Infra/flake.nix at master · DaRacci/Infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
{
  description = "My Infrastructure for Home and Cloud Services";

  nixConfig = {
    extra-substituters = [
      "https://nix-community.cachix.org"
      "https://cache.racci.dev/global"
    ];
    extra-trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      "global:OKNSxDYKp8Q8Tr5/5Bc7CYVSfvdFQV0dMhpG0fOAG0k="
    ];
  };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable-small";
    flake-parts.url = "github:hercules-ci/flake-parts";
    devenv.url = "github:cachix/devenv";
    treefmt-nix.url = "github:numtide/treefmt-nix";
    flake-root.url = "github:srid/flake-root";
  };

  outputs =
    inputs@{ flake-parts, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      imports = [
        inputs.devenv.flakeModule
        inputs.treefmt-nix.flakeModule
        inputs.flake-root.flakeModule
      ];

      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];

      perSystem =
        {
          config,
          system,
          pkgs,
          lib,
          ...
        }:
        {
          _module.args.pkgs = import inputs.nixpkgs {
            inherit system;
            config = {
              allowUnfreePredicate = pkg: pkg.pname == "terraform";
            };
          };

          devenv.shells.default = {
            # Fixes https://github.com/cachix/devenv/issues/528
            containers = lib.mkForce { };

            packages = with pkgs; [
              cocogitto
              git
              age
              sops
              ssh-to-age
              openssh
              terragrunt
            ];

            languages = {
              nix.enable = true;
              terraform = {
                enable = true;
                package = pkgs.terraform.withPlugins (
                  p: with p; [
                    tailscale_tailscale
                    cloudflare_cloudflare
                    carlpett_sops
                    bpg_proxmox
                    digitalocean_digitalocean
                    hashicorp_external
                  ]
                );
              };
            };

            git-hooks.hooks = {
              deadnix.enable = true;
              statix.enable = true;
              ripsecrets.enable = true;
              typos = {
                enable = true;
                settings.ignored-words = [
                  "blong"
                ];
              };
              treefmt = {
                enable = true;
                package = config.treefmt.build.wrapper;
              };
            };

            enterShell = ''
              terraform -chdir=terraform init -backend=false -upgrade > /dev/null 2>&1
            '';
          };

          treefmt.config = {
            inherit (config.flake-root) projectRootFile;

            programs = {
              terraform = {
                enable = true;
                inherit (config.devenv.shells.default.languages.terraform) package;
              };
              statix.enable = true;
              prettier.enable = true;
              shellcheck.enable = true;
            };

            settings.global.excludes = [
              ".envrc"
              "terraform/secrets.yaml"
              "terraform/host-keys.yaml"
              "terraform/.terraform.lock.hcl"
            ];
          };
        };
    };
}