darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(deploy): generalize to any config, all params mandatory (no defaults)

Browse Source
This commit is contained in:
erik
2026-07-13 01:05:28 +02:00
parent 946c44f1d3
commit ec309c8fe1
2 changed files with 54 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+17 -5
View File
@@ -67,14 +67,26 @@ an installer, partitions via disko, installs.
Manual alternative (USB ISO): boot installer, `disko` the disk, then Manual alternative (USB ISO): boot installer, `disko` the disk, then
`nixos-install --flake .#jupiter`. `nixos-install --flake .#jupiter`.
## Rebuild after changes (the daily loop) ## Deploy (the `./deploy` wrapper)
All arguments mandatory — no default host, no default config.
``` ```
# from laptop, build + activate on jupiter over SSH: ./deploy kexec <host> # headless kexec into a RAM installer (RO-root box)
nixos-rebuild switch --flake .#jupiter \ ./deploy install <config> <host> # first install; wipes OS disk, ships host key
--target-host darman@jupiter --use-remote-sudo ./deploy switch <config> <host> # rebuild + activate on a running host
./deploy boot|test <config> <host> # stage for next boot / activate without boot entry
``` ```
Rollback: `nixos-rebuild switch --rollback`, or pick a prior generation at boot. `<config>` is a `nixosConfigurations` name (`jupiter`, `vps`). Its pre-generated
SSH host key lives at `~/.config/homelab/<config>/ssh_host_ed25519_key`.
Examples:
```
./deploy switch jupiter jupiter.sol
./deploy install vps 159.195.64.117
```
Rollback: `nixos-rebuild switch --rollback` on the host, or pick a prior
generation at boot.
## Adding a service ## Adding a service
deploy
+37 -31
View File
@@ -1,15 +1,18 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# Deploy the jupiter NixOS config. # Deploy a NixOS host from this flake. ALL arguments are mandatory (no defaults).
# #
# ./deploy kexec <host> headless-only: for a read-only-root box (ZimaOS) # ./deploy kexec <host> headless kexec into a RAM installer, for a
# where nixos-anywhere can't ssh-copy-id. Uploads a # read-only-root box (ZimaOS) where
# kexec installer (our SSH key baked in) to /tmp and # nixos-anywhere can't ssh-copy-id. Ships our
# boots into it. Then run `install`. # SSH login key. Then run `install`.
# ./deploy install <ip> first install onto a fresh box / running installer # ./deploy install <config> <host> first install (nixos-anywhere). Wipes the
# (nixos-anywhere). Wipes the OS disk. Ships host key. # OS disk. Ships the host's sops key.
# ./deploy [switch] [host] rebuild + activate on a running jupiter (default). # ./deploy switch <config> <host> rebuild + activate on a running host.
# ./deploy boot [host] stage for next boot, don't activate now. # ./deploy boot <config> <host> stage for next boot, don't activate now.
# ./deploy test [host] activate without adding a boot entry. # ./deploy test <config> <host> activate without adding a boot entry.
#
# <config> = a nixosConfigurations name (e.g. jupiter, vps). Its pre-generated
# SSH host key must be at ~/.config/homelab/<config>/ssh_host_ed25519_key.
# #
# Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`). # Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`).
set -euo pipefail set -euo pipefail
@@ -18,18 +21,13 @@ REPO="$(cd "$(dirname "$0")" && pwd)"
cd "$REPO" cd "$REPO"
export PATH="/nix/var/nix/profiles/default/bin:$PATH" export PATH="/nix/var/nix/profiles/default/bin:$PATH"
HOSTKEY="$HOME/.config/homelab/jupiter/ssh_host_ed25519_key" die() { echo "error: $*" >&2; exit 1; }
cmd="${1:-switch}" cmd="${1:-}"; [ -n "$cmd" ] || die "usage: ./deploy <kexec|install|switch|boot|test> ..."
case "$cmd" in
switch|boot|test|install|kexec) shift || true ;;
*) cmd="switch" ;;
esac
case "$cmd" in case "$cmd" in
kexec) kexec)
host="${1:-}" host="${2:-}"; [ -n "$host" ] || die "usage: ./deploy kexec <host>"
[ -n "$host" ] || { echo "usage: ./deploy kexec <ip-or-host>" >&2; exit 1; }
echo ">> building kexec installer + static tools" echo ">> building kexec installer + static tools"
nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball \ nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball \
@@ -45,7 +43,7 @@ case "$cmd" in
o=(-o ControlMaster=auto -o "ControlPath=$cm" -o ControlPersist=300 \ o=(-o ControlMaster=auto -o "ControlPath=$cm" -o ControlPersist=300 \
-o StrictHostKeyChecking=accept-new) -o StrictHostKeyChecking=accept-new)
echo ">> connecting to root@$host (enter the ZimaOS root password once)" echo ">> connecting to root@$host (enter the root password once)"
ssh "${o[@]}" "root@$host" 'mkdir -p /tmp/bin' ssh "${o[@]}" "root@$host" 'mkdir -p /tmp/bin'
scp "${o[@]}" "$cpio" "root@$host:/tmp/bin/cpio" scp "${o[@]}" "$cpio" "root@$host:/tmp/bin/cpio"
scp "${o[@]}" "$bbox" "root@$host:/tmp/bin/gzip" # busybox as gzip (argv0) scp "${o[@]}" "$bbox" "root@$host:/tmp/bin/gzip" # busybox as gzip (argv0)
@@ -58,34 +56,42 @@ case "$cmd" in
ssh "${o[@]}" -O exit "root@$host" 2>/dev/null || true # close control socket ssh "${o[@]}" -O exit "root@$host" 2>/dev/null || true # close control socket
echo ">> box is kexec-ing. Wait ~1-2 min for the installer + network, then:" echo ">> box is kexec-ing. Wait ~1-2 min for the installer + network, then:"
echo " ./deploy install $host" echo " ./deploy install <config> $host"
;; ;;
install) install)
host="${1:-}" config="${2:-}"; host="${3:-}"
[ -n "$host" ] || { echo "usage: ./deploy install <ip-or-host>" >&2; exit 1; } { [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy install <config> <host>"
[ -f "$HOSTKEY" ] || { echo "missing host key: $HOSTKEY" >&2; exit 1; } hostkey="$HOME/.config/homelab/$config/ssh_host_ed25519_key"
[ -f "$hostkey" ] || die "missing host key: $hostkey"
[ -d "./$config" ] || die "no ./$config directory in the repo"
# Stage the pre-generated SSH host key so sops can decrypt on boot #1. # Stage the pre-generated SSH host key so sops can decrypt on boot #1.
stage="$(mktemp -d)" stage="$(mktemp -d)"
trap 'rm -rf "$stage"' EXIT trap 'rm -rf "$stage"' EXIT
install -Dm600 "$HOSTKEY" "$stage/etc/ssh/ssh_host_ed25519_key" install -Dm600 "$hostkey" "$stage/etc/ssh/ssh_host_ed25519_key"
install -Dm644 "$HOSTKEY.pub" "$stage/etc/ssh/ssh_host_ed25519_key.pub" install -Dm644 "$hostkey.pub" "$stage/etc/ssh/ssh_host_ed25519_key.pub"
echo ">> nixos-anywhere onto root@$host (OS disk WILL be wiped)" echo ">> nixos-anywhere .#$config onto root@$host (OS disk WILL be wiped)"
nix run github:nix-community/nixos-anywhere -- \ nix run github:nix-community/nixos-anywhere -- \
--flake ".#jupiter" \ --flake ".#$config" \
--extra-files "$stage" \ --extra-files "$stage" \
--generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \ --generate-hardware-config nixos-generate-config "./$config/hardware-configuration.nix" \
--target-host "root@$host" --target-host "root@$host"
;; ;;
switch|boot|test) switch|boot|test)
host="${1:-jupiter}" config="${2:-}"; host="${3:-}"
echo ">> nixos-rebuild $cmd on darman@$host" { [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy $cmd <config> <host>"
echo ">> nixos-rebuild $cmd .#$config on darman@$host"
nix run nixpkgs#nixos-rebuild -- "$cmd" \ nix run nixpkgs#nixos-rebuild -- "$cmd" \
--flake ".#jupiter" \ --flake ".#$config" \
--target-host "darman@$host" \ --target-host "darman@$host" \
--use-remote-sudo --use-remote-sudo
;; ;;
*)
die "unknown command '$cmd' (kexec|install|switch|boot|test)"
;;
esac esac