WIP: add_raspi #11
128
flake.lock
generated
128
flake.lock
generated
@@ -1,12 +1,114 @@
|
||||
{
|
||||
"nodes": {
|
||||
"argononed": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1729566243,
|
||||
"narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
|
||||
"owner": "nvmd",
|
||||
"repo": "argononed",
|
||||
"rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nvmd",
|
||||
"repo": "argononed",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"locked": {
|
||||
"lastModified": 1767039857,
|
||||
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782562157,
|
||||
"narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "a9cf7546a938c737b079e738de73934a13de9784",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "master",
|
||||
"repo": "nixos-hardware",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-images": {
|
||||
"inputs": {
|
||||
"nixos-stable": [
|
||||
"nixos-raspberrypi",
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixos-unstable": [
|
||||
"nixos-raspberrypi",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1747747741,
|
||||
"narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
|
||||
"owner": "nvmd",
|
||||
"repo": "nixos-images",
|
||||
"rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nvmd",
|
||||
"ref": "sdimage-installer",
|
||||
"repo": "nixos-images",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-raspberrypi": {
|
||||
"inputs": {
|
||||
"argononed": "argononed",
|
||||
"flake-compat": "flake-compat",
|
||||
"nixos-images": "nixos-images",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779023229,
|
||||
"narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
|
||||
"owner": "nvmd",
|
||||
"repo": "nixos-raspberrypi",
|
||||
"rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nvmd",
|
||||
"ref": "main",
|
||||
"repo": "nixos-raspberrypi",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1778869304,
|
||||
"narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
|
||||
"lastModified": 1782467914,
|
||||
"narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
|
||||
"rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -29,11 +131,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776659114,
|
||||
"narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=",
|
||||
"lastModified": 1782093830,
|
||||
"narHash": "sha256-6gmEVe69+KlRkZD4PEEV5xAlB9CB0Y9TiuEgQjDrKTQ=",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "build-system-pkgs",
|
||||
"rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e",
|
||||
"rev": "430680a19bc85a3bda55f12e4cc1a1aadcf2e478",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -49,11 +151,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778901413,
|
||||
"narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
|
||||
"lastModified": 1782089418,
|
||||
"narHash": "sha256-LRD1SuQWr49fGq3A+8GLXfsLE2xqIpQA440YDZwms3M=",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "pyproject.nix",
|
||||
"rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
|
||||
"rev": "43f0b40edd0a74c63f66b7b48d969ae6b740d611",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -64,6 +166,8 @@
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixos-raspberrypi": "nixos-raspberrypi",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"pyproject-build-systems": "pyproject-build-systems",
|
||||
"pyproject-nix": "pyproject-nix",
|
||||
@@ -80,11 +184,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779269674,
|
||||
"narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=",
|
||||
"lastModified": 1782100052,
|
||||
"narHash": "sha256-UfyLY3Hfwb3JqxCcj0953GxTFI5dEL85EKEe6DAFiVs=",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "uv2nix",
|
||||
"rev": "69aec536f6d1acc415ed2e20299312802aba98c6",
|
||||
"rev": "920fc6dfaf9f10ec56de93b184055e1a9f380d5e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
127
flake.nix
127
flake.nix
@@ -21,6 +21,15 @@
|
||||
inputs.uv2nix.follows = "uv2nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixos-hardware = {
|
||||
url = "github:NixOS/nixos-hardware/master";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixos-raspberrypi = {
|
||||
url = "github:nvmd/nixos-raspberrypi/main";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
outputs =
|
||||
@@ -29,6 +38,7 @@
|
||||
pyproject-nix,
|
||||
uv2nix,
|
||||
pyproject-build-systems,
|
||||
nixos-hardware,
|
||||
...
|
||||
}:
|
||||
let
|
||||
@@ -105,5 +115,122 @@
|
||||
packages = forAllSystems (system: {
|
||||
default = pythonSets.${system}.mkVirtualEnv "gatekeeper" workspace.deps.default;
|
||||
});
|
||||
|
||||
|
||||
nixosConfigurations = {
|
||||
gatekeeper-rpi = nixpkgs.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
specialArgs = {
|
||||
inherit workspace overlay;
|
||||
};
|
||||
modules = [
|
||||
"${nixpkgs}/nixos/modules/profiles/headless.nix"
|
||||
"${nixpkgs}/nixos/modules/profiles/minimal.nix"
|
||||
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
|
||||
nixos-hardware.nixosModules.raspberry-pi-3
|
||||
|
||||
({ pkgs, ... }: {
|
||||
nix.nixPath = [
|
||||
"nixpkgs=${pkgs.path}"
|
||||
];
|
||||
|
||||
nix.settings = {
|
||||
trusted-users = [ "root" "@wheel" ];
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
auto-optimise-store = true;
|
||||
};
|
||||
})
|
||||
|
||||
({ config, pkgs, packages, ...}:
|
||||
let
|
||||
gatekeeper-app = pkgs.python3Packages.buildPythonPackage {
|
||||
pname = "gatekeeper-app";
|
||||
version = "0.0.1";
|
||||
propagatedBuildInputs = [packages.gatekeeper];
|
||||
src = ./app;
|
||||
format = "pyproject";
|
||||
};
|
||||
in
|
||||
{
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.generic-extlinux-compatible.enable = true;
|
||||
boot.kernelPackages = pkgs.linuxPackages;
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
networking.hostName = "gatekeeper-rpi";
|
||||
|
||||
#minimal
|
||||
documentation.man.enable = false;
|
||||
xdg.icons.enable = false;
|
||||
xdg.mime.enable = false;
|
||||
xdg.sounds.enable = false;
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"];
|
||||
users.groups = { gatekeeper = {}; };
|
||||
users.users.admin = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "networkmanager" "gatekeeper" ];
|
||||
};
|
||||
users.users.gatekeeper = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["gatekeeper"];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [ 22 ];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
htop
|
||||
pcsclite
|
||||
gatekeeper-app
|
||||
];
|
||||
environment.etc."gatekeeper-env".source =
|
||||
pythonSets.aarch64-linux.mkVirtualEnv "gatekeeper" workspace.deps.default;
|
||||
services.pcscd.enable = true;
|
||||
|
||||
systemd.services.gatekeeper = {
|
||||
enable = true;
|
||||
description = "Gatekeeper service";
|
||||
after = [ "network.target" "pcscd.service"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
environment = {
|
||||
LD_LIBRARY_PATH = "${lib.getLib pkgs.pcsclite}/lib";
|
||||
PYTHONPATH = "/etc/gatekeeper-env/lib/python3.x/site-packages";
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "gatekeeper";
|
||||
Group = "gatekeeper";
|
||||
WorkingDirectory = "/var/lib/gatekeeper";
|
||||
ExecStart = "${pythonSets.aarch64-linux.mkVirtualEnv "gatekeeper" workspace.deps.default}/bin/python -m uvicorn main:app --host 0.0.0.0 --port 8000";
|
||||
Restart = "always";
|
||||
RestartSec = "10";
|
||||
};
|
||||
|
||||
# Create working directory and log directory
|
||||
preStart = ''
|
||||
mkdir -p /var/lib/gatekeeper
|
||||
mkdir -p /var/log/gatekeeper
|
||||
chown -R gatekeeper:gatekeeper /var/lib/gatekeeper
|
||||
chown -R gatekeeper:gatekeeper /var/log/gatekeeper
|
||||
'';
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 8000 ];
|
||||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
system.stateVersion = "25.11";
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user