Initial commit

14 files changed, 311 insertions, 0 deletions

diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..e93a728
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,7 @@
+[submodule "vagrant/nixpkgs"]
+	path = vagrant/nixpkgs
+	url = https://github.com/NixOS/nixpkgs.git
+	branch = nixos-25.11
+[submodule "vagrant/nixsap"]
+	path = vagrant/nixsap
+	url = https://github.com/ip1981/nixsap.git
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..c6c7def
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,13 @@
+        DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+                    Version 2, December 2004
+
+ Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>
+
+ Everyone is permitted to copy and distribute verbatim or modified
+ copies of this license document, and changing it is allowed as long
+ as the name is changed.
+
+            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. You just DO WHAT THE FUCK YOU WANT TO.
diff --git a/vagrant/Vagrantfile b/vagrant/Vagrantfile
new file mode 100644
index 0000000..c873106
--- /dev/null
+++ b/vagrant/Vagrantfile
@@ -0,0 +1,73 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+require 'fileutils'
+
+Vagrant.configure("2") do |config|
+
+  config.vm.provider "virtualbox" do |vb|
+    vb.cpus = 2
+    vb.gui = false
+    vb.memory = 4096
+  end
+
+  config.vm.box = "nixos-25.11"
+  config.vm.box_url = "https://files.pashev.ru/vagrant/nixos/25.11/nixos-25.11-20260522.box"
+  config.vm.box_download_checksum = "805ca9beb4e4d12684393c215d26bb60071d7678bf55ff502953a11ef553897c"
+  config.vm.box_download_checksum_type = "sha256"
+
+  config.ssh.username = "root"
+
+  # FIXME we don't want it as we configure and build stuff *outside* the VM
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+
+  config.trigger.after [ :up, :reload ] do |after_up|
+    after_up.name = "Extract machine info for use by Nix"
+    after_up.ruby do |env, machine|
+      infra_dir = "machines/#{machine.name}/infra"
+      ssh = machine.ssh_info
+
+      FileUtils.mkdir_p infra_dir
+
+      machine.communicate.execute('nixos-generate-config --show-hardware-config') do |type, result|
+        File.write "#{infra_dir}/hardware-configuration.nix", result
+      end
+
+      public_keys = ssh[:private_key_path].map { |p| `ssh-keygen -y -f '#{p}'`.chomp }
+
+      File.write "#{infra_dir}/default.nix", <<~DEFAULT_NIX
+        # This file is generated by Vagrant. Do not edit.
+        {...}:
+        {
+          imports = [ ./hardware-configuration.nix ];
+
+          networking.hostName = "#{machine.name}";
+          services.openssh.enable = true;
+          services.openssh.settings.PermitRootLogin = "prohibit-password";
+
+          users.users.#{ssh[:username]}.openssh.authorizedKeys.keys = #{public_keys};
+        }
+      DEFAULT_NIX
+
+      # FIXME: a better way to reuse `vagrant ssh-config > foo` ?
+      stdout = $stdout
+      $stdout = StringIO.new
+      env.cli('ssh-config', '--host', machine.name.to_s)
+      File.write "#{infra_dir}/ssh_config", $stdout.string
+      $stdout = stdout
+
+    end
+  end
+
+  config.trigger.before :provision do |provision|
+    provision.ruby do |env, machine|
+      system('nixsap', '-I', '.', '-F', "machines/#{machine.name}/infra/ssh_config", 'deploy', "machines/#{machine.name}")
+    end
+  end
+
+  config.vm.define "nixos", autostart: true do |nixos|
+    nixos.vm.disk :disk, size: "50GB", primary: true
+  end
+
+end
+
diff --git a/vagrant/machines/nixos/default.nix b/vagrant/machines/nixos/default.nix
new file mode 100644
index 0000000..720b785
--- /dev/null
+++ b/vagrant/machines/nixos/default.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [ ./infra <modules> ];
+
+  nixsap.deployment.keyrings.root = [ "/run/keys/foo" ];
+}
+
diff --git a/vagrant/modules/default.nix b/vagrant/modules/default.nix
new file mode 100644
index 0000000..985e6e9
--- /dev/null
+++ b/vagrant/modules/default.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+
+let
+  all = lib.filterAttrs
+    ( n: _: n != "default.nix" && ! lib.hasPrefix "." n )
+    (builtins.readDir ./.);
+
+in {
+  imports = [ <nixsap> ] ++ map (p: ./. + "/${p}") ( builtins.attrNames all );
+}
+
diff --git a/vagrant/modules/nixos.nix b/vagrant/modules/nixos.nix
new file mode 100644
index 0000000..4c3047b
--- /dev/null
+++ b/vagrant/modules/nixos.nix
@@ -0,0 +1,34 @@
+{ lib, ... }:
+let
+  inherit (lib) mkForce ;
+in {
+
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.enable = true;
+  documentation.doc.enable = false;
+  documentation.info.enable = false;
+  documentation.man.enable = false;
+  documentation.nixos.enable = false;
+  i18n.supportedLocales = mkForce [ "en_US.UTF-8/UTF-8" ];
+  networking.firewall.allowPing = true;
+  networking.firewall.enable = true;
+  networking.firewall.pingLimit = "--limit 1/second --limit-burst 5";
+  nix.gc.automatic = true;
+  nix.gc.options = "-d";
+  nix.settings.allowed-users = [];
+  security.polkit.enable = false;
+  security.sudo.wheelNeedsPassword = true;
+  services.openssh.authorizedKeysFiles = mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
+  services.openssh.settings.KbdInteractiveAuthentication = false;
+  services.openssh.settings.PasswordAuthentication = false;
+  services.udisks2.enable = false;
+
+  # XXX default logout breaks Vagrant: https://github.com/NixOS/nixpkgs/issues/521679
+  programs.bash.logout = ''
+    if [ -n "$PS1" ]; then
+      printf '\e]0;\a' >&2
+    fi
+  '';
+
+}
+
diff --git a/vagrant/modules/nixsap.nix b/vagrant/modules/nixsap.nix
new file mode 100644
index 0000000..c1d390a
--- /dev/null
+++ b/vagrant/modules/nixsap.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ <nixsap> ];
+}
diff --git a/vagrant/modules/overlay.nix b/vagrant/modules/overlay.nix
new file mode 100644
index 0000000..372da27
--- /dev/null
+++ b/vagrant/modules/overlay.nix
@@ -0,0 +1,3 @@
+{
+  nixpkgs.overlays = [ (import ../pkgs) ];
+}
diff --git a/vagrant/modules/shell.nix b/vagrant/modules/shell.nix
new file mode 100644
index 0000000..a9cd0bc
--- /dev/null
+++ b/vagrant/modules/shell.nix
@@ -0,0 +1,85 @@
+{ pkgs, ... }:
+{
+  programs.bash = {
+    completion.enable = true;
+    promptInit = ''
+      LIGHT_BLUE="\[\033[1;34m\]"
+      BLACK="\[\033[0;30m\]"
+      BLUE="\[\033[0;34m\]"
+      GREEN="\[\033[0;32m\]"
+      CYAN="\[\033[0;36m\]"
+      RED="\[\033[0;31m\]"
+      PURPLE="\[\033[0;35m\]"
+      BROWN="\[\033[0;33m\]"
+      LIGHT_GRAY="\[\033[0;37m\]"
+
+      DARK_GRAY="\[\033[1;30m\]"
+      LIGHT_BLUE="\[\033[1;34m\]"
+      LIGHT_GREEN="\[\033[1;32m\]"
+      LIGHT_CYAN="\[\033[1;36m\]"
+      LIGHT_RED="\[\033[1;31m\]"
+      LIGHT_PURPLE="\[\033[1;35m\]"
+      YELLOW="\[\033[1;33m\]"
+      WHITE="\[\033[1;37m\]"
+
+      NO_COLOUR="\[\033[0m\]"
+
+      DEFAULT_COLOUR=$LIGHT_GRAY
+      PATH_COLOUR=$LIGHT_BLUE
+      HOST_COLOUR=$YELLOW
+
+      if_root() {
+        case "$(id -u)" in
+          0) echo "$1";;
+          *) echo "$2";;
+        esac
+      }
+
+      export PS1=$(cat << PS1
+      $DEFAULT_COLOUR
+      (\$(date -R))
+      [\$(if_root "$RED" "$GREEN")\u$DEFAULT_COLOUR@$HOST_COLOUR\h$DEFAULT_COLOUR:$PATH_COLOUR\w$DEFAULT_COLOUR]
+      \$(if_root '#' '$') $NO_COLOUR
+      PS1
+      )
+    '';
+  };
+
+  environment.variables = {
+    HISTFILE = "/dev/null";
+    HISTIGNORE = "&";
+    MYSQL_HISTFILE = "/dev/null";
+    PSQL_HISTORY = "/dev/null";
+  };
+
+  environment.shellAliases = {
+    grep = "grep --color=auto";
+    rm = "rm -i";
+    sudo = "sudo ";
+  };
+
+  environment.systemPackages = with pkgs;
+    [
+      curl.bin
+      file
+      htop
+      iftop
+      inetutils
+      iotop
+      jq
+      lsof
+      mtr
+      ncdu
+      nmap
+      openssl.bin
+      pigz
+      pv
+      pwgen
+      pxz
+      sysstat
+      tcpdump
+      tmux
+      traceroute
+      tree
+    ];
+}
diff --git a/vagrant/nixpkgs b/vagrant/nixpkgs
new file mode 160000
+Subproject 687f05a9184cad4eaf905c48b63649e3a86f543
diff --git a/vagrant/nixsap b/vagrant/nixsap
new file mode 160000
+Subproject 983675f6d888c91de9c116fc4b302b74f4dffb2
diff --git a/vagrant/pkgs/default.nix b/vagrant/pkgs/default.nix
new file mode 100644
index 0000000..2551bbc
--- /dev/null
+++ b/vagrant/pkgs/default.nix
@@ -0,0 +1,12 @@
+self: super:
+let
+  all = super.lib.attrNames (
+    super.lib.filterAttrs
+    ( n: _: n != "default.nix" && ! super.lib.hasPrefix "." n )
+    (builtins.readDir ./.)
+  );
+in super.lib.listToAttrs (map (f:
+  { name = super.lib.removeSuffix ".nix" f;
+    value = super.callPackage (./. + "/${f}") {inherit super;}; }
+) all)
+
diff --git a/vagrant/pkgs/whatsupnix/default.nix b/vagrant/pkgs/whatsupnix/default.nix
new file mode 100644
index 0000000..f842fdc
--- /dev/null
+++ b/vagrant/pkgs/whatsupnix/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, bash, gawk, nix, makeWrapper }:
+
+stdenv.mkDerivation {
+  name = "whatsupnix";
+  buildInputs = [ bash ];
+  phases = [ "installPhase" ];
+  nativeBuildInputs = [ makeWrapper ];
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a ${./whatsupnix.bash} $out/bin/whatsupnix
+    chmod +x $out/bin/whatsupnix
+    patchShebangs $out/bin/whatsupnix
+    wrapProgram "$out/bin/whatsupnix" \
+      --prefix PATH : '${gawk}/bin:${nix}/bin'
+  '';
+}
+
diff --git a/vagrant/pkgs/whatsupnix/whatsupnix.bash b/vagrant/pkgs/whatsupnix/whatsupnix.bash
new file mode 100755
index 0000000..36b5dc4
--- /dev/null
+++ b/vagrant/pkgs/whatsupnix/whatsupnix.bash
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# Prints build logs for failed derivations in quiet build mode (-Q).
+# See https://github.com/NixOS/nix/issues/443
+#
+# Usage:
+#
+#    set -o pipefail
+#    nix-build ... -Q ... | whatsupnix
+#
+
+
+GAWK=${GAWK:-gawk}
+NIX_STORE=${NIX_STORE:-nix-store}
+
+broken=$(mktemp)
+trap 'rm -f -- "$broken"' EXIT
+
+exec >&2
+
+$GAWK -v broken="$broken" -f <(cat - <<- 'AWK'
+  match($0, /builder for .*(\/nix\/store\/.+\.drv).* failed/, m) {
+    print m[1] >> broken
+  }
+  { print $0 }
+AWK
+)
+
+export NIX_PAGER='' # for nix-store
+while read -r drv; do
+  title="** FAILED $drv LOG  **"
+  frame=${title//?/*}
+
+  echo "$frame"
+  echo "$title"
+  echo "$frame"
+  echo
+
+  $NIX_STORE -l "$drv"
+
+  echo
+done < "$broken"
+
+exit 0
+