ai ftw?

.forgejo/workflows/build-image.yml

@@ -9,18 +9,32 @@ on:
 jobs:
   build:
     name: Build NixOS Base Image
+    # Ensure 'nixos-latest' runner has Docker, SSH client, and basic Nix tools installed.
+    # It seems it already does.
     runs-on: nixos-latest
     env:
       NIXOS_BUILER_HOST: nixos-builder.lab
       NIXOS_BUILER_USER: runner
+      # Proxmox host details for SSH connection (used by Ansible copy/shell tasks)
       PROXMOX_HOST: 192.168.1.205
-      PROXMOX_USER: plasmagoat
+      # PROXMOX_USER is the SSH user Ansible will connect as (`remote_user` in ansible.cfg)
-      TEMPLATE_VMID: 9001
+      # This should be your Linux system CI user, not necessarily the Proxmox API user.
-      LATEST_TEMPLATE_VMID: 9000
+      PROXMOX_USER: ci-user-linux # <-- IMPORTANT: Use your actual Linux SSH user here
+
+      # VM Template IDs for your Ansible playbook
+      # These are now passed to the playbook via --extra-vars, not directly as env vars for qm.
+      # They are defined in group_vars/all.yml, but can be overridden from here if needed.
+      # TEMPLATE_VMID: 9001 # Removed from direct env for explicit passing to Ansible
+      # LATEST_TEMPLATE_VMID: 9000 # Removed from direct env for explicit passing to Ansible
 
     steps:
-      - name: Install nodejs
+      # Use nix-env for setup (as you prefer and it works well for ephemeral environments)
-        run: nix-env -iA nixpkgs.nodejs
+      - name: Install dependencies via nix-env
+        run: |
+          nix-env -iA nixpkgs.nodejs
+          nix-env -iA nixpkgs.ansible
+          nix-env -iA nixpkgs.jq
+          nix-env -iA nixpkgs.openssh
 
       - name: Checkout repo
         uses: actions/checkout@v4
@@ -30,20 +44,26 @@ jobs:
           mkdir -p ~/.config/nix
           echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
 
-      - name: Prepare SSH
+      - name: Prepare SSH keys and known_hosts for builder and Proxmox
         run: |
           mkdir -p ~/.ssh
+          # Ensure this key corresponds to PROXMOX_USER
           echo "${{ secrets.RUNNER_SSH_KEY }}" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -H $NIXOS_BUILER_HOST >> ~/.ssh/known_hosts
+          # Add builder and Proxmox host keys to known_hosts
-          ssh-keyscan -H $PROXMOX_HOST >> ~/.ssh/known_hosts
+          ssh-keyscan -H "$NIXOS_BUILER_HOST" >> ~/.ssh/known_hosts
+          ssh-keyscan -H "$PROXMOX_HOST" >> ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
 
-      - name: Test SSH connection
+      - name: Test SSH connection to NixOS Builder
         run: |
           echo "Testing SSH connection to $NIXOS_BUILER_HOST..."
-          ssh -o StrictHostKeyChecking=yes $NIXOS_BUILER_USER@$NIXOS_BUILER_HOST "echo 'SSH success. Hostname:' && hostname"
+          ssh -o StrictHostKeyChecking=yes "$NIXOS_BUILER_USER"@"$NIXOS_BUILER_HOST" "echo 'SSH success. Hostname:' && hostname"
+
+      - name: Test SSH connection to Proxmox Host
+        run: |
           echo "Testing SSH connection to $PROXMOX_HOST..."
-          ssh -o StrictHostKeyChecking=yes $PROXMOX_USER@$PROXMOX_HOST "echo 'SSH success. Hostname:' && hostname"
+          ssh -o StrictHostKeyChecking=yes "$PROXMOX_USER"@"$PROXMOX_HOST" "echo 'SSH success. Hostname:' && hostname"
 
       - name: Setup Cachix
         run: |
@@ -51,8 +71,8 @@ jobs:
           cachix use plasmagoat
           cachix authtoken ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-      - name: Build NixOS image
+      - name: Build NixOS image (creates result/ symlink)
-        id: build
+        id: build_image # Changed ID for clarity
         run: |
           nix build .#base \
           --builders "ssh://$NIXOS_BUILER_USER@$NIXOS_BUILER_HOST x86_64-linux ~/.ssh/id_rsa 1 1 kvm" \
@@ -60,45 +80,40 @@ jobs:
           --print-out-paths \
            | cachix push plasmagoat
 
-          echo "image=$(ls result/*.vma.zst | head -n 1)" >> $GITHUB_OUTPUT
+          # Capture the actual image path from the result symlink for Ansible
+          IMAGE_PATH=$(find ./result -name "*.vma.zst" | head -n 1)
+          if [ -z "$IMAGE_PATH" ]; then
+            echo "Error: No .vma.zst image found after build."
+            exit 1
+          fi
+          echo "image_path_from_build=${IMAGE_PATH}" >> "$GITHUB_OUTPUT"
 
       - name: Set VERSION from tag or fallback
-        id: version
+        id: version # Keep original ID
         run: |
-          if [ -n "${CI_COMMIT_TAG}" ]; then
+          if [ -n "${CI_COMMIT_TAG}" ]; then # Use CI_COMMIT_TAG for Forgejo
-            echo "tag=${CI_COMMIT_TAG}" >> $GITHUB_OUTPUT
+            echo "tag=${CI_COMMIT_TAG}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=dev-$(date +%s)" >> $GITHUB_OUTPUT
+            echo "tag=dev-$(date +%s)" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Setup Ancible
+      - name: Run Proxmox Image Deployment
         run: |
-          nix-env -iA nixpkgs.ansible
+          chmod +x ./scripts/run_ansible_ci.sh
+          # Execute the script, passing necessary environment variables
+          ./scripts/run_ansible_ci.sh
+        env:
+          # These are passed directly to the `run_ansible_ci.sh` script,
+          # which then uses them to construct Ansible's --extra-vars.
+          # Match these variable names with what `run_ansible_ci.sh` expects.
+          # Note: The `image_path_from_build` comes from the previous step's output.
+          PROXMOX_LOCAL_IMAGE_PATH_FROM_BUILD: ${{ steps.build_image.outputs.image_path_from_build }}
 
-      - name: Run Upload Template Runbook
+          # Provide VMIDs and names, overriding group_vars if desired.
-        run: |
+          # These will be passed as `--extra-vars` to Ansible.
-          ./sripts/run_ancible_ci.sh
+          ANSIBLE_EXTRA_VARS: >-
-
+            backup_template_vmid={{ env.TEMPLATE_VMID | default('9001') }}
-  release:
+            latest_template_vmid={{ env.LATEST_TEMPLATE_VMID | default('9000') }}
-    name: Release Image
+            proxmox_host={{ env.PROXMOX_HOST }}
-    needs: build
+            proxmox_user={{ env.PROXMOX_USER }}
-    runs-on: ubuntu-latest
+            remote_image_path_ci={{ steps.build_image.outputs.image_path_from_build }}
-    if: success()
-
-    steps:
-      - name: Download Artifact
-        id: artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: nixos-base-image
-
-      - name: Create Forgejo Release
-        uses: https://code.forgejo.org/sheik/forgejo-release@v2.6.0
-        with:
-          title: "NixOS Base Image ${{ steps.version.outputs.tag }}"
-          prerelease: ${{ github.ref_type == 'tag' }}
-          tag: ${{ steps.version.outputs.tag }}
-          direction: upload
-          release-notes: |
-            This release contains the NixOS base image for Proxmox labeled `${{ steps.version.outputs.tag }}`.
-          release-dir: "${{ steps.artifact.outputs.download-path }}/nix-support"

ansible/inventory.ini

@@ -1,2 +0,0 @@
-[proxmox]
-proxmox-01 ansible_host=192.168.1.205 ansible_user=plasmagoat

ansible/inventory/hosts.yml

@@ -5,3 +5,4 @@ all:
       hosts:
         proxmox-01:
           ansible_host: 192.168.1.205 # Replace with your Proxmox host IP/hostname
+          ansible_user: plasmagoat

scripts/run_ancible_ci.sh

@@ -1,6 +1,63 @@
 #!/bin/bash
 set -euo pipefail
 
+echo "Starting Ansible CI/CD run..."
+
+# --- 1. Validate required environment variables ---
+if [[ -z "${PROXMOX_LOCAL_IMAGE_PATH_FROM_BUILD}" ]]; then
+  echo "Error: PROXMOX_LOCAL_IMAGE_PATH_FROM_BUILD environment variable not set. Cannot find built image."
+  exit 1
+fi
+
+# --- 2. Navigate to the Ansible directory ---
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd -P)
+ANSIBLE_DIR="${SCRIPT_DIR}/../ansible"
+
+if [[ ! -d "${ANSIBLE_DIR}" ]]; then
+  echo "Error: Ansible directory not found at ${ANSIBLE_DIR}"
+  exit 1
+fi
+
+cd "${ANSIBLE_DIR}"
+echo "Changed directory to: $(pwd)"
+
+# --- 3. Define Ansible Extra Variables ---
+# Base extra variables from our static definitions
+EXTRA_VARS=(
+  # "local_image_path_ci=${PROXMOX_LOCAL_IMAGE_PATH_FROM_BUILD}" # Path to the image file on the CI runner
+  # "image_filename=$(basename "${PROXMOX_LOCAL_IMAGE_PATH_FROM_BUILD}")" # Extract filename
+)
+
+# Append any other variables passed via ANSIBLE_EXTRA_VARS from the workflow
+if [[ -n "${ANSIBLE_EXTRA_VARS:-}" ]]; then
+  # Split by space or newline and add to array
+  IFS=$'\n' read -r -d '' -a ADDITIONAL_VARS <<< "${ANSIBLE_EXTRA_VARS}" || true
+  for var in "${ADDITIONAL_VARS[@]}"; do
+    EXTRA_VARS+=("${var}")
+  done
+fi
+
+# --- 4. Execute the Ansible Playbook ---
+echo "Executing Ansible playbook: upload-template.yml"
+
+# Construct the full --extra-vars string
+EXTRA_VARS_ARGS=""
+for var in "${EXTRA_VARS[@]}"; do
+  EXTRA_VARS_ARGS+=" -e ${var}"
+done
+
+ansible-playbook upload-template.yml \
+  --inventory inventory/hosts.yml \
+  ${EXTRA_VARS_ARGS} \
+  --diff \
+  --check false # Set to true for a dry run, false for actual execution
+
+echo "Ansible playbook execution finished."
+
+
+#!/bin/bash
+set -euo pipefail
+
 # Navigate to the ansible directory
 cd ansible