recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nix: one Hetzner host for the cc-ci CI server + the orchestrator (#cc-ci) #19

Merged
autonomic-bot merged 3 commits from feat/combined-cc-ci-host into main 2026-09-07 20:26:25 +00:00
Conversation 0 Commits 3 Files Changed 32
+892 -90
autonomic-bot commented 2026-09-07 20:26:24 +00:00
Owner
Copy Link
Copy Source

nixosConfigurations.cc-ci builds the machine the orchestrator now shares with the cc-ci CI server (195.201.88.249): cc-ci's nixosModules.cc-ci-server (new flake input, nixpkgs + sops-nix follow ours) + this repo's orchestrator module (nixosModules.cc-ci-orchestrator, cc-ci kept as an alias for notplants-nix) + the new nix/modules/orchestrator-host.nix (the host contract: loops user, claude/opencode CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns 80/443, nix-ld, tool set, ssh cc-ci → loopback).

  • nix/hosts/cc-ci/ — hardware + networking captured from the box (nixos-infect output, gateway fixed), root keys, tailscale, swap.
  • README.md — the from-scratch deploy guide: Hetzner Debian → nixos-infect (with the three fixes it took on the Debian 13 image) → staging → first rebuild → data restore → cutover → day 2.
  • archive/ — retired Incus/Hetzner orchestrator host configs, old terraform, migration plans; references updated.
  • cc-ci-plan/plan-cc-ci-combined-host.md — the working plan + log of the move.

Deployed: nixos-rebuild test then switch on the new box from this branch (4bc4833). 0 failed units except tailscaled-autoconnect (revoked auth key, operator to issue a new one). Dashboard/reports/drone answer on the new IP with the restored LE cert; acme-dns answers on public 53. Pre-cutover quarantine in place (bridge scaled to 0, weekly timers masked).

🤖 Generated with Claude Code

https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

`nixosConfigurations.cc-ci` builds the machine the orchestrator now shares with the cc-ci CI server (195.201.88.249): cc-ci's `nixosModules.cc-ci-server` (new flake input, nixpkgs + sops-nix follow ours) + this repo's orchestrator module (`nixosModules.cc-ci-orchestrator`, `cc-ci` kept as an alias for notplants-nix) + the new `nix/modules/orchestrator-host.nix` (the host contract: loops user, claude/opencode CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns 80/443, nix-ld, tool set, `ssh cc-ci` → loopback). - `nix/hosts/cc-ci/` — hardware + networking captured from the box (nixos-infect output, gateway fixed), root keys, tailscale, swap. - `README.md` — the from-scratch deploy guide: Hetzner Debian → nixos-infect (with the three fixes it took on the Debian 13 image) → staging → first rebuild → data restore → cutover → day 2. - `archive/` — retired Incus/Hetzner orchestrator host configs, old terraform, migration plans; references updated. - `cc-ci-plan/plan-cc-ci-combined-host.md` — the working plan + log of the move. **Deployed:** `nixos-rebuild test` then `switch` on the new box from this branch (4bc4833). 0 failed units except `tailscaled-autoconnect` (revoked auth key, operator to issue a new one). Dashboard/reports/drone answer on the new IP with the restored LE cert; acme-dns answers on public 53. Pre-cutover quarantine in place (bridge scaled to 0, weekly timers masked). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
autonomic-bot added 3 commits 2026-09-07 20:26:25 +00:00
nix: one Hetzner host for the CI server + the orchestrator (#cc-ci) 31af820079 
The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).

nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.

README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
nix/hosts/cc-ci: real hardware + networking from the box; document the infect fixes f105808bed 
hardware.nix / networking.nix are now the nixos-infect output of
195.201.88.249 (ESP E079-7D41, eth0 MAC-pinned), with the one edit that
matters: defaultGateway as an attrset with interface = "eth0".

README §2a records what it actually took to get NixOS running on the
Debian 13 image: NO_SWAP=true (tmpfs /tmp), a manual lustration from rescue
mode because 26.05's systemd initrd did not honour NIXOS_LUSTRATE (Debian's
unit files shadowed every NixOS service), and the gateway fix applied via a
chroot rebuild with the nix sandbox off.

flake: cc-ci input back on main (PR #32 merged as f6dbfa3); loops uid pinned
to 1000 so workspace rsyncs by uid line up.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
orchestrator-host: symlink the opencode installer's binary into ~/.local/bin; README: nginx file perms, first-rebuild wrapper, pre-cutover checks 4bc483326b 
Found on the first activation of #cc-ci on 195.201.88.249: the opencode
installer lands in ~/.opencode/bin (opencode-web then failed at EXEC), and
nginx's pre-start config check runs as the nginx user, so the staged
cert/htpasswd must be root:nginx 0640, not root:root 0600.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
autonomic-bot merged commit 86f15ae2c3 into main 2026-09-07 20:26:25 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#19