From 34179a4e34b3ca3f9154e0c2bc3a5f2599f51f5f Mon Sep 17 00:00:00 2001 From: Patrick Mulligan Date: Fri, 27 Feb 2026 14:42:49 -0500 Subject: [PATCH] feat(deploy): add auto-upgrade, cachix, and passwordless sudo for douro-installed - Passwordless sudo for lamassu user (nixos-rebuild without TTY) - Cachix binary cache (aiolabs) as substituter - Daily auto-upgrade timer pulling latest flake from Forgejo - trusted-users includes lamassu for nix commands Co-Authored-By: Claude Opus 4.6 --- flake.nix | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/flake.nix b/flake.nix index ec3d050..e111a43 100644 --- a/flake.nix +++ b/flake.nix @@ -96,6 +96,28 @@ # Electron sandbox needs unprivileged user namespaces boot.kernel.sysctl."kernel.unprivileged_userns_clone" = 1; + # Passwordless sudo for remote nixos-rebuild switch + security.sudo.wheelNeedsPassword = false; + + # Allow lamassu user to use nix commands + pull from aiolabs binary cache + nix.settings = { + trusted-users = [ "root" "lamassu" ]; + substituters = [ "https://cache.nixos.org" "https://aiolabs.cachix.org" ]; + trusted-public-keys = [ + "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" + "aiolabs.cachix.org-1:PrAjsGU9PE77tFKP2+iO+mgR88c4xv3utM9JmpTblUQ=" + ]; + }; + + # Auto-upgrade: pulls latest flake and runs nixos-rebuild switch + # To update manually: sudo nixos-rebuild switch --flake git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git#douro-installed + system.autoUpgrade = { + enable = true; + flake = "git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git#douro-installed"; + dates = "04:00"; # daily at 4am + allowReboot = false; + }; + # Env template — runtime secrets provisioned via provision-atm.sh system.activationScripts.lamassu-env = '' mkdir -p /var/lib/lamassu-atm