mirror of
https://github.com/srid/nixos-config.git
synced 2026-07-16 22:01:33 +08:00
776c4425b0
The incus-pet CLI gains three big changes that together cut per-container
disk usage by ~5GB, drop nix-rebuild + nix-copy from the deploy path, and
make `deploy` actually pull latest on every invocation. anywhen migrates
from a host-installed service to an incus-pet container in the process.
* Shared /nix/store mount. Each container gets host's /nix/store
bind-mounted read-only (with shift=true for idmapped unprivileged
containers). Zero per-container duplication of nixpkgs closures. The
CLI builds toplevels on the host; the container sees them via the
shared mount, no `nix copy` needed.
* Restart-to-deploy. switch-to-configuration is removed entirely (it
was stalling on dbus-broker reload and hitting the same lock-
contention bug across redeploys). New activation: update
/nix/var/nix/profiles/system, repoint /sbin/init through the profile
symlink, `incus restart`. The new toplevel's own init script handles
/etc setup on boot. Trade-off: ~5s of container reboot per deploy.
* Marshaling flake exposes only nixosModules.default. No nixpkgs
input, no nixosConfigurations entry. The CLI picks nixpkgs at build
time (pinned to nixos-25.11 — matches the LXC image baseline, dodges
unstable regressions) and assembles the full nixosSystem via
`nix build --impure --expr`. Lets us bump nixpkgs without touching
per-deploy state.
* `nix flake update --refresh` on every deploy. Was `nix flake lock`,
which only locks first-seen inputs — re-deploying `github:srid/anywhen`
stayed pinned at the first commit ever resolved. Now every deploy
bumps the target input to the current tip of its ref and bypasses
nix's fetcher cache.
* /sbin/init repoint. The NixOS LXC image hard-links /sbin/init to its
own toplevel's init path. Without switch-to-configuration, `incus
restart` re-execs that old init, which sets up /etc from the old
toplevel — running services keep using the OLD anywhen binary even
though the profile pointer moved. CLI now also does
`ln -sfn /nix/var/nix/profiles/system/init /sbin/init` so the profile
actually drives boot. Idempotent.
* Host gcroot via `nix-store --add-root --indirect`. Container's nix DB
doesn't know about the path (it lives behind the shared mount), so
without a host-side gcroot the host could nix-collect-garbage the
running system out from under the container. Symlink at
~/.local/state/incus-pet/<name>/system. Only the LATEST toplevel is
pinned per app — no rollback today (file a 5-line ring buffer when
rollback matters).
* anywhen flake input removed. `modules/nixos/linux/anywhen.nix` is
gone; the host config no longer imports anywhen as a flake input.
The deploy command takes the flake ref as an argument, so locking it
here was just bloat. `just pureintent anywhen-deploy` runs the
current invocation.
* pureintent ops recipes. New `configurations/nixos/pureintent/mod.just`
with anywhen-{deploy,rm,backup,restore,status,shell}. Namespaced via
`mod pureintent` so each host's recipes live behind their own prefix.
* Drop ssh from deploy path. Bootstrap still pushes the operator's
pubkey (for interactive debugging), but activation goes through
`incus exec` exclusively. No NIX_SSHOPTS, no nix-copy-via-ssh,
no host-key TOFU dance during deploys.
Tested end-to-end on pureintent: anywhen migrated from host-installed
(21-task SQLite DB at /var/lib/anywhen) to an incus-pet container with
the DB intact; hello-web deployed fresh with shared /nix/store; both
serve over the tailscale proxy at 100.122.32.106:{6111,8081}; lock
bumps + new toplevels confirmed after master advances.
84 lines
3.2 KiB
Nix
84 lines
3.2 KiB
Nix
{
|
|
description = "Srid's NixOS / nix-darwin configuration";
|
|
|
|
|
|
inputs = {
|
|
flake-parts.url = "github:hercules-ci/flake-parts";
|
|
|
|
# Principle inputs
|
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
|
nix-darwin.url = "github:LnL7/nix-darwin/master";
|
|
nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
|
|
home-manager.url = "github:nix-community/home-manager/master";
|
|
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
|
nixos-hardware.url = "github:NixOS/nixos-hardware";
|
|
nixos-unified.url = "github:srid/nixos-unified";
|
|
disko.url = "github:nix-community/disko";
|
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
|
agenix.url = "github:ryantm/agenix";
|
|
agenix.inputs = {
|
|
darwin.follows = "nix-darwin";
|
|
home-manager.follows = "home-manager";
|
|
nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# Software inputs
|
|
github-nix-ci.url = "github:juspay/github-nix-ci";
|
|
nixos-vscode-server.flake = false;
|
|
nixos-vscode-server.url = "github:nix-community/nixos-vscode-server";
|
|
nix-index-database.url = "github:nix-community/nix-index-database";
|
|
nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
|
|
zmx.url = "github:neurosnap/zmx";
|
|
# vira.url = "github:juspay/vira/github";
|
|
vira.url = "github:juspay/vira";
|
|
# landrun-nix.url = "github:srid/landrun-nix";
|
|
landrun-nix.url = "github:adrian-gierakowski/landrun-nix/darwin-implementation-via-sandbox-exec";
|
|
jumphost-nix.url = "github:srid/jumphost-nix";
|
|
jumphost-nix.flake = false;
|
|
|
|
# KOLU
|
|
kolu.url = "github:juspay/kolu/feat/dock-activity-window";
|
|
|
|
# anywhen is NOT a flake input — it's deployed as an incus-pet
|
|
# container, with the flake ref passed at deploy time (see
|
|
# `just pureintent anywhen-deploy`). The host config doesn't import
|
|
# anything from anywhen, so locking it here would just bloat
|
|
# flake.lock without buying us anything.
|
|
|
|
project-unknown.url = "github:juspay/project-unknown";
|
|
project-unknown.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
# claude-code 2.1.98 (newer versions are nerfed)
|
|
# See: https://x.com/Sthiven_R/status/2043992488109899849
|
|
llm-agents.url = "github:numtide/llm-agents.nix/d9583b68fdc553936b35dc6ca206d8d8dd552e5b";
|
|
llm-agents.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
# Emanote & Imako
|
|
emanote.url = "github:srid/emanote";
|
|
imako.url = "github:srid/imako";
|
|
disc-scrape.url = "github:srid/disc-scrape";
|
|
|
|
# Devshell
|
|
git-hooks.url = "github:cachix/git-hooks.nix";
|
|
git-hooks.flake = false;
|
|
};
|
|
|
|
outputs = inputs@{ self, ... }:
|
|
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
|
|
systems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
|
|
imports = (with builtins;
|
|
map
|
|
(fn: ./modules/flake-parts/${fn})
|
|
(attrNames (readDir ./modules/flake-parts)));
|
|
|
|
perSystem = { lib, system, ... }: {
|
|
# Make our overlay available to the devShell
|
|
# "Flake parts does not yet come with an endorsed module that initializes the pkgs argument.""
|
|
# So we must do this manually; https://flake.parts/overlays#consuming-an-overlay
|
|
_module.args.pkgs = import inputs.nixpkgs {
|
|
inherit system;
|
|
overlays = lib.attrValues self.overlays;
|
|
config.allowUnfree = true;
|
|
};
|
|
};
|
|
};
|
|
}
|