rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update: run remote eval/copy as fred, root has no key on the server

Browse source
This commit is contained in:
rope 2026-08-13 11:53:52 +01:00
parent dafd23d159
commit 25dc85eeb8
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
common.nix
View file

@ -23,8 +23,11 @@ let
# is to run nix on the server over SSH and hand the resulting closure to
# --store-path, which skips eval and build entirely. Same lantian substituter
# as services/prebuild.nix, and --out-link keeps a gc root on the server so
# `clean` there can't reap the closure mid-copy.
remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(sudo ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && sudo nix copy --from ssh://fred@nordhammer.it $NEW && sudo nixos-rebuild switch --store-path $NEW && ${post}'";
# `clean` there can't reap the closure mid-copy. SSH and the copy run as
# fred, not root: root has no key on the server, and require-sigs = false
# below is a daemon setting, so the daemon takes the unsigned closure from an
# untrusted user just fine. Only the activation needs sudo.
remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW && sudo nixos-rebuild switch --store-path $NEW && ${post}'";
in
{
imports = [