asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: evaluate NixOS in the job, build on the server

Browse source 
The first run failed with "home directory /homeless-shelter exists":
job containers are unprivileged, Nix cannot sandbox builds in them, and
unsandboxed builds trip over each other's leftovers.

Evaluate the system in the job instead, which still catches broken
options before main, and let nixos-rebuild build on the target host,
where the Nix daemon has a proper sandbox.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 17:05:14 +04:00
commit 0b331bc5f1
3 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

13
.forgejo/workflows/nixos.yaml
View file

@ -1,7 +1,7 @@
name: nixos name: nixos
# every push: build the system, so a broken config never reaches main # every push: evaluate the system, so a broken config never reaches main
# main: then switch asxpio-services to it # main: then build it on asxpio-services and switch to it
# #
# Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on # Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
# the server by sops-nix, so CI holds none of them. # the server by sops-nix, so CI holds none of them.
@ -29,9 +29,12 @@ jobs:
- name: Checkout - name: Checkout
uses: actions/checkout@v4 uses: actions/checkout@v4
- name: Build # Job containers are unprivileged, so Nix cannot sandbox builds in
# them. Evaluating the system catches config errors; the build
# itself happens on the server during the deploy.
- name: Evaluate
working-directory: nixos working-directory: nixos
run: nix build .#nixosConfigurations.asxpio-services.config.system.build.toplevel --no-link --print-out-paths run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath
- name: Set up SSH - name: Set up SSH
if: github.ref == 'refs/heads/main' if: github.ref == 'refs/heads/main'
@ -58,7 +61,7 @@ jobs:
run: > run: >
nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
nixos-rebuild switch --flake .#asxpio-services nixos-rebuild switch --flake .#asxpio-services
--target-host asxpio-services --sudo --target-host asxpio-services --build-host asxpio-services --sudo
- name: Remove credentials - name: Remove credentials
if: always() if: always()

2
README.md
View file

@ -39,7 +39,7 @@ blog, czsk, vhpbot, storage). Each deploys from its own repository into
Edit, push a branch, merge to `main`. Edit, push a branch, merge to `main`.
- A branch push builds the NixOS system and dry-runs Ansible against - A branch push evaluates the NixOS system and dry-runs Ansible against
asxpio-ops. asxpio-ops.
- `main` then switches asxpio-services to the new system and applies - `main` then switches asxpio-services to the new system and applies
Ansible to asxpio-ops. Ansible to asxpio-ops.

4
nixos/README.md
View file

@ -20,8 +20,8 @@ Docker-compatible socket, which the CI runner uses to start jobs.
## Changing something ## Changing something
Edit, push a branch (CI builds the system), merge to `main` (CI Edit, push a branch (CI evaluates the system), merge to `main` (CI
deploys). By hand, over WireGuard: builds it on the server and switches to it). By hand, over WireGuard:
```sh ```sh
nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20 nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20