From 2d64edde6463ea95226fd8862d3b3ebade042b75 Mon Sep 17 00:00:00 2001 From: ahtlon Date: Sat, 27 Jun 2026 14:50:50 +0200 Subject: [PATCH 1/2] WIP add rpi nixos-config --- flake.nix | 127 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 127 insertions(+) diff --git a/flake.nix b/flake.nix index bc38ce8..dffb851 100644 --- a/flake.nix +++ b/flake.nix @@ -21,6 +21,15 @@ inputs.uv2nix.follows = "uv2nix"; inputs.nixpkgs.follows = "nixpkgs"; }; + nixos-hardware = { + url = "github:NixOS/nixos-hardware/master"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + nixos-raspberrypi = { + url = "github:nvmd/nixos-raspberrypi/main"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; outputs = @@ -29,6 +38,7 @@ pyproject-nix, uv2nix, pyproject-build-systems, + nixos-hardware, ... }: let @@ -105,5 +115,122 @@ packages = forAllSystems (system: { default = pythonSets.${system}.mkVirtualEnv "gatekeeper" workspace.deps.default; }); + + + nixosConfigurations = { + gatekeeper-rpi = nixpkgs.lib.nixosSystem { + system = "aarch64-linux"; + specialArgs = { + inherit workspace overlay; + }; + modules = [ + "${nixpkgs}/nixos/modules/profiles/headless.nix" + "${nixpkgs}/nixos/modules/profiles/minimal.nix" + "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix" + nixos-hardware.nixosModules.raspberry-pi-3 + + ({ pkgs, ... }: { + nix.nixPath = [ + "nixpkgs=${pkgs.path}" + ]; + + nix.settings = { + trusted-users = [ "root" "@wheel" ]; + experimental-features = [ "nix-command" "flakes" ]; + auto-optimise-store = true; + }; + }) + + ({ config, pkgs, packages, ...}: + let + gatekeeper-app = pkgs.python3Packages.buildPythonPackage { + pname = "gatekeeper-app"; + version = "0.0.1"; + propagatedBuildInputs = [packages.gatekeeper]; + src = ./app; + format = "pyproject"; + }; + in + { + boot.loader.grub.enable = false; + boot.loader.generic-extlinux-compatible.enable = true; + boot.kernelPackages = pkgs.linuxPackages; + boot.tmp.cleanOnBoot = true; + hardware.enableRedistributableFirmware = true; + networking.hostName = "gatekeeper-rpi"; + + #minimal + documentation.man.enable = false; + xdg.icons.enable = false; + xdg.mime.enable = false; + xdg.sounds.enable = false; + + users.users.root.openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"]; + users.groups = { gatekeeper = {}; }; + users.users.admin = { + isNormalUser = true; + extraGroups = [ "wheel" "networkmanager" "gatekeeper" ]; + }; + users.users.gatekeeper = { + isNormalUser = true; + extraGroups = ["gatekeeper"]; + }; + + services.openssh = { + enable = true; + ports = [ 22 ]; + settings = { + PasswordAuthentication = false; + }; + }; + + + environment.systemPackages = with pkgs; [ + git + htop + pcsclite + gatekeeper-app + ]; + environment.etc."gatekeeper-env".source = + pythonSets.aarch64-linux.mkVirtualEnv "gatekeeper" workspace.deps.default; + services.pcscd.enable = true; + + systemd.services.gatekeeper = { + enable = true; + description = "Gatekeeper service"; + after = [ "network.target" "pcscd.service"]; + wantedBy = [ "multi-user.target" ]; + + environment = { + LD_LIBRARY_PATH = "${lib.getLib pkgs.pcsclite}/lib"; + PYTHONPATH = "/etc/gatekeeper-env/lib/python3.x/site-packages"; + }; + + serviceConfig = { + Type = "simple"; + User = "gatekeeper"; + Group = "gatekeeper"; + WorkingDirectory = "/var/lib/gatekeeper"; + ExecStart = "${pythonSets.aarch64-linux.mkVirtualEnv "gatekeeper" workspace.deps.default}/bin/python -m uvicorn main:app --host 0.0.0.0 --port 8000"; + Restart = "always"; + RestartSec = "10"; + }; + + # Create working directory and log directory + preStart = '' + mkdir -p /var/lib/gatekeeper + mkdir -p /var/log/gatekeeper + chown -R gatekeeper:gatekeeper /var/lib/gatekeeper + chown -R gatekeeper:gatekeeper /var/log/gatekeeper + ''; + }; + networking.firewall.allowedTCPPorts = [ 8000 ]; + + time.timeZone = "Europe/Berlin"; + system.stateVersion = "25.11"; + }) + ]; + }; + }; }; } -- 2.51.2 From e871330041ac88b9e42653e477cd87015c199acc Mon Sep 17 00:00:00 2001 From: ahtlon Date: Sat, 27 Jun 2026 14:59:00 +0200 Subject: [PATCH 2/2] Update flake.lock --- flake.lock | 128 ++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 116 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index 9401486..59848db 100644 --- a/flake.lock +++ b/flake.lock @@ -1,12 +1,114 @@ { "nodes": { + "argononed": { + "flake": false, + "locked": { + "lastModified": 1729566243, + "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=", + "owner": "nvmd", + "repo": "argononed", + "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf", + "type": "github" + }, + "original": { + "owner": "nvmd", + "repo": "argononed", + "type": "github" + } + }, + "flake-compat": { + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "nixos-hardware": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782562157, + "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=", + "owner": "NixOS", + "repo": "nixos-hardware", + "rev": "a9cf7546a938c737b079e738de73934a13de9784", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "master", + "repo": "nixos-hardware", + "type": "github" + } + }, + "nixos-images": { + "inputs": { + "nixos-stable": [ + "nixos-raspberrypi", + "nixpkgs" + ], + "nixos-unstable": [ + "nixos-raspberrypi", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1747747741, + "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=", + "owner": "nvmd", + "repo": "nixos-images", + "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4", + "type": "github" + }, + "original": { + "owner": "nvmd", + "ref": "sdimage-installer", + "repo": "nixos-images", + "type": "github" + } + }, + "nixos-raspberrypi": { + "inputs": { + "argononed": "argononed", + "flake-compat": "flake-compat", + "nixos-images": "nixos-images", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1779023229, + "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=", + "owner": "nvmd", + "repo": "nixos-raspberrypi", + "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5", + "type": "github" + }, + "original": { + "owner": "nvmd", + "ref": "main", + "repo": "nixos-raspberrypi", + "type": "github" + } + }, "nixpkgs": { "locked": { - "lastModified": 1778869304, - "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=", + "lastModified": 1782467914, + "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "d233902339c02a9c334e7e593de68855ad26c4cb", + "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", "type": "github" }, "original": { @@ -29,11 +131,11 @@ ] }, "locked": { - "lastModified": 1776659114, - "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=", + "lastModified": 1782093830, + "narHash": "sha256-6gmEVe69+KlRkZD4PEEV5xAlB9CB0Y9TiuEgQjDrKTQ=", "owner": "pyproject-nix", "repo": "build-system-pkgs", - "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e", + "rev": "430680a19bc85a3bda55f12e4cc1a1aadcf2e478", "type": "github" }, "original": { @@ -49,11 +151,11 @@ ] }, "locked": { - "lastModified": 1778901413, - "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=", + "lastModified": 1782089418, + "narHash": "sha256-LRD1SuQWr49fGq3A+8GLXfsLE2xqIpQA440YDZwms3M=", "owner": "pyproject-nix", "repo": "pyproject.nix", - "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a", + "rev": "43f0b40edd0a74c63f66b7b48d969ae6b740d611", "type": "github" }, "original": { @@ -64,6 +166,8 @@ }, "root": { "inputs": { + "nixos-hardware": "nixos-hardware", + "nixos-raspberrypi": "nixos-raspberrypi", "nixpkgs": "nixpkgs", "pyproject-build-systems": "pyproject-build-systems", "pyproject-nix": "pyproject-nix", @@ -80,11 +184,11 @@ ] }, "locked": { - "lastModified": 1779269674, - "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=", + "lastModified": 1782100052, + "narHash": "sha256-UfyLY3Hfwb3JqxCcj0953GxTFI5dEL85EKEe6DAFiVs=", "owner": "pyproject-nix", "repo": "uv2nix", - "rev": "69aec536f6d1acc415ed2e20299312802aba98c6", + "rev": "920fc6dfaf9f10ec56de93b184055e1a9f380d5e", "type": "github" }, "original": { -- 2.51.2