Update flake.lock

flake.lock

@@ -1,12 +1,114 @@
 {
   "nodes": {
+    "argononed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729566243,
+        "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
+        "owner": "nvmd",
+        "repo": "argononed",
+        "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "repo": "argononed",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782562157,
+        "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "a9cf7546a938c737b079e738de73934a13de9784",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
+    "nixos-images": {
+      "inputs": {
+        "nixos-stable": [
+          "nixos-raspberrypi",
+          "nixpkgs"
+        ],
+        "nixos-unstable": [
+          "nixos-raspberrypi",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747747741,
+        "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
+        "owner": "nvmd",
+        "repo": "nixos-images",
+        "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "ref": "sdimage-installer",
+        "repo": "nixos-images",
+        "type": "github"
+      }
+    },
+    "nixos-raspberrypi": {
+      "inputs": {
+        "argononed": "argononed",
+        "flake-compat": "flake-compat",
+        "nixos-images": "nixos-images",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779023229,
+        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
+        "owner": "nvmd",
+        "repo": "nixos-raspberrypi",
+        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "ref": "main",
+        "repo": "nixos-raspberrypi",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778869304,
+        "lastModified": 1782467914,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
         "type": "github"
       },
       "original": {
@@ -29,11 +131,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776659114,
+        "lastModified": 1782093830,
-        "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=",
+        "narHash": "sha256-6gmEVe69+KlRkZD4PEEV5xAlB9CB0Y9TiuEgQjDrKTQ=",
         "owner": "pyproject-nix",
         "repo": "build-system-pkgs",
-        "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e",
+        "rev": "430680a19bc85a3bda55f12e4cc1a1aadcf2e478",
         "type": "github"
       },
       "original": {
@@ -49,11 +151,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778901413,
+        "lastModified": 1782089418,
-        "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
+        "narHash": "sha256-LRD1SuQWr49fGq3A+8GLXfsLE2xqIpQA440YDZwms3M=",
         "owner": "pyproject-nix",
         "repo": "pyproject.nix",
-        "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
+        "rev": "43f0b40edd0a74c63f66b7b48d969ae6b740d611",
         "type": "github"
       },
       "original": {
@@ -64,6 +166,8 @@
     },
     "root": {
       "inputs": {
+        "nixos-hardware": "nixos-hardware",
+        "nixos-raspberrypi": "nixos-raspberrypi",
         "nixpkgs": "nixpkgs",
         "pyproject-build-systems": "pyproject-build-systems",
         "pyproject-nix": "pyproject-nix",
@@ -80,11 +184,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779269674,
+        "lastModified": 1782100052,
-        "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=",
+        "narHash": "sha256-UfyLY3Hfwb3JqxCcj0953GxTFI5dEL85EKEe6DAFiVs=",
         "owner": "pyproject-nix",
         "repo": "uv2nix",
-        "rev": "69aec536f6d1acc415ed2e20299312802aba98c6",
+        "rev": "920fc6dfaf9f10ec56de93b184055e1a9f380d5e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -21,6 +21,15 @@
       inputs.uv2nix.follows = "uv2nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixos-raspberrypi = {
+      url = "github:nvmd/nixos-raspberrypi/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
   };
 
   outputs =
@@ -29,6 +38,7 @@
       pyproject-nix,
       uv2nix,
       pyproject-build-systems,
+      nixos-hardware,
       ...
     }:
     let
@@ -105,5 +115,122 @@
       packages = forAllSystems (system: {
         default = pythonSets.${system}.mkVirtualEnv "gatekeeper" workspace.deps.default;
       });
+
+
+      nixosConfigurations = {
+        gatekeeper-rpi = nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          specialArgs = {
+            inherit workspace overlay;
+          };
+          modules = [
+            "${nixpkgs}/nixos/modules/profiles/headless.nix"
+            "${nixpkgs}/nixos/modules/profiles/minimal.nix"
+            "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+            nixos-hardware.nixosModules.raspberry-pi-3
+
+            ({ pkgs, ... }: {
+              nix.nixPath = [
+                "nixpkgs=${pkgs.path}"
+              ];
+
+              nix.settings = {
+                trusted-users = [ "root" "@wheel" ];
+                experimental-features = [ "nix-command" "flakes" ];
+                auto-optimise-store = true;
+              };
+            })
+
+            ({ config, pkgs, packages, ...}:
+            let
+              gatekeeper-app = pkgs.python3Packages.buildPythonPackage {
+                pname = "gatekeeper-app";
+                version = "0.0.1";
+                propagatedBuildInputs = [packages.gatekeeper];
+                src = ./app;
+                format = "pyproject";
+              };
+            in 
+            {
+              boot.loader.grub.enable = false;
+              boot.loader.generic-extlinux-compatible.enable = true;
+              boot.kernelPackages = pkgs.linuxPackages;
+              boot.tmp.cleanOnBoot = true;
+              hardware.enableRedistributableFirmware = true;
+              networking.hostName = "gatekeeper-rpi";
+
+              #minimal
+              documentation.man.enable = false;
+              xdg.icons.enable  = false;
+              xdg.mime.enable   = false;
+              xdg.sounds.enable = false;
+              
+              users.users.root.openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"];
+              users.groups = { gatekeeper = {}; };
+              users.users.admin = {
+                isNormalUser = true;
+                extraGroups = [ "wheel" "networkmanager" "gatekeeper" ];
+              };
+              users.users.gatekeeper = {
+                isNormalUser = true;
+                extraGroups = ["gatekeeper"];
+              };
+
+              services.openssh = {
+                enable = true;
+                ports = [ 22 ];
+                settings = {
+                  PasswordAuthentication = false;
+                };
+              };
+              
+
+              environment.systemPackages = with pkgs; [
+                git
+                htop
+                pcsclite
+                gatekeeper-app
+              ];
+              environment.etc."gatekeeper-env".source = 
+                  pythonSets.aarch64-linux.mkVirtualEnv "gatekeeper" workspace.deps.default;
+              services.pcscd.enable = true;
+
+              systemd.services.gatekeeper = {
+                enable = true;
+                description = "Gatekeeper service";
+                after = [ "network.target" "pcscd.service"];
+                wantedBy = [ "multi-user.target" ];
+
+                environment = {
+                  LD_LIBRARY_PATH = "${lib.getLib pkgs.pcsclite}/lib";
+                  PYTHONPATH = "/etc/gatekeeper-env/lib/python3.x/site-packages";
+                };
+
+                serviceConfig = {
+                  Type = "simple";
+                  User = "gatekeeper";
+                  Group = "gatekeeper";
+                  WorkingDirectory = "/var/lib/gatekeeper";
+                  ExecStart = "${pythonSets.aarch64-linux.mkVirtualEnv "gatekeeper" workspace.deps.default}/bin/python -m uvicorn main:app --host 0.0.0.0 --port 8000";
+                  Restart = "always";
+                  RestartSec = "10";
+                };
+
+                # Create working directory and log directory
+                preStart = ''
+                  mkdir -p /var/lib/gatekeeper
+                  mkdir -p /var/log/gatekeeper
+                  chown -R gatekeeper:gatekeeper /var/lib/gatekeeper
+                  chown -R gatekeeper:gatekeeper /var/log/gatekeeper
+                '';
+              };
+              networking.firewall.allowedTCPPorts = [ 8000 ];
+              
+              time.timeZone = "Europe/Berlin";
+              system.stateVersion = "25.11";
+            })
+          ];
+        };  
+      };
     };
 }