From 77697276340fbfa7244cafb58ffe3b28e1002572 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Sun, 17 Nov 2024 12:42:28 +0100 Subject: [PATCH] move nixpkgs-stable to private flake inputs now with home-manager and nix-darwin tests, we don't want to increase the number of dependencies a user has to override in their flake.lock. --- dev/private.narHash | 1 + dev/private/flake.lock | 48 +++++++++++++++++++++ dev/private/flake.nix | 9 ++++ flake.lock | 19 +------- flake.nix | 98 ++++++++++++++++++++++++------------------ shell.nix | 5 +++ 6 files changed, 120 insertions(+), 60 deletions(-) create mode 100644 dev/private.narHash create mode 100644 dev/private/flake.lock create mode 100644 dev/private/flake.nix diff --git a/dev/private.narHash b/dev/private.narHash new file mode 100644 index 0000000..b5ccbc3 --- /dev/null +++ b/dev/private.narHash @@ -0,0 +1 @@ +sha256-qF9EiqHqJARLtA+ZABXa2mstgbza762DwoGEIGkyqVY= \ No newline at end of file diff --git a/dev/private/flake.lock b/dev/private/flake.lock new file mode 100644 index 0000000..eb3008e --- /dev/null +++ b/dev/private/flake.lock @@ -0,0 +1,48 @@ +{ + "nodes": { + "nixpkgs-stable": { + "locked": { + "lastModified": 1731842749, + "narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "release-24.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs-stable": "nixpkgs-stable", + "treefmt-nix": "treefmt-nix" + } + }, + "treefmt-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs-stable" + ] + }, + "locked": { + "lastModified": 1730321837, + "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/dev/private/flake.nix b/dev/private/flake.nix new file mode 100644 index 0000000..e3a4865 --- /dev/null +++ b/dev/private/flake.nix @@ -0,0 +1,9 @@ +{ + description = "private inputs"; + inputs.nixpkgs-stable.url = "github:NixOS/nixpkgs/release-24.05"; + + inputs.treefmt-nix.url = "github:numtide/treefmt-nix"; + inputs.treefmt-nix.inputs.nixpkgs.follows = "nixpkgs-stable"; + + outputs = _: { }; +} diff --git a/flake.lock b/flake.lock index 01c146b..eda6a5f 100644 --- a/flake.lock +++ b/flake.lock @@ -16,26 +16,9 @@ "type": "github" } }, - "nixpkgs-stable": { - "locked": { - "lastModified": 1731797254, - "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "release-24.05", - "repo": "nixpkgs", - "type": "github" - } - }, "root": { "inputs": { - "nixpkgs": "nixpkgs", - "nixpkgs-stable": "nixpkgs-stable" + "nixpkgs": "nixpkgs" } } }, diff --git a/flake.nix b/flake.nix index 2777d50..cb212ea 100644 --- a/flake.nix +++ b/flake.nix @@ -1,7 +1,7 @@ { description = "Integrates sops into nixos"; inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; - inputs.nixpkgs-stable.url = "github:NixOS/nixpkgs/release-24.05"; + nixConfig.extra-substituters = [ "https://cache.thalheim.io" ]; nixConfig.extra-trusted-public-keys = [ "cache.thalheim.io-1:R7msbosLEZKrxk/lKxf9BTjOOH7Ax3H0Qj0/6wiHOgc=" @@ -10,21 +10,41 @@ { self, nixpkgs, - nixpkgs-stable, - }: + }@inputs: let + loadPrivateFlake = + path: + let + flakeHash = builtins.readFile "${toString path}.narHash"; + flakePath = "path:${toString path}?narHash=${flakeHash}"; + in + builtins.getFlake (builtins.unsafeDiscardStringContext flakePath); + + privateFlake = loadPrivateFlake ./dev/private; + + privateInputs = privateFlake.inputs; + systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ]; - forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system); - suffix-version = - version: attrs: - nixpkgs.lib.mapAttrs' (name: value: nixpkgs.lib.nameValuePair (name + version) value) attrs; - suffix-stable = suffix-version "-24_05"; + + eachSystem = + f: + builtins.listToAttrs ( + builtins.map (system: { + name = system; + value = f { + pkgs = inputs.nixpkgs.legacyPackages.${system}; + inherit system; + }; + }) systems + ); + in + # public outputs { overlays.default = final: prev: @@ -52,39 +72,33 @@ sops = ./modules/nix-darwin; default = self.darwinModules.sops; }; - packages = forAllSystems ( - system: - import ./default.nix { - pkgs = import nixpkgs { inherit system; }; - } - ); - checks = - nixpkgs.lib.genAttrs - [ - "x86_64-linux" - "aarch64-linux" - ] - ( - system: - let - tests = self.packages.${system}.sops-install-secrets.tests; - packages-stable = import ./default.nix { - pkgs = import nixpkgs-stable { inherit system; }; - }; - tests-stable = packages-stable.sops-install-secrets.tests; - in - tests // (suffix-stable tests-stable) // (suffix-stable packages-stable) - ); + packages = eachSystem ({ pkgs, ... }: import ./default.nix { inherit pkgs; }); + } + // + # dev outputs + { + checks = eachSystem ( + { system, ... }: + let + tests = self.packages.${system}.sops-install-secrets.tests; + packages-stable = import ./default.nix { + pkgs = privateInputs.nixpkgs-stable.legacyPackages.${system}; + }; + tests-stable = packages-stable.sops-install-secrets.tests; + suffix-version = + version: attrs: + nixpkgs.lib.mapAttrs' (name: value: nixpkgs.lib.nameValuePair (name + version) value) attrs; + suffix-stable = suffix-version "-24_05"; + in + tests // (suffix-stable tests-stable) // (suffix-stable packages-stable) + ); - devShells = forAllSystems ( - system: - let - pkgs = nixpkgs.legacyPackages.${system}; - in - { - unit-tests = pkgs.callPackage ./pkgs/unit-tests.nix { }; - default = pkgs.callPackage ./shell.nix { }; - } - ); - }; + devShells = eachSystem ( + { pkgs, ... }: + { + unit-tests = pkgs.callPackage ./pkgs/unit-tests.nix { }; + default = pkgs.callPackage ./shell.nix { }; + } + ); + }; } diff --git a/shell.nix b/shell.nix index 30505fe..02083a6 100644 --- a/shell.nix +++ b/shell.nix @@ -10,6 +10,11 @@ pkgs.mkShell { util-linux nix golangci-lint + + (pkgs.writeScriptBin "update-dev-private-narHash" '' + nix --extra-experimental-features "nix-command flakes" flake lock ./dev/private + nix --extra-experimental-features "nix-command flakes" hash path ./dev/private | tr -d '\n' > ./dev/private.narHash + '') ]; # delve does not compile with hardening enabled hardeningDisable = [ "all" ];