From 7f695a56bc1a8b6970c8047d3e0a68baa039d961 Mon Sep 17 00:00:00 2001 From: Jacek Galowicz Date: Sat, 11 Jul 2026 16:33:05 +0200 Subject: [PATCH 1/4] use treefmt from pkgs withConfig --- flake.lock | 23 +---------------------- flake.nix | 44 +++++++++++++++++++++++++++++++++----------- treefmt.nix | 11 ----------- 3 files changed, 34 insertions(+), 44 deletions(-) delete mode 100644 treefmt.nix diff --git a/flake.lock b/flake.lock index 3fc95f3..bffd844 100644 --- a/flake.lock +++ b/flake.lock @@ -18,28 +18,7 @@ }, "root": { "inputs": { - "nixpkgs": "nixpkgs", - "treefmt-nix": "treefmt-nix" - } - }, - "treefmt-nix": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1780220602, - "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=", - "owner": "numtide", - "repo": "treefmt-nix", - "rev": "db947814a175b7ca6ded66e21383d938df01c227", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "treefmt-nix", - "type": "github" + "nixpkgs": "nixpkgs" } } }, diff --git a/flake.nix b/flake.nix index 4b3ba5c..13c5d8a 100644 --- a/flake.nix +++ b/flake.nix @@ -1,19 +1,15 @@ { description = "declarative-runtime: declarative NixOS service runtime config via paired OpenTofu providers"; - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; - treefmt-nix.url = "github:numtide/treefmt-nix"; - treefmt-nix.inputs.nixpkgs.follows = "nixpkgs"; - }; + inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; outputs = { self, nixpkgs, - treefmt-nix, }: let + inherit (nixpkgs) lib; systems = [ "x86_64-linux" "aarch64-linux" @@ -27,7 +23,6 @@ pkgs = nixpkgs.legacyPackages.${system}; } ); - treefmtEval = forAllSystems ({ pkgs, ... }: treefmt-nix.lib.evalModule pkgs ./treefmt.nix); # runnable examples (see ./examples//README.md). each `name` # surfaces as `nix run .#` (the qemu vm) and as an eval-only # check, so option-name drift fails CI without paying for a full vm test. @@ -69,11 +64,38 @@ name: cfg: nixpkgs.lib.nameValuePair "example-${name}" (exampleSystem system cfg).config.system.build.toplevel ) examples) - // { - formatting = treefmtEval.${system}.config.build.check self; - } ); - formatter = forAllSystems ({ system, ... }: treefmtEval.${system}.config.build.wrapper); + formatter = builtins.mapAttrs ( + _: pkgs: + pkgs.treefmt.withConfig { + settings = { + tree-root-file = "flake.nix"; + on-unmatched = "info"; + formatter = { + nixfmt = { + command = lib.getExe pkgs.nixfmt; + includes = [ "*.nix" ]; + }; + statix = { + command = lib.getExe pkgs.statix; + options = [ "fix" ]; + no-positional-arg-support = true; + includes = [ "*.nix" ]; + }; + deadnix = { + command = lib.getExe pkgs.deadnix; + options = [ "--edit" ]; + includes = [ "*.nix" ]; + }; + prettier = { + command = lib.getExe pkgs.prettier; + options = [ "--write" ]; + includes = [ "*.md" ]; + }; + }; + }; + } + ) nixpkgs.legacyPackages; }; } diff --git a/treefmt.nix b/treefmt.nix deleted file mode 100644 index e7a4f42..0000000 --- a/treefmt.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ ... }: -{ - projectRootFile = "flake.nix"; - programs.nixfmt.enable = true; - - # Markdown formatting. Scoped to *.md so prettier does not touch JSON/YAML/JS. - programs.prettier = { - enable = true; - includes = [ "*.md" ]; - }; -} From be5bbff6b2619d30848a98907511168674c8a66d Mon Sep 17 00:00:00 2001 From: Jacek Galowicz Date: Sat, 11 Jul 2026 16:33:19 +0200 Subject: [PATCH 2/4] run formatter for nix files --- flake.nix | 2 +- modules/lib/default.nix | 6 +++--- services/forgejo/module.nix | 2 +- services/keycloak/lib.nix | 1 - services/keycloak/module.nix | 4 +--- 5 files changed, 6 insertions(+), 9 deletions(-) diff --git a/flake.nix b/flake.nix index 13c5d8a..f3825e5 100644 --- a/flake.nix +++ b/flake.nix @@ -52,7 +52,7 @@ packages = forAllSystems ( { system, ... }: - nixpkgs.lib.mapAttrs (name: cfg: (exampleSystem system cfg).config.system.build.vm) examples + nixpkgs.lib.mapAttrs (_name: cfg: (exampleSystem system cfg).config.system.build.vm) examples ); checks = forAllSystems ( diff --git a/modules/lib/default.nix b/modules/lib/default.nix index c6034a4..c9af551 100644 --- a/modules/lib/default.nix +++ b/modules/lib/default.nix @@ -133,13 +133,13 @@ rec { if refSpec.required or false then lib.mkOption { type = base; - description = refSpec.description; + inherit (refSpec) description; } else lib.mkOption { type = ty.nullOr base; default = null; - description = refSpec.description; + inherit (refSpec) description; } ) spec.refs // lib.listToAttrs ( @@ -157,7 +157,7 @@ rec { } ); default = { }; - description = spec.description; + inherit (spec) description; } ) resourceTypes; diff --git a/services/forgejo/module.nix b/services/forgejo/module.nix index 60dfef5..c44f6bf 100644 --- a/services/forgejo/module.nix +++ b/services/forgejo/module.nix @@ -91,7 +91,7 @@ in declarative-forgejo = tflib.mkReconcileService { name = "declarative-forgejo"; tfConfig = tf.config; - credentials = tf.credentials; + inherit (tf) credentials; afterUnits = [ "forgejo.service" ] ++ lib.optional bootstrapToken "${tokenServiceName}.service"; healthUrl = "${cfg.baseUrl}/api/healthz"; tokenFile = effectiveTokenFile; diff --git a/services/keycloak/lib.nix b/services/keycloak/lib.nix index 0b4ad91..7f60a11 100644 --- a/services/keycloak/lib.nix +++ b/services/keycloak/lib.nix @@ -13,7 +13,6 @@ let oSub oListSub rStr - rBool ; provider = pkgs.terraform-providers.keycloak_keycloak; diff --git a/services/keycloak/module.nix b/services/keycloak/module.nix index 7b64a39..427ed25 100644 --- a/services/keycloak/module.nix +++ b/services/keycloak/module.nix @@ -33,9 +33,7 @@ let in { options.services.keycloak.runtime = { - enable = mkEnableOption ( - "declarative keycloak runtime config, applied via OpenTofu after keycloak.service starts" - ); + enable = mkEnableOption "declarative keycloak runtime config, applied via OpenTofu after keycloak.service starts"; baseUrl = mkOption { type = types.str; From 507ca2faed9a3e485a1faab476858506969f8d72 Mon Sep 17 00:00:00 2001 From: Jacek Galowicz Date: Sat, 11 Jul 2026 16:39:21 +0200 Subject: [PATCH 3/4] update nixpkgs so we get treefmt check --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index bffd844..fe90317 100644 --- a/flake.lock +++ b/flake.lock @@ -2,11 +2,11 @@ "nodes": { "nixpkgs": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1783522502, + "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612", "type": "github" }, "original": { From 4f38c0548c0bfc3ce34e4b3db608cedf5caddbff Mon Sep 17 00:00:00 2001 From: Jacek Galowicz Date: Sat, 11 Jul 2026 16:41:30 +0200 Subject: [PATCH 4/4] simplify rest of the code --- flake.nix | 63 ++++++++++++++++++++++++------------------------------- 1 file changed, 27 insertions(+), 36 deletions(-) diff --git a/flake.nix b/flake.nix index f3825e5..9b61420 100644 --- a/flake.nix +++ b/flake.nix @@ -4,25 +4,9 @@ inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; outputs = - { - self, - nixpkgs, - }: + inputs: let - inherit (nixpkgs) lib; - systems = [ - "x86_64-linux" - "aarch64-linux" - ]; - forAllSystems = - f: - nixpkgs.lib.genAttrs systems ( - system: - f { - inherit system; - pkgs = nixpkgs.legacyPackages.${system}; - } - ); + inherit (inputs.nixpkgs) lib; # runnable examples (see ./examples//README.md). each `name` # surfaces as `nix run .#` (the qemu vm) and as an eval-only # check, so option-name drift fails CI without paying for a full vm test. @@ -31,10 +15,10 @@ }; exampleSystem = system: cfg: - nixpkgs.lib.nixosSystem { + lib.nixosSystem { inherit system; modules = [ - self.nixosModules.default + inputs.self.nixosModules.default cfg ]; }; @@ -46,27 +30,34 @@ nixosModules.forgejo = ./services/forgejo/module.nix; nixosModules.keycloak = ./services/keycloak/module.nix; - nixosConfigurations = nixpkgs.lib.mapAttrs' ( - name: cfg: nixpkgs.lib.nameValuePair "example-${name}" (exampleSystem "x86_64-linux" cfg) + nixosConfigurations = lib.mapAttrs' ( + name: cfg: lib.nameValuePair "example-${name}" (exampleSystem "x86_64-linux" cfg) ) examples; - packages = forAllSystems ( - { system, ... }: - nixpkgs.lib.mapAttrs (_name: cfg: (exampleSystem system cfg).config.system.build.vm) examples - ); + packages = lib.mapAttrs ( + system: _pkgs: lib.mapAttrs (_name: cfg: (exampleSystem system cfg).config.system.build.vm) examples + ) inputs.nixpkgs.legacyPackages; - checks = forAllSystems ( - { pkgs, system }: - # Per-service checks (one attrset per pairing under ./services/). - (import ./services/forgejo/checks.nix { inherit pkgs self; }) - // (import ./services/keycloak/checks.nix { inherit pkgs self; }) - // (nixpkgs.lib.mapAttrs' ( + checks = lib.mapAttrs ( + system: pkgs: + import ./services/forgejo/checks.nix { + inherit pkgs; + inherit (inputs) self; + } + // (import ./services/keycloak/checks.nix { + inherit pkgs; + inherit (inputs) self; + }) + // (lib.mapAttrs' ( name: cfg: - nixpkgs.lib.nameValuePair "example-${name}" (exampleSystem system cfg).config.system.build.toplevel + lib.nameValuePair "example-${name}" (exampleSystem system cfg).config.system.build.toplevel ) examples) - ); + // { + formatting = inputs.self.formatter.${system}.check inputs.self; + } + ) inputs.nixpkgs.legacyPackages; - formatter = builtins.mapAttrs ( + formatter = lib.mapAttrs ( _: pkgs: pkgs.treefmt.withConfig { settings = { @@ -96,6 +87,6 @@ }; }; } - ) nixpkgs.legacyPackages; + ) inputs.nixpkgs.legacyPackages; }; }