nimmo/nixos-config
nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 15 Pull requests Wiki Activity Actions

Publish auto-update package and NixOS module as a standalone flake #61

New issue
Closed
opened 2026-07-16 13:52:22 +01:00 by nimmo · 5 comments
nimmo commented 2026-07-16 13:52:22 +01:00
Owner
Copy link

Context

After the updater has a stable package/module boundary inside this repository, it may be valuable to publish it as a standalone Forgejo repository and flake. That would isolate its release cycle, make the implementation independently testable, and allow other NixOS configurations to consume it without copying scripts.

This work depends on #60. It must not begin until the in-repository extraction has been deployed and proven through a genuine update plus a no-op follow-up.

Scope

  • Create a dedicated Forgejo repository for the updater.
  • Export:
    • the updater package and both commands
    • a NixOS module
    • package checks and hermetic regression tests
    • formatter and development tooling where useful
  • Define a stable module API for host policy, repository location/owner, scheduling, switch execution, and notification integration.
  • Keep secrets external: accept file paths or module-provided values without owning this repository's SOPS layout.
  • Document runtime-state ownership, locking, failure stamps, detached helper units, recovery, and rollback.
  • Add standalone Forgejo CI for linting, evaluation, package builds, and regression tests.
  • Add the external flake as a pinned input to nixos-config and migrate the local module configuration.
  • Establish an update/release policy so automated flake updates cannot silently introduce incompatible updater behaviour.
  • Retain a simple rollback path to the last in-repository implementation during the initial adoption window.

Completion criteria

  • #60 is closed with live deployment evidence.
  • The standalone repository builds and tests without access to nixos-config secrets or host files.
  • Package and NixOS module outputs have documented interfaces.
  • CI blocks releases that fail lint, evaluation, or state-machine regressions.
  • nixos-config consumes an explicitly pinned revision.
  • Existing command names, runtime paths, service/timer names, hold behaviour, and notifications remain compatible or have a documented migration.
  • Electra, Vega, and Lyra evaluate and deploy using the external input.
  • A genuine update and immediate no-op follow-up succeed on the external package.
  • Rollback to the in-repository package has been tested or documented.
  • Repository ownership, maintenance expectations, and release/versioning policy are documented.

Dependency

Blocked by #60.

## Context After the updater has a stable package/module boundary inside this repository, it may be valuable to publish it as a standalone Forgejo repository and flake. That would isolate its release cycle, make the implementation independently testable, and allow other NixOS configurations to consume it without copying scripts. This work depends on #60. It must not begin until the in-repository extraction has been deployed and proven through a genuine update plus a no-op follow-up. ## Scope - Create a dedicated Forgejo repository for the updater. - Export: - the updater package and both commands - a NixOS module - package checks and hermetic regression tests - formatter and development tooling where useful - Define a stable module API for host policy, repository location/owner, scheduling, switch execution, and notification integration. - Keep secrets external: accept file paths or module-provided values without owning this repository's SOPS layout. - Document runtime-state ownership, locking, failure stamps, detached helper units, recovery, and rollback. - Add standalone Forgejo CI for linting, evaluation, package builds, and regression tests. - Add the external flake as a pinned input to `nixos-config` and migrate the local module configuration. - Establish an update/release policy so automated flake updates cannot silently introduce incompatible updater behaviour. - Retain a simple rollback path to the last in-repository implementation during the initial adoption window. ## Completion criteria - [ ] #60 is closed with live deployment evidence. - [ ] The standalone repository builds and tests without access to `nixos-config` secrets or host files. - [ ] Package and NixOS module outputs have documented interfaces. - [ ] CI blocks releases that fail lint, evaluation, or state-machine regressions. - [ ] `nixos-config` consumes an explicitly pinned revision. - [ ] Existing command names, runtime paths, service/timer names, hold behaviour, and notifications remain compatible or have a documented migration. - [ ] Electra, Vega, and Lyra evaluate and deploy using the external input. - [ ] A genuine update and immediate no-op follow-up succeed on the external package. - [ ] Rollback to the in-repository package has been tested or documented. - [ ] Repository ownership, maintenance expectations, and release/versioning policy are documented. ## Dependency Blocked by #60.
nimmo closed this issue 2026-07-20 15:24:54 +01:00
nimmo reopened this issue 2026-08-09 21:16:59 +01:00
nimmo commented 2026-08-09 21:17:50 +01:00
Author
Owner
Copy link

Reopened to resume the standalone flake extraction. Initial repository creation is blocked because the configured Forgejo token lacks the write:organization scope required to create nimmo/nixos-auto-update. Once a suitably scoped token/login is available, the first implementation step is to create that repository and migrate the already-extracted package, thin module, tests, docs, and CI before wiring it into this flake as a pinned input.

Reopened to resume the standalone flake extraction. Initial repository creation is blocked because the configured Forgejo token lacks the write:organization scope required to create nimmo/nixos-auto-update. Once a suitably scoped token/login is available, the first implementation step is to create that repository and migrate the already-extracted package, thin module, tests, docs, and CI before wiring it into this flake as a pinned input.
nimmo commented 2026-08-09 21:27:54 +01:00
Author
Owner
Copy link

Repository created: https://git.nimmog.uk/nimmo/nixos-auto-update. The initial standalone flake and its caller-owned secret-path module are published at 19b4d60; both standalone flake checks (including the VM state-machine test) passed. nixos-config now consumes that pinned revision on local branch tidy-auto-update-split-repo at c70b92f; nix flake check --no-build --accept-flake-config passed for Electra, Lena, Vega, Lyra, Cosmos, and Chaos. The configuration commit has not been pushed or deployed yet.

Repository created: https://git.nimmog.uk/nimmo/nixos-auto-update. The initial standalone flake and its caller-owned secret-path module are published at 19b4d60; both standalone flake checks (including the VM state-machine test) passed. `nixos-config` now consumes that pinned revision on local branch `tidy-auto-update-split-repo` at c70b92f; `nix flake check --no-build --accept-flake-config` passed for Electra, Lena, Vega, Lyra, Cosmos, and Chaos. The configuration commit has not been pushed or deployed yet.
nimmo commented 2026-08-09 21:37:47 +01:00
Author
Owner
Copy link

Follow-up local commit ae33ec9 removes the duplicate updater package, module, scripts, VM fixture, and local regression fixture from nixos-config. The Attic producer now resolves its shared update-policy library from the pinned external package (currently nixos-auto-update 3a63eda), and the local flake re-exports the external package/check. nix flake check --no-build --accept-flake-config and bash -n scripts/attic-cache-build.sh pass. The branch remains local and unpushed.

Follow-up local commit ae33ec9 removes the duplicate updater package, module, scripts, VM fixture, and local regression fixture from `nixos-config`. The Attic producer now resolves its shared update-policy library from the pinned external package (currently `nixos-auto-update` 3a63eda), and the local flake re-exports the external package/check. `nix flake check --no-build --accept-flake-config` and `bash -n scripts/attic-cache-build.sh` pass. The branch remains local and unpushed.
nimmo commented 2026-08-09 22:24:14 +01:00
Author
Owner
Copy link

Post-merge fleet validation

The pinned external updater is now deployed and its scheduled consumer runs have been observed:

  • Vega: successful no-op at 22:00:26 BST; deployed revision a4a9ad1.
  • Electra: successful no-op at 22:11:26 BST; deployed revision a4a9ad1.
  • Lyra: successful build and detached-switch handoff at 22:12:38 BST; running revision a4a9ad1.
  • Cosmos: successful build and detached-switch handoff at 22:05:06 BST; running revision a4a9ad1.
  • Chaos: successful build and detached-switch handoff at 22:10:17 BST; running revision a4a9ad1.

Lena did not respond over Nebula during verification, likely asleep/offline, so it remains unverified.

## Post-merge fleet validation The pinned external updater is now deployed and its scheduled consumer runs have been observed: - Vega: successful no-op at 22:00:26 BST; deployed revision `a4a9ad1`. - Electra: successful no-op at 22:11:26 BST; deployed revision `a4a9ad1`. - Lyra: successful build and detached-switch handoff at 22:12:38 BST; running revision `a4a9ad1`. - Cosmos: successful build and detached-switch handoff at 22:05:06 BST; running revision `a4a9ad1`. - Chaos: successful build and detached-switch handoff at 22:10:17 BST; running revision `a4a9ad1`. Lena did not respond over Nebula during verification, likely asleep/offline, so it remains unverified.
nimmo commented 2026-08-09 22:30:47 +01:00
Author
Owner
Copy link

Lena is intentionally out of scope for closure because it is rarely online. The required external-updater deployment and scheduled-run evidence is complete for Vega, Electra, and Lyra; the observed Cosmos and Chaos runs provide additional coverage.

Lena is intentionally out of scope for closure because it is rarely online. The required external-updater deployment and scheduled-run evidence is complete for Vega, Electra, and Lyra; the observed Cosmos and Chaos runs provide additional coverage.
nimmo closed this issue 2026-08-09 22:30:47 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/issue-236-electra-nova-vega
feat/issue-233-nova-builder-credentials
docs/wiki-final-cutover
fix/remediation-evaluation-evidence
fix/remediation-evidence-review
fix/chaos-synthseek-queue
pre-electra-disko-migration
Labels
Clear labels   
area:authentication
Issues related to authentication area

  
area:flake-utilities
Issues related to flake utilities area

  
area:performance
Issues related to performance area

  
area:tbd
Area to be determined

  
host:chaos
Issues specific to the chaos host.

  
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:nova
Issues specific to the nova host.

  
host:vega
Issues specific to the vega host.

  
investigation
Issue is an investigation task

  
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
priority:high
High priority issue

  
priority:medium
Medium priority issue

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:auto-update-remediation
Guarded Nova-assisted diagnosis and remediation of failed automated updates.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:fleet-boundary-cleanup
Maintainability work that clarifies fleet configuration and automation boundaries.

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:nixos-build-deployment-pipeline
Issues in the NixOS Build & Deployment Pipeline workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
project:wiki-rebuild
Re-found the repository wiki as the fleet's curated knowledge architecture.

  
repo:numtide/flake-utils
Issues related to numtide/flake-utils repository

  
repo:numtide/nix-auth
Issues related to numtide/nix-auth repository

  
repo:numtide/nixos-passthru-cache
Issues related to numtide/nixos-passthru-cache repository

  
repo:numtide/nix-relay
Issues related to numtide/nix-relay repository

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:nix
Issues concerning Nix build, store, cache, or deployment infrastructure.

  
service:sillytavern
Issues related to the SillyTavern service.

  
service:slskd
Soulseek daemon (slskd) work.

  
service:synthseek
Synthseek music discovery/library manager work.

No labels
area:authentication
area:flake-utilities
area:performance
area:tbd
host:chaos
host:electra
host:fleet
host:lyra
host:nova
host:vega
investigation
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
priority:high
priority:medium
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:auto-update-remediation
project:declarative-purity-cleanup
project:external-review
project:fleet-boundary-cleanup
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:nixos-build-deployment-pipeline
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
project:wiki-rebuild
repo:numtide/flake-utils
repo:numtide/nix-auth
repo:numtide/nixos-passthru-cache
repo:numtide/nix-relay
service:auto-update
service:mem0
service:nix
service:sillytavern
service:slskd
service:synthseek
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config#61
No description provided.