recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(1b): RL5 — consolidate Nix code under nix/ (modules->nix/modules, hosts->nix/hosts)

Browse Source 
flake.nix/flake.lock STAY at root so the build ref #cc-ci is unchanged; only flake's internal
configuration.nix path updated. Root-relative refs inside moved modules re-based ../X -> ../../X
(secrets/bridge/dashboard); configuration.nix's ../../modules imports unchanged (both dirs under nix/).
Living docs (README, architecture/install/secrets/enroll) + .drone.yml comment updated to nix/...;
append-only history logs left as-is. DECISIONS.md records RL5 + the deferred-coordinated RL6.

Verified on cc-ci: nixos-rebuild build 'path:#cc-ci' -> toplevel 8i3jcad9 (BYTE-IDENTICAL to the
pre-move build — store derivations are content-addressed on file contents, module .nix not in the
runtime closure); scripts/lint.sh -> lint: PASS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
autonomic-bot
2026-05-27 21:19:09 +01:00
parent 5a811e4ae4
commit 433ec9de30
21 changed files with 63 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
nix/hosts/cc-ci/configuration.nix Normal file
View File

@ -0,0 +1,53 @@
# cc-ci machine config. M0 = faithful reproduction of the baseline (docs/baseline.md)
# so the first flake rebuild is a no-op-then-base. Services (swarm/Traefik/Drone/
# bridge/dashboard) are layered in via ./modules/* in later milestones.
{ pkgs, ... }:
{
imports = [
./hardware.nix
../../modules/packages.nix
../../modules/secrets.nix
../../modules/swarm.nix
../../modules/abra.nix
../../modules/proxy.nix
../../modules/drone.nix
../../modules/drone-runner.nix
../../modules/bridge.nix
../../modules/dashboard.nix
../../modules/backupbot.nix
../../modules/harness.nix
];
# --- Tailscale (ACCESS-CRITICAL: do not break, this is the only route in) ---
# Baseline read the hostname from /etc/ts-hostname at eval time; that is impure
# under flakes, so we pin the known hostname. The reusable auth-key file persists.
services.tailscale = {
enable = true;
authKeyFile = "/etc/ts-auth-key";
extraUpFlags = [ "--hostname=cc-nix-test" ];
};
# --- SSH (root login over tailscale) ---
services.openssh = {
enable = true;
settings.PermitRootLogin = "yes";
};
# --- Firewall: trust tailscale, allow SSH ---
networking.firewall = {
enable = true;
trustedInterfaces = [ "tailscale0" ];
allowedTCPPorts = [ 22 ];
};
environment.systemPackages = with pkgs; [
curl
git
jq
openssh
];
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "24.11";
}

21
nix/hosts/cc-ci/hardware.nix Normal file
View File

@ -0,0 +1,21 @@
# Hardware / platform for cc-ci: an Incus VM (x86_64) on the autonomic infra.
# Mirrors the pre-flake baseline (docs/baseline.md).
{ modulesPath, ... }:
{
imports = [
"${modulesPath}/virtualisation/incus-virtual-machine.nix"
];
# incus-agent for `incus exec`
virtualisation.incus.agent.enable = true;
# cloud-init seeded the VM (network + /etc/ts-* files); keep it enabled.
services.cloud-init = {
enable = true;
network.enable = true;
};
# DHCP from the incus bridge; bridge provides no resolver, so set our own.
networking.useDHCP = true;
networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
}