notplantsandClaude Fable 5.1
31af820079
The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).
nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.
README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
cc-ci-orchestrator
⚠️ HISTORICAL. This README describes the retired Incus VM (
100.116.55.106). The orchestrator now runs on Hetzner — the live host config isnix/hosts/cc-ci-orchestrator-hetzner/configuration.nix. Seecc-ci-plan/plan-orchestrator-hetzner-migration.mdfor the current setup. Kept for history.
NixOS config for the cc-ci-orchestrator Incus VM (b1, project terraform-ci, tailnet
100.116.55.106) — the reboot-resilient host for the cc-ci Builder/Adversary loops + watchdog +
orchestrator session, moved off the unstable 905 MiB Pi.
See cc-ci-plan/plan-orchestrator-migration.md for the full migration.
Files
configuration.nix— the VM's NixOS config (channel-based,nixos-24.11). Deployed to/etc/nixos/configuration.nixon the VM. Provides: nix-ld (so the standalone Claude Code Bun binary runs), tmux/git/python/jq + tools, a 4 GB swapfile, direct ssh to cc-ci (the VM is a tailnet peer — no SOCKS proxy needed, unlike the Pi), an idempotentclaude-installoneshot, and thecc-ci-loopssupervisor service (defined, enabled in Phase D once the workspace is staged).
Deploy (until this is wired to a flake/auto-pull)
# copy configuration.nix to the VM, then:
ssh cc-ci-orchestrator 'nixos-rebuild switch' # or run detached: see below
Over the (currently flaky) Pi→VM link, run the rebuild detached on the VM so an ssh/proxy drop
doesn't abort it, e.g. systemd-run --unit=orch-rebuild --collect nixos-rebuild switch then poll
journalctl -u orch-rebuild.
Status
- Phase A: VM created (2 GB / 2 vCPU / 30 GB), on tailnet, ssh-able. ✅
- Phase B: this config (DRAFT) — nix-ld/claude validation pending on the VM.
- Operator step pending (Phase C):
claude auth loginon the VM (device-code; can't be scripted). - Secrets to stage (Phase C, out-of-band):
/srv/cc-ci/.testenv,~/.ssh/cc-ci-root-ed25519, Incus mTLS certs, the sops master age key.