From 93b196f86886ec0516f4e4146313cafcd8e817bf Mon Sep 17 00:00:00 2001 From: Martin Fischer Date: Sat, 17 Oct 2026 17:15:45 +0200 Subject: refactor: make workstation packages buildable via packages.* --- AGENTS.md | 4 +- nixos/default.nix | 10 +++ nixos/profiles/workstation/default.nix | 12 +--- nixos/profiles/workstation/llm.nix | 72 -------------------- nixos/profiles/workstation/pkgs/pi.nix | 79 ++++++++++++++++++++++ .../profiles/workstation/pkgs/scripts/package.nix | 11 +++ nixos/profiles/workstation/pkgs/scripts/src/ed | 12 ++++ .../profiles/workstation/pkgs/scripts/src/rsqlite | 15 ++++ nixos/profiles/workstation/scripts/ed | 12 ---- nixos/profiles/workstation/scripts/rsqlite | 15 ---- 10 files changed, 132 insertions(+), 110 deletions(-) delete mode 100644 nixos/profiles/workstation/llm.nix create mode 100644 nixos/profiles/workstation/pkgs/pi.nix create mode 100644 nixos/profiles/workstation/pkgs/scripts/package.nix create mode 100755 nixos/profiles/workstation/pkgs/scripts/src/ed create mode 100755 nixos/profiles/workstation/pkgs/scripts/src/rsqlite delete mode 100755 nixos/profiles/workstation/scripts/ed delete mode 100755 nixos/profiles/workstation/scripts/rsqlite diff --git a/AGENTS.md b/AGENTS.md index 0ad33dc..53c787f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -34,10 +34,10 @@ To get the store path to a pin, use the `get-path` npins subcommand: npins -d nixos/npins get-path -Build a package under `nixos/profiles/server/pkgs/` +Build a package under `nixos/profiles//pkgs/` (both `.nix` and `/package.nix` map to ``): - nix build --no-link --file nixos packages.server. + nix build --no-link --file nixos packages.. ## Documentation diff --git a/nixos/default.nix b/nixos/default.nix index c164c7f..7a3d1bf 100644 --- a/nixos/default.nix +++ b/nixos/default.nix @@ -62,5 +62,15 @@ rec { directory = ./profiles/server/pkgs; callPackage = pkgs.newScope { inherit sources; }; }; + + workstation = + let + pkgs = import sources.nixos.outPath { }; + pkgs-unstable = import sources.nixos-unstable.outPath { }; + in + pkgs.lib.packagesFromDirectoryRecursive { + directory = ./profiles/workstation/pkgs; + callPackage = pkgs.newScope { inherit (pkgs-unstable) pi-coding-agent; }; + }; }; } diff --git a/nixos/profiles/workstation/default.nix b/nixos/profiles/workstation/default.nix index 77891fe..fd0a44d 100644 --- a/nixos/profiles/workstation/default.nix +++ b/nixos/profiles/workstation/default.nix @@ -27,7 +27,6 @@ in ./firefox.nix ./dev.nix ./create.nix - ./llm.nix ]; config = { @@ -84,18 +83,13 @@ in vim-full + (callPackage ./pkgs/pi.nix { inherit (pkgs-unstable) pi-coding-agent; }) + (callPackage ./pkgs/scripts/package.nix {}) + cmd50 (writeShellScriptBin "xdg-open" '' ${cmd50}/bin/open "$@" '') - (stdenv.mkDerivation { - name = "workstation-scripts"; - src = ./scripts; - installPhase = '' - mkdir -p $out/bin - cp $src/* $out/bin/ - ''; - }) restic cups skim diff --git a/nixos/profiles/workstation/llm.nix b/nixos/profiles/workstation/llm.nix deleted file mode 100644 index a0dfc92..0000000 --- a/nixos/profiles/workstation/llm.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ pkgs, pkgs-unstable, ... }: - -let - sbox = pkgs.writeShellScriptBin "sbox" '' - set -euo pipefail - - ${pkgs.coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi" - - bwrap_args=( - --die-with-parent - --unshare-pid - --unshare-uts - --unshare-cgroup - --tmpfs / - --dev /dev - --proc /proc - --bind /tmp/pi /tmp - --ro-bind /etc /etc - --bind /nix/store /nix/store - --ro-bind /usr/bin/env /usr/bin/env - --setenv NIX_REMOTE daemon - --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket - --dir /run - --ro-bind-try /run/current-system /run/current-system - # mount git and jj config - --ro-bind "$HOME/.config" "$HOME/.config" - --ro-bind "$HOME/repos/config" "$HOME/repos/config" - # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841 - --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj" - --setenv CARGO_HOME "$HOME/.local/share/cargo" - --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo" - ) - - exec ${pkgs.bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@" - ''; - - pi = pkgs.writeShellScriptBin "pi" '' - set -euo pipefail - - physical_pwd="$(${pkgs.coreutils}/bin/pwd -P)" - - exec ${sbox}/bin/sbox \ - --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \ - --bind "$HOME/.config/pi" "$HOME/.config/pi" \ - --bind "$physical_pwd" "$physical_pwd" \ - --chdir "$physical_pwd" \ - ${pkgs-unstable.pi-coding-agent}/bin/pi \ - --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \ - --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \ - "$@" - ''; - - pit = pkgs.writeShellScriptBin "pit" '' - set -euo pipefail - - tmp_cwd="$(${pkgs.coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)" - cleanup() { - ${pkgs.coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true - } - trap cleanup EXIT - - cd "$tmp_cwd" - exec ${pi}/bin/pi "$@" - ''; -in -{ - environment.systemPackages = [ - sbox - pi - pit - ]; -} diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix new file mode 100644 index 0000000..00e588a --- /dev/null +++ b/nixos/profiles/workstation/pkgs/pi.nix @@ -0,0 +1,79 @@ +{ + bubblewrap, + coreutils, + pi-coding-agent, + symlinkJoin, + writeShellScriptBin, +}: + +let + sbox = writeShellScriptBin "sbox" '' + set -euo pipefail + + ${coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi" + + bwrap_args=( + --die-with-parent + --unshare-pid + --unshare-uts + --unshare-cgroup + --tmpfs / + --dev /dev + --proc /proc + --bind /tmp/pi /tmp + --ro-bind /etc /etc + --bind /nix/store /nix/store + --ro-bind /usr/bin/env /usr/bin/env + --setenv NIX_REMOTE daemon + --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket + --dir /run + --ro-bind-try /run/current-system /run/current-system + # mount git and jj config + --ro-bind "$HOME/.config" "$HOME/.config" + --ro-bind "$HOME/repos/config" "$HOME/repos/config" + # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841 + --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj" + --setenv CARGO_HOME "$HOME/.local/share/cargo" + --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo" + ) + + exec ${bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@" + ''; + + pi = writeShellScriptBin "pi" '' + set -euo pipefail + + physical_pwd="$(${coreutils}/bin/pwd -P)" + + exec ${sbox}/bin/sbox \ + --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \ + --bind "$HOME/.config/pi" "$HOME/.config/pi" \ + --bind "$physical_pwd" "$physical_pwd" \ + --chdir "$physical_pwd" \ + ${pi-coding-agent}/bin/pi \ + --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \ + --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \ + "$@" + ''; + + pit = writeShellScriptBin "pit" '' + set -euo pipefail + + tmp_cwd="$(${coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)" + cleanup() { + ${coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true + } + trap cleanup EXIT + + cd "$tmp_cwd" + exec ${pi}/bin/pi "$@" + ''; +in +symlinkJoin { + name = "pi-sandboxed"; + paths = [ + sbox + pi + pit + ]; +} diff --git a/nixos/profiles/workstation/pkgs/scripts/package.nix b/nixos/profiles/workstation/pkgs/scripts/package.nix new file mode 100644 index 0000000..53d408a --- /dev/null +++ b/nixos/profiles/workstation/pkgs/scripts/package.nix @@ -0,0 +1,11 @@ +{ stdenvNoCC }: + +stdenvNoCC.mkDerivation { + name = "workstation-scripts"; + src = ./src; + + installPhase = '' + mkdir -p $out/bin + cp $src/* $out/bin/ + ''; +} diff --git a/nixos/profiles/workstation/pkgs/scripts/src/ed b/nixos/profiles/workstation/pkgs/scripts/src/ed new file mode 100755 index 0000000..e6c23d3 --- /dev/null +++ b/nixos/profiles/workstation/pkgs/scripts/src/ed @@ -0,0 +1,12 @@ +#!/usr/bin/env bash + +list_files() { + if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then + git -c core.quotePath=false ls-files --cached --others --exclude-standard + else + find . -type f -not -path "*/.*" + fi +} + +files=$(list_files | sk --no-info "$@") || exit +$VISUAL "$files" diff --git a/nixos/profiles/workstation/pkgs/scripts/src/rsqlite b/nixos/profiles/workstation/pkgs/scripts/src/rsqlite new file mode 100755 index 0000000..d9dc2ae --- /dev/null +++ b/nixos/profiles/workstation/pkgs/scripts/src/rsqlite @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +if [[ "$#" != 2 && "$#" != "3" ]]; then + echo "usage: $0 [sql]" + exit 1 +fi + +printf -v path %q "$2" + +if [[ "$#" == "3" ]]; then + printf -v sql %q "$3" +else + sql="" +fi + +ssh "$1" -t "sudo su -c 'sqlite3 /var/lib/$path $sql'" diff --git a/nixos/profiles/workstation/scripts/ed b/nixos/profiles/workstation/scripts/ed deleted file mode 100755 index e6c23d3..0000000 --- a/nixos/profiles/workstation/scripts/ed +++ /dev/null @@ -1,12 +0,0 @@ -#!/usr/bin/env bash - -list_files() { - if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then - git -c core.quotePath=false ls-files --cached --others --exclude-standard - else - find . -type f -not -path "*/.*" - fi -} - -files=$(list_files | sk --no-info "$@") || exit -$VISUAL "$files" diff --git a/nixos/profiles/workstation/scripts/rsqlite b/nixos/profiles/workstation/scripts/rsqlite deleted file mode 100755 index d9dc2ae..0000000 --- a/nixos/profiles/workstation/scripts/rsqlite +++ /dev/null @@ -1,15 +0,0 @@ -#!/usr/bin/env bash -if [[ "$#" != 2 && "$#" != "3" ]]; then - echo "usage: $0 [sql]" - exit 1 -fi - -printf -v path %q "$2" - -if [[ "$#" == "3" ]]; then - printf -v sql %q "$3" -else - sql="" -fi - -ssh "$1" -t "sudo su -c 'sqlite3 /var/lib/$path $sql'" -- cgit v1.3.1