nixos-servers/flake.nix

{
  description = "NixOS definitions for our physical servers";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    deploy-rs.url = "github:serokell/deploy-rs";
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, deploy-rs, disko, agenix, nixpkgs-unstable, ... }:
    let
      system = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${system};
      pkgs-unstable = nixpkgs-unstable.legacyPackages.${system};
      machines = import ./machines;
      mkNixosSystems = systemDef:
        nixpkgs.lib.foldlAttrs (acc: name: machine:
          acc // {
            "${name}" = nixpkgs.lib.nixosSystem (systemDef machine);
          }) { } machines;
      mkDeployNodes = nodeDef:
        nixpkgs.lib.foldlAttrs
        (acc: name: machine: acc // { "${name}" = nodeDef machine; }) { }
        machines;
    in {
      devShells.${system}.default = pkgs.mkShell {
        packages = [
          pkgs.libsecret
          # TODO: using nixos-anywhere from nixos-unstable produces buffer overflow.
          # Related to this issue: https://github.com/nix-community/nixos-anywhere/issues/242
          # Should wait until this is merged in nixos-unstable.
          # pkgs-unstable.nixos-anywhere
          pkgs-unstable.deploy-rs
          pkgs.openssl
          pkgs.postgresql_15
          pkgs-unstable.opentofu
          pkgs.cdrtools
        ];
      };

      formatter.${system} = pkgs.nixfmt;

      nixosConfigurations = mkNixosSystems (machine: {
        inherit system;
        modules = [
          machine.specificConfig
          disko.nixosModules.disko
          agenix.nixosModules.default
          ./configuration.nix
          { networking.hostName = machine.name; }
        ];
      });

      deploy = {
        sshUser = "root";
        user = "root";

        nodes = mkDeployNodes (machine: {
          hostname = machine.hostname;
          profiles.hypervisor = {
            path = deploy-rs.lib.${system}.activate.nixos
              self.nixosConfigurations.${machine.name};
          };
        });
      };

      checks = builtins.mapAttrs
        (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
    };
}