[fanny] add disable autoupdate option at startup

Reviewed-on: kalipso/infrastructure#128

.gitea/workflows/autoupdate.yml

@@ -18,8 +18,27 @@ jobs:
               run: |
                   apt-get update
                   apt-get install -y sudo
+            - name: Install Tea
+              env:
+                TEA_DL_URL: "https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64"
+              shell: bash
+              run: |
+                TEA_DIR=$(mktemp -d -t tmp.XXXX)
+                pushd $TEA_DIR
+                wget "$TEA_DL_URL"
+                wget "${TEA_DL_URL}.sha256"
+                if $(sha256sum --quiet -c "tea-0.9.2-linux-amd64.sha256"); then
+                mv "tea-0.9.2-linux-amd64" /usr/bin/tea
+                chmod +x /usr/bin/tea
+                popd
+                rm -rf $TEA_DIR
+                else
+                popd
+                rm -rf $TEA_DIR
+                echo "::error title=⛔ error hint::Tea v0.9.2 Checksum Failed"
+                exit 1
+                fi
             - uses: https://code.forgejo.org/actions/checkout@v6
-
             - name: Set up Nix
               uses: https://github.com/cachix/install-nix-action@v31
               with: 
@@ -27,16 +46,65 @@ jobs:
 
             - name: Run nix flake update
               run: nix flake update
-            - name: Run nix flake check
-              run: nix flake check --all-systems --verbose
 
-            - name: Create Gitea PR
+            - name: Commit flake.lock
-              uses: https://github.com/infinilabs/gitea-pr@v0
+              run: |
-              with:
+                  git config user.name "malobot"
-                url: https://git.dynamicdiscord.de
+                  git config user.email "malobot@systemli.org"
-                token: ${{ secrets.AHTLONS_GITEA_TOKEN }}
+                  git stash push
-                commit-message: 'Update flake.lock'
+                  git branch nixpkgs_bump_$(date +%Y%m%d)
-                committer: 'malobot <malobot@systemli.org>'
+                  git checkout nixpkgs_bump_$(date +%Y%m%d)
-                base: 'master'
+                  git stash pop
-                title: 'Update flake.lock'
+                  git add flake.lock
-                assignee: 'ahtlon'
+                  git diff --staged --quiet || git commit -m "Update flake.lock"
+
+            - name: Check for eval warnings
+              id: commit
+              shell: bash
+              run: |
+                {
+                echo "COMMIT_DESC<<EOF"
+                echo "Date: $(date)"
+                echo "Evaluation warnings:"
+                nix flake check --all-systems --no-build 2>&1 | grep evaluation | awk '!seen[$0]++' || echo "None :)"
+                echo EOF
+                } >> "$GITHUB_OUTPUT"
+            
+            
+            - name: Login to Gitea
+              shell: bash
+              env:
+                GIT_SERVER_URL: https://git.dynamicdiscord.de
+                GIT_SERVER_TOKEN: ${{ secrets.AHTLONS_GITEA_TOKEN }}
+              run: >-
+                tea login add
+                -u "$GIT_SERVER_URL"
+                -t "$GIT_SERVER_TOKEN"
+            - name: Check for existing pull request
+              id: no-pr
+              continue-on-error: true
+              shell: bash
+              run: >-
+                tea pr -f head -o simple |
+                grep -q ${{ github.ref_name }} &&
+                exit 1 ||
+                exit 0
+            - name: Force push branch
+              run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
+            - name: Create pull request
+              if: steps.no-pr.outcome == 'success'
+              env:
+                COMMIT_MSG: Automatic Nixpkgs update
+                COMMIT_DESC: ${{ steps.commit.outputs.COMMIT_DESC }}
+              shell: bash
+              run: >-
+                tea pr create
+                -L "bump"
+                -t "$COMMIT_MSG"
+                -d "$COMMIT_DESC"
+            - name: Skip pull request
+              if: steps.no-pr.outcome == 'failure'
+              shell: bash
+              run: >
+                echo "::error title=⛔ error hint::
+                A PR already exists for this branch: ${{ github.ref_name }}"

machines/fanny/configuration.nix

@@ -1,4 +1,4 @@
-{ inputs, config, ... }:
+{ inputs, config, lib, ... }:
 let
   sshKeys = import ../ssh_keys.nix;
   peers = import ../modules/malobeo/peers.nix;
@@ -47,6 +47,10 @@ in
     jobset = "infrastructure";
     cacheurl = "https://cache.dynamicdiscord.de";
   };
+  specialisation."NOAUTOUPDATE".configuration = {
+    system.nixos.tags = [ "NOAUTOUPDATE" ];
+    malobeo.autoUpdate.enable = lib.mkForce false;
+  };
 
   malobeo.backup = {
     enable = true;
@@ -135,8 +139,9 @@ in
     enableHostBridge = true;
     interface = "enp1s0";
     gateway = "192.168.1.1";
-    address = "192.168.1.2/24";
+    address = "192.168.1.103/24";
   };
+
   services.malobeo.microvm.deployHosts = [ 
     "overwatch" 
     "infradocs" 
@@ -212,7 +217,7 @@ in
 
     virtualHosts."keys.malobeo.org" = {
       locations."/" = {
-        proxyPass = "http://10.0.0.16";
+        proxyPass = "http://${hosts.malobeo.hosts.vaultwarden.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
         '';

machines/hosts.nix

@@ -6,7 +6,7 @@ let
     hostId = hostId;
     address = "192.168.1.${hostId}";
     gateway = "192.168.1.1";
-    nameservers = [ "192.168.1.17" "1.1.1.1" ]; #setting ns1 as nameserver
+    nameservers = [ "192.168.1.1" "1.1.1.1" ]; #setting ns1 as nameserver
     mac = mac;
   };
 

machines/modules/malobeo/microvm_host.nix

@@ -101,7 +101,7 @@ in
           # under nixosConfigurations
           flake = inputs.malobeo; 
           # Specify from where to let `microvm -u` update later on
-          updateFlake = "git+https://git.dynamicdiscord.de/kalipso/infrastructure";
+          updateFlake = "git+https://git.dynamicdiscord.de/malobeo/infrastructure";
         }; };
     in
     builtins.listToAttrs (map mapperFunc cfg.deployHosts);

machines/nextcloud/configuration.nix

@@ -61,7 +61,7 @@ in
       };
     };
     settings = {
-      trusted_domains = [ "cloud.malobeo.org" ];
+      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
       trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
       "maintenance_window_start" = "1";
       "default_phone_region" = "DE";