eve-psr-nix0/flake.nix

{
  inputs = {
    nixpkgs.url = "nixpkgs/nixos-unstable";
    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.darwin.follows = "";
    };
  };

  outputs = { self, nixpkgs, agenix, ... }@attrs:
    let
      containerDef = import ./containers.nix;
      serviceContainers = containerDef.containers;

      pkgs = import nixpkgs { inherit system; };
      system = "x86_64-linux";
    in {
      devShell.x86_64-linux = pkgs.mkShell {
        buildInputs = [ 
          agenix.packages.x86_64-linux.default
          (pkgs.nixos { }).nixos-rebuild 
          pkgs.terraform 
        ];
        shellHook = ''
          alias deploy="nixos-rebuild switch --target-host root@matri.cx --build-host root@matri.cx --flake .#eve-psr-nix0"
        '';
      };

      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt;

      nixosConfigurations = {
        eve-psr-nix0 = nixpkgs.lib.nixosSystem {
          inherit system;
          specialArgs = attrs;
          modules = [
            ({ modulesPath, ... }: {

              imports = [ agenix.nixosModules.default ./hardware-configuration.nix ];

              nix = {
                buildMachines = [ ];
                distributedBuilds = false;
                settings.experimental-features = [ "nix-command" "flakes" ];
              };

              boot = {
                loader.systemd-boot.enable = true;
                loader.efi.canTouchEfiVariables = true;
              };

              time.timeZone = "America/Chicago";
              networking = {
                hostName = "eve-psr-nix0";
                firewall = {
                  allowedTCPPorts = [ 22 80 443 3034 ];
                  allowedUDPPorts = [ 22 80 443 ];
                };
              };

              environment.systemPackages = with pkgs; [ git pciutils vim wget ];

              services = {
                openssh = { 
                  enable = true;
                };

                hydra = {
                  enable = true;
                  hydraURL = "https://hydra.matri.cx";
                  listenHost = "192.168.0.130";
                  port = 3034;

                  extraConfig = ''
                    using_frontend_proxy = 1
                    base_uri = "https://hydra.matri.cx"
                  '';

                  useSubstitutes = true;

                  notificationSender = "hydra@matri.cx";
                  buildMachinesFiles = [ ];
                };
              };

              virtualisation = {
                oci-containers = {
                  backend = "podman";
                  containers = serviceContainers;
                };
              };

              security.sudo.wheelNeedsPassword = false;
              users = {
                users = {
                  sezycei = {
                    isNormalUser = true;
                    initialPassword = "bootMaster";
                    extraGroups = [ "wheel" ];
                    packages = with pkgs; [ byobu tmux stack ];
                  };
                  torrent = {
                    isNormalUser = true;
                    initialPassword = "torrentUserTemp";
                  };
                };

              };

              age.secrets.keys.file = ./secrets/keys.age;

              #sops = {
              #  age = { sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; };
              #  defaultSopsFile = ./secrets/keys.yaml;
              #  secrets = {
              #    hostname = { };
              #  };
              #};

              system.stateVersion = "22.11";
            })
          ];
        };
      };
    };
}