forked from hacc/haccfiles
stuebinm
2de13398e6
this includes the fix for a remote code excecution as root https://github.com/NixOS/nixpkgs/pull/323761 (probably CVE-2024-6387) annoyingly it did not bump the version number (to check that the fix is indeed there, one has to check wich patches are applied). it also adds nextcloud to the permitteed insecure packages because we again didn't update it in time (in fairness, it is also broken). fun irony!
82 lines
2.7 KiB
Nix
82 lines
2.7 KiB
Nix
{
|
|
description = "hacc infra stuff";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "nixpkgs/nixos-24.05-small";
|
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
|
|
nixpkgs-oldstable.url = "github:/NixOS/nixpkgs?rev=c4aec3c021620d98861639946123214207e98344";
|
|
|
|
nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.05";
|
|
tracktrain.url = "git+https://stuebinm.eu/git/tracktrain?ref=main";
|
|
tracktrain.flake = false;
|
|
|
|
deploy-rs.url = "github:serokell/deploy-rs";
|
|
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
|
sops-nix.url = "github:Mic92/sops-nix";
|
|
sops-nix.inputs.nixpkgs-stable.follows = "nixpkgs";
|
|
|
|
# these exist mostly to make the flake.lock somewhat more human-friendly
|
|
# note that in theory doing this might break things, but it seems fairly unlikely
|
|
nixos-mailserver.inputs = {
|
|
"nixpkgs-24_05".follows = "nixpkgs";
|
|
nixpkgs.follows = "nixpkgs-unstable";
|
|
utils.follows = "/deploy-rs/utils";
|
|
flake-compat.follows = "/deploy-rs/flake-compat";
|
|
};
|
|
};
|
|
|
|
outputs = { self, nixpkgs, deploy-rs, sops-nix, ... }@inputs:
|
|
let modules = {
|
|
bindMounts = import ./modules/bindmounts.nix;
|
|
nopersist = import ./modules/nopersist.nix;
|
|
encboot = import ./modules/encboot.nix;
|
|
};
|
|
profiles = {
|
|
container = import ./modules/container-profile.nix;
|
|
};
|
|
pkgs = import ./pkgs {
|
|
sources = inputs;
|
|
system = "x86_64-linux";
|
|
config.allowUnfree = true;
|
|
config.permittedInsecurePackages = [ "nextcloud-27.1.11" ];
|
|
};
|
|
in {
|
|
nixosConfigurations.parsons = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
./parsons/configuration.nix
|
|
./modules/buildinfo.nix
|
|
./modules/containers.nix
|
|
sops-nix.nixosModules.sops
|
|
{ nixpkgs.pkgs = pkgs; }
|
|
];
|
|
specialArgs = {
|
|
sources = inputs;
|
|
inherit modules profiles;
|
|
inherit (nixpkgs.lib) nixosSystem;
|
|
};
|
|
};
|
|
|
|
deploy.nodes.parsons = {
|
|
hostname = "parsons";
|
|
profiles.system = {
|
|
user = "root";
|
|
autoRollback = false;
|
|
path = deploy-rs.lib.x86_64-linux.activate.nixos
|
|
self.nixosConfigurations.parsons;
|
|
};
|
|
};
|
|
|
|
# This is highly advised, and will prevent many possible mistakes
|
|
checks = builtins.mapAttrs
|
|
(system: deployLib: deployLib.deployChecks self.deploy)
|
|
deploy-rs.lib;
|
|
|
|
packages.x86_64-linux =
|
|
let
|
|
websites = self.nixosConfigurations.parsons.config.hacc.websites.builders;
|
|
in
|
|
{ docs = websites."docs.hacc.space"; } // websites;
|
|
};
|
|
|
|
}
|