motiejus/config
1
Fork 0
Code Packages Releases Activity

upgrading fwminex too

Browse Source
This commit is contained in:
Motiejus Jakštys 2023-09-18 19:50:24 +03:00
parent 9cd5d406cf
commit 5a5ffd6f00
3 changed files with 118 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
data.nix
View File

@ -69,7 +69,7 @@ rec {
jakstIP = "100.89.176.5";
};
"fwminex.motiejus.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [jakstIP vno1IP];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
jakstIP = "100.89.176.6";
vno1IP = "192.168.189.10";

6
hosts/vno1-oh2/configuration.nix
View File

@ -186,6 +186,12 @@
".#vno3-rp3b"
".#fra1-a"
];
deployIfPresent = [
{
derivationTarget = ".#fwminex";
altHostname = myData.hosts."fwminex.motiejus.jakst".vno1IP;
}
];
};
follower = {

193
modules/services/deployerbot/default.nix
View File

@ -4,10 +4,37 @@
pkgs,
myData,
...
}: {
}: let
cfg = config.mj.services.deployerbot;
mkOptional = {
derivationTarget,
altHostname,
}: ''
if ping -c 1 ${altHostname}; then
${pkgs.deploy-rs}/bin/deploy \
--ssh-opts="-i ''${CREDENTIALS_DIRECTORY}/ssh-key" \
--ssh-user=deployerbot-follower \
--confirm-timeout 60 \
--hostname ${altHostname} \
--targets ${derivationTarget} -- \
--accept-flake-config
fi
'';
in {
options.mj.services.deployerbot.main = with lib.types; {
enable = lib.mkEnableOption "Enable system updater orchestrator";
deployDerivations = lib.mkOption {type = listOf str;};
deployIfPresent = lib.mkOption {
type = listOf (submodule (
{...}: {
options = {
derivationTarget = lib.mkOption {type = str;};
altHostname = lib.mkOption {type = str;};
};
}
));
default = [];
};
uidgid = lib.mkOption {type = int;};
repo = lib.mkOption {type = str;};
};
@ -19,90 +46,92 @@
};
config = lib.mkMerge [
(with config.mj.services.deployerbot.main;
lib.mkIf enable {
# TODO: git config --global user.email bot@jakstys.lt
users.users.deployerbot-main = {
description = "Deployerbot Main";
home = "/var/lib/deployerbot-main";
(lib.mkIf cfg.main.enable {
# TODO: git config --global user.email bot@jakstys.lt
users.users.deployerbot-main = {
description = "Deployerbot Main";
home = "/var/lib/deployerbot-main";
useDefaultShell = true;
group = "deployerbot-main";
isSystemUser = true;
createHome = true;
uid = cfg.main.uidgid;
};
users.groups.deployerbot-main.gid = cfg.main.uidgid;
systemd.services.deployerbot = {
description = "Update all known systems";
environment = {TZ = "UTC";};
path = [pkgs.git pkgs.openssh pkgs.nix];
restartIfChanged = false;
serviceConfig = {
Type = "oneshot";
User = "deployerbot-main";
WorkingDirectory = config.users.users.deployerbot-main.home;
LoadCredential = ["ssh-key:/etc/ssh/ssh_host_ed25519_key"];
};
script = let
deployDerivationsStr = builtins.concatStringsSep " " cfg.main.deployDerivations;
in ''
set -x
export GIT_SSH_COMMAND="ssh -i ''${CREDENTIALS_DIRECTORY}/ssh-key"
if [[ ! -d config ]]; then
git clone ${cfg.main.repo} config
cd config
else
cd config
git fetch origin
git reset --hard origin/main
fi
nix flake update --accept-flake-config --commit-lock-file
${pkgs.deploy-rs}/bin/deploy \
--ssh-opts="-i ''${CREDENTIALS_DIRECTORY}/ssh-key" \
--ssh-user=deployerbot-follower \
--confirm-timeout 60 \
--targets ${deployDerivationsStr} -- \
--accept-flake-config
# Optional deployments
${lib.concatLines (map mkOptional cfg.main.deployIfPresent)}
# done
git push origin main
'';
};
systemd.timers.deployerbot = {
description = "deployerbot-main timer";
wantedBy = ["timers.target"];
# 15:38 UTC was the latest merge that I have observed since
# making the commit by looking at 3 commits of this repo.
# Let's try to be optimistic.
timerConfig.OnCalendar = "*-*-* 23:30:00 UTC";
};
mj.base.unitstatus.units = ["deployerbot"];
nix.settings.trusted-users = ["deployerbot-main"];
})
(lib.mkIf cfg.follower.enable {
users.users = {
deployerbot-follower = {
description = "Deployerbot Follower";
home = "/var/lib/deployerbot-follower";
useDefaultShell = true;
group = "deployerbot-main";
group = "deployerbot-follower";
extraGroups = ["wheel"];
isSystemUser = true;
createHome = true;
uid = uidgid;
uid = cfg.follower.uidgid;
openssh.authorizedKeys.keys = let
restrictedPubKey = "from=\"${myData.subnets.tailscale.sshPattern}\" " + cfg.follower.publicKey;
in [restrictedPubKey];
};
users.groups.deployerbot-main.gid = uidgid;
systemd.services.deployerbot = {
description = "Update all known systems";
environment = {TZ = "UTC";};
path = [pkgs.git pkgs.openssh pkgs.nix];
restartIfChanged = false;
serviceConfig = {
Type = "oneshot";
User = "deployerbot-main";
WorkingDirectory = config.users.users.deployerbot-main.home;
LoadCredential = ["ssh-key:/etc/ssh/ssh_host_ed25519_key"];
};
script = let
deployDerivationsStr = builtins.concatStringsSep " " deployDerivations;
in ''
set -x
export GIT_SSH_COMMAND="ssh -i ''${CREDENTIALS_DIRECTORY}/ssh-key"
if [[ ! -d config ]]; then
git clone ${repo} config
cd config
else
cd config
git fetch origin
git reset --hard origin/main
fi
nix flake update --accept-flake-config --commit-lock-file
${pkgs.deploy-rs}/bin/deploy \
--ssh-opts="-i ''${CREDENTIALS_DIRECTORY}/ssh-key" \
--ssh-user=deployerbot-follower \
--confirm-timeout 60 \
--targets ${deployDerivationsStr} -- \
--accept-flake-config
git push origin main
'';
};
systemd.timers.deployerbot = {
description = "deployerbot-main timer";
wantedBy = ["timers.target"];
# 15:38 UTC was the latest merge that I have observed since
# making the commit by looking at 3 commits of this repo.
# Let's try to be optimistic.
timerConfig.OnCalendar = "*-*-* 23:30:00 UTC";
};
mj.base.unitstatus.units = ["deployerbot"];
nix.settings.trusted-users = ["deployerbot-main"];
})
(with config.mj.services.deployerbot.follower;
lib.mkIf enable {
users.users = {
deployerbot-follower = {
description = "Deployerbot Follower";
home = "/var/lib/deployerbot-follower";
useDefaultShell = true;
group = "deployerbot-follower";
extraGroups = ["wheel"];
isSystemUser = true;
createHome = true;
uid = uidgid;
openssh.authorizedKeys.keys = let
restrictedPubKey = "from=\"${myData.subnets.tailscale.sshPattern}\" " + publicKey;
in [restrictedPubKey];
};
};
users.groups.deployerbot-follower.gid = uidgid;
nix.settings.trusted-users = ["deployerbot-follower"];
})
};
users.groups.deployerbot-follower.gid = cfg.follower.uidgid;
nix.settings.trusted-users = ["deployerbot-follower"];
})
];
}