90 lines
2.3 KiB
Plaintext
Executable File
90 lines
2.3 KiB
Plaintext
Executable File
#!/usr/bin/env nix-shell
|
|
#!nix-shell -i bash -p nettools
|
|
|
|
set -e
|
|
|
|
usage() {
|
|
echo "deploy: deploy a nix config to a remote machine, possibly activating it"
|
|
echo ""
|
|
echo "usage: deploy [options] [host]"
|
|
echo "options:"
|
|
echo "- --action switch|test"
|
|
echo "- --variant light|min"
|
|
exit 1
|
|
}
|
|
|
|
action=switch
|
|
host=$(hostname)
|
|
variant=
|
|
nixArgs=()
|
|
parseArgs() {
|
|
while [ "$#" -ne 0 ]; do
|
|
local arg=$1
|
|
shift
|
|
case "$arg" in
|
|
(--action)
|
|
action=$1
|
|
shift
|
|
;;
|
|
(--help)
|
|
usage
|
|
;;
|
|
(--variant)
|
|
if [ -n "$1" ]; then
|
|
variant=-$1
|
|
else
|
|
variant=
|
|
fi
|
|
shift
|
|
;;
|
|
(crappy|desko|lappy|moby|servo)
|
|
host="$arg"
|
|
;;
|
|
(*)
|
|
nixArgs+=("$arg")
|
|
;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
runOnTarget() {
|
|
# run the command ($@) on the machine we're deploying to.
|
|
# if that's a remote machine, then do it via ssh, else local shell.
|
|
if [ -n "$addr" ]; then
|
|
ssh "$addr" "$@"
|
|
else
|
|
"$@"
|
|
fi
|
|
}
|
|
|
|
parseArgs "$@"
|
|
|
|
nix-build -A "hosts.$host$variant" --out-link "./build/result-$host$variant" "${nixArgs[@]}"
|
|
storePath="$(readlink ./build/result-$host$variant)"
|
|
|
|
# mimic `nixos-rebuild --target-host`, in effect:
|
|
# - nix-copy-closure ...
|
|
# - nix-env --set ...
|
|
# - switch-to-configuration <boot|dry-activate|switch|test|>
|
|
# avoid the actual `nixos-rebuild` for a few reasons:
|
|
# - fewer nix evals
|
|
# - more introspectability and debuggability
|
|
# - sandbox friendliness (especially: `git` doesn't have to be run as root)
|
|
|
|
if [ -n "$host" ]; then
|
|
if [ -e /run/secrets/nix_signing_key ]; then
|
|
sudo nix store sign -r -k /run/secrets/nix_signing_key "$storePath"
|
|
else
|
|
echo "not signing store paths: /run/secrets/nix_signing_key does not exist"
|
|
fi
|
|
# add more `-v` for more verbosity (up to 5).
|
|
# builders-use-substitutes false: optimizes so that the remote machine doesn't try to get paths from its substituters.
|
|
# we already have all paths here, and the remote substitution is slow to check and SERIOUSLY flaky on moby in particular.
|
|
nix copy -vv --option builders-use-substitutes false --to "ssh-ng://$host" "$storePath"
|
|
fi
|
|
|
|
if [ -n "$action" ]; then
|
|
runOnTarget sudo nix-env -p /nix/var/nix/profiles/system --set "$storePath"
|
|
runOnTarget sudo "$storePath/bin/switch-to-configuration" "$action"
|
|
fi
|