Integrate deploy-rs for codified remote deploys#696
Merged
Conversation
dbus-broker's unit is Type=notify-reload but never sends the RELOADING=1/READY=1 handshake systemd expects, so any switch that touches its config hangs for the full 90s timeout and fails the whole activation (upstream systemd/dbus-broker#37515). Restarting instead of reloading isn't safe either - switch-to-configuration's own remaining steps talk to systemd over D-Bus, so stopping dbus-broker mid-switch can strand the activation script and leave the bus down until a manual restart, as happened on nixnuc. Leaving it untouched by every switch (neither reload nor restart) avoids both failure modes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iUoDbZzHLBGu7jD3pVGz2
Adds deploy-rs: a declared deploy.nodes table plus `nix run .#deploy-rs -- .#<host>` for build/copy/activate, with automatic rollback if the new generation breaks SSH connectivity. That safety net matters most for kiosk-entryway and kiosk-gene-desk, which have no keyboard normally attached and would otherwise need a physical visit to recover from a bad deploy. Covers all six NixOS hosts plus mightymac. Every node builds itself (remoteBuild = true), so a deploy can be invoked from any machine that can reach the target over SSH, not just mightymac - kiosk-gene-desk's own existing distributedBuilds offload to hetznix02 handles its weak hardware regardless of which machine runs the deploy. Hostnames resolve via Tailscale MagicDNS, so no domain is hardcoded anywhere in this repo. mightymac needed two additions to actually be deployable: a scoped passwordless-sudo rule for deploy-rs's two non-interactive sudo command patterns (nix-darwin has no wheelNeedsPassword-style toggle like NixOS), and deploy-rs's own activate.darwin support wired through lib/mkDeployNode.nix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iUoDbZzHLBGu7jD3pVGz2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nix run .#deploy-rs -- .#<host>) for build/copy/activate remote deploys with automatic rollback if the new generation breaks SSH connectivity - covers all six NixOS hosts plus mightymac, invokable from any machine that can reach the target over SSHnixos-rebuild switchhanging/failing ondbus-broker.service's broken reload (upstream systemd/dbus-broker#37515) - now excluded from both reload and restart on switch fleet-wideTest plan
nix flake check --all-systemspasses--dry-activateverified against every node before a real deploysystemctl is-system-running, dbus-broker/dbus.socket active)🤖 Generated with Claude Code
https://claude.ai/code/session_018iUoDbZzHLBGu7jD3pVGz2