MythEclipse/imphnen-frontend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: simplify deploy - SSH into server and nixos-rebuild

Browse Source 
Server pulls pre-built packages from Cachix, no need to build
the NixOS closure in CI. Just update flake.lock and trigger
a remote rebuild.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
maulanasdqn
2026-03-31 14:30:13 +07:00
co-authored by Claude Opus 4.6
parent e14f6d4ef7
commit aef8d59c9f
1 changed files with 7 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/nix-build.yml
+7 -20
View File
@@ -72,12 +72,6 @@ jobs:
- name: Install Nix - name: Install Nix
uses: DeterminateSystems/nix-installer-action@main uses: DeterminateSystems/nix-installer-action@main
- name: Setup Cachix
uses: cachix/cachix-action@v15
with:
name: msdqn
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- name: Setup SSH - name: Setup SSH
env: env:
INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }} INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
@@ -93,34 +87,27 @@ jobs:
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null
- name: Clone infrastructure - name: Update infra flake.lock
run: | run: |
export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes" export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes"
git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra
cd /tmp/infra
- name: Update flake.lock
working-directory: /tmp/infra
run: |
nix flake update imphnen-frontend nix flake update imphnen-frontend
if git diff --quiet flake.lock; then if git diff --quiet flake.lock; then
echo "flake.lock unchanged, skipping commit" echo "flake.lock unchanged, skipping"
else else
git config user.name "github-actions[bot]" git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com" git config user.email "github-actions[bot]@users.noreply.github.com"
export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes"
git add flake.lock git add flake.lock
git commit -m "chore: update imphnen-frontend-service to ${GITHUB_SHA::7}" git commit -m "chore: update imphnen-frontend-service to ${GITHUB_SHA::7}"
git push git push
fi fi
- name: Deploy with clan - name: Deploy to server
working-directory: /tmp/infra
run: | run: |
if [ -f ~/.ssh/server_key ]; then ssh -i ~/.ssh/server_key -o StrictHostKeyChecking=accept-new root@167.235.70.37 \
export NIX_SSHOPTS="-i $HOME/.ssh/server_key -o StrictHostKeyChecking=accept-new" 'nixos-rebuild switch --flake github:IMPHNEN/imphnen-infrastructure#hetzner --refresh 2>&1 | tail -30'
fi
nix develop .#default --command clan machines update hetzner
- name: Cleanup SSH keys - name: Cleanup
if: always() if: always()
run: rm -f ~/.ssh/infra_deploy ~/.ssh/server_key run: rm -f ~/.ssh/infra_deploy ~/.ssh/server_key