History

pijukka 609c27ce15 calendar: move calendar-web frontend to its own Forgejo repo Source now lives in lukas/calendar-web instead of this flake, matching the website/dashboard pattern: pinix checks it out at /var/www/calendar-web, nginx serves the dist/ output directly, and a new gitpull-calendar-web webhook hook does `git pull && npm ci && npm run build` (esbuild) on push. Frontend/style-only changes no longer need a nixos-rebuild. - webhook.nix: new hook + build script - packages.nix: add nodejs (npm needed for the build script) - forgejo.nix: enable ENABLE_PUSH_CREATE_USER, needed to create the new repo by pushing to it rather than via the web UI - web.nix: nginx root points at /var/www/calendar-web/dist - README.md: document the new deploy path Still needs a Forgejo-side webhook added manually in the calendar-web repo settings (no API token available to script it): target http://127.0.0.1:9000/hooks/gitpull-calendar-web, push events on dev.		2026-07-30 09:28:41 +02:00
..
localServices	calendar: move calendar-web frontend to its own Forgejo repo	2026-07-30 09:28:41 +02:00
configuration.nix	host(pinix): restrict website preview to tailnet	2026-07-28 16:28:14 +02:00
disko.nix	auto	2025-06-29 21:21:33 +02:00
hardware-configuration.nix	auto	2025-06-29 20:48:33 +02:00
hardware-configuration_bak.nix	auto	2025-06-29 20:48:33 +02:00
README.md	docs: add operator guidance and fix remote-deploy command gaps	2026-07-28 22:01:28 +02:00

README.md

raspberry pi

The setup is a little annoying atm. No headless. :(

We want to build a sd image that joins automatically the tailnet, so that we can nixos-rebuild switch —-target-host.

Build and deploy

The primary administration checkout is /home/drone/nixos-config on blunix. Pinix also keeps a checkout at the same path for recovery and optional local builds. Fast-forward it from Forgejo's dev branch before use.

nrsp remains available on tnix for ordinary local updates. It builds the pinix configuration, copies the closure to the Raspberry Pi, and activates it.

From blunix, use the nixbuild.net remote store for AArch64 builds:

nix build \
  --json \
  --eval-store auto \
  --store ssh-ng://eu.nixbuild.net \
  path:.#nixosConfigurations.pinix.config.system.build.toplevel

Copy the output path from the JSON result into the local store, then to pinix, and activate that exact path:

nix copy \
  --from ssh-ng://eu.nixbuild.net \
  /nix/store/<output-path>

nix copy \
  --no-check-sigs \
  --to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' \
  /nix/store/<output-path>

nixos-rebuild switch \
  --no-reexec \
  --store-path /nix/store/<output-path> \
  --target-host pinix \
  --sudo

--no-check-sigs is required because pinix does not trust the nixbuild.net signing key; without it the copy fails with "lacks a signature by a trusted key". --no-reexec is required because nixos-rebuild otherwise tries to rebuild itself from <nixpkgs/nixos> via NIX_PATH, which this flake-only system does not have configured.

Do not put plaintext credentials in flake sources or derivation inputs. Secrets remain encrypted with agenix and are decrypted only on the target host.

Infrastructure addresses and domains can be overridden in the git-ignored variables-local.nix. The required encrypted files and their formats are listed in ../../secrets/README.md.