notplantsandClaude Fable 5.1
31af820079
The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).
nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.
README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
34 lines
1.5 KiB
Nix
34 lines
1.5 KiB
Nix
{ modulesPath, ... }:
|
|
{
|
|
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
|
boot.loader = {
|
|
efi.efiSysMountPoint = "/boot/efi";
|
|
grub = {
|
|
efiSupport = true;
|
|
efiInstallAsRemovable = true;
|
|
device = "nodev";
|
|
};
|
|
};
|
|
fileSystems."/boot/efi" = { device = "/dev/disk/by-uuid/39A5-C7B9"; fsType = "vfat"; };
|
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
|
boot.initrd.kernelModules = [ "nvme" ];
|
|
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
|
|
|
|
# 150G Hetzner volume (scsi-0HC_Volume_106342723) — holds the Rust build trees, which repeatedly
|
|
# filled the 75G root. A full disk here does NOT error: it silently truncates whatever is being
|
|
# written (it destroyed a plan file mid-write before anyone noticed).
|
|
#
|
|
# by-uuid, not /dev/sdb: device names are not stable across reboots and attaching another volume
|
|
# would silently mount the wrong disk here.
|
|
#
|
|
# nofail is REQUIRED, not decoration: without it, a detached/failed volume makes the mount unit a
|
|
# boot dependency, systemd drops to emergency mode, and the box comes up WITHOUT SSH. That failure
|
|
# has already happened once on this host from a bad nixos config, and it needed a recovery to the
|
|
# previous generation. The build cache is not worth risking access to the machine.
|
|
fileSystems."/mnt/data" = {
|
|
device = "/dev/disk/by-uuid/16cd6650-1399-4cb9-a696-54b70d83203a";
|
|
fsType = "ext4";
|
|
options = [ "defaults" "nofail" "x-systemd.device-timeout=10s" ];
|
|
};
|
|
}
|