diff --git a/configuration.nix b/configuration.nix index c0773aa..6838a40 100644 --- a/configuration.nix +++ b/configuration.nix @@ -2,8 +2,8 @@ let radiantApp = radiantwave.packages.${pkgs.system}.default; - # When the live-updater module is enabled (currently dev variants only), - # RadiantWave launches through the mutable /var/lib/radiantwave/current + # When the live-updater module is enabled, RadiantWave launches through the + # mutable /var/lib/radiantwave/current # pointer so it can be swapped without a full nixos-rebuild. Otherwise it # launches straight from the immutable system closure as before. launchBin = @@ -263,32 +263,4 @@ in echo "Backup completed at $(date)" > "$BACKUP_DIR/.backup-timestamp" ''; }; - - # --- Health check service: runs after nixos-upgrade --- - # systemd.services.radiantwave-healthcheck = { - # description = "Verify RadiantWave is running after upgrade, rollback if not"; - # after = [ "nixos-upgrade.service" ]; - # wantedBy = [ "nixos-upgrade.service" ]; - # serviceConfig = { - # Type = "oneshot"; - # # Give cage time to start radiantwave after the switch - # ExecStartPre = "${pkgs.coreutils}/bin/sleep 90"; - # }; - # script = '' - # # The installed `radiantwave` is a makeWrapper script that execs the real - # # binary (`.radiantwave-unwrapped`), so the process comm is not exactly - # # `radiantwave`; match the exec'd binary's command line instead. - # if ${pkgs.procps}/bin/pgrep -f '\.radiantwave-unwrapped' > /dev/null; then - # echo "RadiantWave is running, upgrade successful" - # exit 0 - # fi - - # echo "RadiantWave not found after upgrade, rolling back..." - - # # Roll back to previous NixOS generation - # /run/current-system/sw/bin/nixos-rebuild switch --rollback - - # echo "Rollback completed at $(date)" - # ''; - # }; } diff --git a/flake.nix b/flake.nix index 4375868..5a191cd 100644 --- a/flake.nix +++ b/flake.nix @@ -55,15 +55,17 @@ revision = self.rev or self.dirtyRev or null; - # Live app-update side channel, dev-only for now. The manifest is - # served by the fileserver; closures are fetched (never built) from the - # dev Attic cache. Promotes to prod once validated. - radiantwaveDevUpdaterModule = { baseline }: { + # Live app-update side channel. The manifest is served by the + # fileserver; closures are fetched (never built) from the variant's + # Attic cache. `repo` selects the channel — "radiantwave" (prod, + # ?ref=main) or "radiantwave-dev" (dev, ?ref=dev). All variants follow + # this same update procedure; only the channel differs. + radiantwaveUpdaterModule = { repo, baseline }: { services.radiantwaveUpdater = { enable = true; - manifestUrl = "https://files.radiantwavetech.com/radiantwave-dev/manifest.json"; - atticUrl = "https://attic.radiantwavetech.com/radiantwave-dev"; baselinePackage = baseline; + manifestUrl = "https://files.radiantwavetech.com/${repo}/manifest.json"; + atticUrl = "https://attic.radiantwavetech.com/${repo}"; }; }; @@ -192,8 +194,9 @@ # Kiosk systems. # # Production variants consume the `radiantwave` input (?ref=main); - # `-dev` variants consume `radiantwave-dev` (?ref=dev) and track the - # dev branch of this repo via their autoUpgrade flake refs. + # `-dev` variants consume `radiantwave-dev` (?ref=dev). All variants + # run the same live-app updater against their channel's Attic repo and + # manifest, and track this repo's matching branch via autoUpgrade. nixosConfigurations = { radiantwavekiosk = mkKioskSystem { system = "x86_64-linux"; @@ -201,6 +204,9 @@ hostName = "radiantwavekiosk"; diskModule = ./disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk"; + extraModules = [ + (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.x86_64-linux.default; }) + ]; }; radiantwavekiosk-dev = mkKioskSystem { system = "x86_64-linux"; @@ -209,7 +215,7 @@ diskModule = ./disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev"; extraModules = [ - (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; }) + (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.x86_64-linux.default; }) ]; }; radiantwavekiosk-commercial = mkKioskSystem { @@ -218,6 +224,9 @@ hostName = "radiantwavekiosk-commercial"; diskModule = ./commercial-disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-commercial"; + extraModules = [ + (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.x86_64-linux.default; }) + ]; }; radiantwavekiosk-commercial-dev = mkKioskSystem { system = "x86_64-linux"; @@ -226,7 +235,7 @@ diskModule = ./commercial-disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev"; extraModules = [ - (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; }) + (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.x86_64-linux.default; }) ]; }; # Rotated screen for android-style displays. @@ -238,6 +247,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-android"; extraModules = [ ./rotated_display.nix + (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.x86_64-linux.default; }) ]; }; radiantwavekiosk-android-dev = mkKioskSystem { @@ -248,7 +258,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-android-dev"; extraModules = [ ./rotated_display.nix - (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; }) + (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.x86_64-linux.default; }) ]; }; # Raspberry Pi 5. @@ -256,13 +266,16 @@ radiantwave = radiantwave; hostName = "radiantwavekiosk-rpi"; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-rpi"; + extraModules = [ + (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.aarch64-linux.default; }) + ]; }; radiantwavekiosk-rpi-dev = mkRpiKioskSystem { radiantwave = radiantwave-dev; hostName = "radiantwavekiosk-rpi-dev"; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev"; extraModules = [ - (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.aarch64-linux.default; }) + (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.aarch64-linux.default; }) ]; }; diff --git a/radiantwave-updater.nix b/radiantwave-updater.nix index a298032..a020efb 100644 --- a/radiantwave-updater.nix +++ b/radiantwave-updater.nix @@ -61,18 +61,18 @@ in exit 0 fi - # Realize the closure via the machine's substituters. The app itself - # only exists in the dev Attic cache, but nixpkgs deps (e.g. sqlite) - # are signed by cache.nixos.org and Attic intentionally skips them to - # avoid re-uploading the world. Fetch those from cache.nixos.org so - # the whole closure resolves without ever building from source. - # --add-root pins the fetched closure so GC can't collect it while - # the swap below makes it live. + # Realize the closure via the variant's Attic cache plus cache.nixos.org. + # nixpkgs deps (e.g. sqlite) are signed by cache.nixos.org and Attic + # intentionally skips them to avoid re-uploading the world, so fetch + # them from cache.nixos.org and the whole closure resolves without ever + # building from source. Trusted public keys come from the system config + # (both Attic repos are trusted in configuration.nix). --add-root pins + # the fetched closure so GC can't collect it while the swap below makes + # it live. echo "radiantwave-updater: acquiring ''${NEW_PATH}" ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \ --add-root /var/lib/radiantwave/.current-root \ - --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \ - --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || { + --option extra-substituters "${cfg.atticUrl} https://cache.nixos.org" || { echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}" exit 1 } diff --git a/tools/find_systems.zsh b/tools/find_systems.zsh index bc8fc9e..7e47578 100755 --- a/tools/find_systems.zsh +++ b/tools/find_systems.zsh @@ -9,7 +9,7 @@ set -uo pipefail # no -e: we want to keep going past unreachable hosts -SUBNET="${1:-192.168.4.0/24}" +SUBNET="${1:-192.168.1.0/24}" SSH_USER="kiosk" SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new)