ai ftw?

.forgejo/workflows/build-image.yml

@@ -9,18 +9,32 @@ on:
 jobs:
   build:
     name: Build NixOS Base Image
+    # Ensure 'nixos-latest' runner has Docker, SSH client, and basic Nix tools installed.
+    # It seems it already does.
     runs-on: nixos-latest
     env:
       NIXOS_BUILER_HOST: nixos-builder.lab
       NIXOS_BUILER_USER: runner
+      # Proxmox host details for SSH connection (used by Ansible copy/shell tasks)
       PROXMOX_HOST: 192.168.1.205
-      PROXMOX_USER: plasmagoat
-      TEMPLATE_VMID: 9001
-      LATEST_TEMPLATE_VMID: 9000
+      # PROXMOX_USER is the SSH user Ansible will connect as (`remote_user` in ansible.cfg)
+      # This should be your Linux system CI user, not necessarily the Proxmox API user.
+      PROXMOX_USER: ci-user-linux # <-- IMPORTANT: Use your actual Linux SSH user here
+
+      # VM Template IDs for your Ansible playbook
+      # These are now passed to the playbook via --extra-vars, not directly as env vars for qm.
+      # They are defined in group_vars/all.yml, but can be overridden from here if needed.
+      # TEMPLATE_VMID: 9001 # Removed from direct env for explicit passing to Ansible
+      # LATEST_TEMPLATE_VMID: 9000 # Removed from direct env for explicit passing to Ansible
 
     steps:
-      - name: Install nodejs
-        run: nix-env -iA nixpkgs.nodejs
+      # Use nix-env for setup (as you prefer and it works well for ephemeral environments)
+      - name: Install dependencies via nix-env
+        run: |
+          nix-env -iA nixpkgs.nodejs
+          nix-env -iA nixpkgs.ansible
+          nix-env -iA nixpkgs.jq
+          nix-env -iA nixpkgs.openssh
 
       - name: Checkout repo
         uses: actions/checkout@v4
@@ -30,20 +44,26 @@ jobs:
           mkdir -p ~/.config/nix
           echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
 
-      - name: Prepare SSH
+      - name: Prepare SSH keys and known_hosts for builder and Proxmox
         run: |
           mkdir -p ~/.ssh
+          # Ensure this key corresponds to PROXMOX_USER
           echo "${{ secrets.RUNNER_SSH_KEY }}" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -H $NIXOS_BUILER_HOST >> ~/.ssh/known_hosts
-          ssh-keyscan -H $PROXMOX_HOST >> ~/.ssh/known_hosts
+          # Add builder and Proxmox host keys to known_hosts
+          ssh-keyscan -H "$NIXOS_BUILER_HOST" >> ~/.ssh/known_hosts
+          ssh-keyscan -H "$PROXMOX_HOST" >> ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
 
-      - name: Test SSH connection
+      - name: Test SSH connection to NixOS Builder
         run: |
           echo "Testing SSH connection to $NIXOS_BUILER_HOST..."
-          ssh -o StrictHostKeyChecking=yes $NIXOS_BUILER_USER@$NIXOS_BUILER_HOST "echo 'SSH success. Hostname:' && hostname"
+          ssh -o StrictHostKeyChecking=yes "$NIXOS_BUILER_USER"@"$NIXOS_BUILER_HOST" "echo 'SSH success. Hostname:' && hostname"
+
+      - name: Test SSH connection to Proxmox Host
+        run: |
           echo "Testing SSH connection to $PROXMOX_HOST..."
-          ssh -o StrictHostKeyChecking=yes $PROXMOX_USER@$PROXMOX_HOST "echo 'SSH success. Hostname:' && hostname"
+          ssh -o StrictHostKeyChecking=yes "$PROXMOX_USER"@"$PROXMOX_HOST" "echo 'SSH success. Hostname:' && hostname"
 
       - name: Setup Cachix
         run: |
@@ -51,8 +71,8 @@ jobs:
           cachix use plasmagoat
           cachix authtoken ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-      - name: Build NixOS image
-        id: build
+      - name: Build NixOS image (creates result/ symlink)
+        id: build_image # Changed ID for clarity
         run: |
           nix build .#base \
           --builders "ssh://$NIXOS_BUILER_USER@$NIXOS_BUILER_HOST x86_64-linux ~/.ssh/id_rsa 1 1 kvm" \
@@ -60,45 +80,40 @@ jobs:
           --print-out-paths \
            | cachix push plasmagoat
 
-          echo "image=$(ls result/*.vma.zst | head -n 1)" >> $GITHUB_OUTPUT
+          # Capture the actual image path from the result symlink for Ansible
+          IMAGE_PATH=$(find ./result -name "*.vma.zst" | head -n 1)
+          if [ -z "$IMAGE_PATH" ]; then
+            echo "Error: No .vma.zst image found after build."
+            exit 1
+          fi
+          echo "image_path_from_build=${IMAGE_PATH}" >> "$GITHUB_OUTPUT"
 
       - name: Set VERSION from tag or fallback
-        id: version
+        id: version # Keep original ID
         run: |
-          if [ -n "${CI_COMMIT_TAG}" ]; then
-            echo "tag=${CI_COMMIT_TAG}" >> $GITHUB_OUTPUT
+          if [ -n "${CI_COMMIT_TAG}" ]; then # Use CI_COMMIT_TAG for Forgejo
+            echo "tag=${CI_COMMIT_TAG}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=dev-$(date +%s)" >> $GITHUB_OUTPUT
+            echo "tag=dev-$(date +%s)" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Setup Ancible
+      - name: Run Proxmox Image Deployment
         run: |
-          nix-env -iA nixpkgs.ansible
+          chmod +x ./scripts/run_ansible_ci.sh
+          # Execute the script, passing necessary environment variables
+          ./scripts/run_ansible_ci.sh
+        env:
+          # These are passed directly to the `run_ansible_ci.sh` script,
+          # which then uses them to construct Ansible's --extra-vars.
+          # Match these variable names with what `run_ansible_ci.sh` expects.
+          # Note: The `image_path_from_build` comes from the previous step's output.
+          PROXMOX_LOCAL_IMAGE_PATH_FROM_BUILD: ${{ steps.build_image.outputs.image_path_from_build }}
 
-      - name: Run Upload Template Runbook
-        run: |
-          ./sripts/run_ancible_ci.sh
-
-  release:
-    name: Release Image
-    needs: build
-    runs-on: ubuntu-latest
-    if: success()
-
-    steps:
-      - name: Download Artifact
-        id: artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: nixos-base-image
-
-      - name: Create Forgejo Release
-        uses: https://code.forgejo.org/sheik/forgejo-release@v2.6.0
-        with:
-          title: "NixOS Base Image ${{ steps.version.outputs.tag }}"
-          prerelease: ${{ github.ref_type == 'tag' }}
-          tag: ${{ steps.version.outputs.tag }}
-          direction: upload
-          release-notes: |
-            This release contains the NixOS base image for Proxmox labeled `${{ steps.version.outputs.tag }}`.
-          release-dir: "${{ steps.artifact.outputs.download-path }}/nix-support"
+          # Provide VMIDs and names, overriding group_vars if desired.
+          # These will be passed as `--extra-vars` to Ansible.
+          ANSIBLE_EXTRA_VARS: >-
+            backup_template_vmid={{ env.TEMPLATE_VMID | default('9001') }}
+            latest_template_vmid={{ env.LATEST_TEMPLATE_VMID | default('9000') }}
+            proxmox_host={{ env.PROXMOX_HOST }}
+            proxmox_user={{ env.PROXMOX_USER }}
+            remote_image_path_ci={{ steps.build_image.outputs.image_path_from_build }}