continued

Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>

.forgejo/workflows/ci.yaml

@@ -10,106 +10,8 @@ on:
       - main
 
 jobs:
-  check-pre-commit:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix-build -A tests
-
   check-data-model:
     runs-on: native
     steps:
       - uses: actions/checkout@v4
       - run: nix-shell --run 'nix-unit ./deployment/data-model-test.nix'
-
-  check-mastodon:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.test-mastodon-service -L
-
-  check-peertube:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.test-peertube-service -L
-
-  check-panel:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix-build -A tests.panel
-
-  check-proxmox-basic:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.proxmox-basic -L
-
-  check-deployment-basic:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-basic -L
-
-  check-deployment-cli:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-cli -L
-
-  check-deployment-panel:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-panel -L
-
-  check-deployment-model:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-model-ssh -L
-
-  check-deployment-model-ssh:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-model-ssh -L
-
-  check-deployment-model-nixops4:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-model-nixops4 -L
-
-  check-deployment-model-tf:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build .#checks.x86_64-linux.deployment-model-tf -L
-
-  ## NOTE: NixOps4 does not provide a good “dry run” mode, so we instead check
-  ## proxies for resources, namely whether their `.#vmOptions.<machine>` and
-  ## `.#nixosConfigurations.<machine>` outputs evaluate and build correctly, and
-  ## whether we can dry run `infra/proxmox-*.sh` on them. This will not catch
-  ## everything, and in particular not issues in how NixOps4 wires up the
-  ## resources, but that is still something.
-  check-resources:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: |
-          set -euC
-          echo ==================== [ VM Options ] ====================
-          machines=$(nix eval --impure --raw --expr 'with builtins; toString (attrNames (getFlake (toString ./.)).vmOptions)')
-          for machine in $machines; do
-            echo ~~~~~~~~~~~~~~~~~~~~~: $machine :~~~~~~~~~~~~~~~~~~~~~
-            nix build .#checks.x86_64-linux.vmOptions-$machine
-          done
-          echo
-          echo ==================== [ NixOS Configurations ] ====================
-          machines=$(nix eval --impure --raw --expr 'with builtins; toString (attrNames (getFlake (toString ./.)).nixosConfigurations)')
-          for machine in $machines; do
-            echo ~~~~~~~~~~~~~~~~~~~~~: $machine :~~~~~~~~~~~~~~~~~~~~~
-            nix build .#checks.x86_64-linux.nixosConfigurations-$machine
-          done

.forgejo/workflows/nix-flake-check.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+set -euC
+
+cd "$(dirname "$0")" || exit 3
+
+nix_eval () { nix eval --impure --raw --expr "with builtins; $1"; }
+system=$(nix_eval "currentSystem")
+checks=$(nix_eval "toJSON (attrNames (getFlake (toString ../..)).checks.$system)")
+
+output=$(mktemp)
+
+{
+    cat <<EOF
+name: Nix flake checks
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  push:
+    branches:
+      - main
+
+jobs:
+  _checks:
+    needs: $checks
+    runs-on: native
+    steps:
+      - run: true
+
+  _complete:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix-shell --run '.forgejo/workflows/nix-flake-check.sh check'
+EOF
+
+    for check in $(echo "$checks" | jq -r .[]); do
+        cat <<EOF
+
+  $check:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.$system.$check -vL
+EOF
+    done
+} >| "$output"
+
+target=$(basename "$0" .sh).yaml
+
+if [ $# -eq 1 ] && [ "$1" = "check" ]; then
+    if ! diff_output=$(diff --color=always "$target" "$output"); then
+        printf >&2 'Changes detected (\e[31m< current\e[0m | \e[32m> generated\e[0m):\n%s\n' "$diff_output"
+        exit 1
+    fi
+else
+    mv "$output" "$target"
+fi

.forgejo/workflows/nix-flake-check.yaml

@@ -0,0 +1,300 @@
+name: Nix flake checks
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  push:
+    branches:
+      - main
+
+jobs:
+  _checks:
+    needs: ["deployment-basic","deployment-cli","deployment-model-nixops4","deployment-model-ssh","deployment-model-tf","deployment-model-tf-proxmox","deployment-panel","nixops-deployment-providers-default","nixops-deployment-providers-fedi200","nixops-deployment-providers-fedi201","nixops-deployment-providers-forgejo-ci","nixops-deployment-providers-test","nixops-deployment-providers-vm02116","nixops-deployment-providers-vm02187","nixosConfigurations-fedi200","nixosConfigurations-fedi201","nixosConfigurations-forgejo-ci","nixosConfigurations-test01","nixosConfigurations-test02","nixosConfigurations-test03","nixosConfigurations-test04","nixosConfigurations-test05","nixosConfigurations-test06","nixosConfigurations-test11","nixosConfigurations-test12","nixosConfigurations-test13","nixosConfigurations-test14","nixosConfigurations-vm02116","nixosConfigurations-vm02187","panel","pre-commit","proxmox-basic","test-mastodon-service","test-peertube-service","vmOptions-fedi200","vmOptions-fedi201","vmOptions-test01","vmOptions-test02","vmOptions-test03","vmOptions-test04","vmOptions-test05","vmOptions-test06","vmOptions-test11","vmOptions-test12","vmOptions-test13","vmOptions-test14"]
+    runs-on: native
+    steps:
+      - run: true
+
+  _complete:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix-shell --run '.forgejo/workflows/nix-flake-check.sh check'
+
+  deployment-basic:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-basic -vL
+
+  deployment-cli:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-cli -vL
+
+  deployment-model-nixops4:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-model-nixops4 -vL
+
+  deployment-model-ssh:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-model-ssh -vL
+
+  deployment-model-tf:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-model-tf -vL
+
+  deployment-model-tf-proxmox:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-model-tf-proxmox -L
+
+  deployment-panel:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.deployment-panel -vL
+
+  nixops-deployment-providers-default:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-default -vL
+
+  nixops-deployment-providers-fedi200:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-fedi200 -vL
+
+  nixops-deployment-providers-fedi201:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-fedi201 -vL
+
+  nixops-deployment-providers-forgejo-ci:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-forgejo-ci -vL
+
+  nixops-deployment-providers-test:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-test -vL
+
+  nixops-deployment-providers-vm02116:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-vm02116 -vL
+
+  nixops-deployment-providers-vm02187:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-vm02187 -vL
+
+  nixosConfigurations-fedi200:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-fedi200 -vL
+
+  nixosConfigurations-fedi201:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-fedi201 -vL
+
+  nixosConfigurations-forgejo-ci:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-forgejo-ci -vL
+
+  nixosConfigurations-test01:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test01 -vL
+
+  nixosConfigurations-test02:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test02 -vL
+
+  nixosConfigurations-test03:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test03 -vL
+
+  nixosConfigurations-test04:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test04 -vL
+
+  nixosConfigurations-test05:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test05 -vL
+
+  nixosConfigurations-test06:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test06 -vL
+
+  nixosConfigurations-test11:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test11 -vL
+
+  nixosConfigurations-test12:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test12 -vL
+
+  nixosConfigurations-test13:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test13 -vL
+
+  nixosConfigurations-test14:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-test14 -vL
+
+  nixosConfigurations-vm02116:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-vm02116 -vL
+
+  nixosConfigurations-vm02187:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.nixosConfigurations-vm02187 -vL
+
+  panel:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.panel -vL
+
+  pre-commit:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.pre-commit -vL
+
+  proxmox-basic:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.proxmox-basic -vL
+
+  test-mastodon-service:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.test-mastodon-service -vL
+
+  test-peertube-service:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.test-peertube-service -vL
+
+  vmOptions-fedi200:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-fedi200 -vL
+
+  vmOptions-fedi201:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-fedi201 -vL
+
+  vmOptions-test01:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test01 -vL
+
+  vmOptions-test02:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test02 -vL
+
+  vmOptions-test03:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test03 -vL
+
+  vmOptions-test04:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test04 -vL
+
+  vmOptions-test05:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test05 -vL
+
+  vmOptions-test06:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test06 -vL
+
+  vmOptions-test11:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test11 -vL
+
+  vmOptions-test12:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test12 -vL
+
+  vmOptions-test13:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test13 -vL
+
+  vmOptions-test14:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.vmOptions-test14 -vL

README.md

@@ -146,8 +146,9 @@ details as to what they are for. As an overview:
 - [`keys/`](./keys) contains the public keys of the contributors to this project
   as well as the systems that we administrate.
 
-- [`matrix/`](./matrix) contains everything having to do with setting up a
+- [`machines/`](./machines) contains the code of our machines for internal infra and test VMs.
-  fully-featured Matrix server.
+
+- [`panel/`](./panel) contains the code of our front-end.
 
 - [`secrets/`](./secrets) contains the secrets that need to get injected into
   machine configurations.

default.nix

@@ -65,6 +65,7 @@ in
         pkgs.openssh
         pkgs.httpie
         pkgs.jq
+        pkgs.diffutils
         pkgs.nix-unit
         test-loop
         nixops4.packages.${system}.default

deployment/check/common/data-model-options.nix

@@ -21,5 +21,18 @@ in
       default = [ ];
       example = "ConnectTimeout=60";
     };
+    proxmox-user = mkOption {
+      description = "The ProxmoX user to use.";
+      type = types.str;
+      default = "root@pam";
+    };
+    proxmox-password = mkOption {
+      description = "The ProxmoX password to use.";
+      type = types.str;
+    };
+    node-name = mkOption {
+      description = "the name of the ProxmoX node to use.";
+      type = types.str;
+    };
   };
 }

deployment/check/common/data-model.nix

@@ -5,6 +5,7 @@
   sources ? import ../../../npins,
   ...
 }@args:
+# FIXME allow default values for `config` module parameters?
 
 let
   # having this module's location (`self`) and (serializable) `args`, we know
@@ -23,13 +24,16 @@ let
     pathToRoot
     targetSystem
     sshOpts
+    proxmox-user
+    proxmox-password
     ;
+  node-name = nodeName;
   inherit (lib) mkOption types;
   eval =
     module:
     (lib.evalModules {
       specialArgs = {
-        inherit pkgs inputs;
+        inherit pkgs inputs sources;
       };
       modules = [
         module
@@ -206,6 +210,35 @@ let
                   };
                 };
             };
+            single-nixos-vm-tf-proxmox = environment: {
+              resources."operator-environment".login-shell.username = "operator";
+              implementation =
+                {
+                  required-resources,
+                  deployment-name,
+                }:
+                {
+                  tf-proxmox-host = {
+                    nixos-configuration = mkNixosConfiguration environment required-resources;
+                    system = targetSystem;
+                    ssh = {
+                      username = "root";
+                      host = nodeName;
+                      key-file = null;
+                      inherit sshOpts;
+                    };
+                    module = self;
+                    inherit
+                      args
+                      deployment-name
+                      proxmox-user
+                      proxmox-password
+                      node-name
+                      ;
+                    root-path = pathToRoot;
+                  };
+                };
+            };
           };
       };
       options = {
@@ -249,6 +282,17 @@ let
               configuration = config."example-configuration";
             };
           };
+        "tf-proxmox-deployment" =
+          let
+            env = config.environments."single-nixos-vm-tf-proxmox";
+          in
+          mkOption {
+            type = env.resource-mapping.output-type;
+            default = env.deployment {
+              deployment-name = "tf-proxmox-deployment";
+              configuration = config."example-configuration";
+            };
+          };
       };
     }
   );

deployment/check/data-model-ssh/nixosTest.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  config,
   pkgs,
   ...
 }:

deployment/check/data-model-tf-proxmox/constants.nix

@@ -0,0 +1,11 @@
+{
+  targetMachines = [
+    "mypve"
+  ];
+  pathToRoot = builtins.path {
+    path = ../../..;
+    name = "root";
+  };
+  pathFromRoot = "/deployment/check/data-model-tf-proxmox";
+  enableAcme = true;
+}

deployment/check/data-model-tf-proxmox/default.nix

@@ -0,0 +1,48 @@
+{
+  runNixOSTest,
+  inputs,
+  sources,
+  system,
+}:
+
+let
+  pkgs = import sources.nixpkgs-stable {
+    inherit system;
+    overlays = [ overlay ];
+  };
+  overlay = _: _: {
+    inherit
+      (import "${sources.proxmox-nixos}/pkgs" {
+        craneLib = pkgs.callPackage "${sources.crane}/lib" { };
+        # breaks from https://github.com/NixOS/nixpkgs/commit/06b354eb2dc535c57e9b4caaa16d79168f117a26,
+        # which updates libvncserver to 0.9.15, which was not yet patched at https://git.proxmox.com/?p=vncterm.git.
+        inherit pkgs;
+        # not so picky about version for our purposes
+        pkgs-unstable = pkgs;
+      })
+      proxmox-ve
+      pve-ha-manager
+      ;
+  };
+in
+runNixOSTest {
+  node.specialArgs = {
+    inherit
+      sources
+      pkgs
+      ;
+  };
+  imports = [
+    ../../data-model.nix
+    ../../function.nix
+    ../common/nixosTest.nix
+    ./nixosTest.nix
+  ];
+  _module.args = { inherit inputs sources; };
+  inherit (import ./constants.nix)
+    targetMachines
+    pathToRoot
+    pathFromRoot
+    enableAcme
+    ;
+}

deployment/check/data-model-tf-proxmox/nixosTest.nix

@@ -0,0 +1,263 @@
+{
+  lib,
+  pkgs,
+  sources,
+  ...
+}:
+let
+  inherit (import ./constants.nix) pathToRoot pathFromRoot;
+  inherit (pkgs) system;
+  deployment-config = {
+    inherit pathToRoot pathFromRoot;
+    nodeName = "mypve";
+    targetSystem = system;
+    sshOpts = [ ];
+    proxmox-user = "root@pam";
+    proxmox-password = "mytestpw";
+    node-name = "";
+  };
+  # FIXME generate the image `nixos-generate` was to make, but now do it for a desired `-c configuration.nix` rather than whatever generic thing now
+  deployment =
+    (import ../common/data-model.nix {
+      inherit system;
+      config = deployment-config;
+      # opt not to pass `inputs`, as we could only pass serializable arguments through to its self-call
+    })."tf-proxmox-deployment".tf-proxmox-host;
+  # tracking non-tarball downloads seems unsupported still in npins:
+  # https://github.com/andir/npins/issues/163
+  minimalIso = pkgs.fetchurl {
+    url = "https://releases.nixos.org/nixos/24.05/nixos-24.05.7139.bcba2fbf6963/nixos-minimal-24.05.7139.bcba2fbf6963-x86_64-linux.iso";
+    hash = "sha256-plre/mIHdIgU4xWU+9xErP+L4i460ZbcKq8iy2n4HT8=";
+  };
+  # machine =
+  #   (import "${pkgs.nixos-generators}/share/nixos-generator/nixos-generate.nix" {
+  #     inherit system;
+  #     inherit (sources) nixpkgs;
+  #     formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/proxmox.nix";
+  #     configuration = deployment.nixos-configuration; # /nix/store/9nl9q95lvhbr86ys0q2xakr844cg9vym-nixos-generators-1.8.0/share/nixos-generator/configuration.nix
+  #   }).config;
+  # .config.system.build.toplevel.drvPath
+  gen = import "${pkgs.nixos-generators}/share/nixos-generator/nixos-generate.nix" {
+    inherit system;
+    inherit (sources) nixpkgs;
+    formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/proxmox.nix";
+    configuration = deployment.nixos-configuration;
+  };
+  machine =
+    # lib.trace ".config: ${builtins.toString (lib.attrNames gen.config)}"
+    # lib.trace ".config.system: ${builtins.toString (lib.attrNames gen.config.system)}"
+    # lib.trace ".config.system.build: ${builtins.toString (lib.attrNames gen.config.system.build)}"
+    # lib.trace ".config.system.build.toplevel: ${builtins.toString (lib.attrNames gen.config.system.build.toplevel)}"
+    # lib.trace ".config.system.build.toplevel.drvPath: ${builtins.toString (lib.attrNames gen.config.system.build.toplevel.drvPath)}"
+    gen.config;
+in
+{
+  _class = "nixosTest";
+  imports = [
+    ../common/data-model-options.nix
+  ];
+
+  name = "deployment-model";
+  sourceFileset = lib.fileset.unions [
+    ../../run/tf-proxmox/run.sh
+  ];
+
+  nodes.mypve =
+    { sources, ... }:
+    {
+      imports = [
+        "${sources.proxmox-nixos}/modules/proxmox-ve"
+      ];
+      users.users.root = {
+        password = "mytestpw";
+        hashedPasswordFile = lib.mkForce null;
+      };
+      services.proxmox-ve = {
+        enable = true;
+        ipAddress = "192.168.1.1";
+        vms = {
+          myvm1 = {
+            vmid = 100;
+            memory = 1024;
+            cores = 1;
+            sockets = 1;
+            kvm = true;
+            scsi = [ { file = "local:16"; } ];
+            cdrom = "local:iso/minimal.iso";
+          };
+        };
+      };
+      virtualisation = {
+        additionalPaths = [ minimalIso ];
+        diskSize = 4096;
+        memorySize = 2048;
+      };
+    };
+
+  nodes.deployer =
+    { ... }:
+    {
+      nix.nixPath = [
+        (lib.concatStringsSep ":" (lib.mapAttrsToList (k: v: k + "=" + v) sources))
+      ];
+
+      environment.systemPackages = [
+        deployment.run
+      ];
+
+      # needed only when building from deployer
+      system.extraDependenciesFromModule =
+        { pkgs, ... }:
+        {
+          environment.systemPackages = with pkgs; [
+            hello
+          ];
+        };
+      system.extraDependencies =
+        # (lib.lists.map lib.traceVal)
+        (
+          (lib.lists.concatMap (
+            pkg:
+            (
+              if
+                pkg ? inputDerivation
+                # error: output '/nix/store/dki9d3vldafg9ydrfm7x0g0rr0qljk98-sudo-1.9.16p2' is not allowed to refer to the following paths:
+                #          /nix/store/2xdmps65ryklmbf025bm4pxv16gb8ajv-sudo-1.9.16p2.tar.gz
+                #          /nix/store/58br4vk3q5akf4g8lx0pqzfhn47k3j8d-bash-5.2p37
+                #          /nix/store/8v6k283dpbc0qkdq81nb6mrxrgcb10i1-gcc-wrapper-14-20241116
+                #          /nix/store/9r1nl9ksiyszy4qzzg6y2gcdkca0xmhy-stdenv-linux
+                #          /nix/store/a4rmp6in7igbl1wbz9pli5nq0wiclq0y-groff-1.23.0
+                #          /nix/store/dki9d3vldafg9ydrfm7x0g0rr0qljk98-sudo-1.9.16p2
+                #          /nix/store/f5y58qz2fzpzgkhp0nizixi10x04ppyy-linux-pam-1.6.1
+                #          /nix/store/shkw4qm9qcw5sc5n1k5jznc83ny02r39-default-builder.sh
+                #          /nix/store/vj1c3wf9c11a0qs6p3ymfvrnsdgsdcbq-source-stdenv.sh
+                #          /nix/store/yh6qg1nsi5h2xblcr67030pz58fsaxx3-coreutils-9.6
+                && !(lib.strings.hasInfix "sudo" (lib.traceVal (builtins.toString pkg)))
+              then
+                lib.trace "yes" [
+                  # lib.traceVal pkg.inputDerivation # not of type `path in the Nix store'
+                  (
+                    (
+                      x: builtins.trace "${builtins.toString pkg}: ${builtins.toString (lib.isPath x.inputDerivation)}" x
+                    )
+                    pkg
+                  ).inputDerivation
+                ]
+              else
+                lib.trace "no" [ ]
+            )
+          ) machine.environment.systemPackages)
+          # ++ (let
+          #   base =
+          #     (import "${pkgs.nixos-generators}/share/nixos-generator/nixos-generate.nix" {
+          #       inherit system;
+          #       inherit (sources) nixpkgs;
+          #       formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/proxmox.nix";
+          #       configuration = "${pkgs.nixos-generators}/share/nixos-generator/configuration.nix";
+          #     }).config;
+          # in [
+          #   base.system.build.toplevel.inputDerivation
+          #   base.system.build.etc.inputDerivation
+          #   base.system.build.etcBasedir.inputDerivation
+          #   base.system.build.etcMetadataImage.inputDerivation
+          #   base.system.build.extraUtils.inputDerivation
+          #   base.system.path.inputDerivation
+          #   base.system.build.setEnvironment.inputDerivation
+          #   base.system.build.vm.inputDerivation
+          #   base.system.build.bootStage1.inputDerivation
+          #   base.system.build.bootStage2.inputDerivation
+          # ])
+          ++ [
+            # )
+            # (
+            #   (x: builtins.trace "machine.system.build.vm.inputDerivation: ${builtins.toString (lib.isPath x)}" x)
+            machine.system.build.toplevel.inputDerivation
+            machine.system.build.etc.inputDerivation
+            machine.system.build.etcBasedir.inputDerivation
+            machine.system.build.etcMetadataImage.inputDerivation
+            machine.system.build.extraUtils.inputDerivation
+            machine.system.path.inputDerivation
+            machine.system.build.setEnvironment.inputDerivation
+            machine.system.build.vm.inputDerivation
+            machine.system.build.bootStage1.inputDerivation
+            machine.system.build.bootStage2.inputDerivation
+            pkgs.gnu-config
+            # pkgs.gnu-config.inputDerivation
+            pkgs.byacc
+            # pkgs.byacc.inputDerivation
+            pkgs.stdenv
+            pkgs.stdenvNoCC
+            sources.nixpkgs
+            pkgs.vte
+
+            (
+              ## We build a whole NixOS system that contains the module
+              ## `system.extraDependenciesFromModule`, only to grab its
+              ## configuration and the store paths needed to build it and
+              ## dump them in `system.extraDependencies`.
+              # see: https://git.fediversity.eu/Fediversity/Fediversity/pulls/338/files
+
+              pkgs.closureInfo {
+                rootPaths = map (drv: drv.drvPath) (
+                  [
+                    machine.system.build.toplevel.inputDerivation
+                    machine.system.build.etc.inputDerivation
+                    machine.system.build.etcBasedir.inputDerivation
+                    machine.system.build.etcMetadataImage.inputDerivation
+                    machine.system.build.extraUtils.inputDerivation
+                    machine.system.path.inputDerivation
+                    machine.system.build.setEnvironment.inputDerivation
+                    machine.system.build.vm.inputDerivation
+                    machine.system.build.bootStage1.inputDerivation
+                    machine.system.build.bootStage2.inputDerivation
+                  ]
+                  ++ lib.concatMap (x: if x ? source.inputDerivation then [ x.source.inputDerivation ] else [ ]) (
+                    lib.attrValues machine.environment.etc
+                  )
+                  ++ machine.environment.systemPackages
+                );
+              }
+            )
+
+          ]
+          ++ lib.concatLists (
+            lib.mapAttrsToList (
+              _k: v:
+              if v ? source.inputDerivation then
+                [
+                  # v.source.inputDerivation
+                  (
+                    (
+                      x:
+                      builtins.trace "${builtins.toString (lib.attrNames v)}: ${builtins.toString (lib.isPath x.source.inputDerivation)}" x
+                    )
+                    v
+                  ).source.inputDerivation
+                ]
+              else
+                [ ]
+            ) machine.environment.etc
+          )
+        );
+    };
+
+  extraTestScript = ''
+    mypve.wait_for_unit("pveproxy.service")
+    assert "running" in mypve.succeed("pveproxy status")
+    mypve.succeed("mkdir -p /run/pve")
+    assert "Proxmox" in mypve.succeed("curl -s -i -k https://localhost:8006")
+
+    # mypve.succeed("pvesh set /access/password --userid root@pam --password mypwdlol --confirmation-password mytestpw 1>&2")
+    # mypve.succeed("curl -s -i -k -d '{\"userid\":\"root@pam\",\"password\":\"mypwdhaha\",\"confirmation-password\":\"mypwdlol\"}' -X PUT https://localhost:8006/api2/json/access/password 1>&2")
+    # on mistake: 401 No ticket
+    # mypve.succeed("haha")
+
+    with subtest("Run the deployment"):
+      # target.fail("hello 1>&2")
+      deployer.succeed("""
+        ${lib.getExe deployment.run}
+      """)
+      # target.wait_for_unit("multi-user.target")
+      # target.succeed("su - operator -c hello 1>&2")
+  '';
+}

deployment/data-model-test.nix

@@ -98,8 +98,7 @@ in
                     {
                       options.enable = lib.mkEnableOption "Hello in the shell";
                     };
-                  implementation =
+                  implementation = cfg: {
-                    cfg: {
                     resources = lib.optionalAttrs cfg.enable {
                       hello.login-shell.packages.hello = pkgs.hello;
                     };

deployment/data-model.nix

@@ -29,6 +29,33 @@ let
       else
         lib.strings.toJSON v
     );
+  withPackages = packages: {
+    makeWrapperArgs = [
+      "--prefix"
+      "PATH"
+      ":"
+      "${lib.makeBinPath packages}"
+    ];
+  };
+  writeConfig =
+    {
+      system,
+      module,
+      root-path,
+      deployment-type,
+      deployment-name,
+      args,
+    }:
+    builtins.toString (
+      pkgs.writers.writeText "configuration.nix" ''
+        import ${root-path}/deployment/nixos.nix {
+          system = "${system}";
+          configuration = (import "${root-path}/${module}" (builtins.fromJSON "${
+            lib.replaceStrings [ "\"" ] [ "\\\"" ] (lib.strings.toJSON args)
+          }")).${deployment-name}.${deployment-type}.nixos-configuration;
+        }
+      ''
+    );
 
   functionType = submodule ./function.nix;
   application-resources = submodule {
@@ -85,6 +112,8 @@ let
       };
     };
   };
+  # FIXME allow custom deployment types
+  # FIXME make deployments environment resources?
   deployment-type = attrTag {
     ssh-host = mkOption {
       description = "A deployment by SSH to update a single existing NixOS host.";
@@ -134,30 +163,27 @@ let
                   ;
                 environment = {
                   key_file = key-file;
-                  deployment_name = deployment-name;
-                  root_path = root-path;
                   ssh_opts = sshOpts;
                   inherit
-                    system
                     host
                     username
+                    ;
+                  nixos_conf = writeConfig {
+                    inherit
+                      system
                       module
                       args
+                      deployment-name
+                      root-path
                       ;
-                  deployment_type = "ssh-host";
+                    deployment-type = "ssh-host";
+                  };
                 };
               in
               pkgs.writers.writeBashBin "deploy-sh.sh"
-                {
+                (withPackages [
-                  makeWrapperArgs = [
-                    "--prefix"
-                    "PATH"
-                    ":"
-                    "${lib.makeBinPath [
                   pkgs.jq
-                    ]}"
+                ])
-                  ];
-                }
                 ''
                   env ${
                     toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") environment)
@@ -219,32 +245,29 @@ let
                   ;
                 environment = {
                   key_file = key-file;
-                  deployment_name = deployment-name;
-                  root_path = root-path;
                   ssh_opts = sshOpts;
                   inherit
-                    system
                     host
                     username
+                    ;
+                  nixos_conf = writeConfig {
+                    inherit
+                      system
                       module
                       args
+                      deployment-name
+                      root-path
                       ;
-                  deployment_type = "tf-host";
+                    deployment-type = "tf-host";
+                  };
                 };
                 tf-env = pkgs.callPackage ./run/tf-single-host/tf-env.nix { };
               in
               pkgs.writers.writeBashBin "deploy-tf.sh"
-                {
+                (withPackages [
-                  makeWrapperArgs = [
-                    "--prefix"
-                    "PATH"
-                    ":"
-                    "${lib.makeBinPath [
                   pkgs.jq
                   (pkgs.callPackage ./run/tf-single-host/tf.nix { inherit sources; })
-                    ]}"
+                ])
-                  ];
-                }
                 ''
                   env ${toString (lib.mapAttrsToList (k: v: "TF_VAR_${k}=\"${toBash v}\"") environment)} \
                   tf_env=${tf-env} bash ./deployment/run/tf-single-host/run.sh
@@ -253,6 +276,122 @@ let
         };
       });
     };
+    tf-proxmox-host = mkOption {
+      description = "A Terraform deployment by SSH to update a single existing NixOS host.";
+      type = submodule (tf-host: {
+        options = {
+          system = mkOption {
+            description = "The architecture of the system to deploy to.";
+            type = types.str;
+          };
+          inherit nixos-configuration;
+          ssh = host-ssh;
+          # TODO: add proxmox info
+          module = mkOption {
+            description = "The module to call to obtain the NixOS configuration from.";
+            type = types.str;
+          };
+          args = mkOption {
+            description = "The arguments with which to call the module to obtain the NixOS configuration.";
+            type = types.attrs;
+          };
+          deployment-name = mkOption {
+            description = "The name of the deployment for which to obtain the NixOS configuration.";
+            type = types.str;
+          };
+          root-path = mkOption {
+            description = "The path to the root of the repository.";
+            type = types.path;
+          };
+          proxmox-user = mkOption {
+            description = "The ProxmoX user to use.";
+            type = types.str;
+            default = "root@pam";
+          };
+          # TODO: is sensitivity here handled properly?
+          proxmox-password = mkOption {
+            description = "The ProxmoX password to use.";
+            type = types.str;
+          };
+          node-name = mkOption {
+            description = "the name of the ProxmoX node to use.";
+            type = types.str;
+          };
+          # nixos-conf = mkOption {
+          #   type = types.str;
+          #   default = writeConfig {
+          #     inherit (tf-host.config)
+          #       system
+          #       module
+          #       args
+          #       deployment-name
+          #       root-path
+          #       ;
+          #     deployment-type = "tf-proxmox-host";
+          #   };
+          # };
+          run = mkOption {
+            type = types.package;
+            # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
+            # readOnly = true;
+            default =
+              let
+                inherit (tf-host.config)
+                  system
+                  ssh
+                  module
+                  args
+                  deployment-name
+                  root-path
+                  proxmox-user
+                  proxmox-password
+                  node-name
+                  # nixos-conf
+                  ;
+                inherit (ssh)
+                  host
+                  username
+                  key-file
+                  sshOpts
+                  ;
+                environment = {
+                  key_file = key-file;
+                  ssh_opts = sshOpts;
+                  inherit
+                    host
+                    ;
+                  proxmox_user = proxmox-user;
+                  proxmox_password = proxmox-password;
+                  ssh_user = username;
+                  node_name = node-name;
+                  # nixos_conf = nixos-conf;
+                  nixos_conf = writeConfig {
+                    inherit
+                      system
+                      module
+                      args
+                      deployment-name
+                      root-path
+                      ;
+                    deployment-type = "tf-proxmox-host";
+                  };
+                };
+                tf-env = pkgs.callPackage ./run/tf-proxmox/tf-env.nix { };
+              in
+              pkgs.writers.writeBashBin "deploy-tf-proxmox.sh"
+                (withPackages [
+                  pkgs.jq
+                  pkgs.nixos-generators
+                  (pkgs.callPackage ./run/tf-proxmox/tf.nix { inherit sources; })
+                ])
+                ''
+                  env ${toString (lib.mapAttrsToList (k: v: "TF_VAR_${k}=\"${toBash v}\"") environment)} \
+                  tf_env=${tf-env} bash ./deployment/run/tf-proxmox/run.sh
+                '';
+          };
+        };
+      });
+    };
   };
 in
 {

deployment/flake-part.nix

@@ -41,6 +41,11 @@
           inherit (pkgs.testers) runNixOSTest;
           inherit inputs sources;
         };
+
+        deployment-model-tf-proxmox = import ./check/data-model-tf-proxmox {
+          inherit (pkgs.testers) runNixOSTest;
+          inherit inputs sources system;
+        };
       };
     };
 }

deployment/function.nix

@@ -1,5 +1,38 @@
 /**
-  Modular function type
+  Modular function type.
+
+  Compared to plain nix functions, adds input type-checks
+  at the cost of longer stack traces.
+
+  Usage:
+
+  ```nix
+  { lib, ... }:
+  {
+    options = {
+      my-function = lib.mkOption {
+        description = "My type-safe function invocation.";
+        type = lib.types.submodule PATH/TO/function.nix;
+        readOnly = true;
+        default = {
+          input-type = lib.types.int;
+          output-type = lib.types.int;
+          implementation = x: x + x;
+        };
+      };
+    };
+    config = {
+      my-function.apply "1"
+    };
+  }
+  ```
+
+  A sample stack trace using this ends up like:
+
+  - `INVOKER.apply.<function body>``
+  - `function.nix`
+  - `INVOKER.wrapper.<function body>.output`
+  - `INVOKER.implementation.<function body>`
 */
 { config, lib, ... }:
 let

deployment/run/ssh-single-host/run.sh

@@ -1,6 +1,6 @@
 #! /usr/bin/env bash
 set -xeuo pipefail
-declare username host system module args deployment_name deployment_type key_file root_path ssh_opts
+declare username host key_file ssh_opts nixos_conf
 IFS=" " read -r -a ssh_opts <<< "$( (echo "$ssh_opts" | jq -r '@sh') | tr -d \'\")"
 
 # DEPLOY
@@ -20,18 +20,16 @@ if [[ -n "$key_file" ]]; then
 fi
 destination="$username@$host"
 
-command=(nix-instantiate --show-trace --expr "
+command=(nix-instantiate --show-trace "${nixos_conf}")
-  import $root_path/deployment/nixos.nix {
-    system = \"$system\";
-    configuration = (import \"$root_path/$module\" (builtins.fromJSON ''$args'')).$deployment_name.$deployment_type.nixos-configuration;
-  }
-")
 
 # INSTANTIATE
 # instantiate the config in /nix/store
 "${command[@]}" -A out_path
 
 # get the realized derivation to deploy
+"${command[@]}" --show-trace --eval --strict --json
+
+# FIXME explore import/readFile as ways to instantiate the derivation, potentially allowing to realize the store path up-front from Nix?
 outPath=$(nix-store --realize "$("${command[@]}" --show-trace --eval --strict --json | jq -r '.drv_path')")
 # deploy the config by nix-copy-closure
 NIX_SSHOPTS="${sshOpts[*]}" nix-copy-closure --to "$destination" "$outPath" --gzip --use-substitutes

deployment/run/tf-proxmox/main.tf

@@ -0,0 +1,175 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "= 0.76.1"
+    }
+  }
+}
+
+# locals {
+#   dump_name = "vzdump-qemu-nixos-fediversity-${var.category}.vma.zst"
+# }
+
+provider "proxmox" {
+  endpoint = "https://${var.host}:8006/"
+  insecure = true
+
+  ssh {
+    agent = true
+  }
+
+  # # Choose one authentication method:
+  # api_token = var.virtual_environment_api_token
+  # # OR
+  username  = var.proxmox_user
+  password  = var.proxmox_password
+  # # OR
+  # auth_ticket           = var.virtual_environment_auth_ticket
+  # csrf_prevention_token = var.virtual_environment_csrf_prevention_token
+}
+
+# # FIXME move to host
+# # FIXME add proxmox
+# data "external" "base-hash" {
+#   program = ["sh", "-c", "echo \"{\\\"hash\\\":\\\"$(nix-hash ${path.module}/../common/nixos/base.nix)\\\"}\""]
+# }
+
+# # hash of our code directory, used to trigger re-deploy
+# # FIXME calculate separately to reduce false positives
+# data "external" "hash" {
+#   program = ["sh", "-c", "echo \"{\\\"hash\\\":\\\"$(nix-hash ..)\\\"}\""]
+# }
+
+# # FIXME move to host
+# resource "terraform_data" "template" {
+#   # triggers_replace = [
+#   #   data.external.base-hash.result,
+#   # ]
+
+#   provisioner "local-exec" {
+#     working_dir = path.root
+#     # FIXME configure to use actual base image
+#     command = <<-EOF
+#       set -xeuo pipefail
+
+#       # XXX nixos-generate needs NIX_PATH to have `nixpkgs` set!
+#       nixos-generate -f proxmox -o /tmp/nixos-image
+#       # the above makes /tmp/nixos-image read-only, so our stable file name needs a different directory
+#       mkdir -p /tmp/proxmox-image
+#       ln -sf /tmp/nixos-image/vzdump-qemu-nixos-*.vma.zst /tmp/proxmox-image/${local.dump_name}
+#     EOF
+#   }
+# }
+
+# # FIXME move to host
+# resource "proxmox_virtual_environment_file" "upload" {
+#   lifecycle {
+#     replace_triggered_by = [
+#       terraform_data.template,
+#     ]
+#   }
+
+#   content_type = "images"
+#   datastore_id = "local"
+#   node_name    = var.node_name
+#   overwrite = true
+
+#   source_file {
+#     path = "/tmp/proxmox-image/${local.dump_name}"
+#     file_name = local.dump_name
+#   }
+# }
+
+# FIXME distinguish var.category
+data "proxmox_virtual_environment_vms" "nixos_base" {
+  node_name = var.node_name
+  filter {
+    name = "template"
+    values = [true]
+  }
+  # filter {
+  #   name = "node_name"
+  #   values = ["nixos-base"]
+  # }
+}
+
+# resource "proxmox_virtual_environment_vm" "nix_vm" {
+#   lifecycle {
+#     replace_triggered_by = [
+#       proxmox_virtual_environment_file.upload,
+#     ]
+#   }
+
+#   node_name      = var.node_name
+#   pool_id        = var.pool_id
+#   description    = var.description
+#   started        = true
+
+#   agent {
+#     enabled = true
+#   }
+
+#   cpu {
+#     type         = "x86-64-v2-AES"
+#     cores        = var.cores
+#     sockets      = var.sockets
+#     numa         = true
+#   }
+
+#   memory {
+#     dedicated    = var.memory
+#   }
+
+#   efi_disk {
+#     datastore_id = "linstor_storage"
+#     type         = "4m"
+#   }
+
+#   disk {
+#     datastore_id = "linstor_storage"
+#     interface    = "scsi0"
+#     discard      = "on"
+#     iothread     = true
+#     size         = var.disk_size
+#     ssd          = true
+#   }
+
+#   clone {
+#     datastore_id = "local"
+#     node_name = data.proxmox_virtual_environment_vms.nixos_base.vms[0].node_name # invalid index: empty list
+#     vm_id = data.proxmox_virtual_environment_vms.nixos_base.vms[0].vm_id
+#     full = true
+#   }
+
+#   network_device {
+#     model        = "virtio"
+#     bridge       = "vnet1306"
+#   }
+
+#   operating_system {
+#     type         = "l26"
+#   }
+
+#   scsi_hardware  = "virtio-scsi-single"
+#   bios           = "ovmf"
+# }
+
+# module "nixos-rebuild" {
+#   depends_on = [
+#     proxmox_virtual_environment_vm.nix_vm
+#   ]
+
+#   source = "../tf-single-host"
+
+#   system = var.system
+#   username = var.ssh_user
+#   host = proxmox_virtual_environment_vm.nix_vm.ipv4_addresses[0] # needs guest agent installed
+#   module = var.module
+#   args = var.args
+#   key_file = var.key_file
+#   deployment_name = var.deployment_name
+#   root_path = var.root_path
+#   ssh_opts = var.ssh_opts
+#   deployment_type = var.deployment_type
+# }

deployment/run/tf-proxmox/run.sh

@@ -0,0 +1,10 @@
+#! /usr/bin/env bash
+set -xeuo pipefail
+declare tf_env
+
+export TF_LOG=info
+# export TF_LOG=debug
+
+cd "${tf_env}/deployment/run/tf-proxmox"
+# parallelism=1: limit OOM risk
+tofu apply --auto-approve -lock=false -input=false -parallelism=1

deployment/run/tf-proxmox/setup.nix

@@ -0,0 +1,16 @@
+{
+  pkgs,
+  lib,
+  sources,
+}:
+pkgs.writeScriptBin "setup" ''
+  set -xe
+  # calculated pins
+  echo '${lib.strings.toJSON sources}' > ./.npins.json
+  # generate TF lock for nix's TF providers
+  rm -rf .terraform/
+  rm -f .terraform.lock.hcl
+  # suppress warning on architecture-specific generated lock file:
+  # `Warning: Incomplete lock file information for providers`.
+  tofu init -input=false 1>/dev/null
+''

deployment/run/tf-proxmox/tf-env.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  pkgs,
+  sources ? import ../../../npins,
+}:
+pkgs.stdenv.mkDerivation {
+  name = "tf-repo";
+  src =
+    with lib.fileset;
+    toSource {
+      root = ../../../.;
+      # don't copy ignored files
+      fileset = intersection (gitTracked ../../../.) ../../../.;
+    };
+  buildInputs = [
+    (pkgs.callPackage ./tf.nix { inherit sources; })
+    (pkgs.callPackage ./setup.nix { inherit sources; })
+  ];
+  buildPhase = ''
+    runHook preBuild
+    for category in deployment/run/tf-single-host deployment/run/tf-proxmox; do
+      pushd "$category"
+      source setup
+      popd
+    done
+    runHook postBuild
+  '';
+  installPhase = ''
+    runHook preInstall
+    cp -r . $out
+    runHook postInstall
+  '';
+}

deployment/run/tf-proxmox/tf.nix

@@ -0,0 +1,26 @@
+# FIXME: use overlays so this gets imported just once?
+{
+  pkgs,
+  sources ? import ../../../npins,
+  ...
+}:
+let
+  mkProvider =
+    args:
+    pkgs.terraform-providers.mkProvider (
+      { mkProviderFetcher = { repo, ... }: sources.${repo}; } // args
+    );
+in
+pkgs.opentofu.withPlugins (p: [
+  p.external
+  (mkProvider {
+    owner = "bpg";
+    repo = "terraform-provider-proxmox";
+    rev = "v0.76.1";
+    spdx = "MPL-2.0";
+    hash = null;
+    vendorHash = "sha256-3KJ7gi3UEZu31LhEtcRssRUlfsi4mIx6FGTKi1TDRdg=";
+    homepage = "https://registry.terraform.io/providers/bpg/proxmox";
+    provider-source-address = "registry.opentofu.org/bpg/proxmox";
+  })
+])

deployment/run/tf-proxmox/variables.tf

@@ -0,0 +1,86 @@
+variable "nixos_conf" {
+  description = "The path to the NixOS configuration to deploy."
+  type = string
+}
+
+variable "ssh_user" {
+  description = "the SSH user to use"
+  type = string
+  default = "root"
+}
+
+variable "proxmox_user" {
+  description = "the ProxmoX user to use"
+  type = string
+  default = "root@pam"
+}
+
+variable "proxmox_password" {
+  description = "the ProxmoX password to use"
+  type = string
+  sensitive = true
+}
+
+variable "host" {
+  description = "the host of the ProxmoX Virtual Environment."
+  type = string
+}
+
+variable "node_name" {
+  description = "the name of the ProxmoX node to use."
+  type = string
+}
+
+variable "key_file" {
+  description = "path to the user's SSH private key"
+  type = string
+}
+
+variable "ssh_opts" {
+  description = "Extra SSH options (`-o`) to use."
+  type = string
+  default = "[]"
+}
+
+#########################################
+
+variable "category" {
+  type = string
+  description = "Category to be used in naming the base image."
+  default = "test"
+}
+
+variable "description" {
+  type = string
+  default = ""
+}
+
+variable "sockets" {
+  type = number
+  description = "The number of sockets of the VM."
+  default = 1
+}
+
+variable "cores" {
+  type = number
+  description = "The number of cores of the VM."
+  default = 1
+}
+
+variable "memory" {
+  type = number
+  description = "The amount of memory of the VM in MiB."
+  default = 2048
+}
+
+variable "disk_size" {
+  type = number
+  description = "The amount of disk of the VM in GiB."
+  default = 32
+}
+
+variable "pool_id" {
+  type = string
+  description = "The identifier for a pool to assign the virtual machine to."
+  default = "Fediversity"
+}

deployment/run/tf-single-host/main.tf

@@ -18,11 +18,8 @@ resource "terraform_data" "nixos" {
   # - `data` always runs, which is slow for deploy and especially build.
   triggers_replace = [
     data.external.hash.result,
+    var.nixos_conf,
     var.host,
-    var.module,
-    var.args,
-    var.root_path,
-    var.deployment_type,
   ]
 
   provisioner "local-exec" {
@@ -33,17 +30,11 @@ resource "terraform_data" "nixos" {
     # so are generally discouraged in TF.
     working_dir = path.root
     environment = {
-      system = var.system
+      nixos_conf = var.nixos_conf
       username = var.username
       host = var.host
-      module = var.module
-      host = var.host
-      args = var.args
       key_file = var.key_file
-      deployment_name = var.deployment_name
-      root_path = var.root_path
       ssh_opts = var.ssh_opts
-      deployment_type = var.deployment_type
     }
     # TODO: refactor back to command="ignoreme" interpreter=concat([]) to protect sensitive data from error logs?
     # TODO: build on target?

deployment/run/tf-single-host/variables.tf

@@ -1,7 +1,6 @@
-variable "system" {
+variable "nixos_conf" {
-  description = "The architecture of the system to deploy to."
+  description = "The path to the NixOS configuration to deploy."
   type = string
-  default = "x86_64-linux"
 }
 
 variable "username" {
@@ -15,40 +14,13 @@ variable "host" {
   type = string
 }
 
-variable "module" {
-  description = "The module to call to obtain the NixOS configuration from."
-  type = string
-}
-
-variable "args" {
-  description = "The arguments with which to call the module to obtain the NixOS configuration."
-  type = string
-  default = "{}"
-}
-
 variable "key_file" {
   description = "path to the user's SSH private key"
   type = string
 }
 
-variable "deployment_name" {
-  description = "The name of the deployment for which to obtain the NixOS configuration."
-  type = string
-}
-
-variable "root_path" {
-  description = "The path to the root of the repository."
-  type = string
-}
-
 variable "ssh_opts" {
   description = "Extra SSH options (`-o`) to use."
   type = string
   default = "[]"
 }
-
-variable "deployment_type" {
-  description = "A `deployment-type` from the Fediversity data model, for grabbing the desired NixOS configuration."
-  type = string
-  default = "tf-host"
-}

infra/makeInstallerIso.nix

@@ -5,9 +5,9 @@
 */
 
 {
-  nixpkgs,
-  hostKeys ? { },
   nixosConfiguration,
+  hostKeys ? { },
+  nixpkgs ? (import ../npins).nixpkgs,
 }:
 
 let
@@ -44,7 +44,7 @@ let
       imports = [ "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix" ];
       nixpkgs.hostPlatform = "x86_64-linux";
       services.getty.autologinUser = lib.mkForce "root";
-      programs.bash.loginShellInit = nixpkgs.lib.getExe bootstrap;
+      programs.bash.loginShellInit = lib.getExe bootstrap;
 
       isoImage = {
         compressImage = false;
@@ -55,4 +55,10 @@ let
       };
     };
 in
-(nixpkgs.lib.nixosSystem { modules = [ installer ]; }).config.system.build.isoImage
+(import "${nixpkgs}/nixos/lib/eval-config.nix" {
+  modules = [ installer ];
+  # Allow system to be set modularly in nixpkgs.system.
+  # We set it to null, to remove the "legacy" entrypoint's
+  # non-hermetic default.
+  system = null;
+}).config.system.build.isoImage

infra/proxmox-provision.sh

@@ -223,9 +223,9 @@ build_iso () {
   nix build \
     --impure --expr "
       let flake = builtins.getFlake (builtins.toString ./.); in
-      import ./makeInstallerIso.nix {
+      import ./infra/makeInstallerIso.nix {
         nixosConfiguration = flake.nixosConfigurations.$vm_name;
-        nixpkgs = flake.inputs.nixpkgs;
+        # FIXME pass nixpkgs from npins
         $nix_host_keys
       }
     " \
@@ -239,7 +239,7 @@ Check the Nix logs and fix things. Possibly there just is no NixOS configuration
       "$vm_name"
   fi
 
-  ln -sf "$tmpdir/installer-$vm_name/iso/installer.iso" "$tmpdir/installer-$vm_name.iso"
+  ln -sf "$(ls "$tmpdir/installer-$vm_name"/iso/nixos-*.iso)" "$tmpdir/installer-$vm_name.iso"
 
   printf 'done building ISO for VM %s.\n' "$vm_name"
   release_lock build

npins/sources.json

@@ -192,6 +192,19 @@
       "revision": "48f39fbe2e8f90f9ac160dd4b6929f3ac06d8223",
       "url": "https://github.com/SaumonNet/proxmox-nixos/archive/48f39fbe2e8f90f9ac160dd4b6929f3ac06d8223.tar.gz",
       "hash": "0606qcs8x1jwckd1ivf52rqdmi3lkn66iiqh6ghd4kqx0g2bw3nv"
+    },
+    "terraform-provider-proxmox": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "kiaragrouwstra",
+        "repo": "terraform-provider-proxmox"
+      },
+      "branch": "content-type-images",
+      "submodules": false,
+      "revision": "d465b71e2c112903b9cf235e3a2b4f7997272ab9",
+      "url": "https://github.com/kiaragrouwstra/terraform-provider-proxmox/archive/d465b71e2c112903b9cf235e3a2b4f7997272ab9.tar.gz",
+      "hash": "05l45w40708sx1hyli10ncr0hsjsf0djkc7x9xkdl4gw96m1578n"
     }
   },
   "version": 5

panel/nix/configuration.nix

@@ -218,6 +218,7 @@ in
         cfg.nixops4Package
         pkgs.nix
         pkgs.openssh
+        pkgs.git
       ];
       preStart = ''
         # Auto-migrate on first run or if the package has changed

panel/nix/python-packages/drf-pydantic/default.nix

@@ -13,14 +13,14 @@ buildPythonPackage rec {
   _class = "package";
 
   pname = "drf-pydantic";
-  version = "v2.7.1";
+  version = "v2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "georgebv";
+    owner = "KiaraGrouwstra";
     repo = pname;
-    rev = version;
+    rev = "d21c879543bd106242bd7f86e79da1f668109579";
-    hash = "sha256-ABtSoxj/+HHq4hj4Yb6bEiyOl00TCO/9tvBzhv6afxM=";
+    hash = "sha256-pk0/6BphIiXxR3cewBJ5nKii3kj3lDHLO9U9xqXDxI8=";
   };
 
   nativeBuildInputs = [

services/tests/flake-part.nix

@@ -7,7 +7,6 @@
     {
       checks = {
         test-mastodon-service = pkgs.testers.runNixOSTest ./mastodon.nix;
-        test-pixelfed-garage-service = pkgs.testers.runNixOSTest ./pixelfed-garage.nix;
         test-peertube-service = pkgs.testers.runNixOSTest ./peertube.nix;
       };
     };