kiara/Fediversity
1
0
Fork 0
forked from fediversity/fediversity
Code Pull requests Activity

factor out ssh deployment to make for reusable invocation

Browse source
This commit is contained in:
Kiara Grouwstra 2025-08-30 19:24:50 +02:00
parent 7df7310e96
commit 90d9988d88
Signed by: kiara
SSH key fingerprint: SHA256:COspvLoLJ5WC5rFb9ZDe5urVCkK4LJZOsjfF4duRJFU
6 changed files with 193 additions and 85 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
deployment/check/common/data-model.nix
View file

@ -1,17 +1,18 @@
{
config,
system,
inputs ? (import ../../../default.nix { }).inputs,
inputs ? (import ../../../default.nix { }).inputs, # XXX can't be serialized
sources ? import ../../../npins,
...
}:
}@args:
let
self = "deployment/check/common/data-model.nix";
inherit (sources) nixpkgs;
pkgs = import nixpkgs { inherit system; };
inherit (pkgs) lib;
deployment-config = config;
inherit (deployment-config) nodeName;
inherit (deployment-config) nodeName pathToRoot;
inherit (lib) mkOption types;
eval =
module:
@ -124,17 +125,25 @@ let
{
single-nixos-vm-ssh = environment: {
resources."operator-environment".login-shell.username = "operator";
implementation = requests: {
input = requests;
output.ssh-host = {
nixos-configuration = mkNixosConfiguration environment requests;
ssh = {
username = "root";
host = nodeName;
key-file = null;
implementation =
{
required-resources,
deployment-name,
root-path,
}:
{
input = required-resources;
output.ssh-host = {
nixos-configuration = mkNixosConfiguration environment required-resources;
ssh = {
username = "root";
host = nodeName;
key-file = null;
};
module = self;
inherit args deployment-name root-path;
};
};
};
};
single-nixos-vm-nixops4 = environment: {
resources."operator-environment".login-shell.username = "operator";
@ -175,7 +184,11 @@ let
in
mkOption {
type = env.resource-mapping.output-type;
default = env.deployment config."example-configuration";
default = env.deployment {
deployment-name = "ssh-deployment";
configuration = config."example-configuration";
root-path = pathToRoot;
};
};
"nixops4-deployment" =
let
@ -183,7 +196,11 @@ let
in
mkOption {
type = env.resource-mapping.output-type;
default = env.deployment config."example-configuration";
default = env.deployment {
deployment-name = "nixops4-deployment";
configuration = config."example-configuration";
root-path = pathToRoot;
};
};
};
}

3
deployment/check/common/sharedOptions.nix
View file

@ -32,11 +32,10 @@ in
};
pathFromRoot = mkOption {
type = types.path;
type = types.str;
description = ''
Path from the root of the repository to the working directory.
'';
apply = x: lib.path.removePrefix config.pathToRoot x;
};
pathToCwd = mkOption {

67
deployment/check/data-model-ssh/nixosTest.nix
View file

@ -1,30 +1,20 @@
{
lib,
config,
pkgs,
inputs,
...
}:
let
inherit (import ./constants.nix) pathToRoot pathFromRoot;
inherit (pkgs) system;
escapedJson = v: lib.replaceStrings [ "\"" ] [ "\\\\\"" ] (lib.strings.toJSON v);
deployment-config = {
inherit pathToRoot pathFromRoot;
inherit (config) enableAcme;
acmeNodeIP = if config.enableAcme then config.nodes.acme.networking.primaryIPAddress else null;
nodeName = "ssh";
};
inherit
((import ../common/data-model.nix {
inherit system inputs;
deployment =
(import ../common/data-model.nix {
inherit system;
config = deployment-config;
})."ssh-deployment".ssh-host.ssh
)
host
username
key-file
;
})."ssh-deployment".ssh-host;
in
{
_class = "nixosTest";
@ -36,6 +26,10 @@ in
sourceFileset = lib.fileset.unions [
../../data-model.nix
../../function.nix
../../nixos.nix
../../run/ssh-single-host/run.sh
../../../npins/default.nix
../../../npins/sources.json
../common/data-model.nix
../common/data-model-options.nix
./constants.nix
@ -58,51 +52,12 @@ in
};
extraTestScript = ''
with subtest("ssh: Check the status before deployment"):
with subtest("Check the status before deployment"):
ssh.fail("hello 1>&2")
with subtest("ssh: Run the deployment"):
with subtest("Run the deployment"):
deployer.succeed("""
set -euo pipefail
# INSTANTIATE
command=(nix-instantiate --show-trace --expr '
let
system = "${pkgs.system}"; # FIXME: what system are we deploying to?
in
import ${pathToRoot}/deployment/nixos.nix {
inherit system;
configuration = (
import ${pathToRoot}/deployment/check/common/data-model.nix {
inherit system;
config = builtins.fromJSON "${escapedJson deployment-config}";
}
)."ssh-deployment".ssh-host.nixos-configuration;
}
')
# DEPLOY
host="${lib.defaultTo "root" username}@${host}"
sshOpts=(
${if key-file == null then "" else "-i ${key-file}"}
-o StrictHostKeyChecking=no
-o "ConnectTimeout=1"
-o "ServerAliveInterval=1"
)
# instantiate the config in /nix/store
"''${command[@]}" --show-trace -A out_path
# get the realized derivation to deploy
outPath=$(nix-store --realize "$("''${command[@]}" --show-trace --eval --strict --json | jq -r '.drv_path')")
# deploy the config by nix-copy-closure
NIX_SSHOPTS="''${sshOpts[*]}" nix-copy-closure --to "$host" "$outPath" --gzip --use-substitutes
# switch the remote host to the config
output=$(ssh "''${sshOpts[@]}" "$host" "nix-env --profile /nix/var/nix/profiles/system --set $outPath; nohup $outPath/bin/switch-to-configuration switch &" 2>&1) || echo "status code: $?"
echo "output: $output"
if [[ $output != *"Timeout, server ssh not responding"* ]]; then
echo "non-timeout error: $output"
exit 1
else
exit 0
fi
${deployment.run}
""")
ssh.wait_for_unit("multi-user.target")
ssh.succeed("su - operator -c hello 1>&2")

94
deployment/data-model.nix
View file

@ -71,12 +71,75 @@ let
deployment-type = attrTag {
ssh-host = mkOption {
description = "A deployment by SSH to update a single existing NixOS host.";
type = submodule {
type = submodule (ssh-host: {
options = {
inherit nixos-configuration;
ssh = host-ssh;
module = mkOption {
description = "The module to call to obtain the NixOS configuration from.";
type = types.str;
};
args = mkOption {
description = "The arguments with which to call the module to obtain the NixOS configuration.";
type = types.attrs;
};
deployment-name = mkOption {
description = "The name of the deployment for which to obtain the NixOS configuration.";
type = types.str;
};
root-path = mkOption {
description = "The path to the root of the repository.";
type = types.path;
};
run = mkOption {
type = types.str;
# readOnly = true;
default =
let
inherit (ssh-host.config)
ssh
module
args
deployment-name
root-path
;
inherit (ssh) host username key-file;
environment = {
key_file = key-file;
deployment_name = deployment-name;
root_path = root-path;
system = pkgs.system; # XXX recheck this is the right one
inherit
host
username
module
args
;
deployment_type = "ssh-host";
};
in
''
env ${
toString (
lib.mapAttrsToList (
k: v:
"${k}=\"${
lib.replaceStrings [ "\"" ] [ "\\\\\"" ] (
if lib.isPath v || builtins.isNull v then
toString v
else if lib.isString v then
v
else
lib.strings.toJSON v
)
}\""
) environment
)
} bash ./deployment/run/ssh-single-host/run.sh
'';
};
};
};
});
};
nixops4 = mkOption {
description = "A NixOps4 NixOS deployment. For an example, see https://github.com/nixops4/nixops4-nixos/blob/main/example/deployment.nix.";
@ -192,7 +255,19 @@ in
type = submodule functionType;
readOnly = true;
default = {
input-type = attrsOf application-resources;
input-type = submodule {
options = {
deployment-name = mkOption {
type = types.str;
};
root-path = mkOption {
type = types.str;
};
required-resources = mkOption {
type = attrsOf application-resources;
};
};
};
output-type = deployment-type;
};
};
@ -201,17 +276,24 @@ in
# then the deployments can simply be the result of the function application baked into this module.
deployment = mkOption {
description = "Generate a deployment from a configuration, by applying an environment's resource policies to the applications' resource mappings";
# type = functionTo (functionTo (environment.config.resource-mapping.output-type));
type = functionTo (environment.config.resource-mapping.output-type);
readOnly = true;
default =
cfg:
{
deployment-name,
root-path,
configuration,
}:
# deployment-name: cfg:
# TODO: check cfg.enable.true
let
required-resources = lib.mapAttrs (
name: application-settings: config.applications.${name}.resources application-settings
) cfg.applications;
) configuration.applications;
in
(environment.config.implementation required-resources).output;
(environment.config.implementation { inherit required-resources deployment-name root-path; })
.output;
};
};

22
deployment/nixos.nix
View file

@ -1,6 +1,7 @@
{
configuration,
system,
# commandFn,
sources ? import ../npins,
}:
let
@ -11,13 +12,20 @@ let
};
modules = [ configuration ];
};
os = {
inherit (eval) pkgs config options;
system = eval.config.system.build.toplevel;
inherit (eval.config.system.build) vm vmWithBootLoader;
};
inherit
(
{
inherit (eval) pkgs config options;
system = eval.config.system.build.toplevel;
inherit (eval.config.system.build) vm vmWithBootLoader;
}
.config.system.build
)
toplevel
;
in
{
drv_path = os.config.system.build.toplevel.drvPath;
out_path = os.config.system.build.toplevel;
drv_path = toplevel.drvPath;
out_path = toplevel;
# command = commandFn "$(nix-instantiate --realize ${toplevel.drvPath})";
}

47
deployment/run/ssh-single-host/run.sh Executable file
View file

@ -0,0 +1,47 @@
#! /usr/bin/env bash
set -xeuo pipefail
declare username host system module args deployment_name deployment_type args key_file root_path
# DEPLOY
sshOpts=(
-o BatchMode=yes
-o StrictHostKeyChecking=no
# NOTE the below options are for tests
-o ConnectTimeout=1
-o ServerAliveInterval=1
)
if [[ -n "$key_file" ]]; then
sshOpts+=(
-i "$key_file"
)
fi
destination="$username@$host"
command=(nix-instantiate --show-trace --expr "
import $root_path/deployment/nixos.nix {
system = \"$system\";
configuration = (import \"$root_path/$module\" (builtins.fromJSON ''$args'')).$deployment_name.$deployment_type.nixos-configuration;
}
")
# INSTANTIATE
# instantiate the config in /nix/store
"${command[@]}" -A out_path
# get the realized derivation to deploy
outPath=$(nix-store --realize "$("${command[@]}" --show-trace --eval --strict --json | jq -r '.drv_path')")
# deploy the config by nix-copy-closure
NIX_SSHOPTS="${sshOpts[*]}" nix-copy-closure --to "$destination" "$outPath" --gzip --use-substitutes
# switch the remote host to the config
# NOTE checks here are for tests - in production time-outs could be a real thing, rather than indicator of success!
# shellcheck disable=SC2029
ssh "${sshOpts[@]}" "$destination" "nix-env --profile /nix/var/nix/profiles/system --set $outPath"
# shellcheck disable=SC2029
output=$(ssh "${sshOpts[@]}" "$destination" "nohup $outPath/bin/switch-to-configuration switch &" 2>&1) || echo "status code: $?"
echo "output: $output"
if [[ $output != *"Timeout, server $host not responding"* ]]; then
echo "non-timeout error: $output"
exit 1
else
exit 0
fi