RadiantWaveTech/KioskConfig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix repository pointers

Browse Source
This commit is contained in:
NeilClack
2026-08-17 22:08:47 -05:00
parent b26081046e
commit d37c794be4
5 changed files with 223 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build-dev.yml
-4
View File
@@ -1,8 +1,4 @@
on:
push:
branches:
- main
workflow_dispatch:
jobs:
AGENTS.md
+12 -11
View File
@@ -29,28 +29,28 @@ nix eval .#nixosConfigurations --apply builtins.attrNames
| Name | Target hardware | Disk device | Notes |
|---|---|---|---|
| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave` main |
| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave-dev` ref |
| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production |
| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev |
| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait) |
| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi` |
| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave-dev` |
| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave-legacy` |
| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave` `?ref=dev` |
| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production, uses `radiantwave-legacy` |
| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev, uses `radiantwave` `?ref=dev` |
| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait), uses `radiantwave-legacy` |
| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi`, uses `radiantwave-legacy` |
| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave` `?ref=dev` |
ISOs: `usb-iso`, `commercial-usb-iso`, `android-iso`, `dev-iso` — each bakes in the corresponding system closure for zero-touch install.
## Branching model
Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave` vs `radiantwave-dev`), not at the branch level.
Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave-legacy` vs `radiantwave` `?ref=dev`), not at the branch level.
## CI (Forgejo)
## CI (Gitea)
`.forgejo/workflows/build-dev.yml` — triggered by `repository_dispatch` (`radiantwave-dev-built`) from the RadiantWave repo. Updates `radiantwave-dev` input, builds dev closure + ISO, commits updated `flake.lock`. Runs on `neils-server-runner`.
`.gitea/workflows/build-dev.yml` — triggered by `workflow_dispatch`. Updates `radiantwave` input (dev branch), builds dev closure + ISO, commits updated `flake.lock`. Runs on `build-server`.
## Important gotchas
- **Disk device differs by variant**: `disk-config.nix` uses `/dev/nvme0n1`, `commercial-disk-config.nix` uses `/dev/sda`. Don't mix them up.
- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`. Changing a config name in `flake.nix` requires updating the corresponding ISO config.
- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`, `android-iso.nix` hardcodes `radiantwavekiosk-android`. Changing a config name in `flake.nix` requires updating the corresponding ISO config.
- **Attic cache token**: ISO configs embed a JWT token for Attic in `/etc/nix/netrc`. If builds fail with auth errors, the token may have expired (expiry in the JWT payload).
- **`rotated_display.nix` uses `mkForce`** on `loginShellInit` — it replaces the entire kiosk startup script from `configuration.nix`, don't edit both.
- **SOPS**: `.sops.yaml` configures age-based encryption for `secrets.yaml`. You'll need the private key matching `age1t2wpzv...` to decrypt.
@@ -65,6 +65,7 @@ Single branch (`main`). Production vs. dev split is at the **flake input** level
- `iso-config.nix` — production ISO + zero-touch installer
- `dev-iso.nix` — dev ISO + zero-touch installer
- `commercial-iso-config.nix` — commercial ISO + zero-touch installer
- `android-iso.nix` — android ISO + zero-touch installer
- `rotated_display.nix` — portrait display override for Android variant
- `facter.json` — hardware facter report (NUC 14)
- `14rvk.json`, `pn54.json` — additional hardware facter reports
android-iso.nix
+133
View File
@@ -0,0 +1,133 @@
{
pkgs,
inputs,
self,
...
}:
let
targetSystem =
self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
diskoScript =
self.nixosConfigurations.radiantwavekiosk-android.config.system.build.diskoScript;
in
{
############################################################
# System configuration
############################################################
nix.settings = {
experimental-features = [
"nix-command"
"flakes"
];
substituters = [
"https://cache.nixos.org"
];
flake-registry = "";
connect-timeout = 0;
};
nix.registry.nixpkgs = pkgs.lib.mkForce {
to = {
type = "path";
path = "${inputs.nixpkgs}";
};
};
nix.extraOptions = ''
netrc-file = /etc/nix/netrc
'';
environment.variables.KIOSK_FLAKE = "${self}";
environment.etc."nix/netrc" = {
text = ''
password eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjIwODgzODk2ODEsIm5iZiI6MTc3MjgxMzY4MSwic3ViIjoia2lvc2siLCJodHRwczovL2p3dC5hdHRpYy5ycy92MSI6eyJjYWNoZXMiOnsia2lvc2siOnsiciI6MX19fX0.N6Ktrmmu1LSy2PP8uNF25VHRP1dxPZJ4M0MR1kUpVi0
'';
mode = "0400";
};
networking.networkmanager.enable = true;
############################################################
# User configuration
############################################################
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook"
];
############################################################
# Service configuration
############################################################
services.openssh.enable = true;
systemd.services.NetworkManager-wait-online.enable = false;
systemd.services.zero-touch-install = {
description = "Zero-Touch Kiosk Installation";
wantedBy = [ "multi-user.target" ];
# Make sure we own tty1 exclusively - getty@tty1 will otherwise
# try to spawn a login prompt on the same console.
conflicts = [ "getty@tty1.service" ];
after = [ "systemd-udev-settle.service" "getty@tty1.service" ];
path = with pkgs; [
nix
git
util-linux
nixos-install-tools
curl
networkmanager
mount
umount
disko
];
environment = {
NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
KIOSK_FLAKE = "${self}";
DISKO_SCRIPT = "${diskoScript}";
};
serviceConfig = {
StandardInput = "tty";
StandardOutput = "tty";
StandardError = "tty";
TTYPath = "/dev/tty1";
TTYReset = true;
TTYVHangup = true;
TTYVTDisallocate = true;
};
script = ''
set -euo pipefail
echo "Running disko script..."
echo "Script: $DISKO_SCRIPT"
${diskoScript}
echo "Installing RadiantWave"
echo "Closure Path: ${targetSystem}"
nixos-install \
--system "${targetSystem}" \
--no-root-passwd \
--no-channel-copy
echo "============================================"
echo " Installation complete!"
echo " Please shut down and remove the flash drive before restarting"
echo "============================================"
sleep 10000000
'';
};
}
flake.lock
Generated
+71 -1
View File
@@ -87,6 +87,24 @@
"type": "github"
}
},
"flake-utils_3": {
"inputs": {
"systems": "systems_3"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"nixos-facter-modules": {
"locked": {
"lastModified": 1773858690,
@@ -199,6 +217,22 @@
}
},
"nixpkgs_4": {
"locked": {
"lastModified": 1785967620,
"narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_5": {
"locked": {
"lastModified": 1776877367,
"narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
@@ -234,11 +268,31 @@
"url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git"
}
},
"radiantwave-legacy": {
"radiantwave-dev": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1786826629,
"narHash": "sha256-DW8q8higedCMLlfcAwhEQyP57ZRTok7cG1N8g5P+1ms=",
"ref": "dev",
"rev": "e401bd4ec59d1ef4f2e8b117b5933293615a19f6",
"revCount": 27,
"type": "git",
"url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git"
},
"original": {
"ref": "dev",
"type": "git",
"url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git"
}
},
"radiantwave-legacy": {
"inputs": {
"flake-utils": "flake-utils_3",
"nixpkgs": "nixpkgs_5"
},
"locked": {
"lastModified": 1786170011,
"narHash": "sha256-Vx/3kwIQFRYDZQtVdcdGgJPnNa2Y44HRYZyJAeug6OI=",
@@ -261,6 +315,7 @@
"nixos-raspberrypi": "nixos-raspberrypi",
"nixpkgs": "nixpkgs_2",
"radiantwave": "radiantwave",
"radiantwave-dev": "radiantwave-dev",
"radiantwave-legacy": "radiantwave-legacy"
}
},
@@ -293,6 +348,21 @@
"repo": "default",
"type": "github"
}
},
"systems_3": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
flake.nix
+7 -5
View File
@@ -6,6 +6,7 @@
nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
# radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=main"; # This is the NEW RadiantWave
radiantwave.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git?ref=main";
radiantwave-dev.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git?ref=dev";
radiantwave-legacy.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave-legacy.git?ref=main";
nixos-raspberrypi.url = "github:nvmd/nixos-raspberrypi/main";
};
@@ -17,6 +18,7 @@
disko,
nixos-facter-modules,
radiantwave,
radiantwave-dev,
radiantwave-legacy,
nixos-raspberrypi,
...
@@ -126,7 +128,7 @@
# Kiosk-dev
radiantwavekiosk-dev = mkKioskSystem {
system = "x86_64-linux";
radiantwave = radiantwave;
radiantwave = radiantwave-dev;
diskModule = ./disk-config.nix;
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev";
extraModules = [];
@@ -142,9 +144,9 @@
# Commercial-dev
radiantwavekiosk-commercial-dev = mkKioskSystem {
system = "x86_64-linux";
radiantwave = radiantwave;
radiantwave = radiantwave-dev;
diskModule = ./commercial-disk-config.nix;
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial";
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev";
extraModules = [];
};
# Kiosk - rotated screen for android displays
@@ -162,7 +164,7 @@
};
# Raspberry pi 5 dev
radiantwavekiosk-rpi-dev = mkRpiKioskSystem {
radiantwave = radiantwave;
radiantwave = radiantwave-dev;
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev";
};
# === USB Images ===
@@ -222,7 +224,7 @@
modules = [
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
disko.nixosModules.disko
./iso-config.nix
./android-iso.nix
./disk-config.nix
({ pkgs, ... }: {
environment.systemPackages = [