flake.lock: Update

Flake lock file updates: • Updated input 'disko': 'github:nix-community/disko/79eab0e82cb126bf4ac170f44af82479f0895ab5' (2024-04-08) → 'github:nix-community/disko/8d4ae698eaac8bd717e23507da2ca8b345bec4b5' (2024-04-12) • Updated input 'firefox-darwin': 'github:bandithedoge/nixpkgs-firefox-darwin/49b3ee7dbb9fdbb6388bd5d47895a9a9992b771e' (2024-04-09) → 'github:bandithedoge/nixpkgs-firefox-darwin/10e4a50241d6bbae62754efda7bc4b48dd4aa2c1' (2024-04-14) • Updated input 'home-manager': 'github:nix-community/home-manager/b00d0e4fe9cba0047f54e77418ddda5f17e6ef2c' (2024-04-09) → 'github:nix-community/home-manager/630a0992b3627c64e34f179fab68e3d48c6991c0' (2024-04-14) • Updated input 'nextcloud-snappymail': 'https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz?narHash=sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo%3D' (2024-04-09) → 'https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz?narHash=sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo%3D' (2024-04-14) • Updated input 'nur': 'github:nix-community/nur/ee4ce451f46a08778d1a9f9837eff0750714b08b' (2024-04-09) → 'github:nix-community/nur/1e6e9f41f0fbdcba7ca505a7d54128bc2f1053d6' (2024-04-14) • Updated input 'nvim-treesitter-src': 'github:nvim-treesitter/nvim-treesitter/c16f66cca0c38b4e21371d8330b7f2ad6404f6dc' (2024-04-09) → 'github:nvim-treesitter/nvim-treesitter/d2f4c7830377d6d036e9621ae696dbd28f089897' (2024-04-14) • Updated input 'tree-sitter-bash': 'github:tree-sitter/tree-sitter-bash/f3f26f47a126797c011c311cec9d449d855c3eab' (2024-03-13) → 'github:tree-sitter/tree-sitter-bash/f8fb3274f72a30896075585b32b0c54cad65c086' (2024-04-11) • Updated input 'wsl': 'github:nix-community/NixOS-WSL/aef95bdb6800a3a2af7aa7083d6df03067da6592' (2024-03-15) → 'github:nix-community/NixOS-WSL/0479d4c1ebeb314c5281b4aa7109def821a1b27b' (2024-04-13) • Updated input 'wsl/flake-utils': 'github:numtide/flake-utils/1ef2e671c3b0c19053962c07dbda38332dcebf26' (2024-01-15) → 'github:numtide/flake-utils/b1d9ab70662946ef0850d488da1c9019f3a9752a' (2024-03-11)
arrow image package derivation
2024-12-05 01:19:09 +00:00 · 2024-04-14 12:32:23 +00:00 · 2024-04-14 08:28:39 -04:00 · 2024-04-14 08:08:57 -04:00
12 changed files with 172 additions and 458 deletions
--- a/.github/workflows/arrow.yml
+++ b/.github/workflows/arrow.yml
@ -3,7 +3,7 @@ name: Arrow
 run-name: Arrow - ${{ inputs.rebuild && 'Rebuild and ' || '' }}${{ inputs.action == 'create' && 'Create' || ( inputs.action == 'destroy' && 'Destroy' || 'No Action' ) }}

 env:
-  TERRAFORM_DIRECTORY: hosts/arrow
+  TERRAFORM_DIRECTORY: hosts/arrow/vultr
  DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
  ARROW_IDENTITY_BASE64: ${{ secrets.ARROW_IDENTITY_BASE64 }}
  CLOUDFLARE_R2_ENDPOINT: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
@ -65,7 +65,7 @@ jobs:
      # Build the image
      - name: Build Image
        if: inputs.rebuild && inputs.action != 'destroy'
-        run: nix build .#image.arrow
+        run: nix build .#arrow

      - name: Upload Image to S3
        if: inputs.rebuild && inputs.action != 'destroy'
--- a/flake.lock
+++ b/flake.lock
@ -126,11 +126,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1712612224,
-        "narHash": "sha256-Tv4C8OSPVmm4LbpJGLFSODyvJy6DqrisEGPCQdNVOeY=",
+        "lastModified": 1712947906,
+        "narHash": "sha256-T0eT2lMbcK7RLelkx0qx4SiFpOS/0dt0aSfLB+WsGV8=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "79eab0e82cb126bf4ac170f44af82479f0895ab5",
+        "rev": "8d4ae698eaac8bd717e23507da2ca8b345bec4b5",
        "type": "github"
      },
      "original": {
@ -163,11 +163,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1712623312,
-        "narHash": "sha256-6NlzHMtxCdlF+Zq1Y10YnVr5M/AgMcVhEMZlxlQyeNo=",
+        "lastModified": 1713055748,
+        "narHash": "sha256-LlFkVfdF9GfB02gFNHjnLOV0AQYFY7gWATlniTALeaM=",
        "owner": "bandithedoge",
        "repo": "nixpkgs-firefox-darwin",
-        "rev": "49b3ee7dbb9fdbb6388bd5d47895a9a9992b771e",
+        "rev": "10e4a50241d6bbae62754efda7bc4b48dd4aa2c1",
        "type": "github"
      },
      "original": {
@ -215,11 +215,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@ -251,11 +251,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1712688495,
-        "narHash": "sha256-NrVLXkpT9ZigiI8md6NIzHS+3lE4QTj30IgXG57O9iM=",
+        "lastModified": 1713077896,
+        "narHash": "sha256-Noot8H0EZEAFRQWyGxh9ryvhK96xpIqKbh78X447JWs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "b00d0e4fe9cba0047f54e77418ddda5f17e6ef2c",
+        "rev": "630a0992b3627c64e34f179fab68e3d48c6991c0",
        "type": "github"
      },
      "original": {
@ -323,7 +323,7 @@
    "nextcloud-snappymail": {
      "flake": false,
      "locked": {
-        "lastModified": 1712695892,
+        "lastModified": 1713097756,
        "narHash": "sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo=",
        "type": "tarball",
        "url": "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz"
@ -408,11 +408,11 @@
    },
    "nur": {
      "locked": {
-        "lastModified": 1712692796,
-        "narHash": "sha256-q3Tx4kS+nH4IDcEsZSv8o2IuCn475mGhCYBXxfxZ2gY=",
+        "lastModified": 1713093341,
+        "narHash": "sha256-zON2LEPO98NiUtOItgu+Vz1uWkrUbt5zJbzf5XCm71Y=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "ee4ce451f46a08778d1a9f9837eff0750714b08b",
+        "rev": "1e6e9f41f0fbdcba7ca505a7d54128bc2f1053d6",
        "type": "github"
      },
      "original": {
@ -473,11 +473,11 @@
    "nvim-treesitter-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1712690702,
-        "narHash": "sha256-iWP5nIswAs+7oNBhJpPzBqJ5BLXEt8+kHPi22RtAK3Q=",
+        "lastModified": 1713097426,
+        "narHash": "sha256-rtE1H24sKekGwTIMh7VXkwKVCbJtn8ms4ioK9gF+KxY=",
        "owner": "nvim-treesitter",
        "repo": "nvim-treesitter",
-        "rev": "c16f66cca0c38b4e21371d8330b7f2ad6404f6dc",
+        "rev": "d2f4c7830377d6d036e9621ae696dbd28f089897",
        "type": "github"
      },
      "original": {
@ -660,11 +660,11 @@
    "tree-sitter-bash": {
      "flake": false,
      "locked": {
-        "lastModified": 1710290046,
-        "narHash": "sha256-6Rfxh8Y6dg2wyQ9jYnbOaXm1SVfQDQ1B1tNqgpz6sY4=",
+        "lastModified": 1712878661,
+        "narHash": "sha256-sj1qYb42k0hXXcNCKg1hINYD11wDcVpnoPhZNtlYT6k=",
        "owner": "tree-sitter",
        "repo": "tree-sitter-bash",
-        "rev": "f3f26f47a126797c011c311cec9d449d855c3eab",
+        "rev": "f8fb3274f72a30896075585b32b0c54cad65c086",
        "type": "github"
      },
      "original": {
@ -797,11 +797,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1710519878,
-        "narHash": "sha256-0dbc10OBFUVYyXC+C+N6vRUd8xyBSRxkcZ4Egipbx0M=",
+        "lastModified": 1712984363,
+        "narHash": "sha256-VgCqYB+ymQuZmno8B82L8piyENo5xTNuqubnACYoBRk=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "aef95bdb6800a3a2af7aa7083d6df03067da6592",
+        "rev": "0479d4c1ebeb314c5281b4aa7109def821a1b27b",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -22,8 +22,7 @@
    # Used for user packages and dotfiles
    home-manager = {
      url = "github:nix-community/home-manager/master";
-      inputs.nixpkgs.follows =
-        "nixpkgs"; # Use system packages list for their inputs
+      inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
    };

    # Community packages; used for Firefox extensions
@ -179,78 +178,75 @@
    # Alternatively, could consider using https://github.com/fufexan/nix-gaming
    proton-ge = {
      # https://github.com/GloriousEggroll/proton-ge-custom/releases
-      url =
-        "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton9-2/GE-Proton9-2.tar.gz";
+      url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton9-2/GE-Proton9-2.tar.gz";
      flake = false;
    };

    # Firefox addon from outside the extension store
    bypass-paywalls-clean = {
      # https://gitlab.com/magnolia1234/bpc-uploads/-/commits/master/?ref_type=HEADS
-      url =
-        "git+https://git.masu.rs/noah/bpc-uploads"; # temporary, shouldn't rely on myself
+      url = "git+https://git.masu.rs/noah/bpc-uploads"; # temporary, shouldn't rely on myself
      flake = false;
    };

    # Nextcloud Apps
    nextcloud-news = {
      # https://github.com/nextcloud/news/releases
-      url =
-        "https://github.com/nextcloud/news/releases/download/25.0.0-alpha3/news.tar.gz";
+      url = "https://github.com/nextcloud/news/releases/download/25.0.0-alpha3/news.tar.gz";
      flake = false;
    };
    nextcloud-external = {
      # https://github.com/nextcloud-releases/external/releases
-      url =
-        "https://github.com/nextcloud-releases/external/releases/download/v5.3.1/external-v5.3.1.tar.gz";
+      url = "https://github.com/nextcloud-releases/external/releases/download/v5.3.1/external-v5.3.1.tar.gz";
      flake = false;
    };
    nextcloud-cookbook = {
      # https://github.com/christianlupus-nextcloud/cookbook-releases/releases/
-      url =
-        "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz";
+      url = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz";
      flake = false;
    };
    nextcloud-snappymail = {
      # https://github.com/the-djmaze/snappymail/releases
-      url =
-        "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz";
+      url = "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz";
      flake = false;
    };
-
  };

-  outputs = { nixpkgs, ... }@inputs:
+  outputs =
+    { nixpkgs, ... }@inputs:

    let

      # Global configuration for my systems
-      globals = let baseName = "masu.rs";
-      in rec {
-        user = "noah";
-        fullName = "Noah Masur";
-        gitName = fullName;
-        gitEmail = "7386960+nmasur@users.noreply.github.com";
-        mail.server = "noahmasur.com";
-        mail.imapHost = "imap.purelymail.com";
-        mail.smtpHost = "smtp.purelymail.com";
-        dotfilesRepo = "https://github.com/nmasur/dotfiles";
-        hostnames = {
-          git = "git.${baseName}";
-          influxdb = "influxdb.${baseName}";
-          irc = "irc.${baseName}";
-          metrics = "metrics.${baseName}";
-          minecraft = "minecraft.${baseName}";
-          prometheus = "prom.${baseName}";
-          paperless = "paper.${baseName}";
-          secrets = "vault.${baseName}";
-          stream = "stream.${baseName}";
-          content = "cloud.${baseName}";
-          books = "books.${baseName}";
-          download = "download.${baseName}";
-          transmission = "transmission.${baseName}";
+      globals =
+        let
+          baseName = "masu.rs";
+        in
+        rec {
+          user = "noah";
+          fullName = "Noah Masur";
+          gitName = fullName;
+          gitEmail = "7386960+nmasur@users.noreply.github.com";
+          mail.server = "noahmasur.com";
+          mail.imapHost = "imap.purelymail.com";
+          mail.smtpHost = "smtp.purelymail.com";
+          dotfilesRepo = "https://github.com/nmasur/dotfiles";
+          hostnames = {
+            git = "git.${baseName}";
+            influxdb = "influxdb.${baseName}";
+            irc = "irc.${baseName}";
+            metrics = "metrics.${baseName}";
+            minecraft = "minecraft.${baseName}";
+            prometheus = "prom.${baseName}";
+            paperless = "paper.${baseName}";
+            secrets = "vault.${baseName}";
+            stream = "stream.${baseName}";
+            content = "cloud.${baseName}";
+            books = "books.${baseName}";
+            download = "download.${baseName}";
+            transmission = "transmission.${baseName}";
+          };
        };
-      };

      # Common overlays to always use
      overlays = [
@ -271,13 +267,17 @@
      ];

      # System types to support.
-      supportedSystems =
-        [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
+      supportedSystems = [
+        "x86_64-linux"
+        "x86_64-darwin"
+        "aarch64-linux"
+        "aarch64-darwin"
+      ];

      # Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
-
-    in rec {
+    in
+    rec {

      # Contains my full system builds, including home-manager
      # nixos-rebuild switch --flake .#tempest
@ -292,65 +292,84 @@
      # Contains my full Mac system builds, including home-manager
      # darwin-rebuild switch --flake .#lookingglass
      darwinConfigurations = {
-        lookingglass =
-          import ./hosts/lookingglass { inherit inputs globals overlays; };
+        lookingglass = import ./hosts/lookingglass { inherit inputs globals overlays; };
      };

      # For quickly applying home-manager settings with:
      # home-manager switch --flake .#tempest
      homeConfigurations = {
-        tempest =
-          nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
-        lookingglass =
-          darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
+        tempest = nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
+        lookingglass = darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
      };

      # Disk formatting, only used once
-      diskoConfigurations = { root = import ./disks/root.nix; };
-
-      packages = let
-        arrow = system:
-          import ./hosts/arrow { inherit inputs globals overlays system; };
-        aws = system:
-          import ./hosts/aws { inherit inputs globals overlays system; };
-        staff = system:
-          import ./hosts/staff { inherit inputs globals overlays system; };
-        neovim = system:
-          let pkgs = import nixpkgs { inherit system overlays; };
-          in import ./modules/common/neovim/package {
-            inherit pkgs;
-            colors = (import ./colorscheme/gruvbox-dark).dark;
-          };
-      in {
-        x86_64-linux.arrow = arrow "x86_64-linux";
-        x86_64-linux.aws = aws "x86_64-linux";
-        x86_64-linux.staff = staff "x86_64-linux";
-        x86_64-linux.image = {
-          arrow = inputs.nixos-generators.nixosGenerate {
-            system = "x86_64-linux";
-            format = "iso";
-            modules = import ./hosts/arrow/modules.nix {
-              inherit inputs globals overlays;
-            };
-          };
-        };
-
-        # Package Neovim config into standalone package
-        x86_64-linux.neovim = neovim "x86_64-linux";
-        x86_64-darwin.neovim = neovim "x86_64-darwin";
-        aarch64-linux.neovim = neovim "aarch64-linux";
-        aarch64-darwin.neovim = neovim "aarch64-darwin";
+      diskoConfigurations = {
+        root = import ./disks/root.nix;
      };

+      packages =
+        let
+          arrow =
+            system:
+            import ./hosts/arrow {
+              inherit
+                inputs
+                globals
+                overlays
+                system
+                ;
+            };
+          staff =
+            system:
+            import ./hosts/staff {
+              inherit
+                inputs
+                globals
+                overlays
+                system
+                ;
+            };
+          neovim =
+            system:
+            let
+              pkgs = import nixpkgs { inherit system overlays; };
+            in
+            import ./modules/common/neovim/package {
+              inherit pkgs;
+              colors = (import ./colorscheme/gruvbox-dark).dark;
+            };
+        in
+        {
+          x86_64-linux.staff = staff "x86_64-linux";
+          x86_64-linux.arrow = inputs.nixos-generators.nixosGenerate {
+            system = "x86_64-linux";
+            format = "iso";
+            modules = import ./hosts/arrow/modules.nix { inherit inputs globals overlays; };
+          };
+
+          # Package Neovim config into standalone package
+          x86_64-linux.neovim = neovim "x86_64-linux";
+          x86_64-darwin.neovim = neovim "x86_64-darwin";
+          aarch64-linux.neovim = neovim "aarch64-linux";
+          aarch64-darwin.neovim = neovim "aarch64-darwin";
+        };
+
      # Programs that can be run by calling this flake
-      apps = forAllSystems (system:
-        let pkgs = import nixpkgs { inherit system overlays; };
-        in import ./apps { inherit pkgs; });
+      apps = forAllSystems (
+        system:
+        let
+          pkgs = import nixpkgs { inherit system overlays; };
+        in
+        import ./apps { inherit pkgs; }
+      );

      # Development environments
-      devShells = forAllSystems (system:
-        let pkgs = import nixpkgs { inherit system overlays; };
-        in {
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = import nixpkgs { inherit system overlays; };
+        in
+        {

          # Used to run commands and edit files in this repo
          default = pkgs.mkShell {
@ -419,6 +438,5 @@
          description = "Rust template";
        };
      };
-
    };
 }
--- a/hosts/arrow/aws/main.tf
+++ b/hosts/arrow/aws/main.tf
@ -26,7 +26,7 @@ data "aws_iam_policy_document" "vmimport" {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
-        "s3:ListBucket",
+      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::${aws_s3_object.image.bucket}",
--- a/hosts/arrow/default.nix
+++ b/hosts/arrow/default.nix
@ -1,3 +1,6 @@
+# The Arrow
+# System configuration for temporary VM
+
 {
  inputs,
  globals,
--- a/hosts/arrow/vultr/main.tf
+++ b/hosts/arrow/vultr/main.tf
--- a/hosts/aws/default.nix
+++ b/hosts/aws/default.nix
@ -1,41 +0,0 @@
-{
-  inputs,
-  system,
-  globals,
-  overlays,
-  ...
-}:
-
-inputs.nixos-generators.nixosGenerate {
-  inherit system;
-  format = "amazon";
-  modules =
-    [
-      globals
-      inputs.home-manager.nixosModules.home-manager
-      {
-        nixpkgs.overlays = overlays;
-        networking.hostName = "sheep";
-        gui.enable = false;
-        theme.colors = (import ../../colorscheme/gruvbox).dark;
-        passwordHash = null;
-        publicKeys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
-        ];
-        # AWS settings require this
-        permitRootLogin = "prohibit-password";
-      }
-      ../../modules/common
-      ../../modules/nixos
-      ../../modules/nixos/services/sshd.nix
-    ]
-    ++ [
-      # Required to fix diskSize errors during build
-      (
-        { ... }:
-        {
-          amazonImage.sizeMB = 16 * 1024;
-        }
-      )
-    ];
-}
--- a/hosts/aws/workflow.yml
+++ b/hosts/aws/workflow.yml
@ -1,280 +0,0 @@
-name: 'Terraform'
-env:
-
-  AWS_ACCOUNT_NUMBER: ''
-  AWS_PLAN_ROLE_NAME: github_actions_plan
-  AWS_APPLY_ROLE_NAME: github_actions_admin
-
-  # Always required. Used for authenticating to AWS, but can also act as your
-  # default region if you don't want to specify in the provider configuration.
-  AWS_REGION: us-east-1
-
-  # You must change these to fit your project.
-  TF_VAR_project: change-me
-  TF_VAR_label: change-me
-  TF_VAR_owner: Your Name Here
-
-  # If storing Terraform in a subdirectory, specify it here.
-  TERRAFORM_DIRECTORY: .
-
-  # Pinned versions of tools to use.
-  # Check for new releases:
-  # - https://github.com/hashicorp/terraform/releases
-  # - https://github.com/fugue/regula/releases
-  # - https://github.com/terraform-linters/tflint/releases
-  TERRAFORM_VERSION: 1.2.6
-  REGULA_VERSION: 2.9.0
-  TFLINT_VERSION: 0.39.1
-
-  # Terraform configuration options
-  TERRAFORM_PARALLELISM: 10
-
-  # These variables are passed to Terraform based on GitHub information.
-  TF_VAR_repo: ${{ github.repository }}
-
-# This workflow is triggered in the following ways.
-on:
-
-  # Any push or merge to these branches.
-  push:
-    branches:
-      - dev
-      - prod
-
-  # Any pull request targeting these branches (plan only).
-  pull_request:
-    branches:
-      - dev
-      - prod
-
-
-  # Any manual trigger on these branches.
-  workflow_dispatch:
-    branches:
-      - dev
-      - prod
-
-# -------------------------------------------------------------------
-# The rest of this workflow can operate without adjustments. Edit the
-# below content at your own risk!
-# -------------------------------------------------------------------
-
-# Used to connect to AWS IAM
-permissions:
-  id-token: write
-  contents: read
-  pull-requests: write
-
-# Only run one workflow at a time for each Terraform state. This prevents
-# lockfile conflicts, especially during PR vs push.
-concurrency: terraform-${{ github.base_ref || github.ref }}
-
-jobs:
-  terraform:
-
-    name: 'Terraform'
-
-    # Change this if you need to run your deployment on-prem.
-    runs-on: ubuntu-latest
-
-    steps:
-
-      # Downloads the current repo code to the runner.
-      - name: Checkout Repo Code
-        uses: actions/checkout@v3
-
-      # Enable access to KVM, required to build an image
-      - name: Enable KVM group perms
-        run: |
-            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-            sudo udevadm control --reload-rules
-            sudo udevadm trigger --name-match=kvm
-
-      # Login to AWS
-      - name: AWS Assume Role
-        uses: aws-actions/configure-aws-credentials@v1.6.1
-        with:
-          role-to-assume: ${{ env.AWS_ROLE_ARN }}
-          aws-region: ${{ env.AWS_REGION }}
-
-      # Install Nix
-      - name: Install Nix
-        uses: cachix/install-nix-action@v17
-        with:
-          extra_nix_config: |
-            substituters = s3://insert-cache-bucket https://cache.nixos.org/
-            trusted-public-keys = insert-cache-bucket:M6PsZjHXcLvbQyPUBLICKEYGVoNwI84g1FBQzouRU= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-
-      # Build the image
-      - name: Build Image
-        run: nix build .#aws
-
-      # Copy the image to S3
-      - name: Upload Image to Cache
-        env:
-          NIX_CACHE_PRIVATE_KEY: ${{ secrets.NIX_CACHE_PRIVATE_KEY }}
-        run: |
-          echo "$NIX_CACHE_PRIVATE_KEY" > cache.key
-          nix store sign --key-file cache.key $(readlink result)
-          nix copy --to s3://t2-aws-nixos-test $(readlink result)
-          rm cache.key
-
-      # Exports all GitHub Secrets as environment variables prefixed by
-      # "TF_VAR_", which exposes them to Terraform. The name of each GitHub
-      # Secret must match its Terraform variable name exactly.
-      - name: Export Secrets to Terraform Variables
-        env:
-          ALL_SECRETS: ${{ toJson(secrets) }}
-        run: |
-          echo "$ALL_SECRETS" \
-            | jq "to_entries | .[] | \"TF_VAR_\" + ( .key | ascii_downcase ) + \"=\" + .value" \
-            | tr -d \" >> $GITHUB_ENV
-
-      # Installs the Terraform binary and some other accessory functions.
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_version: ${{ env.TERRAFORM_VERSION }}
-
-      # Checks whether Terraform is formatted properly. If this fails, you
-      # should install the pre-commit hook.
-      - name: Check Formatting
-        run: |
-          terraform fmt -no-color -check -diff -recursive
-
-      # Downloads a Terraform code lint test.
-      - uses: terraform-linters/setup-tflint@v1
-        name: Setup TFLint
-        with:
-          tflint_version: v${{ env.TFLINT_VERSION }}
-
-      # Sets up linting with this codebase.
-      - name: Init TFLint
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: tflint --init
-
-      # Lints the current code.
-      - name: Run TFLint
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          tflint -f compact
-          find ./modules/* -type d -maxdepth 0 | xargs -I __ tflint -f compact --disable-rule=terraform_required_providers --disable-rule=terraform_required_version __
-
-      # Connects to remote state backend and download providers.
-      - name: Terraform Init
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          terraform init \
-            -backend-config="role_arn=${{ env.AWS_STATE_ROLE_ARN }}" \
-            -backend-config="region=us-east-1" \
-            -backend-config="workspace_key_prefix=accounts/${{ env.AWS_ACCOUNT_NUMBER }}/${{ github.repository }}" \
-            -backend-config="key=state.tfstate" \
-            -backend-config="dynamodb_table=global-tf-state-lock"
-
-      # Set the Terraform Workspace to the current branch name.
-      - name: Set Terraform Workspace
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        shell: bash
-        run: |
-          export WORKSPACE=${{ github.base_ref || github.ref_name }}
-          terraform workspace select ${WORKSPACE} || terraform workspace new $WORKSPACE
-          echo "TF_WORKSPACE=$(echo ${WORKSPACE} | sed 's/\//_/g')" >> $GITHUB_ENV
-
-      # Checks differences between current code and infrastructure state.
-      - name: Terraform Plan
-        id: plan
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          terraform plan \
-            -input=false \
-            -no-color \
-            -out=tfplan \
-            -parallelism=${TERRAFORM_PARALLELISM} \
-            -var-file=variables-${TF_WORKSPACE}.tfvars
-
-      # Gets the results of the plan for pull requests.
-      - name: Terraform Show Plan
-        id: show
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: terraform show -no-color tfplan
-
-      # Adds the results of the plan to the pull request.
-      - name: Comment Plan
-        uses: actions/github-script@v6
-        if: github.event_name == 'pull_request'
-        env:
-          STDOUT: "```terraform\n${{ steps.show.outputs.stdout }}```"
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            // 1. Retrieve existing bot comments for the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            })
-            const botComment = comments.find(comment => {
-              return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
-            })
-
-            // 2. Prepare format of the comment
-            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
-            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
-            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
-            <details><summary>Validation Output</summary>
-
-            \`\`\`\n
-            ${{ steps.validate.outputs.stdout }}
-            \`\`\`
-
-            </details>
-
-            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
-
-            <details><summary>Show Plan</summary>
-
-            \`\`\`\n
-            ${process.env.PLAN}
-            \`\`\`
-
-            </details>
-
-            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
-
-            // 3. If we have a comment, update it, otherwise create a new one
-            if (botComment) {
-              github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: botComment.id,
-                body: output
-              })
-            } else {
-              github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: output
-              })
-            }
-
-      # Downloads Regula and checks whether the plan meets compliance requirements.
-      - name: Regula Compliance Check
-        shell: bash
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          REGULA_URL="https://github.com/fugue/regula/releases/download/v${REGULA_VERSION}/regula_${REGULA_VERSION}_Linux_x86_64.tar.gz"
-          curl -sL "$REGULA_URL" -o regula.tar.gz
-          tar xzf regula.tar.gz
-          terraform show -json tfplan | ./regula run
-
-      # Deploys infrastructure or changes to infrastructure.
-      - name: Terraform Apply
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          terraform apply \
-            -auto-approve \
-            -input=false \
-            -parallelism=${TERRAFORM_PARALLELISM} \
-            tfplan
--- a/hosts/swan/default.nix
+++ b/hosts/swan/default.nix
@ -1,8 +1,6 @@
 # The Swan
 # System configuration for my home NAS server

-# See [readme](../README.md) to explain how this file works.
-
 {
  inputs,
  globals,
--- a/hosts/tempest/default.nix
+++ b/hosts/tempest/default.nix
@ -1,8 +1,6 @@
 # The Tempest
 # System configuration for my desktop

-# See [readme](../README.md) to explain how this file works.
-
 {
  inputs,
  globals,
--- a/modules/aws/default.nix
+++ b/modules/aws/default.nix
@ -0,0 +1,15 @@
+{ ... }:
+{
+  config = {
+    # AWS settings require this
+    permitRootLogin = "prohibit-password";
+
+    # Make sure disk size is large enough
+    # https://github.com/nix-community/nixos-generators/issues/150
+    formatConfigs.amazon =
+      { config, ... }:
+      {
+        amazonImage.sizeMB = 16 * 1024;
+      };
+  };
+}
--- a/overlays/bypass-paywalls-clean.nix
+++ b/overlays/bypass-paywalls-clean.nix
@ -3,17 +3,20 @@ inputs: _final: prev: {
  # Based on:
  # https://git.sr.ht/~rycee/nur-expressions/tree/master/item/pkgs/firefox-addons/default.nix#L34

-  bypass-paywalls-clean = let addonId = "magnolia@12.34";
-  in prev.stdenv.mkDerivation rec {
-    pname = "bypass-paywalls-clean";
-    version = "3.4.9.0";
-    src = inputs.bypass-paywalls-clean + "/bypass_paywalls_clean-3.6.3.0.xpi";
-    preferLocalBuild = true;
-    allowSubstitutes = true;
-    buildCommand = ''
-      dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
-      mkdir -p "$dst"
-      install -v -m644 "${src}" "$dst/${addonId}.xpi"
-    '';
-  };
+  bypass-paywalls-clean =
+    let
+      addonId = "magnolia@12.34";
+    in
+    prev.stdenv.mkDerivation rec {
+      pname = "bypass-paywalls-clean";
+      version = "3.4.9.0";
+      src = inputs.bypass-paywalls-clean + "/bypass_paywalls_clean-3.6.3.0.xpi";
+      preferLocalBuild = true;
+      allowSubstitutes = true;
+      buildCommand = ''
+        dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
+        mkdir -p "$dst"
+        install -v -m644 "${src}" "$dst/${addonId}.xpi"
+      '';
+    };
 }