Sergei Poljanski
0b331bc5f1
The first run failed with "home directory /homeless-shelter exists": job containers are unprivileged, Nix cannot sandbox builds in them, and unsandboxed builds trip over each other's leftovers. Evaluate the system in the job instead, which still catches broken options before main, and let nixos-rebuild build on the target host, where the Nix daemon has a proper sandbox. Assisted-by: Claude:fable-5-2
68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
name: nixos
|
|
|
|
# every push: evaluate the system, so a broken config never reaches main
|
|
# main: then build it on asxpio-services and switch to it
|
|
#
|
|
# Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
|
|
# the server by sops-nix, so CI holds none of them.
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'nixos/**'
|
|
- '.forgejo/workflows/nixos.yaml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
asxpio-services:
|
|
runs-on: nix-latest
|
|
env:
|
|
NIX_CONFIG: |
|
|
experimental-features = nix-command flakes
|
|
build-users-group =
|
|
sandbox = false
|
|
NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
|
|
steps:
|
|
- name: Prepare container for actions
|
|
run: nix-env -iA nixpkgs.nodejs_22
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# Job containers are unprivileged, so Nix cannot sandbox builds in
|
|
# them. Evaluating the system catches config errors; the build
|
|
# itself happens on the server during the deploy.
|
|
- name: Evaluate
|
|
working-directory: nixos
|
|
run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath
|
|
|
|
- name: Set up SSH
|
|
if: github.ref == 'refs/heads/main'
|
|
env:
|
|
SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
|
|
run: |
|
|
umask 077
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
|
|
cp ansible/known_hosts ~/.ssh/known_hosts
|
|
# The runner's own host is reached through asxpio-ops: a job
|
|
# container connecting to its host arrives from a bridge
|
|
# address that sshd and the firewall refuse.
|
|
cat > ~/.ssh/config <<'EOF'
|
|
Host asxpio-services
|
|
HostName 10.10.0.20
|
|
User deploy
|
|
ProxyJump deploy@10.10.0.10
|
|
EOF
|
|
|
|
- name: Deploy
|
|
if: github.ref == 'refs/heads/main'
|
|
working-directory: nixos
|
|
run: >
|
|
nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
|
|
nixos-rebuild switch --flake .#asxpio-services
|
|
--target-host asxpio-services --build-host asxpio-services --sudo
|
|
|
|
- name: Remove credentials
|
|
if: always()
|
|
run: rm -f ~/.ssh/id_ed25519
|