rekey

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665870395,
+        "lastModified": 1673301561,
-        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
+        "narHash": "sha256-gRUWHbBAtMuPDJQXotoI8u6+3DGBIUZHkyQWpIv7WpM=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
+        "rev": "42d371d861a227149dc9a7e03350c9ab8b8ddd68",
         "type": "github"
       },
       "original": {
@@ -89,11 +89,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1672770368,
+        "lastModified": 1673343300,
-        "narHash": "sha256-iO6Z9blIe8dcPh3VT2nkej9EimORCoskGQR6xNjICWI=",
+        "narHash": "sha256-5Xdj6kpXYMie0MlnGwqK5FaMdsedxvyuakWtyKB3zaQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d01e7280ad7d13a5a0fae57355bd0dbfe5b81969",
+        "rev": "176e455371a8371586e8a3ff0d56ee9f3ca2324e",
         "type": "github"
       },
       "original": {
@@ -151,11 +151,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1672617983,
+        "lastModified": 1673450908,
-        "narHash": "sha256-68WDiCBs631mbDDk4UAKdGURKcsfW6hjb7wgudTAe5o=",
+        "narHash": "sha256-b8em+kwrNtnB7gR8SyVf6WuTyQ+6tHS6dzt9D9wgKF0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0fc9fca9c8d43edd79d33fea0dd8409d7c4580f4",
+        "rev": "6c8644fc37b6e141cbfa6c7dc8d98846c4ff0c2e",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1672712534,
+        "lastModified": 1673490397,
-        "narHash": "sha256-8S0DdMPcbITnlOu0uA81mTo3hgX84wK8S9wS34HEFY4=",
+        "narHash": "sha256-VCSmIYJy/ZzTvEGjdfITmTYfybXBgZpMjyjDndbou+8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "69fb7bf0a8c40e6c4c197fa1816773774c8ac59f",
+        "rev": "0833f4d063a2bb75aa31680f703ba594a384ffe6",
         "type": "github"
       },
       "original": {

flake.nix

@@ -29,8 +29,28 @@
     ,...
   }@_inputs: let 
     # Context/global stuffs to be passed down
+    # NOTE: this will only read files that are within git tree
+    # all secrets should go into secrets.nix and secrets/*.age
+    proj_root = let 
+      path = builtins.toString ./.;
+    in {
+      inherit path;
+      configs.path = "${path}/native_configs";
+      scripts.path = "${path}/scripts";
+      secrets.path = "${path}/secrets";
+      testdata.path = "${path}/tests";
+      modules.path = "${path}/modules";
+      hosts.path = "${path}/hosts";
+      users.path = "${path}/users";
+    };
     # TODO: adapt to different platforms think about different systems later
     system = "x86_64-linux";
+    overlays = [
+      rust-overlay.overlays.default
+      (self: pkgs@{lib,...}: {
+        lib = pkgs.lib // (import ./lib (_inputs // {inherit pkgs proj_root;}));
+      })
+    ];
     pkgs = import nixpkgs {
       inherit system;
       overlays = import ./overlays.nix _inputs;
@@ -38,31 +58,13 @@
         allowUnfree = true;
       };
     };
+    # now, this lib is extremely powerful as it also engulfs nixpkgs.lib
+    # TODO: I really don't want to extend from nixpkgs.lib because it doesn't extend lib within nixosModule
+    lib = nixpkgs.lib.extend (self: nixpkgs_lib: (nixpkgs_lib // pkgs.lib));
+    inputs_w_lib = (pkgs.lib.recursiveUpdate _inputs {
+      inherit system proj_root pkgs lib; 
+    });
 
-    # inject nixpkgs.lib onto c_ (calculus)
-    _lib = pkgs.lib;
-    inputs = (_lib.recursiveUpdate {
-      inherit system; 
-      # NOTE: this will only read files that are within git tree
-      # all secrets should go into secrets.nix and secrets/*.age
-      proj_root = let 
-        path = builtins.toString ./.;
-      in {
-        inherit path;
-        configs.path = "${path}/native-configs";
-        scripts.path = "${path}/scripts";
-        secrets.path = "${path}/secrets";
-        testdata.path = "${path}/tests";
-        modules.path = "${path}/modules";
-        hosts.path = "${path}/hosts";
-        users.path = "${path}/users";
-      };
-    } _inputs);
-    inputs_w_pkgs = (_lib.recursiveUpdate {inherit pkgs; lib = pkgs.lib;} inputs);
-    lib = _lib.recursiveUpdate (import ./lib inputs_w_pkgs) _lib;
-
-    # update inputs with our library and past onto our end configurations
-    inputs_w_lib = (lib.recursiveUpdate {inherit lib;} inputs_w_pkgs);
     modules = (import ./modules inputs_w_lib);
     hosts = (import ./hosts inputs_w_lib); 
     users = (import ./users inputs_w_lib);
@@ -83,18 +85,24 @@
           expected = "for sure";
         };
       };
+    secrets = import ./secrets final_inputs;
 
   in {
     inherit (hosts) nixosConfigurations;
-    # inherit (users) homeConfigurations;
+    inherit (users) homeConfigurations;
-    inherit lib;
+    inherit lib proj_root;
     devShell."${system}" = import ./dev-shell.nix final_inputs;
     templates = import ./templates final_inputs;
+    secrets = {
+      pubKeys = {
+        hosts = hosts.pubKeys;
+        users = users.pubKeys;
+      };
+    };
 
     unit_tests = lib.runTests unit_tests;
-    secrets = import ./secrets final_inputs;
     debug = {
-      inherit final_inputs hosts users modules lib inputs_w_pkgs unit_tests pkgs;
+      inherit final_inputs hosts users modules lib unit_tests pkgs;
     };
   };
 }

hosts/bao/hardware-configuration.nix

@@ -8,6 +8,7 @@
     [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
+  boot.loader.systemd-boot.enable = true;
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
   # boot.initrd.kernelModules = [ "amdgpu" ];
   boot.initrd.kernelModules = [];

hosts/default.nix

@@ -10,11 +10,13 @@ config = {
     system = "x86_64-linux";
     preset = "base";
   };
+  # TODO: add override so that we can add wsl config on top
   bao.nixosConfig = {
     modules = [
-      import ../modules/kde.sys.nix
+      (import ../modules/nvgpu.sys.nix)
-      import ../modules/pulseaudio.sys.nix
+      (import ../modules/kde.sys.nix)
-      import ../modules/storage.perso.sys.nix
+      (import ../modules/pulseaudio.sys.nix)
+      (import ../modules/storage.perso.sys.nix)
     ];
   };
 };
@@ -29,36 +31,45 @@ propagate = hostConfig@{metadata, nixosConfig}: let
   preset = lib.attrByPath ["preset"] "base" metadata;
   # infer
   hardwareConfig = import "${proj_root.hosts.path}/${hostName}/hardware-configuration.nix";
+  # alias to prevent infinite recursion
+  _nixosConfig = nixosConfig;
 in {
   inherit hostName ssh_pubkey users nixosVersion system preset hardwareConfig;
-  nixosConfig = nixosConfig // {
+  nixosConfig = _nixosConfig // {
     inherit system;
-    lib = finalInputs.lib;
     modules = [
+      {
+        config._module.args = {
+          inherit proj_root;
+          my-lib = finalInputs.lib;
+        };
+      }
+      hardwareConfig
       {
         system.stateVersion = nixosVersion;
         networking.hostName = hostName;
         users.users = users;
       }
       {
-        _module.args = finalInputs;
+        imports = [agenix.nixosModule];
+        environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
       }
-      import "${proj_root.modules.path}/secrets.nix"
+      (import "${proj_root.modules.path}/secrets.nix")
-      import "${proj_root.modules.path}/${preset}.sys.nix"
+      (import "${proj_root.modules.path}/${preset}.sys.nix")
-    ] ++ nixosConfig.modules;
+    ] ++ _nixosConfig.modules;
   };
 };
+# we are blessed by the fact that we engulfed nixpkgs.lib.* at top level
 mkHostFromPropagated = propagatedHostConfig@{nixosConfig,...}: nixpkgs.lib.nixosSystem nixosConfig;
+<<<<<<< HEAD
 mkHost = hostConfig: (lib.pipe [propagate mkHostFromPropagated] hostConfig);
 trimNull = lib.filterAttrsRecursive (name: value: value != null);
 flattenPubkey = lib.mapAttrs (hostName: meta_config: meta_config.metadata.ssh_pubkey);
+=======
+mkHost = hostConfig: (lib.pipe hostConfig [propagate mkHostFromPropagated]);
+>>>>>>> 4619ea4 (rekey)
 in {
-  inherit config;
+  nixosConfigurations = lib.mapAttrs (name: hostConfig: mkHost hostConfig) config;
-  # nixosConfigurations = lib.mapAttrs (name: hostConfig: mkHost hostConfig) config;
-  nixosConfigurations = {};
-  debug = {
-    propagated = lib.mapAttrs (name: hostConfig: propagate hostConfig) config;
-  };
   # {bao = "ssh-ed25519 ..."; another_host = "ssh-rsa ...";}
-  hostKeys = trimNull (flattenPubkey config);
+  pubKeys = lib.getPubkey config;
 }

lib/default.nix

@@ -1,22 +1,30 @@
 {pkgs
-,nixpkgs
+# ,nixpkgs
 ,proj_root
-,agenix
+# ,agenix
 ,nixosDefaultVersion? "22.05"
 ,defaultSystem? "x86_64-linux"
 ,...}@inputs: let
   lib = pkgs.lib;
-  serde = import ./serde.nix inputs // {inherit lib;};
+  inputs_w_lib = (inputs // {inherit lib;});
+  serde = import ./serde.nix inputs_w_lib;
+  shellAsDrv = {script, pname}: (pkgs.callPackage (
+    # just a pattern that we must remember: args to this are children of pkgs.
+    {writeShellScriptBin}: writeShellScriptBin pname script
+  ) {});
+  trimNull = lib.filterAttrs (name: value: value != null);
+  # ssh
+  flattenPubkey = lib.mapAttrs (_identity: meta_config: lib.attrByPath ["metadata" "ssh_pubkey"] null meta_config);
+  getPubkey = config: (lib.pipe config [flattenPubkey trimNull]);
   # procedure = 
 in {
   # short-hand to create a shell derivation
   # NOTE: this is pure. This means, env vars from devShells might not
   # be accessible unless MAYBE they are `export`ed
-  shellAsDrv = {script, pname}: (pkgs.callPackage (
+  inherit shellAsDrv trimNull flattenPubkey getPubkey;
-    # just a pattern that we must remember: args to this are children of pkgs.
+  ssh = {
-    {writeShellScriptBin}: writeShellScriptBin pname script
+    inherit flattenPubkey getPubkey;
-  ) {});
+  };
-
   # Configures hosts as nixosConfiguration
   # mkHost = {hostName
   # , nixosBareConfiguration

modules/amdgpu.sys.nix

@@ -0,0 +1,6 @@
+{
+  imports = [./gpu.sys.nix];
+  boot.initrd.kernelModules = [ "amdgpu" ];
+  services.xserver.enable = true;
+  services.xserver.videoDrivers = [ "amdgpu" ];
+}

modules/base.sys.nix

@@ -1,6 +1,7 @@
 {pkgs
 ,lib
 ,proj_root
+,...
 }:{
   imports = [
     ./minimal.sys.nix

modules/gpu.sys.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }: {
+  environment.systemPackages = [ pkgs.clinfo pkgs.lshw pkgs.glxinfo pkgs.pciutils pkgs.vulkan-tools ];
+  hardware.opengl = {
+    enable = true;
+    extraPackages = [ pkgs.rocm-opencl-icd pkgs.rocm-opencl-runtime ];
+    # Vulkan
+    driSupport = true;
+    driSupport32Bit = true;
+    package = pkgs.mesa.drivers;
+    package32 = pkgs.pkgsi686Linux.mesa.drivers;
+  };
+}

modules/kde.sys.nix

@@ -1,7 +1,8 @@
 { pkgs
-, lib
+, my-lib
+,...
 }: {
-  environment.noXlibs = lib.mkForce false;
+  environment.noXlibs = my-lib.mkForce false;
   # TODO: wireless networking
 
   # Enable the X11 windowing system.

modules/minimal.sys.nix

@@ -1,12 +1,15 @@
 {pkgs
 ,lib
 ,proj_root
+,modulesPath
+,...
 }:{
+  imports = ["${modulesPath}/profiles/minimal.nix"];
   # prune old builds after a while
-  nix.settings.auto-optimize-store = true;
+  nix.settings.auto-optimise-store = true;
   nix.package = pkgs.nixFlakes;             # nix flakes
   nix.extraOptions = ''
-    experimental=feature = nix-command flakes
+    experimental-features = nix-command flakes
   '';
   programs.neovim = {
       enable = true;
@@ -22,6 +25,6 @@
   ];
   users.users.root = {
     # openssh runs in root, no? This is because port < 1024 requires root.
-    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root}/ssh/authorized_keys");
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root.configs.path}/ssh/authorized_keys");
   };
 }

modules/mosh.sys.nix

@@ -1,6 +1,7 @@
 {pkgs
 ,lib
 ,config
+,...
 }: {
   environment.systemPackages = [pkgs.mosh];
   networking.firewall = lib.mkIf config.networking.firewall.enable {

modules/nvgpu.sys.nix

@@ -0,0 +1,7 @@
+{config,...}: {
+  imports = [./gpu.sys.nix];
+  nixpkgs.config.allowUnfree = true;
+  services.xserver.enable = true;
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.stable;
+}

modules/secrets.nix

@@ -1,8 +1,5 @@
-{agenix
+{proj_root
-,proj_root}: {
+,...}: {
-  imports = [
-    agenix.nixosModule
-  ];
   age.secrets.s3fs = {
     file = "${proj_root.secrets.path}/s3fs.age";
     # mode = "600";  # owner + group only
@@ -15,5 +12,8 @@
   age.secrets._nhitrl_cred = {
     file = "${proj_root.secrets.path}/_nhitrl.age";
   };
-  environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
+  age.secrets."wifi.env" = {
+    file = "${proj_root.secrets.path}/wifi.env.age";
+  };
+  # environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
 }

modules/ssh.sys.nix

@@ -1,6 +1,6 @@
 {
   services.openssh = {
     enable = true;
-    permitRootLogin = false;
+    permitRootLogin = "no";
   };
 }

modules/storage.perso.sys.nix

@@ -1,5 +1,5 @@
 # Personal configuration on storage solution
-{ pkgs, config, lib }: {
+{ pkgs, config, lib,... }: {
   environment.systemPackages = [
     pkgs.s3fs
     pkgs.cifs-utils

modules/wifi.sys.nix

@@ -0,0 +1,8 @@
+{config,...}: {
+  networking.wireless.enable = true;
+  networking.wireless.environmentFile = config.age.secrets."wifi.env";
+  networking.wireless.networks = {
+    "Hoang Sa".psk = "@DESERT_PSK@";
+    "Truong Sa".psk = "@DESERT_PSK@";
+  };
+}

nix-conf/system/flake.nix

@@ -230,7 +230,7 @@
             };
             amd_rx470 = {
               # early amd gpu usage
-              # boot.initrd.kernelModules = ["amdgpu"];
+              boot.initrd.kernelModules = ["amdgpu"];
               services.xserver.enable = true;
               services.xserver.videoDrivers = ["amdgpu"];
             };

scripts/config-sysnix.sh

@@ -19,10 +19,10 @@ fi
 SCRIPT_DIR=$(realpath $(dirname $0))
 echo "SCRIPT_DIR: ${SCRIPT_DIR}"
 
-SYSNIX_DIR="${SCRIPT_DIR}/../nix-conf/system"
+SYSNIX_DIR="${SCRIPT_DIR}/.."
 
 # Copy hardware-configuration of existing machine onto our version control
-SYSNIX_PROF="${SYSNIX_DIR}/profiles/${HOSTNAME}"
+SYSNIX_PROF="${SYSNIX_DIR}/hosts/${HOSTNAME}"
 HARDWARE_CONF="${SYSNIX_PROF}/hardware-configuration.nix" 
 if [ ! -f "${HARDWARE_CONF}" ]; then
 	mkdir "$SYSNIX_PROF"

secrets.nix

@@ -1,10 +1,21 @@
-(import
+let 
-  (
+  inherit ((import
-    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    (
-    fetchTarball {
+      let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
-      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      fetchTarball {
-      sha256 = lock.nodes.flake-compat.locked.narHash;
+        url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-    }
+        sha256 = lock.nodes.flake-compat.locked.narHash;
-  )
+      }
-  { src = ./.; }
+    )
-).defaultNix.secrets
+    { src = ./.; }
+  ).defaultNix) secrets;
+  inherit (secrets) pubKeys;
+  inherit (pubKeys) users hosts;
+  all = users // hosts;
+  c_ = builtins;
+in {
+  "secrets/s3fs.age".publicKeys = c_.attrValues (all);
+  "secrets/s3fs.digital-garden.age".publicKeys = c_.attrValues (all);
+  "secrets/_nhitrl.age".publicKeys = c_.attrValues (all);
+  "secrets/wifi.env.age".publicKeys = c_.attrValues (all);
+}

secrets/s3fs.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 ahbzMg 6pTVLAgOY/JZVWiCFHLo8xQ4/CL6620IMaBRpqI8Wws
+-> ssh-ed25519 ahbzMg Lx4TLKDZ2yk3DQsM6nOOI1o+FHu0lNtT2p3PBdao+C4
-CtJeQuy5VzKZhJnIH+/cjlKsAcg0RY2bhHTWVm+hUOY
+RsTScUeLmFrO6v1OOxBbyBCMBMVhsGrtu5W9iMOw8B0
--> ssh-ed25519 glsjZQ we7RCgsnODTJ8rKYhU+9tu0DmLH+98mcQKQ3I2slikM
+-> ssh-ed25519 glsjZQ CdLCkzb1dBoG9gYdMisaZBZT+nnzfOX326CWq6cvN1s
-G81lsFLQR9polxme1K/MU2d8Y01PrTqtzJnVq0EMJF0
+UKGCxej9lZnLzsuFJnFOMpyrz7YzJrHcrFuDz8l8RQk
--> |-grease B\W,I9z ^Gx;$ Kk7!4,P
+-> U<J-grease + A6h/F, 'mix
-0Jl5Lhx7R8YOs9S+hUtQDDpNIqBhC/MM0N7w1MCtwYtkIIIWKfY9jkJ7+Cew2Ee5
+jpEa7b7rRo6bVpTr19c5ALOfaeiP0jldtpQBRWfJnma3VSo3kkDQpfa3RvPjZfD8
-Qb04jnE
+Eg9Zb03MKMUAJnWwfLCXVFQqEVpSaIwI+ujLZ5Cm
---- b7AXWRgK45a/91iwmwt5g+CWOlU/2f4nUDfXlg/bs9A
+--- /a+J/jeGoWwuNvDEAIGzU0WKx86oH+YRTnSexf+8NP4
-¢²%;Þ3RmQÚ‹WhpÌ–VŠ;º×®¡¥VÍÚñ[zš9al¦±=cLêüva<>ëu7é,†tø±’ýUܶh^&å‰Ö¿WåJP6-ÇÒ£
n‘-ˆ¿=™]
+!]Fµ‹O¬J’v”žó%×-ŻtÚŹŘťuzčB­É˙}ś‡Ő"C\;D(ľ‡Ă’FŠÎ®j®ëA7&ąü<C485>˛?é.ć…J•áBa»„ąŽ˛[ŘdXr‘ŢŚO

users/default.nix

@@ -0,0 +1,12 @@
+{lib,...}@inputs: let
+config = {
+  hungtr.metadata = {
+  };
+  "hungtr@bao".metadata = {
+    ssh_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+1+gps6phbZboIb9fH51VNPUCkhSSOAbkI3tq3Ou0Z";
+  };
+};
+in {
+  homeConfigurations = {};
+  pubKeys = lib.getPubkey config;
+}