notplantsandClaude Fable 5.1
f105808bed
hardware.nix / networking.nix are now the nixos-infect output of 195.201.88.249 (ESP E079-7D41, eth0 MAC-pinned), with the one edit that matters: defaultGateway as an attrset with interface = "eth0". README §2a records what it actually took to get NixOS running on the Debian 13 image: NO_SWAP=true (tmpfs /tmp), a manual lustration from rescue mode because 26.05's systemd initrd did not honour NIXOS_LUSTRATE (Debian's unit files shadowed every NixOS service), and the gateway fix applied via a chroot rebuild with the nix sandbox off. flake: cc-ci input back on main (PR #32 merged as f6dbfa3); loops uid pinned to 1000 so workspace rsyncs by uid line up. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
53 lines
2.4 KiB
Nix
53 lines
2.4 KiB
Nix
{
|
|
description = "cc-ci-orchestrator — the cc-ci orchestrator (loops, steering session, weekly upgrader) and the NixOS host it shares with the cc-ci CI server";
|
|
|
|
inputs = {
|
|
# Stable release channel (operator 2026-08-01). `nix flake update` moves it; the cc-ci input
|
|
# below FOLLOWS it, so one nixpkgs builds the whole combined host and CVEs get patched once.
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
|
|
|
sops-nix.url = "github:Mic92/sops-nix";
|
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
# The cc-ci CI server, as a NixOS module (`nixosModules.cc-ci-server`). HTTPS, anonymous read:
|
|
# nix evaluates every input for every output, so the input must be fetchable without
|
|
# credentials. The private secrets submodule is deliberately NOT fetched through this input —
|
|
# the host reads the deployed --recursive checkout's secrets.yaml at activation instead
|
|
# (`cc-ci.sopsFile`). Both `follows` are REQUIRED: without them cc-ci's own nixpkgs/sops-nix
|
|
# pins would produce a second sops-nix module tree and a second nixpkgs in one system.
|
|
cc-ci.url = "git+https://git.autonomic.zone/recipe-maintainers/cc-ci.git";
|
|
cc-ci.inputs.nixpkgs.follows = "nixpkgs";
|
|
cc-ci.inputs.sops-nix.follows = "sops-nix";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, sops-nix, cc-ci, ... }:
|
|
let
|
|
system = "x86_64-linux";
|
|
in
|
|
{
|
|
nixosModules = {
|
|
# The orchestrator itself: loops supervisor, steering session, weekly/hourly timers.
|
|
cc-ci-orchestrator = ./nix/modules/cc-ci.nix;
|
|
# The host contract those units assume: loops user, claude/opencode CLIs, opencode web
|
|
# server + tailnet UI, nix-ld, tool set, `ssh cc-ci` config.
|
|
orchestrator-host = ./nix/modules/orchestrator-host.nix;
|
|
# Old name of cc-ci-orchestrator, kept while notplants-nix still imports it (2026-09).
|
|
cc-ci = ./nix/modules/cc-ci.nix;
|
|
};
|
|
|
|
nixosConfigurations = {
|
|
# THE live host: cc-ci CI server + cc-ci orchestrator on one Hetzner cpx32-class box
|
|
# (195.201.88.249, since 2026-09). README.md is the deploy guide.
|
|
cc-ci = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
cc-ci.nixosModules.cc-ci-server
|
|
self.nixosModules.cc-ci-orchestrator
|
|
self.nixosModules.orchestrator-host
|
|
./nix/hosts/cc-ci/configuration.nix
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|