asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: evaluate NixOS in the job, build on the server

Browse source 
The first run failed with "home directory /homeless-shelter exists":
job containers are unprivileged, Nix cannot sandbox builds in them, and
unsandboxed builds trip over each other's leftovers.

Evaluate the system in the job instead, which still catches broken
options before main, and let nixos-rebuild build on the target host,
where the Nix daemon has a proper sandbox.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 17:05:14 +04:00
commit a3015caae1
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nixos/README.md
View file

@ -20,8 +20,8 @@ Docker-compatible socket, which the CI runner uses to start jobs.
## Changing something
Edit, push a branch (CI builds the system), merge to `main` (CI
deploys). By hand, over WireGuard:
Edit, push a branch (CI evaluates the system), merge to `main` (CI
builds it on the server and switches to it). By hand, over WireGuard:
```sh
nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20