lament/pantheon

new deploy pipeline #74

Merged

lament merged 4 commits from deploy into main

2026-07-09 21:55:03 -05:00

lament commented

2026-07-09 21:16:16 -05:00

Owner

CI deploys through deploy-rs now instead of a raw nixos-rebuild switch --target-host
- new modules/deploy.nix generates flake.deploy.nodes from the directory - one node per host, sshUser = "nixbldRemote", activating as root via passwordless sudo
- the builder host is filtered out (via roleHost "builder") - it runs the runner that drives the deploys, it doesn't deploy itself
- magicRollback + autoRollback + 60s confirmTimeout - a lockout or failed activation auto-reverts to the prior generation, the unattended-safety net for the remote hosts
- deployChecks folded into nix flake check
CI job probes reachability before deploying
- a host that's simply offline (ishtar the desktop) is a ::warning skip, not a failure - deploy step gates on steps.probe.outputs.reachable
- fail-fast: false on the matrix so one down host doesn't kill the others' deploys
deploy-rs wired in as a flake input (nixpkgs follows) and added to the runner's hostPackages so the runner can actually invoke it
left for later: nothing pending - brigid itself still owes its real install/enroll from #72

- CI deploys through `deploy-rs` now instead of a raw `nixos-rebuild switch --target-host` - new `modules/deploy.nix` generates `flake.deploy.nodes` from the directory - one node per host, `sshUser = "nixbldRemote"`, activating as `root` via passwordless sudo - the `builder` host is filtered out (via `roleHost "builder"`) - it runs the runner that drives the deploys, it doesn't deploy itself - `magicRollback` + `autoRollback` + 60s `confirmTimeout` - a lockout or failed activation auto-reverts to the prior generation, the unattended-safety net for the remote hosts - `deployChecks` folded into `nix flake check` - CI job probes reachability before deploying - a host that's simply offline (`ishtar` the desktop) is a `::warning` skip, not a failure - deploy step gates on `steps.probe.outputs.reachable` - `fail-fast: false` on the matrix so one down host doesn't kill the others' deploys - `deploy-rs` wired in as a flake input (`nixpkgs` follows) and added to the runner's `hostPackages` so the runner can actually invoke it - left for later: nothing pending - `brigid` itself still owes its real install/enroll from #72

lament added 1 commit

2026-07-09 21:16:16 -05:00

new deploy pipeline

CI / check (pull_request) Successful in 1m21s

Details

CI / deploy (athena) (pull_request) Has been skipped

Details

CI / deploy (ishtar) (pull_request) Has been skipped

Details

CI / deploy (minerva) (pull_request) Has been skipped

Details

CI / build (athena) (pull_request) Successful in 20s