pre-commit #23

Merged
Gonne merged 3 commits from nerf/nixConfig:pre-commit into main 2023-11-09 15:20:45 +00:00
15 changed files with 352 additions and 204 deletions

2
.gitignore vendored
View file

@ -2,4 +2,4 @@
# Ignore build outputs from performing a nix-build or `nix build` command # Ignore build outputs from performing a nix-build or `nix build` command
result result
result-* result-*
.pre-commit-config.yaml

View file

@ -146,8 +146,7 @@ machine. The only technically required file in there is `configuration.nix`. So
A good skeleton is probably: A good skeleton is probably:
``` ```
flake-inputs: {config, pkgs, lib, flake-inputs, ... }: {
{config, pkgs, lib, ... }: {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
@ -170,6 +169,10 @@ In your hardware
configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff
is already taken care of by `../../roles`. is already taken care of by `../../roles`.
The `flake-inputs` argument is optional, but you can use it if you need to get a hold of the flake inputs,
else this is a complete normal nixos system configuration module (with a lot of settings already imorted
from `../../roles`).
As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
this is constant across all systems and will undergo refactor soon. this is constant across all systems and will undergo refactor soon.
@ -278,3 +281,31 @@ something like this:
{lib, pkgs, config, ...} : {lib, pkgs, config, ...} :
<module code > <module code >
``` ```
# Contributing
Like with all FS projects, you are welcome to contribute. Work is done usually by the person that is most annoyed
by the circumstances or by the person that didn't run fast enough. So we are happy if we get help. That doesn't
mean that we don't need to have some level of quality, people after us needs to work with it. It is live infrastructure
and downtime hurts someone (and in the wrong moment even really bad (Matheball ticket sales for example)).
So here are some Guidelines.
## Coding style and linting.
If you run `nix flake check` there are automated checks in place, please make sure to pass them.
There is also a code autoformatter (`alejandra`) incorporated into those. If you want to run
it you can do so over the development shell or by running `nix fmt`.
You can also install
them into your local git repository as pre-commit hooks, and setting up a shell that has
even more tooling by running `nix develop`. That will give you a bash in which you can run
all the checks manually `pre-commit run -a`. This will also run the autoformatter.
## Process for submitting changes
1. If it is something bigger, please open an issue first describing what and why you want to do something.
If it is just something small, skip this step.
2. Fork the repo and implement your changes in a branch on your fork. Afterwards open a pull request (possibly mentioning the issue).
Against the main branch.
- Your branch should be based on an up to date version of main, if it is not consider rebasing.
3. You will need to find someone with the proper rights to approve of your changes, but most of the time there will be request
for changes first.

View file

@ -1,24 +1,56 @@
{inputs, ...}: {inputs, ...}: {
{
# debug = true; # debug = true;
# We only define machines config in this flake yet, so we only include # We only define machines config in this flake yet, so we only include
# the module that builds these. This file might get fuller, if we need to # the module that builds these. This file might get fuller, if we need to
# build our own packages, that are not flakes. # build our own packages, that are not flakes.
imports = [ ./nixos/flake-module.nix imports = [
./nixos/flake-module.nix
inputs.pre-commit-hooks.flakeModule
# To import a flake module # To import a flake module
# 1. Add foo to inputs # 1. Add foo to inputs
# 2. Add foo as a parameter to the outputs function # 2. Add foo as a parameter to the outputs function
# 3. Add here: foo.flakeModule # 3. Add here: foo.flakeModule
]; ];
systems = ["x86_64-linux"]; systems = ["x86_64-linux"];
# perSystem = { config, self', inputs', pkgs, system, ... }: { perSystem = {
config,
pkgs,
...
}: {
devShells.default = config.pre-commit.devShell;
pre-commit = let
generatedFiles = [
"hardware-configuration\\.nix"
];
in {
check.enable = true;
settings = {
# for some reason statix takes it config differently than all the other hooks.
settings.statix = {
format = "stderr";
ignore = generatedFiles;
};
hooks = {
nil.enable = true;
statix.enable = true;
deadnix = {
enable = true;
excludes = generatedFiles;
};
alejandra.enable = true;
};
};
};
formatter = pkgs.alejandra;
# Per-system attributes can be defined here. The self' and inputs' # Per-system attributes can be defined here. The self' and inputs'
# module parameters provide easy access to attributes of the same # module parameters provide easy access to attributes of the same
# system. # system.
};
# Equivalent to inputs'.nixpkgs.legacyPackages.hello; # Equivalent to inputs'.nixpkgs.legacyPackages.hello;
# };
# flake = { # flake = {
# The usual flake attributes can be defined here, including system- # The usual flake attributes can be defined here, including system-
# agnostic ones like nixosModule and system-enumerating ones, although # agnostic ones like nixosModule and system-enumerating ones, although

View file

@ -33,6 +33,24 @@
"type": "indirect" "type": "indirect"
} }
}, },
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1685518550,
"narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"impermanence": { "impermanence": {
"locked": { "locked": {
"lastModified": 1697303681, "lastModified": 1697303681,
@ -151,12 +169,35 @@
"type": "github" "type": "github"
} }
}, },
"pre-commit-hooks": {
"inputs": {
"flake-compat": [],
"flake-utils": "flake-utils",
"gitignore": [],
"nixpkgs": [],
"nixpkgs-stable": []
},
"locked": {
"lastModified": 1699271226,
"narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"root": { "root": {
"inputs": { "inputs": {
"flake-parts": "flake-parts", "flake-parts": "flake-parts",
"impermanence": "impermanence", "impermanence": "impermanence",
"nixos-mailserver": "nixos-mailserver", "nixos-mailserver": "nixos-mailserver",
"nixpkgs": "nixpkgs", "nixpkgs": "nixpkgs",
"pre-commit-hooks": "pre-commit-hooks",
"sops-nix": "sops-nix" "sops-nix": "sops-nix"
} }
}, },
@ -181,6 +222,21 @@
"type": "github" "type": "github"
} }
}, },
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": { "utils": {
"locked": { "locked": {
"lastModified": 1605370193, "lastModified": 1605370193,

View file

@ -17,6 +17,15 @@
impermanence = { impermanence = {
url = "github:nix-community/impermanence"; url = "github:nix-community/impermanence";
}; };
pre-commit-hooks = {
url = "github:cachix/pre-commit-hooks.nix";
inputs = {
flake-compat.follows = "";
gitignore.follows = "";
nixpkgs-stable.follows = "";
nixpkgs.follows = "";
};
};
}; };
outputs = inputs @ {flake-parts, ...}: outputs = inputs @ {flake-parts, ...}:

View file

@ -1,20 +1,30 @@
# copied and adopted from maralorns config # copied and adopted from maralorns config
# This automatically searches for nixos configs in ./machines/${name}/configuration.nix # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
# and exposes them as outputs.nixosConfigurations.${name} # and exposes them as outputs.nixosConfigurations.${name}
{ withSystem, lib, inputs, ... }: { {
withSystem,
lib,
inputs,
...
}: {
flake = { flake = {
nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }: nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
let
machines = builtins.attrNames (builtins.readDir ./machines); machines = builtins.attrNames (builtins.readDir ./machines);
makeSystem = name: makeSystem = name: let
importedConfig = import (./. + "/machines/${name}/configuration.nix");
systemConfig =
if lib.isFunction importedConfig
then x: importedConfig (x // {flake-inputs = inputs;})
else importedConfig;
in
pkgs.nixos { pkgs.nixos {
imports = [ imports = [
(import (./. + "/machines/${name}/configuration.nix") inputs) systemConfig
inputs.sops-nix.nixosModules.sops inputs.sops-nix.nixosModules.sops
inputs.impermanence.nixosModules.impermanence inputs.impermanence.nixosModules.impermanence
]; ];
}; };
in lib.genAttrs machines makeSystem); in
lib.genAttrs machines makeSystem);
}; };
} }

View file

@ -1,6 +1,4 @@
flake-inputs: {
{config, pkgs, lib, ... }: {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
../../modules/jitsi.nix ../../modules/jitsi.nix

View file

@ -1,4 +1,4 @@
{config, lib, pkgs, modulesPath, ...}: { {lib, ...}: {
imports = []; imports = [];
fileSystems."/" = { fileSystems."/" = {
@ -22,8 +22,7 @@
options = ["subvol=nix"]; options = ["subvol=nix"];
}; };
swapDevices = swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
[{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
nix.settings.max-jobs = lib.mkDefault 4; nix.settings.max-jobs = lib.mkDefault 4;

View file

@ -4,12 +4,13 @@
{ {
imports = []; imports = [];
networking = { networking = {
interfaces.enX0.ipv4.addresses = [ { interfaces.enX0.ipv4.addresses = [
{
address = "192.168.0.25"; address = "192.168.0.25";
prefixLength = 16; prefixLength = 16;
} ]; }
];
defaultGateway = "192.168.0.152"; defaultGateway = "192.168.0.152";
nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
}; };
} }

View file

@ -1,16 +1,17 @@
{lib, config, ...} : {
lib,
let config,
inherit (lib) ...
}: let
inherit
(lib)
mkEnableOption mkEnableOption
mkIf mkIf
mkOption mkOption
types types
; ;
cfg = config.impermanence; cfg = config.impermanence;
in in {
{
imports = []; imports = [];
options.impermanence = { options.impermanence = {
@ -43,5 +44,4 @@ config = mkIf cfg.enable {
}; };
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id"; environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
}; };
} }

View file

@ -1,14 +1,19 @@
{pkgs, config, lib, modulesPath, ...}: {
let config,
inherit (lib) lib,
modulesPath,
...
}: let
inherit
(lib)
mkIf mkIf
mkEnableOption mkEnableOption
mkOption mkOption
head; head
;
inherit (lib.types) str; inherit (lib.types) str;
cfg = config.services.mathebau-jitsi; cfg = config.services.mathebau-jitsi;
in in {
{
imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")]; imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
options.services.mathebau-jitsi = { options.services.mathebau-jitsi = {
@ -23,18 +28,25 @@ in
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.jitsi-meet = { services = {
jitsi-meet = {
enable = true; enable = true;
hostName = cfg.hostName;
config = { config = {
defaultLang = "de"; defaultLang = "de";
}; };
inherit (cfg) hostName;
}; };
services.jitsi-videobridge = { jitsi-videobridge = {
openFirewall = true; openFirewall = true;
nat = { nat = {
publicAddress = "130.83.2.184"; publicAddress = "130.83.2.184";
localAddress = cfg.localAddress; inherit (cfg) localAddress;
};
};
#We are behind a reverse proxy that handles TLS
nginx.virtualHosts."${cfg.hostName}" = {
enableACME = false;
forceSSL = false;
}; };
}; };
environment.persistence.${config.impermanence.name} = { environment.persistence.${config.impermanence.name} = {
@ -43,12 +55,6 @@ in
"/var/lib/prosody" "/var/lib/prosody"
]; ];
}; };
#We are behind a reverse proxy that handles TLS
services.nginx.virtualHosts."${cfg.hostName}" = {
enableACME = false;
forceSSL = false;
};
#The network ports for HTTP(S) are not opened automatically #The network ports for HTTP(S) are not opened automatically
networking.firewall.allowedTCPPorts = [80 443]; networking.firewall.allowedTCPPorts = [80 443];
}; };

View file

@ -1,26 +1,24 @@
{lib, ...}: {lib, ...}:
with lib; with lib; let
let
admins = { admins = {
nerf = { nerf = {
hashedPassword = hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
"$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
keys = [ keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
]; ];
}; };
gonne = { gonne = {
hashedPassword = hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
"$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
keys = [ keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
]; ];
}; };
}; };
mkAdmin = name : mkAdmin = name: {
{hashedPassword, keys}: { hashedPassword,
keys,
}: {
"${name}" = { "${name}" = {
isNormalUser = true; isNormalUser = true;
createHome = true; createHome = true;
@ -31,7 +29,6 @@ let
inherit hashedPassword; inherit hashedPassword;
}; };
}; };
in { in {
users.users = mkMerge (mapAttrsToList mkAdmin admins); users.users = mkMerge (mapAttrsToList mkAdmin admins);
} }

View file

@ -1,5 +1,9 @@
{pkgs, config, lib, modulesPath, ...} : { {
pkgs,
lib,
modulesPath,
...
}: {
imports = [ imports = [
./admins.nix ./admins.nix
./nix_keys.nix ./nix_keys.nix
@ -15,7 +19,8 @@ nix = {
}; };
networking = { networking = {
firewall = { # these shoud be default, but better make sure! firewall = {
# these shoud be default, but better make sure!
enable = true; enable = true;
allowPing = true; allowPing = true;
}; };
@ -35,8 +40,13 @@ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
environment = { environment = {
systemPackages = builtins.attrValues { systemPackages = builtins.attrValues {
inherit (pkgs) inherit
htop lsof tmux btop; (pkgs)
htop
lsof
tmux
btop
;
}; };
}; };

View file

@ -1,5 +1,4 @@
{config, ...}: {config, ...}: {
{
imports = []; imports = [];
services.prometheus.exporters.node = { services.prometheus.exporters.node = {
enable = true; enable = true;