recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Merge pull request 'flake: bump nixpkgs + sops-nix (2026-08-03)' (#11) from chore/server-flake-update-20260803 into main
Some checks failed
continuous-integration/drone/push Build is failing
Details

Browse Source
This commit is contained in:
autonomic-bot
2026-08-03 20:23:05 +00:00
parent 25a583d00e c541cb1474
commit 5366e0616b
3 changed files with 30 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
flake.lock generated
View File

@ -2,17 +2,17 @@
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1751274312,
"narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
"lastModified": 1785734586,
"narHash": "sha256-ODZkEK9Gy50yg6h98u7KkitZ3oc/uuTFK00bh1CRdNA=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
"rev": "531670d871c0e29724a02f3cbcac170adc65b58c",
"type": "github"
},
"original": {
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
"rev": "531670d871c0e29724a02f3cbcac170adc65b58c",
"type": "github"
}
},
@ -29,17 +29,17 @@
]
},
"locked": {
"lastModified": 1750119275,
"narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
"lastModified": 1783174389,
"narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
"rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
"rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
"type": "github"
}
}

16
flake.nix
View File

@ -2,13 +2,17 @@
description = "cc-ci — Co-op Cloud recipe CI server (NixOS)";
inputs = {
# Pinned to the exact revision cc-ci already runs, so the first rebuild from
# this repo is a true no-op-then-base (M0). Bump deliberately, not drift.
nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674";
# Pinned to the nixos-26.05 channel tip (2026-08-03). Matches the orchestrator host's
# channel so both boxes share a nixpkgs and CVEs get patched. Bump deliberately, not drift.
# Previous pin: 50ab793 (nixos-24.11, 2025-06-30) — 24.11 was EOL; this is a 3-release jump
# (24.11 -> 25.05 -> 25.11 -> 26.05). Notable 26.05 changes: systemd Stage 1 boot by default,
# dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory), MySQL 8.0 removed.
nixpkgs.url = "github:NixOS/nixpkgs/531670d871c0e29724a02f3cbcac170adc65b58c";
# Pinned to a commit that still uses plain `buildGoModule` — sops-nix master moved to
# `buildGo125Module` (Go 1.25), which our pinned nixpkgs 24.11 (2025-06-30) does not have.
sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2";
# sops-nix master (buildGo125Module / Go 1.25), which builds against nixpkgs 26.05.
# Previous pin (77c423a) held back to plain buildGoModule for nixpkgs 24.11 compat — no
# longer needed on 26.05.
sops-nix.url = "github:Mic92/sops-nix/f1406619a3884cd5c47992a70b8b35c9c0fcb4c9";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
};

13
nix/hosts/cc-ci-hetzner/networking.nix
View File

@ -14,7 +14,18 @@
"185.12.64.1"
"185.12.64.2"
];
defaultGateway = "172.31.1.1";
# The interface MUST be explicit here. Since NixOS 25.05 the scripted-networking
# module installs the default route from the gateway interface's
# network-addresses-<iface>.service, and it finds that interface either by
# `defaultGateway.interface` or by the gateway address being inside one of the
# interface's subnets. With Hetzner's off-subnet point-to-point gateway
# (91.98.47.73/32 on eth0, gateway 172.31.1.1) neither matched when this was a
# bare string, so NO default route was installed and the 26.05 rebuild on
# 2026-08-03 took the host off the network (recovered via rescue mode).
defaultGateway = {
address = "172.31.1.1";
interface = "eth0";
};
# No IPv6 on this Hetzner instance (link-local only) — nixos-infect emitted an empty
# defaultGateway6/ipv6.route which made network-addresses-eth0.service fail
# ("ip route add /128" with no prefix). v4-only box, so no IPv6 gateway/route declared.