Something went wrong. Try again.
Sovereign infrastructure from one typed specification: a server, its websites, DNS, git, backups and recovery
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081# Turns an instance repository into everything it describes. The instance follows a fixed layout:# spec/default.nix the specification (checked against spec/schema.nix of sov)# sites/ the websites' sources, referenced from the spec# secrets/server.yaml secrets the server reads (sops; recipients in .sops.yaml)# secrets/admin.yaml secrets only the owner's tools read# secrets/host_key.sops the server's SSH host key, its identity (owner only); host_key.pub# host/default.nix what is specific to the machine: hardware, disk, network## Usage, in the instance's flake.nix: outputs = { self, sov }: sov.lib.instance { inherit self; };inputs@{ self, nixpkgs, disko, sops-nix, nixos-anywhere, ... }:{ self }:let sovFlake = inputs.self; instance = self; inherit (nixpkgs) lib; system = "x86_64-linux"; pkgs = nixpkgs.legacyPackages.${system}; sov = import ../spec/derive.nix { inherit lib; specification = instance + "/spec"; }; host = sov.spec.server.hostname;
server = extra: args: lib.nixosSystem { inherit system; specialArgs = { inherit inputs sov instance; } // args; modules = [ disko.nixosModules.disko sops-nix.nixosModules.sops ../modules (instance + "/host") ] ++ extra; };
tool = name: deps: script: { type = "app"; program = toString (pkgs.writeShellScript name '' export PATH=${lib.makeBinPath deps}:$PATH exec ${script} "$@" ''); };in{ # The specification as data, for the sov command (nix eval .#spec.<attr>). inherit (sov) spec; # What the sov command needs from the system: the secrets catalogue and the heartbeats. sov = { inherit (instance.nixosConfigurations.${host}.config.sov) secrets heartbeats state; };
nixosConfigurations = { # The server, including the monthly recovery drill, which installs the copy below. ${host} = server [ ../modules/drill.nix ] { drill = instance.nixosConfigurations.drill.config.system.build; }; # The same server for the recovery drill, without effects on the outside world. drill = server [ ../modules/drill-target.nix ] { }; };
checks.${system} = { # Boots the shared base in a VM and checks its hardening. base = pkgs.testers.runNixOSTest (import ../tests/base.nix { inherit sov sops-nix; }); # The real system builds. server = instance.nixosConfigurations.${host}.config.system.build.toplevel; };
apps.${system} = { # Everything done from outside the server: nix run .#sov -- help sov = tool "sov" [ pkgs.python3 pkgs.sops pkgs.git pkgs.nix pkgs.openssh pkgs.ssh-to-age pkgs.age pkgs.qrencode pkgs.coreutils pkgs.gh ] "${pkgs.python3}/bin/python3 ${../tools/sov.py}"; # Wipes a VPS and installs this instance onto it: nix run .#install -- <user>@<ip> install = tool "install" [ pkgs.sops pkgs.coreutils pkgs.openssh nixos-anywhere.packages.${system}.default ] "${../tools/install.sh} ${host}"; };
# `nix develop`: the sov command as `sov`, plus sops and age. devShells.${system}.default = pkgs.mkShell { packages = [ (pkgs.writeShellScriptBin "sov" ''exec ${instance.apps.${system}.sov.program} "$@"'') pkgs.sops pkgs.age ]; };}