nimmo/nixos-config
nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 15 Pull requests Wiki Activity Actions

feat(nova): establish restricted remote Nix builder #242

Merged
nimmo merged 4 commits from feat/issue-232-nova-builder into main 2026-09-19 22:08:53 +01:00
Conversation 2 Commits 4 Files changed 2 +196 -6
nimmo commented 2026-09-19 21:42:45 +01:00
Owner
Copy link

Closes #232

Summary

  • Establishes and documents Nova’s Fedora-managed, restricted nix-remote-builder boundary.
  • Records the verified controller/client-to-Nova build protocol, recovery procedure, and later NixOS migration contract.
  • Aligns all Nova Forgejo CI Nix cache settings with the fleet policy, retaining Attic and replacing stale cache entries.

Live validation

  • A disposable, forced-command key built a non-substituted derivation on Nova and copied the output back to Lyra.
  • The disposable key was removed from both hosts after verification.
  • Nova’s system and user Nix configuration now use Attic, cache.nixos-cuda.org, and cache.nixos.org; all three responded to nix store info.
  • Nova now uses the established CI-compatible Nix policy: three jobs, nine cores each, and 32/80 GiB free-space thresholds.

Validation

  • actionlint -ignore 'label "nova" is unknown' .forgejo/workflows/attic-cache.yml
  • git diff --check

Follow-up #233 owns durable per-client SOPS-managed credential distribution.

Closes #232 ## Summary - Establishes and documents Nova’s Fedora-managed, restricted `nix-remote-builder` boundary. - Records the verified controller/client-to-Nova build protocol, recovery procedure, and later NixOS migration contract. - Aligns all Nova Forgejo CI Nix cache settings with the fleet policy, retaining Attic and replacing stale cache entries. ## Live validation - A disposable, forced-command key built a non-substituted derivation on Nova and copied the output back to Lyra. - The disposable key was removed from both hosts after verification. - Nova’s system and user Nix configuration now use Attic, `cache.nixos-cuda.org`, and `cache.nixos.org`; all three responded to `nix store info`. - Nova now uses the established CI-compatible Nix policy: three jobs, nine cores each, and 32/80 GiB free-space thresholds. ## Validation - `actionlint -ignore 'label "nova" is unknown' .forgejo/workflows/attic-cache.yml` - `git diff --check` Follow-up #233 owns durable per-client SOPS-managed credential distribution.
docs(nova): record cache policy verification
All checks were successful
AI pull-request review / review (pull_request) Successful in 1m46s
Details
Build and Push Attic Cache / test (pull_request) Successful in 1m42s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped
Details
Build and Push Attic Cache / remediate (pull_request) Has been skipped
Details
Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped
Details
Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped
Details
e11eee6dce
nimmo commented 2026-09-19 21:44:39 +01:00
Author
Owner
Copy link

Automated code review

Reviewed commit: e5b37fb43d7df15b681ff0280b3155ca7ac0e691

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The pull request updates .forgejo/workflows/attic-cache.yml to replace stale CUDA cache references with the fleet-standard cache.nixos-cuda.org and adds documentation docs/nova-remote-builder.md detailing the bootstrap procedure for a Fedora-based remote builder. The changes are consistent with the stated objective of aligning CI cache settings and documenting operational boundaries.

Blocking findings

None.

Important findings

None.

Suggestions

None.

Tests and validation

  • No configured deterministic checks.

Questions

  • The documentation mentions that the durable fleet runbook belongs in the repository wiki once exercised. Is there an existing process or ticket to migrate this content to the wiki, or is this file intended to remain the source of truth for now?

Review limitations

  • Review is limited to the provided diff and human replies; live validation of the Fedora host configuration was not performed.
  • The SSHD configuration path is inferred from standard Fedora practices but not explicitly confirmed in the diff.

Diff coverage

  • .forgejo/workflows/attic-cache.yml: reviewed — included in a context-limited batch
  • docs/nova-remote-builder.md: reviewed — included in a context-limited batch
Review metadata
  • Reviewer: forgejo-ai-review v1
  • Model: qwen3.6:35b-a3b-q8_0
  • Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, docs/nova-remote-builder.md, README.md
  • Commits considered: 4
  • Previous automated review: updated
  • Findings: 0
<!-- forgejo-ai-review:v1 --> ## Automated code review Reviewed commit: `e5b37fb43d7df15b681ff0280b3155ca7ac0e691` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The pull request updates `.forgejo/workflows/attic-cache.yml` to replace stale CUDA cache references with the fleet-standard `cache.nixos-cuda.org` and adds documentation `docs/nova-remote-builder.md` detailing the bootstrap procedure for a Fedora-based remote builder. The changes are consistent with the stated objective of aligning CI cache settings and documenting operational boundaries. ### Blocking findings None. ### Important findings None. ### Suggestions None. ### Tests and validation - No configured deterministic checks. ### Questions - The documentation mentions that the durable fleet runbook belongs in the repository wiki once exercised. Is there an existing process or ticket to migrate this content to the wiki, or is this file intended to remain the source of truth for now? ### Review limitations - Review is limited to the provided diff and human replies; live validation of the Fedora host configuration was not performed. - The SSHD configuration path is inferred from standard Fedora practices but not explicitly confirmed in the diff. ### Diff coverage - `.forgejo/workflows/attic-cache.yml`: **reviewed** — included in a context-limited batch - `docs/nova-remote-builder.md`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, docs/nova-remote-builder.md, README.md - Commits considered: 4 - Previous automated review: updated - Findings: 0 </details>
nimmo force-pushed feat/issue-232-nova-builder from e11eee6dce
All checks were successful
AI pull-request review / review (pull_request) Successful in 1m46s
Details
Build and Push Attic Cache / test (pull_request) Successful in 1m42s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped
Details
Build and Push Attic Cache / remediate (pull_request) Has been skipped
Details
Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped
Details
Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped
Details
to e5b37fb43d
All checks were successful
AI pull-request review / review (pull_request) Successful in 1m33s
Details
Build and Push Attic Cache / test (pull_request) Successful in 1m36s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped
Details
Build and Push Attic Cache / remediate (pull_request) Has been skipped
Details
Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped
Details
Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped
Details
2026-09-19 22:00:52 +01:00 Compare
nimmo commented 2026-09-19 22:01:10 +01:00
Author
Owner
Copy link

Addressed the review suggestions in e5b37fb. docs/nova-remote-builder.md now explicitly identifies Nova’s live Fedora configuration as manual operational state; potential/nova/ is intentionally not treated as deployed configuration, and the future NixOS migration must move the proven policy when Nova is registered. Nova now has an SSHD Match User nix-remote-builder guardrail in addition to key-level restrictions. sshd -t passed, the daemon was reloaded, and sshd -T -C confirmed public-key-only authentication, disabled password/keyboard-interactive login, TTY, tunnelling, and agent/TCP/X11 forwarding, plus the forced nix-store --serve --write command. Repository-wide search found no remaining stale cache references outside the documented historical finding. The branch was force-with-lease updated only because rebasing onto current main rewrote its own previously published commits.

Addressed the review suggestions in e5b37fb. `docs/nova-remote-builder.md` now explicitly identifies Nova’s live Fedora configuration as manual operational state; `potential/nova/` is intentionally not treated as deployed configuration, and the future NixOS migration must move the proven policy when Nova is registered. Nova now has an SSHD `Match User nix-remote-builder` guardrail in addition to key-level restrictions. `sshd -t` passed, the daemon was reloaded, and `sshd -T -C` confirmed public-key-only authentication, disabled password/keyboard-interactive login, TTY, tunnelling, and agent/TCP/X11 forwarding, plus the forced `nix-store --serve --write` command. Repository-wide search found no remaining stale cache references outside the documented historical finding. The branch was force-with-lease updated only because rebasing onto current main rewrote its own previously published commits.
nimmo merged commit 5ba3de88de into main 2026-09-19 22:08:52 +01:00
nimmo deleted branch feat/issue-232-nova-builder 2026-09-19 22:09:02 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area:authentication
Issues related to authentication area

  
area:flake-utilities
Issues related to flake utilities area

  
area:performance
Issues related to performance area

  
area:tbd
Area to be determined

  
host:chaos
Issues specific to the chaos host.

  
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:nova
Issues specific to the nova host.

  
host:vega
Issues specific to the vega host.

  
investigation
Issue is an investigation task

  
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
priority:high
High priority issue

  
priority:medium
Medium priority issue

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:auto-update-remediation
Guarded Nova-assisted diagnosis and remediation of failed automated updates.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:fleet-boundary-cleanup
Maintainability work that clarifies fleet configuration and automation boundaries.

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:nixos-build-deployment-pipeline
Issues in the NixOS Build & Deployment Pipeline workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
project:wiki-rebuild
Re-found the repository wiki as the fleet's curated knowledge architecture.

  
repo:numtide/flake-utils
Issues related to numtide/flake-utils repository

  
repo:numtide/nix-auth
Issues related to numtide/nix-auth repository

  
repo:numtide/nixos-passthru-cache
Issues related to numtide/nixos-passthru-cache repository

  
repo:numtide/nix-relay
Issues related to numtide/nix-relay repository

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:nix
Issues concerning Nix build, store, cache, or deployment infrastructure.

  
service:sillytavern
Issues related to the SillyTavern service.

  
service:slskd
Soulseek daemon (slskd) work.

  
service:synthseek
Synthseek music discovery/library manager work.

No labels
area:authentication
area:flake-utilities
area:performance
area:tbd
host:chaos
host:electra
host:fleet
host:lyra
host:nova
host:vega
investigation
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
priority:high
priority:medium
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:auto-update-remediation
project:declarative-purity-cleanup
project:external-review
project:fleet-boundary-cleanup
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:nixos-build-deployment-pipeline
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
project:wiki-rebuild
repo:numtide/flake-utils
repo:numtide/nix-auth
repo:numtide/nixos-passthru-cache
repo:numtide/nix-relay
service:auto-update
service:mem0
service:nix
service:sillytavern
service:slskd
service:synthseek
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config!242
No description provided.