feat(core): initialize NaxOS declarative NixOS distribution, modules, and ISO installer

2026-09-03 23:53:18 +02:00
parent 88a638955b
commit 5da58ae6d7
28 changed files with 2247 additions and 2 deletions
@@ -0,0 +1,111 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.naxos.gitops;
+
+  # Safe switch script with canary validation and automatic rollback
+  naxosRebuildWrapper = pkgs.writeShellScriptBin "naxos-rebuild-safe" ''
+    set -euo pipefail
+    CONFIG_DIR="''${CONFIG_DIR:-/etc/naxos/repo}"
+    LOG_FILE="/var/log/naxos-rebuild.log"
+
+    echo "[$(date -Iseconds)] Starting NaxOS declarative rebuild..." | tee -a "$LOG_FILE"
+
+    cd "$CONFIG_DIR"
+
+    # Pre-flight check with nix flake check / nixos-rebuild dry-build
+    echo "Running dry build validation..."
+    if ! nixos-rebuild build --flake .#naxos 2>&1 | tee -a "$LOG_FILE"; then
+      echo "Dry-build failed! Configuration aborted without changing running system." | tee -a "$LOG_FILE"
+      exit 1
+    fi
+
+    # Record current generation
+    PREV_GEN=$(readlink -f /nix/var/nix/profiles/system)
+
+    echo "Applying system switch..."
+    if nixos-rebuild switch --flake .#naxos 2>&1 | tee -a "$LOG_FILE"; then
+      echo "System switch succeeded." | tee -a "$LOG_FILE"
+
+      # Canary health check: verify management daemon and storage pools are responsive
+      if systemctl is-active --quiet naxos-api.service; then
+        echo "Canary verification passed: NaxOS daemon active." | tee -a "$LOG_FILE"
+        exit 0
+      else
+        echo "WARNING: NaxOS daemon failed canary test! Initiating safe automatic rollback..." | tee -a "$LOG_FILE"
+        "$PREV_GEN/bin/switch-to-configuration" switch
+        exit 2
+      fi
+    else
+      echo "Switch command failed! Rolling back to $PREV_GEN..." | tee -a "$LOG_FILE"
+      "$PREV_GEN/bin/switch-to-configuration" switch
+      exit 3
+    fi
+  '';
+
+  # Automated remote push/pull service
+  naxosGitSync = pkgs.writeShellScriptBin "naxos-git-sync" ''
+    set -euo pipefail
+    REPO_DIR="/etc/naxos/repo"
+    
+    if [ ! -d "$REPO_DIR/.git" ]; then
+      echo "Git repository not initialized in $REPO_DIR."
+      exit 0
+    fi
+
+    cd "$REPO_DIR"
+
+    if [ -n "''${NAXOS_REMOTE_URL:-}" ]; then
+      echo "Synchronizing with remote GitOps repository..."
+      git fetch origin main || true
+      git push origin main || true
+    fi
+  '';
+
+in {
+  options.services.naxos.gitops = {
+    enable = mkEnableOption "NaxOS GitOps Configuration Synchronization Engine";
+
+    remoteUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "ssh://git@git.lholz.de:2222/naxos/naxos-config.git";
+      description = "Remote Git repository URL for automated backup, auditing, and disaster recovery.";
+    };
+
+    branch = mkOption {
+      type = types.str;
+      default = "main";
+      description = "GitOps target branch.";
+    };
+
+    tokenFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Path to Gitea/Git access token or SSH private key.";
+    };
+
+    autoPushOnCommit = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Automatically push to remote repository whenever web dashboard commits a change.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      git
+      naxosRebuildWrapper
+      naxosGitSync
+    ];
+
+    # Create config repo directory structure
+    systemd.tmpfiles.rules = [
+      "d /etc/naxos 0755 root root -"
+      "d /etc/naxos/repo 0750 root root -"
+      "d /var/log 0755 root root -"
+    ];
+  };
+}