emelie/nix-deploy
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Wiki Activity

Upgrade to 23.05

Browse source
This commit is contained in:
Amanda Graven 2023-06-17 12:22:58 +02:00
parent c0e5c26ae9
commit e21bba4363
Signed by: amanda
GPG key ID: F747582C5608F4CB
8 changed files with 89 additions and 85 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
config/common/services/ssh.nix
View file

@ -2,14 +2,16 @@
{ {
services.openssh = { services.openssh = {
enable = true; enable = true;
permitRootLogin = "no";
passwordAuthentication = false;
kbdInteractiveAuthentication = false;
hostKeys = [ { path = config.secrets.files.ssh_host_ed25519_key.file; type = "ed25519"; } ]; hostKeys = [ { path = config.secrets.files.ssh_host_ed25519_key.file; type = "ed25519"; } ];
kexAlgorithms = [ "curve25519-sha256" "curve25519-sha256@libssh.org" ]; settings = {
macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128-etm@openssh.com" ]; KexAlgorithms = [ "curve25519-sha256" "curve25519-sha256@libssh.org" ];
Macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128-etm@openssh.com" ];
PermitRootLogin = "no";
KbdInteractiveAuthentication = false;
PasswordAuthentication = false;
}; };
};
programs.ssh.knownHosts = { programs.ssh.knownHosts = {
despondos = { despondos = {

3
config/hosts/grondahl/configuration.nix
View file

@ -20,9 +20,8 @@
]; ];
boot.loader.grub.enable = true; boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; boot.loader.grub.device = "/dev/vda";
boot.kernelPackages = pkgs.linuxPackages_5_10; boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
networking = { networking = {
hostName = "grondahl"; hostName = "grondahl";
useDHCP = false; useDHCP = false;

2
config/hosts/rudiger/configuration.nix
View file

@ -17,8 +17,8 @@
]; ];
boot.loader.grub.enable = true; boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/sda"; boot.loader.grub.device = "/dev/sda";
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
boot.supportedFilesystems = ["zfs"]; boot.supportedFilesystems = ["zfs"];
services.zfs.autoSnapshot.enable = false; services.zfs.autoSnapshot.enable = false;

2
config/hosts/rudiger/services/nextcloud.nix
View file

@ -6,7 +6,7 @@
enableBrokenCiphersForSSE = false; enableBrokenCiphersForSSE = false;
hostName = "cloud.graven.dev"; hostName = "cloud.graven.dev";
https = true; https = true;
package = pkgs.nextcloud25; package = pkgs.nextcloud26;
autoUpdateApps.enable = true; autoUpdateApps.enable = true;
maxUploadSize = "10G"; maxUploadSize = "10G";
webfinger = true; webfinger = true;

3
config/hosts/wind/configuration.nix
View file

@ -22,9 +22,8 @@
]; ];
boot.loader.grub.enable = true; boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/sda"; boot.loader.grub.device = "/dev/sda";
boot.kernelPackages = pkgs.linuxPackages_5_10; boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
boot.supportedFilesystems = ["zfs"]; boot.supportedFilesystems = ["zfs"];
services.zfs.autoSnapshot.enable = false; services.zfs.autoSnapshot.enable = false;
services.zfs.autoScrub.enable = true; services.zfs.autoScrub.enable = true;

26
config/sources/nix/sources.json
View file

@ -5,10 +5,10 @@
"homepage": "https://github.com/nmattia/niv", "homepage": "https://github.com/nmattia/niv",
"owner": "nmattia", "owner": "nmattia",
"repo": "niv", "repo": "niv",
"rev": "689d0e5539eddd0b0f566aee7bb18629eee7df74", "rev": "0ebb80e003c26d5388a9b74645fbdcfca3bdd0ef",
"sha256": "1rld3lk42l6b01f2gcrhq8qm9vry1awmfl29zmpiqda9dy89vbx0", "sha256": "0wpnk1n4vjyqwjjrm6dvkyh7xr7983rszfhfcg31v106qhfnh41c",
"type": "tarball", "type": "tarball",
"url": "https://github.com/nmattia/niv/archive/689d0e5539eddd0b0f566aee7bb18629eee7df74.tar.gz", "url": "https://github.com/nmattia/niv/archive/0ebb80e003c26d5388a9b74645fbdcfca3bdd0ef.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}, },
"nixos-hardware": { "nixos-hardware": {
@ -17,22 +17,22 @@
"homepage": "", "homepage": "",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixos-hardware", "repo": "nixos-hardware",
"rev": "d24ea777c57b69c6b143cf11d83184ef71b0dbbf", "rev": "429f232fe1dc398c5afea19a51aad6931ee0fb89",
"sha256": "0hzjm3jvaplm9vrsmnc7ir6jpnf1hnchmm7f2m8r5rwgxkqvpkgg", "sha256": "05a5cfxy9qzb6qq5jrkb65zasa0cmvsym592amjx9sbn7m8858ka",
"type": "tarball", "type": "tarball",
"url": "https://github.com/NixOS/nixos-hardware/archive/d24ea777c57b69c6b143cf11d83184ef71b0dbbf.tar.gz", "url": "https://github.com/NixOS/nixos-hardware/archive/429f232fe1dc398c5afea19a51aad6931ee0fb89.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}, },
"nixpkgs": { "nixpkgs": {
"branch": "release-22.11", "branch": "release-23.05",
"description": "Nix Packages collection", "description": "Nix Packages collection",
"homepage": "", "homepage": "",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "a7af1abd95b89782e24fd7f7b0fb1f12972785cd", "rev": "083cb1a04d196e35b9c8293a379266c854e284c1",
"sha256": "0g8vwn18n9vr14jpv1kd0a8qqdmhx47arjcf196x0ki5rqgvkpb5", "sha256": "0fl9cq9h8i0dc50b1h0snmmcb3vsxz4d14jzsjw4ixfd2bm4dl0n",
"type": "tarball", "type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/a7af1abd95b89782e24fd7f7b0fb1f12972785cd.tar.gz", "url": "https://github.com/NixOS/nixpkgs/archive/083cb1a04d196e35b9c8293a379266c854e284c1.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}, },
"nixus": { "nixus": {
@ -41,10 +41,10 @@
"homepage": "", "homepage": "",
"owner": "Infinisil", "owner": "Infinisil",
"repo": "nixus", "repo": "nixus",
"rev": "9ff2a3923f733849100f99102b57a0d6c7240f2e", "rev": "d8c3e403978da7b11a5dea1d9e8fd4f918668fdd",
"sha256": "1a2dhfrckhv94j4m3q42va1z5k21qk5s25s3m1qj3gkqyxvpilc5", "sha256": "1k145w7yxiwg337hki4vwc398q94j7smhy7bs2j91jahcxy8fb2x",
"type": "tarball", "type": "tarball",
"url": "https://github.com/Infinisil/nixus/archive/9ff2a3923f733849100f99102b57a0d6c7240f2e.tar.gz", "url": "https://github.com/Infinisil/nixus/archive/d8c3e403978da7b11a5dea1d9e8fd4f918668fdd.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
} }
} }

38
config/sources/nix/sources.nix
View file

@ -27,16 +27,17 @@ let
fetch_git = name: spec: fetch_git = name: spec:
let let
ref = ref =
if spec ? ref then spec.ref else spec.ref or (
if spec ? branch then "refs/heads/${spec.branch}" else if spec ? branch then "refs/heads/${spec.branch}" else
if spec ? tag then "refs/tags/${spec.tag}" else if spec ? tag then "refs/tags/${spec.tag}" else
abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!"; abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!"
submodules = if spec ? submodules then spec.submodules else false; );
submodules = spec.submodules or false;
submoduleArg = submoduleArg =
let let
nixSupportsSubmodules = builtins.compareVersions builtins.nixVersion "2.4" >= 0; nixSupportsSubmodules = builtins.compareVersions builtins.nixVersion "2.4" >= 0;
emptyArgWithWarning = emptyArgWithWarning =
if submodules == true if submodules
then then
builtins.trace builtins.trace
( (
@ -44,8 +45,8 @@ let
+ "but your nix's (${builtins.nixVersion}) builtins.fetchGit " + "but your nix's (${builtins.nixVersion}) builtins.fetchGit "
+ "does not support them" + "does not support them"
) )
{} { }
else {}; else { };
in in
if nixSupportsSubmodules if nixSupportsSubmodules
then { inherit submodules; } then { inherit submodules; }
@ -89,7 +90,7 @@ let
if builtins.hasAttr "nixpkgs" sources if builtins.hasAttr "nixpkgs" sources
then sourcesNixpkgs then sourcesNixpkgs
else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then
import <nixpkgs> {} import <nixpkgs> { }
else else
abort abort
'' ''
@ -115,7 +116,7 @@ let
# the path directly as opposed to the fetched source. # the path directly as opposed to the fetched source.
replace = name: drv: replace = name: drv:
let let
saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name; saneName = stringAsChars (c: if (builtins.match "[a-zA-Z0-9]" c) == null then "_" else c) name;
ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}"; ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
in in
if ersatz == "" then drv else if ersatz == "" then drv else
@ -132,7 +133,7 @@ let
); );
# https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295 # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1); range = first: last: if first > last then [ ] else builtins.genList (n: first + n) (last - first + 1);
# https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257 # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1)); stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
@ -143,7 +144,7 @@ let
concatStrings = builtins.concatStringsSep ""; concatStrings = builtins.concatStringsSep "";
# https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331 # https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331
optionalAttrs = cond: as: if cond then as else {}; optionalAttrs = cond: as: if cond then as else { };
# fetchTarball version that is compatible between all the versions of Nix # fetchTarball version that is compatible between all the versions of Nix
builtins_fetchTarball = { url, name ? null, sha256 }@attrs: builtins_fetchTarball = { url, name ? null, sha256 }@attrs:
@ -151,7 +152,7 @@ let
inherit (builtins) lessThan nixVersion fetchTarball; inherit (builtins) lessThan nixVersion fetchTarball;
in in
if lessThan nixVersion "1.12" then if lessThan nixVersion "1.12" then
fetchTarball ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; })) fetchTarball ({ inherit url; } // (optionalAttrs (name != null) { inherit name; }))
else else
fetchTarball attrs; fetchTarball attrs;
@ -161,25 +162,28 @@ let
inherit (builtins) lessThan nixVersion fetchurl; inherit (builtins) lessThan nixVersion fetchurl;
in in
if lessThan nixVersion "1.12" then if lessThan nixVersion "1.12" then
fetchurl ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; })) fetchurl ({ inherit url; } // (optionalAttrs (name != null) { inherit name; }))
else else
fetchurl attrs; fetchurl attrs;
# Create the final "sources" from the config # Create the final "sources" from the config
mkSources = config: mkSources = config:
mapAttrs ( mapAttrs
(
name: spec: name: spec:
if builtins.hasAttr "outPath" spec if builtins.hasAttr "outPath" spec
then abort then
abort
"The values in sources.json should not have an 'outPath' attribute" "The values in sources.json should not have an 'outPath' attribute"
else else
spec // { outPath = replace name (fetch config.pkgs name spec); } spec // { outPath = replace name (fetch config.pkgs name spec); }
) config.sources; )
config.sources;
# The "config" used by the fetchers # The "config" used by the fetchers
mkConfig = mkConfig =
{ sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
, sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile) , sources ? if sourcesFile == null then { } else builtins.fromJSON (builtins.readFile sourcesFile)
, system ? builtins.currentSystem , system ? builtins.currentSystem
, pkgs ? mkPkgs sources system , pkgs ? mkPkgs sources system
}: rec { }: rec {
@ -191,4 +195,4 @@ let
}; };
in in
mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); } mkSources (mkConfig { }) // { __functor = _: settings: mkSources (mkConfig settings); }

6
deploy/default.nix
View file

@ -13,21 +13,21 @@ in import "${sources.nixus}" {} ({ config, ... }: {
nodes = { nodes = {
wind = { lib, config, ... }: { wind = { lib, config, ... }: {
host = "emelie@graven.dev"; host = "graven.dev";
configuration = ../config/hosts/wind/configuration.nix; configuration = ../config/hosts/wind/configuration.nix;
switchTimeout = 300; switchTimeout = 300;
successTimeout = 300; successTimeout = 300;
ignoreFailingSystemdUnits = true; ignoreFailingSystemdUnits = true;
}; };
grondahl = { lib, config, ... }: { grondahl = { lib, config, ... }: {
host = "emelie@anarkafem.dev"; host = "anarkafem.dev";
configuration = ../config/hosts/grondahl/configuration.nix; configuration = ../config/hosts/grondahl/configuration.nix;
successTimeout = 300; successTimeout = 300;
switchTimeout = 300; switchTimeout = 300;
ignoreFailingSystemdUnits = true; ignoreFailingSystemdUnits = true;
}; };
rudiger = { lib, config, ... }: { rudiger = { lib, config, ... }: {
host = "emelie@cloud.graven.dev"; host = "cloud.graven.dev";
configuration = ../config/hosts/rudiger/configuration.nix; configuration = ../config/hosts/rudiger/configuration.nix;
switchTimeout = 300; switchTimeout = 300;
successTimeout = 300; successTimeout = 300;