Lars Nolden
39 lines
1.2 KiB
Nix
39 lines
1.2 KiB
Nix
{ inputs }:
|
|
|
|
let
|
|
mkNode = name: hostname: {
|
|
inherit hostname;
|
|
sshUser = "deploy";
|
|
user = "root";
|
|
profiles.system = {
|
|
path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos
|
|
inputs.self.nixosConfigurations.${name};
|
|
};
|
|
};
|
|
in
|
|
{
|
|
# The Gitea runner has a global `Host * IdentityFile ~/.ssh/larsnolden` in its
|
|
# ~/.ssh/config (a passphrase-locked key). `-F none` makes ssh ignore that
|
|
# config so it doesn't offer the wrong key; `-i` + IdentitiesOnly pins the
|
|
# dedicated deploy key the workflow installs. Applies to both `nix copy` and
|
|
# the activation SSH.
|
|
sshOpts = [
|
|
"-F" "none"
|
|
"-i" "~/.ssh/gebos_deploy"
|
|
"-o" "IdentitiesOnly=yes"
|
|
"-o" "StrictHostKeyChecking=accept-new"
|
|
];
|
|
autoRollback = true;
|
|
magicRollback = true;
|
|
|
|
nodes = {
|
|
# Order matters: the Gitea Actions workflow invokes them in this sequence.
|
|
# SSH/deploy targets use public hostnames because the Gitea runner is not on
|
|
# the private network. Host-to-host traffic still uses the 10.0.0.0/8 IPs.
|
|
# See the host address table in README.md.
|
|
db-host = mkNode "db-host" "db.gebos.online";
|
|
app-host = mkNode "app-host" "app.gebos.online";
|
|
mqtt-ingest = mkNode "mqtt-ingest" "ingest.gebos.online";
|
|
};
|
|
}
|