autonomic-bot
4772e31296
Some checks failed
continuous-integration/drone/push Build is failing
nixpkgs: 50ab793 -> 531670d (nixos-26.05, was nixos-24.11 EOL) sops-nix: 77c423a -> f140661 (master, buildGo125Module now builds on 26.05) 3-release channel jump (24.11 -> 25.05 -> 25.11 -> 26.05) to match the orchestrator host and get CVE patches. 24.11 was EOL (2025-06-30). Notable 26.05 changes reviewed: systemd Stage 1 boot (default, no config change needed), dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory; git present on host), MySQL 8.0 removed (not used as a NixOS module). No system.rebuild/fileSystems/boot.initrd options in the host config, so no config edits required.
85 lines
3.2 KiB
Nix
85 lines
3.2 KiB
Nix
{
|
|
description = "cc-ci — Co-op Cloud recipe CI server (NixOS)";
|
|
|
|
inputs = {
|
|
# Pinned to the nixos-26.05 channel tip (2026-08-03). Matches the orchestrator host's
|
|
# channel so both boxes share a nixpkgs and CVEs get patched. Bump deliberately, not drift.
|
|
# Previous pin: 50ab793 (nixos-24.11, 2025-06-30) — 24.11 was EOL; this is a 3-release jump
|
|
# (24.11 -> 25.05 -> 25.11 -> 26.05). Notable 26.05 changes: systemd Stage 1 boot by default,
|
|
# dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory), MySQL 8.0 removed.
|
|
nixpkgs.url = "github:NixOS/nixpkgs/531670d871c0e29724a02f3cbcac170adc65b58c";
|
|
|
|
# sops-nix master (buildGo125Module / Go 1.25), which builds against nixpkgs 26.05.
|
|
# Previous pin (77c423a) held back to plain buildGoModule for nixpkgs 24.11 compat — no
|
|
# longer needed on 26.05.
|
|
sops-nix.url = "github:Mic92/sops-nix/f1406619a3884cd5c47992a70b8b35c9c0fcb4c9";
|
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
outputs = { nixpkgs, sops-nix, ... }:
|
|
let
|
|
system = "x86_64-linux";
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
# Lint/format toolchain (Phase 1b, RL1). Same tools the `.drone.yml` lint stage and
|
|
# `scripts/lint.sh` use, built from the pinned nixpkgs so CI and local agree byte-for-byte.
|
|
# Nix: nixpkgs-fmt (format) · statix (lints) · deadnix (dead code).
|
|
# Python: ruff (lint + format). Shell: shellcheck + shfmt. YAML: yamllint.
|
|
lintTools = with pkgs; [
|
|
nixpkgs-fmt
|
|
statix
|
|
deadnix
|
|
ruff
|
|
shellcheck
|
|
shfmt
|
|
yamllint
|
|
];
|
|
in
|
|
{
|
|
nixosConfigurations = {
|
|
# Canonical live host target: the Hetzner cc-ci server.
|
|
# Use `.#cc-ci` for the current production host.
|
|
cc-ci = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
./nix/hosts/cc-ci-hetzner/configuration.nix
|
|
];
|
|
};
|
|
|
|
# Legacy Incus VM host definition retained only for historical comparison and fallback.
|
|
# Do NOT use this target on the live Hetzner server.
|
|
cc-ci-incus = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
./nix/hosts/cc-ci/configuration.nix
|
|
];
|
|
};
|
|
|
|
# Explicit alias for the live Hetzner host. Kept alongside `cc-ci` so the intended host
|
|
# target remains obvious in recovery/migration workflows.
|
|
cc-ci-hetzner = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
./nix/hosts/cc-ci-hetzner/configuration.nix
|
|
];
|
|
};
|
|
};
|
|
|
|
devShells.${system} = {
|
|
# Devshell for working on the harness/bridge locally (tools + lint toolchain).
|
|
default = pkgs.mkShell {
|
|
packages = (with pkgs; [ git jq curl ]) ++ lintTools;
|
|
};
|
|
# `nix develop .#lint` — exactly the lint toolchain, nothing else. Used by
|
|
# `scripts/lint.sh` and the `.drone.yml` lint stage.
|
|
lint = pkgs.mkShell {
|
|
packages = lintTools;
|
|
};
|
|
};
|
|
|
|
formatter.${system} = pkgs.nixpkgs-fmt;
|
|
};
|
|
}
|