Refactor imports and secrets. Add per system properties and role based secret access.
Highlights - No need to update flake for every machine anymore, just add a properties.nix file. - Roles are automatically generated from all machine configurations. - Roles and their secrets automatically are grouped and show up in agenix secrets.nix - Machines and their service configs may now query the properties of all machines. - Machine configuration and secrets are now competely isolated into each machine's directory. - Safety checks to ensure no mixing of luks unlocking secrets and hosts with primary ones. - SSH pubkeys no longer centrally stored but instead per machine where the private key lies for better cleanup.
This commit is contained in:
175
flake.nix
175
flake.nix
@@ -44,97 +44,98 @@
|
||||
nixpkgs-hostapd-pr.flake = false;
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, ... }@inputs: {
|
||||
|
||||
nixosConfigurations =
|
||||
let
|
||||
modules = system: with inputs; [
|
||||
./common
|
||||
simple-nixos-mailserver.nixosModule
|
||||
agenix.nixosModules.default
|
||||
dailybuild_modules.nixosModule
|
||||
archivebox.nixosModule
|
||||
nix-index-database.nixosModules.nix-index
|
||||
({ lib, ... }: {
|
||||
config.environment.systemPackages = [
|
||||
agenix.packages.${system}.agenix
|
||||
];
|
||||
|
||||
# because nixos specialArgs doesn't work for containers... need to pass in inputs a different way
|
||||
options.inputs = lib.mkOption { default = inputs; };
|
||||
options.currentSystem = lib.mkOption { default = system; };
|
||||
})
|
||||
];
|
||||
|
||||
mkSystem = system: nixpkgs: path:
|
||||
let
|
||||
allModules = modules system;
|
||||
|
||||
# allow patching nixpkgs, remove this hack once this is solved: https://github.com/NixOS/nix/issues/3920
|
||||
patchedNixpkgsSrc = nixpkgs.legacyPackages.${system}.applyPatches {
|
||||
name = "nixpkgs-patched";
|
||||
src = nixpkgs;
|
||||
patches = [
|
||||
inputs.nixpkgs-hostapd-pr
|
||||
outputs = { self, nixpkgs, ... }@inputs:
|
||||
let
|
||||
machines = (import ./common/machine-info/moduleless.nix
|
||||
{
|
||||
inherit nixpkgs;
|
||||
assertionsModule = "${nixpkgs}/nixos/modules/misc/assertions.nix";
|
||||
}).machines.hosts;
|
||||
in
|
||||
{
|
||||
nixosConfigurations =
|
||||
let
|
||||
modules = system: with inputs; [
|
||||
./common
|
||||
simple-nixos-mailserver.nixosModule
|
||||
agenix.nixosModules.default
|
||||
dailybuild_modules.nixosModule
|
||||
archivebox.nixosModule
|
||||
nix-index-database.nixosModules.nix-index
|
||||
({ lib, ... }: {
|
||||
config.environment.systemPackages = [
|
||||
agenix.packages.${system}.agenix
|
||||
];
|
||||
|
||||
# because nixos specialArgs doesn't work for containers... need to pass in inputs a different way
|
||||
options.inputs = lib.mkOption { default = inputs; };
|
||||
options.currentSystem = lib.mkOption { default = system; };
|
||||
})
|
||||
];
|
||||
|
||||
mkSystem = system: nixpkgs: path:
|
||||
let
|
||||
allModules = modules system;
|
||||
|
||||
# allow patching nixpkgs, remove this hack once this is solved: https://github.com/NixOS/nix/issues/3920
|
||||
patchedNixpkgsSrc = nixpkgs.legacyPackages.${system}.applyPatches {
|
||||
name = "nixpkgs-patched";
|
||||
src = nixpkgs;
|
||||
patches = [
|
||||
inputs.nixpkgs-hostapd-pr
|
||||
];
|
||||
};
|
||||
patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });
|
||||
|
||||
in
|
||||
patchedNixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = allModules ++ [ path ];
|
||||
|
||||
specialArgs = {
|
||||
inherit allModules;
|
||||
};
|
||||
};
|
||||
patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });
|
||||
in
|
||||
nixpkgs.lib.mapAttrs
|
||||
(hostname: cfg:
|
||||
mkSystem cfg.arch nixpkgs cfg.configurationPath)
|
||||
machines;
|
||||
|
||||
in
|
||||
patchedNixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = allModules ++ [ path ];
|
||||
|
||||
specialArgs = {
|
||||
inherit allModules;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
"ray" = mkSystem "x86_64-linux" nixpkgs ./machines/ray/configuration.nix;
|
||||
# "nat" = mkSystem "aarch64-linux" nixpkgs ./machines/nat/configuration.nix;
|
||||
"ponyo" = mkSystem "x86_64-linux" nixpkgs ./machines/ponyo/configuration.nix;
|
||||
"phil" = mkSystem "aarch64-linux" nixpkgs ./machines/phil/configuration.nix;
|
||||
"router" = mkSystem "x86_64-linux" nixpkgs ./machines/router/configuration.nix;
|
||||
"s0" = mkSystem "x86_64-linux" nixpkgs ./machines/storage/s0/configuration.nix;
|
||||
};
|
||||
|
||||
packages =
|
||||
let
|
||||
mkKexec = system:
|
||||
(nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [ ./machines/ephemeral/kexec.nix ];
|
||||
}).config.system.build.kexec_tarball;
|
||||
mkIso = system:
|
||||
(nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [ ./machines/ephemeral/iso.nix ];
|
||||
}).config.system.build.isoImage;
|
||||
in
|
||||
{
|
||||
"x86_64-linux"."kexec" = mkKexec "x86_64-linux";
|
||||
"x86_64-linux"."iso" = mkIso "x86_64-linux";
|
||||
"aarch64-linux"."kexec" = mkKexec "aarch64-linux";
|
||||
"aarch64-linux"."iso" = mkIso "aarch64-linux";
|
||||
};
|
||||
|
||||
deploy.nodes =
|
||||
let
|
||||
mkDeploy = configName: hostname: {
|
||||
inherit hostname;
|
||||
magicRollback = false;
|
||||
sshUser = "root";
|
||||
profiles.system.path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${configName};
|
||||
packages =
|
||||
let
|
||||
mkKexec = system:
|
||||
(nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [ ./machines/ephemeral/kexec.nix ];
|
||||
}).config.system.build.kexec_tarball;
|
||||
mkIso = system:
|
||||
(nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [ ./machines/ephemeral/iso.nix ];
|
||||
}).config.system.build.isoImage;
|
||||
in
|
||||
{
|
||||
"x86_64-linux"."kexec" = mkKexec "x86_64-linux";
|
||||
"x86_64-linux"."iso" = mkIso "x86_64-linux";
|
||||
"aarch64-linux"."kexec" = mkKexec "aarch64-linux";
|
||||
"aarch64-linux"."iso" = mkIso "aarch64-linux";
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
s0 = mkDeploy "s0" "s0";
|
||||
router = mkDeploy "router" "router";
|
||||
ponyo = mkDeploy "ponyo" "ponyo.neet.dev";
|
||||
};
|
||||
deploy.nodes =
|
||||
let
|
||||
mkDeploy = configName: arch: hostname: {
|
||||
inherit hostname;
|
||||
magicRollback = false;
|
||||
sshUser = "root";
|
||||
profiles.system.path = inputs.deploy-rs.lib.${arch}.activate.nixos self.nixosConfigurations.${configName};
|
||||
};
|
||||
in
|
||||
nixpkgs.lib.mapAttrs
|
||||
(hostname: cfg:
|
||||
mkDeploy hostname cfg.arch (builtins.head cfg.hostNames))
|
||||
machines;
|
||||
|
||||
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
|
||||
};
|
||||
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user