0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 11:46:35 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 bd1a3a69ad fix(deploy/development/inventory/planner): split per-round include from union purge_set

`3c1d5d821` solved the cross-round backbone-abriss problem by making
`include` equal the union of every variant's closure for every round.
Side-effect: every matrix round then ALSO deployed the full union, so
`08_deploy_performance.sh` saw `dashboard.infinito.example` still
answering HTTP 200 after a matomo-only `deploy-fresh-purged-apps` —
the deploy step was no longer matomo-only at all.

Split the two concerns instead:

- `include` (PlanEntry[3]) goes back to the per-round variant-closure.
  Both `init`/`builder` (`--include` for the inventory bake) and
  `deploy` (`--id` for ansible) consume it. Each round therefore
  deploys ONLY its own variant-closure again — the pre-`3c1d5d821`
  semantics.
- `purge_set` (PlanEntry[4], new) carries the union across all rounds.
  `deploy.py` uses it for the inter-round wipe instead of the previous
  round's include. Result: between rounds the WHOLE matrix footprint
  is purged, not just the previous round's variant slice — a variant
  pinning `services.<X>.shared: false` cannot leave its bundled
  provider on the host for a sibling round that wires the same service
  shared. The backbone-abriss `3c1d5d821` was hunting stays fixed:
  whichever round needs the backbone re-deploys it immediately after
  the wipe (purge runs at the start of each round, not the end).

`previous_round_include` tracking is gone. The first iteration skips
the purge (nothing to wipe yet), which also covers `total_rounds == 1`
and `--variant N` pinned single-folder modes cleanly.

Unrelated, but staged together because it is part of the same
investigation:

- `roles/dev-nix/templates/nix.conf.j2`: enable `keep-derivations` /
  `keep-outputs`, so `nix-collect-garbage -d` (run by the aggressive
  prune step) does not drop the build closure of pkgmgr's flake; this
  was making every deploy re-fetch the build inputs from
  cache.nixos.org and overshoot pkgmgr's update timeout.
- `roles/pkgmgr/tasks/01_core.yml`: raise the pkgmgr update timeout
  from 600s to 1800s and lower the retry count from 6 to 3, so a slow
  fetch on a single try no longer pushes total wallclock past three
  hours.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-15 00:44:47 +02:00

defaults

chore(tooling): integrate mbake (Makefile linter/formatter) + working-tree drift sync

2026-05-09 00:32:44 +02:00

files

…

README.md

dev-nix

This role installs the Nix package manager in a secure, reproducible, and idempotent way across multiple Linux distributions.

Description

The role installs Nix using either the native package manager (where supported and reliable) or the official installer with SHA256 verification.

On platforms where distro packages are known to be problematic (e.g. Arch Linux ARM), the role deliberately avoids the system package and falls back to the official installer to ensure a working and up-to-date Nix installation.

Overview

This role installs the Nix package manager via pacman on Arch x86_64 or via the official installer with SHA256 verification.

Installation Strategy

The role automatically selects the appropriate installation method:

Arch Linux (x86_64)
Installs nix via the system package manager (pacman).
All other platforms (including Arch Linux ARM, Debian, Ubuntu, Fedora, EL, Generic Linux)
Uses the official Nix installer in multi-user (daemon) mode.

This avoids ABI and SONAME mismatches on rolling or less frequently rebuilt distributions.

Security Model

The official installer is downloaded at runtime and verified before execution:

The installer script is fetched from the official release location
Its SHA256 checksum is fetched from the same release
The checksum is validated before execution
Installation aborts immediately if verification fails

No unverified code is executed on the target system.

Features

Automatic platform detection (Arch x86_64 vs others)
Verified official installer with SHA256 checksum validation
Multi-user (daemon) installation mode
Optional shell integration via /etc/profile.d
Optional activation of experimental features (nix-command, flakes)
Fully idempotent (safe to run multiple times)
Distro-agnostic fallback logic

Configuration Options

Key variables (see defaults/main.yml):

dev_nix_installer_version
Nix version to install via the official installer.
dev_nix_enable_experimental_features
Enable experimental features such as nix-command and flakes.
dev_nix_enable_shell_snippet
Whether to install a profile snippet for automatic environment loading.

Notes on Offline Usage

This role does not ship the installer script and therefore requires network access during installation.

If a fully offline or air-gapped setup is required, the role can be extended to use a locally vendored installer script with a pinned checksum.

Further Resources

Nix project: https://nixos.org
Nix releases: https://releases.nixos.org
Infinito.Nexus License: https://s.infinito.nexus/license

Credits

Developed and maintained by Kevin Veen-Birkenbach. Learn more at veen.world. Part of the Infinito.Nexus Project. Licensed under the Infinito.Nexus Community License (Non-Commercial).