nixos-servers/flake.nix

{
  description = "NixOS definitions for our physical servers";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    deploy-rs.url = "github:serokell/deploy-rs";
    kubenix = {
      url = "github:hall/kubenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    dns = {
      url = "github:kirelagin/dns.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    microvm = {
      url = "github:astro/microvm.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    { self, nixpkgs, deploy-rs, disko, agenix, kubenix, nixpkgs-unstable, dns, microvm, ... }:
    let
      system = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${system};
      lib = pkgs.lib;
      pkgs-unstable = nixpkgs-unstable.legacyPackages.${system};
      machines = import ./nixos/machines;
      physicalMachines = lib.filterAttrs (n: v: v.type == "physical") machines;
      mkNixosSystems = systemDef:
        builtins.mapAttrs
          (name: machine:
            nixpkgs.lib.nixosSystem (systemDef name machine)
          )
          physicalMachines;
      mkDeployNodes = nodeDef:
        builtins.mapAttrs
          (name: machine: nodeDef name machine)
          physicalMachines;
    in
    {
      devShells.${system}.default = pkgs.mkShell {
        packages = with pkgs; [
          libsecret
          # TODO: using nixos-anywhere from nixos-unstable produces buffer overflow.
          # Related to this issue: https://github.com/nix-community/nixos-anywhere/issues/242
          # Should wait until this is merged in nixos-unstable.
          # pkgs-unstable.nixos-anywhere
          pkgs-unstable.deploy-rs
          openssl
          postgresql_15
          opentofu
          cdrtools
          kubectl
          ansible
        ];
      };

      formatter.${system} = pkgs.nixfmt;

      nixosConfigurations = mkNixosSystems (name: machine: {
        inherit system;
        specialArgs = { inherit machines machine kubenix dns microvm disko agenix; };
        modules = [
          ./nixos
          { networking.hostName = name; }
        ];
      });

      deploy = {
        sshUser = "root";
        user = "root";

        nodes = mkDeployNodes (name: machine: {
          hostname = self.nixosConfigurations.${name}.config.networking.fqdn;
          profiles.system = {
            path = deploy-rs.lib.${system}.activate.nixos
              self.nixosConfigurations.${name};
          };
        });
      };

      checks = builtins.mapAttrs
        (system: deployLib: deployLib.deployChecks self.deploy)
        deploy-rs.lib;
    };
}