ryan4yin | 二花
18925eac8b
* fix(colmena): expose colmenaHive for the new evaluator nixpkgs now ships the nix-community Colmena rewrite, whose default evaluator reads an evaluated colmenaHive flake output instead of the raw colmena hive. Without it every colmena apply recipe failed with "does not provide attribute colmenaHive". Add a colmena input pinned to the same v0.5.0 as nixpkgs and expose colmenaHive = colmena.lib.makeHive <raw hive>, with the raw hive kept as an internal binding rather than a flake output of its own. * chore: clean up stale colmena and aquamarine references - point the Colmena links at nix-community/colmena after the move - rename the security-aquamarine-metrics test to youko-metrics (it already tested youko) and update the outputs README - drop the commented aquamarine remote-builder example
Flake Outputs
Is such a complex and fine-grained structure necessary?
There is no need to do this when you have a small number of machines.
But when you have a large number of machines, it is necessary to manage them in a fine-grained way, otherwise, it will be difficult to manage and maintain them.
The number of my machines has grown past a dozen, and the increase in scale has shown signs of getting out of control of complexity, so it is a natural and reasonable choice to use this fine-grained architecture to manage.
Tests
Testing is not necessary when your configuration is not complex, but with the increase in the number and configuration of your machines, testing becomes more and more important.
We have two types of tests: eval tests and nixos tests, both of which can help us detect many obscure errors early, so as to avoid testing directly in the real world, and to avoid failures in personal computers and even corporate online environments.
Related projects & docs:
- haumea: Filesystem-based module system for Nix
- Unveiling the Power of the NixOS Integration Test Driver (Part 1)
- NixOS Tests - NixOS Manual
1. Eval Tests
TODO: More Tests!
Eval Tests evaluate the expressions and compare the results with the expected results. It runs fast, but it doesn't build a real machine. We use eval tests to ensure that some attributes are correctly set for each NixOS and nix-darwin host.
How to run all the eval tests:
nix eval .#evalTests --show-trace --print-build-logs --verbose
Each test is a directory outputs/<system>/tests/<name>/ holding expr.nix and expected.nix; the
suite passes when every expr equals its expected.
Which tests cover a new host
Some tests iterate over every configuration, so a new host is covered automatically and must satisfy them. Others name specific hosts and only cover a new host if you add it.
| Kind | Tests |
|---|---|
| Every configuration | hostname, kernel, nix-system-features, security-apparmor, security-container-groups, security-firewall, security-k3s-kubeconfig, security-ssh-x11 |
| Named hosts only | btrbk, home-manager, home-manager-xdg, computer-use-headless, k3s-master-home-manager, idols-ai-gpu, youko-metrics, ups-metrics, shoukei-logind |
hostname expects each configuration's networking.hostName to equal its name. Niri desktop
configurations are the exception (ai-niri → ai, shoukei-niri → shoukei) and are listed in
specialExpected in that platform's hostname/expected.nix.
2. NixOS Tests
WIP: not working yet
NixOS Tests builds and starts virtual machines using our NixOS configuration and run tests on them. Comparing to eval tests, it runs slow, but it builds a real machine, and we can test the whole system actually works as expected.
Problems:
- We need a private cache server, so that our NixOS tests do not need to build some custom packages every time we run the tests.
- Cannot test the whole host, because my host relies on its unique ssh host key to decrypt its
agenix secrets.
- Maybe it's better to test every service separately, not the whole host?
How to run NixOS tests for every host:
# Format: nix build .#<name>-nixos-tests
nix build .#ruby-nixos-tests
Overview
All the outputs of this flake are defined here.
› tree
.
├── default.nix # The entry point, all the outputs are composed here.
├── README.md
├── aarch64-darwin # All outputs for macOS Apple Silicon
│ ├── default.nix
│ ├── src # every host has its own file in this directory
│ │ ├── fern.nix
│ │ └── frieren.nix
│ └── tests # eval tests
├── aarch64-linux # All outputs for Linux ARM64
│ ├── default.nix
│ ├── src # every host has its own file in this directory
│ │ ├── 12kingdoms-shoukei.nix
│ │ └── idols-akane.nix
│ └── tests # eval tests
└── x86_64-linux # All outputs for Linux x86_64
├── default.nix
├── nixos-tests
├── src # every host has its own file in this directory
│ ├── 12kingdoms-shoryu.nix
│ ├── 12kingdoms-shushou.nix
│ ├── 12kingdoms-youko.nix
│ ├── idols-ai.nix
│ ├── idols-kana.nix
│ ├── idols-ruby.nix
│ ├── k3s-test-1-master-1.nix
│ ├── k3s-test-1-master-2.nix
│ ├── k3s-test-1-master-3.nix
│ ├── k3s-test-1-worker-1.nix
│ ├── k3s-test-1-worker-2.nix
│ └── k3s-test-1-worker-3.nix
└── tests # eval tests (btrbk, computer-use-headless, hostname,
# kernel, security-*, ups-metrics, ...)