feat(tf-incus): deploy via incus exec, drop deployment SSH #1112

Merged

kiara merged 1 commit from kiara/fediversity:incus-exec into main 2026-06-21 10:22:47 +02:00

Conversation 0 Commits 1 Files changed 23 +543 -538

kiara commented 2026-06-21 01:01:46 +02:00

Owner

Copy link

Paves the way for #24, as suggested at #295 (comment).

The tf-incus path provisioned Incus containers with the lxc/incus
provider, then deployed NixOS onto them over SSH: nix-copy-closure
plus switch-to-configuration through ProxyJump=incushost, gated on
await-ssh.sh. To make that channel reachable each container baked the
deployer's pubkey into root's authorized_keys and carried SSH-survival
scaffolding to keep sshd alive across the switch.

The deployer already holds an Incus mTLS client cert and the container
instance name is plumbed through the data model, so the container is
reachable with incus exec against incus:<name> without any SSH into
it. Switch the deployment transport to incus exec:

• New src/effects/incus/run.sh: streams the closure with
  nix-store --export | incus exec -T -- nix-store --import (no
  nix-copy-closure), runs every remote step via incus exec, and
  registers the provider's mTLS remote at runtime (the provider keeps
  remotes in TF state only, so the CLI config dir has none). The
  transport-agnostic nspawn D-Bus-recovery logic is preserved.
• New src/effects/tf/incus/host/ module + await-incus.sh readiness
  gate; hosts/main.tf addresses containers by name, dropping the
  cached-IP dance and await-ssh.sh.
• The deploy/await scripts are writeShellApplication-wrapped so
  pkgs.incus is pinned on PATH.

Containers keep sshd for operator login (the shared
setups/nixos/networking.nix + procolix keys); only the deployer's
baked key and the deploy-SSH scaffolding are removed. The now-dead SSH
key wiring in the api/panel/tf-incus tests is dropped accordingly.

incusModel is also the deployed-config generator for the SSH-transport
tests (apps-tf, deployment-tf-hosts), whose test scripts still SSH
root@<container> after the deploy, so the sshd-survival block stays in
incusModel (inert for the incus path); only extraRootKeys is removed.

Verified on fediversity-ci: deployment-tf-incus-hosts, apps-tf-incus,
apps-api, apps-tf, deployment-tf-hosts all green.

Note that this may remove some ssh bits from api/panel that may turn out useful for say #723.

Paves the way for #24, as suggested at https://git.fediversity.eu/fediversity/fediversity/issues/295#issuecomment-14806. The `tf-incus` path provisioned Incus containers with the `lxc/incus` provider, then deployed NixOS onto them over SSH: `nix-copy-closure` plus `switch-to-configuration` through `ProxyJump=incushost`, gated on `await-ssh.sh`. To make that channel reachable each container baked the deployer's pubkey into root's `authorized_keys` and carried SSH-survival scaffolding to keep sshd alive across the switch. The deployer already holds an Incus mTLS client cert and the container instance name is plumbed through the data model, so the container is reachable with `incus exec` against `incus:<name>` without any SSH into it. Switch the deployment transport to `incus exec`: - New `src/effects/incus/run.sh`: streams the closure with `nix-store --export | incus exec -T -- nix-store --import` (no `nix-copy-closure`), runs every remote step via `incus exec`, and registers the provider's mTLS remote at runtime (the provider keeps remotes in TF state only, so the CLI config dir has none). The transport-agnostic nspawn D-Bus-recovery logic is preserved. - New `src/effects/tf/incus/host/` module + `await-incus.sh` readiness gate; `hosts/main.tf` addresses containers by name, dropping the cached-IP dance and `await-ssh.sh`. - The deploy/await scripts are `writeShellApplication`-wrapped so `pkgs.incus` is pinned on PATH. Containers keep sshd for operator login (the shared `setups/nixos/networking.nix` + procolix keys); only the deployer's baked key and the deploy-SSH scaffolding are removed. The now-dead SSH key wiring in the api/panel/tf-incus tests is dropped accordingly. `incusModel` is also the deployed-config generator for the SSH-transport tests (`apps-tf`, `deployment-tf-hosts`), whose test scripts still SSH `root@<container>` after the deploy, so the sshd-survival block stays in `incusModel` (inert for the incus path); only `extraRootKeys` is removed. Verified on fediversity-ci: deployment-tf-incus-hosts, apps-tf-incus, apps-api, apps-tf, deployment-tf-hosts all green. Note that this may remove some ssh bits from api/panel that may turn out useful for say #723.

kiara added 1 commit 2026-06-21 01:01:46 +02:00

feat(tf-incus): deploy via incus exec, drop deployment SSH ... dd6ba18ec3

The `tf-incus` path provisioned Incus containers with the `lxc/incus`
provider, then deployed NixOS onto them over SSH: `nix-copy-closure`
plus `switch-to-configuration` through `ProxyJump=incushost`, gated on
`await-ssh.sh`. To make that channel reachable each container baked the
deployer's pubkey into root's `authorized_keys` and carried SSH-survival
scaffolding to keep sshd alive across the switch.

The deployer already holds an Incus mTLS client cert and the container
instance name is plumbed through the data model, so the container is
reachable with `incus exec` against `incus:<name>` without any SSH into
it. Switch the deployment transport to `incus exec`:

- New `src/effects/incus/run.sh`: streams the closure with
  `nix-store --export | incus exec -T -- nix-store --import` (no
  `nix-copy-closure`), runs every remote step via `incus exec`, and
  registers the provider's mTLS remote at runtime (the provider keeps
  remotes in TF state only, so the CLI config dir has none). The
  transport-agnostic nspawn D-Bus-recovery logic is preserved.
- New `src/effects/tf/incus/host/` module + `await-incus.sh` readiness
  gate; `hosts/main.tf` addresses containers by name, dropping the
  cached-IP dance and `await-ssh.sh`.
- The deploy/await scripts are `writeShellApplication`-wrapped so
  `pkgs.incus` is pinned on PATH.

Containers keep sshd for operator login (the shared
`setups/nixos/networking.nix` + procolix keys); only the deployer's
baked key and the deploy-SSH scaffolding are removed. The now-dead SSH
key wiring in the api/panel/tf-incus tests is dropped accordingly.

`incusModel` is also the deployed-config generator for the SSH-transport
tests (`apps-tf`, `deployment-tf-hosts`), whose test scripts still SSH
`root@<container>` after the deploy, so the sshd-survival block stays in
`incusModel` (inert for the incus path); only `extraRootKeys` is removed.

Verified on fediversity-ci: deployment-tf-incus-hosts, apps-tf-incus,
apps-api, apps-tf, deployment-tf-hosts all green.

Assisted-by: Claude:claude-opus-4-8

kiara changed title from WIP: feat(tf-incus): deploy via incus exec, drop deployment SSH to feat(tf-incus): deploy via incus exec, drop deployment SSH 2026-06-21 10:22:33 +02:00

kiara requested review from developers 2026-06-21 10:22:33 +02:00

kiara merged commit 46350fed2c into main 2026-06-21 10:22:47 +02:00

kiara deleted branch incus-exec 2026-06-21 10:22:47 +02:00

kiara referenced this pull request from a commit 2026-06-21 10:22:48 +02:00

feat(tf-incus): deploy via `incus exec`, drop deployment SSH (#1112)

kiara referenced this pull request 2026-06-21 10:27:30 +02:00

different deployment methods supported in panel #723

kiara referenced this pull request 2026-06-21 14:59:21 +02:00

Disable root SSH authentication altogether #24

kiara referenced this pull request 2026-06-28 16:10:55 +02:00

feat(panel): operator deployment-method selector + config-source pin (#723) #1071

kiara referenced this pull request from a commit 2026-07-11 13:04:48 +02:00

feat(panel): operator deployment-method selector + config-source pin (#723) (#1071)

Sign in to join this conversation.

Reviewers

No reviewers

fediversity/developers

Labels

Clear labels   

0 points

fibonacci complexity: 0 points

  

0.5 points

fibonacci complexity: 0.5 points

  

1 point

fibonacci complexity: 1 point

  

13 points

fibonacci complexity: 13 points

  

2 points

fibonacci complexity: 2 points

  

21 points

fibonacci complexity: 21 points

  

3 points

fibonacci complexity: 3 points

  

34 points

fibonacci complexity: 34 points

  

5 points

fibonacci complexity: 5 points

  

55 points

fibonacci complexity: 55 points

  

8 points

fibonacci complexity: 8 points

  

ambition

application-offering

  

ambition

configure-applications

  

ambition

front-end

  

ambition/install-applications

  

ambition

security

  

ambition

switch-host

  

ambition

update-applications

  

ambition

user-management

  

api service

features that may relate more to a (to be created) API service

  

blocked

  

component: fediversity panel

  

component: nixops4

  

documentation

  

estimation high: >3d

  

estimation low: <2h

  

estimation mid: <8h

  

infinite points

fibonacci complexity: infinite points

  

productisation

features out-scoped with the decoupling of the productisation effort

  

project-management

Project management related tasks

  

question

  

role: application developer

  

role: application operator

  

role: hosting provider

  

role: maintainer

  

security

  

technical debt

  

testing

  

type unclear

  

type: bug

Anything that doesn't work as advertised

  

type: deliverable

  

type: key result

  

type: objective

  

type: task

  

type: user story

  

user experience

No labels

0 points

0.5 points

1 point

13 points

2 points

21 points

3 points

34 points

5 points

55 points

8 points

ambition

application-offering

ambition

configure-applications

ambition

front-end

ambition/install-applications

ambition

security

ambition

switch-host

ambition

update-applications

ambition

user-management

api service

blocked

component: fediversity panel

component: nixops4

documentation

estimation high: >3d

estimation low: <2h

estimation mid: <8h

infinite points

productisation

project-management

question

role: application developer

role: application operator

role: hosting provider

role: maintainer

security

technical debt

testing

type unclear

type: bug

type: deliverable

type: key result

type: objective

type: task

type: user story

user experience

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fediversity/fediversity!1112

No description provided.