flake.nix: Add deploy-rs for deployment management

configuration/default.nix

@@ -1,9 +1,13 @@
 {
   pkgs,
   lib,
+  modulesPath,
   ...
 }: {
   imports = [
+    "${modulesPath}/profiles/headless.nix"
+    (import ../modules)
+
     ./services/gitea.nix
     ./services/nextcloud.nix
     ./services/webserver.nix
@@ -12,6 +16,14 @@
     ./sops.nix
   ];
 
+  nixpkgs.overlays = [
+    (final: prev: {
+      local = import ../pkgs {
+        pkgs = prev;
+      };
+    })
+  ];
+
   nix = {
     package = pkgs.nixFlakes;
     extraOptions = ''
@@ -23,7 +35,7 @@
   };
 
   nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) ["steam-runtime" "steamcmd"];
+    builtins.elem (lib.getName pkg) ["steam-original" "steam-runtime" "steamcmd"];
 
   # Optimization for minecraft servers, see:
   # https://bugs.mojang.com/browse/MC-183518

configuration/hardware-specific/vm.nix

@@ -0,0 +1,17 @@
+{lib, ...}: {
+  users.users.tlater.password = "insecure";
+
+  # Disable graphical tty so -curses works
+  boot.kernelParams = ["nomodeset"];
+
+  # Sets the base domain for nginx to localhost so that we
+  # can easily test locally with the VM.
+  services.nginx.domain = lib.mkOverride 99 "localhost";
+
+  # Use the staging secrets
+  sops.defaultSopsFile = lib.mkOverride 99 ../../keys/staging.yaml;
+
+  # # Set up VM settings to match real VPS
+  # virtualisation.memorySize = 3941;
+  # virtualisation.cores = 2;
+}

configuration/services/nextcloud.nix

@@ -4,7 +4,7 @@
   ...
 }: let
   inherit (pkgs) fetchNextcloudApp;
-  nextcloud = pkgs.nextcloud23;
+  nextcloud = pkgs.nextcloud24;
   hostName = "nextcloud.${config.services.nginx.domain}";
 in {
   services.nextcloud = {

flake.lock

@@ -40,6 +40,26 @@
         "type": "github"
       }
     },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs",
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1659725433,
+        "narHash": "sha256-1ZxuK67TL29YLw88vQ18Y2Y6iYg8Jb7I6/HVzmNB6nM=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "41f15759dd8b638e7b4f299730d94d5aa46ab7eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
     "devshell": {
       "flake": false,
       "locked": {
@@ -64,7 +84,7 @@
         "flake-utils-pre-commit": "flake-utils-pre-commit",
         "gomod2nix": "gomod2nix",
         "mach-nix": "mach-nix",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "poetry2nix": "poetry2nix",
         "pre-commit-hooks": "pre-commit-hooks"
       },
@@ -128,6 +148,22 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1648199409,
+        "narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils-pre-commit": {
       "locked": {
         "lastModified": 1644229661,
@@ -190,34 +226,18 @@
         "type": "indirect"
       }
     },
-    "nixos-hardware": {
-      "locked": {
-        "lastModified": 1665321371,
-        "narHash": "sha256-0SO6MTW0bX6lxZmz1AZW/Xmk+hnTd7/hp1vF7Tp7jg0=",
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "rev": "236ba4df714131059945d7754c0aa3fbe9d2f74c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "master",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1665466769,
-        "narHash": "sha256-L+qcHpb4Ac3PipMXJY/Ktbu1+KXy23WCZ8pXWmsf7zY=",
-        "owner": "nixos",
+        "lastModified": 1648219316,
+        "narHash": "sha256-Ctij+dOi0ZZIfX5eMhgwugfvB+WZSrvVNAyAuANOsnQ=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0b20bf89e0035b6d62ad58f9db8fdbc99c2b01e8",
+        "rev": "30d3d79b7d3607d56546dd2a6b49e156ba0ec634",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-22.05",
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -239,6 +259,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1665466769,
+        "narHash": "sha256-L+qcHpb4Ac3PipMXJY/Ktbu1+KXy23WCZ8pXWmsf7zY=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0b20bf89e0035b6d62ad58f9db8fdbc99c2b01e8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-22.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1657638268,
         "narHash": "sha256-blBNtQSslAFkg0Gym9fWNJk+bPxGSZib4SOcPrmTPi4=",
@@ -299,8 +335,8 @@
     },
     "root": {
       "inputs": {
-        "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "deploy-rs": "deploy-rs",
+        "nixpkgs": "nixpkgs_2",
         "sops-nix": "sops-nix",
         "tlaternet-webserver": "tlaternet-webserver"
       }
@@ -381,6 +417,21 @@
         "type": "git",
         "url": "https://gitea.tlater.net/tlaternet/tlaternet.git"
       }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1648297722,
+        "narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,12 +3,11 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-22.05";
-    nixos-hardware.url = "github:nixos/nixos-hardware/master";
+    deploy-rs.url = "github:serokell/deploy-rs";
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
     tlaternet-webserver = {
       url = "git+https://gitea.tlater.net/tlaternet/tlaternet.git";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -18,118 +17,119 @@
   outputs = {
     self,
     nixpkgs,
-    nixos-hardware,
     sops-nix,
+    deploy-rs,
     tlaternet-webserver,
   }: let
     system = "x86_64-linux";
-
-    overlays = [
-      (final: prev: {
-        local = import ./pkgs {
-          pkgs = prev;
-        };
-      })
-    ];
-
-    pkgs = import nixpkgs {inherit system overlays;};
-    sops-pkgs = sops-nix.packages.${system};
   in {
-    nixosConfigurations = {
-      tlaternet = nixpkgs.lib.nixosSystem {
-        inherit system;
-
-        modules = [
-          ({modulesPath, ...}: {
-            imports = [(modulesPath + "/profiles/headless.nix")];
-            nixpkgs.overlays = overlays;
-          })
-          (import ./modules)
-
-          (import ./configuration)
-          (import ./configuration/linode.nix)
-          (import ./configuration/hardware-configuration.nix)
+    ##################
+    # Configurations #
+    ##################
+    nixosConfigurations = let
+      # Modules that should be generic to all systems
+      genericModule = {...}: {
+        imports = [
+          # Inject flake dependencies
           sops-nix.nixosModules.sops
           tlaternet-webserver.nixosModules.default
+
+          # Import actual configuration
+          (import ./configuration)
+        ];
+      };
+    in {
+      # The actual system definition
+      tlaternet = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          genericModule
+          (import ./configuration/hardware-specific/linode)
         ];
       };
 
+      # A qemu VM to test the above with
       vm = nixpkgs.lib.nixosSystem {
         inherit system;
-
         modules = [
-          ({modulesPath, ...}: {
-            imports = [(modulesPath + "/profiles/headless.nix")];
-            nixpkgs.overlays = overlays;
-          })
-          (import ./modules)
-
-          (import ./configuration)
-          sops-nix.nixosModules.sops
-          tlaternet-webserver.nixosModules.default
-          ({lib, ...}: {
-            users.users.tlater.password = "insecure";
-
-            # Disable graphical tty so -curses works
-            boot.kernelParams = ["nomodeset"];
-
-            # Sets the base domain for nginx to localhost so that we
-            # can easily test locally with the VM.
-            services.nginx.domain = lib.mkOverride 99 "localhost";
-
-            # Use the staging secrets
-            sops.defaultSopsFile = lib.mkOverride 99 ./keys/staging.yaml;
-
-            # # Set up VM settings to match real VPS
-            # virtualisation.memorySize = 3941;
-            # virtualisation.cores = 2;
-          })
+          genericModule
+          (import ./configuration/hardware-specific/vm.nix)
         ];
       };
     };
 
+    ############################
+    # Deployment configuration #
+    ############################
+    deploy.nodes.tlaternet = {
+      hostname = "tlater.net";
+
+      profiles.system = {
+        user = "root";
+        path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.tlaternet;
+      };
+
+      sshUser = "tlater";
+      sshOpts = ["-p" "2222"];
+      fastConnection = true;
+    };
+
+    #########
+    # Tests #
+    #########
+    checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+
+    ####################
+    # Helper functions #
+    ####################
+    lib = import ./lib {lib = nixpkgs.lib;};
+
+    ####################
+    # VM launch script #
+    ####################
     apps.${system}.default = let
       inherit (self.nixosConfigurations.vm.config.system.build) vm;
       inherit (nixpkgs.legacyPackages.${system}) writeShellScript;
-      inherit (nixpkgs.lib.attrsets) mapAttrsToList;
-      inherit (nixpkgs.lib.strings) concatStringsSep;
-      ports = {
+      qemuNetOpts = self.lib.makeQemuNetOpts {
         "2222" = "2222";
         "3080" = "80";
         "3443" = "443";
-        "2221" = "2221";
         "21025" = "21025"; # Starbound
       };
-      QEMU_NET_OPTS =
-        concatStringsSep ","
-        (mapAttrsToList
-          (host: vm: "hostfwd=::${host}-:${vm}")
-          ports);
     in {
       type = "app";
       program = builtins.toString (writeShellScript "run-vm" ''
-        export QEMU_OPTS="-m 3941 -smp 2 -curses"
-        export QEMU_NET_OPTS="${QEMU_NET_OPTS}"
+        export QEMU_OPTS="-m 3941 -smp 2 -display curses"
+        export QEMU_NET_OPTS="${qemuNetOpts}"
         "${vm}/bin/run-tlaternet-vm"
       '');
     };
 
-    devShells.${system}.default = pkgs.mkShell {
-      sopsPGPKeyDirs = ["./keys/hosts/" "./keys/users/"];
-      nativeBuildInputs = [
-        sops-pkgs.sops-import-keys-hook
-      ];
-      buildInputs = with pkgs; [
-        nixfmt
-        git-lfs
-        sops-pkgs.sops-init-gpg-key
-      ];
+    ###########################
+    # Development environment #
+    ###########################
+    devShells.${system}.default = let
+      inherit (sops-nix.packages.${system}) sops-import-keys-hook sops-init-gpg-key;
+      deploy-rs-bin = deploy-rs.packages.${system}.default;
+      pkgs = nixpkgs.legacyPackages.${system};
+    in
+      nixpkgs.legacyPackages.${system}.mkShell {
+        sopsPGPKeyDirs = ["./keys/hosts/" "./keys/users/"];
+        nativeBuildInputs = [
+          sops-import-keys-hook
+        ];
+        packages = with pkgs; [
+          nixfmt
+          git-lfs
+          sops-init-gpg-key
+          deploy-rs-bin
+        ];
 
-      shellHook = ''
-        # Work around sudo requiring a full terminal when deploying to
-        # a remote host
-        export NIX_SSHOPTS="-t"
-      '';
-    };
+        shellHook = ''
+          # Work around sudo requiring a full terminal when deploying to
+          # a remote host
+          export NIX_SSHOPTS="-t"
+        '';
+      };
   };
 }

lib/default.nix

@@ -0,0 +1,10 @@
+{lib}: let
+  inherit (lib.attrsets) mapAttrsToList;
+  inherit (lib.strings) concatStringsSep;
+in {
+  makeQemuNetOpts = portMapping:
+    concatStringsSep ","
+    (mapAttrsToList
+      (host: vm: "hostfwd=::${host}-:${vm}")
+      portMapping);
+}

pkgs/default.nix

@@ -1,5 +1,5 @@
 {pkgs, ...}: let
-  inherit (pkgs.lib) callPackage;
+  inherit (pkgs) callPackage;
 in {
   starbound = callPackage ./starbound {};
 }