diff --git a/README.md b/README.md index 15073e64..9a032d60 100644 --- a/README.md +++ b/README.md @@ -146,8 +146,8 @@ just local just local debug # detailed output (macOS has no switch/boot mode) ``` -Remote / cluster hosts are deployed with [Colmena](https://github.com/zhaofengli/colmena) on top of -the same flake, e.g. `just col `, `just k3s-test`, `just lab`. +Remote / cluster hosts are deployed with [Colmena](https://github.com/nix-community/colmena) on top +of the same flake, e.g. `just col `, `just k3s-test`, `just lab`. > [What y'all will need when Nix drives you to drink.](https://www.youtube.com/watch?v=Eni9PPPPBpg) > (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...) diff --git a/flake.lock b/flake.lock index 3d8f2ad4..0ad5aa6c 100644 --- a/flake.lock +++ b/flake.lock @@ -82,6 +82,33 @@ "type": "github" } }, + "colmena": { + "inputs": { + "flake-compat": "flake-compat", + "flake-utils": "flake-utils", + "nix-github-actions": "nix-github-actions", + "nixpkgs": [ + "nixpkgs" + ], + "stable": [ + "nixpkgs-stable" + ] + }, + "locked": { + "lastModified": 1790091756, + "narHash": "sha256-YkaWZQV/OO4ZEmin+RHZ/6qFfBah/qSSXduTQMZTNR0=", + "owner": "nix-community", + "repo": "colmena", + "rev": "948491ae031dc0e2e61f0982943dd9964a724bdb", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.5.0", + "repo": "colmena", + "type": "github" + } + }, "crane": { "locked": { "lastModified": 1781825982, @@ -144,13 +171,13 @@ "locked": { "lastModified": 1767039857, "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", - "owner": "NixOS", + "owner": "edolstra", "repo": "flake-compat", "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", "type": "github" }, "original": { - "owner": "NixOS", + "owner": "edolstra", "repo": "flake-compat", "type": "github" } @@ -172,21 +199,6 @@ } }, "flake-compat_3": { - "locked": { - "lastModified": 1761640442, - "narHash": "sha256-AtrEP6Jmdvrqiv4x2xa5mrtaIp3OEe8uBYCDZDS+hu8=", - "owner": "nix-community", - "repo": "flake-compat", - "rev": "4a56054d8ffc173222d09dad23adf4ba946c8884", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_4": { "flake": false, "locked": { "lastModified": 1767039857, @@ -202,7 +214,38 @@ "type": "github" } }, + "flake-compat_4": { + "locked": { + "lastModified": 1761640442, + "narHash": "sha256-AtrEP6Jmdvrqiv4x2xa5mrtaIp3OEe8uBYCDZDS+hu8=", + "owner": "nix-community", + "repo": "flake-compat", + "rev": "4a56054d8ffc173222d09dad23adf4ba946c8884", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "flake-compat", + "type": "github" + } + }, "flake-compat_5": { + "flake": false, + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "NixOS", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_6": { "flake": false, "locked": { "lastModified": 1761640442, @@ -314,6 +357,24 @@ "type": "github" } }, + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "git-hooks": { "inputs": { "flake-compat": [ @@ -484,7 +545,7 @@ "bun2nix": "bun2nix", "flake-parts": "flake-parts", "nixpkgs": "nixpkgs", - "systems": "systems", + "systems": "systems_2", "treefmt-nix": "treefmt-nix" }, "locked": { @@ -607,7 +668,7 @@ }, "nix-gaming": { "inputs": { - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "flake-parts": "flake-parts_2", "git-hooks": "git-hooks", "nixpkgs": [ @@ -628,9 +689,30 @@ "type": "github" } }, + "nix-github-actions": { + "inputs": { + "nixpkgs": [ + "colmena", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1737420293, + "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=", + "owner": "nix-community", + "repo": "nix-github-actions", + "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nix-github-actions", + "type": "github" + } + }, "nixos-apple-silicon": { "inputs": { - "flake-compat": "flake-compat_3", + "flake-compat": "flake-compat_4", "nixpkgs": [ "nixpkgs" ] @@ -852,7 +934,7 @@ }, "pre-commit": { "inputs": { - "flake-compat": "flake-compat", + "flake-compat": "flake-compat_2", "gitignore": "gitignore", "nixpkgs": [ "lanzaboote", @@ -875,7 +957,7 @@ }, "pre-commit-hooks": { "inputs": { - "flake-compat": "flake-compat_4", + "flake-compat": "flake-compat_5", "nixpkgs": [ "nixpkgs" ] @@ -934,6 +1016,7 @@ "inputs": { "agenix": "agenix", "catppuccin": "catppuccin", + "colmena": "colmena", "disko": "disko", "haumea": "haumea", "home-manager": "home-manager", @@ -1014,6 +1097,21 @@ "type": "github" } }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": [ @@ -1059,7 +1157,7 @@ "tuios": { "inputs": { "devshell": "devshell", - "flake-compat": "flake-compat_5", + "flake-compat": "flake-compat_6", "flake-parts": "flake-parts_4", "flake-root": "flake-root", "git-hooks-nix": "git-hooks-nix", diff --git a/flake.nix b/flake.nix index 8bf4a458..d0e5909d 100644 --- a/flake.nix +++ b/flake.nix @@ -85,6 +85,15 @@ url = "github:nix-community/preservation"; }; + # Remote deployment via SSH. Pinned to the same v0.5.0 that nixpkgs ships + # so the `colmenaHive` output we expose matches the CLI's schema. + colmena = { + url = "github:nix-community/colmena/v0.5.0"; + inputs.nixpkgs.follows = "nixpkgs"; + # Reuse the flake's own stable nixpkgs instead of colmena's pinned copy. + inputs.stable.follows = "nixpkgs-stable"; + }; + # secrets management # Pinned to a release tag (not a branch) so `just up` cannot move it # silently; bump deliberately when a new release is needed. diff --git a/lib/README.md b/lib/README.md index b3bb92ec..9482f70b 100644 --- a/lib/README.md +++ b/lib/README.md @@ -12,7 +12,7 @@ reduce code duplication and make it easier to add new machines. [nix-darwin](https://github.com/LnL7/nix-darwin) 3. **`nixosSystem.nix`** - NixOS configuration generator 4. **`colmenaSystem.nix`** - Remote deployment configuration for - [colmena](https://github.com/zhaofengli/colmena) + [colmena](https://github.com/nix-community/colmena) ### Specialized Module Generators diff --git a/modules/nixos/server/remote-building.nix b/modules/nixos/server/remote-building.nix index e3fa0e1e..6726d0b1 100644 --- a/modules/nixos/server/remote-building.nix +++ b/modules/nixos/server/remote-building.nix @@ -47,15 +47,6 @@ # # 1. a hostname that can be resolved by DNS # # 2. the ip address of the remote builder # # 3. a host alias defined globally in /etc/ssh/ssh_config - # hostName = "aquamarine"; - # # remote builder's max-job - # maxJobs = 3; - # # speedFactor's a signed integer - # # https://github.com/ryan4yin/nix-config/issues/70 - # speedFactor = 1; - # } - # { - # inherit sshUser sshKey systems supportedFeatures; # hostName = "ruby"; # maxJobs = 2; # speedFactor = 1; diff --git a/outputs/README.md b/outputs/README.md index 5cad6d74..ea935e9b 100644 --- a/outputs/README.md +++ b/outputs/README.md @@ -48,10 +48,10 @@ suite passes when every `expr` equals its `expected`. Some tests iterate over every configuration, so a new host is covered automatically and must satisfy them. Others name specific hosts and only cover a new host if you add it. -| Kind | Tests | -| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Every configuration | `hostname`, `kernel`, `nix-system-features`, `security-apparmor`, `security-container-groups`, `security-firewall`, `security-k3s-kubeconfig`, `security-ssh-x11` | -| Named hosts only | `btrbk`, `home-manager`, `home-manager-xdg`, `computer-use-headless`, `k3s-master-home-manager`, `idols-ai-gpu`, `security-aquamarine-metrics`, `ups-metrics`, `shoukei-logind` | +| Kind | Tests | +| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Every configuration | `hostname`, `kernel`, `nix-system-features`, `security-apparmor`, `security-container-groups`, `security-firewall`, `security-k3s-kubeconfig`, `security-ssh-x11` | +| Named hosts only | `btrbk`, `home-manager`, `home-manager-xdg`, `computer-use-headless`, `k3s-master-home-manager`, `idols-ai-gpu`, `youko-metrics`, `ups-metrics`, `shoukei-logind` | `hostname` expects each configuration's `networking.hostName` to equal its name. Niri desktop configurations are the exception (`ai-niri` → `ai`, `shoukei-niri` → `shoukei`) and are listed in diff --git a/outputs/default.nix b/outputs/default.nix index a456b29e..2d77f101 100644 --- a/outputs/default.nix +++ b/outputs/default.nix @@ -91,27 +91,10 @@ let darwinSystemValues = builtins.attrValues darwinSystems; allSystemValues = nixosSystemValues ++ darwinSystemValues; - # Helper function to generate a set of attributes for each system - forAllSystems = func: (nixpkgs.lib.genAttrs allSystemNames func); -in -{ - # Add attribute sets into outputs, for debugging - debugAttrs = { - inherit - nixosSystems - darwinSystems - allSystems - allSystemNames - ; - }; - - # NixOS Hosts - nixosConfigurations = lib.attrsets.mergeAttrsList ( - map (it: it.nixosConfigurations or { }) nixosSystemValues - ); - - # Colmena - remote deployment via SSH - colmena = { + # Raw Colmena hive (nodes + meta), evaluated below into the exposed + # `colmenaHive` output. The nix-community Colmena rewrite only reads + # `colmenaHive`, so the raw hive is not an output of its own. + rawColmenaHive = { meta = ( let @@ -135,6 +118,29 @@ in } // lib.attrsets.mergeAttrsList (map (it: it.colmena or { }) nixosSystemValues); + # Helper function to generate a set of attributes for each system + forAllSystems = func: (nixpkgs.lib.genAttrs allSystemNames func); +in +{ + # Add attribute sets into outputs, for debugging + debugAttrs = { + inherit + nixosSystems + darwinSystems + allSystems + allSystemNames + ; + }; + + # NixOS Hosts + nixosConfigurations = lib.attrsets.mergeAttrsList ( + map (it: it.nixosConfigurations or { }) nixosSystemValues + ); + + # Colmena - remote deployment via SSH. The nix-community evaluator reads the + # evaluated `colmenaHive` output built from the raw hive in the `let` block. + colmenaHive = inputs.colmena.lib.makeHive rawColmenaHive; + # macOS Hosts darwinConfigurations = lib.attrsets.mergeAttrsList ( map (it: it.darwinConfigurations or { }) darwinSystemValues diff --git a/outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix b/outputs/x86_64-linux/tests/youko-metrics/expected.nix similarity index 100% rename from outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix rename to outputs/x86_64-linux/tests/youko-metrics/expected.nix diff --git a/outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix b/outputs/x86_64-linux/tests/youko-metrics/expr.nix similarity index 100% rename from outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix rename to outputs/x86_64-linux/tests/youko-metrics/expr.nix