nimmo/redview
Watch
1
0
Fork
You've already forked redview
 0
Code Issues Pull requests Packages Activity Actions

feat: add Nix flake deployment packaging #4

Closed
nimmo wants to merge 1 commit from feat/nix-flake-deployment into main
pull from: feat/nix-flake-deployment
merge into: nimmo:main
Conversation 1 Commits 1 Files changed 4 +246
nimmo commented 2026-07-25 23:44:02 +01:00
Owner
Copy link

Summary\n\nAdds a reusable NixOS module for deploying Redview as an OCI container.\n\n## Accelerator support\n\n- CPU selects the cpu-latest image\n- AMD selects the amd-latest image and exposes /dev/kfd and /dev/dri\n- NVIDIA selects the nvidia-latest image and enables --gpus=all\n\nThe module also supports persistent data/media/BDFR storage, environment files, custom images, and extra volumes/options.\n\n## Validation\n\n- nix flake check\n- Full NixOS evaluation for CPU, AMD, and NVIDIA modes\n- npm test unavailable in the build environment because Node/npm are not installed

## Summary\n\nAdds a reusable NixOS module for deploying Redview as an OCI container.\n\n## Accelerator support\n\n- CPU selects the cpu-latest image\n- AMD selects the amd-latest image and exposes /dev/kfd and /dev/dri\n- NVIDIA selects the nvidia-latest image and enables --gpus=all\n\nThe module also supports persistent data/media/BDFR storage, environment files, custom images, and extra volumes/options.\n\n## Validation\n\n- nix flake check\n- Full NixOS evaluation for CPU, AMD, and NVIDIA modes\n- npm test unavailable in the build environment because Node/npm are not installed
feat: add Nix flake deployment packaging
All checks were successful
AI pull-request review / review (pull_request) Successful in 6m43s
Details
4a50a4cc70
nimmo closed this pull request 2026-07-25 23:45:09 +01:00
nimmo commented 2026-07-25 23:50:13 +01:00
Author
Owner
Copy link

Automated code review

Reviewed commit: 4a50a4cc707e699d3e2778b039db2bb418d40c9c

Verdict: Requires further work

Resolve the blocking or important findings and investigate failed deterministic checks before merging.

Overall assessment

Introduces a NixOS module and flake configuration for deploying Redview as an OCI container, including hardware accelerator support, persistent storage mapping, environment variable handling, and updated deployment documentation.

Blocking findings

None.

Important findings

None.

Suggestions

  • Hardcoded OCI container backend (nix/redview.nix:145; high confidence)
    virtualisation.oci-containers.backend = "docker";
    Impact: Overrides the global NixOS virtualisation.oci-containers.backend setting, preventing users from deploying with Podman or other OCI runtimes without manual configuration overrides.
    Suggested fix: Remove the hardcoded assignment to allow the host's NixOS configuration to dictate the runtime, or expose it as a module option with a sensible default.

  • Unnecessary NET_ADMIN capability (nix/redview.nix:167; high confidence)
    extraOptions = [ "--cap-add=NET_ADMIN" ] ++ selected.extraOptions ++ cfg.extraOptions;
    Impact: Grants network administration capabilities to the container by default, which may violate least-privilege principles if the application does not require network namespace manipulation.
    Suggested fix: Remove --cap-add=NET_ADMIN unless Redview explicitly requires it. If required, document the dependency or make it conditional based on a module option.

  • Placeholder package output in flake (flake.nix:12; high confidence)
    packages.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.writeText "redview-flake-package" "Use services.redview in a NixOS configuration to deploy Redview.\n";
    Impact: Exposes a non-functional package output that may confuse flake discovery tooling or users expecting a buildable derivation.
    Suggested fix: Remove the dummy output if it is not strictly required by external tooling, or replace it with a proper source/build derivation if local compilation is intended in the future.

Tests and validation

  • unit-tests: failure
    • Raw output: `

    /usr/bin/node-22[279904]: std::unique_ptr node::WorkerThreadsTaskRunner::DelayedTaskScheduler::Start() at ../../src/node_platform.cc:104

    Assertion failed: (0) == (uv_thread_create(t.get(), start_thread, this))

----- Native stack trace -----

1: 0x7fe278027767 node::Assert(node::AssertionInfo const&) [/lib64/libnode.so.127]
2: 0x7fe2780be3a2 node::WorkerThreadsTaskRunner::WorkerThreadsTaskRunner(int, node::PlatformDebugLogLevel) [/lib64/libnode.so.127]
3: 0x7fe2780d1781 node::NodePlatform::NodePlatform(int, v8::TracingController*, v8::PageAllocator*) [/lib64/libnode.so.127]
4: 0x7fe277ff016b [/lib64/libnode.so.127]
5: 0x7fe277ff153c node::Start(int, char**) [/lib64/libnode.so.127]
6: 0x7fe277c0a681 [/lib64/libc.so.6]
7: 0x7fe277c0a798 __libc_start_main [/lib64/libc.so.6]
8: 0x55866100a035 _start [/usr/bin/node-22]
`

Questions

  • Is the --cap-add=NET_ADMIN capability strictly required for Redview's networking logic, or can it be safely removed?
  • Should the NixOS module respect the host's global OCI backend configuration instead of hardcoding Docker?

Review limitations

  • Review is limited to static analysis of the provided diff; runtime behavior, NixOS evaluation results, and actual container deployment were not tested.
  • Changes are isolated to packaging, flake configuration, and documentation; core application logic (database, API routes, frontend) was not modified or supplied for review.
  • The initial automated review context is untrusted and was evaluated independently against the provided diff.

Diff coverage

  • README.md: reviewed — included in a context-limited batch
  • flake.lock: reviewed — included in a context-limited batch
  • flake.nix: reviewed — included in a context-limited batch
  • nix/redview.nix: reviewed — included in a context-limited batch
Review metadata
  • Reviewer: forgejo-ai-review v1
  • Model: qwen3.6:35b-a3b-q8_0
  • Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
  • Commits considered: 1
  • Previous automated review: none found
  • Findings: 3
<!-- forgejo-ai-review:v1 --> ## Automated code review Reviewed commit: `4a50a4cc707e699d3e2778b039db2bb418d40c9c` ## Verdict: Requires further work Resolve the blocking or important findings and investigate failed deterministic checks before merging. ### Overall assessment Introduces a NixOS module and flake configuration for deploying Redview as an OCI container, including hardware accelerator support, persistent storage mapping, environment variable handling, and updated deployment documentation. ### Blocking findings None. ### Important findings None. ### Suggestions - **Hardcoded OCI container backend** (nix/redview.nix:145; high confidence) virtualisation.oci-containers.backend = "docker"; Impact: Overrides the global NixOS `virtualisation.oci-containers.backend` setting, preventing users from deploying with Podman or other OCI runtimes without manual configuration overrides. Suggested fix: Remove the hardcoded assignment to allow the host's NixOS configuration to dictate the runtime, or expose it as a module option with a sensible default. - **Unnecessary NET_ADMIN capability** (nix/redview.nix:167; high confidence) extraOptions = [ "--cap-add=NET_ADMIN" ] ++ selected.extraOptions ++ cfg.extraOptions; Impact: Grants network administration capabilities to the container by default, which may violate least-privilege principles if the application does not require network namespace manipulation. Suggested fix: Remove `--cap-add=NET_ADMIN` unless Redview explicitly requires it. If required, document the dependency or make it conditional based on a module option. - **Placeholder package output in flake** (flake.nix:12; high confidence) packages.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.writeText "redview-flake-package" "Use services.redview in a NixOS configuration to deploy Redview.\n"; Impact: Exposes a non-functional package output that may confuse flake discovery tooling or users expecting a buildable derivation. Suggested fix: Remove the dummy output if it is not strictly required by external tooling, or replace it with a proper source/build derivation if local compilation is intended in the future. ### Tests and validation - unit-tests: **failure** - Raw output: ` # /usr/bin/node-22[279904]: std::unique_ptr<long unsigned int> node::WorkerThreadsTaskRunner::DelayedTaskScheduler::Start() at ../../src/node_platform.cc:104 # Assertion failed: (0) == (uv_thread_create(t.get(), start_thread, this)) ----- Native stack trace ----- 1: 0x7fe278027767 node::Assert(node::AssertionInfo const&) [/lib64/libnode.so.127] 2: 0x7fe2780be3a2 node::WorkerThreadsTaskRunner::WorkerThreadsTaskRunner(int, node::PlatformDebugLogLevel) [/lib64/libnode.so.127] 3: 0x7fe2780d1781 node::NodePlatform::NodePlatform(int, v8::TracingController*, v8::PageAllocator*) [/lib64/libnode.so.127] 4: 0x7fe277ff016b [/lib64/libnode.so.127] 5: 0x7fe277ff153c node::Start(int, char**) [/lib64/libnode.so.127] 6: 0x7fe277c0a681 [/lib64/libc.so.6] 7: 0x7fe277c0a798 __libc_start_main [/lib64/libc.so.6] 8: 0x55866100a035 _start [/usr/bin/node-22] ` ### Questions - Is the `--cap-add=NET_ADMIN` capability strictly required for Redview's networking logic, or can it be safely removed? - Should the NixOS module respect the host's global OCI backend configuration instead of hardcoding Docker? ### Review limitations - Review is limited to static analysis of the provided diff; runtime behavior, NixOS evaluation results, and actual container deployment were not tested. - Changes are isolated to packaging, flake configuration, and documentation; core application logic (database, API routes, frontend) was not modified or supplied for review. - The initial automated review context is untrusted and was evaluated independently against the provided diff. ### Diff coverage - `README.md`: **reviewed** — included in a context-limited batch - `flake.lock`: **reviewed** — included in a context-limited batch - `flake.nix`: **reviewed** — included in a context-limited batch - `nix/redview.nix`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 1 - Previous automated review: none found - Findings: 3 </details>
All checks were successful
AI pull-request review / review (pull_request) Successful in 6m43s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/redview!4
No description provided.