recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nix/hosts/cc-ci: real hardware + networking from the box; document the infect fixes

Browse Source 
hardware.nix / networking.nix are now the nixos-infect output of
195.201.88.249 (ESP E079-7D41, eth0 MAC-pinned), with the one edit that
matters: defaultGateway as an attrset with interface = "eth0".

README §2a records what it actually took to get NixOS running on the
Debian 13 image: NO_SWAP=true (tmpfs /tmp), a manual lustration from rescue
mode because 26.05's systemd initrd did not honour NIXOS_LUSTRATE (Debian's
unit files shadowed every NixOS service), and the gateway fix applied via a
chroot rebuild with the nix sandbox off.

flake: cc-ci input back on main (PR #32 merged as f6dbfa3); loops uid pinned
to 1000 so workspace rsyncs by uid line up.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
This commit is contained in:
notplants
2026-09-07 20:15:16 +00:00
co-authored by Claude Fable 5.1
parent 31af820079
commit f105808bed
6 changed files with 86 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nix/hosts/cc-ci/hardware.nix
+13 -33
View File
@@ -1,39 +1,19 @@
# PROVISIONAL — copied from the old cc-ci server (same Hetzner cloud layout) so the flake can be
# evaluated before the new box yielded its own file. MUST be replaced by /etc/nixos/hardware-configuration.nix
# from the new host (README §3): the ESP UUID below belongs to the OLD machine.
# Hardware configuration for cc-ci on Hetzner Cloud (cpx32: AMD 4 vCPU / 8 GB / x86_64).
# Generated by nixos-infect from a Debian 12 base image, then committed here.
#
# nixos-infect uses GRUB + EFI on Hetzner (not systemd-boot), with a qemu-guest profile
# because Hetzner Cloud uses KVM virtualisation.
#
# IMPORTANT: networking.nix (below) contains the server's static public IP.
# When provisioning a new server via `terraform apply`, copy the fresh networking.nix
# from /etc/nixos/networking.nix on the new host and commit it here before rebuilding.
# Generated by nixos-infect on this machine (2026-09-07), captured verbatim per README §3.
# The ESP UUID is specific to THIS server; a new server gets a new file.
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
loader = {
efi.efiSysMountPoint = "/boot/efi";
grub = {
efiSupport = true;
efiInstallAsRemovable = true;
device = "nodev";
};
boot.loader = {
efi.efiSysMountPoint = "/boot/efi";
grub = {
efiSupport = true;
efiInstallAsRemovable = true;
device = "nodev";
};
initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
initrd.kernelModules = [ "nvme" ];
};
fileSystems."/boot/efi" = {
device = "/dev/disk/by-uuid/D978-69EE";
fsType = "vfat";
};
fileSystems."/" = {
device = "/dev/sda1";
fsType = "ext4";
};
fileSystems."/boot/efi" = { device = "/dev/disk/by-uuid/E079-7D41"; fsType = "vfat"; };
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
}
nix/hosts/cc-ci/networking.nix
+22 -32
View File
@@ -1,48 +1,38 @@
# PROVISIONAL — derived from the old cc-ci server networking.nix with the new address; replace with the
# nixos-infect output of the new host (README §3), keeping defaultGateway.interface.
# Hetzner static networking — generated by nixos-infect at provision time.
#
# This file is server-specific: the IP, gateway, and MAC address are tied to a
# particular Hetzner instance. When provisioning a new server:
# 1. After `terraform apply` + nixos-infect completes, run:
# ssh root@<new-ip> 'cat /etc/nixos/networking.nix'
# 2. Replace this file's contents with the output and commit.
# 3. Then: `nixos-rebuild switch --flake .#cc-ci-hetzner --target-host root@<new-ip>`
#
# Current instance: 195.201.88.249 (fsn1, Hetzner server 134485294, provisioned 2026-05-31).
# Generated by nixos-infect on this machine (2026-09-07), captured per README §3, with ONE edit:
# `defaultGateway` as an attrset WITH `interface = "eth0"`. The generated bare-string form leaves
# NixOS ≥25.05 without a default route (the host boots and is unreachable) — see README §2.
{ lib, ... }: {
# This file was populated at runtime with the networking
# details gathered from the active system.
networking = {
nameservers = [
"185.12.64.1"
"185.12.64.2"
];
# The interface MUST be explicit here. Since NixOS 25.05 the scripted-networking
# module installs the default route from the gateway interface's
# network-addresses-<iface>.service, and it finds that interface either by
# `defaultGateway.interface` or by the gateway address being inside one of the
# interface's subnets. With Hetzner's off-subnet point-to-point gateway
# (195.201.88.249/32 on eth0, gateway 172.31.1.1) neither matched when this was a
# bare string, so NO default route was installed and the 26.05 rebuild on
# 2026-08-03 took the host off the network (recovered via rescue mode).
defaultGateway = {
address = "172.31.1.1";
nameservers = [ "2a01:4ff:ff00::add:2"
"2a01:4ff:ff00::add:1"
"185.12.64.2"
];
defaultGateway = { address = "172.31.1.1"; interface = "eth0"; };
defaultGateway6 = {
address = "fe80::1";
interface = "eth0";
};
# No IPv6 on this Hetzner instance (link-local only) — nixos-infect emitted an empty
# defaultGateway6/ipv6.route which made network-addresses-eth0.service fail
# ("ip route add /128" with no prefix). v4-only box, so no IPv6 gateway/route declared.
dhcpcd.enable = false;
usePredictableInterfaceNames = lib.mkForce false;
interfaces = {
eth0 = {
ipv4.addresses = [
{ address = "195.201.88.249"; prefixLength = 32; }
{ address="195.201.88.249"; prefixLength=32; }
];
ipv4.routes = [{ address = "172.31.1.1"; prefixLength = 32; }];
ipv6.addresses = [
{ address="2a01:4f8:1c1c:a9b::1"; prefixLength=64; }
{ address="fe80::2ff8:e3ea:bbb8:aa39"; prefixLength=64; }
];
ipv4.routes = [ { address = "172.31.1.1"; prefixLength = 32; } ];
ipv6.routes = [ { address = "fe80::1"; prefixLength = 128; } ];
};
};
};
services.udev.extraRules = ''
ATTR{address}=="00:00:00:00:00:00", NAME="eth0"
ATTR{address}=="92:00:09:d5:ec:0d", NAME="eth0"
'';
}