flake.lock

@@ -159,11 +159,11 @@
       },
       "locked": {
         "dir": "contrib",
-        "lastModified": 1673504032,
+        "lastModified": 1673321445,
-        "narHash": "sha256-x4nv7g8+bQXg5PfkFw3vCcr3pYI0Hco0VoSbAy60xek=",
+        "narHash": "sha256-5jdmIgcN2PNWHozyj8WRoSVJBiQi61SqWGfTJXUBDOI=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "143d3f1f3224bca02bfef7df0932b9d7524a3ff2",
+        "rev": "1df2db0bc4dfa2e4f632f9b3dbae00b8b29f2d9f",
         "type": "github"
       },
       "original": {
@@ -180,11 +180,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1673511313,
+        "lastModified": 1673338492,
-        "narHash": "sha256-QGUT3w1bHclVRqX958EPOd3OxR/R10MoV97N5jx/qbw=",
+        "narHash": "sha256-UbqugOENjdtTWCvJQQ0ym80zTB28esvJQPO3j3+Zmjw=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "5af6fe31f9906e70a1e8985dbbdcc4ae66c7f82d",
+        "rev": "de5bef64b8158b85b47256d5a366973534130621",
         "type": "github"
       },
       "original": {
@@ -211,11 +211,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1673466167,
+        "lastModified": 1673301451,
-        "narHash": "sha256-1HzUCtWwHRGzTOHCIKGG0lVL6wvsyPSSyBuIqZWYowc=",
+        "narHash": "sha256-0IvOqAXZ+dHjOV7dQl4iEcCUmzqg8VvGg+UZ68ONDIg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "68e03abb2fd8db50eaee69ad58b208451143e005",
+        "rev": "35f1f865c03671a4f75a6996000f03ac3dc3e472",
         "type": "github"
       },
       "original": {
@@ -242,11 +242,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1673450908,
+        "lastModified": 1673226411,
-        "narHash": "sha256-b8em+kwrNtnB7gR8SyVf6WuTyQ+6tHS6dzt9D9wgKF0=",
+        "narHash": "sha256-b6cGb5Ln7Zy80YO66+cbTyGdjZKtkoqB/iIIhDX9gRA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c8644fc37b6e141cbfa6c7dc8d98846c4ff0c2e",
+        "rev": "aa1d74709f5dac623adb4d48fdfb27cc2c92a4d4",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1673490397,
+        "lastModified": 1673317790,
-        "narHash": "sha256-VCSmIYJy/ZzTvEGjdfITmTYfybXBgZpMjyjDndbou+8=",
+        "narHash": "sha256-GWjj/bqTXPsKgwWGFZUyHRShxFvufShYnuyyeP99wmk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "0833f4d063a2bb75aa31680f703ba594a384ffe6",
+        "rev": "9724998ea2caf23214674bf0c2cdf6ec0b1719af",
         "type": "github"
       },
       "original": {

flake.nix

@@ -25,43 +25,14 @@
     neovim-nightly-overlay.url = "github:nix-community/neovim-nightly-overlay";
   };
 
-  outputs =
+  outputs = {
-    { nixpkgs
+    nixpkgs, agenix, home-manager, flake-utils, nixgl, rust-overlay, flake-compat,
-    , agenix
+    neovim-nightly-overlay
-    , home-manager
-    , flake-utils
-    , nixgl
-    , rust-overlay
-    , flake-compat
-    , neovim-nightly-overlay
     ,...
-    }@_inputs:
+  }@_inputs: let 
-    let
     # Context/global stuffs to be passed down
-      # NOTE: this will only read files that are within git tree
-      # all secrets should go into secrets.nix and secrets/*.age
-      proj_root =
-        let
-          path = builtins.toString ./.;
-        in
-        {
-          inherit path;
-          configs.path = "${path}/native_configs";
-          scripts.path = "${path}/scripts";
-          secrets.path = "${path}/secrets";
-          testdata.path = "${path}/tests";
-          modules.path = "${path}/modules";
-          hosts.path = "${path}/hosts";
-          users.path = "${path}/users";
-        };
     # TODO: adapt to different platforms think about different systems later
     system = "x86_64-linux";
-      overlays = [
-        rust-overlay.overlays.default
-        (self: pkgs@{ lib, ... }: {
-          lib = pkgs.lib // (import ./lib (_inputs // { inherit pkgs proj_root; }));
-        })
-      ];
     pkgs = import nixpkgs {
       inherit system;
       overlays = import ./overlays.nix _inputs;
@@ -69,20 +40,31 @@
         allowUnfree = true;
       };
     };
-      # now, this lib is extremely powerful as it also engulfs nixpkgs.lib
-      # lib = nixpkgs.lib // pkgs.lib;
-      lib = (builtins.foldl' (lhs: rhs: (nixpkgs.lib.recursiveUpdate lhs rhs)) { } [
-        nixpkgs.lib
-        pkgs.lib
-        (import ./lib {
-          inherit proj_root pkgs overlays system;
-          inherit (pkgs) lib;
-        })
-      ]);
-      inputs_w_lib = (pkgs.lib.recursiveUpdate _inputs {
-        inherit system proj_root pkgs lib;
-      });
 
+    # inject nixpkgs.lib onto c_ (calculus)
+    _lib = pkgs.lib;
+    inputs = (_lib.recursiveUpdate {
+      inherit system; 
+      # NOTE: this will only read files that are within git tree
+      # all secrets should go into secrets.nix and secrets/*.age
+      proj_root = let 
+        path = builtins.toString ./.;
+      in {
+        inherit path;
+        configs.path = "${path}/native-configs";
+        scripts.path = "${path}/scripts";
+        secrets.path = "${path}/secrets";
+        testdata.path = "${path}/tests";
+        modules.path = "${path}/modules";
+        hosts.path = "${path}/hosts";
+        users.path = "${path}/users";
+      };
+    } _inputs);
+    inputs_w_pkgs = (_lib.recursiveUpdate {inherit pkgs; lib = pkgs.lib;} inputs);
+    lib = _lib.recursiveUpdate (import ./lib inputs_w_pkgs) _lib;
+
+    # update inputs with our library and past onto our end configurations
+    inputs_w_lib = (lib.recursiveUpdate {inherit lib;} inputs_w_pkgs);
     modules = (import ./modules inputs_w_lib);
     hosts = (import ./hosts inputs_w_lib); 
     users = (import ./users inputs_w_lib);
@@ -103,25 +85,18 @@
           expected = "for sure";
         };
       };
-      secrets = import ./secrets final_inputs;
 
-    in
+  in {
-    {
     inherit (hosts) nixosConfigurations;
-      inherit (users) homeConfigurations;
+    # inherit (users) homeConfigurations;
-      inherit lib proj_root;
+    inherit lib;
     devShell."${system}" = import ./dev-shell.nix final_inputs;
     templates = import ./templates final_inputs;
-      secrets = {
-        pubKeys = {
-          hosts = hosts.pubKeys;
-          users = users.pubKeys;
-        };
-      };
 
     unit_tests = lib.runTests unit_tests;
+    secrets = import ./secrets final_inputs;
     debug = {
-        inherit final_inputs hosts users modules lib inputs_w_lib unit_tests pkgs nixpkgs;
+      inherit final_inputs hosts users modules lib inputs_w_lib unit_tests pkgs;
     };
   };
 }

hosts/bao/hardware-configuration.nix

@@ -8,7 +8,6 @@
     [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.loader.systemd-boot.enable = true;
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
   # boot.initrd.kernelModules = [ "amdgpu" ];
   boot.initrd.kernelModules = [];

hosts/default.nix

@@ -10,13 +10,11 @@ config = {
     system = "x86_64-linux";
     preset = "base";
   };
-  # TODO: add override so that we can add wsl config on top
   bao.nixosConfig = {
     modules = [
-      (import ../modules/nvgpu.sys.nix)
+      import ../modules/kde.sys.nix
-      (import ../modules/kde.sys.nix)
+      import ../modules/pulseaudio.sys.nix
-      (import ../modules/pulseaudio.sys.nix)
+      import ../modules/storage.perso.sys.nix
-      (import ../modules/storage.perso.sys.nix)
     ];
   };
 };
@@ -31,45 +29,36 @@ propagate = hostConfig@{metadata, nixosConfig}: let
   preset = lib.attrByPath ["preset"] "base" metadata;
   # infer
   hardwareConfig = import "${proj_root.hosts.path}/${hostName}/hardware-configuration.nix";
-  # alias to prevent infinite recursion
-  _nixosConfig = nixosConfig;
 in {
   inherit hostName ssh_pubkey users nixosVersion system preset hardwareConfig;
-  nixosConfig = _nixosConfig // {
+  nixosConfig = nixosConfig // {
     inherit system;
+    lib = finalInputs.lib;
     modules = [
-      {
-        config._module.args = {
-          inherit proj_root;
-          my-lib = finalInputs.lib;
-        };
-      }
-      hardwareConfig
       {
         system.stateVersion = nixosVersion;
         networking.hostName = hostName;
         users.users = users;
       }
       {
-        imports = [agenix.nixosModule];
+        _module.args = finalInputs;
-        environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
       }
-      (import "${proj_root.modules.path}/secrets.nix")
+      import "${proj_root.modules.path}/secrets.nix"
-      (import "${proj_root.modules.path}/${preset}.sys.nix")
+      import "${proj_root.modules.path}/${preset}.sys.nix"
-    ] ++ _nixosConfig.modules;
+    ] ++ nixosConfig.modules;
   };
 };
-# we are blessed by the fact that we engulfed nixpkgs.lib.* at top level
 mkHostFromPropagated = propagatedHostConfig@{nixosConfig,...}: nixpkgs.lib.nixosSystem nixosConfig;
-<<<<<<< HEAD
 mkHost = hostConfig: (lib.pipe [propagate mkHostFromPropagated] hostConfig);
 trimNull = lib.filterAttrsRecursive (name: value: value != null);
 flattenPubkey = lib.mapAttrs (hostName: meta_config: meta_config.metadata.ssh_pubkey);
-=======
-mkHost = hostConfig: (lib.pipe hostConfig [propagate mkHostFromPropagated]);
->>>>>>> 4619ea4 (rekey)
 in {
-  nixosConfigurations = lib.mapAttrs (name: hostConfig: mkHost hostConfig) config;
+  inherit config;
+  # nixosConfigurations = lib.mapAttrs (name: hostConfig: mkHost hostConfig) config;
+  nixosConfigurations = {};
+  debug = {
+    propagated = lib.mapAttrs (name: hostConfig: propagate hostConfig) config;
+  };
   # {bao = "ssh-ed25519 ..."; another_host = "ssh-rsa ...";}
-  pubKeys = lib.getPubkey config;
+  hostKeys = trimNull (flattenPubkey config);
 }

lib/default.nix

@@ -1,30 +1,22 @@
 {pkgs
-# ,nixpkgs
+,nixpkgs
 ,proj_root
-# ,agenix
+,agenix
 ,nixosDefaultVersion? "22.05"
 ,defaultSystem? "x86_64-linux"
 ,...}@inputs: let
   lib = pkgs.lib;
-  inputs_w_lib = (inputs // {inherit lib;});
+  serde = import ./serde.nix inputs // {inherit lib;};
-  serde = import ./serde.nix inputs_w_lib;
-  shellAsDrv = {script, pname}: (pkgs.callPackage (
-    # just a pattern that we must remember: args to this are children of pkgs.
-    {writeShellScriptBin}: writeShellScriptBin pname script
-  ) {});
-  trimNull = lib.filterAttrs (name: value: value != null);
-  # ssh
-  flattenPubkey = lib.mapAttrs (_identity: meta_config: lib.attrByPath ["metadata" "ssh_pubkey"] null meta_config);
-  getPubkey = config: (lib.pipe config [flattenPubkey trimNull]);
   # procedure = 
 in {
   # short-hand to create a shell derivation
   # NOTE: this is pure. This means, env vars from devShells might not
   # be accessible unless MAYBE they are `export`ed
-  inherit shellAsDrv trimNull flattenPubkey getPubkey;
+  shellAsDrv = {script, pname}: (pkgs.callPackage (
-  ssh = {
+    # just a pattern that we must remember: args to this are children of pkgs.
-    inherit flattenPubkey getPubkey;
+    {writeShellScriptBin}: writeShellScriptBin pname script
-  };
+  ) {});
+
   # Configures hosts as nixosConfiguration
   # mkHost = {hostName
   # , nixosBareConfiguration

modules/amdgpu.sys.nix

@@ -1,6 +0,0 @@
-{
-  imports = [./gpu.sys.nix];
-  boot.initrd.kernelModules = [ "amdgpu" ];
-  services.xserver.enable = true;
-  services.xserver.videoDrivers = [ "amdgpu" ];
-}

modules/base.sys.nix

@@ -1,7 +1,6 @@
 {pkgs
 ,lib
 ,proj_root
-,...
 }:{
   imports = [
     ./minimal.sys.nix

modules/gpu.sys.nix

@@ -1,12 +0,0 @@
-{ pkgs, ... }: {
-  environment.systemPackages = [ pkgs.clinfo pkgs.lshw pkgs.glxinfo pkgs.pciutils pkgs.vulkan-tools ];
-  hardware.opengl = {
-    enable = true;
-    extraPackages = [ pkgs.rocm-opencl-icd pkgs.rocm-opencl-runtime ];
-    # Vulkan
-    driSupport = true;
-    driSupport32Bit = true;
-    package = pkgs.mesa.drivers;
-    package32 = pkgs.pkgsi686Linux.mesa.drivers;
-  };
-}

modules/kde.sys.nix

@@ -1,8 +1,7 @@
 { pkgs
-, my-lib
+, lib
-,...
 }: {
-  environment.noXlibs = my-lib.mkForce false;
+  environment.noXlibs = lib.mkForce false;
   # TODO: wireless networking
 
   # Enable the X11 windowing system.

modules/minimal.sys.nix

@@ -1,15 +1,12 @@
 {pkgs
 ,lib
 ,proj_root
-,modulesPath
-,...
 }:{
-  imports = ["${modulesPath}/profiles/minimal.nix"];
   # prune old builds after a while
-  nix.settings.auto-optimise-store = true;
+  nix.settings.auto-optimize-store = true;
   nix.package = pkgs.nixFlakes;             # nix flakes
   nix.extraOptions = ''
-    experimental-features = nix-command flakes
+    experimental=feature = nix-command flakes
   '';
   programs.neovim = {
       enable = true;
@@ -25,6 +22,6 @@
   ];
   users.users.root = {
     # openssh runs in root, no? This is because port < 1024 requires root.
-    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root.configs.path}/ssh/authorized_keys");
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root}/ssh/authorized_keys");
   };
 }

modules/mosh.sys.nix

@@ -1,7 +1,6 @@
 {pkgs
 ,lib
 ,config
-,...
 }: {
   environment.systemPackages = [pkgs.mosh];
   networking.firewall = lib.mkIf config.networking.firewall.enable {

modules/nvgpu.sys.nix

@@ -1,7 +0,0 @@
-{config,...}: {
-  imports = [./gpu.sys.nix];
-  nixpkgs.config.allowUnfree = true;
-  services.xserver.enable = true;
-  services.xserver.videoDrivers = [ "nvidia" ];
-  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.stable;
-}

modules/secrets.nix

@@ -1,5 +1,8 @@
-{proj_root
+{agenix
-,...}: {
+,proj_root}: {
+  imports = [
+    agenix.nixosModule
+  ];
   age.secrets.s3fs = {
     file = "${proj_root.secrets.path}/s3fs.age";
     # mode = "600";  # owner + group only
@@ -12,8 +15,5 @@
   age.secrets._nhitrl_cred = {
     file = "${proj_root.secrets.path}/_nhitrl.age";
   };
-  age.secrets."wifi.env" = {
+  environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
-    file = "${proj_root.secrets.path}/wifi.env.age";
-  };
-  # environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
 }

modules/ssh.sys.nix

@@ -1,6 +1,6 @@
 {
   services.openssh = {
     enable = true;
-    permitRootLogin = "no";
+    permitRootLogin = false;
   };
 }

modules/storage.perso.sys.nix

@@ -1,5 +1,5 @@
 # Personal configuration on storage solution
-{ pkgs, config, lib,... }: {
+{ pkgs, config, lib }: {
   environment.systemPackages = [
     pkgs.s3fs
     pkgs.cifs-utils

modules/wifi.sys.nix

@@ -1,8 +0,0 @@
-{config,...}: {
-  networking.wireless.enable = true;
-  networking.wireless.environmentFile = config.age.secrets."wifi.env";
-  networking.wireless.networks = {
-    "Hoang Sa".psk = "@DESERT_PSK@";
-    "Truong Sa".psk = "@DESERT_PSK@";
-  };
-}

nix-conf/system/flake.nix

@@ -230,7 +230,7 @@
             };
             amd_rx470 = {
               # early amd gpu usage
-              boot.initrd.kernelModules = ["amdgpu"];
+              # boot.initrd.kernelModules = ["amdgpu"];
               services.xserver.enable = true;
               services.xserver.videoDrivers = ["amdgpu"];
             };

scripts/config-sysnix.sh

@@ -19,10 +19,10 @@ fi
 SCRIPT_DIR=$(realpath $(dirname $0))
 echo "SCRIPT_DIR: ${SCRIPT_DIR}"
 
-SYSNIX_DIR="${SCRIPT_DIR}/.."
+SYSNIX_DIR="${SCRIPT_DIR}/../nix-conf/system"
 
 # Copy hardware-configuration of existing machine onto our version control
-SYSNIX_PROF="${SYSNIX_DIR}/hosts/${HOSTNAME}"
+SYSNIX_PROF="${SYSNIX_DIR}/profiles/${HOSTNAME}"
 HARDWARE_CONF="${SYSNIX_PROF}/hardware-configuration.nix" 
 if [ ! -f "${HARDWARE_CONF}" ]; then
 	mkdir "$SYSNIX_PROF"

secrets.nix

@@ -1,5 +1,4 @@
-let 
+(import
-  inherit ((import
   (
     let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
     fetchTarball {
@@ -8,14 +7,4 @@ let
     }
   )
   { src = ./.; }
-  ).defaultNix) secrets;
+).defaultNix.secrets
-  inherit (secrets) pubKeys;
-  inherit (pubKeys) users hosts;
-  all = users // hosts;
-  c_ = builtins;
-in {
-  "secrets/s3fs.age".publicKeys = c_.attrValues (all);
-  "secrets/s3fs.digital-garden.age".publicKeys = c_.attrValues (all);
-  "secrets/_nhitrl.age".publicKeys = c_.attrValues (all);
-  "secrets/wifi.env.age".publicKeys = c_.attrValues (all);
-}

secrets/s3fs.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 ahbzMg Lx4TLKDZ2yk3DQsM6nOOI1o+FHu0lNtT2p3PBdao+C4
+-> ssh-ed25519 ahbzMg 6pTVLAgOY/JZVWiCFHLo8xQ4/CL6620IMaBRpqI8Wws
-RsTScUeLmFrO6v1OOxBbyBCMBMVhsGrtu5W9iMOw8B0
+CtJeQuy5VzKZhJnIH+/cjlKsAcg0RY2bhHTWVm+hUOY
--> ssh-ed25519 glsjZQ CdLCkzb1dBoG9gYdMisaZBZT+nnzfOX326CWq6cvN1s
+-> ssh-ed25519 glsjZQ we7RCgsnODTJ8rKYhU+9tu0DmLH+98mcQKQ3I2slikM
-UKGCxej9lZnLzsuFJnFOMpyrz7YzJrHcrFuDz8l8RQk
+G81lsFLQR9polxme1K/MU2d8Y01PrTqtzJnVq0EMJF0
--> U<J-grease + A6h/F, 'mix
+-> |-grease B\W,I9z ^Gx;$ Kk7!4,P
-jpEa7b7rRo6bVpTr19c5ALOfaeiP0jldtpQBRWfJnma3VSo3kkDQpfa3RvPjZfD8
+0Jl5Lhx7R8YOs9S+hUtQDDpNIqBhC/MM0N7w1MCtwYtkIIIWKfY9jkJ7+Cew2Ee5
-Eg9Zb03MKMUAJnWwfLCXVFQqEVpSaIwI+ujLZ5Cm
+Qb04jnE
---- /a+J/jeGoWwuNvDEAIGzU0WKx86oH+YRTnSexf+8NP4
+--- b7AXWRgK45a/91iwmwt5g+CWOlU/2f4nUDfXlg/bs9A
-!]Fµ‹O¬J’v”žó%×-ŻtÚŹŘťuzčB­É˙}ś‡Ő"C\;D(ľ‡Ă’FŠÎ®j®ëA7&ąü<C485>˛?é.ć…J•áBa»„ąŽ˛[ŘdXr‘ŢŚO
+¢²%;Þ3RmQÚ‹WhpÌ–VŠ;º×®¡¥VÍÚñ[zš9al¦±=cLêüva<>ëu7é,†tø±’ýUܶh^&å‰Ö¿WåJP6-ÇÒ£
n‘-ˆ¿=™]

users/default.nix

@@ -1,12 +0,0 @@
-{lib,...}@inputs: let
-config = {
-  hungtr.metadata = {
-  };
-  "hungtr@bao".metadata = {
-    ssh_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+1+gps6phbZboIb9fH51VNPUCkhSSOAbkI3tq3Ou0Z";
-  };
-};
-in {
-  homeConfigurations = {};
-  pubKeys = lib.getPubkey config;
-}