sfos/flake.nix

{
  description = "sfos (self-host os)";
  nixConfig = {
    extra-substituters = ["https://microvm.cachix.org"];
    extra-trusted-public-keys = ["microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys="];
  };

  inputs = {
    flake-utils.url = "github:numtide/flake-utils";
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    stable.url = "github:NixOS/nixpkgs/nixos-24.05";
    systems.url = "github:nix-systems/default";
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
    devenv.url = "github:cachix/devenv";
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    ess = {
      url = "github:acaloiaro/ess/v2.13.0";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    microvm = {
      url = "github:astro/microvm.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = inputs @ {
    agenix,
    devenv,
    microvm,
    nixpkgs,
    self,
    stable,
    systems,
    ...
  }: let
    inherit (self) outputs;
    lib = nixpkgs.lib;
    pkgs = nixpkgs.legacyPackages."x86_64-linux";
    system = "x86_64-linux";
    forEachSystem = nixpkgs.lib.genAttrs (import systems);
  in {
    inherit lib;
    packages.${system} = {
      default = self.packages.${system}.my-microvm;
      my-microvm = self.nixosConfigurations.my-microvm.config.microvm.declaredRunner;
    };
    devShells = forEachSystem (system: let
      config = self.devShells.${system}.default.config;
    in {
      default = devenv.lib.mkShell {
        inherit inputs pkgs;
        modules = [
          {
            languages = {
              nix.enable = true;
            };

            packages = with pkgs; [
              opentofu
              pre-commit
              nixos-anywhere
            ];

            enterShell =
              #bash
              ''
                run-show-help
              '';

            pre-commit.hooks.env-sample-sync = {
              enable = true;
              always_run = true;
              pass_filenames = false;
              name = "env-sample-sync";
              description = "Sync secrets to env.sample";
              entry = "${inputs.ess.packages.${system}.default}/bin/ess";
            };

            scripts = {
              run-show-help = {
                description = "Show this help text";
                exec = ''
                  echo
                  echo Helper scripts available:
                  echo
                  ${pkgs.gnused}/bin/sed -e 's| |XX|g' \
                    -e 's|=| |' <<EOF | \
                    ${pkgs.util-linuxMinimal}/bin/column -t | \
                    ${pkgs.gnused}/bin/sed -e 's|XX| |g'
                  ${pkgs.lib.generators.toKeyValue {} (pkgs.lib.mapAttrs (name: value: value.description) config.scripts)}
                  EOF
                  echo
                  echo To start the web server, the tasks server, create certificates,
                  echo 'add hosts to hostsfiles, dependent services, (redis, et al),'
                  echo just type
                  echo
                  echo "    devenv up"
                  echo
                  echo
                '';
              };
            };
          }
        ];
      };
    });

    nixosModules = import ./modules/nixos;
    nixosConfigurations = let
      nixos-config = {
        modules,
        system ? "x86_64-linux",
      }:
        nixpkgs.lib.nixosSystem {
          inherit system;
          specialArgs = {inherit inputs outputs stable self;};
          modules =
            modules
            ++ [
              (import ./overlays)
              agenix.nixosModules.default
              {environment.systemPackages = [agenix.packages.${system}.default];}
            ];
        };
      microvm-config = {modules}:
        nixpkgs.lib.nixosSystem {
          inherit system;
          specialArgs = {inherit inputs outputs stable self;};
          modules =
            modules
            ++ [
              microvm.nixosModules.microvm
              {
                users.users.root.password = "";
                microvm = {
                  volumes = [
                    {
                      mountPoint = "/var";
                      image = "var.img";
                      size = 1024;
                    }
                  ];

                  interfaces = [
                    {
                      type = "user";
                      id = "net1";
                      mac = "02:00:00:00:00:01";
                    }
                  ];
                  shares = [
                    {
                      # use proto = "virtiofs" for MicroVMs that are started by systemd
                      proto = "9p";
                      tag = "ro-store";
                      # a host's /nix/store will be picked up so that no
                      # squashfs/erofs will be built for it.
                      source = "/nix/store";
                      mountPoint = "/nix/.ro-store";
                    }
                  ];

                  # "qemu" has 9p built-in!
                  hypervisor = "qemu";
                  socket = "control.socket";
                };
              }
            ];
        };
    in {
      sfos-host-01 = nixos-config {modules = [./nixos/sfos-host-01/configuration.nix];};
      my-microvm = microvm-config {modules = [./nixos/sfos-host-01/configuration.nix];};
    };
  };
}