-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactor and tidy the flake definition.
This removes a bunch of duplication in the deploy/start-vm/diff scripts left over from the introduction of the wpia-packit-private machine. These script now only exist as one script, that accepts a machine name as their argument. In order to split up the `flake.nix` file, it makes use of the [`flake-parts`][flake-parts] library. This library uses the same module system as NixOS itself, but at the flake configuration level itself. The deploy script is changed from using `nixos-rebuild switch` to our own implementation of it. The primary goal of this is to ensure the derivation of the built system gets deployed too, allowing us to reliable diff the system state in the future. [flake-parts]: https://flake.parts/
- Loading branch information
Showing
22 changed files
with
365 additions
and
240 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,149 +2,33 @@ | |
| inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05"; | ||
| inputs.disko.url = "github:nix-community/disko"; | ||
| inputs.disko.inputs.nixpkgs.follows = "nixpkgs"; | ||
|
|
||
| outputs = { nixpkgs, self, ... } @inputs: | ||
| let | ||
| pkgsArgs = { | ||
| overlays = [ self.overlays.default ]; | ||
| config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [ | ||
| inputs.flake-parts.url = "github:hercules-ci/flake-parts"; | ||
|
|
||
| outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } ({ withSystem, lib, self, nixpkgs, ... }: { | ||
| imports = [ | ||
| ./packages | ||
| ./machines | ||
| ./scripts | ||
| ./tests | ||
| ]; | ||
| perSystem = { system, pkgs, ... }: { | ||
| _module.args.pkgs = import inputs.nixpkgs { | ||
| inherit system; | ||
| config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ | ||
| "vault" | ||
| "vault-bin" | ||
| ]; | ||
| }; | ||
| in | ||
| { | ||
| overlays.default = (final: prev: { | ||
| packit = final.callPackage ./packages/packit { }; | ||
| outpack_server = final.callPackage ./packages/outpack_server { }; | ||
| packit-app = final.callPackage ./packages/packit/packit-app.nix { }; | ||
| packit-api = final.callPackage ./packages/packit/packit-api.nix { }; | ||
| fetch-secrets = final.writers.writePython3Bin "fetch-secrets" | ||
| { | ||
| libraries = [ final.python3.pkgs.hvac ]; | ||
| } ./scripts/fetch-secrets.py; | ||
| }); | ||
|
|
||
| nixosConfigurations.wpia-packit = nixpkgs.lib.nixosSystem { | ||
| system = "x86_64-linux"; | ||
| specialArgs = { inherit inputs; }; | ||
| modules = [ | ||
| ./machines/wpia-packit.nix | ||
| ./hardware-configuration.nix | ||
| { nixpkgs = pkgsArgs; } | ||
| devShells.default = pkgs.mkShell { | ||
| buildInputs = [ | ||
| pkgs.nix-prefetch-github | ||
| pkgs.nixos-rebuild | ||
| pkgs.nix-diff | ||
| ]; | ||
| }; | ||
|
|
||
| nixosConfigurations.wpia-packit-private = nixpkgs.lib.nixosSystem { | ||
| system = "x86_64-linux"; | ||
| specialArgs = { inherit inputs; }; | ||
| modules = [ | ||
| ./machines/wpia-packit-private.nix | ||
| ./hardware-configuration.nix | ||
| { nixpkgs = pkgsArgs; } | ||
| ]; | ||
| }; | ||
|
|
||
| packages.x86_64-linux = | ||
| let pkgs = import nixpkgs ({ system = "x86_64-linux"; } // pkgsArgs); | ||
| in { | ||
| inherit (pkgs) outpack_server packit-app packit-api packit fetch-secrets; | ||
|
|
||
| default = self.nixosConfigurations.wpia-packit.config.system.build.toplevel; | ||
|
|
||
| deploy = pkgs.writeShellApplication { | ||
| name = "deploy-wpia-packit"; | ||
| runtimeInputs = [ pkgs.nixos-rebuild ]; | ||
| text = '' | ||
| nixos-rebuild switch \ | ||
| --flake .#wpia-packit \ | ||
| --target-host [email protected] \ | ||
| --use-substitutes | ||
| ''; | ||
| }; | ||
|
|
||
| deploy-private = pkgs.writeShellApplication { | ||
| name = "deploy-wpia-packit-private"; | ||
| runtimeInputs = [ pkgs.nixos-rebuild ]; | ||
| text = '' | ||
| nixos-rebuild switch \ | ||
| --flake .#wpia-packit-private \ | ||
| --target-host [email protected] \ | ||
| --use-substitutes | ||
| ''; | ||
| }; | ||
|
|
||
| update-ssh-keys = pkgs.writeShellApplication { | ||
| name = "update-ssh-keys"; | ||
| runtimeInputs = [ pkgs.curl ]; | ||
| text = builtins.readFile ./scripts/update-ssh-keys.sh; | ||
| }; | ||
|
|
||
| diff = pkgs.writeShellApplication { | ||
| name = "diff"; | ||
| runtimeInputs = [ pkgs.nix pkgs.nix-diff ]; | ||
| text = '' | ||
| current=$(ssh [email protected] readlink /run/current-system) | ||
| nix-copy-closure --from [email protected] "$current" | ||
| # In theory .drvPath should allow us to use string interpolation | ||
| # instead of re-evaluating the flake, but for some reason it | ||
| # pulls all the build-time dependencies. | ||
| target=$(nix path-info --derivation .#nixosConfigurations.wpia-packit.config.system.build.toplevel) | ||
| nix-diff "$@" "$current" "$target" | ||
| ''; | ||
| }; | ||
|
|
||
| update = pkgs.writers.writePython3Bin "update" { } ./scripts/update.py; | ||
|
|
||
| start-vm = pkgs.writeShellApplication { | ||
| name = "start-vm"; | ||
| runtimeInputs = [ pkgs.vault-bin ]; | ||
| text = | ||
| let vaultUrl = self.nixosConfigurations.wpia-packit.config.vault.url; | ||
| in '' | ||
| token=$(vault print token) | ||
| if [[ -z $token ]]; then | ||
| echo "Logging in to ${vaultUrl}" | ||
| token=$(env VAULT_ADDR="${vaultUrl}" vault login -method=github -field=token) | ||
| fi | ||
| exec ${nixpkgs.lib.getExe self.nixosConfigurations.wpia-packit.config.system.build.vm} \ | ||
| -fw_cfg name=opt/vault-token,string="$token" "$@" | ||
| ''; | ||
| }; | ||
|
|
||
| start-vm-private = pkgs.writeShellApplication { | ||
| name = "start-vm-private"; | ||
| runtimeInputs = [ pkgs.vault-bin ]; | ||
| text = | ||
| let vaultUrl = self.nixosConfigurations.wpia-packit-private.config.vault.url; | ||
| in '' | ||
| token=$(vault print token) | ||
| if [[ -z $token ]]; then | ||
| echo "Logging in to ${vaultUrl}" | ||
| token=$(env VAULT_ADDR="${vaultUrl}" vault login -method=github -field=token) | ||
| fi | ||
| exec ${nixpkgs.lib.getExe self.nixosConfigurations.wpia-packit-private.config.system.build.vm} \ | ||
| -fw_cfg name=opt/vault-token,string="$token" "$@" | ||
| ''; | ||
| }; | ||
|
|
||
| vm-test = self.checks.x86_64-linux.default.driver; | ||
| }; | ||
|
|
||
| checks.x86_64-linux.default = | ||
| let pkgs = import nixpkgs ({ system = "x86_64-linux"; } // pkgsArgs); | ||
| in pkgs.callPackage ./tests { inherit inputs; }; | ||
|
|
||
| devShells.x86_64-linux.default = | ||
| let pkgs = import nixpkgs ({ system = "x86_64-linux"; } // pkgsArgs); | ||
| in pkgs.mkShell { | ||
| buildInputs = [ | ||
| pkgs.nix-prefetch-github | ||
| pkgs.nixos-rebuild | ||
| ]; | ||
| }; | ||
| }; | ||
|
|
||
| systems = [ "x86_64-linux" ]; | ||
| }); | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.