From 0b331bc5f1d1ba19a2e1c0f89717ce73ca3e5c4b Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 12 Nov 2026 17:05:14 +0400
Subject: [PATCH] ci: evaluate NixOS in the job, build on the server

The first run failed with "home directory /homeless-shelter exists":
job containers are unprivileged, Nix cannot sandbox builds in them, and
unsandboxed builds trip over each other's leftovers.

Evaluate the system in the job instead, which still catches broken
options before main, and let nixos-rebuild build on the target host,
where the Nix daemon has a proper sandbox.

Assisted-by: Claude:fable-5-2
---
 .forgejo/workflows/nixos.yaml | 13 ++++++++-----
 README.md                     |  2 +-
 nixos/README.md               |  4 ++--
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/.forgejo/workflows/nixos.yaml b/.forgejo/workflows/nixos.yaml
index 4b031f8..40c252e 100644
--- a/.forgejo/workflows/nixos.yaml
+++ b/.forgejo/workflows/nixos.yaml
@@ -1,7 +1,7 @@
 name: nixos
 
-# every push: build the system, so a broken config never reaches main
-# main:       then switch asxpio-services to it
+# every push: evaluate the system, so a broken config never reaches main
+# main:       then build it on asxpio-services and switch to it
 #
 # Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
 # the server by sops-nix, so CI holds none of them.
@@ -29,9 +29,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build
+      # Job containers are unprivileged, so Nix cannot sandbox builds in
+      # them. Evaluating the system catches config errors; the build
+      # itself happens on the server during the deploy.
+      - name: Evaluate
         working-directory: nixos
-        run: nix build .#nixosConfigurations.asxpio-services.config.system.build.toplevel --no-link --print-out-paths
+        run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath
 
       - name: Set up SSH
         if: github.ref == 'refs/heads/main'
@@ -58,7 +61,7 @@ jobs:
         run: >
           nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
           nixos-rebuild switch --flake .#asxpio-services
-          --target-host asxpio-services --sudo
+          --target-host asxpio-services --build-host asxpio-services --sudo
 
       - name: Remove credentials
         if: always()
diff --git a/README.md b/README.md
index debbc20..74d10ef 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ blog, czsk, vhpbot, storage). Each deploys from its own repository into
 
 Edit, push a branch, merge to `main`.
 
-- A branch push builds the NixOS system and dry-runs Ansible against
+- A branch push evaluates the NixOS system and dry-runs Ansible against
   asxpio-ops.
 - `main` then switches asxpio-services to the new system and applies
   Ansible to asxpio-ops.
diff --git a/nixos/README.md b/nixos/README.md
index 00b7564..2e4848e 100644
--- a/nixos/README.md
+++ b/nixos/README.md
@@ -20,8 +20,8 @@ Docker-compatible socket, which the CI runner uses to start jobs.
 
 ## Changing something
 
-Edit, push a branch (CI builds the system), merge to `main` (CI
-deploys). By hand, over WireGuard:
+Edit, push a branch (CI evaluates the system), merge to `main` (CI
+builds it on the server and switches to it). By hand, over WireGuard:
 
 ```sh
 nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20