From 18925eac8bf49fb5dc6edfb2f3a256249a481021 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Sat, 3 Oct 2026 12:14:13 +0800 Subject: [PATCH] fix(colmena): expose colmenaHive for the nix-community evaluator (#361) * fix(colmena): expose colmenaHive for the new evaluator nixpkgs now ships the nix-community Colmena rewrite, whose default evaluator reads an evaluated colmenaHive flake output instead of the raw colmena hive. Without it every colmena apply recipe failed with "does not provide attribute colmenaHive". Add a colmena input pinned to the same v0.5.0 as nixpkgs and expose colmenaHive = colmena.lib.makeHive , with the raw hive kept as an internal binding rather than a flake output of its own. * chore: clean up stale colmena and aquamarine references - point the Colmena links at nix-community/colmena after the move - rename the security-aquamarine-metrics test to youko-metrics (it already tested youko) and update the outputs README - drop the commented aquamarine remote-builder example --- README.md | 4 +- flake.lock | 144 +++++++++++++++--- flake.nix | 9 ++ lib/README.md | 2 +- modules/nixos/server/remote-building.nix | 9 -- outputs/README.md | 8 +- outputs/default.nix | 48 +++--- .../expected.nix | 0 .../expr.nix | 0 9 files changed, 164 insertions(+), 60 deletions(-) rename outputs/x86_64-linux/tests/{security-aquamarine-metrics => youko-metrics}/expected.nix (100%) rename outputs/x86_64-linux/tests/{security-aquamarine-metrics => youko-metrics}/expr.nix (100%) diff --git a/README.md b/README.md index 15073e64..9a032d60 100644 --- a/README.md +++ b/README.md @@ -146,8 +146,8 @@ just local just local debug # detailed output (macOS has no switch/boot mode) ``` -Remote / cluster hosts are deployed with [Colmena](https://github.com/zhaofengli/colmena) on top of -the same flake, e.g. `just col `, `just k3s-test`, `just lab`. +Remote / cluster hosts are deployed with [Colmena](https://github.com/nix-community/colmena) on top +of the same flake, e.g. `just col `, `just k3s-test`, `just lab`. > [What y'all will need when Nix drives you to drink.](https://www.youtube.com/watch?v=Eni9PPPPBpg) > (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...) diff --git a/flake.lock b/flake.lock index 3d8f2ad4..0ad5aa6c 100644 --- a/flake.lock +++ b/flake.lock @@ -82,6 +82,33 @@ "type": "github" } }, + "colmena": { + "inputs": { + "flake-compat": "flake-compat", + "flake-utils": "flake-utils", + "nix-github-actions": "nix-github-actions", + "nixpkgs": [ + "nixpkgs" + ], + "stable": [ + "nixpkgs-stable" + ] + }, + "locked": { + "lastModified": 1790091756, + "narHash": "sha256-YkaWZQV/OO4ZEmin+RHZ/6qFfBah/qSSXduTQMZTNR0=", + "owner": "nix-community", + "repo": "colmena", + "rev": "948491ae031dc0e2e61f0982943dd9964a724bdb", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.5.0", + "repo": "colmena", + "type": "github" + } + }, "crane": { "locked": { "lastModified": 1781825982, @@ -144,13 +171,13 @@ "locked": { "lastModified": 1767039857, "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", - "owner": "NixOS", + "owner": "edolstra", "repo": "flake-compat", "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", "type": "github" }, "original": { - "owner": "NixOS", + "owner": "edolstra", "repo": "flake-compat", "type": "github" } @@ -172,21 +199,6 @@ } }, "flake-compat_3": { - "locked": { - "lastModified": 1761640442, - "narHash": "sha256-AtrEP6Jmdvrqiv4x2xa5mrtaIp3OEe8uBYCDZDS+hu8=", - "owner": "nix-community", - "repo": "flake-compat", - "rev": "4a56054d8ffc173222d09dad23adf4ba946c8884", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_4": { "flake": false, "locked": { "lastModified": 1767039857, @@ -202,7 +214,38 @@ "type": "github" } }, + "flake-compat_4": { + "locked": { + "lastModified": 1761640442, + "narHash": "sha256-AtrEP6Jmdvrqiv4x2xa5mrtaIp3OEe8uBYCDZDS+hu8=", + "owner": "nix-community", + "repo": "flake-compat", + "rev": "4a56054d8ffc173222d09dad23adf4ba946c8884", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "flake-compat", + "type": "github" + } + }, "flake-compat_5": { + "flake": false, + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "NixOS", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_6": { "flake": false, "locked": { "lastModified": 1761640442, @@ -314,6 +357,24 @@ "type": "github" } }, + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "git-hooks": { "inputs": { "flake-compat": [ @@ -484,7 +545,7 @@ "bun2nix": "bun2nix", "flake-parts": "flake-parts", "nixpkgs": "nixpkgs", - "systems": "systems", + "systems": "systems_2", "treefmt-nix": "treefmt-nix" }, "locked": { @@ -607,7 +668,7 @@ }, "nix-gaming": { "inputs": { - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "flake-parts": "flake-parts_2", "git-hooks": "git-hooks", "nixpkgs": [ @@ -628,9 +689,30 @@ "type": "github" } }, + "nix-github-actions": { + "inputs": { + "nixpkgs": [ + "colmena", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1737420293, + "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=", + "owner": "nix-community", + "repo": "nix-github-actions", + "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nix-github-actions", + "type": "github" + } + }, "nixos-apple-silicon": { "inputs": { - "flake-compat": "flake-compat_3", + "flake-compat": "flake-compat_4", "nixpkgs": [ "nixpkgs" ] @@ -852,7 +934,7 @@ }, "pre-commit": { "inputs": { - "flake-compat": "flake-compat", + "flake-compat": "flake-compat_2", "gitignore": "gitignore", "nixpkgs": [ "lanzaboote", @@ -875,7 +957,7 @@ }, "pre-commit-hooks": { "inputs": { - "flake-compat": "flake-compat_4", + "flake-compat": "flake-compat_5", "nixpkgs": [ "nixpkgs" ] @@ -934,6 +1016,7 @@ "inputs": { "agenix": "agenix", "catppuccin": "catppuccin", + "colmena": "colmena", "disko": "disko", "haumea": "haumea", "home-manager": "home-manager", @@ -1014,6 +1097,21 @@ "type": "github" } }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": [ @@ -1059,7 +1157,7 @@ "tuios": { "inputs": { "devshell": "devshell", - "flake-compat": "flake-compat_5", + "flake-compat": "flake-compat_6", "flake-parts": "flake-parts_4", "flake-root": "flake-root", "git-hooks-nix": "git-hooks-nix", diff --git a/flake.nix b/flake.nix index 8bf4a458..d0e5909d 100644 --- a/flake.nix +++ b/flake.nix @@ -85,6 +85,15 @@ url = "github:nix-community/preservation"; }; + # Remote deployment via SSH. Pinned to the same v0.5.0 that nixpkgs ships + # so the `colmenaHive` output we expose matches the CLI's schema. + colmena = { + url = "github:nix-community/colmena/v0.5.0"; + inputs.nixpkgs.follows = "nixpkgs"; + # Reuse the flake's own stable nixpkgs instead of colmena's pinned copy. + inputs.stable.follows = "nixpkgs-stable"; + }; + # secrets management # Pinned to a release tag (not a branch) so `just up` cannot move it # silently; bump deliberately when a new release is needed. diff --git a/lib/README.md b/lib/README.md index b3bb92ec..9482f70b 100644 --- a/lib/README.md +++ b/lib/README.md @@ -12,7 +12,7 @@ reduce code duplication and make it easier to add new machines. [nix-darwin](https://github.com/LnL7/nix-darwin) 3. **`nixosSystem.nix`** - NixOS configuration generator 4. **`colmenaSystem.nix`** - Remote deployment configuration for - [colmena](https://github.com/zhaofengli/colmena) + [colmena](https://github.com/nix-community/colmena) ### Specialized Module Generators diff --git a/modules/nixos/server/remote-building.nix b/modules/nixos/server/remote-building.nix index e3fa0e1e..6726d0b1 100644 --- a/modules/nixos/server/remote-building.nix +++ b/modules/nixos/server/remote-building.nix @@ -47,15 +47,6 @@ # # 1. a hostname that can be resolved by DNS # # 2. the ip address of the remote builder # # 3. a host alias defined globally in /etc/ssh/ssh_config - # hostName = "aquamarine"; - # # remote builder's max-job - # maxJobs = 3; - # # speedFactor's a signed integer - # # https://github.com/ryan4yin/nix-config/issues/70 - # speedFactor = 1; - # } - # { - # inherit sshUser sshKey systems supportedFeatures; # hostName = "ruby"; # maxJobs = 2; # speedFactor = 1; diff --git a/outputs/README.md b/outputs/README.md index 5cad6d74..ea935e9b 100644 --- a/outputs/README.md +++ b/outputs/README.md @@ -48,10 +48,10 @@ suite passes when every `expr` equals its `expected`. Some tests iterate over every configuration, so a new host is covered automatically and must satisfy them. Others name specific hosts and only cover a new host if you add it. -| Kind | Tests | -| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Every configuration | `hostname`, `kernel`, `nix-system-features`, `security-apparmor`, `security-container-groups`, `security-firewall`, `security-k3s-kubeconfig`, `security-ssh-x11` | -| Named hosts only | `btrbk`, `home-manager`, `home-manager-xdg`, `computer-use-headless`, `k3s-master-home-manager`, `idols-ai-gpu`, `security-aquamarine-metrics`, `ups-metrics`, `shoukei-logind` | +| Kind | Tests | +| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Every configuration | `hostname`, `kernel`, `nix-system-features`, `security-apparmor`, `security-container-groups`, `security-firewall`, `security-k3s-kubeconfig`, `security-ssh-x11` | +| Named hosts only | `btrbk`, `home-manager`, `home-manager-xdg`, `computer-use-headless`, `k3s-master-home-manager`, `idols-ai-gpu`, `youko-metrics`, `ups-metrics`, `shoukei-logind` | `hostname` expects each configuration's `networking.hostName` to equal its name. Niri desktop configurations are the exception (`ai-niri` → `ai`, `shoukei-niri` → `shoukei`) and are listed in diff --git a/outputs/default.nix b/outputs/default.nix index a456b29e..2d77f101 100644 --- a/outputs/default.nix +++ b/outputs/default.nix @@ -91,27 +91,10 @@ let darwinSystemValues = builtins.attrValues darwinSystems; allSystemValues = nixosSystemValues ++ darwinSystemValues; - # Helper function to generate a set of attributes for each system - forAllSystems = func: (nixpkgs.lib.genAttrs allSystemNames func); -in -{ - # Add attribute sets into outputs, for debugging - debugAttrs = { - inherit - nixosSystems - darwinSystems - allSystems - allSystemNames - ; - }; - - # NixOS Hosts - nixosConfigurations = lib.attrsets.mergeAttrsList ( - map (it: it.nixosConfigurations or { }) nixosSystemValues - ); - - # Colmena - remote deployment via SSH - colmena = { + # Raw Colmena hive (nodes + meta), evaluated below into the exposed + # `colmenaHive` output. The nix-community Colmena rewrite only reads + # `colmenaHive`, so the raw hive is not an output of its own. + rawColmenaHive = { meta = ( let @@ -135,6 +118,29 @@ in } // lib.attrsets.mergeAttrsList (map (it: it.colmena or { }) nixosSystemValues); + # Helper function to generate a set of attributes for each system + forAllSystems = func: (nixpkgs.lib.genAttrs allSystemNames func); +in +{ + # Add attribute sets into outputs, for debugging + debugAttrs = { + inherit + nixosSystems + darwinSystems + allSystems + allSystemNames + ; + }; + + # NixOS Hosts + nixosConfigurations = lib.attrsets.mergeAttrsList ( + map (it: it.nixosConfigurations or { }) nixosSystemValues + ); + + # Colmena - remote deployment via SSH. The nix-community evaluator reads the + # evaluated `colmenaHive` output built from the raw hive in the `let` block. + colmenaHive = inputs.colmena.lib.makeHive rawColmenaHive; + # macOS Hosts darwinConfigurations = lib.attrsets.mergeAttrsList ( map (it: it.darwinConfigurations or { }) darwinSystemValues diff --git a/outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix b/outputs/x86_64-linux/tests/youko-metrics/expected.nix similarity index 100% rename from outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix rename to outputs/x86_64-linux/tests/youko-metrics/expected.nix diff --git a/outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix b/outputs/x86_64-linux/tests/youko-metrics/expr.nix similarity index 100% rename from outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix rename to outputs/x86_64-linux/tests/youko-metrics/expr.nix