1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
# krops (krebs ops)
krops is a lightweigt toolkit to deploy NixOS systems, remotely or locally.
## Some Features
- store your secrets in [password store](https://www.passwordstore.org/)
- build your system remotely
- minimal overhead (it's basically just `nixos-rebuild switch`!)
- run from custom nixpkgs branch/checkout/fork
## Minimal Example
Create a file named `krops.nix` (name doesn't matter) with following content:
```nix
let
krops = (import <nixpkgs> {}).fetchgit {
url = https://cgit.krebsco.de/krops/;
rev = "v1.17.0";
sha256 = "150jlz0hlb3ngf9a1c9xgcwzz1zz8v2lfgnzw08l3ajlaaai8smd";
};
lib = import "${krops}/lib";
pkgs = import "${krops}/pkgs" {};
source = lib.evalSource [{
nixpkgs.git = {
clean.exclude = ["/.version-suffix"];
ref = "4b4bbce199d3b3a8001ee93495604289b01aaad3";
url = https://github.com/NixOS/nixpkgs;
};
nixos-config.file = toString (pkgs.writeText "nixos-config" ''
{ pkgs, ... }: {
fileSystems."/" = { device = "/dev/sda1"; };
boot.loader.systemd-boot.enable = true;
services.openssh.enable = true;
environment.systemPackages = [ pkgs.git ];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa ADD_YOUR_OWN_PUBLIC_KEY_HERE user@localhost"
];
}
'');
}];
in
pkgs.krops.writeDeploy "deploy" {
source = source;
target = "root@YOUR_IP_ADDRESS_OR_HOST_NAME_HERE";
}
```
and run `$(nix-build --no-out-link krops.nix)` to deploy the target machine.
Under the hood, this will make the sources available on the target machine
below `/var/src`, and execute `nixos-rebuild switch -I /var/src`.
## Deployment Target Attribute
The `target` attribute to `writeDeploy` can either be a string or an attribute
set, specifying where to make the sources available, as well as where to run
the deployment.
If specified as string, the format could be described as:
```
[[USER]@]HOST[:PORT][/SOME/PATH]
```
Portions in square brakets are optional.
If the `USER` is the empty string, as in e.g. `@somehost`, then the username
will be obtained by SSH from its configuration files.
If the `target` attribute is an attribute set, then it has to define the attributes
`host`, `path`, `port`, `sudo`, and `user`. This allows to deploy to targets
that don't allow sshing in as root, but allow (preferably passwordless) sudo:
```nix
pkgs.krops.writeDeploy "deploy" {
source = /* ... */;
target = lib.mkTarget "user@host/path" // {
sudo = true;
};
}
```
For more details about the `target` attribute, please check the `mkTarget`
function in lib/default.nix.
## Source Types
### `derivation`
Nix expression to be built at the target machine.
Supported attributes:
* `text` -
Nix expression to be built.
### `file`
The file source type transfers local files (and folders) to the target
using [`rsync`](https://rsync.samba.org/).
Supported attributes:
* `path` -
absolute path to files that should by transfered
* `useChecksum` (optional) -
boolean that controls whether file contents should be checked to decide
whether a file has changed. This is useful when `path` points at files
with mangled timestamps, e.g. the Nix store.
### `git`
Git sources that will be fetched on the target machine.
Supported attributes:
* `url` -
URL of the Git repository that should be fetched.
* `ref` -
Branch / tag / commit that should be fetched.
* `clean.exclude` -
List of patterns that should be excluded from Git cleaning.
### `pass`
The pass source type transfers contents from a local
[password store](https://www.passwordstore.org/) to the target machine.
Supported attributes:
* `dir` -
absolute path to the password store.
* `name` -
sub-directory in the password store.
### `pipe`
Executes a local command, capture its stdout, and send that as a file to the
target machine.
Supported attributes:
* `command` -
The (shell) command to run.
### `symlink`
Symlink to create at the target, relative to the target directory.
This can be used to reference files in other sources.
Supported attributes:
* `target` -
Content of the symlink. This is typically a relative path.
## References
- [In-depth example](http://tech.ingolf-wagner.de/nixos/krops/) by [Ingolf Wagner](https://ingolf-wagner.de/)
## Communication
Comments, questions, pull-requests, etc. are very welcome, and can be directed
at:
- IRC: #krebs at freenode
- Mail: [spam@krebsco.de](mailto:spam@krebsco.de)
|
