From d0b00ada96b0a63fed09897357aec697182b4802 Mon Sep 17 00:00:00 2001 From: alexion Date: Fri, 28 Aug 2026 11:01:15 -0400 Subject: [PATCH] refactor(flake): split assembly by concept --- flake/default.nix | 77 ++++++++++----------------------------- flake/guests.nix | 26 ++++--------- flake/hosts.nix | 44 ++++++++++++++++++++++ flake/modules.nix | 22 +++++++++++ guests/actualbudget.nix | 2 +- guests/copyparty.nix | 2 +- guests/nesting-sample.nix | 2 +- guests/reverse-proxy.nix | 2 +- guests/sample.nix | 2 +- lib/default.nix | 7 ++++ lib/network.nix | 12 ++++++ 11 files changed, 117 insertions(+), 81 deletions(-) create mode 100644 flake/hosts.nix create mode 100644 flake/modules.nix create mode 100644 lib/default.nix create mode 100644 lib/network.nix diff --git a/flake/default.nix b/flake/default.nix index 7127139..e742025 100644 --- a/flake/default.nix +++ b/flake/default.nix @@ -5,26 +5,11 @@ }: let registryAssembly = import ./registry.nix { inherit lib self; }; + modules = import ./modules.nix { inherit lib; }; + dotfilesLib = import ../lib { inherit lib; }; - collectNixFiles = - dir: - lib.flatten ( - lib.mapAttrsToList ( - name: type: - let - path = dir + "/${name}"; - in - if type == "directory" then - collectNixFiles path - else if type == "regular" && lib.hasSuffix ".nix" name then - [ path ] - else - [ ] - ) (builtins.readDir dir) - ); - - moduleFiles = collectNixFiles (self + "/modules"); - guestFiles = collectNixFiles (self + "/guests"); + moduleFiles = modules.mkModules (self + "/modules"); + guestFiles = modules.mkModules (self + "/guests"); collectedRegistry = registryAssembly.collect { hosts = self.nixosConfigurations; }; @@ -37,15 +22,10 @@ let registry = collectedRegistry; }; - bridgeName = id: "br-vlan${toString id}"; - dotfiles = { - inherit (guests) guest; + inherit (guests) mkGuest; - lib = { - inherit bridgeName; - inherit (guests) deriveMac; - }; + lib = dotfilesLib; }; guests = import ./guests.nix { @@ -54,43 +34,24 @@ let lib self specialArgs - bridgeName moduleFiles registryAssembly + dotfilesLib ; }; - mkHost = - { - hostName, - system ? "x86_64-linux", - }: - inputs.nixpkgs.lib.nixosSystem { - inherit system specialArgs; - modules = - moduleFiles - ++ guestFiles - ++ [ - inputs.chaotic.nixosModules.default - inputs.disko.nixosModules.disko - inputs.sops-nix.nixosModules.sops - inputs.stylix.nixosModules.stylix - registryAssembly.module - (self + "/hosts/${hostName}") - { - networking.hostName = hostName; - modules.host.enable = true; - } - ]; - }; - - mkHosts = - hostsDir: - let - hostNames = lib.attrNames (lib.filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir)); - in - lib.genAttrs hostNames (hostName: mkHost { inherit hostName; }); + hosts = import ./hosts.nix { + inherit + inputs + lib + self + specialArgs + moduleFiles + guestFiles + registryAssembly + ; + }; in { - inherit mkHosts; + inherit (hosts) mkHosts; } diff --git a/flake/guests.nix b/flake/guests.nix index 33ab552..e3df47b 100644 --- a/flake/guests.nix +++ b/flake/guests.nix @@ -3,22 +3,12 @@ lib, self, specialArgs, - bridgeName, moduleFiles, registryAssembly, + dotfilesLib, }: let - inherit (lib) escapeShellArg mapAttrsToList; - - deriveMac = - name: - let - hash = builtins.hashString "sha256" name; - octet = i: builtins.substring (i * 2) 2 hash; - in - lib.concatStringsSep ":" ([ "02" ] ++ map octet [ 0 1 2 3 4 ]); - - guest = + mkGuest = { name, interior ? { }, @@ -59,13 +49,13 @@ let createdMounts = lib.filterAttrs (_guestPath: m: m.create != null) cfg.mounts; mountCreateScript = lib.concatStringsSep "\n" ( - mapAttrsToList ( + lib.mapAttrsToList ( _guestPath: m: let create = m.create; in '' - ${config.system.path}/bin/install -d -o ${escapeShellArg (toString create.owner)} -g ${escapeShellArg create.group} -m ${escapeShellArg create.mode} ${escapeShellArg m.hostPath} + ${config.system.path}/bin/install -d -o ${lib.escapeShellArg (toString create.owner)} -g ${lib.escapeShellArg create.group} -m ${lib.escapeShellArg create.mode} ${lib.escapeShellArg m.hostPath} '' ) createdMounts ); @@ -113,7 +103,7 @@ let }; mac = lib.mkOption { type = lib.types.str; - default = deriveMac name; + default = dotfilesLib.deriveMac name; defaultText = lib.literalMD "a stable address derived from the guest's namespace path"; example = "bc:24:11:00:00:01"; description = '' @@ -316,7 +306,7 @@ let } (lib.mkIf networked ( let - bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (bridgeName cfg.vlan)}.device"; + bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (dotfilesLib.bridgeName cfg.vlan)}.device"; in { after = [ bridgeDevice ]; @@ -329,7 +319,7 @@ let containers.${machineName} = lib.mkIf (cfg.backend == "container") { autoStart = cfg.autoStart; privateNetwork = lib.mkDefault true; - hostBridge = lib.mkIf networked (bridgeName cfg.vlan); + hostBridge = lib.mkIf networked (dotfilesLib.bridgeName cfg.vlan); privateUsers = lib.mkDefault "no"; additionalCapabilities = lib.optionals cfg.nesting [ "CAP_NET_ADMIN" ]; allowedDevices = lib.optionals cfg.nesting [ @@ -366,5 +356,5 @@ let }; in { - inherit deriveMac guest; + inherit mkGuest; } diff --git a/flake/hosts.nix b/flake/hosts.nix new file mode 100644 index 0000000..59a4c88 --- /dev/null +++ b/flake/hosts.nix @@ -0,0 +1,44 @@ +{ + inputs, + lib, + self, + specialArgs, + moduleFiles, + guestFiles, + registryAssembly, +}: +let + mkHost = + { + hostName, + system ? "x86_64-linux", + }: + inputs.nixpkgs.lib.nixosSystem { + inherit system specialArgs; + modules = + moduleFiles + ++ guestFiles + ++ [ + inputs.chaotic.nixosModules.default + inputs.disko.nixosModules.disko + inputs.sops-nix.nixosModules.sops + inputs.stylix.nixosModules.stylix + registryAssembly.module + (self + "/hosts/${hostName}") + { + networking.hostName = hostName; + modules.host.enable = true; + } + ]; + }; + + mkHosts = + hostsDir: + let + hostNames = lib.attrNames (lib.filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir)); + in + lib.genAttrs hostNames (hostName: mkHost { inherit hostName; }); +in +{ + inherit mkHosts; +} diff --git a/flake/modules.nix b/flake/modules.nix new file mode 100644 index 0000000..88bd71a --- /dev/null +++ b/flake/modules.nix @@ -0,0 +1,22 @@ +{ lib }: +let + collectNixFiles = + dir: + lib.flatten ( + lib.mapAttrsToList ( + name: type: + let + path = dir + "/${name}"; + in + if type == "directory" then + collectNixFiles path + else if type == "regular" && lib.hasSuffix ".nix" name then + [ path ] + else + [ ] + ) (builtins.readDir dir) + ); +in +{ + mkModules = collectNixFiles; +} diff --git a/guests/actualbudget.nix b/guests/actualbudget.nix index c4f5aac..037eee6 100644 --- a/guests/actualbudget.nix +++ b/guests/actualbudget.nix @@ -10,7 +10,7 @@ let in { imports = [ - (dotfiles.guest { + (dotfiles.mkGuest { name = "actualbudget"; interior = { modules.services.actualbudget = { diff --git a/guests/copyparty.nix b/guests/copyparty.nix index 161cdc8..03523cc 100644 --- a/guests/copyparty.nix +++ b/guests/copyparty.nix @@ -35,7 +35,7 @@ let in { imports = [ - (dotfiles.guest { + (dotfiles.mkGuest { name = "copyparty"; interior = { modules.services.copyparty = { diff --git a/guests/nesting-sample.nix b/guests/nesting-sample.nix index 12a1e27..302bd0d 100644 --- a/guests/nesting-sample.nix +++ b/guests/nesting-sample.nix @@ -1,7 +1,7 @@ args@{ dotfiles, ... }: # A sample guest whose interior runs an OCI container on Podman. # The image is pulled at runtime, so the guest builds with no build-time fetch. -dotfiles.guest { +dotfiles.mkGuest { name = "nesting-sample"; interior = { virtualisation.oci-containers.containers.hello = { diff --git a/guests/reverse-proxy.nix b/guests/reverse-proxy.nix index 090081a..98200b1 100644 --- a/guests/reverse-proxy.nix +++ b/guests/reverse-proxy.nix @@ -9,7 +9,7 @@ let in { imports = [ - (dotfiles.guest { + (dotfiles.mkGuest { name = "reverse-proxy"; interior = { modules.services.reverse-proxy.enable = true; diff --git a/guests/sample.nix b/guests/sample.nix index 1e0fab9..a4a761d 100644 --- a/guests/sample.nix +++ b/guests/sample.nix @@ -2,4 +2,4 @@ args@{ dotfiles, ... }: # The tracer-bullet guest: the thinnest complete path from discovery to a # running nested container. Its interior is just the guest-base — the baseline # toolset and SSH access — so it proves the concept without carrying a service. -dotfiles.guest { name = "sample"; } args +dotfiles.mkGuest { name = "sample"; } args diff --git a/lib/default.nix b/lib/default.nix new file mode 100644 index 0000000..9c5aebb --- /dev/null +++ b/lib/default.nix @@ -0,0 +1,7 @@ +{ lib }: +let + network = import ./network.nix { inherit lib; }; +in +{ + inherit (network) bridgeName deriveMac; +} diff --git a/lib/network.nix b/lib/network.nix new file mode 100644 index 0000000..f8524f1 --- /dev/null +++ b/lib/network.nix @@ -0,0 +1,12 @@ +{ lib }: +{ + bridgeName = id: "br-vlan${toString id}"; + + deriveMac = + name: + let + hash = builtins.hashString "sha256" name; + octet = i: builtins.substring (i * 2) 2 hash; + in + lib.concatStringsSep ":" ([ "02" ] ++ map octet [ 0 1 2 3 4 ]); +}