forked from Fediversity/Fediversity
Valentin Gagarin
7c33e8aaf3
This setup is greatly inspired by the one used for [0], although with notable modifications, such as: - a SASS preprocessor and CSS compressor - more streamlined NixOS integration tests - cleaned up service configuration - a few notes on how to do things better in the future [0]: https://github.com/Nix-Security-WG/nix-security-tracker/ Apart from cloning the Nix setup, there were additional steps: - Create an empty `src` directory, since the package requires it - In the development shell, run `django-admin startproject panel src` Note that while you can already do ```bash manage migrate manage runserver ``` the NixOS integration tests will fail, since `settings.py` needs careful massaging to expose knobs that can be turned from our systemd wrapper. The required changes are introduced in the next commit to make them observable. Noteworthy related work: - https://github.com/sephii/django.nix Rather mature setup with a clean interface, uses Caddy as reverse proxy. - https://git.dgnum.eu/mdebray/djangonix A work-in-progress attempt to capture more moving parts through the module system, in particular secrets. - https://github.com/DavHau/django-nixos Out of date and somewhat simplistic, but serves as a reasonable example for what can be done I chose the variant I'm intimately familiar with in order to be able to pass on knowledge or help with maintenance. But for the future I strongly recommend picking the good bits from the other implementations that control complexity in static configuration parts through Nix expressions.
83 lines
2.1 KiB
Nix
83 lines
2.1 KiB
Nix
{
|
|
inputs = {
|
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
|
|
flake-parts.url = "github:hercules-ci/flake-parts";
|
|
git-hooks.url = "github:cachix/git-hooks.nix";
|
|
agenix.url = "github:ryantm/agenix";
|
|
|
|
disko.url = "github:nix-community/disko";
|
|
|
|
nixops4.url = "github:nixops4/nixops4";
|
|
nixops4-nixos.url = "github:nixops4/nixops4-nixos";
|
|
};
|
|
|
|
outputs =
|
|
inputs@{ flake-parts, ... }:
|
|
flake-parts.lib.mkFlake { inherit inputs; } {
|
|
systems = [
|
|
"x86_64-linux"
|
|
"aarch64-linux"
|
|
"x86_64-darwin"
|
|
"aarch64-darwin"
|
|
];
|
|
|
|
imports = [
|
|
inputs.git-hooks.flakeModule
|
|
inputs.nixops4.modules.flake.default
|
|
|
|
./deployment/flake-part.nix
|
|
./infra/flake-part.nix
|
|
./services/flake-part.nix
|
|
];
|
|
|
|
perSystem =
|
|
{
|
|
config,
|
|
pkgs,
|
|
inputs',
|
|
...
|
|
}:
|
|
{
|
|
formatter = pkgs.nixfmt-rfc-style;
|
|
|
|
pre-commit.settings.hooks =
|
|
## Not everybody might want pre-commit hooks, so we make them
|
|
## opt-in. Maybe one day we will decide to have them everywhere.
|
|
let
|
|
inherit (builtins) concatStringsSep;
|
|
optin = [
|
|
"deployment"
|
|
"infra"
|
|
"keys"
|
|
"secrets"
|
|
"services"
|
|
"panel"
|
|
];
|
|
files = "^((" + concatStringsSep "|" optin + ")/.*\\.nix|[^/]*\\.nix)$";
|
|
in
|
|
{
|
|
nixfmt-rfc-style = {
|
|
enable = true;
|
|
inherit files;
|
|
};
|
|
deadnix = {
|
|
enable = true;
|
|
inherit files;
|
|
};
|
|
trim-trailing-whitespace = {
|
|
enable = true;
|
|
inherit files;
|
|
};
|
|
};
|
|
|
|
devShells.default = pkgs.mkShell {
|
|
packages = [
|
|
pkgs.nil
|
|
inputs'.agenix.packages.default
|
|
inputs'.nixops4.packages.default
|
|
];
|
|
shellHook = config.pre-commit.installationScript;
|
|
};
|
|
};
|
|
};
|
|
}
|