nimmo/nixos-config

Watch

Fork 0

05 – Deploy Vega from Electra via Nova #236

New issue

Closed

opened 2026-09-19 20:31:59 +01:00 by nimmo · 1 comment

nimmo commented

2026-09-19 20:31:59 +01:00

Owner

Goal

Prove an end-to-end Electra controller -> Nova builder -> Vega target workflow using Electra’s local source snapshot, without requiring Vega to pull the working tree from Forgejo.

Dependencies

Build-placement implementation: #234 and #235. #235 remains open only for live evidence; its merged configuration may be used for this canary.

Scope boundary

Electra is the current local-build controller and Vega is the first deployment target. Chaos remains in scope for the fleet-wide target generalisation in #237; this issue must not introduce a Vega-only design that prevents that rollout.

Requirements

Explicitly define where evaluation happens, how the exact local source snapshot is captured, how the closure moves from Nova to Vega, and which identity may activate it.
Preserve both modified tracked files and intentionally included untracked files; document the Nix flake/Git source-filtering behaviour rather than assuming “dirty” covers both.
Support explicit target test, boot, and switch semantics. Use just test only for validation in this project; do not switch generations while testing.
Keep Nova unable to deploy to Vega, and keep Vega unable to access controller credentials.
Treat the existing just test-remote target-side-build workflow as a migration input. Do not retire or replace it until the new flow demonstrates equivalent dirty-tree safety and recovery.

Validation

Make a safe, identifiable uncommitted Electra-side Vega change and test it through the new flow without a commit or push. Show evaluation uses the captured source snapshot, a required build occurs on Nova, the closure reaches Vega, and Vega activates it with test. Exercise failure and rollback.

## Goal Prove an end-to-end Electra controller -> Nova builder -> Vega target workflow using Electra’s local source snapshot, without requiring Vega to pull the working tree from Forgejo. ## Dependencies Build-placement implementation: #234 and #235. #235 remains open only for live evidence; its merged configuration may be used for this canary. ## Scope boundary Electra is the current local-build controller and Vega is the first deployment target. Chaos remains in scope for the fleet-wide target generalisation in #237; this issue must not introduce a Vega-only design that prevents that rollout. ## Requirements - Explicitly define where evaluation happens, how the exact local source snapshot is captured, how the closure moves from Nova to Vega, and which identity may activate it. - Preserve both modified tracked files and intentionally included untracked files; document the Nix flake/Git source-filtering behaviour rather than assuming “dirty” covers both. - Support explicit target `test`, `boot`, and `switch` semantics. Use `just test` only for validation in this project; do not switch generations while testing. - Keep Nova unable to deploy to Vega, and keep Vega unable to access controller credentials. - Treat the existing `just test-remote` target-side-build workflow as a migration input. Do not retire or replace it until the new flow demonstrates equivalent dirty-tree safety and recovery. ## Validation Make a safe, identifiable uncommitted Electra-side Vega change and test it through the new flow without a commit or push. Show evaluation uses the captured source snapshot, a required build occurs on Nova, the closure reaches Vega, and Vega activates it with `test`. Exercise failure and rollback.

nimmo added this to the NixOS Build & Deployment Pipeline milestone

2026-09-19 20:32:00 +01:00

nimmo added the

project:nixos-build-deployment-pipeline

service:nix

labels

2026-09-19 21:01:39 +01:00

nimmo referenced this issue

2026-09-19 21:01:58 +01:00

06 – Generalise Remote Deployment Across the NixOS Fleet #237

~~nimmo referenced this issue 2026-09-19 21:02:12 +01:00~~

07 – Harden Build and Deployment Trust Boundaries #238

nimmo referenced this issue

2026-09-19 21:02:24 +01:00

08 – Audit Forgejo Write Access Across Workload Hosts #239

nimmo added reference feat/issue-236-electra-nova-vega

2026-09-20 09:07:26 +01:00

nimmo referenced this issue

2026-09-20 10:47:30 +01:00

feat(nix): add controller-to-target test workflow #246

nimmo commented

2026-09-20 23:21:15 +01:00

Author

Owner

Tested and confirmed working.

Also replaced content of just test-remote with test-controller as the previous command worked well and I was ready to retire it after the new implementation was shown to work.

Tested and confirmed working. Also replaced content of just test-remote with test-controller as the previous command worked well and I was ready to retire it after the new implementation was shown to work.

nimmo closed this issue

2026-09-20 23:21:15 +01:00

nimmo referenced this issue

2026-09-21 17:46:03 +01:00

06 – Generalise Remote Deployment Across the NixOS Fleet #237

nimmo referenced this issue

2026-09-21 17:46:48 +01:00

feat(nix): generalise remote deployment across the fleet (#237) #248