Merge pull request 'update-deployment-workflow' (#18) from update-deployment-workflow into master

Reviewed-on: #18

.forgejo/workflows/check.yml

@@ -1,3 +1,5 @@
+name: flake check
+
 on: [push]
 jobs:
   check:

.forgejo/workflows/deployment/deploy-systems.yml

@@ -0,0 +1,27 @@
+name: deploy systems
+
+on:
+  push:
+    paths:
+      - "**.lock"
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: install nix action
+        uses: https://github.com/DeterminateSystems/nix-installer-action@v5
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
+      - name: write private key
+        run: |
+          mkdir -p .ssh && cd .ssh
+          echo "$SSH_KEY" > forgejo
+          chmod 400 forgejo
+        shell: bash
+        env:
+          SSH_KEY: ${{secrets.SSH_DEPLOY_KEY}}
+      - name: deploy
+        run: |
+          cd .ssh
+          nix run github:serokell/deploy-rs -- --ssh-opts="-i forgejo -o StrictHostKeyChecking=no" --skip-checks --targets .#arashi .#kariru .#sakura .#sora .#yuki

.forgejo/workflows/fmt.yml

@@ -1,3 +1,5 @@
+name: fmt check
+
 on: [push]
 jobs:
   check:

hosts/arashi/default.nix

@@ -28,6 +28,9 @@
   };
 
   users.users.notoh.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKWRbIwwHuyEOLhA9dKTf4TgFqtPR5MNcJorKm731S7G arashi''
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKWRbIwwHuyEOLhA9dKTf4TgFqtPR5MNcJorKm731S7G arashi"
+  ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo"
   ];
 }

hosts/deploy.nix

@@ -1,54 +1,64 @@
 inputs: {
   nodes = with inputs.deploy-rs.lib.x86_64-linux; {
     sakura = {
-      hostname = "sakura";
+      hostname = "100.121.201.47";
       profiles.system = {
         user = "root";
         path = activate.nixos inputs.self.nixosConfigurations.sakura;
       };
-      sshUser = "notoh";
+      sshUser = "root";
-      sshOpts = ["-t" "-i" "~/.ssh/sakura"];
+      sshOpts = ["-t" "-i" "~/.ssh/forgejo"];
-      magicRollback = false;
+      magicRollback = true;
     };
     kariru = {
-      hostname = "kariru";
+      hostname = "100.126.229.95";
       profiles.system = {
         user = "root";
         path = activate.nixos inputs.self.nixosConfigurations.kariru;
       };
-      sshUser = "notoh";
+      sshUser = "root";
-      sshOpts = ["-t" "-i" "~/.ssh/kariru"];
+      sshOpts = ["-t" "-i" "~/.ssh/forgejo"];
-      magicRollback = false;
+      magicRollback = true;
     };
     yuki = {
-      hostname = "yuki";
+      hostname = "100.110.140.130";
       profiles.system = {
         user = "root";
         path = activate.nixos inputs.self.nixosConfigurations.yuki;
       };
-      sshUser = "notoh";
+      sshUser = "root";
-      sshOpts = ["-t" "-i" "~/.ssh/yuki"];
+      sshOpts = ["-t" "-i" "~/.ssh/forgejo"];
-      magicRollback = false;
+      magicRollback = true;
     };
     arashi = {
-      hostname = "arashi";
+      hostname = "100.94.214.100";
       profiles.system = {
         user = "root";
         path = activate.nixos inputs.self.nixosConfigurations.arashi;
       };
-      sshUser = "notoh";
+      sshUser = "root";
-      sshOpts = ["-t" "-i" "~/.ssh/arashi"];
+      sshOpts = ["-t" "-i" "~/.ssh/forgejo"];
-      magicRollback = false;
+      magicRollback = true;
     };
     sora = {
-      hostname = "sora";
+      hostname = "100.87.54.48";
       profiles.system = {
         user = "root";
         path = activate.nixos inputs.self.nixosConfigurations.sora;
       };
-      sshUser = "notoh";
+      sshUser = "root";
-      sshOpts = ["-t" "-i" "~/.ssh/kumo"];
+      sshOpts = ["-t" "-i" "~/.ssh/forgejo"];
-      magicRollback = false;
+      magicRollback = true;
+    };
+    tsuru = {
+      hostname = "100.82.146.40";
+      profiles.system = {
+        user = "root";
+        path = activate.nixos inputs.self.nixosConfigurations.tsuru;
+      };
+      sshUser = "root";
+      sshOpts = ["-t" "-i" "~/.ssh/forgejo"];
+      magicRollback = true;
     };
   };
 }

hosts/kariru/default.nix

@@ -24,6 +24,9 @@
   };
 
   users.users.notoh.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPmWafzbhah18nm2z1epc6139XVlcKT0ndAI0wbLj+/6 kariru''
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPmWafzbhah18nm2z1epc6139XVlcKT0ndAI0wbLj+/6 kariru"
+  ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo"
   ];
 }

hosts/sakura/default.nix

@@ -1,4 +1,4 @@
-{...}: {
+{pkgs, ...}: {
   imports = [
     ./hardware-configuration.nix
     ./services
@@ -26,6 +26,11 @@
   };
 
   users.users.notoh.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICqAjaV2D2J8ln4n39ZvszCF5Jql+0IaSpFCJlzDSLv6 sakura''
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICqAjaV2D2J8ln4n39ZvszCF5Jql+0IaSpFCJlzDSLv6 sakura"
   ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo"
+  ];
+
+  environment.systemPackages = [pkgs.cowsay];
 }

hosts/sora/default.nix

@@ -10,6 +10,9 @@ _: {
   zramSwap.enable = true;
   networking.hostName = "sora";
   users.users.notoh.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmI3hRDFjxLjrM3pE471e4jxSlcqeizh3iNVVdaMHeN sora''
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmI3hRDFjxLjrM3pE471e4jxSlcqeizh3iNVVdaMHeN sora"
+  ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo"
   ];
 }

hosts/tsuru/default.nix

@@ -24,6 +24,9 @@
   };
 
   users.users.notoh.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKwby2FLCKFZZlOLDRhsm9GckyYAuyk0mq28jRD02tdv tsuru''
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKwby2FLCKFZZlOLDRhsm9GckyYAuyk0mq28jRD02tdv tsuru"
+  ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo"
   ];
 }

hosts/yuki/default.nix

@@ -24,6 +24,9 @@
   };
 
   users.users.notoh.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLDqOjZIQQ+YYir9MQnlh8wgqI1dz5nYL054OnIgDa yuki''
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLDqOjZIQQ+YYir9MQnlh8wgqI1dz5nYL054OnIgDa yuki"
+  ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo"
   ];
 }

modules/openssh.nix

@@ -5,7 +5,7 @@
       KbdInteractiveAuthentication = false;
       PasswordAuthentication = lib.mkForce false;
       PubkeyAuthentication = lib.mkForce true;
-      PermitRootLogin = lib.mkForce "no";
+      PermitRootLogin = lib.mkForce "yes";
       StreamLocalBindUnlink = "yes";
       GatewayPorts = "clientspecified";
     };

modules/security.nix

@@ -55,7 +55,9 @@
       "192.168.0.0/16"
       "172.16.0.0/12"
       "10.0.0.0/8"
-      "5.161.181.184"
+      "5.161.181.184/32"
+      "100.71.49.65/10"
+      "100.82.146.40/10"
     ];
     jails.DEFAULT = {
       settings = {