From dbca46d05205bdaab07d4faf1899a6452f34dd0f Mon Sep 17 00:00:00 2001 From: Vincent Ambo Date: Sun, 29 Jan 2023 19:44:23 +0300 Subject: feat(ops/terraform): add module for deploying NixOS system closures This module makes it fairly easy to deploy NixOS system closures using Terraform, while properly separating the evaluation of a derivation (to determine whether a deploy is needed) from the building and copying of the closure itself. This has been on my stack for a while. It was originally developed for Resoptima, who agreed to open-sourcing it in depot back when we completed our work with them. Their contribution has been acknowledged in the README. Co-Authored-By: Florian Klink Change-Id: Ica4c170658cd25f1fb7072c9a45735fcc4351474 Reviewed-on: https://cl.tvl.fyi/c/depot/+/7950 Reviewed-by: tazjin Tested-by: BuildkiteCI --- ops/terraform/deploy-nixos/nixos-copy.sh | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100755 ops/terraform/deploy-nixos/nixos-copy.sh (limited to 'ops/terraform/deploy-nixos/nixos-copy.sh') diff --git a/ops/terraform/deploy-nixos/nixos-copy.sh b/ops/terraform/deploy-nixos/nixos-copy.sh new file mode 100755 index 000000000000..1c6b8df024d2 --- /dev/null +++ b/ops/terraform/deploy-nixos/nixos-copy.sh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash +# +# Copies a NixOS system to a target host, using the provided key. +set -ueo pipefail + +scratch="$(mktemp -d)" +trap 'rm -rf -- "${scratch}"' EXIT + +echo -n "$DEPLOY_KEY" > $scratch/id_deploy +chmod 0600 $scratch/id_deploy + +export NIX_SSHOPTS="\ + -o StrictHostKeyChecking=no\ + -o UserKnownHostsFile=/dev/null\ + -o GlobalKnownHostsFile=/dev/null\ + -o IdentityFile=$scratch/id_deploy" + +nix-copy-closure \ + --to ${TARGET_USER}@${TARGET_ADDRESS} \ + ${SYSTEM_DRV} \ + --gzip \ + --include-outputs \ + --use-substitutes -- cgit 1.4.1