From a3015caae12c3ea1217a54b4f3a5e51307fe7284 Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Thu, 12 Nov 2026 17:05:14 +0400 Subject: [PATCH] ci: evaluate NixOS in the job, build on the server The first run failed with "home directory /homeless-shelter exists": job containers are unprivileged, Nix cannot sandbox builds in them, and unsandboxed builds trip over each other's leftovers. Evaluate the system in the job instead, which still catches broken options before main, and let nixos-rebuild build on the target host, where the Nix daemon has a proper sandbox. Assisted-by: Claude:fable-5-2 --- .forgejo/workflows/nixos.yaml | 13 ++++++++----- nixos/README.md | 4 ++-- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.forgejo/workflows/nixos.yaml b/.forgejo/workflows/nixos.yaml index 4b031f8..40c252e 100644 --- a/.forgejo/workflows/nixos.yaml +++ b/.forgejo/workflows/nixos.yaml @@ -1,7 +1,7 @@ name: nixos -# every push: build the system, so a broken config never reaches main -# main: then switch asxpio-services to it +# every push: evaluate the system, so a broken config never reaches main +# main: then build it on asxpio-services and switch to it # # Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on # the server by sops-nix, so CI holds none of them. @@ -29,9 +29,12 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Build + # Job containers are unprivileged, so Nix cannot sandbox builds in + # them. Evaluating the system catches config errors; the build + # itself happens on the server during the deploy. + - name: Evaluate working-directory: nixos - run: nix build .#nixosConfigurations.asxpio-services.config.system.build.toplevel --no-link --print-out-paths + run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath - name: Set up SSH if: github.ref == 'refs/heads/main' @@ -58,7 +61,7 @@ jobs: run: > nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c nixos-rebuild switch --flake .#asxpio-services - --target-host asxpio-services --sudo + --target-host asxpio-services --build-host asxpio-services --sudo - name: Remove credentials if: always() diff --git a/nixos/README.md b/nixos/README.md index 00b7564..2e4848e 100644 --- a/nixos/README.md +++ b/nixos/README.md @@ -20,8 +20,8 @@ Docker-compatible socket, which the CI runner uses to start jobs. ## Changing something -Edit, push a branch (CI builds the system), merge to `main` (CI -deploys). By hand, over WireGuard: +Edit, push a branch (CI evaluates the system), merge to `main` (CI +builds it on the server and switches to it). By hand, over WireGuard: ```sh nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20