flake.nix

{
  description = "nixops -- generic NixOS fleet base: inventory-driven modules, deploy tooling, ops devShell";

  nixConfig = {
    extra-substituters = [ "https://nix-community.cachix.org" ];
    extra-trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
    ];
  };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    deploy-rs = {
      url = "github:serokell/deploy-rs";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      sops-nix,
      deploy-rs,
      disko,
      ...
    }:
    let
      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];
      forEachSystem = nixpkgs.lib.genAttrs systems;
    in
    {
      nixosModules.default = {
        imports = [
          sops-nix.nixosModules.sops
          disko.nixosModules.disko
          ./modules
        ];
      };

      nixosModules.opsWorkstation = ./modules/ops-workstation.nix;

      lib = {
        mkNixosConfigs = import ./lib/mkNixosConfigs.nix { inherit nixpkgs sops-nix self; };
        mkDeploy = import ./lib/mkDeploy.nix { inherit deploy-rs; };
        mkDevShell = import ./lib/mkDevShell.nix { inherit nixpkgs deploy-rs; };
      };

      templates.default = {
        path = ./templates/default;
        description = "nixops instance -- new fleet scaffold";
      };

      formatter = forEachSystem (system: nixpkgs.legacyPackages.${system}.nixfmt);

      packages = forEachSystem (
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          newCmd = pkgs.writeShellApplication {
            name = "new";
            runtimeInputs = with pkgs; [
              gum
              age
              openssh
              git
              gawk
              gnused
              coreutils
              findutils
              direnv
              nixVersions.latest
            ];
            text = ''
              export TEMPLATE_DIR="${./templates/default}"
            ''
            + builtins.readFile ./scripts/new.sh;
          };
        in
        {
          new = newCmd;
          opsvm =
            (nixpkgs.lib.nixosSystem {
              inherit system;
              modules = [
                self.nixosModules.opsWorkstation
                ({ modulesPath, pkgs, ... }: {
                  imports = [ "${modulesPath}/virtualisation/qemu-vm.nix" ];
                  # Fallback hostname; the real one comes from the launcher's
                  # -fw_cfg name=opt/opsvm/hostname,string=<name> and gets
                  # applied by opsvm-hostname.service before getty.
                  networking.hostName = "opsvm";
                  system.stateVersion = "25.05";
                  virtualisation = {
                    memorySize = 4096;
                    cores = 4;
                    diskSize = 20000;
                    graphics = false;
                  };
                  # qemu_fw_cfg exposes /sys/firmware/qemu_fw_cfg/by_name/... so
                  # the wrapper can push the requested hostname without a mount.
                  boot.kernelModules = [ "qemu_fw_cfg" ];
                  systemd.services.opsvm-hostname = {
                    description = "Apply hostname pushed via QEMU fw_cfg";
                    wantedBy = [ "sysinit.target" ];
                    before = [
                      "network-pre.target"
                      "systemd-user-sessions.service"
                      "getty.target"
                    ];
                    after = [ "sys-firmware-qemu_fw_cfg.mount" ];
                    unitConfig.ConditionPathExists = "/sys/firmware/qemu_fw_cfg/by_name/opt/opsvm/hostname/raw";
                    serviceConfig = {
                      Type = "oneshot";
                      RemainAfterExit = true;
                    };
                    path = with pkgs; [ coreutils ];
                    script = ''
                      name=$(tr -d '[:space:]' < /sys/firmware/qemu_fw_cfg/by_name/opt/opsvm/hostname/raw)
                      if [ -n "$name" ]; then
                        echo "$name" > /proc/sys/kernel/hostname
                        echo "$name" > /etc/hostname
                      fi
                    '';
                  };
                  # 9p mounts backed by the host state dir (opsvm-launch wraps
                  # run-opsvm-vm with matching -virtfs args). nofail so a bare
                  # run-opsvm-vm invocation still boots to a login prompt.
                  # dfltuid/dfltgid map an empty mapped-xattr mount root to the
                  # ops user (uid 1000, primary group `users` gid 100), so no
                  # post-mount chown is needed.
                  #
                  # These MUST use virtualisation.fileSystems (not the plain
                  # fileSystems). qemu-vm.nix overrides `fileSystems` with
                  # `mkVMOverride cfg.fileSystems` at line 1413, so any plain
                  # `fileSystems.*` declaration here is silently dropped --
                  # the mount unit is never generated and nothing shares back
                  # to the host state dir.
                  #
                  # x-systemd.requires=modprobe@9pnet_virtio.service pulls the
                  # 9p transport module on demand; without it the mount would
                  # race against module load (same option the nix-store 9p
                  # mount uses).
                  virtualisation.fileSystems."/home/ops/.ssh" = {
                    device = "opsssh";
                    fsType = "9p";
                    options = [
                      "trans=virtio"
                      "version=9p2000.L"
                      "cache=loose"
                      "nofail"
                      "msize=104857600"
                      "dfltuid=1000"
                      "dfltgid=100"
                      "x-systemd.requires=modprobe@9pnet_virtio.service"
                    ];
                    neededForBoot = false;
                  };
                  virtualisation.fileSystems."/home/ops/.config/sops/age" = {
                    device = "opsage";
                    fsType = "9p";
                    options = [
                      "trans=virtio"
                      "version=9p2000.L"
                      "cache=loose"
                      "nofail"
                      "msize=104857600"
                      "dfltuid=1000"
                      "dfltgid=100"
                      "x-systemd.requires=modprobe@9pnet_virtio.service"
                    ];
                    neededForBoot = false;
                  };
                  virtualisation.fileSystems."/home/ops/workdir" = {
                    device = "opsworkdir";
                    fsType = "9p";
                    options = [
                      "trans=virtio"
                      "version=9p2000.L"
                      "cache=loose"
                      "nofail"
                      "msize=104857600"
                      "dfltuid=1000"
                      "dfltgid=100"
                      "x-systemd.requires=modprobe@9pnet_virtio.service"
                    ];
                    neededForBoot = false;
                  };
                  # Parent dirs of the age mount -- systemd creates the leaf
                  # mountpoint but not intermediate directories.
                  systemd.tmpfiles.rules = [
                    "d /home/ops/.config       0755 ops users -"
                    "d /home/ops/.config/sops  0755 ops users -"
                  ];
                  # `new` on PATH so the operator can scaffold when they
                  # want to; no auto-run.
                  environment.systemPackages = [ newCmd ];
                  # First-login: drop the operator into the shared workdir.
                  # Nothing else -- fleet scaffolding is up to the user
                  # (e.g. `new $(hostname)` for a name matching the VM).
                  environment.etc."profile.d/opsvm-firstlogin.sh".text = ''
                    # shellcheck shell=sh
                    if [ "$(id -un)" = "ops" ] && [ -d "$HOME/workdir" ]; then
                      cd "$HOME/workdir" || true
                    fi
                  '';
                })
              ];
            }).config.system.build.vm;
        }
      );

      apps = forEachSystem (
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          newApp = {
            type = "app";
            program = "${self.packages.${system}.new}/bin/new";
          };
          opsvmLauncher = pkgs.writeShellApplication {
            name = "opsvm-launch";
            runtimeInputs = with pkgs; [ coreutils ];
            text = ''
              export RAW_VM="${self.packages.${system}.opsvm}"
            ''
            + builtins.readFile ./scripts/opsvm-launch.sh;
          };
          opsvmApp = {
            type = "app";
            program = "${opsvmLauncher}/bin/opsvm-launch";
          };
        in
        {
          new = newApp;
          default = newApp;
          opsvm = opsvmApp;
        }
      );
    };
}