nimmo/nixos-config

Watch

Fork 0

refactor(auto-update): split updater into standalone flake #156

Merged

nimmo merged 2 commits from tidy-auto-update-split-repo into main

2026-08-09 21:52:48 +01:00

nimmo commented

2026-08-09 21:44:12 +01:00

Owner

Summary

consume the new pinned nimmo/nixos-auto-update flake for the updater package, module, and VM state-machine check
remove the duplicate updater implementation from this repository
make the Attic producer source its shared update-policy library from the external package

Validation

nix flake check --accept-flake-config
bash -n scripts/attic-cache-build.sh
Vega just test (user-run)

Remaining live evidence

After merge and deployment to a clean main checkout, run one genuine Vega auto-update followed immediately by a no-op follow-up.

Refs #61

## Summary - consume the new pinned `nimmo/nixos-auto-update` flake for the updater package, module, and VM state-machine check - remove the duplicate updater implementation from this repository - make the Attic producer source its shared update-policy library from the external package ## Validation - `nix flake check --accept-flake-config` - `bash -n scripts/attic-cache-build.sh` - Vega `just test` (user-run) ## Remaining live evidence After merge and deployment to a clean `main` checkout, run one genuine Vega auto-update followed immediately by a no-op follow-up. Refs #61

nimmo added the

host:fleet

phase:packaging

service:auto-update

labels

2026-08-09 21:44:12 +01:00

nimmo added 2 commits

2026-08-09 21:44:12 +01:00

feat(auto-update): adopt standalone flake module c70b92fb44

refactor(auto-update): remove local implementation

Build and Push Attic Cache / test (pull_request) Successful in 1m15s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 6m24s

Details

569d02ef9f

nimmo commented

2026-08-09 21:50:37 +01:00

Author

Owner

Automated code review

Reviewed commit: 569d02ef9fc31db63c77194f0c249cd602a7057d

Verdict: Requires further work

Resolve the blocking or important findings and investigate failed deterministic checks before merging.

Overall assessment

Refactors the NixOS auto-update implementation by removing local scripts, packages, and modules, replacing them with an external nimmo/nixos-auto-update flake input. Updates CI workflows, host configurations, and the common base module to consume the new module and package. Introduces direct configuration of the ntfy SOPS file in the base module and changes script sourcing to rely on the external package's output path.

Blocking findings

Potential evaluation failure due to unknown NixOS option in base.nix (modules/common/base.nix:37; high confidence)
- services.nixos-auto-update.notifications.ntfy.sopsFile = ../../secrets/ntfy.yaml;
  Impact: If the external nimmo/nixos-auto-update flake module does not define the services.nixos-auto-update.notifications.ntfy.sopsFile option, all hosts will fail NixOS evaluation immediately upon deployment.
  Suggested fix: Verify that the pinned external flake exposes this exact option. If it uses a different option name or manages secrets internally, adjust the assignment in modules/common/base.nix accordingly.

Important findings

CI script dependency on external package file path (scripts/attic-cache-build.sh:764; high confidence)
+. "$auto_update_package/share/nixos-auto-update/nixos-update-common.sh"
Impact: The Attic cache workflow will fail if the external flake's nixos-auto-update package does not install nixos-update-common.sh to the exact path /share/nixos-auto-update/nixos-update-common.sh. This breaks the automated lock-update pipeline.
Suggested fix: Confirm the external flake's default.nix or shell.nix installs the shared script to this location. If it uses a different output or path, update the sourcing command in attic-cache-build.sh.

Suggestions

Local regression test suite removal (tests/auto-update-regressions.sh; medium confidence)
Deleted file. Removed from .forgejo/workflows/attic-cache.yml and justfiles/maintenance.just.
Impact: The repository no longer runs the local auto-update regression tests in CI or via just test-auto-update. If these tests were not fully migrated to the external flake's CI, validation coverage for policy enforcement and isolation logic is reduced.
Suggested fix: Ensure the external flake's CI pipeline executes equivalent regression tests. If so, document this dependency in the PR description or README.

Tests and validation

No configured deterministic checks.

Questions

Does the external nimmo/nixos-auto-update flake module define services.nixos-auto-update.notifications.ntfy.sopsFile, or does it expect secrets to be managed differently (e.g., via a dedicated sopsFile option at the top level)?

Review limitations

I do not have access to the source code of the external nimmo/nixos-auto-update flake, so I cannot verify if the expected NixOS options or package output paths are actually defined there.
Review is based solely on the provided diff and PR description; runtime behavior of the detached switch helper and ntfy notifications depends on the external implementation.

Diff coverage

.forgejo/workflows/attic-cache.yml: reviewed — included in a context-limited batch
README.md: reviewed — included in a context-limited batch
flake.lock: reviewed — included in a context-limited batch
flake.nix: reviewed — included in a context-limited batch
hosts/chaos/default.nix: reviewed — included in a context-limited batch
hosts/cosmos/default.nix: reviewed — included in a context-limited batch
hosts/lyra/default.nix: reviewed — included in a context-limited batch
hosts/vega/default.nix: reviewed — included in a context-limited batch
justfiles/maintenance.just: reviewed — included in a context-limited batch
modules/common/base.nix: reviewed — included in a context-limited batch
modules/profiles/gui.nix: reviewed — included in a context-limited batch
modules/services/nixos-auto-update.nix: reviewed — included in a context-limited batch
packages/nixos-auto-update/default.nix: reviewed — included in a context-limited batch
potential/nova/default.nix: reviewed — included in a context-limited batch
scripts/attic-cache-build.sh: reviewed — included in a context-limited batch
scripts/nixos-auto-update-control.sh: reviewed — included in a context-limited batch
scripts/nixos-auto-update.sh: reviewed — included in a context-limited batch
scripts/nixos-update-common.sh: reviewed — included in a context-limited batch
secrets/README.md: reviewed — included in a context-limited batch
tests/auto-update-regressions.sh: reviewed — included in a context-limited batch
tests/nixos-auto-update-vm.nix: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 2
Previous automated review: none found
Findings: 3

## Automated code review Reviewed commit: `569d02ef9fc31db63c77194f0c249cd602a7057d` ## Verdict: Requires further work Resolve the blocking or important findings and investigate failed deterministic checks before merging. ### Overall assessment Refactors the NixOS auto-update implementation by removing local scripts, packages, and modules, replacing them with an external `nimmo/nixos-auto-update` flake input. Updates CI workflows, host configurations, and the common base module to consume the new module and package. Introduces direct configuration of the ntfy SOPS file in the base module and changes script sourcing to rely on the external package's output path. ### Blocking findings - **Potential evaluation failure due to unknown NixOS option in base.nix** (modules/common/base.nix:37; high confidence) + services.nixos-auto-update.notifications.ntfy.sopsFile = ../../secrets/ntfy.yaml; Impact: If the external `nimmo/nixos-auto-update` flake module does not define the `services.nixos-auto-update.notifications.ntfy.sopsFile` option, all hosts will fail NixOS evaluation immediately upon deployment. Suggested fix: Verify that the pinned external flake exposes this exact option. If it uses a different option name or manages secrets internally, adjust the assignment in `modules/common/base.nix` accordingly. ### Important findings - **CI script dependency on external package file path** (scripts/attic-cache-build.sh:764; high confidence) +. "$auto_update_package/share/nixos-auto-update/nixos-update-common.sh" Impact: The Attic cache workflow will fail if the external flake's `nixos-auto-update` package does not install `nixos-update-common.sh` to the exact path `/share/nixos-auto-update/nixos-update-common.sh`. This breaks the automated lock-update pipeline. Suggested fix: Confirm the external flake's `default.nix` or `shell.nix` installs the shared script to this location. If it uses a different output or path, update the sourcing command in `attic-cache-build.sh`. ### Suggestions - **Local regression test suite removal** (tests/auto-update-regressions.sh; medium confidence) Deleted file. Removed from `.forgejo/workflows/attic-cache.yml` and `justfiles/maintenance.just`. Impact: The repository no longer runs the local auto-update regression tests in CI or via `just test-auto-update`. If these tests were not fully migrated to the external flake's CI, validation coverage for policy enforcement and isolation logic is reduced. Suggested fix: Ensure the external flake's CI pipeline executes equivalent regression tests. If so, document this dependency in the PR description or README. ### Tests and validation - No configured deterministic checks. ### Questions - Does the external `nimmo/nixos-auto-update` flake module define `services.nixos-auto-update.notifications.ntfy.sopsFile`, or does it expect secrets to be managed differently (e.g., via a dedicated `sopsFile` option at the top level)? ### Review limitations - I do not have access to the source code of the external `nimmo/nixos-auto-update` flake, so I cannot verify if the expected NixOS options or package output paths are actually defined there. - Review is based solely on the provided diff and PR description; runtime behavior of the detached switch helper and ntfy notifications depends on the external implementation. ### Diff coverage - `.forgejo/workflows/attic-cache.yml`: **reviewed** — included in a context-limited batch - `README.md`: **reviewed** — included in a context-limited batch - `flake.lock`: **reviewed** — included in a context-limited batch - `flake.nix`: **reviewed** — included in a context-limited batch - `hosts/chaos/default.nix`: **reviewed** — included in a context-limited batch - `hosts/cosmos/default.nix`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `justfiles/maintenance.just`: **reviewed** — included in a context-limited batch - `modules/common/base.nix`: **reviewed** — included in a context-limited batch - `modules/profiles/gui.nix`: **reviewed** — included in a context-limited batch - `modules/services/nixos-auto-update.nix`: **reviewed** — included in a context-limited batch - `packages/nixos-auto-update/default.nix`: **reviewed** — included in a context-limited batch - `potential/nova/default.nix`: **reviewed** — included in a context-limited batch - `scripts/attic-cache-build.sh`: **reviewed** — included in a context-limited batch - `scripts/nixos-auto-update-control.sh`: **reviewed** — included in a context-limited batch - `scripts/nixos-auto-update.sh`: **reviewed** — included in a context-limited batch - `scripts/nixos-update-common.sh`: **reviewed** — included in a context-limited batch - `secrets/README.md`: **reviewed** — included in a context-limited batch - `tests/auto-update-regressions.sh`: **reviewed** — included in a context-limited batch - `tests/nixos-auto-update-vm.nix`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 2 - Previous automated review: none found - Findings: 3 </details>

nimmo commented

2026-08-09 21:52:14 +01:00

Author

Owner

Automated-review follow-up

The two important findings are verified against the pinned external flake revision rather than assumed from the diff:

nix flake check --accept-flake-config evaluated every host and ran the re-exported external updater VM state-machine test. That evaluation would fail if services.nixos-auto-update.notifications.ntfy.sopsFile were undefined.
nix eval --raw .#nixosConfigurations.vega.config.services.nixos-auto-update.notifications.ntfy.sopsFile resolves to the SOPS secret file in the store.
nix build --no-link --print-out-paths .#nixos-auto-update exposes the required library at share/nixos-auto-update/nixos-update-common.sh; the new producer source path was checked with test -r.

The external flake’s own CI and re-exported state-machine check replace the deleted in-tree test fixture. The remaining live evidence is still documented in #61: one genuine post-merge Vega update and an immediate no-op follow-up.

## Automated-review follow-up The two important findings are verified against the pinned external flake revision rather than assumed from the diff: - `nix flake check --accept-flake-config` evaluated every host and ran the re-exported external updater VM state-machine test. That evaluation would fail if `services.nixos-auto-update.notifications.ntfy.sopsFile` were undefined. - `nix eval --raw .#nixosConfigurations.vega.config.services.nixos-auto-update.notifications.ntfy.sopsFile` resolves to the SOPS secret file in the store. - `nix build --no-link --print-out-paths .#nixos-auto-update` exposes the required library at `share/nixos-auto-update/nixos-update-common.sh`; the new producer source path was checked with `test -r`. The external flake’s own CI and re-exported state-machine check replace the deleted in-tree test fixture. The remaining live evidence is still documented in #61: one genuine post-merge Vega update and an immediate no-op follow-up.

nimmo merged commit a4a9ad1b9f into main

2026-08-09 21:52:48 +01:00

nimmo deleted branch tidy-auto-update-split-repo

2026-08-09 21:52:48 +01:00

nimmo referenced this pull request from a commit

2026-08-09 21:52:48 +01:00

Merge pull request 'refactor(auto-update): split updater into standalone flake' (#156) from tidy-auto-update-split-repo into main