Update packages and deploy using deploy-rs

.gitignore

@@ -10,3 +10,4 @@ terraform.tfstate.backup
 terraform.tfvars
 .direnv
 .vscode
+result

dns.tf

@@ -14,6 +14,22 @@ resource "hetznerdns_record" "banditlair_hcloud_a" {
   ttl     = 600
 }
 
+resource "hetznerdns_record" "backend1_a" {
+  zone_id = data.hetznerdns_zone.banditlair_zone.id
+  name    = "backend1"
+  value   = hcloud_server.backend1.ipv4_address
+  type    = "A"
+  ttl     = 600
+}
+
+resource "hetznerdns_record" "db1_a" {
+  zone_id = data.hetznerdns_zone.banditlair_zone.id
+  name    = "db1"
+  value   = hcloud_server.db1.ipv4_address
+  type    = "A"
+  ttl     = 600
+}
+
 resource "hetznerdns_record" "banditlair_dedicated_a" {
   zone_id = data.hetznerdns_zone.banditlair_zone.id
   name    = "*"

flake.lock

@@ -1,12 +1,64 @@
 {
   "nodes": {
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs",
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1632822684,
+        "narHash": "sha256-lt7eayYmgsD5OQwpb1XYfHpxttn43bWo7G7hIJs+zJw=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "9a02de4373e0ec272d08a417b269a28ac8b961b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1627913399,
+        "narHash": "sha256-hY8g6H2KFL8ownSiFeMOjwPC8P0ueXpCVEbxgda3pko=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "12c64ca55c1014cdc1b16ed5a804aa8576601ff2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1630248577,
+        "lastModified": 1632086102,
-        "narHash": "sha256-9d/yq96TTrnF7qjA6wPYk+rYjWAXwfUmwk3qewezSeg=",
+        "narHash": "sha256-wVTcf0UclFS+zHtfPToB13jIO7n0U9N50MuRbPjQViE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e0ce3c683ae677cf5aab597d645520cddd13392b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1637595801,
+        "narHash": "sha256-LkIMwVFKCuEqidaUdg8uxwpESAXjsPo4oCz3eJ7RaRw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8d8a28b47b7c41aeb4ad01a2bd8b7d26986c3512",
+        "rev": "263ef4cc4146c9fab808085487438c625d4426a9",
         "type": "github"
       },
       "original": {
@@ -18,7 +70,23 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "deploy-rs": "deploy-rs",
+        "nixpkgs": "nixpkgs_2"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1631561581,
+        "narHash": "sha256-3VQMV5zvxaVLvqqUrNz3iJelLw30mIVSfZmAaauM3dA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "7e5bf3925f6fbdfaf50a2a7ca0be2879c4261d19",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -1,7 +1,8 @@
 {
   inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+  inputs.deploy-rs.url = "github:serokell/deploy-rs";
 
-  outputs = { self, nixpkgs }:
+  outputs = { self, nixpkgs, deploy-rs }:
     let
       pkgs = nixpkgs.legacyPackages.x86_64-linux;
 
@@ -13,68 +14,89 @@
         ];
       };
     in
-      {
+    {
-        devShell.x86_64-linux = pkgs.mkShell {
+      devShell.x86_64-linux = pkgs.mkShell {
-          buildInputs = with pkgs; [
+        buildInputs = with pkgs; [
-            nixpkgs-fmt
+          nixpkgs-fmt
-            terraform
+          terraform
-            terraform-ls
+          terraform-ls
-            sops
+          sops
+          deploy-rs.packages."x86_64-linux".deploy-rs
+        ];
+      };
+
+      nixosConfigurations = {
+        db1 = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = common.modules ++ [
+            ./modules/postgresql.nix
+            ./modules/custom-backup-job.nix
+            ./modules/custom-backup-job.nix
+            (
+              {
+                networking.hostName = "db1";
+                networking.domain = "banditlair.com";
+                networking.firewall.interfaces."enp7s0".allowedTCPPorts = [ 5432 ];
+                services.custom-backup-job = {
+                  additionalReadWritePaths = [ "/nix/var/data/postgresql" ];
+                  additionalPreHook = ''
+                    ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp
+                    ${pkgs.postgresql_12}/bin/pg_dump -U nextcloud nextcloud > /nix/var/data/postgresql/nextcloud.dmp
+                  '';
+                  startAt = "03:00";
+                };
+                system.stateVersion = "21.05";
+              }
+            )
           ];
         };
+        backend1 = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = common.modules ++ [
+            ./modules/nginx.nix
+            ./modules/murmur.nix
+            ./modules/synapse.nix
+            ./modules/nextcloud.nix
+            ./modules/custom-backup-job.nix
+            (
+              {
+                networking.hostName = "backend1";
+                networking.domain = "banditlair.com";
+                networking.localCommands = "ip addr add 95.216.177.3/32 dev enp1s0";
+                networking.firewall.allowedTCPPorts = [ 80 443 64738 ];
+                networking.firewall.allowedUDPPorts = [ 64738 ];
+                services.custom-backup-job = {
+                  additionalPaths = [ "/var/lib/nextcloud/config" ];
+                  additionalReadWritePaths = [ "/nix/var/data/murmur" ];
+                  additionalPreHook = "cp /var/lib/murmur/murmur.sqlite /nix/var/data/murmur/murmur.sqlite";
+                  startAt = "03:30";
+                };
+                system.stateVersion = "21.05";
+              }
+            )
+          ];
+        };
+      };
 
-        nixosConfigurations = {
+      deploy.nodes = {
-          db1 = nixpkgs.lib.nixosSystem {
+        db1 = {
-            system = "x86_64-linux";
+          hostname = "db1.banditlair.com";
-            modules = common.modules ++ [
+          profiles.system = {
-              ./modules/postgresql.nix
+            user = "root";
-              ./modules/custom-backup-job.nix
+            sshUser = "root";
-              ./modules/custom-backup-job.nix
+            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.db1;
-              (
+          };
-                {
+        };
-                  networking.hostName = "db1";
+        backend1 = {
-                  networking.domain = "banditlair.com";
+          hostname = "backend1.banditlair.com";
-                  networking.firewall.interfaces."enp7s0".allowedTCPPorts = [ 5432 ];
+          profiles.system = {
-                  services.custom-backup-job = {
+            user = "root";
-                    additionalReadWritePaths = [ "/nix/var/data/postgresql" ];
+            sshUser = "root";
-                    additionalPreHook = ''
+            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backend1;
-                      ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp
-                      ${pkgs.postgresql_12}/bin/pg_dump -U nextcloud nextcloud > /nix/var/data/postgresql/nextcloud.dmp
-                    '';
-                    startAt = "03:00";
-                  };
-                  system.stateVersion = "21.05";
-                }
-              )
-            ];
-          };
-          backend1 = nixpkgs.lib.nixosSystem {
-            system = "x86_64-linux";
-            modules = common.modules ++ [
-              ./modules/nginx.nix
-              ./modules/murmur.nix
-              ./modules/synapse.nix
-              ./modules/nextcloud.nix
-              ./modules/custom-backup-job.nix
-              (
-                {
-                  networking.hostName = "backend1";
-                  networking.domain = "banditlair.com";
-                  networking.localCommands = "ip addr add 95.216.177.3/32 dev enp1s0";
-                  networking.firewall.allowedTCPPorts = [ 80 443 64738 ];
-                  networking.firewall.allowedUDPPorts = [ 64738 ];
-                  services.custom-backup-job = {
-                    additionalPaths = [ "/var/lib/nextcloud/config" ];
-                    additionalReadWritePaths = [ "/nix/var/data/murmur" ];
-                    additionalPreHook = "cp /var/lib/murmur/murmur.sqlite /nix/var/data/murmur/murmur.sqlite";
-                    startAt = "03:30";
-                  };
-                  system.stateVersion = "21.05";
-                }
-              )
-            ];
           };
         };
-
       };
+
+      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+    };
 }

modules/nextcloud.nix

@@ -41,7 +41,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud21;
+    package = pkgs.nextcloud22;
     hostName = "cloud.${config.networking.domain}";
     config = {
       dbtype = "pgsql";
@@ -52,6 +52,7 @@ in
       adminpassFile = "/var/keys/nextcloud-admin-pass";
       adminuser = "root";
       overwriteProtocol = "https";
+      defaultPhoneRegion = "BE";
     };
   };
   users.users.nextcloud.extraGroups = [ "keys" ];