rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

4
services/wan-watchdog.nix
View file

@ -21,6 +21,10 @@ let
# as "up". Two anycast targets so one being down isn't a false alarm.
watchdog = pkgs.writeShellScript "wan-watchdog" ''
set -uo pipefail
# Hold this for the whole check/recovery operation. Never restart the
# network or flush conntrack during activation, verification or rollback.
exec 9>/run/lock/fred-deploy.lock
${pkgs.util-linux}/bin/flock -n 9 || exit 0
wan=eno1
state=/var/lib/wan-watchdog
ipfile=$state/wan-ip