some plans
This commit is contained in:
parent
8fda07ecd3
commit
4b3a0b226e
3 changed files with 997 additions and 0 deletions
|
|
@ -21,6 +21,7 @@
|
|||
(sleeper-service (hostname . "sleeper-service"))
|
||||
(grey-area (hostname . "grey-area"))
|
||||
(reverse-proxy (hostname . "reverse-proxy"))
|
||||
(limiting-factor (hostname . "limiting-factor"))
|
||||
(little-rascal (hostname . "little-rascal"))))
|
||||
(deployment . ((default-mode . "boot")
|
||||
(timeout . 300)
|
||||
|
|
|
|||
432
research/migration-to-git-centered-deployment.md
Normal file
432
research/migration-to-git-centered-deployment.md
Normal file
|
|
@ -0,0 +1,432 @@
|
|||
# Migration to Git-Centered Multi-Host Flake Deployment
|
||||
|
||||
## Executive Summary
|
||||
|
||||
**Yes, you can successfully move to a git-centered multi-host flake with nixos-rebuild and eliminate your custom lab tool.** Your current setup is already 90% ready for this transition.
|
||||
|
||||
## Current State Analysis
|
||||
|
||||
### ✅ What You Already Have Working
|
||||
|
||||
1. **Complete multi-host flake.nix** with all 6 machines configured
|
||||
2. **Deploy-rs integration** with proper SSH configuration via Tailscale
|
||||
3. **Well-organized git repository** with proper module structure
|
||||
4. **SSH key authentication** working across all machines
|
||||
5. **Proper NixOS configurations** for each machine
|
||||
|
||||
### 🔄 What Needs to Change
|
||||
|
||||
1. **Replace lab tool commands** with native nixos-rebuild/deploy-rs
|
||||
2. **Use git URLs** as the source of truth instead of local paths
|
||||
3. **Streamline deployment workflow** to be git-first
|
||||
|
||||
## Migration Steps
|
||||
|
||||
### Step 1: Test Git-Based Deployment (30 minutes)
|
||||
|
||||
Verify your repo works as a flake input:
|
||||
|
||||
```bash
|
||||
# Test from any machine - this should work immediately
|
||||
nixos-rebuild build --flake github:yourusername/home-lab#sleeper-service
|
||||
|
||||
# Test remote deployment
|
||||
nixos-rebuild switch --flake github:yourusername/home-lab#sleeper-service \
|
||||
--target-host sleeper-service.tail807ea.ts.net \
|
||||
--build-host localhost \
|
||||
--use-remote-sudo
|
||||
```
|
||||
|
||||
### Step 2: Replace Lab Tool Commands (1 hour)
|
||||
|
||||
| Your Current Command | New Git-Based Command |
|
||||
| ------------------------------- | ----------------------------------------------------------------------------------- |
|
||||
| `lab status` | `ssh sma@HOST.tail807ea.ts.net "systemctl is-system-running"` |
|
||||
| `lab deploy-rs sleeper-service` | `nix run github:serokell/deploy-rs -- github:yourusername/home-lab#sleeper-service` |
|
||||
| `lab hybrid-update all` | `nix run github:serokell/deploy-rs -- github:yourusername/home-lab` |
|
||||
|
||||
### Step 3: Create Migration Scripts (30 minutes)
|
||||
|
||||
Create `scripts/deploy.sh`:
|
||||
|
||||
```bash
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
REPO="github:yourusername/home-lab"
|
||||
HOST="${1:-}"
|
||||
ACTION="${2:-switch}"
|
||||
|
||||
if [[ -z "$HOST" ]]; then
|
||||
echo "Usage: $0 <hostname> [switch|boot|test]"
|
||||
echo "Available hosts: congenital-optimist sleeper-service grey-area reverse-proxy little-rascal limiting-factor"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case "$HOST" in
|
||||
"congenital-optimist")
|
||||
nixos-rebuild "$ACTION" --flake "$REPO#$HOST"
|
||||
;;
|
||||
"all")
|
||||
nix run github:serokell/deploy-rs -- "$REPO"
|
||||
;;
|
||||
*)
|
||||
nixos-rebuild "$ACTION" --flake "$REPO#$HOST" \
|
||||
--target-host "$HOST.tail807ea.ts.net" \
|
||||
--build-host localhost \
|
||||
--use-remote-sudo
|
||||
;;
|
||||
esac
|
||||
```
|
||||
|
||||
### Step 4: Update Flake for Git-First Usage (15 minutes)
|
||||
|
||||
Add to your `flake.nix`:
|
||||
|
||||
```nix
|
||||
apps.${system} = {
|
||||
# ... existing apps ...
|
||||
|
||||
deploy = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy" ''
|
||||
exec ${./scripts/deploy.sh} "$@"
|
||||
''}";
|
||||
};
|
||||
|
||||
status = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "status" ''
|
||||
hosts="sleeper-service grey-area reverse-proxy little-rascal limiting-factor"
|
||||
for host in $hosts; do
|
||||
printf "%-20s " "$host:"
|
||||
if ssh -o ConnectTimeout=5 sma@$host.tail807ea.ts.net "systemctl is-system-running" 2>/dev/null; then
|
||||
echo "✅ Online"
|
||||
else
|
||||
echo "❌ Unreachable"
|
||||
fi
|
||||
done
|
||||
''}";
|
||||
};
|
||||
};
|
||||
```
|
||||
|
||||
## Can You Ditch the Lab Tool? YES
|
||||
|
||||
### Benefits of Ditching Lab Tool
|
||||
|
||||
1. **Simpler toolchain** - No custom Guile code to maintain
|
||||
2. **Better integration** - Native Nix tooling works with IDEs, CI/CD
|
||||
3. **Community support** - deploy-rs is actively maintained
|
||||
4. **Reduced complexity** - Standard workflows everyone understands
|
||||
5. **Better error handling** - Nix's error messages vs custom tool debugging
|
||||
|
||||
### What You'll Lose (and Alternatives)
|
||||
|
||||
| Lab Tool Feature | Alternative | Difficulty |
|
||||
| ----------------- | ------------------------- | ----------- |
|
||||
| Simple commands | Shell aliases/scripts | Easy |
|
||||
| Health checks | systemctl + monitoring | Easy |
|
||||
| Error aggregation | Standard Nix error output | None needed |
|
||||
| Custom logic | deploy-rs hooks | Medium |
|
||||
|
||||
### Transition Strategy
|
||||
|
||||
**Week 1: Parallel Testing**
|
||||
|
||||
- Use both lab tool and new git-based commands
|
||||
- Verify everything works identically
|
||||
|
||||
**Week 2: Switch Primary Workflow**
|
||||
|
||||
- Use git-based commands for daily operations
|
||||
- Keep lab tool as fallback
|
||||
|
||||
**Week 3: Full Migration**
|
||||
|
||||
- Remove lab tool from flake.nix
|
||||
- Archive the code (don't delete)
|
||||
- Update all documentation
|
||||
|
||||
## Daily Workflow (Post-Migration)
|
||||
|
||||
### Simple Status Check
|
||||
|
||||
```bash
|
||||
nix run github:yourusername/home-lab#status
|
||||
```
|
||||
|
||||
### Deploy Single Machine
|
||||
|
||||
```bash
|
||||
nix run github:yourusername/home-lab#deploy sleeper-service
|
||||
```
|
||||
|
||||
### Deploy All Machines
|
||||
|
||||
```bash
|
||||
nix run github:serokell/deploy-rs -- github:yourusername/home-lab
|
||||
```
|
||||
|
||||
### Update Dependencies and Deploy
|
||||
|
||||
```bash
|
||||
# Local development
|
||||
nix flake update
|
||||
git commit -am "Update dependencies"
|
||||
git push
|
||||
nix run github:serokell/deploy-rs
|
||||
|
||||
# Or directly from git
|
||||
nix run github:serokell/deploy-rs -- github:yourusername/home-lab
|
||||
```
|
||||
|
||||
## Why This Migration Makes Sense
|
||||
|
||||
### Technical Benefits
|
||||
|
||||
1. **Source of truth in git** - No more "is my local repo in sync?"
|
||||
2. **Atomic deployments** - Git commits = deployment units
|
||||
3. **Rollback capability** - `git revert` + redeploy
|
||||
4. **CI/CD ready** - GitHub Actions can deploy on push
|
||||
5. **Reproducible** - Anyone can deploy from any machine
|
||||
|
||||
### Operational Benefits
|
||||
|
||||
1. **Simpler onboarding** - Standard Nix workflows
|
||||
2. **Better documentation** - Tons of deploy-rs examples online
|
||||
3. **Less maintenance** - No custom tool to update
|
||||
4. **IDE integration** - Works with direnv, nix-shell, etc.
|
||||
|
||||
## Using Git Repo as Flake Input: Advanced Approach
|
||||
|
||||
### Overview
|
||||
|
||||
Instead of just using git URLs directly in commands, you can structure your setup with your home-lab repo as an input to other flakes or create a "deployment flake" that references your configuration flake. This provides additional benefits:
|
||||
|
||||
**Benefits of Git Repo as Input:**
|
||||
|
||||
1. **Version pinning** - Lock specific commits of your config
|
||||
2. **Composite deployments** - Combine multiple config repos
|
||||
3. **Environment separation** - Different input versions for dev/staging/prod
|
||||
4. **Dependency management** - Nix manages the git fetching and caching
|
||||
5. **Reproducible builds** - flake.lock ensures exact versions
|
||||
|
||||
### Implementation Options
|
||||
|
||||
#### Option 1: Deployment Flake (Recommended)
|
||||
|
||||
Create a separate "deployment flake" that uses your home-lab repo as an input:
|
||||
|
||||
**`deployment/flake.nix`:**
|
||||
|
||||
```nix
|
||||
{
|
||||
description = "Home Lab Deployment Controller";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
|
||||
# Your home-lab config as input
|
||||
home-lab-config.url = "github:yourusername/home-lab";
|
||||
# Or for specific branch: "github:yourusername/home-lab/development"
|
||||
# Or for specific commit: "github:yourusername/home-lab/abc123def"
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, deploy-rs, home-lab-config, ... }: {
|
||||
# Re-export configurations from your home-lab
|
||||
nixosConfigurations = home-lab-config.nixosConfigurations;
|
||||
|
||||
# Enhanced deployment with additional tooling
|
||||
deploy.nodes = {
|
||||
sleeper-service = {
|
||||
hostname = "sleeper-service.tail807ea.ts.net";
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos
|
||||
home-lab-config.nixosConfigurations.sleeper-service;
|
||||
sshUser = "sma";
|
||||
sudo = "sudo -u";
|
||||
autoRollback = true;
|
||||
magicRollback = true;
|
||||
};
|
||||
};
|
||||
# ... other nodes
|
||||
};
|
||||
|
||||
# Deployment apps with version control
|
||||
apps.x86_64-linux = {
|
||||
deploy-dev = {
|
||||
type = "app";
|
||||
program = "${nixpkgs.legacyPackages.x86_64-linux.writeShellScript "deploy-dev" ''
|
||||
# Deploy using development branch
|
||||
nix run github:serokell/deploy-rs -- \
|
||||
github:yourusername/deployment-flake/dev
|
||||
''}";
|
||||
};
|
||||
|
||||
deploy-prod = {
|
||||
type = "app";
|
||||
program = "${nixpkgs.legacyPackages.x86_64-linux.writeShellScript "deploy-prod" ''
|
||||
# Deploy using main branch (stable)
|
||||
nix run github:serokell/deploy-rs -- \
|
||||
github:yourusername/deployment-flake/main
|
||||
''}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
#### Option 2: Multi-Environment in Same Repo
|
||||
|
||||
Modify your existing flake to support different input sources:
|
||||
|
||||
**Modified `flake.nix`:**
|
||||
|
||||
```nix
|
||||
{
|
||||
description = "Home Lab NixOS Configuration";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
|
||||
# Optional: Reference yourself for advanced scenarios
|
||||
# home-lab-stable.url = "github:yourusername/home-lab/stable";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, deploy-rs, ... } @ inputs:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
|
||||
# Function to create deployment for specific git ref
|
||||
mkDeployment = gitRef: {
|
||||
deploy.nodes = {
|
||||
sleeper-service = {
|
||||
hostname = "sleeper-service.tail807ea.ts.net";
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos
|
||||
(import "${gitRef}/machines/sleeper-service" { inherit inputs; });
|
||||
# ... rest of config
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
in {
|
||||
# ... existing nixosConfigurations ...
|
||||
|
||||
# Multiple deployment targets
|
||||
deploy = mkDeployment self;
|
||||
|
||||
apps.${system} = {
|
||||
deploy-from-main = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy-main" ''
|
||||
nix run github:serokell/deploy-rs -- github:yourusername/home-lab/main
|
||||
''}";
|
||||
};
|
||||
|
||||
deploy-from-dev = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy-dev" ''
|
||||
nix run github:serokell/deploy-rs -- github:yourusername/home-lab/development
|
||||
''}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
### Comparison: Direct Git URLs vs Git Inputs
|
||||
|
||||
| Aspect | Direct Git URLs | Git as Input |
|
||||
| --------------------- | ---------------- | ------------------ |
|
||||
| **Simplicity** | ✅ Very simple | ⚠️ More complex |
|
||||
| **Version Control** | ⚠️ Always latest | ✅ Pinned versions |
|
||||
| **Reproducibility** | ⚠️ Can change | ✅ Locked versions |
|
||||
| **Multi-environment** | ❌ Hard | ✅ Easy |
|
||||
| **Caching** | ✅ Good | ✅ Excellent |
|
||||
| **Setup Time** | ✅ Immediate | ⚠️ More setup |
|
||||
|
||||
### Recommended Hybrid Approach
|
||||
|
||||
For your home lab, I recommend a **hybrid approach**:
|
||||
|
||||
1. **Start with direct git URLs** (what we outlined earlier) for immediate migration
|
||||
2. **Evolve to git inputs** once you want more sophisticated deployment patterns
|
||||
|
||||
**When to use git inputs:**
|
||||
|
||||
- You want staging/production environments
|
||||
- You need to pin specific versions for stability
|
||||
- You're composing multiple configuration repositories
|
||||
- You want sophisticated CI/CD with version management
|
||||
|
||||
**When direct git URLs are sufficient:**
|
||||
|
||||
- Simple home lab with one configuration repo
|
||||
- You always want the latest versionwe want to move this repo to a
|
||||
- You prefer simplicity over advanced features
|
||||
|
||||
### Migration Path with Git Inputs
|
||||
|
||||
If you choose the git input approach:
|
||||
|
||||
**Phase 1: Create deployment flake**
|
||||
|
||||
```bash
|
||||
mkdir -p deployment
|
||||
cd deployment
|
||||
# Create the deployment flake shown above
|
||||
```
|
||||
|
||||
**Phase 2: Update workflow**
|
||||
|
||||
```bash
|
||||
# Instead of:
|
||||
nix run github:serokell/deploy-rs -- github:yourusername/home-lab
|
||||
|
||||
# You'd use:
|
||||
nix run github:serokell/deploy-rs -- github:yourusername/deployment-flake
|
||||
|
||||
# Or for specific environments:
|
||||
nix run github:yourusername/deployment-flake#deploy-dev
|
||||
nix run github:yourusername/deployment-flake#deploy-prod
|
||||
```
|
||||
|
||||
**Phase 3: Version management**
|
||||
|
||||
```bash
|
||||
# Pin to specific home-lab version
|
||||
cd deployment
|
||||
nix flake update home-lab-config --commit-lock-file
|
||||
git commit -m "Pin home-lab to version abc123"
|
||||
|
||||
# Deploy pinned version
|
||||
nix run github:serokell/deploy-rs
|
||||
```
|
||||
|
||||
### Impact on Lab Tool Elimination
|
||||
|
||||
Using git inputs **doesn't change** the fundamental recommendation to eliminate the lab tool. In fact, it makes it even more compelling because:
|
||||
|
||||
1. **Nix handles git operations** - No need for custom git logic in lab tool
|
||||
2. **Better version management** - Native flake.lock handling
|
||||
3. **Cleaner abstractions** - Separate deployment concerns from config
|
||||
|
||||
### Recommendation
|
||||
|
||||
For your specific situation, I'd suggest:
|
||||
|
||||
1. **Start with direct git URLs** (simpler, immediate migration)
|
||||
2. **Keep git inputs as future enhancement** when you need:
|
||||
- Staging environments
|
||||
- Version pinning for stability
|
||||
- More complex deployment patterns
|
||||
|
||||
The beauty is that both approaches eliminate the lab tool dependency and use git as the source of truth. The git input approach just adds more sophisticated version management on top.
|
||||
|
||||
564
research/nix-flakes-remote-management.md
Normal file
564
research/nix-flakes-remote-management.md
Normal file
|
|
@ -0,0 +1,564 @@
|
|||
# Nix Flakes: A Comprehensive Guide to Remote Management
|
||||
|
||||
## What Are Nix Flakes?
|
||||
|
||||
Nix flakes are an experimental feature (now stable as of Nix 2.4+) that provides a standard way to write reproducible Nix expressions. They address key issues in the Nix ecosystem by offering:
|
||||
|
||||
- **Uniform structure** for Nix projects
|
||||
- **Version pinning** of dependencies via lock files
|
||||
- **Reproducible builds** across different environments
|
||||
- **URL-like syntax** for specifying remote resources
|
||||
|
||||
## Migration to Multi-Host Flake with Git as Source of Truth
|
||||
|
||||
### Current State Analysis
|
||||
|
||||
Your current setup already has most pieces in place for a git-centric multi-host flake deployment:
|
||||
|
||||
**✅ Already Implemented:**
|
||||
|
||||
- Multi-host flake.nix with all machines configured
|
||||
- Deploy-rs integration for safe remote deployments
|
||||
- Git repository structure with proper organization
|
||||
- SSH key-based authentication via Tailscale
|
||||
|
||||
**🔄 Needs Migration:**
|
||||
|
||||
- Lab tool dependency can be reduced/eliminated
|
||||
- Direct nixos-rebuild usage needs configuration
|
||||
- Git remote references need to be established
|
||||
- Deployment workflows need streamlining
|
||||
|
||||
### Migration Steps
|
||||
|
||||
#### Step 1: Prepare Git Repository as Source of Truth
|
||||
|
||||
1. **Ensure Git Repository is Clean and Accessible**
|
||||
|
||||
```bash
|
||||
# Make sure your repo is committed and pushed
|
||||
git add .
|
||||
git commit -m "Pre-migration: Current stable state"
|
||||
git push origin main
|
||||
|
||||
# Verify remote access works
|
||||
git ls-remote origin
|
||||
```
|
||||
|
||||
2. **Add Git URL to Flake Registry** (Optional but Convenient)
|
||||
|
||||
```bash
|
||||
# Add your repo to the flake registry for easy access
|
||||
nix registry add home-lab github:yourusername/home-lab
|
||||
# or for a local git repo:
|
||||
nix registry add home-lab git+file:///home/geir/Projects/home-lab
|
||||
```
|
||||
|
||||
#### Step 2: Configure Direct nixos-rebuild Usage
|
||||
|
||||
Create deployment scripts that use git as the source:
|
||||
|
||||
**`scripts/deploy-from-git.sh`:**
|
||||
|
||||
```bash
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
REPO_URL="github:yourusername/home-lab" # or your actual repo URL
|
||||
HOST="${1:-}"
|
||||
ACTION="${2:-switch}"
|
||||
|
||||
if [[ -z "$HOST" ]]; then
|
||||
echo "Usage: $0 <hostname> [switch|boot|test]"
|
||||
echo "Available hosts: congenital-optimist, sleeper-service, grey-area, reverse-proxy, little-rascal, limiting-factor"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case "$HOST" in
|
||||
"congenital-optimist")
|
||||
# Local deployment
|
||||
nixos-rebuild "$ACTION" --flake "$REPO_URL#$HOST"
|
||||
;;
|
||||
*)
|
||||
# Remote deployment
|
||||
nixos-rebuild "$ACTION" --flake "$REPO_URL#$HOST" \
|
||||
--target-host "$HOST.tail807ea.ts.net" \
|
||||
--build-host localhost \
|
||||
--use-remote-sudo
|
||||
;;
|
||||
esac
|
||||
```
|
||||
|
||||
#### Step 3: Eliminate Lab Tool Dependencies
|
||||
|
||||
Your lab tool currently provides several features. Here's how to replace them with native nixos-rebuild and deploy-rs:
|
||||
|
||||
**Lab Tool Feature → Replacement:**
|
||||
|
||||
1. **`lab status`** → **SSH + systemctl**
|
||||
|
||||
```bash
|
||||
# Replace with simple SSH checks
|
||||
ssh sma@sleeper-service.tail807ea.ts.net "systemctl is-system-running"
|
||||
```
|
||||
|
||||
2. **`lab deploy-rs <machine>`** → **Direct deploy-rs**
|
||||
|
||||
```bash
|
||||
# Already in your flake.nix - use directly
|
||||
nix run github:serokell/deploy-rs -- .#sleeper-service
|
||||
```
|
||||
|
||||
3. **`lab hybrid-update`** → **nixos-rebuild with git**
|
||||
|
||||
```bash
|
||||
# Update flake.lock and deploy
|
||||
nix flake update github:yourusername/home-lab
|
||||
nixos-rebuild switch --flake github:yourusername/home-lab#sleeper-service \
|
||||
--target-host sleeper-service.tail807ea.ts.net \
|
||||
--build-host localhost
|
||||
```
|
||||
|
||||
#### Step 4: Create Streamlined Deployment Workflow
|
||||
|
||||
**Option A: Pure nixos-rebuild Approach**
|
||||
|
||||
Add this to your flake.nix apps section:
|
||||
|
||||
```nix
|
||||
apps.${system} = {
|
||||
# ...existing apps...
|
||||
|
||||
deploy-from-git = {
|
||||
type = "app";
|
||||
program = "${nixpkgs.legacyPackages.${system}.writeShellScript "deploy-from-git" ''
|
||||
set -euo pipefail
|
||||
HOST="''${1:-}"
|
||||
ACTION="''${2:-switch}"
|
||||
REPO_URL="github:yourusername/home-lab"
|
||||
|
||||
if [[ -z "$HOST" ]]; then
|
||||
echo "Usage: nix run .#deploy-from-git <hostname> [switch|boot|test]"
|
||||
echo "Available hosts: ${builtins.concatStringsSep ", " (builtins.attrNames self.nixosConfigurations)}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case "$HOST" in
|
||||
"congenital-optimist")
|
||||
nixos-rebuild "$ACTION" --flake "$REPO_URL#$HOST"
|
||||
;;
|
||||
*)
|
||||
nixos-rebuild "$ACTION" --flake "$REPO_URL#$HOST" \
|
||||
--target-host "$HOST.tail807ea.ts.net" \
|
||||
--build-host localhost \
|
||||
--use-remote-sudo
|
||||
;;
|
||||
esac
|
||||
''}";
|
||||
};
|
||||
|
||||
update-and-deploy = {
|
||||
type = "app";
|
||||
program = "${nixpkgs.legacyPackages.${system}.writeShellScript "update-and-deploy" ''
|
||||
set -euo pipefail
|
||||
HOST="''${1:-all}"
|
||||
|
||||
echo "Updating flake.lock..."
|
||||
nix flake update
|
||||
|
||||
if [[ "$HOST" == "all" ]]; then
|
||||
for host in ${builtins.concatStringsSep " " (builtins.attrNames self.nixosConfigurations)}; do
|
||||
echo "Deploying $host..."
|
||||
nix run .#deploy-from-git "$host"
|
||||
done
|
||||
else
|
||||
nix run .#deploy-from-git "$HOST"
|
||||
fi
|
||||
''}";
|
||||
};
|
||||
};
|
||||
```
|
||||
|
||||
**Option B: Enhanced deploy-rs Configuration**
|
||||
|
||||
Your current deploy-rs config is already excellent. Just ensure you're using it directly:
|
||||
|
||||
```bash
|
||||
# Deploy single machine
|
||||
nix run github:serokell/deploy-rs -- .#sleeper-service
|
||||
|
||||
# Deploy all machines
|
||||
nix run github:serokell/deploy-rs
|
||||
|
||||
# Dry run
|
||||
nix run github:serokell/deploy-rs -- .#sleeper-service --dry-activate
|
||||
```
|
||||
|
||||
#### Step 5: Implement Git-Based CI/CD (Optional)
|
||||
|
||||
Create `.github/workflows/deploy.yml`:
|
||||
|
||||
```yaml
|
||||
name: Deploy NixOS Configurations
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
target:
|
||||
description: 'Target machine (or "all")'
|
||||
required: true
|
||||
default: "all"
|
||||
type: choice
|
||||
options:
|
||||
- all
|
||||
- sleeper-service
|
||||
- grey-area
|
||||
- reverse-proxy
|
||||
- little-rascal
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: DeterminateSystems/nix-installer-action@v4
|
||||
- uses: DeterminateSystems/magic-nix-cache-action@v2
|
||||
|
||||
- name: Setup SSH
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H sleeper-service.tail807ea.ts.net >> ~/.ssh/known_hosts
|
||||
# Add other hosts...
|
||||
|
||||
- name: Deploy configurations
|
||||
run: |
|
||||
if [[ "${{ github.event.inputs.target || 'all' }}" == "all" ]]; then
|
||||
nix run github:serokell/deploy-rs
|
||||
else
|
||||
nix run github:serokell/deploy-rs -- .#${{ github.event.inputs.target }}
|
||||
fi
|
||||
```
|
||||
|
||||
### Can You Ditch the Lab Tool?
|
||||
|
||||
**Yes, you can largely eliminate the lab tool dependency.** Here's the analysis:
|
||||
|
||||
#### Lab Tool Features vs Native Alternatives
|
||||
|
||||
| Lab Tool Feature | Native Alternative | Keep or Ditch? |
|
||||
| ------------------- | ------------------------------------------ | ----------------------------------------- |
|
||||
| `lab status` | `ssh + systemctl` or simple scripts | **Ditch** - Simple to replace |
|
||||
| `lab deploy-rs` | Direct `nix run github:serokell/deploy-rs` | **Ditch** - Redundant wrapper |
|
||||
| `lab hybrid-update` | `nix flake update + nixos-rebuild` | **Ditch** - Native tools better |
|
||||
| Machine inventory | Flake configuration | **Ditch** - Already in flake.nix |
|
||||
| SSH connectivity | Native SSH + Tailscale | **Ditch** - No added value |
|
||||
| Health checks | Systemd + monitoring | **Maybe Keep** - If you need custom logic |
|
||||
|
||||
#### Recommended Transition Strategy
|
||||
|
||||
**Phase 1: Immediate (Keep Lab Tool for Safety)**
|
||||
|
||||
- Start using direct nixos-rebuild commands alongside lab tool
|
||||
- Test git-based deployments in parallel
|
||||
- Verify all functionality works
|
||||
|
||||
**Phase 2: Gradual Migration (2-4 weeks)**
|
||||
|
||||
- Replace lab tool usage with native commands in daily workflow
|
||||
- Keep lab tool available as fallback
|
||||
- Document new procedures
|
||||
|
||||
**Phase 3: Complete Migration (1 month)**
|
||||
|
||||
- Remove lab tool from default packages
|
||||
- Archive lab tool code (don't delete - might need reference)
|
||||
- Update documentation to reflect new workflow
|
||||
|
||||
#### Simplified Daily Workflow (Post-Migration)
|
||||
|
||||
```bash
|
||||
# Check status
|
||||
ssh sma@sleeper-service.tail807ea.ts.net "systemctl is-system-running"
|
||||
|
||||
# Update and deploy single machine
|
||||
nix flake update
|
||||
nixos-rebuild switch --flake github:yourusername/home-lab#sleeper-service \
|
||||
--target-host sleeper-service.tail807ea.ts.net \
|
||||
--build-host localhost
|
||||
|
||||
# Or use deploy-rs (recommended)
|
||||
nix run github:serokell/deploy-rs -- .#sleeper-service
|
||||
|
||||
# Deploy all machines
|
||||
nix run github:serokell/deploy-rs
|
||||
|
||||
# Test deployment
|
||||
nix run github:serokell/deploy-rs -- .#sleeper-service --dry-activate
|
||||
```
|
||||
|
||||
### Key Benefits of This Migration
|
||||
|
||||
1. **Simplified Toolchain**: Fewer custom tools to maintain
|
||||
2. **Better Integration**: Native Nix tooling works better with ecosystem
|
||||
3. **Improved CI/CD**: GitHub Actions + git hooks work seamlessly
|
||||
4. **Enhanced Reproducibility**: Git references ensure exact versions
|
||||
5. **Reduced Complexity**: No custom Guile code to debug
|
||||
6. **Better Documentation**: Standard Nix workflows are well-documented
|
||||
7. **Community Support**: deploy-rs has active community and examples
|
||||
|
||||
### Migration Checklist
|
||||
|
||||
- [ ] Ensure git repository is accessible remotely
|
||||
- [ ] Test direct nixos-rebuild with git references
|
||||
- [ ] Verify deploy-rs works with all machines
|
||||
- [ ] Create simple status checking scripts
|
||||
- [ ] Update deployment documentation
|
||||
- [ ] Train team on new workflow
|
||||
- [ ] Set up CI/CD if desired
|
||||
- [ ] Archive lab tool code
|
||||
- [ ] Remove lab tool from flake.nix
|
||||
|
||||
## Core Structure and Components
|
||||
|
||||
### Flake.nix Structure
|
||||
|
||||
Every flake contains a `flake.nix` file in its root directory with this basic structure:
|
||||
|
||||
```nix
|
||||
{
|
||||
description = "A very basic flake";
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
};
|
||||
outputs = { self, nixpkgs }: {
|
||||
# Your outputs here
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
### Flake.lock Files
|
||||
|
||||
- Automatically generated by Nix
|
||||
- Pins all dependencies to exact revisions
|
||||
- Ensures deterministic builds
|
||||
- Contains a graph of all input dependencies with specific commit hashes
|
||||
|
||||
## Remote Management Strategies
|
||||
|
||||
### 1. GitHub-Based Remote References
|
||||
|
||||
Flakes use intuitive URL syntax for remote repositories:
|
||||
|
||||
```nix
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
home-manager.url = "github:nix-community/home-manager";
|
||||
my-config.url = "github:username/nixos-config";
|
||||
}
|
||||
```
|
||||
|
||||
**URL Formats:**
|
||||
|
||||
- `github:owner/repo` - Latest commit from default branch
|
||||
- `github:owner/repo/branch` - Specific branch
|
||||
- `github:owner/repo/commit-hash` - Specific commit
|
||||
- `github:owner/repo?dir=subdir` - Subdirectory in repository
|
||||
|
||||
### 2. Remote Deployment Tools
|
||||
|
||||
#### nixos-rebuild (Built-in)
|
||||
|
||||
The official tool with remote capabilities:
|
||||
|
||||
```bash
|
||||
nixos-rebuild switch --flake .#hostname \
|
||||
--target-host root@192.168.1.100 \
|
||||
--build-host localhost
|
||||
```
|
||||
|
||||
**Advantages:**
|
||||
|
||||
- Built into NixOS
|
||||
- Supports cross-compilation
|
||||
- Can build locally or remotely
|
||||
|
||||
#### deploy-rs
|
||||
|
||||
A sophisticated multi-profile deployment tool:
|
||||
|
||||
```bash
|
||||
nix run github:serokell/deploy-rs
|
||||
```
|
||||
|
||||
**Features:**
|
||||
|
||||
- Multi-profile deployments
|
||||
- Lesser-privileged deployments
|
||||
- Rollback capabilities
|
||||
- Safety checks for remote connectivity
|
||||
|
||||
#### Colmena
|
||||
|
||||
Community tool for fleet management:
|
||||
|
||||
```bash
|
||||
nix run nixpkgs#colmena apply
|
||||
```
|
||||
|
||||
**Benefits:**
|
||||
|
||||
- Fleet-wide deployments
|
||||
- Parallel operations
|
||||
- Custom deployment strategies
|
||||
|
||||
### 3. FlakeHub: Modern Distribution Platform
|
||||
|
||||
FlakeHub is a commercial platform by Determinate Systems offering:
|
||||
|
||||
- **Semantic versioning** for flakes
|
||||
- **Private flake repositories**
|
||||
- **Advanced caching** with identity-aware access
|
||||
- **GitHub Actions integration** for automated publishing
|
||||
|
||||
```bash
|
||||
# Using FlakeHub CLI
|
||||
fh search <query>
|
||||
fh apply github:DeterminateSystems/zero-to-nix
|
||||
```
|
||||
|
||||
## Advanced Remote Management Patterns
|
||||
|
||||
### 1. Multi-Host Configurations
|
||||
|
||||
Structure your flake to manage multiple hosts:
|
||||
|
||||
```nix
|
||||
{
|
||||
outputs = { nixpkgs, ... }: {
|
||||
nixosConfigurations = {
|
||||
server1 = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./hosts/server1 ];
|
||||
};
|
||||
server2 = nixpkgs.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
modules = [ ./hosts/server2 ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
### 2. Cross-Architecture Deployments
|
||||
|
||||
Nix flakes excel at cross-compilation:
|
||||
|
||||
```bash
|
||||
# Build ARM64 system on x86_64 host
|
||||
nixos-rebuild switch --flake .#pi4 \
|
||||
--target-host pi@192.168.1.50 \
|
||||
--build-host localhost
|
||||
```
|
||||
|
||||
### 3. Registry and Shortcuts
|
||||
|
||||
Use the flake registry for convenient shortcuts:
|
||||
|
||||
```bash
|
||||
# Add custom registry entries
|
||||
nix registry add my-config github:username/nixos-config
|
||||
|
||||
# Use in other flakes
|
||||
nixos-rebuild switch --flake my-config#hostname
|
||||
```
|
||||
|
||||
## Best Practices for Remote Management
|
||||
|
||||
### 1. Repository Organization
|
||||
|
||||
```
|
||||
nixos-config/
|
||||
├── flake.nix
|
||||
├── flake.lock
|
||||
├── hosts/
|
||||
│ ├── server1/
|
||||
│ ├── server2/
|
||||
│ └── workstation/
|
||||
├── modules/
|
||||
│ ├── common/
|
||||
│ └── services/
|
||||
└── secrets/
|
||||
```
|
||||
|
||||
### 2. Security Considerations
|
||||
|
||||
- Use SSH key authentication
|
||||
- Implement proper access controls
|
||||
- Consider using tools like `sops-nix` for secrets management
|
||||
- Enable automatic rollback on deployment failures
|
||||
|
||||
### 3. CI/CD Integration
|
||||
|
||||
GitHub Actions example for automated deployments:
|
||||
|
||||
```yaml
|
||||
name: Deploy NixOS
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: DeterminateSystems/nix-installer-action@v4
|
||||
- name: Deploy to servers
|
||||
run: |
|
||||
nix run github:serokell/deploy-rs
|
||||
```
|
||||
|
||||
### 4. Caching Strategies
|
||||
|
||||
- Use binary caches to speed up deployments
|
||||
- Consider FlakeHub Cache for enterprise environments
|
||||
- Implement local caching for frequently used dependencies
|
||||
|
||||
## Troubleshooting Remote Management
|
||||
|
||||
### Common Issues:
|
||||
|
||||
1. **SSH connectivity** - Ensure passwordless authentication
|
||||
2. **Build failures** - Check cross-compilation settings
|
||||
3. **Lock file conflicts** - Use `nix flake update` carefully
|
||||
4. **Network timeouts** - Configure appropriate timeouts for remote operations
|
||||
|
||||
### Debugging Commands:
|
||||
|
||||
```bash
|
||||
# Test flake evaluation
|
||||
nix flake show github:username/repo
|
||||
|
||||
# Check flake metadata
|
||||
nix flake metadata github:username/repo
|
||||
|
||||
# Update specific input
|
||||
nix flake update input-name
|
||||
```
|
||||
|
||||
## Conclusion
|
||||
|
||||
Nix flakes provide a robust foundation for remote system management with excellent reproducibility guarantees. The combination of GitHub-based distribution, powerful deployment tools like deploy-rs, and modern platforms like FlakeHub creates a comprehensive ecosystem for managing distributed Nix-based infrastructure.
|
||||
|
||||
**For your specific home lab setup**, transitioning to a git-centric multi-host flake deployment will:
|
||||
|
||||
- **Simplify your toolchain** by eliminating the custom lab tool
|
||||
- **Improve reproducibility** by using git as the single source of truth
|
||||
- **Enhance collaboration** by leveraging standard Nix workflows
|
||||
- **Reduce maintenance burden** by using well-supported community tools
|
||||
|
||||
The migration can be done gradually, and your existing flake.nix structure already supports this transition perfectly. The key to successful remote management lies in proper repository organization, security practices, and choosing the right tools for your specific deployment patterns.
|
||||
Loading…
Add table
Add a link
Reference in a new issue