alexion
f1d6df7d51
Add a NixOS VM integration test to the flake's checks, so nix flake check boots the network foundation and one guest on a virtual L2 segment and asserts the three behaviors a VM can honestly reproduce: the guest presents its own MAC distinct from the host's, gets its own IP on a tagged VLAN across the segment, and writes to a bind mount owned by the shared storage group. A tagged router node serving DHCP only on VLAN 10 makes the address and reverse ping prove 802.1Q tagging end to end, not plain reachability. Booting a networked guest surfaced a latent defect: the guest's own networkd default-enables systemd-resolved, which conflicts with the nested-container default of inheriting the host's resolv.conf, failing the guest toplevel build. Fix it in the guest networking realization so a networked guest keeps its own resolver.
95 lines
2.9 KiB
Nix
95 lines
2.9 KiB
Nix
{
|
|
description = "Alexion's NixOS configuration — one flake for every host";
|
|
|
|
inputs = {
|
|
# Base channel.
|
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
|
|
|
# Fresher packages, reachable per-package as `unstable.<name>`.
|
|
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
|
|
|
# Latest stable release, reachable per-package as `stable.<name>`.
|
|
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
|
|
|
|
home-manager = {
|
|
url = "github:nix-community/home-manager";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Follows our nixpkgs so its plugins build against the same package set.
|
|
nixvim = {
|
|
url = "github:nix-community/nixvim";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Declarative disk partitioning.
|
|
# Each host declares its own layout.
|
|
disko = {
|
|
url = "github:nix-community/disko";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Upstream per-machine hardware profiles.
|
|
# Each host imports its own.
|
|
nixos-hardware = {
|
|
url = "github:NixOS/nixos-hardware";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Decrypts committed secrets at activation, from an age identity on the host.
|
|
sops-nix = {
|
|
url = "github:Mic92/sops-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Themes the graphical layer from one base16 scheme.
|
|
# Follows our nixpkgs so it themes the same package set the host builds.
|
|
stylix = {
|
|
url = "github:danth/stylix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Agent-ergonomic CLI for Gitea, with a home-manager module for the agent context.
|
|
gitea-axi = {
|
|
url = "git+https://git.alexion.dev/alexion/gitea-axi";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Personal agent skills, packaged as per-skill derivations with a home-manager module.
|
|
skills = {
|
|
url = "git+https://git.alexion.dev/alexion/skills";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# CachyOS kernel and binary cache.
|
|
# Pins its own nixpkgs so its cache stays usable and the kernel is fetched from it.
|
|
chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
|
|
};
|
|
|
|
outputs =
|
|
{ self, nixpkgs, ... }@inputs:
|
|
let
|
|
inherit (nixpkgs) lib;
|
|
my = import ./lib.nix { inherit lib inputs self; };
|
|
in
|
|
{
|
|
# Helper functions for discovering and building hosts.
|
|
lib = my;
|
|
|
|
# Every host under hosts/ is discovered and built.
|
|
nixosConfigurations = my.mkHosts (self + "/hosts");
|
|
|
|
# `nix flake check` builds each host's toplevel, and boots one guest
|
|
# end to end in a VM to exercise its externally observable behavior.
|
|
checks.x86_64-linux = lib.mapAttrs (
|
|
_name: host: host.config.system.build.toplevel
|
|
) self.nixosConfigurations
|
|
// {
|
|
guest-integration = import ./tests/guest-integration.nix {
|
|
inherit inputs self;
|
|
system = "x86_64-linux";
|
|
};
|
|
};
|
|
};
|
|
}
|