rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drop lantian attic cache (compromised)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-19 09:36:50 +01:00
parent 8dab56de4f
commit 89c0205fe2
3 changed files with 10 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
common.nix
View file

@ -69,13 +69,13 @@ let
# always evaluates on the machine it runs on (--build-host ships the
# derivation, not the expression), so the only way to move eval off a client
# is to run nix on the server over SSH and hand the resulting closure to
# --store-path, which skips eval and build entirely. Same lantian substituter
# as services/prebuild.nix, and --out-link keeps a gc root on the server so
# `clean` there can't reap the closure mid-copy. SSH and the copy run as
# --store-path, which skips eval and build entirely. --out-link keeps a gc
# root on the server so `clean` there can't reap the closure mid-copy.
# SSH and the copy run as
# fred, not root: root has no key on the server, and require-sigs = false
# below is a daemon setting, so the daemon takes the unsigned closure from an
# untrusted user just fine. Only the activation needs sudo.
remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW --log-format internal-json 2>&1 | ${copyBar}/bin/nix-copy-bar && sudo nixos-rebuild switch --no-reexec --store-path $NEW && ${post}'";
remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW --log-format internal-json 2>&1 | ${copyBar}/bin/nix-copy-bar && sudo nixos-rebuild switch --no-reexec --store-path $NEW && ${post}'";
in
{
imports = [