Fediversity/flake.nix

84 lines
2.1 KiB
Nix
Raw Normal View History

2024-11-13 22:41:34 +01:00
{
inputs = {
2024-11-26 12:59:21 +01:00
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
2024-11-13 22:41:34 +01:00
flake-parts.url = "github:hercules-ci/flake-parts";
git-hooks.url = "github:cachix/git-hooks.nix";
2024-12-11 13:25:31 +01:00
agenix.url = "github:ryantm/agenix";
2024-11-13 22:59:51 +01:00
disko.url = "github:nix-community/disko";
nixops4.url = "github:nixops4/nixops4";
nixops4-nixos.url = "github:nixops4/nixops4-nixos";
2024-11-13 22:41:34 +01:00
};
outputs =
inputs@{ flake-parts, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [
"x86_64-linux"
"aarch64-linux"
"x86_64-darwin"
"aarch64-darwin"
];
2024-11-14 01:10:00 +01:00
imports = [
inputs.git-hooks.flakeModule
inputs.nixops4.modules.flake.default
2024-11-14 01:10:00 +01:00
2024-11-13 22:59:51 +01:00
./deployment/flake-part.nix
./infra/flake-part.nix
2024-11-14 01:10:00 +01:00
./services/flake-part.nix
];
2024-11-13 22:41:34 +01:00
perSystem =
2024-11-13 22:59:51 +01:00
{
config,
pkgs,
inputs',
...
}:
2024-11-13 22:41:34 +01:00
{
formatter = pkgs.nixfmt-rfc-style;
pre-commit.settings.hooks =
## Not everybody might want pre-commit hooks, so we make them
## opt-in. Maybe one day we will decide to have them everywhere.
let
inherit (builtins) concatStringsSep;
optin = [
"deployment"
"infra"
"keys"
2024-12-11 13:26:38 +01:00
"secrets"
"services"
scaffold Django web service This setup is greatly inspired by the one used for [0], although with notable modifications, such as: - a SASS preprocessor and CSS compressor - more streamlined NixOS integration tests - cleaned up service configuration - a few notes on how to do things better in the future [0]: https://github.com/Nix-Security-WG/nix-security-tracker/ Apart from cloning the Nix setup, there were additional steps: - Create an empty `src` directory, since the package requires it - In the development shell, run `django-admin startproject panel src` Note that while you can already do ```bash manage migrate manage runserver ``` the NixOS integration tests will fail, since `settings.py` needs careful massaging to expose knobs that can be turned from our systemd wrapper. The required changes are introduced in the next commit to make them observable. Noteworthy related work: - https://github.com/sephii/django.nix Rather mature setup with a clean interface, uses Caddy as reverse proxy. - https://git.dgnum.eu/mdebray/djangonix A work-in-progress attempt to capture more moving parts through the module system, in particular secrets. - https://github.com/DavHau/django-nixos Out of date and somewhat simplistic, but serves as a reasonable example for what can be done I chose the variant I'm intimately familiar with in order to be able to pass on knowledge or help with maintenance. But for the future I strongly recommend picking the good bits from the other implementations that control complexity in static configuration parts through Nix expressions.
2025-02-12 23:51:55 +01:00
"panel"
];
2024-11-13 22:41:34 +01:00
files = "^((" + concatStringsSep "|" optin + ")/.*\\.nix|[^/]*\\.nix)$";
in
{
nixfmt-rfc-style = {
enable = true;
inherit files;
};
deadnix = {
enable = true;
inherit files;
};
trim-trailing-whitespace = {
enable = true;
inherit files;
};
2024-11-13 22:41:34 +01:00
};
2024-11-14 01:10:00 +01:00
devShells.default = pkgs.mkShell {
2024-11-13 22:59:51 +01:00
packages = [
pkgs.nil
2024-12-11 13:25:31 +01:00
inputs'.agenix.packages.default
2024-11-13 22:59:51 +01:00
inputs'.nixops4.packages.default
];
2024-11-14 01:10:00 +01:00
shellHook = config.pre-commit.installationScript;
};
2024-11-13 22:41:34 +01:00
};
};
}