NeilClack
f74d8cb708
The previous commit wrapped the manifest's storePath string in a symlinkJoin. symlinkJoin passes its paths as a file, so a bare store-path string registered no dependency: Nix never substituted the closure and the symlinkJoin failed with 'radiantwave-9b57e48: No such file or directory'. builtins.storePath turns the published path into a real store-path dependency that Nix substitutes from the channel's Attic cache, so the app is baked and never compiled. Keep the raw string (publishedPath) for the updater's plain-string baseline pointer.
317 lines
13 KiB
Nix
317 lines
13 KiB
Nix
{
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
|
disko.url = "github:nix-community/disko";
|
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
|
nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
|
|
nixos-raspberrypi.url = "github:nvmd/nixos-raspberrypi/main";
|
|
};
|
|
|
|
outputs =
|
|
{
|
|
self,
|
|
nixpkgs,
|
|
disko,
|
|
nixos-facter-modules,
|
|
nixos-raspberrypi,
|
|
...
|
|
}@inputs:
|
|
let
|
|
system = "x86_64-linux";
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
|
|
# Plymouth theme: renders the RadiantWave SVG to a full-HD splash.png
|
|
# at build time (librsvg), so the theme is hermetic and resolution-
|
|
# independent. The .plymouth file's /usr paths are rewritten to $out
|
|
# (the NixOS module's initrd fixup rewrites store paths again).
|
|
mkRadiantwavePlymouth = targetPkgs:
|
|
targetPkgs.stdenv.mkDerivation {
|
|
pname = "radiantwave-plymouth";
|
|
version = "1.0.0";
|
|
|
|
nativeBuildInputs = [ targetPkgs.librsvg ];
|
|
|
|
src = ./assets/RWT-Circular-Color-ForOnDark.svg;
|
|
dontUnpack = true;
|
|
|
|
buildPhase = ''
|
|
mkdir -p $out/share/plymouth/themes/radiantwave
|
|
rsvg-convert \
|
|
--keep-aspect-ratio \
|
|
--background-color=#111318 \
|
|
--width=1280 \
|
|
--height=720 \
|
|
--output=$out/share/plymouth/themes/radiantwave/splash.png \
|
|
$src
|
|
sed 's,/usr/,'"$out"'/,g' ${./plymouth-theme/radiantwave.plymouth} \
|
|
> $out/share/plymouth/themes/radiantwave/radiantwave.plymouth
|
|
cp ${./plymouth-theme/radiantwave.script} \
|
|
$out/share/plymouth/themes/radiantwave/radiantwave.script
|
|
'';
|
|
};
|
|
|
|
revision = self.rev or self.dirtyRev or null;
|
|
|
|
# DEV/PROD CHANNEL SELECTOR — the single block that differs between the
|
|
# `main` and `dev` branches. Everything downstream (the four configs, the
|
|
# ISOs, the updater module) is identical on both branches and pulls from
|
|
# this channel, so a `dev`-to-`main` merge carries your changes with it
|
|
# automatically. There are no more `-dev` sibling configs to copy.
|
|
#
|
|
# main: atticRepo = "radiantwave", gitRef = ""
|
|
# dev: atticRepo = "radiantwave-dev", gitRef = "?ref=dev"
|
|
#
|
|
# To flip branches, change ONLY these two values (then push/merge).
|
|
#
|
|
# Note there is deliberately NO app version here. The RadiantWave app is
|
|
# not built or pinned by this repo; each channel's published manifest is
|
|
# the single source of truth (see `publishedApp` below).
|
|
channel = {
|
|
atticRepo = "radiantwave-dev"; # dev
|
|
gitRef = "?ref=dev"; # dev
|
|
};
|
|
|
|
# Exposed so CI (see .gitea/workflows/build.yml) and humans can verify
|
|
# which channel this checkout resolves to. On `main` this is
|
|
# "radiantwave"; on `dev` it is "radiantwave-dev".
|
|
channelName = channel.atticRepo;
|
|
|
|
# Channel metadata shared by the configs and the CI preflight.
|
|
channelAtticUrl = "https://attic.radiantwavetech.com/${channel.atticRepo}";
|
|
channelManifestDir = "https://files.radiantwavetech.com/${channel.atticRepo}";
|
|
|
|
# The baked RadiantWave app is whatever the channel's published manifest
|
|
# currently announces. RadiantWave CI builds the app, pushes the closure
|
|
# to the channel's Attic cache, and writes {version, storePath} to the
|
|
# manifest. We fetch that manifest at eval time and use its storePath
|
|
# verbatim, so an image always carries exactly the published closure and
|
|
# never compiles RadiantWave from source. This is an *impure* fetch (no
|
|
# hash), so every eval that reaches the app needs `--impure`: CI, the
|
|
# kiosk's system.autoUpgrade, and local `build-rpi.sh` all pass it.
|
|
manifestFor = manifestFile:
|
|
builtins.fromJSON (builtins.readFile (builtins.fetchurl {
|
|
url = "${channelManifestDir}/${manifestFile}";
|
|
}));
|
|
|
|
# The published closure as a plain store-path string. Used for the
|
|
# updater's runtime baseline pointer (a plain string; the closure itself
|
|
# is pulled in via publishedApp below).
|
|
publishedPath = manifestFile: (manifestFor manifestFile).storePath;
|
|
|
|
# The published closure as a real store-path dependency.
|
|
# builtins.storePath makes the derivation depend on this exact path and
|
|
# substitute it from the channel's Attic cache (configured as a trusted
|
|
# substituter), so the app is never compiled from source. The closure
|
|
# itself is not fetched by this repository; RadiantWave CI publishes it.
|
|
publishedApp = manifestFile: builtins.storePath (publishedPath manifestFile);
|
|
|
|
# Live app-update side channel. The manifest is served by the
|
|
# fileserver; closures are fetched (never built) from the channel's
|
|
# Attic cache. `repo` selects the channel — "radiantwave" (main) or
|
|
# "radiantwave-dev" (dev) — and `manifestFile` selects the per-arch
|
|
# manifest (default "manifest.json"; Raspberry Pi uses
|
|
# "aarch64-manifest.json"). All variants follow this same update
|
|
# procedure; only the channel/arch differ.
|
|
radiantwaveUpdaterModule = { repo, baseline, manifestFile ? "manifest.json" }: {
|
|
services.radiantwaveUpdater = {
|
|
enable = true;
|
|
baselinePath = baseline;
|
|
manifestUrl = "https://files.radiantwavetech.com/${repo}/${manifestFile}";
|
|
atticUrl = "https://attic.radiantwavetech.com/${repo}";
|
|
};
|
|
};
|
|
|
|
mkKioskSystem = {
|
|
system,
|
|
upgradeFlakeRef,
|
|
hostName,
|
|
diskModule,
|
|
extraModules ? [],
|
|
}:
|
|
nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
|
|
specialArgs = {
|
|
inherit upgradeFlakeRef;
|
|
radiantwaveApp = publishedApp "manifest.json";
|
|
radiantwavePlymouth = mkRadiantwavePlymouth;
|
|
};
|
|
|
|
modules = [
|
|
{ nixpkgs.config.allowUnfree = true; }
|
|
{
|
|
networking.hostName = hostName;
|
|
system.configurationRevision = revision;
|
|
}
|
|
./configuration.nix
|
|
./radiantwave-updater.nix
|
|
disko.nixosModules.disko
|
|
diskModule
|
|
nixos-facter-modules.nixosModules.facter
|
|
# Hardware facter report. This is a NUC 14 report currently
|
|
# applied to every x86 variant (including commercial SATA
|
|
# hardware). To use per-model reports: generate them on each
|
|
# hardware target (procedure in AGENTS.md), commit them as
|
|
# facter-<model>.json, and select per variant here, e.g.:
|
|
# { facter.reportPath = ./facter-commercial.json; }
|
|
{ facter.reportPath = ./facter.json; }
|
|
] ++ extraModules;
|
|
};
|
|
|
|
mkRpiKioskSystem = {
|
|
upgradeFlakeRef,
|
|
hostName,
|
|
extraModules ? [],
|
|
}:
|
|
nixos-raspberrypi.lib.nixosSystem {
|
|
specialArgs = {
|
|
inherit upgradeFlakeRef;
|
|
inherit nixos-raspberrypi;
|
|
radiantwaveApp = publishedApp "aarch64-manifest.json";
|
|
radiantwavePlymouth = mkRadiantwavePlymouth;
|
|
};
|
|
|
|
modules = [
|
|
{ nixpkgs.config.allowUnfree = true; }
|
|
({ ... }: {
|
|
imports = with nixos-raspberrypi.nixosModules; [
|
|
sd-image
|
|
raspberry-pi-5.base
|
|
raspberry-pi-5.page-size-16k
|
|
raspberry-pi-5.display-vc4
|
|
];
|
|
})
|
|
./configuration.nix
|
|
./radiantwave-updater.nix
|
|
{
|
|
networking.hostName = hostName;
|
|
system.configurationRevision = revision;
|
|
|
|
boot.loader.systemd-boot.enable = nixpkgs.lib.mkForce false;
|
|
boot.loader.efi.canTouchEfiVariables = nixpkgs.lib.mkForce false;
|
|
boot.loader.raspberry-pi.bootloader = "kernel";
|
|
|
|
nix.settings.extra-substituters = [
|
|
"https://nixos-raspberrypi.cachix.org"
|
|
];
|
|
nix.settings.extra-trusted-public-keys = [
|
|
"nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
|
|
];
|
|
}
|
|
] ++ extraModules;
|
|
};
|
|
|
|
# Zero-touch USB installer image. `targetConfig` names the kiosk system
|
|
# to install: the closure comes from the packages output below and the
|
|
# partitioning script from the paired disk module, so the ISO always
|
|
# installs the matching system for its hardware.
|
|
mkIso = { targetConfig, diskModule }:
|
|
nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
|
|
specialArgs = {
|
|
inherit inputs;
|
|
inherit self;
|
|
};
|
|
|
|
modules = [
|
|
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
|
|
disko.nixosModules.disko
|
|
(import ./zero-touch-installer.nix { inherit targetConfig; })
|
|
diskModule
|
|
({ pkgs, ... }: {
|
|
environment.systemPackages = [
|
|
disko.packages.${system}.default
|
|
];
|
|
isoImage.storeContents = [
|
|
self.packages.x86_64-linux.${targetConfig}
|
|
];
|
|
environment.etc."disko-config.nix".source = diskModule;
|
|
})
|
|
];
|
|
};
|
|
in
|
|
{
|
|
inherit channelName channelAtticUrl channelManifestDir;
|
|
|
|
packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
|
|
packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
|
|
packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
|
|
packages.x86_64-linux.radiantwavekiosk-rpi = self.nixosConfigurations.radiantwavekiosk-rpi.config.system.build.toplevel;
|
|
|
|
# Kiosk systems — one per hardware target, no dev/prod siblings.
|
|
#
|
|
# Every config consumes the channel selected at the top of this file
|
|
# (see `channel`): the published manifest whose closure is baked as the
|
|
# app, the Attic repo/manifest it fetches live updates from, and the
|
|
# KioskConfig git ref it auto-upgrades from. On `main` the channel is
|
|
# prod; on `dev` it is the dev channel. Because there is exactly one
|
|
# config per hardware type, changes made on `dev` reach prod via a plain
|
|
# merge — no copying.
|
|
nixosConfigurations = {
|
|
radiantwavekiosk = mkKioskSystem {
|
|
system = "x86_64-linux";
|
|
hostName = "radiantwavekiosk";
|
|
diskModule = ./disk-config.nix;
|
|
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk";
|
|
extraModules = [
|
|
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedPath "manifest.json"; })
|
|
];
|
|
};
|
|
radiantwavekiosk-commercial = mkKioskSystem {
|
|
system = "x86_64-linux";
|
|
hostName = "radiantwavekiosk-commercial";
|
|
diskModule = ./commercial-disk-config.nix;
|
|
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-commercial";
|
|
extraModules = [
|
|
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedPath "manifest.json"; })
|
|
];
|
|
};
|
|
# Rotated screen for android-style displays.
|
|
radiantwavekiosk-android = mkKioskSystem {
|
|
system = "x86_64-linux";
|
|
hostName = "radiantwavekiosk-android";
|
|
diskModule = ./disk-config.nix;
|
|
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-android";
|
|
extraModules = [
|
|
./rotated_display.nix
|
|
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedPath "manifest.json"; })
|
|
];
|
|
};
|
|
# Raspberry Pi 5.
|
|
radiantwavekiosk-rpi = mkRpiKioskSystem {
|
|
hostName = "radiantwavekiosk-rpi";
|
|
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-rpi";
|
|
extraModules = [
|
|
(radiantwaveUpdaterModule {
|
|
repo = channel.atticRepo;
|
|
baseline = publishedPath "aarch64-manifest.json";
|
|
manifestFile = "aarch64-manifest.json";
|
|
})
|
|
];
|
|
};
|
|
|
|
# === USB Images ===
|
|
# Each ISO installs exactly the named system closure using that
|
|
# system's disk layout. NVMe layouts pair with ./disk-config.nix,
|
|
# SATA with ./commercial-disk-config.nix — don't cross them.
|
|
# The same names build dev-flavored images when the flake is checked
|
|
# out on the `dev` branch (the channel block above selects the dev
|
|
# manifest, attic repo, and upgrade ref), so there are no separate
|
|
# -dev ISOs.
|
|
kiosk-iso = mkIso {
|
|
targetConfig = "radiantwavekiosk";
|
|
diskModule = ./disk-config.nix;
|
|
};
|
|
commercial-iso = mkIso {
|
|
targetConfig = "radiantwavekiosk-commercial";
|
|
diskModule = ./commercial-disk-config.nix;
|
|
};
|
|
android-iso = mkIso {
|
|
targetConfig = "radiantwavekiosk-android";
|
|
diskModule = ./disk-config.nix;
|
|
};
|
|
};
|
|
};
|
|
}
|