colmena initial implementation for sandbox and monitor
All checks were successful
Hello World / test (push) Successful in 4s
All checks were successful
Hello World / test (push) Successful in 4s
This commit is contained in:
parent
a90630ecb6
commit
5feb74d56d
40 changed files with 27629 additions and 141 deletions
|
|
@ -1,61 +0,0 @@
|
|||
name: "Build NixOS Image"
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: native
|
||||
steps:
|
||||
- name: Install nodejs
|
||||
run: nix-env -iA nixpkgs.nodejs
|
||||
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# - name: Install Nix
|
||||
# uses: cachix/install-nix-action@v31
|
||||
# with:
|
||||
# nix_path: nixpkgs=channel:nixos-unstable
|
||||
# extra_nix_config: |
|
||||
# experimental-features = nix-command flakes
|
||||
|
||||
# - name: Enable experimental features
|
||||
# run: |
|
||||
# mkdir -p ~/.config/nix
|
||||
# echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
|
||||
|
||||
# - name: Update Channel
|
||||
# run: nix-channel --update
|
||||
|
||||
- name: Build NixOS image
|
||||
working-directory: nixos
|
||||
run: nix build .#proxmoxTemplate
|
||||
|
||||
# - name: Upload & Restore to Proxmox
|
||||
# working-directory: nixos
|
||||
# env:
|
||||
# PROXMOX_SSH_KEY: ${{ secrets.PROXMOX_SSH_KEY }}
|
||||
# PROXMOX_HOST: 192.168.1.205
|
||||
# PROXMOX_USER: root
|
||||
# run: |
|
||||
# set -e
|
||||
|
||||
# IMAGE_NAME="vm-image.vma.zst"
|
||||
# REMOTE_PATH="/var/lib/vz/template/$IMAGE_NAME"
|
||||
# VM_ID="9000"
|
||||
|
||||
# echo "Starting ssh-agent and uploading..."
|
||||
# eval "$(ssh-agent -s)"
|
||||
# ssh-add <(echo "$PROXMOX_SSH_KEY")
|
||||
|
||||
# echo "Uploading image..."
|
||||
# scp -o StrictHostKeyChecking=no ./result/$IMAGE_NAME $PROXMOX_USER@$PROXMOX_HOST:$REMOTE_PATH
|
||||
|
||||
# echo "Restoring VM $VM_ID..."
|
||||
# ssh -o StrictHostKeyChecking=no $PROXMOX_USER@$PROXMOX_HOST "
|
||||
# qm stop $VM_ID || true
|
||||
# qm destroy $VM_ID || true
|
||||
# qmrestore --unique $REMOTE_PATH $VM_ID
|
||||
# qm template $VM_ID
|
||||
# "
|
||||
53
.forgejo/workflows/colmena-apply.yml
Normal file
53
.forgejo/workflows/colmena-apply.yml
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
name: "Colmena apply"
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v*" # triggers on v1.0.0, v1.2.3, etc.
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
apply:
|
||||
name: Apply flake configurations to colmena hive
|
||||
# Ensure 'nixos-latest' runner has Docker, SSH client, and basic Nix tools installed.
|
||||
# It seems it already does.
|
||||
runs-on: nixos-latest
|
||||
env:
|
||||
NIXOS_BUILER_HOST: nixos-builder.lab
|
||||
NIXOS_BUILER_USER: runner
|
||||
|
||||
steps:
|
||||
# Use nix-env for setup (as you prefer and it works well for ephemeral environments)
|
||||
- name: Install dependencies via nix-env
|
||||
run: |
|
||||
nix-env -iA nixpkgs.nodejs
|
||||
nix-env -iA nixpkgs.openssh
|
||||
nix-env -if https://github.com/zhaofengli/colmena/tarball/main
|
||||
nix-env -iA cachix -f https://cachix.org/api/v1/install
|
||||
cachix use plasmagoat
|
||||
cachix authtoken ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Enable experimental features
|
||||
run: |
|
||||
mkdir -p ~/.config/nix
|
||||
echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
|
||||
|
||||
- name: Prepare SSH keys and known_hosts for builder and Proxmox
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.RUNNER_SSH_KEY }}" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$NIXOS_BUILER_HOST" >> ~/.ssh/known_hosts
|
||||
chmod 600 ~/.ssh/known_hosts
|
||||
|
||||
- name: Test SSH connection to NixOS Builder
|
||||
run: |
|
||||
echo "Testing SSH connection to $NIXOS_BUILER_HOST..."
|
||||
ssh -o StrictHostKeyChecking=yes "$NIXOS_BUILER_USER"@"$NIXOS_BUILER_HOST" "echo 'SSH success. Hostname:' && hostname"
|
||||
|
||||
- name: Apply Colmena
|
||||
id: apply
|
||||
run: colmena apply
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
name: Deploy NixOS VM
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: nixos/nix
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Terraform
|
||||
run: nix-env -iA nixpkgs.terraform
|
||||
|
||||
- name: Setup SSH key
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
|
||||
- name: Terraform Init & Apply
|
||||
run: |
|
||||
terraform init
|
||||
terraform apply -auto-approve
|
||||
working-directory: ./terraform
|
||||
env:
|
||||
PROXMOX_PASSWORD: ${{ secrets.PROXMOX_PASSWORD }}
|
||||
|
||||
- name: Deploy NixOS via nixos-anywhere
|
||||
run: |
|
||||
nix run github:numtide/nixos-anywhere -- \
|
||||
--build-on-remote \
|
||||
--flake .#new-vm \
|
||||
root@<new-vm-ip>
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
name: Terraform Proxmox NixOS VM Deploy
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
deploy-nixos-vm:
|
||||
runs-on: nixos-latest
|
||||
steps:
|
||||
- name: Install nodejs
|
||||
run: nix-env -iA nixpkgs.nodejs
|
||||
|
||||
- name: Install terraform
|
||||
run: nix-env -iA nixpkgs.terraform
|
||||
|
||||
- name: Install sops
|
||||
run: nix-env -iA nixpkgs.sops
|
||||
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Decrypt secrets
|
||||
env:
|
||||
SOPS_AGE_KEY_FILE: ${{ secrets.AGE_KEY_FILE }}
|
||||
run: |
|
||||
sops --decrypt secrets.yaml.enc > secrets.yaml
|
||||
|
||||
- name: Terraform Init
|
||||
run: terraform init
|
||||
|
||||
- name: Terraform Apply
|
||||
env:
|
||||
PROXMOX_PASSWORD: ${{ secrets.PROXMOX_PASSWORD }}
|
||||
run: terraform apply -auto-approve
|
||||
Loading…
Add table
Add a link
Reference in a new issue