flake-module.nix

@@ -14,7 +14,6 @@
   systems = ["x86_64-linux"];
   perSystem = {
     config,
-    inputs',
     pkgs,
     ...
   }: {

flake.nix

@@ -28,6 +28,6 @@
     };
   };
 
-  outputs = inputs@{ flake-parts, ... }:
-    flake-parts.lib.mkFlake { inherit inputs; } (import ./flake-module.nix);
+  outputs = inputs @ {flake-parts, ...}:
+    flake-parts.lib.mkFlake {inherit inputs;} (import ./flake-module.nix);
 }

nixos/flake-module.nix

@@ -1,20 +1,30 @@
 # copied and adopted from maralorns config
-
 # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
 # and exposes them as outputs.nixosConfigurations.${name}
-{ withSystem, lib, inputs, ... }: {
+{
+  withSystem,
+  lib,
+  inputs,
+  ...
+}: {
   flake = {
-    nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
-    let
+    nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
       machines = builtins.attrNames (builtins.readDir ./machines);
-      makeSystem = name:
+      makeSystem = name: let
+        importedConfig = import (./. + "/machines/${name}/configuration.nix");
+        systemConfig =
+          if lib.isFunction importedConfig
+          then x: importedConfig (x // {flake-inputs = inputs;})
+          else importedConfig;
+      in
         pkgs.nixos {
           imports = [
-            (import (./. + "/machines/${name}/configuration.nix") inputs)
+            systemConfig
             inputs.sops-nix.nixosModules.sops
             inputs.impermanence.nixosModules.impermanence
           ];
         };
-    in lib.genAttrs machines makeSystem);
+    in
+      lib.genAttrs machines makeSystem);
   };
 }

nixos/machines/ghatanothoa/configuration.nix

@@ -1,19 +1,17 @@
-flake-inputs:
-{config, pkgs, lib, ... }: {
-
-imports = [
+{
+  imports = [
     ./hardware-configuration.nix
     ../../modules/jitsi.nix
     ../../roles
     ./network.nix
-];
+  ];
 
   services.mathebau-jitsi = {
     enable = true;
     hostName = "meet.mathebau.de";
   };
 
-# System configuration here
+  # System configuration here
   networking.hostName = "ghatanothoa";
   system.stateVersion = "23.11";
 }

nixos/machines/ghatanothoa/hardware-configuration.nix

@@ -1,15 +1,15 @@
-{config, lib, pkgs, modulesPath, ...}: {
-  imports = [ ];
+{lib, ...}: {
+  imports = [];
 
   fileSystems."/" = {
     device = "gha-root";
     fsType = "tmpfs";
-    options = [ "size=1G" "mode=755" ];
+    options = ["size=1G" "mode=755"];
   };
   fileSystems."/persist" = {
     device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
     fsType = "btrfs";
-    options = [ "subvol=persist" ];
+    options = ["subvol=persist"];
     neededForBoot = true;
   };
   fileSystems."/boot" = {
@@ -19,11 +19,10 @@
   fileSystems."/nix" = {
     device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
     fsType = "btrfs";
-    options = [ "subvol=nix" ];
+    options = ["subvol=nix"];
   };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
+  swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
 
   nix.settings.max-jobs = lib.mkDefault 4;
 

nixos/machines/ghatanothoa/network.nix

@@ -2,14 +2,15 @@
 # everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
 # depend on the same thing
 {
-  imports = [ ];
+  imports = [];
   networking = {
-    interfaces.enX0.ipv4.addresses = [ {
+    interfaces.enX0.ipv4.addresses = [
+      {
         address = "192.168.0.25";
         prefixLength = 16;
-    } ];
+      }
+    ];
     defaultGateway = "192.168.0.152";
     nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
   };
 }
-

nixos/modules/impermanence.nix

@@ -1,19 +1,20 @@
-{lib, config, ...} :
-
-let 
-  inherit (lib)
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit
+    (lib)
     mkEnableOption
     mkIf
     mkOption
     types
     ;
   cfg = config.impermanence;
-in
+in {
+  imports = [];
 
-{
-imports = [ ];
-
-options.impermanence = {
+  options.impermanence = {
     enable = mkEnableOption "impermanence";
     storagePath = mkOption {
       type = types.path;
@@ -25,9 +26,9 @@ options.impermanence = {
       default = "persist";
       description = "the name of the persistent data store";
     };
-};
+  };
 
-config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
     environment.persistence.${cfg.name} = {
       persistentStoragePath = cfg.storagePath;
       directories = [
@@ -42,6 +43,5 @@ config = mkIf cfg.enable {
       ];
     };
     environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
-};
-
+  };
 }

nixos/modules/jitsi.nix

@@ -1,14 +1,19 @@
-{pkgs, config, lib, modulesPath, ...}:
-let 
-  inherit (lib)
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}: let
+  inherit
+    (lib)
     mkIf
     mkEnableOption
     mkOption
-    head;
+    head
+    ;
   inherit (lib.types) str;
   cfg = config.services.mathebau-jitsi;
-in
-{
+in {
   imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
 
   options.services.mathebau-jitsi = {
@@ -23,18 +28,25 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.jitsi-meet = {
+    services = {
+      jitsi-meet = {
         enable = true;
-      hostName = cfg.hostName;
         config = {
           defaultLang = "de";
         };
+        inherit (cfg) hostName;
       };
-    services.jitsi-videobridge = {
+      jitsi-videobridge = {
         openFirewall = true;
         nat = {
           publicAddress = "130.83.2.184";
-        localAddress = cfg.localAddress;
+          inherit (cfg) localAddress;
+        };
+      };
+      #We are behind a reverse proxy that handles TLS
+      nginx.virtualHosts."${cfg.hostName}" = {
+        enableACME = false;
+        forceSSL = false;
       };
     };
     environment.persistence.${config.impermanence.name} = {
@@ -43,13 +55,7 @@ in
         "/var/lib/prosody"
       ];
     };
-  #We are behind a reverse proxy that handles TLS
-    services.nginx.virtualHosts."${cfg.hostName}" = {
-      enableACME = false;
-      forceSSL = false;
-    };
-
     #The network ports for HTTP(S) are not opened automatically
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedTCPPorts = [80 443];
   };
 }

nixos/roles/admins.nix

@@ -1,37 +1,34 @@
-{lib, ...} :
-with lib;
-
-let
+{lib, ...}:
+with lib; let
   admins = {
     nerf = {
-      hashedPassword =
-        "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
+      hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
       keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
       ];
     };
     gonne = {
-      hashedPassword =
-        "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
+      hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
       keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
       ];
     };
   };
 
-  mkAdmin = name :
-  {hashedPassword, keys}: {
+  mkAdmin = name: {
+    hashedPassword,
+    keys,
+  }: {
     "${name}" = {
       isNormalUser = true;
       createHome = true;
-      extraGroups = [ "wheel" ];
+      extraGroups = ["wheel"];
       group = "users";
       home = "/home/${name}";
-      openssh.authorizedKeys = { inherit keys; };
+      openssh.authorizedKeys = {inherit keys;};
       inherit hashedPassword;
     };
   };
-
 in {
   users.users = mkMerge (mapAttrsToList mkAdmin admins);
 }

nixos/roles/default.nix

@@ -1,46 +1,56 @@
-{pkgs, config, lib, modulesPath, ...} : {
-
-imports = [
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
     ./admins.nix
     ./nix_keys.nix
     ./prometheusNodeExporter.nix
     (modulesPath + "/virtualisation/xen-domU.nix")
     ../modules/impermanence.nix
   ];
-nix = {
+  nix = {
     extraOptions = ''
       experimental-features = nix-command flakes
       builders-use-substitutes = true
     '';
-};
+  };
 
-networking = {
-  firewall = { # these shoud be default, but better make sure!
+  networking = {
+    firewall = {
+      # these shoud be default, but better make sure!
       enable = true;
       allowPing = true;
     };
     nftables.enable = true;
     useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
     # hosts = # TODO write something to autogenerate ip adresses!
-};
+  };
 
-users = {
+  users = {
     mutableUsers = false;
     users.root.hashedPassword = "!";
-};
-
-impermanence.enable = true;
-
-sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-environment = {
-  systemPackages = builtins.attrValues {
-    inherit (pkgs)
-      htop lsof tmux btop;
   };
-};
 
-services = {
+  impermanence.enable = true;
+
+  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+
+  environment = {
+    systemPackages = builtins.attrValues {
+      inherit
+        (pkgs)
+        htop
+        lsof
+        tmux
+        btop
+        ;
+    };
+  };
+
+  services = {
     journald.extraConfig = "SystemMaxUse=5G";
 
     nginx = {
@@ -56,7 +66,7 @@ services = {
         PasswordAuthentication = false;
       };
     };
-#Prevent clock drift due to interaction problem with xen hardware clock 
+    #Prevent clock drift due to interaction problem with xen hardware clock
     timesyncd.enable = lib.mkForce true;
-};
+  };
 }

nixos/roles/nix_keys.nix

@@ -1,5 +1,5 @@
 {
-  imports = [ ];
+  imports = [];
   nix.settings.trusted-public-keys = [
     "nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
     "gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="

nixos/roles/prometheusNodeExporter.nix

@@ -1,6 +1,5 @@
-{config, ...}:
-{
-  imports = [ ];
+{config, ...}: {
+  imports = [];
   services.prometheus.exporters.node = {
     enable = true;
     port = 9100;
@@ -35,6 +34,6 @@
       "processes"
     ];
   };
-  networking.firewall.allowedTCPPorts = [ 9100 ];
-  environment.persistence.${config.impermanence.name}.directories = [ "/var/lib/${config.services.prometheus.stateDir}" ];
+  networking.firewall.allowedTCPPorts = [9100];
+  environment.persistence.${config.impermanence.name}.directories = ["/var/lib/${config.services.prometheus.stateDir}"];
 }