rootcell/flake.nix at main · rootcell-ai/rootcell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
{
  description = "rootcell: root-capable coding-agent workspaces with allowlisted egress";

  inputs = {
    nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/0.1";

    home-manager = {
      url = "github:nix-community/home-manager/release-26.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nixos-lima = {
      url = "github:nixos-lima/nixos-lima/v0.0.5";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, home-manager, nixos-lima, ... }:
    let
      # Rootcell currently provisions aarch64-linux guests.
      system = "aarch64-linux";

      # Username inside the guest. MUST agree with:
      #   - GUEST_USER in ./rootcell
      username = "luser";

      pkgs = import nixpkgs {
        inherit system;
        config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
          "claude-code"
          "cursor-cli"
        ];
      };

      mkVM = module: nixpkgs.lib.nixosSystem {
        inherit system;
        specialArgs = { inherit username; };
        modules = [
          nixos-lima.nixosModules.lima
          module
        ];
      };

      rootcellSourceRevision = self.rev or self.dirtyRev or "unknown";
      nixpkgsRevision = nixpkgs.rev or "unknown";

      # Optional host-side packages for running rootcell on macOS through Nix.
      forEachDarwin = nixpkgs.lib.genAttrs [ "aarch64-darwin" "x86_64-darwin" ];
      darwinPkgs = forEachDarwin (sys:
        let
          p = nixpkgs.legacyPackages.${sys};
        in {
          lima = p.lima;
          hostTools = p.buildEnv {
            name = "rootcell-host-tools";
            paths = [
              p.bun
              p.lima
              p.opentofu
            ];
          };
        });
    in
    {
      # Two VMs share common.nix; each pulls in its own role module.
      # Built/switched with `nixos-rebuild switch --flake .#<name>`.
      nixosConfigurations = {
        agent-vm    = mkVM ./agent-vm.nix;
        firewall-vm = mkVM ./firewall-vm.nix;
      };

      # Home Manager only attaches to the agent VM. The firewall VM is an
      # appliance with no interactive user. Built/switched with `home-manager`.
      homeConfigurations.${username} = home-manager.lib.homeManagerConfiguration {
        inherit pkgs;
        extraSpecialArgs = { inherit username; };
        modules = [ ./home.nix ];
      };

      inherit rootcellSourceRevision nixpkgsRevision;

      packages = forEachDarwin (sys: {
        lima    = darwinPkgs.${sys}.lima;
        hostTools = darwinPkgs.${sys}.hostTools;
        default = darwinPkgs.${sys}.hostTools;
      }) // {
        aarch64-linux = {
          "home-manager" = home-manager.packages.${system}.home-manager;
          default = home-manager.packages.${system}.home-manager;
        };
      };
    };
}