Establish repository foundation and shared work environment
This commit is contained in:
kiri committed
1 parent
3c022ad2f9
commit
f164d8b76e
15 files changed
+571
-523
No files matched your search
@@ -1,63 +1,40 @@
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
account = config.facts.account;
|
||||
mkScope =
|
||||
config: scope:
|
||||
let
|
||||
email = account.emails.${scope}.address;
|
||||
key = config.facts.machine.sshKeys.${scope} or null;
|
||||
hasSigningKey = key != null;
|
||||
privateKeyPath =
|
||||
if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
|
||||
in
|
||||
{
|
||||
allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
|
||||
git = {
|
||||
user = {
|
||||
name = account.realName;
|
||||
inherit email;
|
||||
}
|
||||
// lib.optionalAttrs hasSigningKey {
|
||||
signingKey = "${privateKeyPath}.pub";
|
||||
};
|
||||
}
|
||||
// lib.optionalAttrs hasSigningKey {
|
||||
core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
|
||||
gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
flake.modules.homeManager.git =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{ config, ... }:
|
||||
let
|
||||
machine = config.facts.machine;
|
||||
allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
|
||||
githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
|
||||
|
||||
gh = pkgs.symlinkJoin {
|
||||
name = "gh-with-read-only-token-${pkgs.gh.version}";
|
||||
paths = [ pkgs.gh ];
|
||||
nativeBuildInputs = [ pkgs.makeWrapper ];
|
||||
meta.mainProgram = "gh";
|
||||
postBuild = ''
|
||||
wrapProgram "$out/bin/gh" \
|
||||
--run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
|
||||
'';
|
||||
};
|
||||
|
||||
mkScope =
|
||||
scope:
|
||||
let
|
||||
email = account.emails.${scope}.address;
|
||||
key = machine.sshKeys.${scope} or null;
|
||||
hasSigningKey = key != null;
|
||||
privateKeyPath =
|
||||
if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
|
||||
in
|
||||
{
|
||||
allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
|
||||
git = {
|
||||
user = {
|
||||
name = account.realName;
|
||||
inherit email;
|
||||
}
|
||||
// lib.optionalAttrs hasSigningKey {
|
||||
signingKey = "${privateKeyPath}.pub";
|
||||
};
|
||||
}
|
||||
// lib.optionalAttrs hasSigningKey {
|
||||
core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
|
||||
gpg.ssh.allowedSignersFile = allowedSignersFile;
|
||||
};
|
||||
};
|
||||
|
||||
personal = mkScope "personal";
|
||||
work = mkScope "work";
|
||||
personal = mkScope config "personal";
|
||||
in
|
||||
{
|
||||
xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" (
|
||||
personal.allowedSigners ++ work.allowedSigners ++ [ "" ]
|
||||
);
|
||||
xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" personal.allowedSigners;
|
||||
|
||||
programs.git = {
|
||||
enable = true;
|
||||
@@ -73,34 +50,52 @@ in
|
||||
email = account.emails.personal.address;
|
||||
};
|
||||
};
|
||||
includes = [
|
||||
{
|
||||
condition = "gitdir:${account.nixosConfigurationPath}/";
|
||||
contents = personal.git;
|
||||
}
|
||||
{
|
||||
condition = "gitdir:${config.home.homeDirectory}/yookr/";
|
||||
contents = work.git;
|
||||
}
|
||||
{
|
||||
condition = "gitdir:${config.xdg.userDirs.projects}/own/";
|
||||
contents = personal.git;
|
||||
}
|
||||
{
|
||||
condition = "gitdir:${config.xdg.userDirs.projects}/ext/";
|
||||
contents = personal.git;
|
||||
}
|
||||
{
|
||||
condition = "gitdir:${config.xdg.userDirs.projects}/forks/";
|
||||
contents = personal.git;
|
||||
}
|
||||
];
|
||||
includes =
|
||||
map
|
||||
(path: {
|
||||
condition = "gitdir:${path}/";
|
||||
contents = personal.git;
|
||||
})
|
||||
[
|
||||
account.nixosConfigurationPath
|
||||
"${config.xdg.userDirs.projects}/own"
|
||||
"${config.xdg.userDirs.projects}/ext"
|
||||
"${config.xdg.userDirs.projects}/forks"
|
||||
];
|
||||
};
|
||||
|
||||
programs.gh = {
|
||||
enable = true;
|
||||
package = gh;
|
||||
settings.git_protocol = "ssh";
|
||||
};
|
||||
};
|
||||
|
||||
flake.modules.homeManager.work-git =
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
work = mkScope config "work";
|
||||
githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
|
||||
gh = pkgs.symlinkJoin {
|
||||
name = "gh-with-read-only-token-${pkgs.gh.version}";
|
||||
paths = [ pkgs.gh ];
|
||||
nativeBuildInputs = [ pkgs.makeWrapper ];
|
||||
meta.mainProgram = "gh";
|
||||
postBuild = ''
|
||||
wrapProgram "$out/bin/gh" \
|
||||
--run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
xdg.configFile."git/allowed_signers".text = lib.mkAfter (
|
||||
lib.concatStringsSep "\n" work.allowedSigners
|
||||
);
|
||||
programs.git.includes = [
|
||||
{
|
||||
condition = "gitdir:${config.home.homeDirectory}/yookr/";
|
||||
contents = work.git;
|
||||
}
|
||||
];
|
||||
programs.gh.package = gh;
|
||||
};
|
||||
}
|
||||
Reference in new issue
Block a user