notplantsandClaude Fable 5.1
31af820079
The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).
nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.
README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
49 lines
2.2 KiB
Nix
49 lines
2.2 KiB
Nix
# PROVISIONAL — derived from the old cc-ci server networking.nix with the new address; replace with the
|
|
# nixos-infect output of the new host (README §3), keeping defaultGateway.interface.
|
|
# Hetzner static networking — generated by nixos-infect at provision time.
|
|
#
|
|
# This file is server-specific: the IP, gateway, and MAC address are tied to a
|
|
# particular Hetzner instance. When provisioning a new server:
|
|
# 1. After `terraform apply` + nixos-infect completes, run:
|
|
# ssh root@<new-ip> 'cat /etc/nixos/networking.nix'
|
|
# 2. Replace this file's contents with the output and commit.
|
|
# 3. Then: `nixos-rebuild switch --flake .#cc-ci-hetzner --target-host root@<new-ip>`
|
|
#
|
|
# Current instance: 195.201.88.249 (fsn1, Hetzner server 134485294, provisioned 2026-05-31).
|
|
{ lib, ... }: {
|
|
networking = {
|
|
nameservers = [
|
|
"185.12.64.1"
|
|
"185.12.64.2"
|
|
];
|
|
# The interface MUST be explicit here. Since NixOS 25.05 the scripted-networking
|
|
# module installs the default route from the gateway interface's
|
|
# network-addresses-<iface>.service, and it finds that interface either by
|
|
# `defaultGateway.interface` or by the gateway address being inside one of the
|
|
# interface's subnets. With Hetzner's off-subnet point-to-point gateway
|
|
# (195.201.88.249/32 on eth0, gateway 172.31.1.1) neither matched when this was a
|
|
# bare string, so NO default route was installed and the 26.05 rebuild on
|
|
# 2026-08-03 took the host off the network (recovered via rescue mode).
|
|
defaultGateway = {
|
|
address = "172.31.1.1";
|
|
interface = "eth0";
|
|
};
|
|
# No IPv6 on this Hetzner instance (link-local only) — nixos-infect emitted an empty
|
|
# defaultGateway6/ipv6.route which made network-addresses-eth0.service fail
|
|
# ("ip route add /128" with no prefix). v4-only box, so no IPv6 gateway/route declared.
|
|
dhcpcd.enable = false;
|
|
usePredictableInterfaceNames = lib.mkForce false;
|
|
interfaces = {
|
|
eth0 = {
|
|
ipv4.addresses = [
|
|
{ address = "195.201.88.249"; prefixLength = 32; }
|
|
];
|
|
ipv4.routes = [{ address = "172.31.1.1"; prefixLength = 32; }];
|
|
};
|
|
};
|
|
};
|
|
services.udev.extraRules = ''
|
|
ATTR{address}=="00:00:00:00:00:00", NAME="eth0"
|
|
'';
|
|
}
|