Add ornithologist LXC

flake.nix

@@ -103,5 +103,10 @@
       (mkHost "nextcloud" {
         suite = "server/lxc";
       })
+
+      # Container for managing server flock.
+      (mkHost "ornithologist" {
+        suite = "server/lxc";
+      })
     ];
 }

helpers.nix

@@ -12,99 +12,101 @@ with inputs.nixpkgs.lib; {
     suite ? "",
     docker ? false,
     hostModules ? [],
-  }:
+  }: let
-    {
+    # Secrets directory.
-      nixosConfigurations.${hostname} = nixosSystem rec {
+    secrets = builtins.toString inputs.secrets;
-        # Architecture.
-        system = platform;
 
-        # nixpkgs config.
+    # Architecture.
-        pkgs = import nixpkgs {
+    system = platform;
-          inherit system;
 
-          config = {
+    # Stable nixpkgs with overlay.
-            # Allow installation of proprietary software.
+    pkgs = import nixpkgs {
-            allowUnfree = true;
+      inherit system;
-            # Allow the installation of packages marked as insecure in nixpkgs.
-            permittedInsecurePackages = [
-              "dotnet-sdk-6.0.428" # For WebOne.
-              "dotnet-runtime-6.0.36" # For WebOne.
-            ];
-          };
 
-          # Import my overlays.
+      config = {
-          overlays = [
+        # Allow installation of proprietary software.
-            (import ./overlay.nix {inherit nixpkgs-unstable nixpkgs-pr-feishin;})
+        allowUnfree = true;
-          ];
+        # Allow the installation of packages marked as insecure in nixpkgs.
-        };
+        permittedInsecurePackages = [
-
+          "dotnet-sdk-6.0.428" # For WebOne.
-        specialArgs = {
+          "dotnet-runtime-6.0.36" # For WebOne.
-          # Pass hostname & inputs to config.
+        ];
-          inherit inputs hostname;
-
-          # Secrets directory.
-          secrets = builtins.toString inputs.secrets;
-        };
-
-        modules =
-          [
-            nixvim.nixosModules.nixvim # Neovim.
-            lanzaboote.nixosModules.lanzaboote # Secure boot.
-            sops-nix.nixosModules.sops # Secrets management.
-
-            ./suites/${suite} # Collection of configuration options for different types of systems.
-            ./hosts/${hostname} # Host-specific config.
-
-            # Home manager.
-            home-manager.nixosModules.home-manager
-            {
-              home-manager = {
-                useGlobalPkgs = true;
-                useUserPackages = true;
-                backupFileExtension = "backup";
-                users.fern = {
-                  # Me!
-                  home.username = "fern";
-                  home.homeDirectory = "/home/fern";
-
-                  # Home manager version.
-                  home.stateVersion = "25.05";
-
-                  # Let Home Manager install and manage itself.
-                  programs.home-manager.enable = true;
-
-                  # Import config.
-                  imports = [./suites/${suite}/home.nix];
-                };
-              };
-            }
-          ]
-          ++ hostModules # Host-specific modules.
-          ++ optionals (docker == true) [./suites/server/docker] # Enable docker if required.
-          ++ (filesystem.listFilesRecursive ./modules); # Custom modules.
       };
-    }
+
-    // optionalAttrs (strings.hasPrefix "server" suite) {
+      # Import my overlays.
-      deploy.nodes.${hostname} = let
+      overlays = [
-        deployPkgs = import nixpkgs {
+        (import ./overlay.nix {inherit nixpkgs-unstable nixpkgs-pr-feishin;})
-          inherit system;
+      ];
-          overlays = [
+    };
-            deploy-rs.overlays.default
+
-            (self: super: {
+    # deploy-rs.
-              deploy-rs = {
+    deployPkgs = import nixpkgs {
-                inherit (pkgs) deploy-rs;
+      inherit system;
-                lib = super.deploy-rs.lib;
+
+      overlays = [
+        deploy-rs.overlays.default
+        (self: super: {
+          deploy-rs = {
+            inherit (pkgs) deploy-rs;
+            lib = super.deploy-rs.lib;
+          };
+        })
+      ];
+    };
+  in {
+    nixosConfigurations.${hostname} = nixosSystem {
+      inherit system pkgs;
+
+      specialArgs = {
+        # Pass variables to config.
+        inherit inputs secrets hostname;
+      };
+
+      modules =
+        [
+          nixvim.nixosModules.nixvim # Neovim.
+          lanzaboote.nixosModules.lanzaboote # Secure boot.
+          sops-nix.nixosModules.sops # Secrets management.
+
+          ./suites/${suite} # Collection of configuration options for different types of systems.
+          ./hosts/${hostname} # Host-specific config.
+
+          # Home manager.
+          home-manager.nixosModules.home-manager
+          {
+            home-manager = {
+              useGlobalPkgs = true;
+              useUserPackages = true;
+              backupFileExtension = "backup";
+              users.fern = {
+                # Me!
+                home.username = "fern";
+                home.homeDirectory = "/home/fern";
+
+                # Home manager version.
+                home.stateVersion = "25.05";
+
+                # Let Home Manager install and manage itself.
+                programs.home-manager.enable = true;
+
+                # Import config.
+                imports = [./suites/${suite}/home.nix];
               };
-            })
+            };
-          ];
+          }
-        };
+        ]
-      in {
+        ++ hostModules # Host-specific modules.
-        hostname = "${hostname}.local";
+        ++ optionals (docker == true) [./suites/server/docker] # Enable docker if required.
-        profiles.system = {
+        ++ (filesystem.listFilesRecursive ./modules); # Custom modules.
-          user = "root";
+    };
-          sshuser = "fern";
+
-          path = deployPkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.${hostname};
+    deploy.nodes.${hostname} = mkIf (strings.hasPrefix "server" suite) {
-        };
+      hostname = "${hostname}.local";
+      profiles.system = {
+        user = "root";
+        sshuser = "fern";
+        path = deployPkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.${hostname};
       };
     };
+  };
 }

hosts/muskduck/default.nix

@@ -39,6 +39,9 @@ with lib; {
     ];
   };
 
+  # Allow emulating aarch64 to build for Raspberry Pi.
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
   # Share Music dir.
   services.samba = {
     enable = true;

hosts/ornithologist/default.nix

@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  # Allow emulating aarch64 to build for Raspberry Pi.
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
+  # Install some packages.
+  environment.systemPackages = with pkgs; [deploy-rs];
+}

suites/desktop/default.nix

@@ -26,9 +26,6 @@ with lib; {
       "udev.log_priority=3"
       "rd.systemd.show_status=auto"
     ];
-
-    # Allow emulating aarch64 to build for Raspberry Pi.
-    binfmt.emulatedSystems = ["aarch64-linux"];
   };
 
   # Enable smart card support (for YubiKey).