138 lines
4 KiB
Nix
138 lines
4 KiB
Nix
{
|
||
description = "Forgejo CI Runners";
|
||
|
||
inputs = {
|
||
# NixOS nixpkgs 24.11
|
||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
|
||
|
||
# Lix - Substitution of the Nix package manager, focused on correctness, usability, and growth – and committed to doing right by its community.
|
||
# https://git.lix.systems/lix-project/lix
|
||
lix-module = {
|
||
url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-2.tar.gz";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
|
||
# srvos - NixOS modules for Hetzner Cloud and other services
|
||
srvos.url = "github:numtide/srvos";
|
||
|
||
# disko - NixOS module for managing disks
|
||
disko.url = "github:nix-community/disko";
|
||
|
||
# Cachix helper functions for deploying NixOS systems with flakes.
|
||
cachix-deploy-flake.url = "github:cachix/cachix-deploy-flake";
|
||
|
||
# Cachix - Nix binary cache hosting and continuous integration
|
||
cachix-flake = {
|
||
url = "github:cachix/cachix";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
|
||
# sops-nix - Atomic secret provisioning for NixOS based on sops
|
||
# https://github.com/Mic92/sops-nix
|
||
sops-nix = {
|
||
url = "github:Mic92/sops-nix";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
};
|
||
|
||
outputs =
|
||
{
|
||
self,
|
||
sops-nix,
|
||
nixpkgs,
|
||
srvos,
|
||
disko,
|
||
cachix-flake,
|
||
cachix-deploy-flake,
|
||
lix-module,
|
||
...
|
||
}@inputs:
|
||
let
|
||
inherit (nixpkgs) lib;
|
||
common = system: rec {
|
||
pkgs = import nixpkgs {
|
||
inherit system;
|
||
overlays = [
|
||
(final: prev: {
|
||
cachix = cachix-flake.packages.${system}.default;
|
||
})
|
||
];
|
||
};
|
||
cachix-deploy-lib = cachix-deploy-flake.lib pkgs;
|
||
};
|
||
|
||
aarch64-linux-modules = [ ];
|
||
|
||
x86_64-linux-modules = [
|
||
"${inputs.nixpkgs}/nixos/modules/virtualisation/lxd-virtual-machine.nix"
|
||
sops-nix.nixosModules.sops
|
||
srvos.nixosModules.server
|
||
lix-module.nixosModules.default
|
||
./profiles/role-lxc-vm.nix
|
||
{
|
||
users.users.root.openssh.authorizedKeys.keys = [
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
||
];
|
||
services.openssh.enable = true;
|
||
services.openssh.settings.PermitRootLogin = "without-password";
|
||
}
|
||
];
|
||
in
|
||
{
|
||
# NixOS configurations for manual deployment
|
||
nixosConfigurations = {
|
||
"x86_64" = lib.nixosSystem {
|
||
system = "x86_64-linux";
|
||
specialArgs = { inherit inputs; };
|
||
modules = x86_64-linux-modules;
|
||
};
|
||
};
|
||
|
||
# Cachix deploy for automated deployments
|
||
packages.aarch64-linux.default =
|
||
let
|
||
inherit (common "aarch64-linux") cachix-deploy-lib;
|
||
in
|
||
cachix-deploy-lib.nixos {
|
||
imports = aarch64-linux-modules;
|
||
};
|
||
packages.x86_64-linux.default =
|
||
let
|
||
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||
in
|
||
cachix-deploy-lib.nixos {
|
||
imports = x86_64-linux-modules;
|
||
};
|
||
|
||
# Constructs a deploy.json output that can be used to deploy the runners
|
||
# https://docs.cachix.org/deploy/reference#deploy-json
|
||
|
||
deploy-json = {
|
||
"x86_64" =
|
||
let
|
||
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||
in
|
||
cachix-deploy-lib.spec {
|
||
agents = {
|
||
"x86_64" =
|
||
let
|
||
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||
in
|
||
cachix-deploy-lib.nixos {
|
||
imports = x86_64-linux-modules;
|
||
};
|
||
};
|
||
};
|
||
};
|
||
|
||
# Convenience output that aggregates the outputs for home, nixos.
|
||
# Also used in ci to build targets generally.
|
||
top =
|
||
let
|
||
nixtop = nixpkgs.lib.genAttrs (builtins.attrNames inputs.self.nixosConfigurations) (
|
||
attr: inputs.self.nixosConfigurations.${attr}.config.system.build.toplevel
|
||
);
|
||
in
|
||
nixtop;
|
||
};
|
||
}
|