diff --git a/flake.lock b/flake.lock index c118d73..e432da3 100644 --- a/flake.lock +++ b/flake.lock @@ -68,48 +68,10 @@ "type": "github" } }, - "nixpkgs_26_05": { - "locked": { - "lastModified": 1791143449, - "narHash": "sha256-9+n3ReS2y9xS199LoJjKUWHwZrISGHWgkD/LUZTDZyA=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "0d9e9b832d03ac387417e16ce1febf73b2e631e1", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-26.05", - "repo": "nixpkgs", - "type": "github" - } - }, "root": { "inputs": { "nix-minecraft": "nix-minecraft", - "nixpkgs": "nixpkgs_2", - "nixpkgs_26_05": "nixpkgs_26_05", - "sops-nix": "sops-nix" - } - }, - "sops-nix": { - "inputs": { - "nixpkgs": [ - "nixpkgs_26_05" - ] - }, - "locked": { - "lastModified": 1791103873, - "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=", - "owner": "Mic92", - "repo": "sops-nix", - "rev": "dcd241ba97088c22569d1573286e1b9daad340c0", - "type": "github" - }, - "original": { - "owner": "Mic92", - "repo": "sops-nix", - "type": "github" + "nixpkgs": "nixpkgs_2" } }, "systems": { diff --git a/flake.nix b/flake.nix index 23cb1b3..1ee1ae0 100644 --- a/flake.nix +++ b/flake.nix @@ -3,17 +3,12 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; - nixpkgs_26_05.url = "github:NixOS/nixpkgs/nixos-26.05"; - sops-nix.url = "github:Mic92/sops-nix"; - sops-nix.inputs.nixpkgs.follows = "nixpkgs_26_05"; nix-minecraft.url = "github:Infinidoge/nix-minecraft"; }; outputs = inputs @ { self, nixpkgs, - nixpkgs_26_05, - sops-nix, nix-minecraft, ... }: let @@ -60,12 +55,9 @@ modules = [./nix-system-configs/modules/system/traefik.nix]; }; - "nixos-build-machine" = nixpkgs_26_05.lib.nixosSystem { + "nixos-build-machine" = nixpkgs.lib.nixosSystem { inherit system; - modules = [ - sops-nix.nixosModules.sops - ./nix-system-configs/modules/system/build_machine.nix - ]; + modules = [./nix-system-configs/modules/system/build_machine.nix]; }; "nixos-logs" = nixpkgs.lib.nixosSystem { diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh index 37e7ff6..72f5051 100755 --- a/nix-system-configs/modules/scripts/pull.zsh +++ b/nix-system-configs/modules/scripts/pull.zsh @@ -210,15 +210,12 @@ fi # Step 4: Rebuild system using local flake # Compute repository root (three levels up from this script: .../nix-system-configs/modules/scripts -> repo root) FLAKE_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -# Map repository configuration filenames to flake nixosConfigurations names. -# Normalise the snake-cases as dashes. -case "${selected_system}" in - blank_system_USE_THIS_AS_COPY) flake_name="nixos-blank" ;; - gramethus) flake_name="nixos-logs" ;; - wireguard_server) flake_name="nixos-local-wireguard-server" ;; - nixos-*) flake_name="${selected_system}" ;; - *) flake_name="nixos-${selected_system//_/-}" ;; -esac +# Normalize selected system name to flake nixosConfigurations naming convention (prefix with 'nixos-' if missing) +if [[ "${selected_system}" == nixos-* ]]; then + flake_name="${selected_system}" +else + flake_name="nixos-${selected_system}" +fi # If the selected system is the database module, use the standard non-flake rebuild if [[ "${selected_system}" == "database" ]]; then diff --git a/nix-system-configs/modules/scripts/push.zsh b/nix-system-configs/modules/scripts/push.zsh index becbf48..522c724 100755 --- a/nix-system-configs/modules/scripts/push.zsh +++ b/nix-system-configs/modules/scripts/push.zsh @@ -102,14 +102,12 @@ echo "" # Step 1: Rebuild system print_info "Rebuilding NixOS system..." -# Map repository configuration filenames to flake nixosConfigurations names. -case "${selected_system}" in - blank_system_USE_THIS_AS_COPY) flake_name="nixos-blank" ;; - gramethus) flake_name="nixos-logs" ;; - wireguard_server) flake_name="nixos-local-wireguard-server" ;; - nixos-*) flake_name="${selected_system}" ;; - *) flake_name="nixos-${selected_system//_/-}" ;; -esac +# Normalize selected system name to flake nixosConfigurations naming convention (prefix with 'nixos-' if missing) +if [[ "${selected_system}" == nixos-* ]]; then + flake_name="${selected_system}" +else + flake_name="nixos-${selected_system}" +fi echo "" if sudo NIX_CONFIG='experimental-features = nix-command flakes' nixos-rebuild switch --upgrade-all --flake "${PWD}#${flake_name}"; then diff --git a/nix-system-configs/modules/secrets-config/sops-build-machine.nix b/nix-system-configs/modules/secrets-config/sops-build-machine.nix index 4953eea..75b9931 100644 --- a/nix-system-configs/modules/secrets-config/sops-build-machine.nix +++ b/nix-system-configs/modules/secrets-config/sops-build-machine.nix @@ -4,7 +4,18 @@ lib, ... }: { - # This will add secrets.yml to the Nix store + imports = let + # replace this with an actual commit id or tag + commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; + in [ + "${builtins.fetchTarball { + url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; + # replace this with an actual hash + sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; + }}/modules/sops" + ]; + + # This will add secrets.yml to the nix store # You can avoid this by adding a string to the full path instead, i.e. # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml; @@ -23,12 +34,4 @@ owner = "root"; mode = "0400"; }; - - sops.secrets."github_runner_token" = { - format = "yaml"; - sopsFile = ../../secrets/build_machine/secrets.yaml; - owner = "root"; - mode = "0400"; - restartUnits = ["github-runner-build-machine.service"]; - }; } diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index 54c61a6..c957e74 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -191,7 +191,6 @@ in { } ]; networking.defaultGateway = "10.1.1.1"; - networking.resolvconf.enable = false; environment.etc."resolv.conf".text = '' nameserver 10.1.1.2 ''; @@ -219,52 +218,6 @@ in { }; }; - users.groups.github-runner = {}; - users.users.github-runner = { - isSystemUser = true; - group = "github-runner"; - home = "/var/lib/github-runner"; - createHome = true; - }; - - services.github-runners.build-machine = { - enable = true; - user = "github-runner"; - group = "github-runner"; - name = "nixos-build-machine"; - url = "https://github.com/bitcoin-dev-tools"; - tokenFile = "/run/github-runner-token"; - ephemeral = true; - replace = true; - extraLabels = ["nixos" "build-machine"]; - }; - - systemd.services.github-runner-build-machine = { - requires = ["sops-nix.service"]; - after = ["sops-nix.service"]; - serviceConfig.ExecStartPre = lib.mkBefore [ - "+${pkgs.writeShellScript "prepare-github-runner-token" '' - set -eu - token="$(<${config.sops.secrets.github_runner_token.path})" - case "$token" in - TOKEN=*) token="''${token#TOKEN=}" ;; - *) - echo "GitHub runner token secret must use TOKEN= format" >&2 - exit 1 - ;; - esac - if [ -z "$token" ] || [[ "$token" == *$'\n'* ]]; then - echo "GitHub runner token secret must contain one non-empty token" >&2 - exit 1 - fi - token_file=/run/github-runner-token - printf '%s' "$token" > "$token_file.tmp" - chmod 0400 "$token_file.tmp" - mv -f "$token_file.tmp" "$token_file" - ''}" - ]; - }; - # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave diff --git a/nix-system-configs/secrets/build_machine/secrets.yaml b/nix-system-configs/secrets/build_machine/secrets.yaml index 8ee6ccd..019b967 100644 --- a/nix-system-configs/secrets/build_machine/secrets.yaml +++ b/nix-system-configs/secrets/build_machine/secrets.yaml @@ -1,8 +1,8 @@ runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str] -github_runner_token: ENC[AES256_GCM,data:zu1nICWyNdZF5om9Mi3sRbaeBWPfB/J52sSTDeSii5sVVZg=,iv:CZE/TXVX3NfYfj9xCTTHkiqTN50sEISRhypGAPQdzEg=,tag:uqq9IYbYuKIcLPm4BMkT6A==,type:str] sops: age: - - enc: | + - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m + enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3 @@ -10,8 +10,8 @@ sops: TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw== -----END AGE ENCRYPTED FILE----- - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m - - enc: | + - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca + enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn @@ -19,8 +19,7 @@ sops: U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg== -----END AGE ENCRYPTED FILE----- - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca - lastmodified: "2026-10-05T09:26:20Z" - mac: ENC[AES256_GCM,data:oM69M815SR0TDzUOrMbXanXd5vikDgADhFmXvY6VrhWSoRwweApiLsKjT1IxdH3yQCQVLdsGIhU8/0+Ke3ZZ64TBYYi8cBp+7Uua4UHqCz1ouwXVSO7/aVOQciySMxV2+fftZu0tUn8rdvAdpdPrucadgYLGmF9vJM4hSo7xy+4=,iv:Y19E6AftjLw3FRmxC2LykwSgVnv6UOK6K+3UyVaBTZg=,tag:D7AFDR5+hxm4YSFydLetVg==,type:str] + lastmodified: "2026-02-12T17:12:42Z" + mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.3 + version: 3.11.0