dotfiles/dev-shells.nix at main · gekoke/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
{ inputs, ... }:
{
  perSystem =
    {
      config,
      inputs',
      pkgs,
      lib,
      system,
      ...
    }:
    {
      devShells = {
        default = pkgs.mkShellNoCC {
          packages = [
            # keep-sorted start
            inputs'.agenix.packages.agenix
            pkgs.deadnix
            pkgs.nix-update
            pkgs.opentofu
            pkgs.pinact
            pkgs.prettier
            pkgs.tflint
            pkgs.zizmor
            # keep-sorted end
          ];

          shellHook = config.pre-commit.installationScript;
        };

        cache = pkgs.mkShellNoCC {
          installationScript = inputs.agenix-shell.lib.installationScript system {
            secrets.CACHIX_AUTH_TOKEN.file = ./secrets/cachix-auth-token.age;
          };
        };

        deploy = pkgs.mkShellNoCC {
          env =
            let
              awsAccessKeyId = "AKIA2GKH7CBDHA4OSHRD"; # gitleaks:allow
            in
            {
              TF_VAR_aws_access_key = awsAccessKeyId;
              AWS_ACCESS_KEY_ID = awsAccessKeyId; # Automatically source for backend config (`tofu init`)
            };
          shellHook =
            let
              installationScript = inputs.agenix-shell.lib.installationScript system {
                secrets = {
                  AWS_SECRET_ACCESS_KEY.file = ./secrets/aws-secret-key.age; # Automatically source for backend config (`tofu init`)

                  TF_VAR_aws_secret_key.file = ./secrets/aws-secret-key.age;
                  TF_VAR_cloudflare_api_token.file = ./secrets/cloudflare-api-token.age;
                  TF_VAR_github_token.file = ./secrets/github-token.age;
                  TF_VAR_hcloud_token.file = ./secrets/hcloud-token.age;
                  TF_VAR_neon_api_key.file = ./secrets/neon-api-key.age;
                };
              };
            in
            ''
              source ${lib.getExe installationScript}
            '';
          packages =
            let
              pkgs = inputs'.nixpkgs-for-opentofu.legacyPackages;
              openTofuWithPlugins = pkgs.opentofu.withPlugins (p: [
                # keep-sorted start
                p.cloudflare_cloudflare
                p.hashicorp_aws
                p.hashicorp_external
                p.hashicorp_null
                p.hashicorp_tls
                p.hetznercloud_hcloud
                p.integrations_github
                p.kislerdm_neon
                # keep-sorted end

                # nixos-anwyhere (Git module) dependencies
                # keep-sorted start
                p.hashicorp_external
                p.hashicorp_null
                # keep-sorted end
              ]);
            in
            [ openTofuWithPlugins ];
        };
      };
    };
}