name: nixos

# every push: evaluate the system, so a broken config never reaches main
# main:       then build it on asxpio-services and switch to it
#
# Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
# the server by sops-nix, so CI holds none of them.

on:
  push:
    paths:
      - 'nixos/**'
      - '.forgejo/workflows/nixos.yaml'
  workflow_dispatch:

jobs:
  asxpio-services:
    runs-on: nix-latest
    env:
      NIX_CONFIG: |
        experimental-features = nix-command flakes
        build-users-group =
        sandbox = false
      NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
    steps:
      - name: Prepare container for actions
        run: nix-env -iA nixpkgs.nodejs_22

      - name: Checkout
        uses: actions/checkout@v4

      # Job containers are unprivileged, so Nix cannot sandbox builds in
      # them. Evaluating the system catches config errors; the build
      # itself happens on the server during the deploy.
      - name: Evaluate
        working-directory: nixos
        run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath

      - name: Set up SSH
        if: github.ref == 'refs/heads/main'
        env:
          SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
        run: |
          umask 077
          mkdir -p ~/.ssh
          printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
          cp ansible/known_hosts ~/.ssh/known_hosts
          # The runner's own host is reached through asxpio-ops: a job
          # container connecting to its host arrives from a bridge
          # address that sshd and the firewall refuse.
          cat > ~/.ssh/config <<'EOF'
          Host asxpio-services
            HostName 10.10.0.20
            User deploy
            ProxyJump deploy@10.10.0.10
          EOF

      - name: Deploy
        if: github.ref == 'refs/heads/main'
        working-directory: nixos
        run: >
          nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
          nixos-rebuild switch --flake .#asxpio-services
          --target-host asxpio-services --build-host asxpio-services --sudo

      - name: Remove credentials
        if: always()
        run: rm -f ~/.ssh/id_ed25519