flake.nix

# This was generated by home-manager running with a flake installation.
{
  description = "Nix configuration of logan";

  # See https://nixos-and-flakes.thiscute.world/other-usage-of-flakes/inputs for
  # various URL notations.
  inputs = {
    agenix = {
      # Fork with installSecretFn fix (upstream ryantm/agenix PR #228, rebased).
      # Replaces per-secret IDENTITIES inlining with a single shell function,
      # keeping the activation script under MAX_ARG_STRLEN.  The compact
      # activation module in nixos-modules/agenix-compact-activation.nix is
      # still present (commented out in nixos-configs/secrets.nix) as a
      # fallback should this fork diverge or be dropped.
      url = "github:LoganBarnett/agenix?ref=installSecretFn";
      # url = "github:ryantm/agenix";
      inputs.darwin.follows = "nix-darwin";
      inputs.home-manager.follows = "home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    emacs-config = {
      url = "github:LoganBarnett/emacs-config";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.hyuqueue.follows = "hyuqueue";
    };
    # https://github.com/oddlama/agenix-rekey
    # Allows re-keying and bootstrapping of secrets used by agenix.
    agenix-rekey = {
      url = "github:LoganBarnett/agenix-rekey?ref=rust-runtime";
      # There is a documented gotcha in the readme if this must change.  Review
      # agenix-rekey's README for details.
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Attic is a Nix cache server.
    attic = {
      url = "github:zhaofengli/attic";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    authentik-nix = {
      url = "github:nix-community/authentik-nix";
    };
    dns-smart-block = {
      url = "github:LoganBarnett/dns-smart-block";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Give us a tool for getting the current system.  See
    # https://discourse.nixos.org/t/getting-the-current-system-from-the-command-line/19781/10
    # for discussion on the matter.
    current-system = {
      url = "github:nix-systems/current-system";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # github-to-jenkins-webhook = {
    #   # TODO: Always keep one path example around.  Don't use file:// unless
    #   # you're pointing at a tarball (which should happen just about never).
    #   url = "path:/Users/logan/dev/github-to-jenkins-webhook";
    #   inputs.nixpkgs.follows = "nixpkgs";
    # };

    flake-sync-status = {
      url = "github:LoganBarnett/flake-sync-status";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Allow Flatpak usage, specifically so we can install Roblox via Sober.
    flatpaks.url = "github:in-a-dil-emma/declarative-flatpak/latest";
    garage-queue = {
      url = "github:LoganBarnett/garage-queue";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    hash-color = {
      url = "github:LoganBarnett/hash-color?ref=main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    loku = {
      url = "github:LoganBarnett/loku";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    mac-app-util = {
      url = "github:hraban/mac-app-util";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    metalps = {
      url = "github:LoganBarnett/metalps";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nextcloud-desktop = {
      # What's on master doesn't build with the current settings.  It looks like
      # they've moved onto qt6 but Nix has many components that don't work on
      # qt6 on darwin.  So pin it to the last known working state.
      url = "github:nextcloud/desktop?dir=admin/nix&rev=19a2f8cc7da52f62b6e7f4ca3b68ba7056b46f4e";
      # inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-darwin = {
      url = "github:LnL7/nix-darwin/nix-darwin-25.11";
      # rev = "72dd60bfc98c128149d84213b17d1b8a68863055";
      # Leaving this present breaks things and nix-darwin will not load or
      # otherwise will not be present.  It is not understood why, even though
      # documentation typically recommends this step.
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Allow surgical edits to static/literal Nix files.  Great for doing things
    # like bumping a version and hash automatically.
    # Pinned to b5017f8d (last known-good revision).  The upstream
    # cargoLock.lockFile derivation produces a dangling Cargo.lock symlink
    # under Nix >= 2.33; workstation.nix rebuilds from source with cargoHash.
    nix-editor = {
      url = "github:snowfallorg/nix-editor/b5017f8d61753ce6a3a1a2aa7e474d59146a8ae3";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-hapi = {
      url = "github:LoganBarnett/nix-hapi";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-hapi-provider-aruba-cx = {
      url = "github:LoganBarnett/nix-hapi-provider-aruba-cx";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-hapi-provider-ldap = {
      url = "github:LoganBarnett/nix-hapi-provider-ldap";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-hapi-provider-porkbun = {
      url = "github:LoganBarnett/nix-hapi-provider-porkbun";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
    nix-option-search = {
      url = "github:ciderale/nix-option-search";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-remote-builder-doctor = {
      url = "github:LoganBarnett/nix-remote-builder-doctor";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nur = {
      url = "github:nix-community/NUR";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    optnix = {
      url = "github:water-sucks/optnix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixos-generators = {
      # url = "github:LoganBarnett/nixos-generators?ref=add-sd-image-raspberrypi";
      url = "github:nix-community/nixos-generators/master";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixos-anywhere = {
      url = "github:numtide/nixos-anywhere";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        disko.follows = "disko";
      };
    };
    nixos-hardware = {
      url = "github:NixOS/nixos-hardware/master";
      # nixos-hardware doesn't actually use nixpkgs.
      # inputs.nixpkgs.follows = "nixpkgs";
    };
    # Give us the ability to manage the boot options via config.txt,
    # declaratively.
    nixos-raspberrypi = {
      url = "github:nvmd/nixos-raspberrypi/develop";
      inputs.nixpkgs.follows = "nixpkgs-nixos-raspberrypi";
    };
    nixpkgs-nixos-raspberrypi = {
      url = "github:nvmd/nixpkgs/modules-with-keys-25.11";
    };
    # This is forced at the moment, because we have some heavy deltas coming
    # into flake.lock and I want that to stabilize before I pin it here.
    # nixpkgs.url = "github:nixos/nixpkgs?ref=f9f59197478b3ec9c954b67ae0d1d5429de23124";
    nixpkgs.url = "github:nixos/nixpkgs/25.11";
    nixpkgs-25-11.url = "github:nixos/nixpkgs/25.11";
    nixpkgs-openscad-bin.url = "github:LoganBarnett/nixpkgs/openscad-darwin-preserve-cli";
    # The newest version of Octoprint on nixpkgs 25.11 enters some kind of
    # refresh loop on the UI, and my attempts to debug it have come up empty.
    # It doesn't print any apparent error - I believe it is misidentifying
    # authentication issues.  This issue exists even when all of the
    # authentication settings are removed.
    # nixpkgs-octoprint.url = "github:nixos/nixpkgs/24.11";
    nixos-option-pr-369151.url = "github:nixos/nixpkgs?ref=pull/369151/head";
    lix-module = {
      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.93.3-2.tar.gz";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    hyuqueue = {
      url = "github:LoganBarnett/hyuqueue";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    home-manager = {
      # Pinned to master at PR #8770 merge commit, which fixes skills
      # generating flat <name>.md files instead of <name>/SKILL.md
      # directories.  release-25.11 does not have this fix.
      # https://github.com/nix-community/home-manager/pull/8770
      url = "github:nix-community/home-manager/91be7cce763fa4022c7cf025a71b0c366d1b6e77";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    openhab-flake = {
      url = "github:LoganBarnett/openhab-flake/add-darwin-devshell-support";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    org-wiki = {
      url = "github:LoganBarnett/org-wiki";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    proc-siding = {
      url = "github:LoganBarnett/proc-siding";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    programsdb = {
      url = "github:wamserma/flake-programs-sqlite";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    repo-sync-flake = {
      url = "github:LoganBarnett/repo-sync";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    sonify-health = {
      url = "github:LoganBarnett/sonify-health";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    sytter = {
      url = "github:LoganBarnett/sytter";
      # url = "git+ssh://git@gitea.proton:2222/logan/sytter";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    typeypipe-flake = {
      url = "github:dkoontz/TypeyPipe";
      # url = "github:LoganBarnett/TypeyPipe";
      # url = "path:/Users/logan/dev/TypeyPipe";
      # inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    flake-inputs@{
      agenix-rekey,
      nix-darwin,
      nixpkgs,
      nixos-generators,
      self,
      ...
    }:
    let
      facts = import ./nixos-modules/facts.nix;
      nodes =
        self.containerGuestHosts
        // self.nixosConfigurations
        // self.darwinConfigurations;
      container-guest-host =
        args@{
          host-id,
          flake-inputs,
          system,
        }:
        nix-host args;
      # autoStart = true;
      # privateNetwork = false;
      # # This is a critical gotcha with containers in NixOS.  Set `specialArgs`
      # # to be the typical flake-input-to-module stuff that you would set on a
      # # normal host (e.g. `nixosSystem`).  Without this, you blunder into
      # # unhelpful infinite recursion issues.  See
      # # https://discourse.nixos.org/t/infinite-recursion-caused-by-flake-input-in-a-container-in-nixops/39590/4
      # # for a detailed explanation.
      # specialArgs = {
      #   inherit facts flake-inputs host-id nodes system;
      #   host-id = "grafana";
      # };
      # config = import ./hosts/${host-id}.nix;
      # };

      nix-host =
        args@{
          host-id,
          flake-inputs,
          system,
        }:
        flake-inputs.nixpkgs.lib.nixosSystem {
          specialArgs = {
            inherit
              facts
              flake-inputs
              host-id
              nodes
              system
              ;
            disko-proper = flake-inputs.disko;
            lib-custom = import ./lib.nix;
          }
          # nixos-raspberrypi modules now expect the flake ref via specialArgs
          # (since cdda49f).  Pass it through when available so RPi hosts work.
          // flake-inputs.nixpkgs.lib.optionalAttrs (flake-inputs ? nixos-raspberrypi) {
            inherit (flake-inputs) nixos-raspberrypi;
          };
          modules = [
            flake-inputs.home-manager.nixosModules.home-manager
            flake-inputs.nix-option-search.nixosModules.default
            flake-inputs.nix-remote-builder-doctor.nixosModules.default
            ./hosts/${host-id}.nix
            # This is the only way to pull in this dependency.  In the flake it
            # resides in, this is already imported, so importing it again via
            # `imports` just makes Nix barf with an infinite recursion error.
            # openhab-flake.nixosModules.${system}.openhab
            {
              home-manager.extraSpecialArgs = {
                inherit facts flake-inputs host-id;
              };
            }
            {
              nixpkgs.overlays = [
                flake-inputs.nix-remote-builder-doctor.overlays.default
              ];
            }
          ];
        };

      darwin-host =
        args@{
          host-id,
          flake-inputs,
          system,
        }:
        nix-darwin.lib.darwinSystem {
          specialArgs = {
            inherit
              facts
              flake-inputs
              host-id
              nodes
              system
              ;
            lib-custom = import ./lib.nix;
            disko-proper = flake-inputs.disko;
          };
          modules = [
            flake-inputs.home-manager.darwinModules.home-manager
            # flake-inputs.nix-option-search.darwinModules.default
            flake-inputs.nix-remote-builder-doctor.darwinModules.default
            {
              nixpkgs.overlays = [
                (final: prev: {
                  nixos-option =
                    flake-inputs.nixos-option-pr-369151.outputs.legacyPackages.${system}.nixos-option;
                })
                flake-inputs.nix-remote-builder-doctor.overlays.default
              ];
            }
            {
              home-manager.extraSpecialArgs = {
                inherit
                  facts
                  flake-inputs
                  host-id
                  system
                  ;
              };
            }
            ./hosts/${host-id}.nix
          ];
        };

      lib = nixpkgs.lib;
      forAllSystems = lib.genAttrs lib.systems.flakeExposed;
      host-config = name: hostFacts: {
        flake-inputs =
          flake-inputs
          // (lib.attrsets.mapAttrs (name: input-name: flake-inputs."${input-name}") (
            hostFacts.flake-input-overrides or { }
          ));
        host-id = name;
        system = hostFacts.system;
      };
      # Only give us converted hosts for given OS (platform?).  This way we can
      # pick which hosts go to which `*Configurations` attribute
      # (e.g. nixosConfigurations vs darwinConfigurations).
      host-configs-for-os =
        f: os: hostsFacts:
        lib.pipe hostsFacts [
          (lib.attrsets.filterAttrs (
            name: hostFacts:
            # Perhaps dangerous - we need a better way of parsing these things since
            # they are known to be inconsistent, and sometimes we're dealing with a
            # double while other times it might be a triple.
            hostFacts ? system
            && (builtins.elemAt (lib.strings.splitString "-" hostFacts.system) 1) == os
          ))
          (lib.attrsets.mapAttrs host-config)
          (lib.attrsets.mapAttrs (n: f))
        ];
    in
    {
      devShells = forAllSystems (
        system:
        let
          pkgs = import nixpkgs { inherit system; };
          fmt-staged = pkgs.callPackage ./derivations/fmt-staged.nix { };
          nix-direnv-add-envrc =
            pkgs.callPackage ./derivations/nix-direnv-add-envrc.nix
              { };
          nix-host-key-install =
            pkgs.callPackage ./derivations/nix-host-key-install.nix
              { };
          gnused-wrapper = pkgs.callPackage ./derivations/gnused-wrapper.nix { };
          proton-deploy = pkgs.callPackage ./derivations/proton-deploy.nix { };
          sonification-test =
            pkgs.callPackage ./derivations/sonification-test/default.nix
              { };
          work-alias = lib.concatStrings [
            "n"
            "w"
            "e"
            "a"
          ];
        in
        {
          default = pkgs.mkShell {
            packages = [
              fmt-staged
              nix-direnv-add-envrc
              nix-host-key-install
              # On Darwin the stdenv injects raw gnused into PATH, which
              # bypasses our system-wide wrapper.  Including it here ensures the
              # wrapper wins because mkShell prepends packages before stdenv
              # tools.
              gnused-wrapper
              proton-deploy
              sonification-test
              pkgs.just
              pkgs.nixfmt-rfc-style
              pkgs.treefmt
            ];
            shellHook = ''
              export FLAKE_ROOT="$PWD"
              export WITH_VPN_CHECK_HOST="stash.americas.${work-alias}colo.pvt"
              export WITH_VPN_CHECK_IP="10.210.16.252"
              mkdir --parents .git/hooks
              ln --symbolic --force \
                ${fmt-staged}/bin/fmt-staged .git/hooks/pre-commit
            '';
          };
        }
      );
      darwinConfigurations =
        host-configs-for-os darwin-host "darwin"
          facts.network.hosts;
      nixosConfigurations = host-configs-for-os nix-host "linux" facts.network.hosts;
      containerGuestHosts = { };
      packages.aarch64-darwin.nucleus =
        self.nixosConfigurations.nucleus.config.system.build.isoImage;

      # Kept for reference in case we start using nixos-generators again.
      # packages.aarch64-darwin.nucleus-ng = let
      #   system = "x86_64-linux";
      #   host-id = "nucleus";
      # in nixos-generators.nixosGenerate {
      #   inherit system;
      #   format = "install-iso";
      #   specialArgs = {
      #     inherit facts flake-inputs host-id nodes system;
      #     disko-proper = flake-inputs.disko;
      #   };
      #   modules = [
      #     ./hosts/nucleus.nix
      #   ];
      # };

      # Just expose Disko in some ways - used by ../bin/remote-deploy.
      packages.x86_64-linux.disko =
        flake-inputs.disko.packages.x86_64-linux.disko
          or flake-inputs.disko.packages.x86_64-linux.default;
      packages.aarch64-linux.disko =
        flake-inputs.disko.packages.aarch64-linux.disko
          or flake-inputs.disko.packages.aarch64-linux.default;

      agenix-rekey = agenix-rekey.configure {
        userFlake = self;
        # nodes = self.nixosConfigurations
        #         // self.darwinConfigurations;
        nixosConfigurations =
          self.nixosConfigurations
          // self.darwinConfigurations
          // self.containerGuestHosts;
      };

    };

}