recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
027fdbd1613bdb5ae11260ec91d372eacde4e9dc
cc-ci-orchestrator/nix/README.md
autonomic-bot e2551f3d79 chore(nix): infra polish — bake cc-ci IP, mark stale Incus config, park nginx vhost 
- SSH config: replace REPLACE_WITH_CC_CI_HETZNER_TAILNET_IP placeholder with
  the real tailnet IP 100.95.31.88 (so a fresh re-provision is correct).
- nix/configuration.nix + nix/README.md: mark HISTORICAL/dead (old Incus VM,
  superseded by the Hetzner host) to prevent a wrong-host deploy.
- nginx oc.commoninternet.net vhost: note it's PARKED alongside opencode-web
  (kept for one-step re-enable, not deleted).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-02 00:07:05 +00:00

1.9 KiB
Raw Blame History

cc-ci-orchestrator

⚠️ HISTORICAL. This README describes the retired Incus VM (100.116.55.106). The orchestrator now runs on Hetzner — the live host config is nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix. See cc-ci-plan/plan-orchestrator-hetzner-migration.md for the current setup. Kept for history.

NixOS config for the cc-ci-orchestrator Incus VM (b1, project terraform-ci, tailnet 100.116.55.106) — the reboot-resilient host for the cc-ci Builder/Adversary loops + watchdog + orchestrator session, moved off the unstable 905 MiB Pi.

See cc-ci-plan/plan-orchestrator-migration.md for the full migration.

Files

  • configuration.nix — the VM's NixOS config (channel-based, nixos-24.11). Deployed to /etc/nixos/configuration.nix on the VM. Provides: nix-ld (so the standalone Claude Code Bun binary runs), tmux/git/python/jq + tools, a 4 GB swapfile, direct ssh to cc-ci (the VM is a tailnet peer — no SOCKS proxy needed, unlike the Pi), an idempotent claude-install oneshot, and the cc-ci-loops supervisor service (defined, enabled in Phase D once the workspace is staged).

Deploy (until this is wired to a flake/auto-pull)

# copy configuration.nix to the VM, then:
ssh cc-ci-orchestrator 'nixos-rebuild switch'    # or run detached: see below

Over the (currently flaky) Pi→VM link, run the rebuild detached on the VM so an ssh/proxy drop doesn't abort it, e.g. systemd-run --unit=orch-rebuild --collect nixos-rebuild switch then poll journalctl -u orch-rebuild.

Status

  • Phase A: VM created (2 GB / 2 vCPU / 30 GB), on tailnet, ssh-able. ✅
  • Phase B: this config (DRAFT) — nix-ld/claude validation pending on the VM.
  • Operator step pending (Phase C): claude auth login on the VM (device-code; can't be scripted).
  • Secrets to stage (Phase C, out-of-band): /srv/cc-ci/.testenv, ~/.ssh/cc-ci-root-ed25519, Incus mTLS certs, the sops master age key.