From 804011f53826c226cbf7e0acd8002087a223051d Mon Sep 17 00:00:00 2001 From: Henrik Lissner Date: Mon, 26 Oct 2020 05:48:12 -0400 Subject: [PATCH] Refactor flake --- default.nix | 68 +++++++++++++++++++++++++++++++++++++ flake.nix | 64 ++++++----------------------------- hosts/ao/default.nix | 6 ++-- hosts/default.nix | 71 --------------------------------------- hosts/kuro/default.nix | 6 ++-- hosts/linode.nix | 4 +-- hosts/personal.nix | 28 +++++++++++++++ hosts/shiro/default.nix | 6 ++-- lib/default.nix | 6 ++-- lib/nixos.nix | 25 ++++++++++++++ modules/editors/emacs.nix | 2 +- modules/security.nix | 16 +++++++++ 12 files changed, 164 insertions(+), 138 deletions(-) create mode 100644 default.nix delete mode 100644 hosts/default.nix create mode 100644 hosts/personal.nix create mode 100644 lib/nixos.nix create mode 100644 modules/security.nix diff --git a/default.nix b/default.nix new file mode 100644 index 00000000..4f7a3d9b --- /dev/null +++ b/default.nix @@ -0,0 +1,68 @@ +{ inputs, config, lib, pkgs, ... }: + +with lib; +with lib.my; +with inputs; +{ + imports = + # I use home-manager to deploy files to $HOME; little else + [ home-manager.nixosModules.home-manager ] + # All my personal modules + ++ (mapModulesRec' (toString ./modules) import); + + # Common config for all nixos machines; and to ensure the flake operates + # soundly + environment.variables.DOTFILES = dotFilesDir; + + # Configure nix and nixpkgs + environment.variables.NIXPKGS_ALLOW_UNFREE = "1"; + nix = { + package = pkgs.unstable.nixFlakes; + extraOptions = "experimental-features = nix-command flakes"; + nixPath = [ + "nixpkgs=${nixos}" + "nixpkgs-unstable=${nixos-unstable}" + "nixpkgs-overlays=${dotFilesDir}/overlays" + "home-manager=${home-manager}" + "dotfiles=${dotFilesDir}" + ]; + binaryCaches = [ + "https://cache.nixos.org/" + "https://nix-community.cachix.org" + ]; + binaryCachePublicKeys = [ + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + ]; + registry = { + nixos.flake = nixos; + nixpkgs.flake = nixos-unstable; + }; + }; + system.configurationRevision = mkIf (self ? rev) self.rev; + system.stateVersion = "20.09"; + + + ## Some reasonable, global defaults + # This is here to appease 'nix flake check' for generic hosts with no + # hardware-configuration.nix or fileSystem config. + fileSystems."/".device = "/dev/disk/by-label/nixos"; + + # Use the latest kernel + boot.kernelPackages = pkgs.linuxPackages_latest; + + boot.loader = { + efi.canTouchEfiVariables = true; + systemd-boot.configurationLimit = 10; + systemd-boot.enable = mkDefault true; + }; + + # Just the bear necessities... + environment.systemPackages = with pkgs; [ + unstable.cached-nix-shell + coreutils + git + vim + wget + gnumake + ]; +} diff --git a/flake.nix b/flake.nix index 69229f2a..440fbb3c 100644 --- a/flake.nix +++ b/flake.nix @@ -27,21 +27,23 @@ let inherit (builtins) baseNameOf; inherit (lib) nixosSystem mkIf removeSuffix attrNames attrValues; - inherit (lib.my) dotFilesDir mapModules mapModulesRec mapModulesRec'; + inherit (lib.my) dotFilesDir mapModules mapModulesRec mapHosts; system = "x86_64-linux"; lib = nixos.lib.extend - (self: super: { my = import ./lib { inherit pkgs; lib = self; }; }); + (self: super: { my = import ./lib { inherit pkgs inputs; lib = self; }; }); mkPkgs = pkgs: extraOverlays: import pkgs { inherit system; config.allowUnfree = true; # forgive me Stallman senpai overlays = extraOverlays ++ (attrValues self.overlays); }; - pkgs = mkPkgs nixos [ self.overlay ]; + pkgs = mkPkgs nixos [ self.overlay ]; unstable = mkPkgs nixos-unstable []; in { + lib = lib.my; + overlay = final: prev: { inherit unstable; @@ -49,63 +51,17 @@ }; overlays = - mapModules (toString ./overlays) import; + mapModules ./overlays import; packages."${system}" = - mapModules (toString ./packages) + mapModules ./packages (p: pkgs.callPackage p {}); nixosModules = - mapModulesRec (toString ./modules) import; + { dotfiles = import ./.; } + // mapModulesRec ./modules import; nixosConfigurations = - mapModules (toString ./hosts) - (modulePath: nixosSystem { - inherit system; - specialArgs = { inherit lib inputs; }; - modules = [ - # Common config for all nixos machines; and to ensure the flake - # operates soundly - { - networking.hostName = removeSuffix ".nix" (baseNameOf modulePath); - environment.variables.NIXPKGS_ALLOW_UNFREE = "1"; - environment.variables.DOTFILES = dotFilesDir; - nixpkgs.pkgs = pkgs; - nix = { - package = unstable.nixFlakes; - extraOptions = "experimental-features = nix-command flakes"; - nixPath = [ - "nixpkgs=${nixos}" - "nixpkgs-unstable=${nixos-unstable}" - "nixpkgs-overlays=${dotFilesDir}/overlays" - "home-manager=${home-manager}" - "dotfiles=${dotFilesDir}" - ]; - binaryCaches = [ - "https://cache.nixos.org/" - "https://nix-community.cachix.org" - ]; - binaryCachePublicKeys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - ]; - registry = { - nixos.flake = nixos; - nixpkgs.flake = nixos-unstable; - }; - }; - system.configurationRevision = mkIf (self ? rev) self.rev; - system.stateVersion = "20.09"; - } - - # I use home-manager to deploy files to $HOME; little else - home-manager.nixosModules.home-manager - - # All my personal modules - { imports = mapModulesRec' (toString ./modules) import; } - - ./hosts # config common to all hosts - modulePath # host-specific config - ]; - }); + mapHosts ./hosts { inherit system; }; }; } diff --git a/hosts/ao/default.nix b/hosts/ao/default.nix index 08bcb6c5..e378f37b 100644 --- a/hosts/ao/default.nix +++ b/hosts/ao/default.nix @@ -4,7 +4,10 @@ with lib.my; { - imports = [ ./hardware-configuration.nix ]; + imports = [ + ../personal.nix + ./hardware-configuration.nix + ]; ## Modules modules = { @@ -20,7 +23,6 @@ with lib.my; ## Local config - boot.loader.systemd-boot.enable = true; networking.networkmanager.enable = true; # nginx hosts diff --git a/hosts/default.nix b/hosts/default.nix deleted file mode 100644 index a3279920..00000000 --- a/hosts/default.nix +++ /dev/null @@ -1,71 +0,0 @@ -# hosts/default.nix -# -# Loads config common to all hosts. - -{ config, lib, pkgs, ... }: - -with lib; -with lib.my; -{ - ## Some reasonable, global defaults - # This is here to appease 'nix flake check' for generic hosts with no - # hardware-configuration.nix or fileSystem config. - fileSystems."/".device = "/dev/disk/by-label/nixos"; - - boot.loader = { - efi.canTouchEfiVariables = true; - systemd-boot.configurationLimit = 10; - }; - - # Just the bear necessities... - environment.systemPackages = with pkgs; [ - unstable.cached-nix-shell - coreutils - git - vim - wget - gnumake - ]; - - networking.firewall.enable = true; - networking.hosts = - let hostConfig = { - "192.168.1.2" = [ "ao" ]; - "192.168.1.3" = [ "aka" ]; - "192.168.1.10" = [ "kuro" ]; - "192.168.1.11" = [ "shiro" ]; - "192.168.1.12" = [ "midori" ]; - }; - hosts = flatten (attrValues hostConfig); - hostName = config.networking.hostName; - in mkIf (builtins.elem hostName hosts) hostConfig; - - # Use the latest kernel - boot.kernelPackages = pkgs.linuxPackages_latest; - - - ## Location config -- since Toronto is my 127.0.0.1 - time.timeZone = lib.mkDefault "America/Toronto"; - i18n.defaultLocale = lib.mkDefault "en_US.UTF-8"; - # For redshift, mainly - location = (if config.time.timeZone == "America/Toronto" then { - latitude = 43.70011; - longitude = -79.4163; - } else if config.time.timeZone == "Europe/Copenhagen" then { - latitude = 55.88; - longitude = 12.5; - } else {}); - - - ## System security tweaks - boot.tmpOnTmpfs = true; - security.hideProcessInformation = true; - security.protectKernelImage = true; - # Fix a security hole in place for backwards compatibility. See desc in - # nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix - boot.loader.systemd-boot.editor = false; - - # Change me later! - user.initialPassword = "nix"; - users.users.root.initialPassword = "nix"; -} diff --git a/hosts/kuro/default.nix b/hosts/kuro/default.nix index f8079afb..a7a1074a 100644 --- a/hosts/kuro/default.nix +++ b/hosts/kuro/default.nix @@ -1,6 +1,9 @@ { ... }: { - imports = [ ./hardware-configuration.nix ]; + imports = [ + ../personal.nix + ./hardware-configuration.nix + ]; ## Modules modules = { @@ -73,7 +76,6 @@ programs.ssh.startAgent = true; services.openssh.startWhenNeeded = true; - boot.loader.systemd-boot.enable = true; networking.networkmanager.enable = true; # The global useDHCP flag is deprecated, therefore explicitly set to false # here. Per-interface useDHCP will be mandatory in the future, so this diff --git a/hosts/linode.nix b/hosts/linode.nix index ea609567..15f129e9 100644 --- a/hosts/linode.nix +++ b/hosts/linode.nix @@ -27,9 +27,7 @@ { config, lib, pkgs, ... }: -let - inherit (lib) filter pathExists; -in +with lib; { imports = filter pathExists ["/etc/nixos/configuration.nix"]; diff --git a/hosts/personal.nix b/hosts/personal.nix new file mode 100644 index 00000000..835f4cc9 --- /dev/null +++ b/hosts/personal.nix @@ -0,0 +1,28 @@ +{ config, lib, ... }: + +with lib; +{ + networking.hosts = + let hostConfig = { + "192.168.1.2" = [ "ao" ]; + "192.168.1.3" = [ "aka" ]; + "192.168.1.10" = [ "kuro" ]; + "192.168.1.11" = [ "shiro" ]; + "192.168.1.12" = [ "midori" ]; + }; + hosts = flatten (attrValues hostConfig); + hostName = config.networking.hostName; + in mkIf (builtins.elem hostName hosts) hostConfig; + + ## Location config -- since Toronto is my 127.0.0.1 + time.timeZone = mkDefault "America/Toronto"; + i18n.defaultLocale = mkDefault "en_US.UTF-8"; + # For redshift, mainly + location = (if config.time.timeZone == "America/Toronto" then { + latitude = 43.70011; + longitude = -79.4163; + } else if config.time.timeZone == "Europe/Copenhagen" then { + latitude = 55.88; + longitude = 12.5; + } else {}); +} diff --git a/hosts/shiro/default.nix b/hosts/shiro/default.nix index b4aecc25..f61b89dd 100644 --- a/hosts/shiro/default.nix +++ b/hosts/shiro/default.nix @@ -2,7 +2,10 @@ { ... }: { - imports = [ ./hardware-configuration.nix ]; + imports = [ + ../personal.nix + ./hardware-configuration.nix + ]; ## Modules modules = { @@ -77,7 +80,6 @@ programs.ssh.startAgent = true; services.openssh.startWhenNeeded = true; - boot.loader.systemd-boot.enable = true; networking.wireless.enable = true; hardware.opengl.enable = true; diff --git a/lib/default.nix b/lib/default.nix index d74386d8..8cd67160 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -1,4 +1,4 @@ -{ lib, pkgs, ... }: +{ inputs, lib, pkgs, ... }: let inherit (lib) makeExtensible attrValues foldr; @@ -10,8 +10,8 @@ let }; mylib = makeExtensible (self: - with self; mapModules (toString ./.) - (file: import file { inherit self lib pkgs; })); + with self; mapModules ./. + (file: import file { inherit self lib pkgs inputs; })); in mylib.extend (self: super: diff --git a/lib/nixos.nix b/lib/nixos.nix new file mode 100644 index 00000000..754fde40 --- /dev/null +++ b/lib/nixos.nix @@ -0,0 +1,25 @@ +{ inputs, lib, pkgs, ... }: + +with lib; +with lib.my; +let system = "x86_64-linux"; +in { + mkHost = path: attrs @ { system ? system, ... }: + nixosSystem { + inherit system; + specialArgs = { inherit lib inputs; }; + modules = [ + { + nixpkgs.pkgs = pkgs; + networking.hostName = mkDefault (removeSuffix ".nix" (baseNameOf path)); + } + (filterAttrs (n: v: !elem n [ "system" ]) attrs) + ../. + (import path) + ]; + }; + + mapHosts = dir: attrs @ { system ? system, ... }: + mapModules dir + (hostPath: mkHost hostPath attrs); +} diff --git a/modules/editors/emacs.nix b/modules/editors/emacs.nix index f26425f1..3832fb5b 100644 --- a/modules/editors/emacs.nix +++ b/modules/editors/emacs.nix @@ -2,7 +2,7 @@ # https://github.com/hlissner/doom-emacs. This module sets it up to meet my # particular Doomy needs. -{ config, options, lib, pkgs, inputs, ... }: +{ config, lib, pkgs, inputs, ... }: with lib; with lib.my; diff --git a/modules/security.nix b/modules/security.nix new file mode 100644 index 00000000..a2e8a35e --- /dev/null +++ b/modules/security.nix @@ -0,0 +1,16 @@ +{ ... }: + +{ + ## System security tweaks + boot.tmpOnTmpfs = true; + security.hideProcessInformation = true; + security.protectKernelImage = true; + + # Fix a security hole in place for backwards compatibility. See desc in + # nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix + boot.loader.systemd-boot.editor = false; + + # Change me later! + user.initialPassword = "nix"; + users.users.root.initialPassword = "nix"; +}