From d37c794be42d1ceb312f229a2beb4a7e70ba73fa Mon Sep 17 00:00:00 2001 From: NeilClack Date: Mon, 17 Aug 2026 22:08:47 -0500 Subject: [PATCH] Fix repository pointers --- .gitea/workflows/build-dev.yml | 4 - AGENTS.md | 23 +++--- android-iso.nix | 133 +++++++++++++++++++++++++++++++++ flake.lock | 72 +++++++++++++++++- flake.nix | 12 +-- 5 files changed, 223 insertions(+), 21 deletions(-) create mode 100644 android-iso.nix diff --git a/.gitea/workflows/build-dev.yml b/.gitea/workflows/build-dev.yml index 9a301e4..cb907c8 100644 --- a/.gitea/workflows/build-dev.yml +++ b/.gitea/workflows/build-dev.yml @@ -1,8 +1,4 @@ on: - push: - branches: - - main - workflow_dispatch: jobs: diff --git a/AGENTS.md b/AGENTS.md index 03fab65..99a0fad 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -29,28 +29,28 @@ nix eval .#nixosConfigurations --apply builtins.attrNames | Name | Target hardware | Disk device | Notes | |---|---|---|---| -| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave` main | -| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave-dev` ref | -| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production | -| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev | -| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait) | -| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi` | -| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave-dev` | +| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave-legacy` | +| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave` `?ref=dev` | +| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production, uses `radiantwave-legacy` | +| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev, uses `radiantwave` `?ref=dev` | +| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait), uses `radiantwave-legacy` | +| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi`, uses `radiantwave-legacy` | +| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave` `?ref=dev` | ISOs: `usb-iso`, `commercial-usb-iso`, `android-iso`, `dev-iso` — each bakes in the corresponding system closure for zero-touch install. ## Branching model -Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave` vs `radiantwave-dev`), not at the branch level. +Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave-legacy` vs `radiantwave` `?ref=dev`), not at the branch level. -## CI (Forgejo) +## CI (Gitea) -`.forgejo/workflows/build-dev.yml` — triggered by `repository_dispatch` (`radiantwave-dev-built`) from the RadiantWave repo. Updates `radiantwave-dev` input, builds dev closure + ISO, commits updated `flake.lock`. Runs on `neils-server-runner`. +`.gitea/workflows/build-dev.yml` — triggered by `workflow_dispatch`. Updates `radiantwave` input (dev branch), builds dev closure + ISO, commits updated `flake.lock`. Runs on `build-server`. ## Important gotchas - **Disk device differs by variant**: `disk-config.nix` uses `/dev/nvme0n1`, `commercial-disk-config.nix` uses `/dev/sda`. Don't mix them up. -- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`. Changing a config name in `flake.nix` requires updating the corresponding ISO config. +- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`, `android-iso.nix` hardcodes `radiantwavekiosk-android`. Changing a config name in `flake.nix` requires updating the corresponding ISO config. - **Attic cache token**: ISO configs embed a JWT token for Attic in `/etc/nix/netrc`. If builds fail with auth errors, the token may have expired (expiry in the JWT payload). - **`rotated_display.nix` uses `mkForce`** on `loginShellInit` — it replaces the entire kiosk startup script from `configuration.nix`, don't edit both. - **SOPS**: `.sops.yaml` configures age-based encryption for `secrets.yaml`. You'll need the private key matching `age1t2wpzv...` to decrypt. @@ -65,6 +65,7 @@ Single branch (`main`). Production vs. dev split is at the **flake input** level - `iso-config.nix` — production ISO + zero-touch installer - `dev-iso.nix` — dev ISO + zero-touch installer - `commercial-iso-config.nix` — commercial ISO + zero-touch installer +- `android-iso.nix` — android ISO + zero-touch installer - `rotated_display.nix` — portrait display override for Android variant - `facter.json` — hardware facter report (NUC 14) - `14rvk.json`, `pn54.json` — additional hardware facter reports diff --git a/android-iso.nix b/android-iso.nix new file mode 100644 index 0000000..c294d7c --- /dev/null +++ b/android-iso.nix @@ -0,0 +1,133 @@ +{ + pkgs, + inputs, + self, + ... +}: +let + targetSystem = + self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel; + + diskoScript = + self.nixosConfigurations.radiantwavekiosk-android.config.system.build.diskoScript; +in +{ + ############################################################ + # System configuration + ############################################################ + + nix.settings = { + experimental-features = [ + "nix-command" + "flakes" + ]; + + substituters = [ + "https://cache.nixos.org" + ]; + + flake-registry = ""; + + connect-timeout = 0; + }; + + nix.registry.nixpkgs = pkgs.lib.mkForce { + to = { + type = "path"; + path = "${inputs.nixpkgs}"; + }; + }; + + nix.extraOptions = '' + netrc-file = /etc/nix/netrc + ''; + + environment.variables.KIOSK_FLAKE = "${self}"; + + environment.etc."nix/netrc" = { + text = '' + password eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjIwODgzODk2ODEsIm5iZiI6MTc3MjgxMzY4MSwic3ViIjoia2lvc2siLCJodHRwczovL2p3dC5hdHRpYy5ycy92MSI6eyJjYWNoZXMiOnsia2lvc2siOnsiciI6MX19fX0.N6Ktrmmu1LSy2PP8uNF25VHRP1dxPZJ4M0MR1kUpVi0 + ''; + mode = "0400"; + }; + + networking.networkmanager.enable = true; + + ############################################################ + # User configuration + ############################################################ + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" + ]; + + ############################################################ + # Service configuration + ############################################################ + + services.openssh.enable = true; + + systemd.services.NetworkManager-wait-online.enable = false; + + systemd.services.zero-touch-install = { + description = "Zero-Touch Kiosk Installation"; + + wantedBy = [ "multi-user.target" ]; + + # Make sure we own tty1 exclusively - getty@tty1 will otherwise + # try to spawn a login prompt on the same console. + conflicts = [ "getty@tty1.service" ]; + after = [ "systemd-udev-settle.service" "getty@tty1.service" ]; + + path = with pkgs; [ + nix + git + util-linux + nixos-install-tools + curl + networkmanager + mount + umount + disko + ]; + + environment = { + NIX_PATH = "nixpkgs=${inputs.nixpkgs}"; + KIOSK_FLAKE = "${self}"; + DISKO_SCRIPT = "${diskoScript}"; + }; + + serviceConfig = { + StandardInput = "tty"; + StandardOutput = "tty"; + StandardError = "tty"; + TTYPath = "/dev/tty1"; + TTYReset = true; + TTYVHangup = true; + TTYVTDisallocate = true; + }; + + script = '' + set -euo pipefail + + echo "Running disko script..." + echo "Script: $DISKO_SCRIPT" + + ${diskoScript} + + echo "Installing RadiantWave" + echo "Closure Path: ${targetSystem}" + + nixos-install \ + --system "${targetSystem}" \ + --no-root-passwd \ + --no-channel-copy + + echo "============================================" + echo " Installation complete!" + echo " Please shut down and remove the flash drive before restarting" + echo "============================================" + sleep 10000000 + ''; + }; +} diff --git a/flake.lock b/flake.lock index 71d4587..3a3eb10 100644 --- a/flake.lock +++ b/flake.lock @@ -87,6 +87,24 @@ "type": "github" } }, + "flake-utils_3": { + "inputs": { + "systems": "systems_3" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "nixos-facter-modules": { "locked": { "lastModified": 1773858690, @@ -199,6 +217,22 @@ } }, "nixpkgs_4": { + "locked": { + "lastModified": 1785967620, + "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_5": { "locked": { "lastModified": 1776877367, "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=", @@ -234,11 +268,31 @@ "url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git" } }, - "radiantwave-legacy": { + "radiantwave-dev": { "inputs": { "flake-utils": "flake-utils_2", "nixpkgs": "nixpkgs_4" }, + "locked": { + "lastModified": 1786826629, + "narHash": "sha256-DW8q8higedCMLlfcAwhEQyP57ZRTok7cG1N8g5P+1ms=", + "ref": "dev", + "rev": "e401bd4ec59d1ef4f2e8b117b5933293615a19f6", + "revCount": 27, + "type": "git", + "url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git" + }, + "original": { + "ref": "dev", + "type": "git", + "url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git" + } + }, + "radiantwave-legacy": { + "inputs": { + "flake-utils": "flake-utils_3", + "nixpkgs": "nixpkgs_5" + }, "locked": { "lastModified": 1786170011, "narHash": "sha256-Vx/3kwIQFRYDZQtVdcdGgJPnNa2Y44HRYZyJAeug6OI=", @@ -261,6 +315,7 @@ "nixos-raspberrypi": "nixos-raspberrypi", "nixpkgs": "nixpkgs_2", "radiantwave": "radiantwave", + "radiantwave-dev": "radiantwave-dev", "radiantwave-legacy": "radiantwave-legacy" } }, @@ -293,6 +348,21 @@ "repo": "default", "type": "github" } + }, + "systems_3": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index ca0ee2a..4d4d9e3 100644 --- a/flake.nix +++ b/flake.nix @@ -6,6 +6,7 @@ nixos-facter-modules.url = "github:numtide/nixos-facter-modules"; # radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=main"; # This is the NEW RadiantWave radiantwave.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git?ref=main"; + radiantwave-dev.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git?ref=dev"; radiantwave-legacy.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave-legacy.git?ref=main"; nixos-raspberrypi.url = "github:nvmd/nixos-raspberrypi/main"; }; @@ -17,6 +18,7 @@ disko, nixos-facter-modules, radiantwave, + radiantwave-dev, radiantwave-legacy, nixos-raspberrypi, ... @@ -126,7 +128,7 @@ # Kiosk-dev radiantwavekiosk-dev = mkKioskSystem { system = "x86_64-linux"; - radiantwave = radiantwave; + radiantwave = radiantwave-dev; diskModule = ./disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev"; extraModules = []; @@ -142,9 +144,9 @@ # Commercial-dev radiantwavekiosk-commercial-dev = mkKioskSystem { system = "x86_64-linux"; - radiantwave = radiantwave; + radiantwave = radiantwave-dev; diskModule = ./commercial-disk-config.nix; - upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial"; + upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev"; extraModules = []; }; # Kiosk - rotated screen for android displays @@ -162,7 +164,7 @@ }; # Raspberry pi 5 dev radiantwavekiosk-rpi-dev = mkRpiKioskSystem { - radiantwave = radiantwave; + radiantwave = radiantwave-dev; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev"; }; # === USB Images === @@ -222,7 +224,7 @@ modules = [ "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix" disko.nixosModules.disko - ./iso-config.nix + ./android-iso.nix ./disk-config.nix ({ pkgs, ... }: { environment.systemPackages = [