upgrading fwminex too

data.nix

@@ -69,7 +69,7 @@ rec {
       jakstIP = "100.89.176.5";
     };
     "fwminex.motiejus.jakst" = rec {
-      extraHostNames = [jakstIP];
+      extraHostNames = [jakstIP vno1IP];
       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
       jakstIP = "100.89.176.6";
       vno1IP = "192.168.189.10";

hosts/vno1-oh2/configuration.nix

@@ -186,6 +186,12 @@
             ".#vno3-rp3b"
             ".#fra1-a"
           ];
+          deployIfPresent = [
+            {
+              derivationTarget = ".#fwminex";
+              altHostname = myData.hosts."fwminex.motiejus.jakst".vno1IP;
+            }
+          ];
         };
 
         follower = {

modules/services/deployerbot/default.nix

@@ -4,10 +4,37 @@
   pkgs,
   myData,
   ...
-}: {
+}: let
+  cfg = config.mj.services.deployerbot;
+  mkOptional = {
+    derivationTarget,
+    altHostname,
+  }: ''
+    if ping -c 1 ${altHostname}; then
+      ${pkgs.deploy-rs}/bin/deploy \
+        --ssh-opts="-i ''${CREDENTIALS_DIRECTORY}/ssh-key" \
+        --ssh-user=deployerbot-follower \
+        --confirm-timeout 60 \
+        --hostname ${altHostname} \
+        --targets ${derivationTarget} -- \
+          --accept-flake-config
+    fi
+  '';
+in {
   options.mj.services.deployerbot.main = with lib.types; {
     enable = lib.mkEnableOption "Enable system updater orchestrator";
     deployDerivations = lib.mkOption {type = listOf str;};
+    deployIfPresent = lib.mkOption {
+      type = listOf (submodule (
+        {...}: {
+          options = {
+            derivationTarget = lib.mkOption {type = str;};
+            altHostname = lib.mkOption {type = str;};
+          };
+        }
+      ));
+      default = [];
+    };
     uidgid = lib.mkOption {type = int;};
     repo = lib.mkOption {type = str;};
   };
@@ -19,90 +46,92 @@
   };
 
   config = lib.mkMerge [
-    (with config.mj.services.deployerbot.main;
+    (lib.mkIf cfg.main.enable {
-      lib.mkIf enable {
+      # TODO: git config --global user.email bot@jakstys.lt
-        # TODO: git config --global user.email bot@jakstys.lt
+      users.users.deployerbot-main = {
-        users.users.deployerbot-main = {
+        description = "Deployerbot Main";
-          description = "Deployerbot Main";
+        home = "/var/lib/deployerbot-main";
-          home = "/var/lib/deployerbot-main";
+        useDefaultShell = true;
+        group = "deployerbot-main";
+        isSystemUser = true;
+        createHome = true;
+        uid = cfg.main.uidgid;
+      };
+      users.groups.deployerbot-main.gid = cfg.main.uidgid;
+
+      systemd.services.deployerbot = {
+        description = "Update all known systems";
+        environment = {TZ = "UTC";};
+        path = [pkgs.git pkgs.openssh pkgs.nix];
+        restartIfChanged = false;
+        serviceConfig = {
+          Type = "oneshot";
+          User = "deployerbot-main";
+          WorkingDirectory = config.users.users.deployerbot-main.home;
+          LoadCredential = ["ssh-key:/etc/ssh/ssh_host_ed25519_key"];
+        };
+        script = let
+          deployDerivationsStr = builtins.concatStringsSep " " cfg.main.deployDerivations;
+        in ''
+          set -x
+          export GIT_SSH_COMMAND="ssh -i ''${CREDENTIALS_DIRECTORY}/ssh-key"
+          if [[ ! -d config ]]; then
+            git clone ${cfg.main.repo} config
+            cd config
+          else
+            cd config
+            git fetch origin
+            git reset --hard origin/main
+          fi
+
+          nix flake update --accept-flake-config --commit-lock-file
+
+          ${pkgs.deploy-rs}/bin/deploy \
+            --ssh-opts="-i ''${CREDENTIALS_DIRECTORY}/ssh-key" \
+            --ssh-user=deployerbot-follower \
+            --confirm-timeout 60 \
+            --targets ${deployDerivationsStr} -- \
+              --accept-flake-config
+
+          # Optional deployments
+          ${lib.concatLines (map mkOptional cfg.main.deployIfPresent)}
+
+          # done
+          git push origin main
+        '';
+      };
+
+      systemd.timers.deployerbot = {
+        description = "deployerbot-main timer";
+        wantedBy = ["timers.target"];
+        # 15:38 UTC was the latest merge that I have observed since
+        # making the commit by looking at 3 commits of this repo.
+        # Let's try to be optimistic.
+        timerConfig.OnCalendar = "*-*-* 23:30:00 UTC";
+      };
+
+      mj.base.unitstatus.units = ["deployerbot"];
+
+      nix.settings.trusted-users = ["deployerbot-main"];
+    })
+    (lib.mkIf cfg.follower.enable {
+      users.users = {
+        deployerbot-follower = {
+          description = "Deployerbot Follower";
+          home = "/var/lib/deployerbot-follower";
           useDefaultShell = true;
-          group = "deployerbot-main";
+          group = "deployerbot-follower";
+          extraGroups = ["wheel"];
           isSystemUser = true;
           createHome = true;
-          uid = uidgid;
+          uid = cfg.follower.uidgid;
+          openssh.authorizedKeys.keys = let
+            restrictedPubKey = "from=\"${myData.subnets.tailscale.sshPattern}\" " + cfg.follower.publicKey;
+          in [restrictedPubKey];
         };
-        users.groups.deployerbot-main.gid = uidgid;
+      };
-
+      users.groups.deployerbot-follower.gid = cfg.follower.uidgid;
-        systemd.services.deployerbot = {
+      nix.settings.trusted-users = ["deployerbot-follower"];
-          description = "Update all known systems";
+    })
-          environment = {TZ = "UTC";};
-          path = [pkgs.git pkgs.openssh pkgs.nix];
-          restartIfChanged = false;
-          serviceConfig = {
-            Type = "oneshot";
-            User = "deployerbot-main";
-            WorkingDirectory = config.users.users.deployerbot-main.home;
-            LoadCredential = ["ssh-key:/etc/ssh/ssh_host_ed25519_key"];
-          };
-          script = let
-            deployDerivationsStr = builtins.concatStringsSep " " deployDerivations;
-          in ''
-            set -x
-            export GIT_SSH_COMMAND="ssh -i ''${CREDENTIALS_DIRECTORY}/ssh-key"
-            if [[ ! -d config ]]; then
-              git clone ${repo} config
-              cd config
-            else
-              cd config
-              git fetch origin
-              git reset --hard origin/main
-            fi
-
-            nix flake update --accept-flake-config --commit-lock-file
-
-            ${pkgs.deploy-rs}/bin/deploy \
-              --ssh-opts="-i ''${CREDENTIALS_DIRECTORY}/ssh-key" \
-              --ssh-user=deployerbot-follower \
-              --confirm-timeout 60 \
-              --targets ${deployDerivationsStr} -- \
-                --accept-flake-config
-
-            git push origin main
-          '';
-        };
-
-        systemd.timers.deployerbot = {
-          description = "deployerbot-main timer";
-          wantedBy = ["timers.target"];
-          # 15:38 UTC was the latest merge that I have observed since
-          # making the commit by looking at 3 commits of this repo.
-          # Let's try to be optimistic.
-          timerConfig.OnCalendar = "*-*-* 23:30:00 UTC";
-        };
-
-        mj.base.unitstatus.units = ["deployerbot"];
-
-        nix.settings.trusted-users = ["deployerbot-main"];
-      })
-    (with config.mj.services.deployerbot.follower;
-      lib.mkIf enable {
-        users.users = {
-          deployerbot-follower = {
-            description = "Deployerbot Follower";
-            home = "/var/lib/deployerbot-follower";
-            useDefaultShell = true;
-            group = "deployerbot-follower";
-            extraGroups = ["wheel"];
-            isSystemUser = true;
-            createHome = true;
-            uid = uidgid;
-            openssh.authorizedKeys.keys = let
-              restrictedPubKey = "from=\"${myData.subnets.tailscale.sshPattern}\" " + publicKey;
-            in [restrictedPubKey];
-          };
-        };
-        users.groups.deployerbot-follower.gid = uidgid;
-        nix.settings.trusted-users = ["deployerbot-follower"];
-      })
   ];
 }