nimmo/nixos-config

Watch

Fork 0

feat(nix): offload workload-host builds to nova #245

Merged

nimmo merged 1 commit from feat/issue-235-service-host-builds into main

2026-09-20 08:52:55 +01:00

nimmo commented

2026-09-20 08:47:38 +01:00

Owner

Refs #235

Moves Vega, Lyra, and Chaos to Nova remote-only builds; returns Electra to local builds; adds one-shot local/remote controls to just test and just deploy.

Validation completed locally: nix flake check, Nova policy check, and deploy wrapper/regression suites. Live target just test evidence remains required before merge.

Refs #235 Moves Vega, Lyra, and Chaos to Nova remote-only builds; returns Electra to local builds; adds one-shot `local`/`remote` controls to `just test` and `just deploy`. Validation completed locally: `nix flake check`, Nova policy check, and deploy wrapper/regression suites. Live target `just test` evidence remains required before merge.

nimmo added 1 commit

2026-09-20 08:47:39 +01:00

feat(nix): offload workload-host builds to nova

Build and Push Attic Cache / test (pull_request) Successful in 1m31s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 1m37s

Details

69f61a0aa7

nimmo commented

2026-09-20 08:49:16 +01:00

Author

Owner

Automated code review

Reviewed commit: 69f61a0aa734dfbaecbf373d47bb5e251415b4e7

Verdict: Requires further work

Resolve the blocking or important findings and investigate failed deterministic checks before merging.

Overall assessment

The PR implements a fleet-wide shift to offload builds for Vega, Lyra, and Chaos to the Nova remote builder, while returning Electra to local-only builds. It introduces one-shot local/remote overrides in just test and nixos-deploy.sh, adds SOPS-managed SSH keys for the new hosts, and updates documentation and checks.

Blocking findings

Missing secret file for Lyra remote builder key (hosts/lyra/default.nix:76; high confidence)
The diff shows hosts/lyra/default.nix referencing config.sops.secrets."nix-remote-builder/lyra-private-key".path, but the PR only adds secrets/nix-remote-builders/chaos.json and secrets/nix-remote-builders/vega.json. There is no secrets/nix-remote-builders/lyra.json in the diff.
Impact: Evaluation of the Lyra host will fail because the SOPS secret file does not exist, preventing deployment or testing of this host.
Suggested fix: Add secrets/nix-remote-builders/lyra.json to the repository with the appropriate encrypted key and SOPS configuration.

Important findings

Inconsistent secret file naming in deploy script (scripts/nixos-deploy.sh:115; medium confidence)
The script uses the variable remote_builder_key="${NIXOS_DEPLOY_REMOTE_BUILDER_KEY:-/run/secrets/nix-remote-builder/${current_host}-private-key}". The host-specific secret files are named after the host (e.g., chaos.json, vega.json), but the default path assumes a file named ${current_host}-private-key. If the SOPS decryption produces a file with a different name or if the key is not installed at that specific path, the remote build will fail.
Impact: Remote builds triggered via the deploy script may fail to find the SSH key if the default path does not match the actual secret location or name.
Suggested fix: Verify that SOPS installs the secret exactly at /run/secrets/nix-remote-builder/${current_host}-private-key and matches the expected filename. If the secret file is named differently (e.g., lyra.json), ensure the path in the script or the SOPS configuration aligns.

Suggestions

Justfile build mode argument parsing ambiguity (justfiles/deploy.just:27; medium confidence)
The test recipe parses SPECIALISATION and BUILD_MODE. It checks if SPEC_ARG is 'local' or 'remote' to set MODE. However, the usage comment says just test dgpu remote. If a user runs just test remote, it sets MODE=remote. If they run just test local, it sets MODE=local. This logic seems correct, but the error message "build mode specified more than once" might be confusing if a user accidentally passes a specialisation that matches 'local' or 'remote' (unlikely but possible).
Impact: Low risk of user confusion.
Suggested fix: Consider adding explicit validation or clearer usage examples in the Justfile comments to prevent misuse.

Tests and validation

No configured deterministic checks.

Questions

Where is the secrets/nix-remote-builders/lyra.json file? It is referenced in hosts/lyra/default.nix but not included in the PR diff.
Does the SOPS configuration for Lyra match the pattern used for Vega and Chaos in .sops.yaml?

Review limitations

I cannot verify the content of the encrypted SOPS files or the actual existence of lyra.json outside the provided diff.
I cannot run nix flake check to validate the configuration changes.
I cannot test the just test or nixos-deploy.sh scripts in a live environment.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
README.md: reviewed — included in a context-limited batch
docs/nova-remote-builder.md: reviewed — included in a context-limited batch
flake.nix: reviewed — included in a context-limited batch
hosts/chaos/default.nix: reviewed — included in a context-limited batch
hosts/electra/default.nix: reviewed — included in a context-limited batch
hosts/lyra/default.nix: reviewed — included in a context-limited batch
hosts/vega/default.nix: reviewed — included in a context-limited batch
justfiles/deploy.just: reviewed — included in a context-limited batch
modules/common/nova-remote-builder.nix: reviewed — included in a context-limited batch
packages/nixos-deploy/default.nix: reviewed — included in a context-limited batch
scripts/nixos-deploy.sh: reviewed — included in a context-limited batch
secrets/nix-remote-builders/chaos.json: reviewed — included in a context-limited batch
secrets/nix-remote-builders/vega.json: reviewed — included in a context-limited batch
tests/nixos-deploy-regressions.sh: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, docs/nova-remote-builder.md, README.md
Commits considered: 1
Previous automated review: none found
Findings: 3

## Automated code review Reviewed commit: `69f61a0aa734dfbaecbf373d47bb5e251415b4e7` ## Verdict: Requires further work Resolve the blocking or important findings and investigate failed deterministic checks before merging. ### Overall assessment The PR implements a fleet-wide shift to offload builds for Vega, Lyra, and Chaos to the Nova remote builder, while returning Electra to local-only builds. It introduces one-shot `local`/`remote` overrides in `just test` and `nixos-deploy.sh`, adds SOPS-managed SSH keys for the new hosts, and updates documentation and checks. ### Blocking findings - **Missing secret file for Lyra remote builder key** (hosts/lyra/default.nix:76; high confidence) The diff shows `hosts/lyra/default.nix` referencing `config.sops.secrets."nix-remote-builder/lyra-private-key".path`, but the PR only adds `secrets/nix-remote-builders/chaos.json` and `secrets/nix-remote-builders/vega.json`. There is no `secrets/nix-remote-builders/lyra.json` in the diff. Impact: Evaluation of the Lyra host will fail because the SOPS secret file does not exist, preventing deployment or testing of this host. Suggested fix: Add `secrets/nix-remote-builders/lyra.json` to the repository with the appropriate encrypted key and SOPS configuration. ### Important findings - **Inconsistent secret file naming in deploy script** (scripts/nixos-deploy.sh:115; medium confidence) The script uses the variable `remote_builder_key="${NIXOS_DEPLOY_REMOTE_BUILDER_KEY:-/run/secrets/nix-remote-builder/${current_host}-private-key}"`. The host-specific secret files are named after the host (e.g., `chaos.json`, `vega.json`), but the default path assumes a file named `${current_host}-private-key`. If the SOPS decryption produces a file with a different name or if the key is not installed at that specific path, the remote build will fail. Impact: Remote builds triggered via the deploy script may fail to find the SSH key if the default path does not match the actual secret location or name. Suggested fix: Verify that SOPS installs the secret exactly at `/run/secrets/nix-remote-builder/${current_host}-private-key` and matches the expected filename. If the secret file is named differently (e.g., `lyra.json`), ensure the path in the script or the SOPS configuration aligns. ### Suggestions - **Justfile build mode argument parsing ambiguity** (justfiles/deploy.just:27; medium confidence) The `test` recipe parses `SPECIALISATION` and `BUILD_MODE`. It checks if `SPEC_ARG` is 'local' or 'remote' to set `MODE`. However, the usage comment says `just test dgpu remote`. If a user runs `just test remote`, it sets `MODE=remote`. If they run `just test local`, it sets `MODE=local`. This logic seems correct, but the error message "build mode specified more than once" might be confusing if a user accidentally passes a specialisation that matches 'local' or 'remote' (unlikely but possible). Impact: Low risk of user confusion. Suggested fix: Consider adding explicit validation or clearer usage examples in the Justfile comments to prevent misuse. ### Tests and validation - No configured deterministic checks. ### Questions - Where is the `secrets/nix-remote-builders/lyra.json` file? It is referenced in `hosts/lyra/default.nix` but not included in the PR diff. - Does the SOPS configuration for Lyra match the pattern used for Vega and Chaos in `.sops.yaml`? ### Review limitations - I cannot verify the content of the encrypted SOPS files or the actual existence of `lyra.json` outside the provided diff. - I cannot run `nix flake check` to validate the configuration changes. - I cannot test the `just test` or `nixos-deploy.sh` scripts in a live environment. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `README.md`: **reviewed** — included in a context-limited batch - `docs/nova-remote-builder.md`: **reviewed** — included in a context-limited batch - `flake.nix`: **reviewed** — included in a context-limited batch - `hosts/chaos/default.nix`: **reviewed** — included in a context-limited batch - `hosts/electra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `justfiles/deploy.just`: **reviewed** — included in a context-limited batch - `modules/common/nova-remote-builder.nix`: **reviewed** — included in a context-limited batch - `packages/nixos-deploy/default.nix`: **reviewed** — included in a context-limited batch - `scripts/nixos-deploy.sh`: **reviewed** — included in a context-limited batch - `secrets/nix-remote-builders/chaos.json`: **reviewed** — included in a context-limited batch - `secrets/nix-remote-builders/vega.json`: **reviewed** — included in a context-limited batch - `tests/nixos-deploy-regressions.sh`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, docs/nova-remote-builder.md, README.md - Commits considered: 1 - Previous automated review: none found - Findings: 3 </details>

nimmo commented

2026-09-20 08:51:43 +01:00

Author

Owner

Automated-review follow-up

No code change is required for the reported findings:

secrets/nix-remote-builders/lyra.json already exists on the target branch from #233, and the existing Lyra SOPS creation rule remains in .sops.yaml; it is not newly added by this MR, so it is absent from the diff.
Evaluating the three configured secret paths confirms the deploy/test default convention exactly: /run/secrets/nix-remote-builder/{lyra,vega,chaos}-private-key.
just test accepts only the documented hardware specialisations (battery, igpu, dgpu); none conflict with local or remote. The deploy regression suite covers both override modes.

The deterministic Attic test check and AI-review workflow both succeeded. Local validation also completed nix flake check, the focused Nova policy check, and both deploy regression suites. Live just test evidence remains outstanding before merge.

## Automated-review follow-up No code change is required for the reported findings: - `secrets/nix-remote-builders/lyra.json` already exists on the target branch from #233, and the existing Lyra SOPS creation rule remains in `.sops.yaml`; it is not newly added by this MR, so it is absent from the diff. - Evaluating the three configured secret paths confirms the deploy/test default convention exactly: `/run/secrets/nix-remote-builder/{lyra,vega,chaos}-private-key`. - `just test` accepts only the documented hardware specialisations (`battery`, `igpu`, `dgpu`); none conflict with `local` or `remote`. The deploy regression suite covers both override modes. The deterministic Attic test check and AI-review workflow both succeeded. Local validation also completed `nix flake check`, the focused Nova policy check, and both deploy regression suites. Live `just test` evidence remains outstanding before merge.

nimmo merged commit dc958fbbc5 into main

2026-09-20 08:52:55 +01:00

nimmo deleted branch feat/issue-235-service-host-builds

2026-09-20 08:52:56 +01:00

nimmo referenced this pull request from a commit

2026-09-20 08:52:57 +01:00

Merge pull request 'feat(nix): offload workload-host builds to nova' (#245) from feat/issue-235-service-host-builds into main