Migrate packages to use callPackage pattern
All checks were successful
CI / build (push) Successful in 2m46s
All checks were successful
CI / build (push) Successful in 2m46s
This commit is contained in:
parent
478b8903e0
commit
15ece3585e
11 changed files with 92 additions and 62 deletions
2
.gitignore
vendored
2
.gitignore
vendored
|
@ -1,5 +1,5 @@
|
||||||
/configuration.nix
|
/configuration.nix
|
||||||
/result*
|
result*
|
||||||
/host/*/result*
|
/host/*/result*
|
||||||
*.qcow2
|
*.qcow2
|
||||||
/.direnv
|
/.direnv
|
||||||
|
|
2
.vscode/settings.json
vendored
2
.vscode/settings.json
vendored
|
@ -1,5 +1,5 @@
|
||||||
{
|
{
|
||||||
"nix.enableLanguageServer": true,
|
"nix.enableLanguageServer": true,
|
||||||
"nix.formatterPath": "nixfmt",
|
"nix.formatterPath": "nix fmt",
|
||||||
"nix.serverPath": "nixd",
|
"nix.serverPath": "nixd",
|
||||||
}
|
}
|
|
@ -9,12 +9,12 @@
|
||||||
name = "qois-infrastructure-shell";
|
name = "qois-infrastructure-shell";
|
||||||
buildInputs =
|
buildInputs =
|
||||||
let
|
let
|
||||||
vscode-with-extensions = pkgs.vscode-with-extensions.override {
|
vscodium-with-extensions = pkgs.vscode-with-extensions.override {
|
||||||
vscodeExtensions = with pkgs.vscode-extensions; [ jnoortheen.nix-ide ];
|
vscodeExtensions = with pkgs.vscode-extensions; [ jnoortheen.nix-ide ];
|
||||||
vscode = pkgs.vscodium;
|
vscode = pkgs.vscodium;
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
[ vscode-with-extensions ]
|
[ vscodium-with-extensions ]
|
||||||
++ (with self.packages.${system}; [
|
++ (with self.packages.${system}; [
|
||||||
cache
|
cache
|
||||||
deploy-qois
|
deploy-qois
|
||||||
|
|
|
@ -1,11 +0,0 @@
|
||||||
{
|
|
||||||
self,
|
|
||||||
system,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
with pkgs.lib;
|
|
||||||
let
|
|
||||||
nixosConfigs = mapAttrsToList (n: v: v.config.system.build.toplevel) self.nixosConfigurations;
|
|
||||||
in
|
|
||||||
pkgs.linkFarmFromDrvs "allHosts" (nixosConfigs ++ [ self.packages.${system}.docs ])
|
|
16
packages/cache.nix → packages/cache/default.nix
vendored
16
packages/cache.nix → packages/cache/default.nix
vendored
|
@ -1,11 +1,17 @@
|
||||||
{ pkgs, ... }:
|
{
|
||||||
pkgs.writeShellApplication {
|
attic-client,
|
||||||
|
findutils,
|
||||||
|
gnugrep,
|
||||||
|
writeShellApplication,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
writeShellApplication {
|
||||||
name = "cache";
|
name = "cache";
|
||||||
meta.description = "Access the infrastructure's attic cache. Mostly used in CI.";
|
meta.description = "Access the infrastructure's attic cache. Mostly used in CI.";
|
||||||
runtimeInputs = [
|
runtimeInputs = [
|
||||||
pkgs.attic-client
|
attic-client
|
||||||
pkgs.findutils
|
findutils
|
||||||
pkgs.gnugrep
|
gnugrep
|
||||||
];
|
];
|
||||||
text = ''
|
text = ''
|
||||||
SERVER="https://attic.qo.is/"
|
SERVER="https://attic.qo.is/"
|
|
@ -1,17 +1,37 @@
|
||||||
{ system, ... }@inputs:
|
{
|
||||||
|
self,
|
||||||
|
system,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with pkgs.lib;
|
||||||
{
|
{
|
||||||
${system} =
|
${system} =
|
||||||
let
|
let
|
||||||
all = import ./all.nix inputs;
|
packages = pipe (self.lib.foldersWithNix ./.) [
|
||||||
|
(map (name: {
|
||||||
|
inherit name;
|
||||||
|
path = path.append ./. "./${name}/default.nix";
|
||||||
|
}))
|
||||||
|
(map (
|
||||||
|
{ name, path }:
|
||||||
|
{
|
||||||
|
inherit name;
|
||||||
|
value = pkgs.callPackage path {
|
||||||
|
inherit self;
|
||||||
|
inherit system;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
))
|
||||||
|
listToAttrs
|
||||||
|
];
|
||||||
in
|
in
|
||||||
{
|
packages
|
||||||
inherit all;
|
// {
|
||||||
default = all;
|
default =
|
||||||
cache = import ./cache.nix inputs;
|
let
|
||||||
deploy-qois = import ./deploy-qois.nix inputs;
|
nixosConfigs = mapAttrsToList (n: v: v.config.system.build.toplevel) self.nixosConfigurations;
|
||||||
docs = import ./docs.nix inputs;
|
in
|
||||||
sops = import ./sops.nix inputs;
|
pkgs.linkFarmFromDrvs "all" (nixosConfigs ++ (attrValues packages));
|
||||||
sops-config = import ./sops-config.nix inputs;
|
|
||||||
sops-rekey = import ./sops-rekey.nix inputs;
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,13 +1,13 @@
|
||||||
{
|
{
|
||||||
pkgs,
|
deploy-rs,
|
||||||
self,
|
self,
|
||||||
system,
|
writeShellApplication,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
pkgs.writeShellApplication {
|
writeShellApplication {
|
||||||
name = "deploy-qois";
|
name = "deploy-qois";
|
||||||
meta.description = "Deploy configuration to specificed targets.";
|
meta.description = "Deploy configuration to specificed targets.";
|
||||||
runtimeInputs = [ pkgs.deploy-rs ];
|
runtimeInputs = [ deploy-rs ];
|
||||||
text = ''
|
text = ''
|
||||||
deploy --interactive --targets "''${@:-${self}}"
|
deploy --interactive --targets "''${@:-${self}}"
|
||||||
'';
|
'';
|
|
@ -1,16 +1,24 @@
|
||||||
{ pkgs, self, ... }:
|
{
|
||||||
|
mdbook-cmdrun,
|
||||||
|
mdbook-plantuml,
|
||||||
|
mdbook,
|
||||||
|
plantuml,
|
||||||
|
self,
|
||||||
|
stdenv,
|
||||||
|
...
|
||||||
|
}:
|
||||||
let
|
let
|
||||||
version = self.rev or self.dirtyRev;
|
version = self.rev or self.dirtyRev;
|
||||||
in
|
in
|
||||||
pkgs.stdenv.mkDerivation {
|
stdenv.mkDerivation {
|
||||||
inherit version;
|
inherit version;
|
||||||
name = "qois-docs-${version}";
|
name = "qois-docs-${version}";
|
||||||
buildInputs = with pkgs; [
|
buildInputs = [
|
||||||
mdbook
|
mdbook
|
||||||
mdbook-cmdrun
|
mdbook-cmdrun
|
||||||
mdbook-plantuml
|
mdbook-plantuml
|
||||||
plantuml
|
plantuml
|
||||||
];
|
];
|
||||||
src = ../.;
|
src = self;
|
||||||
buildPhase = "mdbook build --dest-dir $out";
|
buildPhase = "mdbook build --dest-dir $out";
|
||||||
}
|
}
|
|
@ -1,19 +1,24 @@
|
||||||
{
|
{
|
||||||
pkgs,
|
gnugrep,
|
||||||
|
gnupg,
|
||||||
|
lib,
|
||||||
|
runCommand,
|
||||||
self,
|
self,
|
||||||
system,
|
ssh-to-age,
|
||||||
|
writeText,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
|
with lib;
|
||||||
let
|
let
|
||||||
metaHostConfigs = import ../defaults/meta/hosts.nix { inherit pkgs; };
|
metaHostConfigs = import ../../defaults/meta/hosts.nix { };
|
||||||
userPgpKeys =
|
userPgpKeys =
|
||||||
let
|
let
|
||||||
keysFolder = "${self.inputs.private}/sops_keys";
|
keysFolder = "${self.inputs.private}/sops_keys";
|
||||||
gpgFingerprintsFile =
|
gpgFingerprintsFile =
|
||||||
pkgs.runCommand "userPgpKeys"
|
runCommand "userPgpKeys"
|
||||||
{
|
{
|
||||||
src = keysFolder;
|
src = keysFolder;
|
||||||
buildInputs = with pkgs; [
|
buildInputs = [
|
||||||
gnupg
|
gnupg
|
||||||
gnugrep
|
gnugrep
|
||||||
];
|
];
|
||||||
|
@ -36,13 +41,13 @@ let
|
||||||
userAgeKeys = [ ];
|
userAgeKeys = [ ];
|
||||||
serverAgeKeys =
|
serverAgeKeys =
|
||||||
let
|
let
|
||||||
getHostsWithSshKeys = pkgs.lib.filterAttrs (name: cfg: cfg ? sshKey);
|
getHostsWithSshKeys = filterAttrs (name: cfg: cfg ? sshKey);
|
||||||
mapHostToAgeKey = builtins.mapAttrs (
|
mapHostToAgeKey = mapAttrs (
|
||||||
name: cfg:
|
name: cfg:
|
||||||
pkgs.lib.readFile (
|
readFile (
|
||||||
pkgs.runCommand "sshToAgeKey"
|
runCommand "sshToAgeKey"
|
||||||
{
|
{
|
||||||
buildInputs = [ pkgs.ssh-to-age ];
|
buildInputs = [ ssh-to-age ];
|
||||||
}
|
}
|
||||||
''
|
''
|
||||||
echo "${cfg.sshKey}" | ssh-to-age -o $out
|
echo "${cfg.sshKey}" | ssh-to-age -o $out
|
||||||
|
@ -51,14 +56,14 @@ let
|
||||||
);
|
);
|
||||||
in
|
in
|
||||||
mapHostToAgeKey (getHostsWithSshKeys metaHostConfigs.qois.meta.hosts);
|
mapHostToAgeKey (getHostsWithSshKeys metaHostConfigs.qois.meta.hosts);
|
||||||
toCommaList = builtins.concatStringsSep ",";
|
toCommaList = concatStringsSep ",";
|
||||||
in
|
in
|
||||||
pkgs.writeText ".sops.yaml" (
|
writeText ".sops.yaml" (
|
||||||
''
|
''
|
||||||
# This file was generated by nix, see packages/sops-config.nix for details.
|
# This file was generated by nix, see packages/sops-config.nix for details.
|
||||||
''
|
''
|
||||||
+ builtins.toJSON {
|
+ strings.toJSON {
|
||||||
keys = userPgpKeys ++ userAgeKeys ++ builtins.attrValues serverAgeKeys;
|
keys = userPgpKeys ++ userAgeKeys ++ attrValues serverAgeKeys;
|
||||||
creation_rules =
|
creation_rules =
|
||||||
[
|
[
|
||||||
# Secrets for administrators (a.k.a. passwords)
|
# Secrets for administrators (a.k.a. passwords)
|
||||||
|
@ -78,7 +83,7 @@ pkgs.writeText ".sops.yaml" (
|
||||||
++
|
++
|
||||||
|
|
||||||
# Server specific secrets
|
# Server specific secrets
|
||||||
(pkgs.lib.mapAttrsToList (serverName: serverKey: {
|
(mapAttrsToList (serverName: serverKey: {
|
||||||
path_regex = "private/nixos-configurations/${serverName}/secrets\.sops\.(yaml|json|env|ini)$";
|
path_regex = "private/nixos-configurations/${serverName}/secrets\.sops\.(yaml|json|env|ini)$";
|
||||||
pgp = toCommaList userPgpKeys;
|
pgp = toCommaList userPgpKeys;
|
||||||
age = toCommaList (userAgeKeys ++ [ serverKey ]);
|
age = toCommaList (userAgeKeys ++ [ serverKey ]);
|
|
@ -1,14 +1,15 @@
|
||||||
{
|
{
|
||||||
pkgs,
|
findutils,
|
||||||
self,
|
self,
|
||||||
system,
|
system,
|
||||||
|
writeShellApplication,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
pkgs.writeShellApplication {
|
writeShellApplication {
|
||||||
name = "sops-rekey";
|
name = "sops-rekey";
|
||||||
meta.description = "Rekey all sops secrets with changed keys";
|
meta.description = "Rekey all sops secrets with changed keys";
|
||||||
runtimeInputs = [
|
runtimeInputs = [
|
||||||
pkgs.findutils
|
findutils
|
||||||
self.packages.${system}.sops
|
self.packages.${system}.sops
|
||||||
];
|
];
|
||||||
text = ''
|
text = ''
|
|
@ -1,13 +1,14 @@
|
||||||
{
|
{
|
||||||
pkgs,
|
gitMinimal,
|
||||||
self,
|
nix,
|
||||||
system,
|
sops,
|
||||||
|
writeShellApplication,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
pkgs.writeShellApplication {
|
writeShellApplication {
|
||||||
name = "sops";
|
name = "sops";
|
||||||
meta.description = "Run SOPS with the generated configuration";
|
meta.description = "Run SOPS with the generated configuration";
|
||||||
runtimeInputs = with pkgs; [
|
runtimeInputs = [
|
||||||
sops
|
sops
|
||||||
gitMinimal
|
gitMinimal
|
||||||
nix
|
nix
|
Loading…
Reference in a new issue