.envrc

@@ -0,0 +1,6 @@
+# If nix-shell available, then nix is installed. We're going to use nix-direnv.
+if command -v nix-shell &> /dev/null
+then
+    use flake
+fi
+

default.nix

@@ -0,0 +1,11 @@
+# We use top-level nix-flake, so default.nix is basically just a wrapper around ./flake.nix
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).defaultNix

dev-shell.nix

@@ -0,0 +1,20 @@
+# Ideally, this should contain the barebone necessary for building/interacting 
+# with tech used in this project
+#
+# Should also incorporate shortcuts like scripts/{hm-switch,conf-sysnix}.sh in here instead
+#
+# It should not contain PDE
+{pkgs? import <nixpkgs> {}
+,lib
+,...}: pkgs.mkShell {
+  # mkShell doesn't care about the differences across nativeBuildInputs,
+  # buildInputs, or packages
+  buildInputs = [
+    # shell scripts
+    (lib.shellAsDrv {script = ''echo "hello world"''; pname = "hello";})
+  ];
+
+  # env vars
+  lol="hello world";
+}
+

docs/DEV.md

@@ -0,0 +1,36 @@
+# Journal on development
+
+This contains information dump to record thoughts as I design this repo
+
+## Nix as first-class citizen instead of native config
+
+- Nix can export JSON and other object serialization formats
+
+- Still allows native config, so that Neovim, for example, which uses Turing-complete
+  config language, to make full use of its native LSP.
+
+## Design pattern emerges from unstructured code
+
+### Modules
+
+- Main thing for the first big refactor of codebase
+
+- nixpkgs and home-manager has their own interface for modules 
+
+- The main benefit is to provide (runtime) type-safety on options, along with
+documentations and defaults
+
+## Nitpicky details
+
+### `nativeBuildInputs` vs `buildInputs`
+
+- `nativeBuildInputs` is available **before** `buildInputs`.
+
+- `nativeBuildInputs` is supposed to be built by a deployment machine (not target)
+
+- `buildInputs` gives you access during runtime
+
+- `nativeBulidInputs` gives you access to packages during build time
+
+- `mkShell` doesn't care about `packages`, `nativeBuildInputs`, `buildInputs`
+

flake.lock

@@ -0,0 +1,218 @@
+{
+  "nodes": {
+    "agenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1665870395,
+        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1668681692,
+        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1671966569,
+        "narHash": "sha256-jbLgfSnmLchARBNFRvCic63CFQ9LAyvlXnBpc2kwjQc=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c55fa26ce05fee8e063db22918d05a73d430b2ea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixgl": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1661367362,
+        "narHash": "sha256-Qc8MXcV+YCPREu8kk6oggk23ZBKLqeQRAIsLbHEviPE=",
+        "owner": "guibou",
+        "repo": "nixGL",
+        "rev": "7165ffbccbd2cf4379b6cd6d2edd1620a427e5ae",
+        "type": "github"
+      },
+      "original": {
+        "owner": "guibou",
+        "repo": "nixGL",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1660551188,
+        "narHash": "sha256-a1LARMMYQ8DPx1BgoI/UN4bXe12hhZkCNqdxNi6uS0g=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "441dc5d512153039f19ef198e662e4f3dbb9fd65",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1671983799,
+        "narHash": "sha256-Z2Ro6hFPZHkBqkVXY5/aBUzxi5xizQGvuHQ9+T5B/ks=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fad51abd42ca17a60fc1d4cb9382e2d79ae31836",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1665296151,
+        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "14ccaaedd95a488dd7ae142757884d8e125b3363",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "agenix": "agenix",
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "home-manager": "home-manager",
+        "nixgl": "nixgl",
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1672107670,
+        "narHash": "sha256-m4kP+8k46JwSXYDugykIVvRyoNofZDG7atjbi5+sLoU=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "f4827ef0518463f31a52ab2e5c500c80558fdd78",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,95 @@
+{
+  description = "My personal configuration in Nix (and some native configurations)";
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-unstable";
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    flake-utils.url = "github:numtide/flake-utils";
+    nixgl.url = "github:guibou/nixGL";
+    rust-overlay.url = "github:oxalica/rust-overlay";
+    # Allows default.nix to call onto flake.nix. Useful for nix eval and automations
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
+  };
+
+  outputs = {
+    nixpkgs, agenix, home-manager, flake-utils, nixgl, rust-overlay, flake-compat
+    ,...
+  }@_inputs: let 
+    # Context/global stuffs to be passed down
+    # TODO: adapt to different platforms think about different systems later
+    system = "x86_64-linux";
+    pkgs = import nixpkgs {
+      inherit system;
+      config = {
+        allowUnfree = true;
+      };
+    };
+
+    # inject nixpkgs.lib onto c_ (calculus)
+    _lib = pkgs.lib;
+    inputs = (_lib.recursiveUpdate {
+      inherit system; 
+      # NOTE: this will only read files that are within git tree
+      # all secrets should go into secrets.nix and secrets/*.age
+      proj_root = let 
+        path = builtins.toString ./.;
+      in {
+        inherit path;
+        configs.path = "${path}/native-configs";
+        scripts.path = "${path}/scripts";
+        secrets.path = "${path}/secrets";
+        testdata.path = "${path}/tests";
+        modules.path = "${path}/modules";
+        hosts.path = "${path}/hosts";
+        users.path = "${path}/users";
+      };
+    } _inputs);
+    inputs_w_pkgs = (_lib.recursiveUpdate {inherit pkgs; lib = pkgs.lib;} inputs);
+    lib = _lib.recursiveUpdate (import ./lib inputs_w_pkgs) _lib;
+
+    # update inputs with our library and past onto our end configurations
+    inputs_w_lib = (lib.recursiveUpdate {inherit lib;} inputs_w_pkgs);
+    modules = (import ./modules inputs_w_lib);
+    hosts = (import ./hosts inputs_w_lib); 
+    users = (import ./users inputs_w_lib);
+    
+    # {nixpkgs, agenix, home-manager, flake-utils, nixgl, rust-overlay, flake-compat
+    # ,pkgs, lib (extended), proj_root}
+    final_inputs = inputs_w_lib;
+
+    # Tests: unit + integration
+    unit_tests = (import ./lib/test.nix final_inputs) //
+      {
+        test_example = {
+          expr = "names must start with 'test'";
+          expected = "or won't show up";
+        };
+        not_show = {
+          expr = "this will be ignored by lib.runTests";
+          expected = "for sure";
+        };
+      };
+
+  in {
+    inherit (hosts) nixosConfigurations;
+    # inherit (users) homeConfigurations;
+    inherit lib;
+    devShell."${system}" = import ./dev-shell.nix final_inputs;
+    templates = import ./templates final_inputs;
+
+    unit_tests = lib.runTests unit_tests;
+    secrets = import ./secrets final_inputs;
+    debug = {
+      inherit final_inputs hosts users modules lib inputs_w_pkgs unit_tests;
+    };
+  };
+}

hosts/Felia/hardware-configuration.nix

@@ -0,0 +1,80 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  ## NOTE: These filesystems are mounted by a wrapper script from nix-wsl
+
+  # fileSystems."/" =
+  #   {
+  #     device = "/dev/sdc";
+  #     fsType = "ext4";
+  #   };
+  #
+  # fileSystems."/mnt/wsl" =
+  #   {
+  #     device = "tmpfs";
+  #     fsType = "tmpfs";
+  #   };
+  #
+  # fileSystems."/mnt/wsl/docker-desktop/shared-sockets/guest-services" =
+  #   {
+  #     device = "none";
+  #     fsType = "tmpfs";
+  #   };
+  #
+  # fileSystems."/usr/lib/wsl/drivers" =
+  #   {
+  #     device = "drivers";
+  #     fsType = "drvfs";
+  #   };
+  #
+  # fileSystems."/usr/lib/wsl/lib" =
+  #   {
+  #     device = "lib";
+  #     fsType = "drvfs";
+  #   };
+
+  fileSystems."/mnt/c" =
+    {
+      device = "C:";
+      fsType = "drvfs";
+    };
+
+  fileSystems."/mnt/d" =
+    {
+      device = "D:";
+      fsType = "drvfs";
+    };
+
+  fileSystems."/mnt/f" =
+    {
+      device = "F:";
+      fsType = "drvfs";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.bond0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.bonding_masters.useDHCP = lib.mkDefault true;
+  # networking.interfaces.dummy0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.sit0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.tunl0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/bao/default.nix

@@ -0,0 +1,5 @@
+{nixpkgs, agenix, home-manager, flake-utils, nixgl, rust-overlay, flake-compat
+,pkgs, lib, proj_root}: {
+  
+}
+

hosts/bao/hardware-configuration.nix

@@ -0,0 +1,41 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  # boot.initrd.kernelModules = [ "amdgpu" ];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [ "kvm-amd" "coretemp"];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    # Might be wise to use /dev/nvme0p1 instead
+    { device = "/dev/disk/by-uuid/27fc09b3-e3b7-4883-94a0-c313a0e0abe2";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    # Might be wise to use /dev/nvme0p2 instead
+    { device = "/dev/disk/by-uuid/EBA6-394D";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/default.nix

@@ -0,0 +1,64 @@
+{nixpkgs, agenix, home-manager, flake-utils, nixgl, rust-overlay, flake-compat
+,pkgs, lib, proj_root, nixosDefaultVersion? "22.05", defaultSystem? "x86_64-linux",...}@finalInputs: let
+config = {
+  bao.metadata = {
+    # req
+    hostName = "bao";
+    # opts
+    ssh_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBuAaAE7TiQmMH300VRj/pYCri1qPmHjd+y9aX2J0Fs";
+    nixosVersion = "22.11";
+    system = "x86_64-linux";
+    preset = "base";
+  };
+  bao.nixosConfig = {
+    modules = [
+      import ../modules/kde.sys.nix
+      import ../modules/pulseaudio.sys.nix
+      import ../modules/storage.perso.sys.nix
+    ];
+  };
+};
+propagate = hostConfig@{metadata, nixosConfig}: let 
+  # req
+  inherit (metadata) hostName;
+  # opts
+  ssh_pubkey = lib.attrByPath ["ssh_pubkey"] null metadata; # metadata.ssh_pubkey??undefined
+  users = lib.attrByPath ["users"] {} metadata;
+  nixosVersion = lib.attrByPath ["nixosVersion"] nixosDefaultVersion metadata;
+  system = lib.attrByPath ["system"] defaultSystem metadata;
+  preset = lib.attrByPath ["preset"] "base" metadata;
+  # infer
+  hardwareConfig = import "${proj_root.hosts.path}/${hostName}/hardware-configuration.nix";
+in {
+  inherit hostName ssh_pubkey users nixosVersion system preset hardwareConfig;
+  nixosConfig = nixosConfig // {
+    inherit system;
+    lib = finalInputs.lib;
+    modules = [
+      {
+        system.stateVersion = nixosVersion;
+        networking.hostName = hostName;
+        users.users = users;
+      }
+      {
+        _module.args = finalInputs;
+      }
+      import "${proj_root.modules.path}/secrets.nix"
+      import "${proj_root.modules.path}/${preset}.sys.nix"
+    ] ++ nixosConfig.modules;
+  };
+};
+mkHostFromPropagated = propagatedHostConfig@{nixosConfig,...}: nixpkgs.lib.nixosSystem nixosConfig;
+mkHost = hostConfig: (lib.pipe [propagate mkHostFromPropagated] hostConfig);
+trimNull = lib.filterAttrs (name: value: value != null);
+flattenPubkey = lib.mapAttrs (hostName: meta_config: meta_config.metadata.ssh_pubkey);
+in {
+  inherit config;
+  # nixosConfigurations = lib.mapAttrs (name: hostConfig: mkHost hostConfig) config;
+  nixosConfigurations = {};
+  debug = {
+    propagated = lib.mapAttrs (name: hostConfig: propagate hostConfig) config;
+  };
+  # {bao = "ssh-ed25519 ..."; another_host = "ssh-rsa ...";}
+  hostKeys = trimNull (flattenPubkey config);
+}

hosts/homeless/hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelParams = [ "console=ttyS0,19200n8" ];
+  boot.loader.grub.extraConfig = ''
+    serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial;
+    terminal_output serial
+  '';
+  boot.loader.grub.forceInstall = true;
+  boot.loader.grub.device = "nodev";
+  boot.loader.timeout = 10;
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/sda";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [{ device = "/dev/sdb"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s5.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/lester/hardware-configuration.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelParams = [ "console=ttyS0,19200n8" ];
+  boot.loader.grub.extraConfig = ''
+    serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial;
+    terminal_output serial
+  '';
+  boot.loader.grub.forceInstall = true;
+  boot.loader.grub.device = "nodev";
+  boot.loader.timeout = 10;
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/sda";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/sdb"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s5.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/lizzi/default.nix

@@ -0,0 +1,4 @@
+{nixpkgs, agenix, home-manager, flake-utils, nixgl, rust-overlay, flake-compat
+,pkgs, lib, proj_root}: {
+  
+}

hosts/lizzi/hardware-configuration.nix

@@ -0,0 +1,49 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelParams = [ "console=ttyS0,19200n8" ];
+  boot.loader.grub.extraConfig = ''
+    serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial;
+    terminal_output serial
+  '';
+  boot.loader.grub.forceInstall = true;
+  boot.loader.grub.device = "nodev";
+  boot.loader.timeout = 10;
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/sda";
+      fsType = "ext4";
+    };
+    # Assume Linode volume "gitea" exists, mount it to '/gitea"'
+    "/gitea" = {
+      device = "/dev/disk/by-id/scsi-0Linode_Volume_gitea";
+      fsType = "ext4";
+    };
+  };
+
+  swapDevices =
+    [{ device = "/dev/sdb"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s5.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/nyx/hardware-configuration.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  boot.kernelParams = ["console=ttyS0,19200n8"];
+  boot.loader.grub.extraConfig = ''
+    serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial;
+    terminal_output serial;
+  '';
+  boot.loader.grub.forceInstall = true;
+  boot.loader.grub.device = "nodev";
+  boot.loader.timeout = 10;
+  fileSystems."/" =
+    { device = "/dev/sda";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/sdb"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s5.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

lib/default.nix

@@ -0,0 +1,48 @@
+{pkgs
+,nixpkgs
+,proj_root
+,agenix
+,nixosDefaultVersion? "22.05"
+,defaultSystem? "x86_64-linux"
+,...}@inputs: let
+  lib = pkgs.lib;
+  serde = import ./serde.nix inputs // {inherit lib;};
+  # procedure = 
+in {
+  # short-hand to create a shell derivation
+  # NOTE: this is pure. This means, env vars from devShells might not
+  # be accessible unless MAYBE they are `export`ed
+  shellAsDrv = {script, pname}: (pkgs.callPackage (
+    # just a pattern that we must remember: args to this are children of pkgs.
+    {writeShellScriptBin}: writeShellScriptBin pname script
+  ) {});
+
+  # Configures hosts as nixosConfiguration
+  # mkHost = {hostName
+  # , nixosBareConfiguration
+  # , finalInputs
+  # , users ? {}
+  # , nixosVersion? nixosDefaultVersion
+  # , system? defaultSystem
+  # , preset? "base"}:  # base | minimal 
+  # let 
+  #   hardwareConfig = hostname: import "${proj_root.hosts.path}/${hostName}/hardware-configuration.nix";
+  # in nixpkgs.lib.nixosSystem (nixosBareConfiguration // {
+  #   inherit system;
+  #   modules = [
+  #     {
+  #       system.stateVersion = nixosVersion;
+  #       networking.hostName = hostName;
+  #       users.users = users;
+  #     }
+  #     {
+  #       _module.args = finalInputs;
+  #     }
+  #     import "${proj_root.modules.path}/secrets.nix"
+  #     import "${proj_root.modules.path}/${preset}.sys.nix"
+  #   ] ++ nixosBareConfiguration.modules;
+  #   lib = finalInputs.lib;
+  # });
+  inherit serde;
+  inherit (serde) fromYaml fromYamlPath;
+}

lib/serde.nix

@@ -0,0 +1,29 @@
+# Takes care of serializing and deserializing to some formats
+# Blame: Pegasust<pegasucksgg@gmail.com>
+# TODO: Add to* formats from pkgs.formats.*
+{ pkgs
+, lib
+,...
+} @ inputs:
+let 
+  yamlToJsonDrv = yamlContent: outputPath: pkgs.callPackage
+    ({ runCommand }:
+      # runCommand source: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/trivial-builders.nix#L33
+      runCommand outputPath { inherit yamlContent; nativeBuildInputs = [ pkgs.yq ]; }
+        # run yq which outputs '.' (no filter) on file at yamlPath
+        # note that $out is passed onto the bash/sh script for execution
+        ''
+          echo "$yamlContent" | yq >$out
+        '')
+    { };
+in {
+  # Takes in a yaml string and produces a derivation with translated JSON at $outputPath
+  # similar to builtins.fromJSON, turns a YAML string to nix attrset
+  fromYaml = yamlContent: builtins.fromJSON (builtins.readFile (yamlToJsonDrv yamlContent "any_output.json"));
+  fromYamlPath = yamlPath: builtins.fromJSON (
+    builtins.readFile (
+      yamlToJsonDrv (
+        builtins.readFile yamlPath) 
+      "any-output.json"));
+  # TODO: fromToml?
+}

lib/test.nix

@@ -0,0 +1,3 @@
+{lib,...}: {
+  
+}

modules/base.sys.nix

@@ -0,0 +1,14 @@
+{pkgs
+,lib
+,proj_root
+}:{
+  imports = [
+    ./minimal.sys.nix
+    ./mosh.sys.nix
+    ./tailscale.sys.nix
+    ./ssh.sys.nix
+  ];
+  environment.systemPackages = [pkgs.lm_sensors];
+  time.timeZone = "America/Phoenix";
+
+}

modules/default.nix

@@ -0,0 +1 @@
+inputs: {}

modules/kde.sys.nix

@@ -0,0 +1,27 @@
+{ pkgs
+, lib
+}: {
+  environment.noXlibs = lib.mkForce false;
+  # TODO: wireless networking
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+  # KDE & Plasma 5
+  services.xserver.displayManager.sddm.enable = true;
+  services.xserver.desktopManager.plasma5 = {
+    enable = true;
+    excludePackages = let plasma5 = pkgs.libsForQt5; in
+      [
+        plasma5.elisa # audio viewer
+        plasma5.konsole # I use alacritty instaed
+        plasma5.plasma-browser-integration
+        plasma5.print-manager # will enable if I need
+        plasma5.khelpcenter # why not just write manpages instead :(
+        # plasma5.ksshaskpass   # pls just put prompts on my dear terminal
+      ];
+  };
+
+  # disables KDE's setting of askpassword
+  programs.ssh.askPassword = "";
+  programs.ssh.enableAskPassword = false;
+}

modules/minimal.sys.nix

@@ -0,0 +1,27 @@
+{pkgs
+,lib
+,proj_root
+}:{
+  # prune old builds after a while
+  nix.settings.auto-optimize-store = true;
+  nix.package = pkgs.nixFlakes;             # nix flakes
+  nix.extraOptions = ''
+    experimental=feature = nix-command flakes
+  '';
+  programs.neovim = {
+      enable = true;
+      defaultEditor = true;
+  };
+  programs.git.enable = true;  
+  environment.systemPackages = [
+    pkgs.gnumake
+    pkgs.wget
+    pkgs.inetutils # network diag
+    pkgs.mtr # network diag
+    pkgs.sysstat # sys diag
+  ];
+  users.users.root = {
+    # openssh runs in root, no? This is because port < 1024 requires root.
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root}/ssh/authorized_keys");
+  };
+}

modules/mosh.sys.nix

@@ -0,0 +1,12 @@
+{pkgs
+,lib
+,config
+}: {
+  environment.systemPackages = [pkgs.mosh];
+  networking.firewall = lib.mkIf config.networking.firewall.enable {
+    allowedUDPPortRanges = [
+      { from = 60000; to = 61000; } # mosh
+    ];
+  };
+}
+

modules/pipewire.audio.sys.nix

@@ -0,0 +1,15 @@
+{
+  # Sound: pipewire
+  sound.enable = false;
+  hardware.pulseaudio.enable = false;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # Might want to use JACK in the future
+    jack.enable = true;
+  };
+
+  security.rtkit.enable = true;
+}

modules/pulseaudio.sys.nix

@@ -0,0 +1,9 @@
+{
+  # Enable sound. (pulse audio)
+  sound.enable = true;
+  programs.dconf.enable = true;
+  hardware.pulseaudio.enable = true;
+  hardware.pulseaudio.support32Bit = true;
+  nixpkgs.config.pulseaudio = true;
+  hardware.pulseaudio.extraConfig = "load-module module-combine-sink";
+}

modules/secrets.nix

@@ -0,0 +1,19 @@
+{agenix
+,proj_root}: {
+  imports = [
+    agenix.nixosModule
+  ];
+  age.secrets.s3fs = {
+    file = "${proj_root.secrets.path}/s3fs.age";
+    # mode = "600";  # owner + group only
+    # owner = "hungtr";
+    # group = "users";
+  };
+  age.secrets."s3fs.digital-garden" = {
+    file = "${proj_root.secrets.path}/s3fs.digital-garden.age";
+  };
+  age.secrets._nhitrl_cred = {
+    file = "${proj_root.secrets.path}/_nhitrl.age";
+  };
+  environment.systemPackages = [agenix.defaultPackage.x86_64-linux];
+}

modules/ssh.sys.nix

@@ -0,0 +1,6 @@
+{
+  services.openssh = {
+    enable = true;
+    permitRootLogin = false;
+  };
+}

modules/storage.perso.sys.nix

@@ -0,0 +1,110 @@
+# Personal configuration on storage solution
+{ pkgs, config, lib }: {
+  environment.systemPackages = [
+    pkgs.s3fs
+    pkgs.cifs-utils
+  ];
+
+  # Sadly, autofs uses systemd, so we can't put it in home-manager
+  # HACK: need to store secret somewhere so that root can access this
+  # because autofs may run as root for now, we enforce putting the secret in this monorepo
+  # TODO: make this configuration nix-less to show that it's 100% data
+  services.autofs =
+    let
+      # confToBackendArg {lol="what"; empty=""; name_only=null;} -> "lol=what,empty=,name_only"
+      # TODO: change null -> true/false. This allows overriding & better self-documentation
+      confToBackendArg = conf: (lib.concatStringsSep ","
+        (lib.mapAttrsToList (name: value: "${name}${lib.optionalString (value != null) "=${value}"}") conf));
+
+      # mount_dest: path ("wow")
+      # backend_args: nix attrs representing the arguments to be passed to s3fs 
+      #    ({"-fstype" = "fuse"; "use_cache" = "/tmp";})
+      # bucket: bucket name (hungtr-hot)
+      #     NOTE: s3 custom provider will be provided inside
+      #    backend_args, so just put the bucket name here
+      #
+      #-> "${mount_dest} ${formatted_args} ${s3fs-bin}#${bucket}"
+      autofs-s3fs_entry =
+        { mount_dest
+        , backend_args ? { "-fstype" = "fuse"; }
+        , bucket
+        }@inputs:
+        let
+          s3fs-exec = "${pkgs.s3fs}/bin/s3fs";
+        in
+        "${mount_dest} ${confToBackendArg backend_args} :${s3fs-exec}\#${bucket}";
+      personalStorage = [
+        # hungtr-hot @ phoenix is broken :)
+        # (autofs-s3fs_entry {
+        #   mount_dest = "hot";
+        #   backend_args = {
+        #     "-fstype" = "fuse";
+        #     use_cache = "/tmp";
+        #     del_cache = null;
+        #     allow_other = null;
+        #     url = ''"https://f5i0.ph.idrivee2-32.com"'';
+        #     # TODO: builtins.readFile requires a Git-controlled file
+        #     passwd_file = config.age.secrets.s3fs.path;
+        #     dbglevel = "debug"; # enable this for better debugging info in journalctl
+        #     uid = "1000"; # default user
+        #     gid = "100";  # users
+        #     umask="003";  # others read only, fully shared for users group
+        #     # _netdev = null; # ignored by s3fs (https://github.com/s3fs-fuse/s3fs-fuse/blob/master/src/s3fs.cpp#L4910)
+        #   };
+        #   bucket = "hungtr-hot";
+        # })
+        (autofs-s3fs_entry {
+          mount_dest = "garden";
+          backend_args = {
+            "-fstype" = "fuse";
+            use_cache = "/tmp";
+            del_cache = null;
+            allow_other = null;
+            url = "https://v5h5.la11.idrivee2-14.com";
+            passwd_file = config.age.secrets."s3fs.digital-garden".path;
+            dbglevel = "debug"; # enable this for better debugging info in journalctl
+            uid = "1000"; # default user
+            gid = "100"; # users
+            umask = "003"; # others read only, fully shared for users group
+          };
+          bucket = "digital-garden";
+        })
+        (
+          let args = {
+            "-fstype" = "cifs";
+            credentials = config.age.secrets._nhitrl_cred.path;
+            user = null;
+            uid = "1001";
+            gid = "100";
+            dir_mode = "0777";
+            file_mode = "0777";
+          };
+          in "felia_d ${confToBackendArg args} ://felia.coati-celsius.ts.net/d"
+        )
+        (
+          let args = {
+            "-fstype" = "cifs";
+            credentials = config.age.secrets._nhitrl_cred.path;
+            user = null;
+            uid = "1001";
+            gid = "100";
+            dir_mode = "0777";
+            file_mode = "0777";
+          };
+          in "felia_f ${confToBackendArg args} ://felia.coati-celsius.ts.net/f"
+        )
+      ];
+      persoConf = pkgs.writeText "auto.personal" (builtins.concatStringsSep "\n" personalStorage);
+    in
+    {
+      enable = true;
+      # Creates /perso directory with every subdirectory declared by ${personalStorage}
+      # as of now (might be stale), /perso/hot is the only mount accessible
+      # that is also managed by s3fs
+      autoMaster = ''
+        /perso file:${persoConf}
+      '';
+      timeout = 30; # default: 600, 600 seconds (10 mins) of inactivity => unmount
+      # debug = true; # writes to more to journalctl
+    };
+}

modules/tailscale.sys.nix

@@ -0,0 +1,48 @@
+{pkgs
+,config
+,lib
+,...}: {
+  environment.systemPackages = [pkgs.tailscale];
+  services.tailscale.enable = true;
+
+  systemd.services.tailscale-autoconnect = {
+    description = "Automatically connects to Tailscale";
+
+    # make sure tailscale is running before trying to connect to tailscale
+    after = [ "network-pre.target" "tailscale.service" ];
+    wants = [ "network-pre.target" "tailscale.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    # set this service as a oneshot job
+    serviceConfig.Type = "oneshot";
+
+    # have the job run this shell script
+    script = ''
+      # wait for tailscaled to settle
+      sleep 2
+      # check if we are already authenticated to tailscale
+      status="$(${pkgs.tailscale}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
+      if [ $status = "Running" ]; then # if so, then do nothing
+        exit 0
+      fi
+
+      # ${pkgs.tailscale}/bin/tailscale up # blocks, doesn't give url
+      # This time, configure device auth so that we authenticate from portal
+      # https://tailscale.com/kb/1099/device-authorization/#enable-device-authorization-for-your-network 
+      ${pkgs.tailscale}/bin/tailscale up -authkey tskey-auth-kJcgTG5CNTRL-PUVFkk31z1bThHpfq3FC5b1jcMmkW2EYW
+    '';
+  };
+
+  networking.firewall = lib.mkIf config.networking.firewall.enable {
+    trustedInterfaces = [
+      "tailscale0"
+    ];
+    allowedUDPPorts = [
+      config.services.tailscale.port
+    ];
+    allowedTCPPorts = [
+      22
+    ];
+    checkReversePath = "loose";
+  };
+}

native_configs/README.md

@@ -0,0 +1,3 @@
+# Native configs
+
+Contains all configurations that are written in their native language

native_configs/neovim/init.lua

@@ -216,7 +216,7 @@ require('telescope').setup {
             case_mode = 'smart_case'
         },
         file_browser = {
-            theme = "ivy",
+            theme = require('telescope.themes').get_ivy().theme,
             hiject_netrw = true, -- disables netrw and use file-browser instead
             mappings = {
                 ["i"] = {}, -- disable any shortcut in insert mode for now
@@ -246,7 +246,7 @@ pcall(require('telescope').load_extension, 'file_browser')
 remap('n', '<C-p>', '<cmd>Telescope<cr>', { desc = 'Open Telescope general search' })
 
 remap('n', '<leader>fm', function()
-    require("telescope").extensions.file_browser.file_browser()
+    require("telescope").extensions.file_browser.file_browser({})
 end, { desc = '[F]ile [M]utation' })
 
 remap('n', '<leader>ff', function()
@@ -284,7 +284,7 @@ end, { desc = '[F]ind [D]iagnostics' })
 -- ZK remap stuffs
 remap('n', '<leader>zf', function()
     -- vim.cmd([[:ZkNotes]])
-    require('zk').edit({}, {multi_select = false})
+    require('zk').edit({}, { multi_select = false })
 end, { desc = '[Z]ettelkasten [F]iles' })
 
 remap('n', '<leader>zg', function()
@@ -894,7 +894,7 @@ require('zk.commands').add("ZkGrep", function(match_ctor)
     elseif type(match_ctor) == 'string' then
         match = { match = grep_str }
     end
-    require('zk').edit(match, { title = "Grep: '" .. grep_str .. "'", mutli_select = false})
+    require('zk').edit(match, { title = "Grep: '" .. grep_str .. "'", mutli_select = false })
 end)
 
 
@@ -943,4 +943,3 @@ require('lualine').setup {
 }
 
 require('nvim-surround').setup {}
-

nix-conf/home-manager/base/alacritty.nix

@@ -5,7 +5,7 @@
 }:
 let
   inherit (myLib) fromYaml;
-  actualConfig = fromYaml (builtins.readFile "${proj_root}//alacritty/alacritty.yml");
+  actualConfig = fromYaml (builtins.readFile "${proj_root.config.path}//alacritty/alacritty.yml");
   cfg = config.base.alacritty;
 in
 {

nix-conf/home-manager/base/mkModuleArgs.nix

@@ -5,9 +5,14 @@
 let
   recursiveUpdate = lib.recursiveUpdate;
   _lib = recursiveUpdate lib (import ../../lib { inherit pkgs lib; });
+  proj_root = builtins.toString ./../../..;
 in
 # TODO: Unpollute inputs
 recursiveUpdate inputs {
-  proj_root = builtins.toString ./../../..;
+  proj_root = {
+    path = proj_root;
+    config.path = "${proj_root}/native_configs";
+    scripts.path = "${proj_root}/scripts";
+  };
   myLib = _lib;
 }

nix-conf/home-manager/base/private_chromium.nix

@@ -0,0 +1,48 @@
+{ config, pkgs, lib, ... }:
+let cfg = config.base.private_chromium;
+in
+{
+  options.base.private_chromium = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      example = false;
+      description = ''
+        Enable extremely lightweight chromium with vimium plugin
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    # home.packages = [pkgs.ungoogled-chromium];
+    programs.chromium = {
+      enable = true;
+      package = pkgs.ungoogled-chromium;
+      extensions =
+        let
+          mkChromiumExtForVersion = browserVersion: { id, sha256, extVersion, ... }:
+            {
+              inherit id;
+              crxPath = builtins.fetchurl {
+                url = "https://clients2.google.com/service/update2/crx" +
+                  "?response=redirect" +
+                  "&acceptformat=crx2,crx3" +
+                  "&prodversion=${browserVersion}" +
+                  "&x=id%3D${id}%26installsource%3Dondemand%26uc";
+                name = "${id}.crx";
+                inherit sha256;
+              };
+              version = extVersion;
+            };
+          mkChromiumExt = mkChromiumExtForVersion (lib.versions.major pkgs.ungoogled-chromium.version);
+        in
+        [
+          # vimium
+          (mkChromiumExt {
+            id = "dbepggeogbaibhgnhhndojpepiihcmeb";
+            sha256 = "00qhbs41gx71q026xaflgwzzridfw1sx3i9yah45cyawv8q7ziic";
+            extVersion = "1.67.4";
+          })
+        ];
+    };
+  };
+}

nix-conf/home-manager/base/productive_desktop.nix

@@ -0,0 +1,9 @@
+inputs@{pkgs,...}: {
+  imports = [
+    # slack
+    ({pkgs,...}: {
+      home.packages = [pkgs.slack];
+    })
+    ./private_chromium.nix
+  ];
+}

nix-conf/home-manager/base/shells.nix

@@ -36,7 +36,7 @@ in
     };
   };
   config = myLib.mkIf cfg.enable {
-    xdg.configFile."starship.toml".source = "${proj_root}//starship/starship.toml";
+    xdg.configFile."starship.toml".source = "${proj_root.config.path}//starship/starship.toml";
     # nix: Propagates the environment with packages and vars when enter (children of)
     # a directory with shell.nix-compatible and .envrc
     programs.direnv = {
@@ -51,7 +51,7 @@ in
     };
     programs.tmux = {
       enable = true;
-      extraConfig = builtins.readFile "${proj_root}/tmux/tmux.conf";
+      extraConfig = builtins.readFile "${proj_root.config.path}/tmux/tmux.conf";
     };
     programs.exa = {
       enable = true;

nix-conf/home-manager/base/ssh.nix

@@ -17,7 +17,7 @@ in
   config.programs.ssh = {
     inherit (cfg) enable;
     forwardAgent = true;
-    extraConfig = builtins.readFile "${proj_root}/ssh/config";
+    extraConfig = builtins.readFile "${proj_root.config.path}/ssh/config";
   };
 }
 

nix-conf/home-manager/flake.nix

@@ -35,52 +35,7 @@
       # lib = (import ../lib { inherit pkgs; lib = pkgs.lib; });
       base = import ./base;
       inherit (base) mkModuleArgs;
-      private_chromium = {config, pkgs, lib, ...}: let cfg = config.base.private_chromium;
+      
-      in {
-        options.base.private_chromium = {
-          enable = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            example = false;
-            description = ''
-            Enable extremely lightweight chromium with vimium plugin
-            '';
-          };
-        };
-        config = lib.mkIf cfg.enable {
-          # home.packages = [pkgs.ungoogled-chromium];
-          programs.chromium = {
-            enable = true;
-            package = pkgs.ungoogled-chromium;
-            extensions = 
-            let
-              mkChromiumExtForVersion = browserVersion: {id, sha256, extVersion,...}:
-              {
-                inherit id;
-                crxPath = builtins.fetchurl {
-                  url = "https://clients2.google.com/service/update2/crx"+
-                    "?response=redirect"+
-                    "&acceptformat=crx2,crx3"+
-                    "&prodversion=${browserVersion}"+
-                    "&x=id%3D${id}%26installsource%3Dondemand%26uc";
-                  name = "${id}.crx";
-                  inherit sha256;
-                };
-                version = extVersion;
-              };
-              mkChromiumExt = mkChromiumExtForVersion (lib.versions.major pkgs.ungoogled-chromium.version);
-            in
-            [
-              # vimium
-              (mkChromiumExt {
-                id = "dbepggeogbaibhgnhhndojpepiihcmeb"; 
-                sha256 = "00qhbs41gx71q026xaflgwzzridfw1sx3i9yah45cyawv8q7ziic"; 
-                extVersion = "1.67.4";
-              })
-            ];
-          };
-        };
-      };
       kde_module = {config, pkgs, ...}: {
         fonts.fontconfig.enable = true;
         home.packages = [
@@ -121,7 +76,7 @@
             modules = base.modules ++ [
               ./home.nix
               kde_module
-              private_chromium
+              ./base/productive_desktop.nix
             ];
             # optionally pass inarguments to module
             # we migrate this from in-place modules to allow flexibility

nix-conf/home-manager/home.nix

@@ -8,6 +8,7 @@
 , myHome
 , myLib
 , option # The options we're given, this might be useful for typesafety?
+, proj_root
 , ...
 }:
 let
@@ -15,16 +16,17 @@ let
     # Yes, I desperately want neovim to work out-of-the-box without flake.nix for now
     # I want at least python LSP to work everywhere because it's basically
     # an alternative to bash script when I move to OpenColo
-    pkgs.gccStdenv
+    # pkgs.gccStdenv
     pkgs.gcc
     pkgs.tree-sitter
-    pkgs.ripgrep
+    pkgs.fzf  # file name fuzzy search
-    pkgs.fzf
+    pkgs.sumneko-lua-language-server
-    # pkgs.sumneko-lua-language-server
+    pkgs.ripgrep  # content fuzzy search
-    pkgs.ripgrep
+    pkgs.zk  # Zettelkasten (limited support)
-    pkgs.zk
+    pkgs.fd  # Required by a Telescope plugin (?)
-    pkgs.fd
     pkgs.stdenv.cc.cc.lib
+    rust_pkgs
+    pkgs.rust-analyzer
     # Python3 as alternative to bash scripts :^)
     # (pkgs.python310Full.withPackages (pypkgs: [
     #   # python-lsp-server's dependencies is absolutely astronomous
@@ -33,7 +35,36 @@ let
     #   pypkgs.ujson  # pylsp seems to rely on this. satisfy it lol
     # ]))
   ];
-  proj_root = builtins.toString ./../..;
+  rust_pkgs = (pkgs.rust-bin.selectLatestNightlyWith
+    (
+      toolchain:
+      toolchain.default.override {
+        extensions = [ "rust-src" ];
+      }
+    ));
+# NOTE: Failure 1: buildInputs is pretty much ignored
+#   my_neovim = pkgs.neovim-unwrapped.overrideDerivation (old: {
+# # TODO: is there a more beautiful way to override propagatedBuildInputs?
+#     name = "hungtr-" + old.name;
+#     buildInputs = (old.buildInputs or []) ++ [
+#       pkgs.tree-sitter # highlighting
+#       rust_pkgs        # for potentially rust-analyzer
+#       pkgs.fzf
+#       pkgs.ripgrep
+#       pkgs.zk
+#       pkgs.fd
+#     ];
+# NOTE: Failure 2: propagatedBuildInputs probably only concerns dyn libs
+#   });
+  # NOTE: Failure 3: must be unwrapped neovim because home-manager does the wrapping
+  # my_neovim = pkgs.neovim;
+
+  # NOTE: Add packages to nvim_pkgs instead, so that it's available at userspace
+  # and is added to the path after wrapping.
+  # check: nix repl `homeConfigurations.hungtr.config.programs.neovim.finalPackage.buildCommand`
+  # see: :/--suffix.*PATH
+  # there should be mentions of additional packages
+  my_neovim = pkgs.neovim-unwrapped;
   inherit (myLib) fromYaml;
 in
 {
@@ -44,14 +75,14 @@ in
   };
   home.packages = pkgs.lib.unique ([
     # pkgs.ncdu
-    pkgs.rclone
+    pkgs.rclone   # cloud file operations
-    pkgs.htop
+    pkgs.htop     # system diagnostics in CLI
-    pkgs.ripgrep
+    pkgs.ripgrep  # content fuzzy search
-    pkgs.unzip
+    pkgs.unzip    # compression
-    pkgs.zip
+    pkgs.zip      # compression
 
     # cool utilities
-    pkgs.yq # Yaml adaptor for jq (only pretty print, little query)
+    pkgs.yq       # Yaml adaptor for jq (only pretty print, little query)
     pkgs.xorg.xclock # TODO: only include if have GL # For testing GL installation
     pkgs.logseq # TODO: only include if have GL # Obsidian alt
     pkgs.mosh # Parsec for SSH
@@ -59,30 +90,35 @@ in
     pkgs.lynx # Web browser at your local terminal
 
     # Personal management
-    pkgs.keepass
+    pkgs.keepass  # password manager. wish there is a keepass-query
 
     # pkgs.tailscale # VPC;; This should be installed in system-nix
     pkgs.python310 # dev packages should be in project
     # pkgs.python310.numpy
     # pkgs.python310Packages.tensorflow
     # pkgs.python310Packages.scikit-learn
-  ] ++ (myHome.packages or [ ]) ++ nvim_pkgs);
+  ] ++ (myHome.packages or [ ]) 
+  # ++ nvim_pkgs
+  );
 
   ## Configs ## 
-  xdg.configFile."nvim/init.lua".source = "${proj_root}//neovim/init.lua";
+  xdg.configFile."nvim/init.lua".source = "${proj_root.config.path}//neovim/init.lua";
-  xdg.configFile."zk/config.toml".source = "${proj_root}//zk/config.toml";
+  xdg.configFile."zk/config.toml".source = "${proj_root.config.path}//zk/config.toml";
 
   ## Programs ##
   programs.jq = {
     enable = true;
   };
+  # TODO: override the original package, inject tree-sitter and stuffs
   programs.neovim = {
     enable = true;
+    package = my_neovim;
     viAlias = true;
     vimAlias = true;
     withPython3 = true;
     withNodeJs = true;
     extraPackages = nvim_pkgs;
+    # only for here for archive-documentation
     # extraPython3Packages = (pypkgs: [
     #   # pypkgs.python-lsp-server
     #   pypkgs.ujson

nix-conf/system/configuration.nix

@@ -33,7 +33,7 @@ with lib;
   };
   users.users.root = {
     # openssh runs in root, no? This is because port < 1024 requires root.
-    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root}/ssh/authorized_keys");
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile "${proj_root}/native_configs/ssh/authorized_keys");
   };
 
   # Some basic programs

nix-conf/system/flake.nix

@@ -211,7 +211,9 @@
           ./configuration.nix
           # automount using s3fs
           ({config, pkgs, lib, ...}: {
-            environment.systemPackages = [pkgs.s3fs pkgs.cifs-utils]; # s3fs-fuse
+            environment.systemPackages = [
+              pkgs.s3fs pkgs.cifs-utils pkgs.lm_sensors pkgs.hddtemp
+            ]; # s3fs-fuse
             # Sadly, autofs uses systemd, so we can't put it in home-manager
             # HACK: need to store secret somewhere so that root can access this
             # because autofs may run as root for now, we enforce putting the secret in this monorepo

nix-conf/system/profiles/bao/hardware-configuration.nix

@@ -11,7 +11,7 @@
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
   # boot.initrd.kernelModules = [ "amdgpu" ];
   boot.initrd.kernelModules = [];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ "kvm-amd" "coretemp"];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =

nixops/simple_hydra.nix

@@ -1,31 +0,0 @@
-{
-  my-hydra = { config, pkgs, ... }: {
-    # send email
-    services.postfix = {
-      enable = true;
-      setSendmail = true;
-    };
-    # postgresql as a build queue (optimization possible?)
-    services.postgresql = {
-      enable = true;
-      package = pkgs.postgresql;
-      identMap = ''
-        hydra-users hydra hydra
-        hydra-users hydra-queue-runner hydra
-        hydra-users hydra-www hydra
-        hydra-users root postgres
-        hydra-users postgres postgres
-      '';
-    };
-    services.hydra = {
-      enable = true;
-      useSubstitutes = true;
-      # hydraURL = 
-    };
-    networking = {
-      firewall = {
-        allowedTCPPorts = [ config.services.hydra.port ];
-      };
-    };
-  };
-}

nixops/simple_hydra_vbox.nix

@@ -1,25 +0,0 @@
-# guide: https://qfpl.io/posts/nix/starting-simple-hydra/
-{
-  my-hydra = { config, pkgs, ... }: {
-    deployment = {
-      targetEnv = "virtualbox";
-      virtualbox.memorySize = 1024; # 1 GB``
-      virtualbox.vcpu = 2; # 2 vcpus :/ very limited on Linode, sorry
-      virtualbox.headless = true; # no gui pls
-    };
-    services = {
-      nixosManual.showManual = false; # save space, just no manual on our nix installation
-      ntp.enable = true; # time daemon
-      openssh = {
-        allowSFTP = false; # Prefer using SCP because connection is less verbose (?)
-        # we are going to generate rsa public key pair to machine
-        passwordAuthentication = false; # client-pubkey/server-prikey or dig yourself
-      };
-    };
-    users = {
-      mutableUsers = false; # Remember Trien's Windows freeze function? this is it.
-      # Yo, allow trusted users through ok?
-      users.root.openssh.authorizedKeys.keyFiles = [ "ssh/authorizedKeys" ];
-    };
-  };
-}

scripts/config-sysnix-edge.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env sh
+## Configures a new nixos system to this repository
+## Blame: Hung Tran (Pegasust) <pegasucksgg@gmail.com>
+
+set -xv
+
+HOSTNAME=${1}
+
+if [ -z $HOSTNAME ]; then
+	current_hostname=$(hostname)
+	echo "Missing hostname as first param."
+	echo "Type the hostname you want to be here"
+	read -p "[${current_hostname}] > " HOSTNAME
+	HOSTNAME=${HOSTNAME:-${current_hostname}}
+	read -p "Using hostname: ${HOSTNAME}. Press ENTER to continue." _WHATEVER_
+fi
+
+# Where is this script located
+SCRIPT_DIR=$(realpath $(dirname $0))
+echo "SCRIPT_DIR: ${SCRIPT_DIR}"
+
+SYSNIX_DIR="${SCRIPT_DIR}/.."
+
+# Copy hardware-configuration of existing machine onto our version control
+SYSNIX_PROF="${SYSNIX_DIR}/hosts/${HOSTNAME}"
+HARDWARE_CONF="${SYSNIX_PROF}/hardware-configuration.nix" 
+if [ ! -f "${HARDWARE_CONF}" ]; then
+	mkdir "$SYSNIX_PROF"
+	sudo cp /etc/nixos/hardware-configuration.nix ${HARDWARE_CONF}
+fi
+git add "${HARDWARE_CONF}"
+
+# Copy ssh/id-rsa details onto ssh/authorized_keys
+SSH_PRIV="${HOME}/.ssh/id_rsa"
+SSH_PUB="${SSH_PRIV}.pub"
+SSH_DIR="${SCRIPT_DIR}/../native_configs/ssh"
+if [ ! -f "${SSH_PRIV}" ]; then
+	ssh-keygen -b 2048 -t rsa -f "${SSH_PRIV}" -q -N ""
+fi
+# idempotently adds to authorized_keys
+cat "${SSH_PUB}" >> "${SSH_DIR}/authorized_keys"
+# sort "${SSH_DIR}/authorized_keys" | uniq >"${SSH_DIR}/authorized_keys"
+# NOTE: if we do sort... file >file, the ">file" is performed first, which truncates
+# the file before we open to read. Hence, `sort [...] file >file` yields empty file.
+# Because of this, we have to use `-o`
+sort -u "${SSH_DIR}/authorized_keys" -o "${SSH_DIR}/authorized_keys"
+
+echo "Apply nixos-rebuild"
+sudo nixos-rebuild switch --flake "${SYSNIX_DIR}#${HOSTNAME}"
+

scripts/config-sysnix.sh

@@ -33,7 +33,7 @@ git add "${HARDWARE_CONF}"
 # Copy ssh/id-rsa details onto ssh/authorized_keys
 SSH_PRIV="${HOME}/.ssh/id_rsa"
 SSH_PUB="${SSH_PRIV}.pub"
-SSH_DIR="${SCRIPT_DIR}/../ssh"
+SSH_DIR="${SCRIPT_DIR}/../native_configs/ssh"
 if [ ! -f "${SSH_PRIV}" ]; then
 	ssh-keygen -b 2048 -t rsa -f "${SSH_PRIV}" -q -N ""
 fi

secrets.nix

@@ -0,0 +1,10 @@
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).defaultNix.secrets

secrets/_nhitrl.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 ahbzMg QEQ0gfV00KEZFXSUMAnITVG2vAhS0IrnbbEXVsQRjXA
+/iXv++nOsRRmWAu4dFTmxxC7qlCjMuTYuTa6GsYgsX0
+-> ssh-ed25519 glsjZQ Lob1uedpMxsDygT/i6Pnuwi6BzdgZPAeemISakcncVM
+UddBD1YezLMeCUn4UuHGIrK68AwCIwuHAobpkJdi/3U
+-> Tx+>#u-grease ;A%8 W
+m11Fw6roG6feroJ/o5Ro8Dv1C3Piq3bGbdV78TH9Z0URPru+srdINovMvoVqjkuZ
+eHiRwb1fN0ymLRD6/WxT4ZLKbT6J5yNPCrc+
+--- 88hy3b76RX3PAc0Lfms//lhuqsi2tsqmL9gFQqUMBKM
+>%
frPåúéÚó€+÷JY`•îŽð',„ë~<7E><>ÄôʼfÝ‚Ä_
Q2A59N/ÄV·þ
ºÝ[ˆSgË3üß4Y(´cä}N[’Ò•ëJ¡ò6Uµ¯pvf/i§Ò+‘tÒTÞ^–Ø)<1A>

secrets/default.nix

@@ -0,0 +1,18 @@
+# TODO: put ssh keys as user/host config
+inputs: let 
+  # user-specific (~/.ssh/id_ed25519.pub)
+  users = {
+    "hungtr@bao" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+1+gps6phbZboIb9fH51VNPUCkhSSOAbkI3tq3Ou0Z";
+  };
+  # System-specific settings (/etc/ssh/ssh_host_ed25519_key.pub)
+  systems = {
+    "bao" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBuAaAE7TiQmMH300VRj/pYCri1qPmHjd+y9aX2J0Fs";
+  };
+  all = users // systems;
+  # stands for calculus
+  c_ = builtins;
+in {
+  "system/secrets/s3fs.age".publicKeys = c_.attrValues (all);
+  "system/secrets/s3fs.digital-garden.age".publicKeys = c_.attrValues (all);
+  "system/secrets/_nhitrl.age".publicKeys = c_.attrValues (all);
+}

secrets/s3fs.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 ahbzMg 6pTVLAgOY/JZVWiCFHLo8xQ4/CL6620IMaBRpqI8Wws
+CtJeQuy5VzKZhJnIH+/cjlKsAcg0RY2bhHTWVm+hUOY
+-> ssh-ed25519 glsjZQ we7RCgsnODTJ8rKYhU+9tu0DmLH+98mcQKQ3I2slikM
+G81lsFLQR9polxme1K/MU2d8Y01PrTqtzJnVq0EMJF0
+-> |-grease B\W,I9z ^Gx;$ Kk7!4,P
+0Jl5Lhx7R8YOs9S+hUtQDDpNIqBhC/MM0N7w1MCtwYtkIIIWKfY9jkJ7+Cew2Ee5
+Qb04jnE
+--- b7AXWRgK45a/91iwmwt5g+CWOlU/2f4nUDfXlg/bs9A
+¢²%;Þ3RmQÚ‹WhpÌ–VŠ;º×®¡¥VÍÚñ[zš9al¦±=cLêüva<>ëu7é,†tø±’ýUܶh^&å‰Ö¿WåJP6-ÇÒ£
n‘-ˆ¿=™]

secrets/s3fs.digital-garden.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 ahbzMg GUriNV3lYlrA4xfIUj9PedI8p87avdQKOXhFqVnyzG4
+TvLDyCGbmU0N26SLWDIhj8tAgwrx1kFyhe6knPvJbLg
+-> ssh-ed25519 glsjZQ uZUN8LJ5tnBlkrQ23JutAMzOODVF/96m+5qwgE0mJgM
+srPQPu/fcCSDsbyZF8HLytPts7LGib6AHKBxaVXbK+c
+-> R{n]I@-grease
+EdbrkSaDEZBhArX2fk83dPE8DAtFuCdzm9TlIfXWhv8+jFLNmSshkKYc2Rlj/FE1
+7w
+--- GYDU/uV9eu8AKstyufFIueBnuvXwlKO3Oz9LLxkkhKQ
+fâ/MôïŽ×XƒÁ€ôÑb€vÎV}®
^}|~êž¹.í•qÒU–Ô"‘€Öµ*«Åy‡…ÆÄñÇIôifªjîE´JW®a\ðÉysUïö<>“Ÿ¥Qè$’

shell.nix

@@ -0,0 +1,13 @@
+# This uses the exported devShells from flake.nix
+# the default or base version of nix-shell can be found in dev-shell.nix instead
+# This architecture is because we use top-level flake.nix
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).shellNix

templates/default.nix

@@ -0,0 +1,15 @@
+# TODO: templates should be able to have initial states like
+# repo name, author,...
+{pkgs
+,lib
+,...
+}: {
+  rust = {
+    path = ./rust;
+    description = "Minimal Rust build template using Naersk, rust-overlay, rust-analyzer";
+  };
+  rust-monorepo = {
+    path = ./rust-monorepo;
+    description = "Opinionated Rust monorepo, extended from ./rust, using Cargo workspace";
+  };
+}

templates/rust-monorepo/.envrc

@@ -0,0 +1 @@
+use flake

templates/rust-monorepo/.github/workflows/build_nix.yml

@@ -0,0 +1,13 @@
+name: "Build legacy Nix package on Ubuntu"
+
+on:
+  push:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v12
+      - name: Building package
+        run: nix-build . -A defaultPackage.x86_64-linux

templates/rust-monorepo/Cargo.lock

@@ -0,0 +1,14 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "cli"
+version = "0.1.0"
+dependencies = [
+ "core",
+]
+
+[[package]]
+name = "core"
+version = "0.1.0"

templates/rust-monorepo/Cargo.toml

@@ -0,0 +1,5 @@
+[workspace]
+members = [
+    "packages/*",
+    "exec/*"
+]

templates/rust-monorepo/default.nix

@@ -0,0 +1,7 @@
+(import (
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/99f1c2157fba4bfe6211a321fd0ee43199025dbf.tar.gz";
+    sha256 = "0x2jn3vrawwv9xp15674wjz9pixwjyj3j771izayl962zziivbx2"; }
+) {
+  src =  ./.;
+}).defaultNix

templates/rust-monorepo/exec/cli/.gitignore

@@ -0,0 +1 @@
+/target

templates/rust-monorepo/exec/cli/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "cli"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+core = { version = "0.1.0", path = "../../packages/core" }

templates/rust-monorepo/exec/cli/src/main.rs

@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}

templates/rust-monorepo/flake.nix

@@ -0,0 +1,35 @@
+{
+  inputs = {
+    naersk.url = "github:nix-community/naersk/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    utils.url = "github:numtide/flake-utils";
+    rust-overlay = "github:oxalica/rust-overlay";
+  };
+
+  outputs = { self, nixpkgs, utils, naersk, rust-overlay }:
+    utils.lib.eachDefaultSystem (system:
+      let
+        overlays = [ rust-overlay.overlays.default ];
+        pkgs = import nixpkgs { inherit system overlays; };
+        naersk-lib = pkgs.callPackage naersk { };
+      in
+      {
+        defaultPackage = naersk-lib.buildPackage ./.;
+        devShell = with pkgs; mkShell {
+          buildInputs = [
+            (pkgs.rust-bin.selectLatestNightlyWith
+              (
+                toolchain:
+                toolchain.default.override {
+                  extensions = [ "rust-src" ];
+                }
+              ))
+            pkgs.rust-analyzer
+          ];
+          RUST_SRC_PATH = rustPlatform.rustLibSrc;
+          shellHook = ''
+            # nix flake update # is this even needed?
+          '';
+        };
+      });
+}

templates/rust-monorepo/packages/core/.gitignore

@@ -0,0 +1,2 @@
+/target
+/Cargo.lock

templates/rust-monorepo/packages/core/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "core"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]

templates/rust-monorepo/packages/core/src/lib.rs

@@ -0,0 +1,14 @@
+pub fn add(left: usize, right: usize) -> usize {
+    left + right
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn it_works() {
+        let result = add(2, 2);
+        assert_eq!(result, 4);
+    }
+}

templates/rust-monorepo/shell.nix

@@ -0,0 +1,7 @@
+(import (
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/99f1c2157fba4bfe6211a321fd0ee43199025dbf.tar.gz";
+    sha256 = "0x2jn3vrawwv9xp15674wjz9pixwjyj3j771izayl962zziivbx2"; }
+) {
+  src =  ./.;
+}).shellNix

templates/rust/.envrc

@@ -0,0 +1 @@
+use flake

templates/rust/.github/workflows/build_nix.yml

@@ -0,0 +1,13 @@
+name: "Build legacy Nix package on Ubuntu"
+
+on:
+  push:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v12
+      - name: Building package
+        run: nix-build . -A defaultPackage.x86_64-linux

templates/rust/default.nix

@@ -0,0 +1,7 @@
+(import (
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/99f1c2157fba4bfe6211a321fd0ee43199025dbf.tar.gz";
+    sha256 = "0x2jn3vrawwv9xp15674wjz9pixwjyj3j771izayl962zziivbx2"; }
+) {
+  src =  ./.;
+}).defaultNix

templates/rust/flake.nix

@@ -0,0 +1,35 @@
+{
+  inputs = {
+    naersk.url = "github:nix-community/naersk/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    utils.url = "github:numtide/flake-utils";
+    rust-overlay = "github:oxalica/rust-overlay";
+  };
+
+  outputs = { self, nixpkgs, utils, naersk, rust-overlay }:
+    utils.lib.eachDefaultSystem (system:
+      let
+        overlays = [ rust-overlay.overlays.default ];
+        pkgs = import nixpkgs { inherit system overlays; };
+        naersk-lib = pkgs.callPackage naersk { };
+      in
+      {
+        defaultPackage = naersk-lib.buildPackage ./.;
+        devShell = with pkgs; mkShell {
+          buildInputs = [
+            (pkgs.rust-bin.selectLatestNightlyWith
+              (
+                toolchain:
+                toolchain.default.override {
+                  extensions = [ "rust-src" ];
+                }
+              ))
+            pkgs.rust-analyzer
+          ];
+          RUST_SRC_PATH = rustPlatform.rustLibSrc;
+          shellHook = ''
+            # nix flake update # is this even needed?
+          '';
+        };
+      });
+}

templates/rust/shell.nix

@@ -0,0 +1,7 @@
+(import (
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/99f1c2157fba4bfe6211a321fd0ee43199025dbf.tar.gz";
+    sha256 = "0x2jn3vrawwv9xp15674wjz9pixwjyj3j771izayl962zziivbx2"; }
+) {
+  src =  ./.;
+}).shellNix