feat(wpcarro/diogenes): Support rebuild-diogenes r/3807

- deploy-diogenes: terraform updates + NixOS rebuilds
- rebuild-diogenes: NixOS rebuilds

Change-Id: Ibd6db7115d9919fa44ee9d318f88e1bf29e2bdce
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5160
Tested-by: BuildkiteCI
Reviewed-by: wpcarro <wpcarro@gmail.com>
Autosubmit: wpcarro <wpcarro@gmail.com>

1 files changed, 33 insertions, 7 deletions

diff --git a/users/wpcarro/nixos/default.nix b/users/wpcarro/nixos/default.nix
index aa1dfea55e92..de8bb028f1a2 100644
--- a/users/wpcarro/nixos/default.nix
+++ b/users/wpcarro/nixos/default.nix
@@ -1,22 +1,48 @@
 { depot, pkgs, ... }:
 
-let systemFor = sys: (depot.ops.nixos.nixosFor sys).system;
-in {
+let
+  inherit (depot.users.wpcarro.nixos) diogenes;
+  systemFor = sys: (depot.ops.nixos.nixosFor sys).system;
+in
+{
   marcusSystem = systemFor depot.users.wpcarro.nixos.marcus;
+
+  # Apply terraform updates and rebuild NixOS for diogenes.
   deploy-diogenes = pkgs.writeShellScriptBin "deploy-diogenes" ''
     set -euo pipefail
     readonly TF_STATE_DIR=/depot/users/wpcarro/terraform
     rm -f $TF_STATE_DIR/*.json
-    readonly STORE_PATH="$(nix-build /depot -A users.wpcarro.nixos.diogenes)"
+    readonly STORE_PATH="${diogenes.json}"
+    # We can't use the result symlink because terraform looks for a *.json file
+    # in the current working directory.
     cp $STORE_PATH $TF_STATE_DIR
 
-    function cleanup() {
-      rm -f "$TF_STATE_DIR/$(basename $STORE_PATH)"
-    }
+    if [ ! -d $TF_STATE_DIR/.terraform ]; then
+      ${pkgs.terraform}/bin/terraform -chdir="$TF_STATE_DIR" init
+    fi
+
+    # function cleanup() {
+    #   rm -f "$TF_STATE_DIR/$(basename $STORE_PATH)"
+    # }
+    # trap cleanup EXIT
 
-    trap cleanup EXIT
     ${pkgs.terraform}/bin/terraform -chdir="$TF_STATE_DIR" apply
   '';
 
+  # Rebuild NixOS for diogenes without applying terraform updates.
+  rebuild-diogenes = pkgs.writeShellScriptBin "rebuild-diogenes" ''
+    set -euo pipefail
+    readonly target="root@''${1}"
+
+    # We need to call nix-build here on the drvPath because it may not be in
+    # /nix/store yet.
+    readonly STORE_PATH="$(nix-build ${diogenes.drvPath} --no-out-link --show-trace)"
+    nix-copy-closure --to $target ${diogenes.osPath} \
+      --gzip --use-substitutes $STORE_PATH
+
+    ssh $target 'nix-env --profile /nix/var/nix/profiles/system --set ${diogenes.osPath}'
+    ssh $target '${diogenes.osPath}/bin/switch-to-configuration switch'
+  '';
+
   meta.ci.targets = [ "marcusSystem" ];
 }