From 3495538ab18820cfc3e7db8fe27a9d2ab5bb2d1f Mon Sep 17 00:00:00 2001 From: Lukas Holzner Date: Fri, 4 Sep 2026 07:29:57 +0200 Subject: [PATCH] fix(ci): fix flake evaluation, pure modulesPath, user attrset, and add Gitea Packages upload --- .gitea/workflows/build-iso.yaml | 17 ++++++++++-- .gitea/workflows/package.yaml | 15 ++++++++++ .gitea/workflows/test-modules.yaml | 17 +++++++++--- flake.lock | 44 ++++++++++++++++++++++++++++++ iso/installer-iso.nix | 8 +++--- modules/core/users.nix | 23 ++++++++-------- modules/services/apps/immich.nix | 10 ++++++- modules/storage/zfs.nix | 3 +- profiles/hardware-generic.nix | 6 ++++ 9 files changed, 118 insertions(+), 25 deletions(-) create mode 100644 flake.lock diff --git a/.gitea/workflows/build-iso.yaml b/.gitea/workflows/build-iso.yaml index 66feffa..eaa133a 100644 --- a/.gitea/workflows/build-iso.yaml +++ b/.gitea/workflows/build-iso.yaml @@ -11,6 +11,10 @@ on: required: true default: 'stable' +permissions: + contents: write + packages: write + jobs: build-iso: runs-on: ubuntu-latest @@ -21,7 +25,6 @@ jobs: - name: Install Nix with Flake Support uses: cachix/install-nix-action@v27 with: - nix_path: nixpkgs=channel:nixos-24.11 extra_nix_config: | experimental-features = nix-command flakes @@ -39,8 +42,18 @@ jobs: echo "iso_file=$ISO_FILE" >> $GITHUB_OUTPUT echo "sha256=$SHA256" >> $GITHUB_OUTPUT + - name: Publish ISO to Gitea Packages + run: | + ISO_FILE="${{ steps.iso-info.outputs.iso_file }}" + if [ -f "$ISO_FILE" ]; then + curl -s --fail-with-body -X PUT \ + -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \ + --upload-file "$ISO_FILE" \ + "${{ github.server_url }}/api/packages/naxos/generic/naxos-installer/latest/$(basename "$ISO_FILE")" || true + fi + - name: Upload ISO Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v3 with: name: naxos-installer-iso path: result/iso/*.iso diff --git a/.gitea/workflows/package.yaml b/.gitea/workflows/package.yaml index be47110..8cf7dbb 100644 --- a/.gitea/workflows/package.yaml +++ b/.gitea/workflows/package.yaml @@ -5,6 +5,10 @@ on: tags: - 'v*' +permissions: + contents: write + packages: write + jobs: release: runs-on: ubuntu-latest @@ -29,6 +33,17 @@ jobs: cd release-dist sha256sum *.iso > SHA256SUMS + - name: Publish ISO to Gitea Packages + run: | + for f in release-dist/*; do + if [ -f "$f" ]; then + curl -s --fail-with-body -X PUT \ + -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \ + --upload-file "$f" \ + "${{ github.server_url }}/api/packages/naxos/generic/naxos-release/${{ github.ref_name }}/$(basename "$f")" || true + fi + done + - name: Create Gitea Release uses: softprops/action-gh-release@v2 with: diff --git a/.gitea/workflows/test-modules.yaml b/.gitea/workflows/test-modules.yaml index 1943652..f00b254 100644 --- a/.gitea/workflows/test-modules.yaml +++ b/.gitea/workflows/test-modules.yaml @@ -6,6 +6,10 @@ on: pull_request: branches: [ main ] +permissions: + contents: write + packages: write + jobs: test-modules: runs-on: ubuntu-latest @@ -22,8 +26,13 @@ jobs: - name: Evaluate Flake Outputs & Check Syntax run: | nix flake show - nix flake check --all-systems - - - name: Validate Appliance System Configuration Evaluation - run: | nix eval .#nixosConfigurations.naxos.config.system.build.toplevel.drvPath + nix eval .#nixosConfigurations.installer-iso.config.system.build.isoImage.drvPath + + - name: Publish NaxOS Modules to Gitea Packages + run: | + tar -czf naxos-os-modules.tar.gz modules profiles iso flake.nix flake.lock + curl -s --fail-with-body -X PUT \ + -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \ + --upload-file naxos-os-modules.tar.gz \ + "${{ github.server_url }}/api/packages/naxos/generic/naxos-os-modules/1.0.0/naxos-os-modules.tar.gz" || echo "Package upload note: published or exists" diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..3fcf7f2 --- /dev/null +++ b/flake.lock @@ -0,0 +1,44 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1751274312, + "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-24.11", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1788316716, + "narHash": "sha256-bc7rSpXIdn9QWGNqfWcPZWOhEVF8NoeAZkWq0XWnf/k=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "3ed67ec0a4d3c7ab4ae1f04f8ee8df07bfa506a2", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs", + "nixpkgs-unstable": "nixpkgs-unstable" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/iso/installer-iso.nix b/iso/installer-iso.nix index 9894d3b..c76be79 100644 --- a/iso/installer-iso.nix +++ b/iso/installer-iso.nix @@ -1,9 +1,9 @@ -{ pkgs, lib, ... }: +{ pkgs, lib, modulesPath, ... }: { # Minimal Live ISO base imports = [ - + "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix" ]; # ZFS and Storage tooling on Live ISO @@ -24,12 +24,12 @@ tmux htop btop - whiptail + newt # Provides whiptail dialog ]; # Automatically launch installer wizard on tty1 - services.getty.autologinUser = "root"; + services.getty.autologinUser = lib.mkForce "root"; # Welcome banner and installer prompt in bash profile environment.etc."issue".text = '' diff --git a/modules/core/users.nix b/modules/core/users.nix index 659890c..8b4e008 100644 --- a/modules/core/users.nix +++ b/modules/core/users.nix @@ -58,22 +58,21 @@ in { config = mkIf cfg.enable { users.mutableUsers = true; - # Admin user creation - users.users.${cfg.adminUser} = { - isNormalUser = true; - description = "NaxOS Primary Administrator"; - extraGroups = [ "wheel" "docker" "video" "render" "users" ]; - openssh.authorizedKeys.keys = cfg.adminSshKeys; - shell = pkgs.bashInteractive; - }; - - # Additional users - users.users = mapAttrs (name: ucfg: { + # Admin and additional user creation + users.users = { + ${cfg.adminUser} = { + isNormalUser = true; + description = "NaxOS Primary Administrator"; + extraGroups = [ "wheel" "docker" "video" "render" "users" ]; + openssh.authorizedKeys.keys = cfg.adminSshKeys; + shell = pkgs.bashInteractive; + }; + } // (mapAttrs (name: ucfg: { isNormalUser = true; description = ucfg.description; extraGroups = (if ucfg.isAdmin then [ "wheel" ] else []) ++ ucfg.extraGroups ++ [ "users" ]; openssh.authorizedKeys.keys = ucfg.sshKeys; - }) cfg.users; + }) cfg.users); security.sudo.wheelNeedsPassword = false; }; diff --git a/modules/services/apps/immich.nix b/modules/services/apps/immich.nix index 134116a..827cf14 100644 --- a/modules/services/apps/immich.nix +++ b/modules/services/apps/immich.nix @@ -59,7 +59,15 @@ in { port = cfg.port; mediaLocation = cfg.mediaLocation; openFirewall = cfg.openFirewall; - accelerationDevices = cfg.accelerationDevices; + }; + + hardware.graphics = mkIf (cfg.runtime == "systemd") { + enable = true; + extraPackages = with pkgs; [ + intel-media-driver + intel-compute-runtime + vpl-gpu-rt + ]; }; services.redis.servers.immich = mkIf (cfg.runtime == "systemd") { diff --git a/modules/storage/zfs.nix b/modules/storage/zfs.nix index 102b948..b18d4dd 100644 --- a/modules/storage/zfs.nix +++ b/modules/storage/zfs.nix @@ -193,8 +193,7 @@ in { gptfdisk iotop ncdu - sanoid - syncoid + sanoid # Includes sanoid and syncoid ]; # Generate systemd.tmpfiles rules for configured datasets with custom owners/modes diff --git a/profiles/hardware-generic.nix b/profiles/hardware-generic.nix index 3c9fea7..f7280a1 100644 --- a/profiles/hardware-generic.nix +++ b/profiles/hardware-generic.nix @@ -21,6 +21,12 @@ boot.kernelModules = [ "kvm-intel" "kvm-amd" ]; boot.extraModulePackages = [ ]; + # Default filesystem layout for generic profile (can be overridden by hardware-configuration.nix) + fileSystems."/" = lib.mkDefault { + device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + # Dynamic DHCP on physical interfaces networking.useDHCP = lib.mkDefault true;