Olivier/chiasson-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rebase to flake parts #11

Browse Source
This commit is contained in:
OlivierChiasson
2026-05-25 13:48:47 -03:00
parent fba5a7a2aa
commit 6978396646
25 changed files with 567 additions and 305 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/system/caching/attic.nix
+94 -24
View File
@@ -56,6 +56,42 @@
'';
};
retries = mkOption {
type = types.int;
default = 3;
description = "Attempts per push before giving up (handles transient Attic/network stalls).";
};
background = mkOption {
type = types.bool;
default = true;
description = ''
Run `attic push` in the background so the build finishes immediately.
Failures/timeouts are logged; they do not fail the build.
'';
};
timeoutSec = mkOption {
type = types.int;
default = 600;
description = "Kill `attic push` after this many seconds (background or foreground).";
};
uploadJobs = mkOption {
type = types.int;
default = 3;
description = "Parallel upload workers (`attic push -j`). Lower if the server stalls under load.";
};
logFile = mkOption {
type = types.str;
default = "";
description = ''
Append push logs here. Empty → `$XDG_RUNTIME_DIR/nix-attic-push.log`
(or `/tmp/nix-attic-push-$UID.log`).
'';
};
excludedPatterns = mkOption {
type = types.listOf types.str;
default = [ ];
@@ -96,6 +132,7 @@
enabled = cfg.enable && cfg.cacheName != "" && endpointBase != "" && cfg.publicKey != "";
cacheUrl = "${endpointBase}/${cfg.cacheName}";
pushTokenFile = if cfg.push.tokenFile != null then cfg.push.tokenFile else cfg.tokenFile;
atticTomlServersSection = "[servers.ci]";
hmAtticCliModule =
{ lib, osConfig ? { }, ... }:
let
@@ -146,11 +183,16 @@
set -eu
set -f
export PATH="${lib.makeBinPath [
pkgs.attic-client
pkgs.nix
pkgs.gnused
pkgs.coreutils
]}:$PATH"
echo "attic: hook start drv=''${DRV_PATH:-<unknown>}" >&2
echo "attic: endpoint=${lib.escapeShellArg endpointBase} cache=${lib.escapeShellArg cfg.cacheName}" >&2
export PATH="${lib.makeBinPath [ pkgs.attic-client pkgs.nix pkgs.gnused ]}:$PATH"
${lib.optionalString (pushTokenFile != null) ''
token_path=${lib.escapeShellArg pushTokenFile}
if [ ! -r "$token_path" ]; then
echo "attic: skipping push (token not readable at $token_path)" >&2
@@ -158,31 +200,17 @@
fi
ATTIC_TOKEN="$(tr -d '\n' < "$token_path")"
''}
if [ -z "$ATTIC_TOKEN" ]; then
echo "attic: skipping push (token is empty)" >&2
exit 0
fi
ATTIC_CONFIG_HOME="$(mktemp -d /tmp/attic-hook-XXXXXX)"
export XDG_CONFIG_HOME="$ATTIC_CONFIG_HOME"
cleanup() {
rm -rf "$ATTIC_CONFIG_HOME"
}
trap cleanup EXIT
if ! attic login --set-default ci ${lib.escapeShellArg endpointBase} "$ATTIC_TOKEN" >/dev/null 2>&1; then
echo "attic: login failed (build succeeded; check token/server URL)" >&2
exit 0
fi
push_paths=""
skipped_roots=0
pushed_roots=0
seen_roots=0
for path in $OUT_PATHS; do
seen_roots=$((seen_roots + 1))
echo "attic: evaluating OUT_PATH $path" >&2
skip=0
skip_reason=""
@@ -217,17 +245,59 @@
echo "attic: summary seen=$seen_roots selected=$pushed_roots skipped=$skipped_roots" >&2
if [ -n "$push_paths" ]; then
echo "attic: pushing to ci:${cfg.cacheName}" >&2
if ! attic push ${lib.escapeShellArg "ci:${cfg.cacheName}"} $push_paths; then
echo "attic: push failed (build succeeded; check token/network)" >&2
else
echo "attic: push succeeded" >&2
fi
else
if [ -z "$push_paths" ]; then
echo "attic: nothing selected for push" >&2
exit 0
fi
runtime_dir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
attic_config_home="$runtime_dir/nix-attic-hook"
export XDG_CONFIG_HOME="$attic_config_home"
mkdir -p "$attic_config_home/attic"
{
printf '%s\n' 'default-server = "ci"'
printf '\n'
printf '%s\n' ${builtins.toJSON atticTomlServersSection}
printf 'endpoint = %s\n' ${builtins.toJSON endpointBase}
printf 'token = "%s"\n' "$ATTIC_TOKEN"
} > "$attic_config_home/attic/config.toml"
log_file=${lib.escapeShellArg cfg.push.logFile}
if [ -z "$log_file" ]; then
log_file="$runtime_dir/nix-attic-push.log"
fi
mkdir -p "$(dirname "$log_file")"
push_cmd() {
attempt=1
max_attempts=${toString cfg.push.retries}
while [ "$attempt" -le "$max_attempts" ]; do
echo "attic: push attempt $attempt/$max_attempts $(date -Is) paths:$push_paths" >&2
if timeout ${toString cfg.push.timeoutSec} \
attic push -j ${toString cfg.push.uploadJobs} \
${lib.escapeShellArg "ci:${cfg.cacheName}"} \
$push_paths; then
echo "attic: push succeeded $(date -Is)" >&2
return 0
fi
echo "attic: push failed or timed out (attempt $attempt/$max_attempts)" >&2
attempt=$((attempt + 1))
[ "$attempt" -le "$max_attempts" ] && sleep 5
done
return 1
}
${lib.optionalString cfg.push.background ''
echo "attic: scheduling background push → $log_file" >&2
(
push_cmd
) >> "$log_file" 2>&1 &
exit 0
''}
${lib.optionalString (!cfg.push.background) ''
push_cmd 2>&1 | tee -a "$log_file"
exit 0
''}
'');
environment.systemPackages = lib.mkIf cfg.userCli.enable [ pkgs.attic-client ];
modules/system/default.nix
+1
View File
@@ -6,6 +6,7 @@
self.nixosModules.systemFonts
self.nixosModules.systemNetworking
self.nixosModules.systemLocalsend
self.nixosModules.systemChromiumHevcVaapi
self.nixosModules.systemMonitorInput
self.nixosModules.systemSpotify
self.nixosModules.systemPackagesDefaults
modules/system/flatpak.nix
+2 -2
View File
@@ -75,9 +75,9 @@
# Never remote-delete flathub here — interactive and breaks unattended rebuilds.
${pkgs.flatpak}/bin/flatpak --system remote-add --if-not-exists flathub \
https://flathub.org/repo/flathub.flatpakrepo || true
https://dl.flathub.org/repo/ || true
${pkgs.flatpak}/bin/flatpak --system remote-modify flathub \
--url=https://flathub.org/repo/flathub.flatpakrepo 2>/dev/null || true
--url=https://dl.flathub.org/repo/ 2>/dev/null || true
allowed=( ${lib.concatStringsSep " " (map lib.escapeShellArg allowedAppIds)} )
modules/system/gaming.nix
+35 -1
View File
@@ -7,13 +7,13 @@
with pkgs;
[
lutris
bottles
wine
winetricks
gamemode
mangohud
goverlay
]
++ lib.optionals cfg.launchers.enableBottles [ bottles ]
++ lib.optionals pkgs.stdenv.isx86_64 [ heroic ];
steamExtraPkgs =
@@ -66,6 +66,19 @@
description = "`programs.gamemode` (Feral GameMode).";
};
gamescope = {
enable = lib.mkEnableOption ''
`programs.gamescope` — isolated compositor for Steam/Proton on Wayland
(fixes games embedding inside the Steam window).
'';
capSysNice = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Allow gamescope to renice itself for smoother frame pacing.";
};
};
jack.enable = lib.mkOption {
type = lib.types.bool;
default = true;
@@ -76,6 +89,11 @@
};
launchers = {
enableBottles = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Install native `pkgs.bottles` in the launcher bundle.";
};
forUsers = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = null;
@@ -93,6 +111,17 @@
config = lib.mkIf cfg.enable (lib.mkMerge [
{
# openldap's upstream test suite is flaky in the Nix sandbox (test017, test001, …).
# Disabling checks avoids cascading failures in lutris, apache, gnupg, nfs-utils, etc.
# Upstream: https://github.com/NixOS/nixpkgs/issues/514113
nixpkgs.overlays = [
(_: prev: {
openldap = prev.openldap.overrideAttrs (_: {
doCheck = false;
});
})
];
programs.steam = {
enable = true;
remotePlay.openFirewall = cfg.steam.remotePlay.openFirewall;
@@ -106,6 +135,11 @@
programs.gamemode.enable = cfg.gamemode.enable;
programs.gamescope = lib.mkIf cfg.gamescope.enable {
enable = true;
inherit (cfg.gamescope) capSysNice;
};
chiasson.system.audio.pipewire.jack.enable = lib.mkIf (cfg.jack.enable) (lib.mkDefault true);
assertions = [
modules/system/users/catalog-default.nix
+3
View File
@@ -19,6 +19,9 @@
# to /sys/class/backlight/*/brightness without sudo. Harmless on hosts without a
# backlight (servers, desktop towers): the group simply has no devices to own.
"video"
# DRI render nodes and input devices for gamescope / Steam on Wayland (no sudo).
"render"
"input"
];
# Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`.