stura-infra/flake.nix

{

  description = "StuRa HTWD NixOS Configurations";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
    authentik = {
      url = "github:nix-community/authentik-nix";
    };
    mailserver = {
      url = "git+https://gitlab.com/simple-nixos-mailserver/nixos-mailserver?ref=nixos-25.11";
    };
    sops = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      authentik,
      mailserver,
      disko,
      sops,
    }:
    let
      sshkeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINABEf0jBjtDdezDDtvl1v27l0DbHP2XUgMARTZXC+MR goeranh@node5"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDmYHNdtPmQqvNINEWJgqEojrye+wQKr0S0VwlGv7xUa goeranh@node7"
      ];
    in
    rec {
      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
      packages.x86_64-linux =
        builtins.foldl'
          (
            result: name:
            result
            // {
              # run nixos-rebuild switch on the target system
              # the config will be built locally and copied over
              "${name}-update" = nixpkgs.legacyPackages.x86_64-linux.writeShellScriptBin "update" ''
                nixos-rebuild switch --flake .#${name} --target-host root@${name}.test.htw.stura-dresden.de
              '';

              # copy install image to testserver and deploy the specified configuration to it
              "${name}-deploy-test" = nixpkgs.legacyPackages.x86_64-linux.writeShellScriptBin "deploy" ''
                FILENAME="$(ls ${self.packages.x86_64-linux."installer-iso".outPath}/iso)"
                scp ${
                  self.packages.x86_64-linux."installer-iso".outPath
                }/iso/$FILENAME root@10.1.0.17:/var/lib/vz/template/iso/$FILENAME
                ssh 10.1.0.17 "qm create $1 --name ${
                  nixosConfigurations.${name}.config.networking.fqdn
                } --cores 4 --memory 4096 --sata1 file=/var/lib/vz/template/iso/$FILENAME,media=cdrom --scsi1 pool1:32 --scsihw virtio-scsi-single --net0 virtio,bridge=vmbr1 --description \"von goeranh mailserver flake genierierte wegwerf-vm <br> ${
                  nixosConfigurations.${name}.config.networking.fqdn
                }\""
                ssh 10.1.0.17 "qm start $1"

                # hardcoded deployment ip
                # wait until a connection to port 22 on the deployment ip is reachable
                until nc -vzw 2 141.56.51.98 22 2>/dev/null; do echo trying; sleep 2; done

                # run nixos-anywhere on the deployment address with the specified configuration
                nix run github:nix-community/nixos-anywhere -- --flake .#${name} --target-host root@141.56.51.98
              '';

            }
          )
          { }
          (
            # filter all nixos configs containing installer
            builtins.filter (item: !nixpkgs.lib.hasInfix "-" item) (builtins.attrNames nixosConfigurations)
          )
        // (
          let
            iso-config = nixpkgs.lib.nixosSystem {
              system = "x86_64-linux";
              modules = [
                "${nixpkgs}/nixos/modules/installer/cd-dvd/iso-image.nix"
                {
                  users.users.administration = {
                    password = "test";
                    isNormalUser = true;
                  };
                  users.users.root.openssh.authorizedKeys.keys = sshkeys;
                  networking.interfaces.ens18.ipv4.addresses = [
                    {
                      address = "141.56.51.98";
                      prefixLength = 24;
                    }
                  ];
                  services.getty.autologinUser = "root";
                  services.openssh.enable = true;
                  system.stateVersion = "25.11";
                  networking.dhcpcd.enable = nixpkgs.lib.mkForce false;
                  networking.defaultGateway.address = "141.56.51.254";
                  networking.nameservers = [ "9.9.9.9" ];
                }
              ];
            };
          in
          {
            installer-iso = iso-config.config.system.build.isoImage;
            installer-vm = iso-config.config.system.build.vm;
          }
        );

      nixosConfigurations = builtins.foldl' (
        result: input:
        result
        // {
          "${input}" = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules =
              let
                modulesPath = "${nixpkgs}";
              in
              [
                ./hosts/${input}
                ./default.nix
                disko.nixosModules.disko
                authentik.nixosModules.default
                mailserver.nixosModules.mailserver
                {
                  _module.args = { inherit modulesPath; };
                }
              ];
          };
        }
      ) { } (builtins.attrNames (builtins.readDir ./hosts));
    };

}