Enable live app updater on production variants

All variants now follow the same update procedure as the dev flakes;
prod variants pull the RadiantWave binary, Attic repo, and manifest
from the radiantwave channel instead of radiantwave-dev.

configuration.nix

@@ -2,8 +2,8 @@
 
 let
   radiantApp = radiantwave.packages.${pkgs.system}.default;
-  # When the live-updater module is enabled (currently dev variants only),
-  # RadiantWave launches through the mutable /var/lib/radiantwave/current
+  # When the live-updater module is enabled, RadiantWave launches through the
+  # mutable /var/lib/radiantwave/current
   # pointer so it can be swapped without a full nixos-rebuild. Otherwise it
   # launches straight from the immutable system closure as before.
   launchBin =
@@ -263,32 +263,4 @@ in
       echo "Backup completed at $(date)" > "$BACKUP_DIR/.backup-timestamp"
     '';
   };
-
-  # --- Health check service: runs after nixos-upgrade ---
-  # systemd.services.radiantwave-healthcheck = {
-  #   description = "Verify RadiantWave is running after upgrade, rollback if not";
-  #   after = [ "nixos-upgrade.service" ];
-  #   wantedBy = [ "nixos-upgrade.service" ];
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     # Give cage time to start radiantwave after the switch
-  #     ExecStartPre = "${pkgs.coreutils}/bin/sleep 90";
-  #   };
-  #   script = ''
-  #     # The installed `radiantwave` is a makeWrapper script that execs the real
-  #     # binary (`.radiantwave-unwrapped`), so the process comm is not exactly
-  #     # `radiantwave`; match the exec'd binary's command line instead.
-  #     if ${pkgs.procps}/bin/pgrep -f '\.radiantwave-unwrapped' > /dev/null; then
-  #       echo "RadiantWave is running, upgrade successful"
-  #       exit 0
-  #     fi
-
-  #     echo "RadiantWave not found after upgrade, rolling back..."
-
-  #     # Roll back to previous NixOS generation
-  #     /run/current-system/sw/bin/nixos-rebuild switch --rollback
-
-  #     echo "Rollback completed at $(date)"
-  #   '';
-  # };
 }

flake.nix

@@ -55,15 +55,17 @@
 
       revision = self.rev or self.dirtyRev or null;
 
-      # Live app-update side channel, dev-only for now. The manifest is
-      # served by the fileserver; closures are fetched (never built) from the
-      # dev Attic cache. Promotes to prod once validated.
-      radiantwaveDevUpdaterModule = { baseline }: {
+      # Live app-update side channel. The manifest is served by the
+      # fileserver; closures are fetched (never built) from the variant's
+      # Attic cache. `repo` selects the channel — "radiantwave" (prod,
+      # ?ref=main) or "radiantwave-dev" (dev, ?ref=dev). All variants follow
+      # this same update procedure; only the channel differs.
+      radiantwaveUpdaterModule = { repo, baseline }: {
         services.radiantwaveUpdater = {
           enable = true;
-          manifestUrl = "https://files.radiantwavetech.com/radiantwave-dev/manifest.json";
-          atticUrl = "https://attic.radiantwavetech.com/radiantwave-dev";
           baselinePackage = baseline;
+          manifestUrl = "https://files.radiantwavetech.com/${repo}/manifest.json";
+          atticUrl = "https://attic.radiantwavetech.com/${repo}";
         };
       };
 
@@ -192,8 +194,9 @@
       # Kiosk systems.
       #
       # Production variants consume the `radiantwave` input (?ref=main);
-      # `-dev` variants consume `radiantwave-dev` (?ref=dev) and track the
-      # dev branch of this repo via their autoUpgrade flake refs.
+      # `-dev` variants consume `radiantwave-dev` (?ref=dev). All variants
+      # run the same live-app updater against their channel's Attic repo and
+      # manifest, and track this repo's matching branch via autoUpgrade.
       nixosConfigurations = {
         radiantwavekiosk = mkKioskSystem {
           system = "x86_64-linux";
@@ -201,6 +204,9 @@
           hostName = "radiantwavekiosk";
           diskModule = ./disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk";
+          extraModules = [
+            (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.x86_64-linux.default; })
+          ];
         };
         radiantwavekiosk-dev = mkKioskSystem {
           system = "x86_64-linux";
@@ -209,7 +215,7 @@
           diskModule = ./disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev";
           extraModules = [
-            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; })
+            (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.x86_64-linux.default; })
           ];
         };
         radiantwavekiosk-commercial = mkKioskSystem {
@@ -218,6 +224,9 @@
           hostName = "radiantwavekiosk-commercial";
           diskModule = ./commercial-disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-commercial";
+          extraModules = [
+            (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.x86_64-linux.default; })
+          ];
         };
         radiantwavekiosk-commercial-dev = mkKioskSystem {
           system = "x86_64-linux";
@@ -226,7 +235,7 @@
           diskModule = ./commercial-disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev";
           extraModules = [
-            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; })
+            (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.x86_64-linux.default; })
           ];
         };
         # Rotated screen for android-style displays.
@@ -238,6 +247,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-android";
           extraModules = [
             ./rotated_display.nix
+            (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.x86_64-linux.default; })
           ];
         };
         radiantwavekiosk-android-dev = mkKioskSystem {
@@ -248,7 +258,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-android-dev";
           extraModules = [
             ./rotated_display.nix
-            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; })
+            (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.x86_64-linux.default; })
           ];
         };
         # Raspberry Pi 5.
@@ -256,13 +266,16 @@
           radiantwave = radiantwave;
           hostName = "radiantwavekiosk-rpi";
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-rpi";
+          extraModules = [
+            (radiantwaveUpdaterModule { repo = "radiantwave"; baseline = radiantwave.packages.aarch64-linux.default; })
+          ];
         };
         radiantwavekiosk-rpi-dev = mkRpiKioskSystem {
           radiantwave = radiantwave-dev;
           hostName = "radiantwavekiosk-rpi-dev";
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev";
           extraModules = [
-            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.aarch64-linux.default; })
+            (radiantwaveUpdaterModule { repo = "radiantwave-dev"; baseline = radiantwave-dev.packages.aarch64-linux.default; })
           ];
         };
 

radiantwave-updater.nix

@@ -61,18 +61,18 @@ in
           exit 0
         fi
 
-        # Realize the closure via the machine's substituters. The app itself
-        # only exists in the dev Attic cache, but nixpkgs deps (e.g. sqlite)
-        # are signed by cache.nixos.org and Attic intentionally skips them to
-        # avoid re-uploading the world. Fetch those from cache.nixos.org so
-        # the whole closure resolves without ever building from source.
-        # --add-root pins the fetched closure so GC can't collect it while
-        # the swap below makes it live.
+        # Realize the closure via the variant's Attic cache plus cache.nixos.org.
+        # nixpkgs deps (e.g. sqlite) are signed by cache.nixos.org and Attic
+        # intentionally skips them to avoid re-uploading the world, so fetch
+        # them from cache.nixos.org and the whole closure resolves without ever
+        # building from source. Trusted public keys come from the system config
+        # (both Attic repos are trusted in configuration.nix). --add-root pins
+        # the fetched closure so GC can't collect it while the swap below makes
+        # it live.
         echo "radiantwave-updater: acquiring ''${NEW_PATH}"
         ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \
           --add-root /var/lib/radiantwave/.current-root \
-          --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \
-          --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || {
+          --option extra-substituters "${cfg.atticUrl} https://cache.nixos.org" || {
           echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}"
           exit 1
         }

tools/find_systems.zsh

@@ -9,7 +9,7 @@
 
 set -uo pipefail # no -e: we want to keep going past unreachable hosts
 
-SUBNET="${1:-192.168.4.0/24}"
+SUBNET="${1:-192.168.1.0/24}"
 SSH_USER="kiosk"
 SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new)