flake.nix

{
  description = "NixOS configuration for the Open Computing Facility";

  inputs = {
    nixpkgs = {
      type = "github";
      owner = "nixos";
      repo = "nixpkgs";
      ref = "nixos-26.05";
    };

    nixpkgs-deprecated = {
      type = "github";
      owner = "nixos";
      repo = "nixpkgs";
      ref = "nixos-25.11";
    };

    nixpkgs-unstable = {
      type = "github";
      owner = "nixos";
      repo = "nixpkgs";
      ref = "nixos-unstable";
    };

    systems = {
      type = "github";
      owner = "nix-systems";
      repo = "default";
      ref = "main";
    };

    colmena = {
      type = "github";
      owner = "zhaofengli";
      repo = "colmena";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    agenix = {
      type = "github";
      owner = "ryantm";
      repo = "agenix";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    agenix-rekey = {
      type = "github";
      owner = "oddlama";
      repo = "agenix-rekey";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    disko = {
      type = "github";
      owner = "nix-community";
      repo = "disko";
      ref = "latest";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nix-index-database = {
      type = "github";
      owner = "nix-community";
      repo = "nix-index-database";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    ocflib = {
      type = "github";
      owner = "ocf";
      repo = "ocflib";
      ref = "master";
    };

    ocf-dns = {
      url = "github:ocf/dns";
      flake = false;
    };

    ocf-sync-etc = {
      type = "github";
      owner = "ocf";
      repo = "etc";
      ref = "master";
    };

    ocf-pam-trimspaces = {
      type = "github";
      owner = "ocf";
      repo = "pam_trimspaces";
      ref = "master";
    };

    ocf-utils = {
      type = "github";
      owner = "ocf";
      repo = "utils";
      ref = "master";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.ocflib.follows = "ocflib";
    };

    wayout = {
      type = "github";
      owner = "ocf";
      repo = "wayout";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    ocf-cosmic-applets = {
      type = "github";
      owner = "ocf";
      repo = "cosmic-applets";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    ocf-jukebox = {
      url = "github:ocf/jukebox-django";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    niks3 = {
      type = "github";
      owner = "Mic92";
      repo = "niks3";
      ref = "main";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      nixpkgs-deprecated,
      nixpkgs-unstable,
      systems,
      colmena,
      agenix,
      agenix-rekey,
      disko,
      nix-index-database,
      ocflib,
      ocf-dns,
      ocf-sync-etc,
      ocf-pam-trimspaces,
      ocf-utils,
      wayout,
      ocf-cosmic-applets,
      ocf-jukebox,
      niks3,
    }@inputs:
    let
      # ============== #
      # Things to edit #
      # ============== #

      overlays = [
        self.overlays.default
        ocflib.overlays.default
        ocf-sync-etc.overlays.default
        ocf-pam-trimspaces.overlays.default
        nix-index-database.overlays.nix-index
        agenix-rekey.overlays.default
      ];

      customModules = (
        with nixpkgs.lib; filter (hasSuffix ".nix") (filesystem.listFilesRecursive ./modules)
      );

      commonModules = customModules ++ [
        ./profiles/base.nix
        agenix.nixosModules.default
        agenix-rekey.nixosModules.default
        disko.nixosModules.disko
        niks3.nixosModules.default
        niks3.nixosModules.niks3-auto-upload
        wayout.nixosModules.default
      ];

      hostDefaults = {
        inherit nixpkgs;
        system = "x86_64-linux";
        config = {
          allowUnfreePredicate =
            pkg:
            builtins.elem (nixpkgs.lib.getName pkg) [
              "code"
              "claude-code"
              "dwarf-fortress"
              "google-chrome"
              "helvetica-neue-lt-std" # tornado
              "nvidia-settings"
              "nvidia-x11"
              "nvidia-kernel-modules"
              "steam"
              "steam-unwrapped"
              "vscode"
              "zoom"
              "drawio"
              "datagrip"
              "davinci-resolve"
              "1password"
              "1password-cli"
            ];
        };
      };

      # override the hostDefaults attribute set per host
      #
      # NOTE: all hosts will be sharing the same ocf nix modules in this
      # repository regardless of what pkgs or system is set to
      hostOverrides = {
        overheat.system = "aarch64-linux";
      };

      # ============== #
      # Glue/Internals #
      # ============== #

      # returns the nixpkgs pkgs set for a given:
      # - nixpkgs input
      # - system architecture like "x86_64-linux"
      pkgsFor =
        {
          nixpkgs,
          system,
          config,
          ...
        }@args:
        import args.nixpkgs {
          inherit overlays;
          inherit (args) system config;
        };

      specialArgsFor =
        hostAttrs:
        let
          pkgsFromInput = nixpkgs': pkgsFor (hostAttrs // { nixpkgs = nixpkgs'; });
        in
        {
          inherit self inputs;

          # even if stable is the default, an overridden host may still want to
          # access pkgs-stable as a specialArg
          pkgs-stable = pkgsFromInput nixpkgs;

          # pkgs-unstable exposes the packages from the nixpkgs-unstable input
          # this should only be used as a *temporary* measure when the version of
          # a package in nixpkgs stable is not sufficiently updated
          pkgs-unstable = pkgsFromInput nixpkgs-unstable;
          pkgs-deprecated = pkgsFromInput nixpkgs-deprecated;
        };

      mapHostOverrides =
        f: builtins.mapAttrs (name: overrides: f (hostDefaults // overrides)) hostOverrides;

      forAllSystems =
        fn:
        nixpkgs.lib.genAttrs (import systems) (system: fn (pkgsFor (hostDefaults // { inherit system; })));

      readGroup =
        group:
        nixpkgs.lib.mapAttrs' (host: _: {
          # host config can be in the form of hostname.nix or
          # hostname/default.nix
          name = nixpkgs.lib.removeSuffix ".nix" host;
          value = group;
        }) (builtins.readDir ./hosts/${group});

      hosts = nixpkgs.lib.concatMapAttrs (group: _: readGroup group) (builtins.readDir ./hosts);

      deploy-user = "ocf-nix-deploy-user";
      colmenaHosts = builtins.mapAttrs (
        host: group:
        let
          profile = builtins.filter builtins.pathExists [ ./profiles/${group}.nix ];
          hostConfig = ./hosts/${group}/${host}.nix;
        in
        { config, ... }: {
          imports = nixpkgs.lib.flatten [
            commonModules
            profile
            hostConfig
          ];

          deployment.tags = [ group ];
          deployment.targetHost = "${host}.ocf.berkeley.edu";
          # TODO: Think of a less ugly way of doing this
          deployment.targetUser =
            nixpkgs.lib.mkIf self.colmenaHive.nodes.${host}.config.ocf.managed-deployment.enable
              deploy-user;

          system.nixos.variant_id = "ocf-${group}";
          system.nixos.variantName = config.system.nixos.variant_id;

          networking.hostName = "${host}";
          networking.hostId = builtins.substring 0 8 (builtins.hashString "sha1" "${host}");
        }
      ) hosts;
    in
    {
      formatter = forAllSystems (pkgs: pkgs.nixfmt-tree);

      colmenaHive = colmena.lib.makeHive (
        colmenaHosts
        // {
          meta = {
            nixpkgs = pkgsFor hostDefaults;
            nodeNixpkgs = mapHostOverrides pkgsFor;
            specialArgs = specialArgsFor hostDefaults;
            nodeSpecialArgs = mapHostOverrides specialArgsFor;
          };
        }
      );

      autoDeploy =
        let
          # returns the value of a managed-deployment option (given as a string containing the option name) for the given node
          getOptionForNode =
            option: node: self.colmenaHive.nodes.${node}.config.ocf.managed-deployment.${option};

          # returns a list of the MAC addresses for the given list of nodes with automated deploy enabled
          # hosts that do not have mac-address set will be gracefully ignored
          getMACs =
            nodes:
            builtins.filter (mac: mac != "") (builtins.map (node: getOptionForNode "mac-address" node) nodes);
        in
        {
          # list of nodes with automated deploy enabled, to be consumed by github actions
          nodes = builtins.filter (node: getOptionForNode "automated-deploy" node) (
            builtins.attrNames self.colmenaHive.nodes
          );

          # list of mac addresses of nodes that github actions should wake up on deploy
          MACs = getMACs self.autoDeploy.nodes;

          # attribute set combining automatedDeployNodes and automatedDeployNodeMACs
          # get json with `nix eval .#autoDeploy.nodesWithMACs --json`!
          # TODO: script to wake up hosts with this
          nodesWithMACs = nixpkgs.lib.listToAttrs (
            nixpkgs.lib.zipListsWith (name: value: {
              inherit name value;
            }) self.autoDeploy.nodes self.autoDeploy.MACs
          );
        };

      overlays.default = final: prev: {
        ocf-utils = ocf-utils.packages.${final.stdenv.hostPlatform.system}.default;
        ocf-jukebox = ocf-jukebox.packages.${final.stdenv.hostPlatform.system}.default;
        plasma-applet-commandoutput = final.callPackage ./pkgs/plasma-applet-commandoutput.nix { };
        catppuccin-sddm = final.qt6Packages.callPackage ./pkgs/catppuccin-sddm.nix { };
        ocf-cosmic-applets = ocf-cosmic-applets.packages.${final.stdenv.hostPlatform.system}.default;
        ocf-cosmic-greeter = final.callPackage ./pkgs/ocf-cosmic-greeter.nix { };
        ocf-hplip = final.callPackage ./pkgs/ocf-hplip.nix { };
        ocf-niks3-push = final.callPackage ./pkgs/ocf-niks3-push {
          niks3 = niks3.packages.${final.stdenv.hostPlatform.system}.default;
        };

        # nixpkgs quota is built without RPC support, it can't query
        # NFS quotas from the filehost via rquotad.
        # This wasn't necessary for old puppet hosts because debian packages quota with rpc enabled.
        quota = prev.quota.overrideAttrs (old: {
          buildInputs = (old.buildInputs or [ ]) ++ [ final.libtirpc ];
          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ final.rpcsvc-proto ];
          configureFlags = (old.configureFlags or [ ]) ++ [ "--enable-rpc" ];
        });

        # https://github.com/matrix-org/matrix-appservice-irc/issues/1861
        matrix-appservice-irc = prev.matrix-appservice-irc.override {
          nodejs-slim = final.nodejs-slim_22;
        };
      };

      agenix-rekey = agenix-rekey.configure {
        userFlake = self;
        nixosConfigurations = self.colmenaHive.nodes;
      };

      devShells = forAllSystems (
        pkgs:
        let
          # explicitly use pkgs so it doesnt collide with flake inputs
          deployPkgs = [
            colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
            pkgs.git
            pkgs.openssh_gssapi
            pkgs.wol
            pkgs.nixfmt-tree
            pkgs.nix-fast-build
          ];
        in
        {
          # for development/debugging
          default = pkgs.mkShell {
            packages =
              # explicitly use pkgs so it doesnt collide with flake inputs
              [
                disko.packages.${pkgs.stdenv.hostPlatform.system}.disko
                pkgs.age
                pkgs.agenix-rekey
                pkgs.age-plugin-fido2-hmac
                pkgs.nix-du
                pkgs.nix-tree
                pkgs.nix-eval-jobs
                pkgs.nix-output-monitor
              ]
              ++ deployPkgs;
          };

          # for ci/cd
          deploy = pkgs.mkShell {
            packages = deployPkgs;
          };
        }
      );

      nixosConfigurations = self.colmenaHive.nodes;
    };
}