nix builder

2026-10-06 06:08:11 +09:00 · 2026-09-03 23:26:45 +09:00
parent 10f4d99cb7
commit 56bc3161d7
1 changed files with 82 additions and 0 deletions
@@ -0,0 +1,82 @@
+{
+  config,
+  pkgs,
+  primaryUser,
+  ...
+}:
+
+let
+  homeDirectory = "/home/${primaryUser}";
+  fleetDirectory = "${homeDirectory}/srv/nix-fleet";
+  stateDirectory = "/var/lib/nix-fleet";
+  sourceDirectory = "${stateDirectory}/source";
+
+  git = "${pkgs.git}/bin/git";
+  nix = "${config.nix.package}/bin/nix";
+  rsync = "${pkgs.rsync}/bin/rsync";
+
+  cleanCheckoutConditions = [
+    "${git} -C ${fleetDirectory} diff --quiet"
+    "${git} -C ${fleetDirectory} diff --cached --quiet"
+  ];
+in
+{
+  systemd.services.nix-fleet-converge = {
+    description = "Update inputs, build the fleet, and deploy changed hosts";
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+
+    environment = {
+      HOME = homeDirectory;
+      NIX_CONFIG = ''
+        accept-flake-config = true
+        max-jobs = 4
+        cores = 3
+      '';
+    };
+
+    serviceConfig = {
+      Type = "oneshot";
+      User = primaryUser;
+      Restart = "on-failure";
+      RestartSec = "5min";
+      StateDirectory = "nix-fleet";
+      StateDirectoryMode = "0750";
+      WorkingDirectory = stateDirectory;
+      UMask = "0077";
+      ExecCondition = cleanCheckoutConditions;
+
+      # Work in a disposable copy so updating the dotfiles lock never dirties
+      # the operator's nix-fleet checkout.
+      ExecStart = [
+        "${git} -C ${fleetDirectory} pull --ff-only"
+        "${rsync} --archive --delete --exclude=.git/ --exclude=.direnv/ --exclude=result --exclude=result-* ${fleetDirectory}/ ${sourceDirectory}/"
+        "${nix} flake update --flake ${sourceDirectory} dotfiles"
+        "${nix} run ${sourceDirectory}#converge -- ${sourceDirectory} ${stateDirectory}"
+      ];
+    };
+  };
+
+  systemd.timers.nix-fleet-converge = {
+    description = "Periodically converge the NixOS fleet";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "2min";
+      OnUnitInactiveSec = "5min";
+      RandomizedDelaySec = "30s";
+      Persistent = true;
+      Unit = "nix-fleet-converge.service";
+    };
+  };
+
+  # Only an actual successful deployment touches gc-request. This starts the
+  # builder's root nh-clean unit; remote host stores are never cleaned here.
+  systemd.paths.nix-fleet-gc = {
+    description = "Garbage-collect superseded fleet builds on nix-builder";
+    wantedBy = [ "multi-user.target" ];
+    pathConfig = {
+      PathChanged = "${stateDirectory}/gc-request";
+      Unit = "nh-clean.service";
+    };
+  };
+}