xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-08-20 22:55:08 +02:00
commit 2972bf312e
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
4 changed files with 52 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

38
flake.nix
View file

@ -23,15 +23,29 @@
in
{
formatter.${system} = pkgs.nixfmt-tree;
apps.nixos-diff = {
type = "app";
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
${pkgs.git}/bin/git checkout flake.lock
${pkgs.git}/bin/git pull --ff-only
${pkgs.nix}/bin/nix flake update
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
''}";
apps = {
nixos-diff = {
type = "app";
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
${pkgs.git}/bin/git checkout flake.lock
${pkgs.git}/bin/git pull --ff-only
${pkgs.nix}/bin/nix flake update
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
''}";
};
deploy = {
type = "app";
program = "${pkgs.writeShellScript "deploy.sh" ''
set -e
host="''${1:?usage: nix run .#apps.deploy -- <host>}"
${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
set -e
cd /etc/nixos
nix run .#apps.nixos-diff && nixos-rebuild switch
EOF
''}";
};
};
devShells.${system}.default = pkgs.mkShell {
packages = [
@ -256,6 +270,12 @@
group = "forgejo";
mode = "0440";
};
forgejo-oauth2-jwt-secret = {
file = ./secrets/forgejo-oauth2-jwt-secret.age;
owner = "forgejo";
group = "forgejo";
mode = "0440";
};
forgejo-runner-token-snowden = {
file = ./secrets/forgejo-runner-token-snowden.age;
owner = "root";