
|
|
inherit (defaults) hasHostSecrets containers;
|
|
|
|
};
|
|
|
|
"raspberry" = {
|
|
|
|
inherit (defaults) hasHostSecrets containers;
|
|
|
|
};
|
|
|
|
"lappy-t495" = {
|
|
|
|
inherit (defaults) hasHostSecrets containers;
|
|
|
|
};
|
|
|
|
"tablet" = {
|
|
|
|
inherit (defaults) hasHostSecrets containers;
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
machinesWithHostSecrets = lib.filter (machine: machines.${machine}.hasHostSecrets) (builtins.attrNames machines);
|
|
|
|
machinesWithContainers = lib.filter (machine: (builtins.length machines.${machine}.containers) != 0) (builtins.attrNames machines);
|
|
|
|
in {
|
|
|
|
packages = mergeAttrsList [
|
|
|
|
(mergeAttrsList (
|
|
|
|
lib.forEach machinesWithHostSecrets (machine_name: {
|
|
|
|
"secrets-init-${machine_name}" = secretsInitScriptForSystem machine_name;
|
|
|
|
"vault-policy-${machine_name}" = vaultPolicyForSystem machine_name;
|
|
|
|
})
|
|
|
|
))
|
|
|
|
|
|
|
|
(mergeAttrsList (lib.forEach machinesWithContainers (machine_name: let
|
|
|
|
machine = machines.${machine_name};
|
|
|
|
containers = machine.containers;
|
|
|
|
in (mergeAttrsList (lib.forEach containers (container_name: {
|
|
|
|
"secrets-init-${machine_name}-container-${container_name}" = secretsInitScriptForContainer machine_name container_name;
|
|
|
|
"vault-policy-${machine_name}-container-${container_name}" = vaultPolicyForContainer machine_name container_name;
|
|
|
|
}))))))
|
|
|
|
];
|
|
|
|
})
|
|
|
|
]
|
|
|
|
))
|