rm some pipelines

try store mounted read-only
- `--store` as per https://blog.kotatsu.dev/posts/2023-04-21-woodpecker-nix-caching/ - `--eval-store` as per https://kevincox.ca/2022/01/02/nix-in-docker-caching/ mount store rm kvm bash -> sh
2025-08-04 22:51:59 +02:00 · 2025-08-04 22:51:59 +02:00 · 2025-08-04 22:51:59 +02:00 · 2025-08-04 22:51:59 +02:00 · 2025-08-04 22:51:59 +02:00 · 2025-08-04 22:51:59 +02:00
11 changed files with 12 additions and 121 deletions
--- a/.woodpecker/cd.yaml
+++ b/.woodpecker/cd.yaml
@ -8,12 +8,14 @@ when:
 steps:
  - name: build
    image: nixos/nix
+    volumes:
+      - /nix:/mnt/nix:ro
    commands:
      - |
        mkdir -p ~/.ssh
        echo "$CD_SSH_KEY" > ~/.ssh/id_ed25519
        chmod 600 ~/.ssh/id_ed25519
-      - nix-shell --run 'eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 && ssh-agent -s && SHELL=$(which bash) nixops4 apply -v default'
+      - nix-shell --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt --run 'eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 && ssh-agent -s && SHELL=$(which sh) nixops4 apply -v default'
    environment:
      CD_SSH_KEY:
        from_secret: cd_ssh_key
--- a/.woodpecker/check-data-model.yaml
+++ b/.woodpecker/check-data-model.yaml
@ -9,5 +9,7 @@ when:
 steps:
  - name: check-data-model
    image: nixos/nix
+    volumes:
+      - /nix:/mnt/nix:ro
    commands:
-      - nix-shell --run 'nix-unit ./deployment/data-model-test.nix'
+      - nix-shell --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt --run 'nix-unit ./deployment/data-model-test.nix'
--- a/.woodpecker/check-deployment-basic.yaml
+++ b/.woodpecker/check-deployment-basic.yaml
@ -1,15 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: pull_request
-  - event: push
-    branch: main
-
-steps:
-  - name: check-deployment-basic
-    image: nixos/nix
-    commands:
-      - nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.deployment-basic -L
-    devices:
-      - /dev/kvm:/dev/kvm
--- a/.woodpecker/check-deployment-cli.yaml
+++ b/.woodpecker/check-deployment-cli.yaml
@ -1,15 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: pull_request
-  - event: push
-    branch: main
-
-steps:
-  - name: check-deployment-cli
-    image: nixos/nix
-    commands:
-      - nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.deployment-cli -L
-    devices:
-      - /dev/kvm:/dev/kvm
--- a/.woodpecker/check-deployment-panel.yaml
+++ b/.woodpecker/check-deployment-panel.yaml
@ -1,15 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: pull_request
-  - event: push
-    branch: main
-
-steps:
-  - name: check-deployment-panel
-    image: nixos/nix
-    commands:
-      - nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.deployment-panel -L
-    devices:
-      - /dev/kvm:/dev/kvm
--- a/.woodpecker/check-mastodon.yaml
+++ b/.woodpecker/check-mastodon.yaml
@ -9,5 +9,7 @@ when:
 steps:
  - name: check-mastodon
    image: nixos/nix
+    volumes:
+      - /nix:/mnt/nix:ro
    commands:
-      - nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.test-mastodon-service -L
+      - nix build --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.test-mastodon-service -L
--- a/.woodpecker/check-panel.yaml
+++ b/.woodpecker/check-panel.yaml
@ -1,13 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: pull_request
-  - event: push
-    branch: main
-
-steps:
-  - name: check-panel
-    image: nixos/nix
-    commands:
-      - nix-build -A tests.panel
--- a/.woodpecker/check-peertube.yaml
+++ b/.woodpecker/check-peertube.yaml
@ -1,13 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: pull_request
-  - event: push
-    branch: main
-
-steps:
-  - name: check-peertube
-    image: nixos/nix
-    commands:
-      - nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.test-peertube-service -L
--- a/.woodpecker/check-pre-commit.yaml
+++ b/.woodpecker/check-pre-commit.yaml
@ -1,13 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: pull_request
-  - event: push
-    branch: main
-
-steps:
-  - name: check-pre-commit
-    image: nixos/nix
-    commands:
-      - nix-build -A tests
--- a/.woodpecker/check-resources.yaml
+++ b/.woodpecker/check-resources.yaml
@ -1,33 +0,0 @@
-$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
-
-when:
-  - event: manual
-  - event: push
-    branch: main
-
-## NOTE: NixOps4 does not provide a good “dry run” mode, so we instead check
-## proxies for resources, namely whether their `.#vmOptions.<machine>` and
-## `.#nixosConfigurations.<machine>` outputs evaluate and build correctly, and
-## whether we can dry run `infra/proxmox-*.sh` on them. This will not catch
-## everything, and in particular not issues in how NixOps4 wires up the
-## resources, but that is still something.
-steps:
-  - name: check-resources
-    image: nixos/nix
-    commands:
-      - echo ==================== [ VM Options ] ====================
-      - |
-        set -euC
-        machines=$(nix eval --impure --raw --expr 'with builtins; toString (attrNames (getFlake (toString ./.)).vmOptions)')
-        for machine in $machines; do
-          echo ~~~~~~~~~~~~~~~~~~~~~: $machine :~~~~~~~~~~~~~~~~~~~~~
-          nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.vmOptions-$machine
-        done
-      - echo ==================== [ NixOS Configurations ] ====================
-      - |
-        set -euC
-        machines=$(nix eval --impure --raw --expr 'with builtins; toString (attrNames (getFlake (toString ./.)).nixosConfigurations)')
-        for machine in $machines; do
-          echo ~~~~~~~~~~~~~~~~~~~~~: $machine :~~~~~~~~~~~~~~~~~~~~~
-          nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.nixosConfigurations-$machine
-        done
--- a/.woodpecker/update.yaml
+++ b/.woodpecker/update.yaml
@ -8,8 +8,10 @@ when:
 steps:
  - name: lockfile
    image: nixos/nix
+    volumes:
+      - /nix:/mnt/nix:ro
    commands:
-      - nix-shell --run "npins update"
+      - nix-shell --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt --run "npins update"
      # - name: Create PR
      #   uses: https://github.com/KiaraGrouwstra/gitea-create-pull-request@f9f80aa5134bc5c03c38f5aaa95053492885b397
      #   with:
Author	SHA1	Message	Date
Kiara Grouwstra	9c7c38bd45	rm some pipelines Some checks failed ci/woodpecker/manual/check-mastodon Pipeline failed Details ci/woodpecker/manual/update Pipeline failed Details ci/woodpecker/manual/cd Pipeline failed Details ci/woodpecker/manual/check-data-model Pipeline failed Details	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	6d89c7c09c	try store mounted read-only - `--store` as per https://blog.kotatsu.dev/posts/2023-04-21-woodpecker-nix-caching/ - `--eval-store` as per https://kevincox.ca/2022/01/02/nix-in-docker-caching/ mount store rm kvm bash -> sh	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	9d14f2e5a9	mv woodpecker	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	da1401a9c0	mount /dev/kvm This reverts commit 32a8c011133045f624f23d0cacd6e2b81ccc78eb.	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	554d9ac459	schema	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	7a86b00838	container dns rm dns	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	472453c6b7	enable firewall	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	7570f40cf1	document nftables	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	ddb4aa32b4	generalize firewall hole	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	cbaaa52d5d	rm agent exec plug hole in firewall format	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	d635759101	disable firewall nftables disables nftables for woodpecker, just like for forgejo-ci	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	42fa39c95e	disable exec agent make service group setting conditional make secrets conditional make things conditional rm group	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	fd416c4d22	set service groups add agent groups	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	49c71ba3ed	un-template none like _file somehow?	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	dba912bd95	fix container agent	2025-08-04 22:51:59 +02:00
Kiara Grouwstra	3ce080591e	add woodpecker CI add woodpecker status: agents error `agent could not auth: individual agent not found by token: sql: no rows in result set` allow manual set `image: bash` to initally test `local` woodpecker back-end split CI jobs image: `bash` (`local` back-end) -> `nixos/nix` (`docker` back-end) add debugging lines to CD pipeline to debug error `Could not open a connection to your authentication agent` add more debug prints to CD even more debugging continue debugging debug harder explicitly specify flakes as nixos/nix image is missing this rm /home update fedi203 wrap faulty statement fix check-resources split strace pkg un-strace un-test cd dedupe image max 5 un-bash strace configure user simplify secrets set just group for system users unverbose npins	2025-08-04 22:51:59 +02:00