From d6611626760a7239e00e5fa5903ccf58d28dc514 Mon Sep 17 00:00:00 2001 From: NeilClack Date: Thu, 27 Aug 2026 20:58:07 -0500 Subject: [PATCH] Add live RadiantWave updater (dev variants) Add a radiantwave-updater NixOS module that polls a manifest on the fileserver and swaps the app pointer /var/lib/radiantwave/current to new closures fetched from the dev Attic cache. Closures are fetched with 'nix copy --from', never built from source; the swap is atomic via mv -T. Enable it on the -dev variants only for now: the login shell launches from /var/lib/radiantwave/current/bin/radiantwave when enabled, and from the immutable system path otherwise, so prod behavior is unchanged. The pointer is seeded on first boot to the baseline copy already baked into the closure (no duplication). --- configuration.nix | 12 +++++- flake.nix | 24 ++++++++++++ radiantwave-updater.nix | 85 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 119 insertions(+), 2 deletions(-) create mode 100644 radiantwave-updater.nix diff --git a/configuration.nix b/configuration.nix index e51b742..c0773aa 100644 --- a/configuration.nix +++ b/configuration.nix @@ -1,7 +1,15 @@ -{ pkgs, radiantwave, upgradeFlakeRef, radiantwavePlymouth, ... }: +{ config, pkgs, radiantwave, upgradeFlakeRef, radiantwavePlymouth, ... }: let radiantApp = radiantwave.packages.${pkgs.system}.default; + # When the live-updater module is enabled (currently dev variants only), + # RadiantWave launches through the mutable /var/lib/radiantwave/current + # pointer so it can be swapped without a full nixos-rebuild. Otherwise it + # launches straight from the immutable system closure as before. + launchBin = + if config.services.radiantwaveUpdater.enable or false + then "/var/lib/radiantwave/current/bin/radiantwave" + else "/run/current-system/sw/bin/radiantwave"; myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ]; in { @@ -159,7 +167,7 @@ in # Release the splash screen right before the compositor takes over the display sudo -n plymouth quit --wait || true - exec dbus-run-session cage -- /run/current-system/sw/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1 + exec dbus-run-session cage -- ${launchBin} -d -s > /tmp/kiosk.log 2>&1 fi ''; diff --git a/flake.nix b/flake.nix index bdcf415..4375868 100644 --- a/flake.nix +++ b/flake.nix @@ -55,6 +55,18 @@ revision = self.rev or self.dirtyRev or null; + # Live app-update side channel, dev-only for now. The manifest is + # served by the fileserver; closures are fetched (never built) from the + # dev Attic cache. Promotes to prod once validated. + radiantwaveDevUpdaterModule = { baseline }: { + services.radiantwaveUpdater = { + enable = true; + manifestUrl = "https://files.radiantwavetech.com/radiantwave-dev/manifest.json"; + atticUrl = "https://attic.radiantwavetech.com/radiantwave-dev"; + baselinePackage = baseline; + }; + }; + mkKioskSystem = { system, radiantwave, @@ -79,6 +91,7 @@ system.configurationRevision = revision; } ./configuration.nix + ./radiantwave-updater.nix disko.nixosModules.disko diskModule nixos-facter-modules.nixosModules.facter @@ -116,6 +129,7 @@ ]; }) ./configuration.nix + ./radiantwave-updater.nix radiantwave.nixosModules.default { networking.hostName = hostName; @@ -194,6 +208,9 @@ hostName = "radiantwavekiosk-dev"; diskModule = ./disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev"; + extraModules = [ + (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; }) + ]; }; radiantwavekiosk-commercial = mkKioskSystem { system = "x86_64-linux"; @@ -208,6 +225,9 @@ hostName = "radiantwavekiosk-commercial-dev"; diskModule = ./commercial-disk-config.nix; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev"; + extraModules = [ + (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; }) + ]; }; # Rotated screen for android-style displays. radiantwavekiosk-android = mkKioskSystem { @@ -228,6 +248,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-android-dev"; extraModules = [ ./rotated_display.nix + (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; }) ]; }; # Raspberry Pi 5. @@ -240,6 +261,9 @@ radiantwave = radiantwave-dev; hostName = "radiantwavekiosk-rpi-dev"; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev"; + extraModules = [ + (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.aarch64-linux.default; }) + ]; }; # === USB Images === diff --git a/radiantwave-updater.nix b/radiantwave-updater.nix new file mode 100644 index 0000000..af27ef7 --- /dev/null +++ b/radiantwave-updater.nix @@ -0,0 +1,85 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.services.radiantwaveUpdater; +in +{ + options.services.radiantwaveUpdater = { + enable = lib.mkEnableOption "live RadiantWave app updates via a polled manifest"; + + manifestUrl = lib.mkOption { + type = lib.types.str; + description = "HTTP(S) URL of the JSON manifest announcing the current app store path."; + }; + + atticUrl = lib.mkOption { + type = lib.types.str; + description = "Attic cache URL to fetch the app closure from (fetch-only, never builds)."; + }; + + baselinePackage = lib.mkOption { + type = lib.types.package; + description = "Copy of RadiantWave baked into the system closure, used to seed the runtime pointer before the first update."; + }; + }; + + config = lib.mkIf cfg.enable { + # Runtime pointer the login shell launches RadiantWave from. Seeded on + # first boot to the baseline copy already baked into the system closure + # (so the ISO carries it with no duplication); the updater service later + # re-points it atomically to newer closures fetched from Attic. + systemd.tmpfiles.rules = [ + "L /var/lib/radiantwave/current - - - - ${cfg.baselinePackage.outPath}" + ]; + + systemd.services.radiantwave-updater = { + description = "Poll the RadiantWave manifest and swap the live app pointer"; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + set -u + + NEW_PATH=$(${pkgs.curl}/bin/curl -fsSL "${cfg.manifestUrl}" \ + | ${pkgs.jq}/bin/jq -er .storePath) || { + echo "radiantwave-updater: failed to fetch/parse manifest from ${cfg.manifestUrl}" + exit 0 + } + + CURRENT=$(${pkgs.coreutils}/bin/readlink /var/lib/radiantwave/current 2>/dev/null || true) + + if [ -z "$NEW_PATH" ] || [ "$NEW_PATH" = "$CURRENT" ]; then + echo "radiantwave-updater: already current (''${CURRENT})" + exit 0 + fi + + # Fetch the closure from the signed Attic cache only. This never + # builds from source; it fails outright if the path isn't there. + echo "radiantwave-updater: acquiring ''${NEW_PATH}" + ${pkgs.nix}/bin/nix copy --from "${cfg.atticUrl}" "$NEW_PATH" || { + echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}" + exit 1 + } + + # Atomic swap: the app never observes a half-updated pointer. + ${pkgs.coreutils}/bin/ln -sfn "$NEW_PATH" /var/lib/radiantwave/current.tmp + ${pkgs.coreutils}/bin/mv -T /var/lib/radiantwave/current.tmp /var/lib/radiantwave/current + echo "radiantwave-updater: swapped ''${CURRENT} -> ''${NEW_PATH}" + ''; + }; + + systemd.timers.radiantwave-updater = { + description = "Check for RadiantWave app updates"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "2min"; + OnUnitActiveSec = "2min"; + Persistent = true; + Unit = "radiantwave-updater.service"; + }; + }; + }; +}