f4d76f8f25
scripts/deploy-pinix.sh wraps the documented nixbuild.net build/copy/ switch sequence for pinix (flake check, diff-closures, --dry-run via dry-activate) into a single command; CLAUDE.md gets a pointer to it next to the manual steps it wraps. .claude/settings.json adds a read-only Bash allowlist (nix eval/build/ store diff-closures, curl, systemctl is-active, journalctl, git fetch) based on this session's actual usage, to cut down permission prompts. Also gitignore .claude/settings.local.json, which was untracked but not ignored and contains bearer tokens from ad-hoc API calls.
65 lines
2.1 KiB
Bash
Executable file
65 lines
2.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Wraps the pinix remote-build/deploy sequence documented in CLAUDE.md:
|
|
# build on eu.nixbuild.net, copy the closure through blunix to pinix,
|
|
# then activate. Run from the nixos-config repo root (any subdir is fine,
|
|
# cds to the repo root itself).
|
|
|
|
usage() {
|
|
echo "Usage: $0 [--dry-run] [--skip-check]" >&2
|
|
echo " --dry-run build + copy, then nixos-rebuild dry-activate instead of switch" >&2
|
|
echo " --skip-check skip the leading 'nix flake check'" >&2
|
|
exit 1
|
|
}
|
|
|
|
dry_run=false
|
|
skip_check=false
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--dry-run) dry_run=true ;;
|
|
--skip-check) skip_check=true ;;
|
|
-h|--help) usage ;;
|
|
*) usage ;;
|
|
esac
|
|
done
|
|
|
|
cd "$(git rev-parse --show-toplevel)"
|
|
|
|
if [[ "$skip_check" == false ]]; then
|
|
echo "==> nix flake check"
|
|
nix flake check
|
|
fi
|
|
|
|
echo "==> building pinix toplevel on eu.nixbuild.net"
|
|
build_json=$(nix build --json --eval-store auto --store ssh-ng://eu.nixbuild.net \
|
|
path:.#nixosConfigurations.pinix.config.system.build.toplevel)
|
|
system=$(echo "$build_json" | jq -r '.[0].outputs.out')
|
|
echo " -> $system"
|
|
|
|
echo "==> copying closure from nixbuild.net to blunix"
|
|
nix copy --from ssh-ng://eu.nixbuild.net "$system"
|
|
|
|
echo "==> copying closure to pinix"
|
|
nix copy --no-check-sigs --to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' "$system"
|
|
|
|
current=$(ssh pinix 'readlink -f /run/current-system')
|
|
if [[ "$current" != "$system" ]]; then
|
|
echo "==> diff-closures (running pinix system -> new)"
|
|
nix store diff-closures "$current" "$system" || true
|
|
else
|
|
echo "==> new closure is identical to what's already running on pinix"
|
|
fi
|
|
|
|
if [[ "$dry_run" == true ]]; then
|
|
echo "==> dry-activate on pinix"
|
|
nixos-rebuild dry-activate --no-reexec --store-path "$system" --target-host pinix --sudo
|
|
echo "==> dry run only, not switching -- re-run without --dry-run to activate"
|
|
exit 0
|
|
fi
|
|
|
|
echo "==> switching pinix to new generation"
|
|
nixos-rebuild switch --no-reexec --store-path "$system" --target-host pinix --sudo
|
|
|
|
echo "==> verifying"
|
|
ssh -T pinix 'readlink -f /run/current-system; readlink -f /nix/var/nix/profiles/system; systemctl is-system-running'
|