Lars Nolden
5e2454f622
The gitea-runner is a systemd DynamicUser whose passwd home is /, so ssh expands ~ to /.ssh/... (not $HOME). deploy-rs passes ssh opts to ssh with no shell, so a tilde in deploy.nix sshOpts resolved to a missing key and nix copy failed with 'failed to start SSH connection'. Keep deploy.nix sshOpts path-free; build absolute -i/known_hosts paths in deploy.yml from $HOME (bash-expanded) and append them via --ssh-opts, which deploy-rs merges into NIX_SSHOPTS for the copy and the activation ssh. Also removes the temporary SSH debug step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.4 KiB
Nix
40 lines
1.4 KiB
Nix
{ inputs }:
|
|
|
|
let
|
|
mkNode = name: hostname: {
|
|
inherit hostname;
|
|
sshUser = "deploy";
|
|
user = "root";
|
|
profiles.system = {
|
|
path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos
|
|
inputs.self.nixosConfigurations.${name};
|
|
};
|
|
};
|
|
in
|
|
{
|
|
# Path-free ssh options only. The key path and known_hosts are runner-specific
|
|
# and injected by the deploy.yml via deploy-rs `--ssh-opts` (which appends to
|
|
# this list for both `nix copy` and the activation SSH). They must be absolute:
|
|
# the gitea-runner is a systemd DynamicUser whose passwd home is `/`, so ssh
|
|
# expands `~` to `/.ssh/...` (NOT $HOME) and a tilde here finds no key. The
|
|
# workflow builds the absolute paths from $HOME, where bash expands correctly.
|
|
# `-F none` ignores the runner's ~/.ssh/config; IdentitiesOnly pins the key.
|
|
sshOpts = [
|
|
"-F" "none"
|
|
"-o" "IdentitiesOnly=yes"
|
|
"-o" "StrictHostKeyChecking=accept-new"
|
|
];
|
|
autoRollback = true;
|
|
magicRollback = true;
|
|
|
|
nodes = {
|
|
# Order matters: the Gitea Actions workflow invokes them in this sequence.
|
|
# SSH/deploy targets use public hostnames because the Gitea runner is not on
|
|
# the private network. Host-to-host traffic still uses the 10.0.0.0/8 IPs.
|
|
# See the host address table in README.md.
|
|
db-host = mkNode "db-host" "db.gebos.online";
|
|
app-host = mkNode "app-host" "app.gebos.online";
|
|
mqtt-ingest = mkNode "mqtt-ingest" "ingest.gebos.online";
|
|
};
|
|
}
|