From 13c92280ab9520c6a6fb0e92763cdeef5875f468 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?=
 <nicolas.jeannerod@moduscreate.com>
Date: Wed, 2 Jul 2025 17:49:44 +0200
Subject: [PATCH] Clean up `lib` in `forgejo-ci` and extend on the
 `.ssh/config` comment (#428)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-on: https://git.fediversity.eu/Fediversity/Fediversity/pulls/428
Reviewed-by: kiara Grouwstra <kiara@procolix.eu>
Co-authored-by: Nicolas “Niols” Jeannerod <nicolas.jeannerod@moduscreate.com>
Co-committed-by: Nicolas “Niols” Jeannerod <nicolas.jeannerod@moduscreate.com>
---
 machines/dev/forgejo-ci/default.nix | 32 ++++++++++++++++-------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/machines/dev/forgejo-ci/default.nix b/machines/dev/forgejo-ci/default.nix
index 569cbb4b..f0aa9c45 100644
--- a/machines/dev/forgejo-ci/default.nix
+++ b/machines/dev/forgejo-ci/default.nix
@@ -1,12 +1,23 @@
-{
-  lib,
-  ...
-}:
+{ lib, ... }:
+
+let
+  inherit (lib) mkDefault mkForce;
+in
+
 {
   _class = "nixops4Resource";
 
-  # XXX this needs an SSH config entry `forgejo-ci` to locate and access the machine. also needs `HostKeyAlias`.
-  ssh.host = lib.mkForce "forgejo-ci";
+  # NOTE: This needs an SSH config entry `forgejo-ci` to locate and access the
+  # machine. This is because different people access the machine in different
+  # way (eg. via a proxy vs. via Procolix's VPN). This might look like:
+  #
+  #     Host forgejo-ci
+  #          HostName 45.142.234.216
+  #          HostKeyAlias forgejo-ci
+  #
+  # The `HostKeyAlias` statement is crucial. Without it, deployment will fail
+  # with the SSH error “Host key verification failed”.
+  ssh.host = mkForce "forgejo-ci";
 
   fediversityVm = {
     domain = "procolix.com";
@@ -21,14 +32,7 @@
   };
 
   nixos.module =
-    {
-      config,
-      lib,
-      ...
-    }:
-    let
-      inherit (lib) mkDefault mkForce;
-    in
+    { config, ... }:
     {
       _class = "nixos";