ci-images/flake.nix

{
	description = "Standard images that Greg wants to build";
	inputs = {
		nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
		flake-parts.url = "github:hercules-ci/flake-parts";
		greg.url = "github:greg-hellings/nixos-config";
	};

	outputs = inputs@{ self, nixpkgs, flake-utils, greg, flake-parts }:
	flake-parts.lib.mkFlake { inherit inputs; } {
		flake = {
		};
		systems = [
			"x86_64-linux"
			"aarch64-linux"
			"x86_64-darwin"
			"aarch64-darwin"
		];
		perSystem = sys@{ config, pkgs, system, ... }: {
			_module.args.pkgs = import nixpkgs {
				inherit system;
				config.allowUnfree = true;
			};
			packages = {
				vm-test = let
					basicPython = (pkgs.python3.withPackages (p: with p; [ pyyaml ]));
				in pkgs.dockerTools.buildLayeredImage {
					name = "vm-test";
					tag = "latest";
					contents = with pkgs; [
						bash
						pkgs.dockerTools.binSh
						pkgs.dockerTools.caCertificates
						coreutils
						curlWithGnuTls
						pkgs.dockerTools.fakeNss
						gawk
						gnugrep
						findutils
						jq
						packer
						shellcheck
						pkgs.dockerTools.usrBinEnv
						(xonsh.overridePythonAttrs (old: rec { python3 = basicPython; propagatedBuildInputs = old.propagatedBuildInputs ++ [ basicPython.pkgs.pyyaml ];}))
					];
					extraCommands = builtins.concatStringsSep "\n" [
						"mkdir -p tmp"
						"chmod  1777 tmp"
					];
					config.Env = [
						"CURL_CA_BUNDLE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
					];
				};
			};
		};
	};
}