refactor(nix): consolidate deploy flake into root flake with pure ISO builds

Move deploy/nixos/flake.nix into the root flake.nix, adding mkAtmApp
for pure Nix builds of the Electron app (no local pnpm needed). Simplify
build-iso.sh to a thin wrapper around `nix build .#iso-<model>`. Add
douro hardware configuration. Streamline live.nix to consume the
Nix-built app package.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Patrick Mulligan 2026-02-27 10:58:43 -05:00
commit 625cebed25
8 changed files with 832 additions and 342 deletions

View file

@ -2,6 +2,7 @@
# Build a bootable NixOS Live USB ISO for testing the ATM Electron app
# on physical hardware.
#
# The build is fully pure — no local pnpm or .env manipulation needed.
# After booting, provision credentials with: bash provision-atm.sh <atm-ip>
#
# Usage: bash build-iso.sh <model>
@ -19,100 +20,26 @@ if [ -z "$MODEL" ]; then
exit 1
fi
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
MACHINE_DIR="$REPO_ROOT/apps/machine"
ENV_FILE="$MACHINE_DIR/.env"
ENV_BACKUP=""
echo "=== Building Lamassu ATM Live USB ISO (model: $MODEL) ==="
# Step 1: Set machine-specific .env for Vite build (VITE_ vars are compile-time)
echo ""
echo "--- Step 1: Configuring .env for $MODEL ---"
if [ -f "$ENV_FILE" ]; then
ENV_BACKUP="$ENV_FILE.build-backup"
cp "$ENV_FILE" "$ENV_BACKUP"
echo "Backed up existing .env"
fi
# Write model-specific env (production endpoints baked into the build)
cat > "$ENV_FILE" << 'ENVEOF'
VITE_RELAY_URL=wss://relay.atm.aiolabs.dev
VITE_LIGHTNING_PUB_PUBKEY=64b0d9b1af689e99e4b8a23ee7b77715b394740a6830bdccf4718a060a53649a
VITE_LIGHTNING_PUB_API_URL=https://lp.atm.aiolabs.dev
VITE_ADMIN_TOKEN=lamassu-dev-admin-token
VITE_ATM_PRIVATE_KEY=f391a2c3fc734f443b0f685688a0441b5fb9805853c0023f570c5a3c6412b136
VITE_EXTENSION_API_URL=https://lp-ext.atm.aiolabs.dev
VITE_APP_ID=6016dadc6c677f131bc82cc0cb780d2b1090b83b8b7d0c972e469010270a4208
VITE_LNDCONNECT_URL=lndconnect://lnd.atm.aiolabs.dev:443?cert=&macaroon=AgEDbG5kAvgBAwoQjLYgcUni_8EKmwpX_vwOWxIBMBoWCgdhZGRyZXNzEgRyZWFkEgV3cml0ZRoTCgRpbmZvEgRyZWFkEgV3cml0ZRoXCghpbnZvaWNlcxIEcmVhZBIFd3JpdGUaIQoIbWFjYXJvb24SCGdlbmVyYXRlEgRyZWFkEgV3cml0ZRoWCgdtZXNzYWdlEgRyZWFkEgV3cml0ZRoXCghvZmZjaGFpbhIEcmVhZBIFd3JpdGUaFgoHb25jaGFpbhIEcmVhZBIFd3JpdGUaFAoFcGVlcnMSBHJlYWQSBXdyaXRlGhgKBnNpZ25lchIIZ2VuZXJhdGUSBHJlYWQAAAYgClsDux9_gPaKUK7PI54y-sTwt5WGmSzrzfKaKamwvK0
ENVEOF
# Append model-specific config
case "$MODEL" in
douro)
cat >> "$ENV_FILE" << 'EOF'
VITE_LAMASSU_MACHINE_MODEL=douro
VITE_LAMASSU_FIAT_CODE=GTQ
EOF
;;
tejo)
cat >> "$ENV_FILE" << 'EOF'
VITE_LAMASSU_MACHINE_MODEL=tejo
VITE_LAMASSU_FIAT_CODE=GTQ
EOF
;;
sintra)
cat >> "$ENV_FILE" << 'EOF'
VITE_LAMASSU_MACHINE_MODEL=sintra
VITE_LAMASSU_FIAT_CODE=EUR
EOF
;;
douro|tejo|sintra) ;;
*)
echo "ERROR: Unknown model '$MODEL'. Use 'douro', 'tejo', or 'sintra'."
# Restore backup
if [ -n "$ENV_BACKUP" ]; then
mv "$ENV_BACKUP" "$ENV_FILE"
fi
exit 1
;;
esac
echo "Set VITE_LAMASSU_MACHINE_MODEL=$MODEL"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
# Step 2: Build the Electron app (with model-specific .env baked in)
echo "=== Building Lamassu ATM Live USB ISO (model: $MODEL) ==="
echo ""
echo "--- Step 2: Building Electron app ---"
echo "This is a pure Nix build — no local pnpm required."
echo ""
cd "$REPO_ROOT"
pnpm run build --filter=@lamassu/machine
nix build ".#iso-${MODEL}" --show-trace
# Restore original .env
if [ -n "$ENV_BACKUP" ]; then
mv "$ENV_BACKUP" "$ENV_FILE"
echo "Restored original .env"
fi
# Step 3: Verify build outputs exist
echo ""
echo "--- Step 3: Verifying build outputs ---"
if [ ! -d "$MACHINE_DIR/dist" ]; then
echo "ERROR: $MACHINE_DIR/dist not found. Build failed?"
exit 1
fi
if [ ! -d "$MACHINE_DIR/dist-electron" ]; then
echo "ERROR: $MACHINE_DIR/dist-electron not found. Build failed?"
exit 1
fi
echo "OK: dist/ and dist-electron/ present"
# Step 4: Build the NixOS ISO
echo ""
echo "--- Step 4: Building NixOS ISO for $MODEL (this takes a while) ---"
cd "$SCRIPT_DIR"
export MACHINE_DIR="$MACHINE_DIR"
nix build ".#iso-${MODEL}" --impure --show-trace
# Step 5: Print results
# Print results
ISO_PATH=$(ls result/iso/*.iso 2>/dev/null | head -1)
if [ -z "$ISO_PATH" ]; then
echo "ERROR: ISO not found in result/iso/"

View file

@ -1,44 +0,0 @@
{
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1735563628,
"narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1771177547,
"narHash": "sha256-trTtk3WTOHz7hSw89xIIvahkgoFJYQ0G43IlqprFoMA=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "ac055f38c798b0d87695240c7b761b82fc7e5bc2",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs",
"nixpkgs-unstable": "nixpkgs-unstable"
}
}
},
"root": "root",
"version": 7
}

View file

@ -1,71 +0,0 @@
{
description = "Lamassu Next ATM - NixOS Deployment";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
# For Electron/Node.js packaging
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
};
outputs = { self, nixpkgs, nixpkgs-unstable }:
let
system = "x86_64-linux";
pkgs = import nixpkgs {
inherit system;
config.allowUnfree = true;
};
pkgs-unstable = import nixpkgs-unstable {
inherit system;
config.allowUnfree = true;
};
# Helper to create a live USB config for a specific machine model
mkLiveConfig = machineModel: nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit pkgs-unstable nixpkgs machineModel; };
modules = [ ./live.nix ];
};
in
{
# NixOS configuration for UP Board ATM (installed to disk)
nixosConfigurations.lamassu-atm = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit pkgs-unstable; };
modules = [
./hardware/upboard.nix
./configuration.nix
./lamassu-atm.nix
];
};
# Live USB configurations per machine model
nixosConfigurations.lamassu-live-douro = mkLiveConfig "douro";
nixosConfigurations.lamassu-live-tejo = mkLiveConfig "tejo";
nixosConfigurations.lamassu-live-sintra = mkLiveConfig "sintra";
# Keep generic for backwards compat
nixosConfigurations.lamassu-live = mkLiveConfig "douro";
# Standalone module for importing into existing NixOS configs
nixosModules.default = import ./lamassu-atm.nix;
nixosModules.lamassu-atm = import ./lamassu-atm.nix;
packages.${system} = {
# ISO images per machine model
iso-douro = self.nixosConfigurations.lamassu-live-douro.config.system.build.isoImage;
iso-tejo = self.nixosConfigurations.lamassu-live-tejo.config.system.build.isoImage;
iso-sintra = self.nixosConfigurations.lamassu-live-sintra.config.system.build.isoImage;
# Default (backwards compat)
iso = self.nixosConfigurations.lamassu-live.config.system.build.isoImage;
# SD card image (if needed)
sdcard = self.nixosConfigurations.lamassu-atm.config.system.build.sdImage;
};
};
}

View file

@ -0,0 +1,89 @@
# Douro (Bay Trail) Hardware Configuration
# Bay Trail Atom SoC with eDP panel, mSATA internal storage.
#
# Kernel 5.15 LTS required: i915 eDP display regression in 6.x kernels
# causes blank screen on Bay Trail with embedded DisplayPort panels.
{ config, lib, pkgs, ... }:
{
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
timeout = 3;
};
# Bay Trail needs 5.15 LTS (i915 eDP regression in 6.x)
kernelPackages = pkgs.linuxPackages_5_15;
initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"usb_storage"
"sd_mod"
"sdhci_pci"
"i915"
];
kernelModules = [
"kvm-intel"
"i2c-dev"
"spi-dev"
];
kernelParams = [
"i915.enable_psr=0"
"vt.handoff=7" # Bay Trail: preserve BIOS display init
"quiet"
"splash"
];
};
# Disk layout: GPT with ESP (sda1) + ext4 root (sda2)
fileSystems."/" = {
device = "/dev/disk/by-label/nixos";
fsType = "ext4";
};
# make-disk-image.nix labels the ESP as "ESP" (not "boot")
fileSystems."/boot" = {
device = "/dev/disk/by-label/ESP";
fsType = "vfat";
};
# NixOS 24.05 uses hardware.opengl (not hardware.graphics)
hardware = {
opengl = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver
vaapiIntel
vaapiVdpau
libvdpau-va-gl
];
};
enableRedistributableFirmware = true;
cpu.intel.updateMicrocode = true;
};
powerManagement = {
enable = true;
cpuFreqGovernor = "performance";
};
# Disable suspend/hibernate for kiosk
systemd.targets = {
sleep.enable = false;
suspend.enable = false;
hibernate.enable = false;
hybrid-sleep.enable = false;
};
# Serial port access for bill validator/dispenser
services.udev.extraRules = lib.mkAfter ''
KERNEL=="ttyS[0-9]*", MODE="0666"
KERNEL=="ttyUSB[0-9]*", MODE="0666"
KERNEL=="ttyACM[0-9]*", MODE="0666"
'';
}

View file

@ -10,100 +10,27 @@
# Does NOT import hardware/upboard.nix (its fileSystems conflict with live boot).
# Instead, duplicates only the hardware-relevant kernel modules and GPU config.
{ config, lib, pkgs, pkgs-unstable, nixpkgs, machineModel ? "douro", ... }:
{ config, lib, pkgs, pkgs-unstable, nixpkgs, machineModel ? "douro", atm-app, ... }:
let
# Pre-built Electron app copied into the Nix store.
# Build first: pnpm run build --filter=@lamassu/machine
# Requires --impure: reads MACHINE_DIR env var to find build artifacts (dist/ is gitignored)
machineDir = builtins.getEnv "MACHINE_DIR";
# Resolve pnpm virtual store paths for native modules
pnpmStore = machineDir + "/../../node_modules/.pnpm";
betterSqliteStore = pnpmStore + "/better-sqlite3@11.10.0/node_modules";
bindingsStore = pnpmStore + "/bindings@1.5.0/node_modules";
fileUriStore = pnpmStore + "/file-uri-to-path@1.0.0/node_modules";
# HAL package (workspace dep, resolved via symlink in pnpm)
halDir = machineDir + "/../../packages/hal";
# serialport and its transitive native deps (required by @lamassu/hal at runtime)
serialportStore = pnpmStore + "/serialport@12.0.0/node_modules";
serialportStreamStore = pnpmStore + "/@serialport+stream@12.0.0/node_modules/@serialport";
serialportBindingsCppStore = pnpmStore + "/@serialport+bindings-cpp@12.0.1/node_modules/@serialport";
serialportBindingsIfaceStore = pnpmStore + "/@serialport+bindings-interface@1.2.2/node_modules/@serialport";
serialportBindingMockStore = pnpmStore + "/@serialport+binding-mock@10.2.2/node_modules/@serialport";
# serialport parser sub-packages (barrel import in serialport@12 eagerly requires all of these)
parserStore = suffix: pnpmStore + "/@serialport+${suffix}@12.0.0/node_modules/@serialport";
debugStore = pnpmStore + "/debug@4.3.4/node_modules";
msStore = pnpmStore + "/ms@2.1.2/node_modules";
nodeAddonApiStore = pnpmStore + "/node-addon-api@7.0.0/node_modules";
nodeGypBuildStore = pnpmStore + "/node-gyp-build@4.6.0/node_modules";
lodashEsStore = pnpmStore + "/lodash-es@4.17.23/node_modules";
# Fiat code per machine model
# Fiat code per machine model (for envTemplate display only)
fiatCodeForModel = {
douro = "GTQ";
tejo = "GTQ";
sintra = "EUR";
}.${machineModel} or "USD";
atm-app = assert machineDir != ""
|| throw "MACHINE_DIR env var must be set (use build-iso.sh or: export MACHINE_DIR=/path/to/apps/machine)";
pkgs.runCommand "lamassu-atm-app" { } ''
mkdir -p $out/node_modules/@lamassu $out/node_modules/@serialport
cp -r ${builtins.path { path = machineDir + "/dist"; name = "dist"; }} $out/dist
cp -r ${builtins.path { path = machineDir + "/dist-electron"; name = "dist-electron"; }} $out/dist-electron
cp ${builtins.path { path = machineDir + "/package.json"; name = "package.json"; }} $out/package.json
# Native modules required at runtime (not bundled by Vite)
# Resolved from pnpm virtual store to get real files (not symlinks)
cp -rL ${builtins.path { path = betterSqliteStore + "/better-sqlite3"; name = "better-sqlite3"; }} $out/node_modules/better-sqlite3
cp -rL ${builtins.path { path = bindingsStore + "/bindings"; name = "bindings"; }} $out/node_modules/bindings
cp -rL ${builtins.path { path = fileUriStore + "/file-uri-to-path"; name = "file-uri-to-path"; }} $out/node_modules/file-uri-to-path
# @lamassu/hal (workspace package, dynamically imported for hardware access)
mkdir -p $out/node_modules/@lamassu/hal/dist
cp -rL ${builtins.path { path = halDir + "/dist"; name = "hal-dist"; }}/* $out/node_modules/@lamassu/hal/dist/
cp ${builtins.path { path = halDir + "/package.json"; name = "hal-package-json"; }} $out/node_modules/@lamassu/hal/package.json
# serialport and transitive deps (native module chain for RS232 hardware)
cp -rL ${builtins.path { path = serialportStore + "/serialport"; name = "serialport"; }} $out/node_modules/serialport
cp -rL ${builtins.path { path = serialportStreamStore + "/stream"; name = "serialport-stream"; }} $out/node_modules/@serialport/stream
# bindings-cpp: copy only dist/ + prebuilds/ + package.json (build/ has broken symlinks)
mkdir -p $out/node_modules/@serialport/bindings-cpp
cp -rL ${builtins.path { path = serialportBindingsCppStore + "/bindings-cpp/dist"; name = "serialport-bindings-cpp-dist"; }} $out/node_modules/@serialport/bindings-cpp/dist
cp -rL ${builtins.path { path = serialportBindingsCppStore + "/bindings-cpp/prebuilds"; name = "serialport-bindings-cpp-prebuilds"; }} $out/node_modules/@serialport/bindings-cpp/prebuilds
cp ${builtins.path { path = serialportBindingsCppStore + "/bindings-cpp/package.json"; name = "serialport-bindings-cpp-pkg"; }} $out/node_modules/@serialport/bindings-cpp/package.json
cp -rL ${builtins.path { path = serialportBindingsIfaceStore + "/bindings-interface"; name = "serialport-bindings-interface"; }} $out/node_modules/@serialport/bindings-interface
cp -rL ${builtins.path { path = serialportBindingMockStore + "/binding-mock"; name = "serialport-binding-mock"; }} $out/node_modules/@serialport/binding-mock
cp -rL ${builtins.path { path = debugStore + "/debug"; name = "debug"; }} $out/node_modules/debug
cp -rL ${builtins.path { path = msStore + "/ms"; name = "ms"; }} $out/node_modules/ms
cp -rL ${builtins.path { path = nodeAddonApiStore + "/node-addon-api"; name = "node-addon-api"; }} $out/node_modules/node-addon-api
cp -rL ${builtins.path { path = nodeGypBuildStore + "/node-gyp-build"; name = "node-gyp-build"; }} $out/node_modules/node-gyp-build
cp -rL ${builtins.path { path = lodashEsStore + "/lodash-es"; name = "lodash-es"; }} $out/node_modules/lodash-es
# serialport parser sub-packages (barrel import requires all 10)
cp -rL ${builtins.path { path = parserStore "parser-byte-length" + "/parser-byte-length"; name = "parser-byte-length"; }} $out/node_modules/@serialport/parser-byte-length
cp -rL ${builtins.path { path = parserStore "parser-cctalk" + "/parser-cctalk"; name = "parser-cctalk"; }} $out/node_modules/@serialport/parser-cctalk
cp -rL ${builtins.path { path = parserStore "parser-delimiter" + "/parser-delimiter"; name = "parser-delimiter"; }} $out/node_modules/@serialport/parser-delimiter
cp -rL ${builtins.path { path = parserStore "parser-inter-byte-timeout" + "/parser-inter-byte-timeout"; name = "parser-inter-byte-timeout"; }} $out/node_modules/@serialport/parser-inter-byte-timeout
cp -rL ${builtins.path { path = parserStore "parser-packet-length" + "/parser-packet-length"; name = "parser-packet-length"; }} $out/node_modules/@serialport/parser-packet-length
cp -rL ${builtins.path { path = parserStore "parser-readline" + "/parser-readline"; name = "parser-readline"; }} $out/node_modules/@serialport/parser-readline
cp -rL ${builtins.path { path = parserStore "parser-ready" + "/parser-ready"; name = "parser-ready"; }} $out/node_modules/@serialport/parser-ready
cp -rL ${builtins.path { path = parserStore "parser-regex" + "/parser-regex"; name = "parser-regex"; }} $out/node_modules/@serialport/parser-regex
cp -rL ${builtins.path { path = parserStore "parser-slip-encoder" + "/parser-slip-encoder"; name = "parser-slip-encoder"; }} $out/node_modules/@serialport/parser-slip-encoder
cp -rL ${builtins.path { path = parserStore "parser-spacepacket" + "/parser-spacepacket"; name = "parser-spacepacket"; }} $out/node_modules/@serialport/parser-spacepacket
'';
# .env template with regtest defaults pointing to the dev machine
# .env template — runtime secrets are provisioned later via provision-atm.sh.
# Only non-secret defaults and display vars go here.
envTemplate = pkgs.writeText "lamassu-atm-env" ''
VITE_RELAY_URL=wss://relay.atm.aiolabs.dev
VITE_LIGHTNING_PUB_PUBKEY=64b0d9b1af689e99e4b8a23ee7b77715b394740a6830bdccf4718a060a53649a
VITE_LIGHTNING_PUB_API_URL=https://lp.atm.aiolabs.dev
VITE_ADMIN_TOKEN=lamassu-dev-admin-token
VITE_ATM_PRIVATE_KEY=f391a2c3fc734f443b0f685688a0441b5fb9805853c0023f570c5a3c6412b136
VITE_EXTENSION_API_URL=https://lp-ext.atm.aiolabs.dev
VITE_APP_ID=6016dadc6c677f131bc82cc0cb780d2b1090b83b8b7d0c972e469010270a4208
VITE_LNDCONNECT_URL=lndconnect://lnd.atm.aiolabs.dev:443?cert=&macaroon=AgEDbG5kAvgBAwoQjLYgcUni_8EKmwpX_vwOWxIBMBoWCgdhZGRyZXNzEgRyZWFkEgV3cml0ZRoTCgRpbmZvEgRyZWFkEgV3cml0ZRoXCghpbnZvaWNlcxIEcmVhZBIFd3JpdGUaIQoIbWFjYXJvb24SCGdlbmVyYXRlEgRyZWFkEgV3cml0ZRoWCgdtZXNzYWdlEgRyZWFkEgV3cml0ZRoXCghvZmZjaGFpbhIEcmVhZBIFd3JpdGUaFgoHb25jaGFpbhIEcmVhZBIFd3JpdGUaFAoFcGVlcnMSBHJlYWQSBXdyaXRlGhgKBnNpZ25lchIIZ2VuZXJhdGUSBHJlYWQAAAYgClsDux9_gPaKUK7PI54y-sTwt5WGmSzrzfKaKamwvK0
VITE_RELAY_URL=
VITE_LIGHTNING_PUB_PUBKEY=
VITE_LIGHTNING_PUB_API_URL=
VITE_ADMIN_TOKEN=
VITE_ATM_PRIVATE_KEY=
VITE_EXTENSION_API_URL=
VITE_APP_ID=
VITE_LNDCONNECT_URL=
VITE_LAMASSU_MACHINE_MODEL=${machineModel}
VITE_LAMASSU_FIAT_CODE=${fiatCodeForModel}
ELECTRON_FORCE_PROD=1