mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
b79c5807ae
* ci: pin actions, scope tokens, run the runtime security VM test * test: add a just recipe for the runtime firewall VM test
356 lines
10 KiB
Makefile
356 lines
10 KiB
Makefile
# just is a command runner, Justfile is very similar to Makefile, but simpler.
|
|
|
|
# Use nushell for shell commands
|
|
# To use this justfile, you need to enter a shell with just & nushell installed:
|
|
#
|
|
# nix shell nixpkgs#just nixpkgs#nushell
|
|
set shell := ["nu", "-c"]
|
|
|
|
utils_nu := absolute_path("utils.nu")
|
|
|
|
############################################################################
|
|
#
|
|
# Common commands(suitable for all machines)
|
|
#
|
|
############################################################################
|
|
|
|
# List all the just commands
|
|
default:
|
|
@just --list
|
|
|
|
# Run eval tests
|
|
[group('nix')]
|
|
test:
|
|
let result = (nix eval .#evalTests --json --show-trace --print-build-logs --verbose | str trim); if $result != "true" { error make { msg: $"eval tests failed: evalTests returned ($result)" } }
|
|
|
|
# Build and run the runtime security VM test (needs /dev/kvm; not run by just test)
|
|
[linux]
|
|
[group('nix')]
|
|
test-vm:
|
|
nix build --no-link --print-build-logs .#checks.x86_64-linux.security-exporters
|
|
|
|
# Evaluate a NixOS host configuration without building it.
|
|
[group('nix')]
|
|
eval-host host:
|
|
nix eval $".#nixosConfigurations.{{host}}.config.system.build.toplevel.drvPath" --raw --show-trace
|
|
|
|
# Build a NixOS host system closure without changing the current system.
|
|
[group('nix')]
|
|
build-host host:
|
|
nix build $".#nixosConfigurations.{{host}}.config.system.build.toplevel" --no-link --print-build-logs
|
|
|
|
# Build a MicroVM runner locally. Deploy it with microvm-deploy so the closure is copied remotely.
|
|
[group('nix')]
|
|
build-microvm guest:
|
|
nix build $".#nixosConfigurations.{{guest}}.config.microvm.declaredRunner" --no-link --print-build-logs
|
|
|
|
# Update all the flake inputs
|
|
[group('nix')]
|
|
up:
|
|
nix flake update --commit-lock-file
|
|
|
|
# Update specific input
|
|
# Usage: just upp nixpkgs
|
|
[group('nix')]
|
|
upp input:
|
|
nix flake update {{input}} --commit-lock-file
|
|
|
|
# List all generations of the system profile
|
|
[group('nix')]
|
|
history:
|
|
nix profile history --profile /nix/var/nix/profiles/system
|
|
|
|
# Open a nix shell with the flake
|
|
[group('nix')]
|
|
repl:
|
|
nix repl -f flake:nixpkgs
|
|
|
|
# remove all old generations
|
|
# on darwin, you may need to switch to root user to run this command
|
|
[group('nix')]
|
|
clean:
|
|
# Wipe out NixOS's history
|
|
sudo nix profile wipe-history --profile /nix/var/nix/profiles/system
|
|
# Wipe out home-manager's history
|
|
nix profile wipe-history --profile $"($env.XDG_STATE_HOME)/nix/profiles/home-manager"
|
|
|
|
# Garbage collect all unused nix store entries
|
|
[group('nix')]
|
|
gc:
|
|
# garbage collect all unused nix store entries(system-wide)
|
|
sudo nix-collect-garbage --delete-older-than 7d
|
|
# garbage collect all unused nix store entries(for the user - home-manager)
|
|
# https://github.com/NixOS/nix/issues/8508
|
|
nix-collect-garbage --delete-older-than 7d
|
|
|
|
# Enter a shell session which has all the necessary tools for this flake
|
|
[linux]
|
|
[group('nix')]
|
|
shell:
|
|
nix shell nixpkgs#git nixpkgs#neovim nixpkgs#colmena
|
|
|
|
# Enter a shell session which has all the necessary tools for this flake
|
|
[macos]
|
|
[group('nix')]
|
|
shell:
|
|
nix shell nixpkgs#git nixpkgs#neovim
|
|
|
|
# upgrade determinate nix
|
|
[macos]
|
|
[group('nix')]
|
|
nix-upgrade:
|
|
sudo determinate-nixd upgrade
|
|
|
|
[group('nix')]
|
|
fmt:
|
|
# format the nix files in this repo
|
|
# (use external find so symlinked dirs like the `result` build output are not followed)
|
|
^find . -name '*.nix' -not -path './.git/*' | lines | each { |it| nixfmt $it | ignore }
|
|
|
|
# Show all the auto gc roots in the nix store
|
|
[group('nix')]
|
|
gcroot:
|
|
ls -al /nix/var/nix/gcroots/auto/
|
|
|
|
# Verify all the store entries
|
|
# Nix Store can contains corrupted entries if the nix store object has been modified unexpectedly.
|
|
# This command will verify all the store entries,
|
|
# and we need to fix the corrupted entries manually via `sudo nix store delete <store-path-1> <store-path-2> ...`
|
|
[group('nix')]
|
|
verify-store:
|
|
nix store verify --all
|
|
|
|
# Repair Nix Store Objects
|
|
[group('nix')]
|
|
repair-store *paths:
|
|
nix store repair {{paths}}
|
|
|
|
# Update all Nixpkgs inputs
|
|
[group('nix')]
|
|
up-nix:
|
|
nix flake update --commit-lock-file nixpkgs-stable nixpkgs-master nixpkgs-darwin nixpkgs-patched
|
|
|
|
# override nixpkgs's commit hash
|
|
[group('nix')]
|
|
override-pkgs hash:
|
|
nix flake update --commit-lock-file nixpkgs --override-input nixpkgs github:NixOS/nixpkgs/{{hash}}
|
|
|
|
############################################################################
|
|
#
|
|
# NixOS Desktop related commands
|
|
#
|
|
############################################################################
|
|
|
|
# Deploy the nixosConfiguration by hostname match
|
|
[linux]
|
|
[group('homelab')]
|
|
local mode="switch" verbosity="normal":
|
|
#!/usr/bin/env nu
|
|
use {{utils_nu}} *;
|
|
nixos-switch (hostname) {{mode}} {{verbosity}}
|
|
|
|
# Deploy the niri nixosConfiguration by hostname match
|
|
[linux]
|
|
[group('desktop')]
|
|
niri mode="switch" verbosity="normal":
|
|
#!/usr/bin/env nu
|
|
use {{utils_nu}} *;
|
|
nixos-switch $"(hostname)-niri" {{mode}} {{verbosity}}
|
|
|
|
############################################################################
|
|
#
|
|
# Darwin related commands
|
|
#
|
|
############################################################################
|
|
|
|
[macos]
|
|
[group('desktop')]
|
|
brew-upgrade:
|
|
brew upgrade --cask --greedy
|
|
|
|
[macos]
|
|
[group('desktop')]
|
|
darwin-rollback:
|
|
#!/usr/bin/env nu
|
|
use {{utils_nu}} *;
|
|
darwin-rollback
|
|
|
|
# Deploy the darwinConfiguration by hostname match
|
|
[macos]
|
|
[group('desktop')]
|
|
local verbosity="normal":
|
|
#!/usr/bin/env nu
|
|
use {{utils_nu}} *;
|
|
darwin-build (hostname) {{verbosity}};
|
|
darwin-switch (hostname) {{verbosity}}
|
|
|
|
|
|
# Reset launchpad to force it to reindex Applications
|
|
[macos]
|
|
[group('desktop')]
|
|
reset-launchpad:
|
|
defaults write com.apple.dock ResetLaunchPad -bool true
|
|
killall Dock
|
|
|
|
############################################################################
|
|
#
|
|
# Homelab - VM host related commands
|
|
#
|
|
############################################################################
|
|
|
|
# Remote deployment via colmena
|
|
[linux]
|
|
[group('homelab')]
|
|
col tag mode="switch":
|
|
colmena apply {{mode}} --on '@{{tag}}' --verbose --show-trace
|
|
|
|
# Deploy one microVM guest through microvm.nix's SSH deployment workflow.
|
|
# The host is the physical machine running the guest; the guest address is used for activation.
|
|
[linux]
|
|
[group('homelab')]
|
|
microvm-deploy guest host guest_ip:
|
|
nix run $".#nixosConfigurations.{{guest}}.config.microvm.deploy.installOnHost" -- root@{{host}}
|
|
nix run $".#nixosConfigurations.{{guest}}.config.microvm.deploy.sshSwitch" -- root@{{guest_ip}} --use-remote-sudo
|
|
|
|
# Deploy all the VM hosts (physical machines running the VMs)
|
|
[linux]
|
|
[group('homelab')]
|
|
lab mode="switch":
|
|
colmena apply {{mode}} --on '@virt-*' --verbose --show-trace
|
|
|
|
[linux]
|
|
[group('homelab')]
|
|
shoryu mode="switch":
|
|
colmena apply {{mode}} --on '@shoryu' --verbose --show-trace
|
|
|
|
[linux]
|
|
[group('homelab')]
|
|
shushou mode="switch":
|
|
colmena apply {{mode}} --on '@shushou' --verbose --show-trace
|
|
|
|
[linux]
|
|
[group('homelab')]
|
|
youko mode="switch":
|
|
colmena apply {{mode}} --on '@youko' --verbose --show-trace
|
|
|
|
############################################################################
|
|
#
|
|
# Commands for other Virtual Machines
|
|
#
|
|
############################################################################
|
|
|
|
[linux]
|
|
[group('homelab')]
|
|
ruby mode="switch":
|
|
colmena apply {{mode}} --on '@ruby' --verbose --show-trace
|
|
|
|
[linux]
|
|
[group('homelab')]
|
|
kana mode="switch":
|
|
colmena apply {{mode}} --on '@kana' --verbose --show-trace
|
|
|
|
############################################################################
|
|
#
|
|
# Kubernetes related commands
|
|
#
|
|
############################################################################
|
|
|
|
[linux]
|
|
[group('homelab')]
|
|
k3s-test mode="switch":
|
|
colmena apply {{mode}} --on '@k3s-test-*' --verbose --show-trace
|
|
|
|
# =================================================
|
|
#
|
|
# AI agent commands
|
|
#
|
|
# =================================================
|
|
|
|
# Start the dsh web UI without opening a browser, proxied via mihomo's mixed port.
|
|
[group('agents')]
|
|
dsh-web:
|
|
#!/usr/bin/env nu
|
|
# dsh's web fetch refuses a DNS answer it does not call public, and a fake-ip
|
|
# resolver answers with 198.18.0.0/15. A proxied hop lets mihomo resolve the
|
|
# origin instead, which skips that check and leaves fake-ip acceleration
|
|
# intact. The policy reaches every Node fetch the harness makes, so mihomo
|
|
# becomes a dependency for LLM, web search and HTTP MCP traffic too.
|
|
with-env { HTTPS_PROXY: "http://127.0.0.1:7897", HTTP_PROXY: "http://127.0.0.1:7897" } { ^dsh web --no-open }
|
|
|
|
# =================================================
|
|
#
|
|
# Other useful commands
|
|
#
|
|
# =================================================
|
|
|
|
[group('common')]
|
|
path:
|
|
$env.PATH | split row ":"
|
|
|
|
[group('common')]
|
|
trace-access app *args:
|
|
strace -f -t -e trace=file {{app}} {{args}} | complete | $in.stderr | lines | find -v -r "(/nix/store|/newroot|/proc)" | parse --regex '"(/.+)"' | sort | uniq
|
|
|
|
[linux]
|
|
[group('common')]
|
|
penvof pid:
|
|
sudo cat $"/proc/($pid)/environ" | tr '\0' '\n'
|
|
|
|
# Remove all reflog entries and prune unreachable objects
|
|
[group('git')]
|
|
ggc:
|
|
git reflog expire --expire-unreachable=now --all
|
|
git gc --prune=now
|
|
|
|
# Amend the last commit without changing the commit message
|
|
[group('git')]
|
|
game:
|
|
git commit --amend -a --no-edit
|
|
|
|
# Delete all failed pods
|
|
[group('k8s')]
|
|
del-failed:
|
|
kubectl delete pod --all-namespaces --field-selector="status.phase==Failed"
|
|
|
|
[linux]
|
|
[group('services')]
|
|
list-inactive:
|
|
systemctl list-units -all --state=inactive
|
|
|
|
[linux]
|
|
[group('services')]
|
|
list-failed:
|
|
systemctl list-units -all --state=failed
|
|
|
|
[linux]
|
|
[group('services')]
|
|
list-systemd:
|
|
systemctl list-units systemd-*
|
|
|
|
|
|
# =================================================
|
|
#
|
|
# GitHub CLI + Nixpkgs Review via Github Action
|
|
# https://github.com/ryan4yin/nixpkgs-review-gha
|
|
#
|
|
# =================================================
|
|
|
|
[group('github')]
|
|
gh-login:
|
|
gh auth login -h github.com --skip-ssh-key --git-protocol ssh
|
|
|
|
# Run nixpkgs-review for PR
|
|
[group('nixpkgs')]
|
|
pkg-review pr:
|
|
gh workflow run review.yml --repo ryan4yin/nixpkgs-review-gha -f x86_64-darwin=no -f post-result=true -f pr={{pr}}
|
|
|
|
# Run package tests for PR
|
|
[group('nixpkgs')]
|
|
pkg-test pr pname:
|
|
gh workflow run review.yml --repo ryan4yin/nixpkgs-review-gha -f x86_64-darwin=no -f post-result=true -f pr={{pr}} -f extra-args="-p {{pname}}.passthru.tests"
|
|
|
|
# View the summary of a workflow
|
|
[group('nixpkgs')]
|
|
pkg-summary:
|
|
gh workflow view review.yml --repo ryan4yin/nixpkgs-review-gha
|