cnx-network-clan/flake.nix

{
  inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/26.05.tar.gz";
  inputs.nixpkgs.follows = "clan-core/nixpkgs";
  inputs.treefmt-nix.url = "github:numtide/treefmt-nix";
  inputs.treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
  # Simple NixOS Mailserver, pinned to the branch matching clan-core's nixpkgs.
  inputs.nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-26.05";
  inputs.nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";

  outputs =
    {
      self,
      clan-core,
      nixpkgs,
      ...
    }@inputs:
    let
      # Usage see: https://docs.clan.lol
      clan = clan-core.lib.clan {
        inherit self;
        imports = [ ./clan.nix ];
        specialArgs = { inherit inputs; };

        # Customize nixpkgs
        # pkgsForSystem =
        #   system:
        #   import nixpkgs {
        #     inherit system;
        #     config = {
        #       allowUnfree = true;
        #     };
        #     overlays = [];
        #   };
        secrets.age.plugins = [
          "age-plugin-yubikey"
          "age-plugin-fido2-hmac"
        ];
      };

      systems = [
        "x86_64-linux"
        "aarch64-linux"
        "aarch64-darwin"
        "x86_64-darwin"
      ];
      forAllSystems = nixpkgs.lib.genAttrs systems;
      pkgsFor = system: clan-core.inputs.nixpkgs.legacyPackages.${system};
      treefmtFor = system: inputs.treefmt-nix.lib.evalModule (pkgsFor system) ./fmt.nix;
    in
    {
      inherit (clan.config) nixosConfigurations nixosModules clanInternals;
      clan = clan.config;

      # `nix fmt` and the `nix flake check` formatting gate.
      formatter = forAllSystems (system: (treefmtFor system).config.build.wrapper);
      checks = forAllSystems (system: {
        formatting = (treefmtFor system).config.build.check self;
      });

      # Add the Clan cli tool to the dev shell.
      # Use "nix develop" to enter the dev shell.
      devShells = forAllSystems (
        system:
        let
          clanCli = clan-core.packages.${system}.clan-cli;
          # `clan machines update a b c` normally runs machines in parallel,
          # which interleaves their output and buries the YubiKey PIN prompts.
          # This wrapper (first in PATH) runs them one at a time instead; any
          # flags fall through to the real CLI untouched.
          clanSequential = (pkgsFor system).writeShellScriptBin "clan" ''
            if [ "$#" -gt 3 ] && [ "$1" = machines ] && [ "$2" = update ]; then
              shift 2
              for arg in "$@"; do
                case "$arg" in
                  -*) exec ${clanCli}/bin/clan machines update "$@" ;;
                esac
              done
              for machine in "$@"; do
                ${clanCli}/bin/clan machines update "$machine" || exit
              done
              exit 0
            fi
            exec ${clanCli}/bin/clan "$@"
          '';
        in
        {
          default = (pkgsFor system).mkShell {
            packages = [
              clanSequential
              clanCli
              (treefmtFor system).config.build.wrapper
            ];
          };
        }
      );
    };
}