notplantsandClaude Fable 5.1
31af820079
The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).
nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.
README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
53 lines
2.4 KiB
Nix
53 lines
2.4 KiB
Nix
{
|
|
description = "cc-ci-orchestrator — the cc-ci orchestrator (loops, steering session, weekly upgrader) and the NixOS host it shares with the cc-ci CI server";
|
|
|
|
inputs = {
|
|
# Stable release channel (operator 2026-08-01). `nix flake update` moves it; the cc-ci input
|
|
# below FOLLOWS it, so one nixpkgs builds the whole combined host and CVEs get patched once.
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
|
|
|
sops-nix.url = "github:Mic92/sops-nix";
|
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
# The cc-ci CI server, as a NixOS module (`nixosModules.cc-ci-server`). HTTPS, anonymous read:
|
|
# nix evaluates every input for every output, so the input must be fetchable without
|
|
# credentials. The private secrets submodule is deliberately NOT fetched through this input —
|
|
# the host reads the deployed --recursive checkout's secrets.yaml at activation instead
|
|
# (`cc-ci.sopsFile`). Both `follows` are REQUIRED: without them cc-ci's own nixpkgs/sops-nix
|
|
# pins would produce a second sops-nix module tree and a second nixpkgs in one system.
|
|
cc-ci.url = "git+https://git.autonomic.zone/recipe-maintainers/cc-ci.git?ref=feat/nixos-module-export";
|
|
cc-ci.inputs.nixpkgs.follows = "nixpkgs";
|
|
cc-ci.inputs.sops-nix.follows = "sops-nix";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, sops-nix, cc-ci, ... }:
|
|
let
|
|
system = "x86_64-linux";
|
|
in
|
|
{
|
|
nixosModules = {
|
|
# The orchestrator itself: loops supervisor, steering session, weekly/hourly timers.
|
|
cc-ci-orchestrator = ./nix/modules/cc-ci.nix;
|
|
# The host contract those units assume: loops user, claude/opencode CLIs, opencode web
|
|
# server + tailnet UI, nix-ld, tool set, `ssh cc-ci` config.
|
|
orchestrator-host = ./nix/modules/orchestrator-host.nix;
|
|
# Old name of cc-ci-orchestrator, kept while notplants-nix still imports it (2026-09).
|
|
cc-ci = ./nix/modules/cc-ci.nix;
|
|
};
|
|
|
|
nixosConfigurations = {
|
|
# THE live host: cc-ci CI server + cc-ci orchestrator on one Hetzner cpx32-class box
|
|
# (195.201.88.249, since 2026-09). README.md is the deploy guide.
|
|
cc-ci = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
cc-ci.nixosModules.cc-ci-server
|
|
self.nixosModules.cc-ci-orchestrator
|
|
self.nixosModules.orchestrator-host
|
|
./nix/hosts/cc-ci/configuration.nix
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|