Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 NeilClack
|
e50391ba9e | ||
|
NeilClack
|
8796feddd9 |
@@ -1,91 +0,0 @@
|
||||
name: Build Dev ISOs
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- dev
|
||||
env:
|
||||
NIX_CONFIG: |
|
||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
|
||||
extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
|
||||
jobs:
|
||||
build-dev-kiosk:
|
||||
runs-on: orion-lxc
|
||||
steps:
|
||||
- name: Clone Repository
|
||||
run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
- name: Checkout dev branch
|
||||
run: git checkout dev
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
- name: Build dev kiosk ISO
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
|
||||
- name: Rename dev kiosk ISO
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso"
|
||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
- name: Copy dev kiosk ISO to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
- name: Cleanup
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
|
||||
build-dev-android:
|
||||
runs-on: orion-lxc
|
||||
steps:
|
||||
- name: Clone Repository
|
||||
run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
- name: Checkout dev branch
|
||||
run: git checkout dev
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
- name: Build dev android ISO
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
|
||||
- name: Rename dev android ISO
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
|
||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
- name: Copy dev android ISO to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
- name: Cleanup
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
|
||||
build-dev-commercial:
|
||||
runs-on: orion-lxc
|
||||
steps:
|
||||
- name: Clone Repository
|
||||
run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
- name: Checkout dev branch
|
||||
run: git checkout dev
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
- name: Build dev commercial ISO
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
|
||||
- name: Rename dev commercial ISO
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso"
|
||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
- name: Copy dev commercial ISO to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
- name: Cleanup
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
@@ -1,42 +0,0 @@
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
env:
|
||||
NIX_CONFIG: |
|
||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave
|
||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
|
||||
|
||||
jobs:
|
||||
build-android:
|
||||
runs-on: orion-lxc
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
|
||||
- name: Build android kiosk ISO
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
|
||||
|
||||
- name: Rename android kiosk ISO
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-android-iso-${ISO_DATE}.iso"
|
||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "ANDROID_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Copy android kiosk ISO to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
|
||||
- name: Cleanup android kiosk ISO
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}"
|
||||
@@ -1,42 +0,0 @@
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
env:
|
||||
NIX_CONFIG: |
|
||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave
|
||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
|
||||
|
||||
jobs:
|
||||
build-commercial:
|
||||
runs-on: orion-lxc
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
|
||||
- name: Build commercial kiosk ISO
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
|
||||
|
||||
- name: Rename commercial kiosk ISO
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-commercial-iso-${ISO_DATE}.iso"
|
||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "COMMERCIAL_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Copy commercial kiosk ISO to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
|
||||
- name: Cleanup commercial kiosk ISO
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}"
|
||||
@@ -1,42 +0,0 @@
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
env:
|
||||
NIX_CONFIG: |
|
||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave
|
||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
|
||||
|
||||
jobs:
|
||||
build-kiosk:
|
||||
runs-on: orion-lxc
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
|
||||
- name: Build kiosk ISO
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
|
||||
|
||||
- name: Rename kiosk ISO
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-home-${ISO_DATE}.iso"
|
||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Copy kiosk ISO to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
|
||||
- name: Cleanup kiosk ISO
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}"
|
||||
@@ -1,39 +0,0 @@
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
NIX_CONFIG: |
|
||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave https://nixos-raspberrypi.cachix.org
|
||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
|
||||
|
||||
jobs:
|
||||
build-rpi:
|
||||
runs-on: orion-lxc
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
|
||||
- name: Build Raspberry Pi image
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure .#nixosConfigurations.radiantwavekiosk-rpi.config.system.build.sdImage
|
||||
|
||||
- name: Rename Raspberry Pi image
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-rpi-${ISO_DATE}.img.zst"
|
||||
cp -L result/sd-image/*.img.zst "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Copy Raspberry Pi image to fileserver
|
||||
run: |
|
||||
scp "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
|
||||
- name: Cleanup Raspberry Pi image
|
||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}"
|
||||
@@ -0,0 +1,150 @@
|
||||
# One build workflow for every branch — do not add per-branch copies.
|
||||
#
|
||||
# The branch/ref selects the channel, nothing else does: the flake's `channel`
|
||||
# block picks the app input, Attic repo, and upgrade ref, so the same config
|
||||
# names build dev images on `dev` and prod images on `main`. This file itself
|
||||
# is identical on both branches.
|
||||
#
|
||||
# Trigger model:
|
||||
# * push to `dev` -> build every development image
|
||||
# * new git tag -> build every production image (tags live on main)
|
||||
# * manual dispatch -> build the channel of the selected branch
|
||||
#
|
||||
# Hardware variants come from an include-matrix:
|
||||
# ISO variants -> .config.system.build.isoImage (storeContents pulls in the closure)
|
||||
# Raspberry Pi -> .config.system.build.sdImage
|
||||
# `orion-lxc` emulates aarch64-linux, so the Pi build runs alongside the rest.
|
||||
name: Build Kiosk Images
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- dev
|
||||
tags:
|
||||
- "*"
|
||||
|
||||
env:
|
||||
# Both channel caches plus the Raspberry Pi cachix, so a build can substitute
|
||||
# from whichever channel the checked-out ref selects.
|
||||
NIX_CONFIG: |
|
||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org
|
||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: ${{ matrix.label }}
|
||||
runs-on: orion-lxc
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- label: kiosk
|
||||
system: kiosk-iso
|
||||
target: isoImage
|
||||
outdir: iso
|
||||
ext: iso
|
||||
arch: x86_64-linux
|
||||
manifest: manifest.json
|
||||
- label: commercial
|
||||
system: commercial-iso
|
||||
target: isoImage
|
||||
outdir: iso
|
||||
ext: iso
|
||||
arch: x86_64-linux
|
||||
manifest: manifest.json
|
||||
- label: android
|
||||
system: android-iso
|
||||
target: isoImage
|
||||
outdir: iso
|
||||
ext: iso
|
||||
arch: x86_64-linux
|
||||
manifest: manifest.json
|
||||
- label: rpi
|
||||
system: radiantwavekiosk-rpi
|
||||
target: sdImage
|
||||
outdir: sd-image
|
||||
ext: img.zst
|
||||
arch: aarch64-linux
|
||||
manifest: aarch64-manifest.json
|
||||
|
||||
steps:
|
||||
- name: Clone repository
|
||||
run: |
|
||||
rm -rf ./* ./.[!.]* 2>/dev/null || true
|
||||
ref="${GITHUB_REF#refs/heads/}"
|
||||
ref="${ref#refs/tags/}"
|
||||
git clone --depth 1 --branch "$ref" \
|
||||
ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||
git log --oneline -1
|
||||
|
||||
- name: Determine channel
|
||||
run: |
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
CHANNEL=$(nix eval --impure --raw .#channelName)
|
||||
if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi
|
||||
echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
|
||||
echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV"
|
||||
echo "Building the '$CHANNEL' channel ($LABEL)"
|
||||
|
||||
# Production only: fail fast unless the baked closure is exactly what
|
||||
# RadiantWave CI published to Attic. The dev channel churns on every
|
||||
# dispatch, so this is skipped there.
|
||||
- name: Verify baked baseline matches the published channel
|
||||
run: |
|
||||
set -euo pipefail
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
|
||||
if [ "$CHANNEL" != "radiantwave" ]; then
|
||||
echo "channel '$CHANNEL' is not production; skipping baseline preflight"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
VERSION=$(nix eval --impure --raw .#channelVersion)
|
||||
ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
|
||||
MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}"
|
||||
BASELINE=$(nix eval --impure --raw .#baselineOutPaths.${{ matrix.arch }})
|
||||
|
||||
MANIFEST=$(curl -fsSL "$MANIFEST_URL")
|
||||
PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
|
||||
PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
|
||||
|
||||
echo "channel version : $VERSION"
|
||||
echo "manifest version: $PUB_VERSION"
|
||||
echo "baseline path : $BASELINE"
|
||||
echo "manifest path : $PUB_PATH"
|
||||
|
||||
if [ "$VERSION" != "$PUB_VERSION" ]; then
|
||||
echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
|
||||
exit 1
|
||||
fi
|
||||
if [ "$BASELINE" != "$PUB_PATH" ]; then
|
||||
echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
|
||||
echo " Run 'nix flake update radiantwave' so the pinned input resolves to the released commit."
|
||||
exit 1
|
||||
fi
|
||||
HASH=$(basename "$BASELINE" | cut -d- -f1)
|
||||
if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
|
||||
echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Prepare output directory
|
||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||
|
||||
- name: Build ${{ matrix.label }}
|
||||
run: |
|
||||
export NIXPKGS_ALLOW_UNFREE=1
|
||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||
nix build -L --impure \
|
||||
".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}"
|
||||
|
||||
- name: Publish ${{ matrix.label }}
|
||||
run: |
|
||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||
FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}"
|
||||
cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \
|
||||
"/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||
rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||
@@ -10,10 +10,12 @@ Hosted on Gitea: `https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig`
|
||||
|
||||
Two branches — `main` (prod) and `dev`. There are **no `-dev` configs**: each hardware target has exactly one config, and the branch selects its channel via the single `channel` block at the top of `flake.nix`:
|
||||
|
||||
- `main`: `channel.appInput = radiantwave` (main), `atticRepo = "radiantwave"`, `gitRef = ""` (default branch).
|
||||
- `dev`: `channel.appInput = radiantwave-dev`, `atticRepo = "radiantwave-dev"`, `gitRef = "?ref=dev"`.
|
||||
- `main`: `channel.appInput = radiantwave` (pinned to tag `1.8`), `atticRepo = "radiantwave"`, `gitRef = ""` (default branch), `appVersion = "1.8"`.
|
||||
- `dev`: `channel.appInput = radiantwave-dev`, `atticRepo = "radiantwave-dev"`, `gitRef = "?ref=dev"`, `appVersion = <dev fingerprint>`.
|
||||
|
||||
Everything downstream (the configs, ISOs, updater module, autoUpgrade refs) reads from `channel`, so a `dev`→`main` merge carries your changes automatically — no copying between sibling configs. To flip a channel, change only those three `channel` values. When merging, reconcile just this one block.
|
||||
Everything downstream (the configs, ISOs, updater module, autoUpgrade refs) reads from `channel`, so a `dev`→`main` merge carries your changes automatically — no copying between sibling configs. To flip a channel, change only those four `channel` values. When merging, reconcile just this one block.
|
||||
|
||||
`channel.appVersion` is applied to the baked app via `appPackage = system: channel.appInput.packages.${system}.default.override { version = channel.appVersion; }`. RadiantWave's own flake only injects its version from the ambient `APP_VERSION` env var on impure evals, so pure evals (local `nix build`, `build-rpi.sh`) fall back to `0.1.0`. Declaring the version here keeps local and CI builds correct without `--impure`, and the derivation matches the Attic closure when RadiantWave CI built it with the same version string. Bump `appVersion` whenever the pinned input changes (release tag on `main`, short commit hash on `dev`).
|
||||
|
||||
Both gitea repos are public: all git access is plain HTTPS (`git+https://...`), no SSH keys or access tokens on the kiosks. Don't reintroduce `git+ssh` URLs in flake/upgrade refs.
|
||||
|
||||
@@ -42,10 +44,10 @@ One config per hardware target. Dev/prod is the branch, not the config — see `
|
||||
|
||||
| Name | Target hardware | Disk device | App input |
|
||||
|---|---|---|---|
|
||||
| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | `radiantwave` (main) |
|
||||
| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | `radiantwave` (main) |
|
||||
| `radiantwavekiosk-android` | Intel NUC 14, rotated display | `/dev/nvme0n1` | `radiantwave` (main) |
|
||||
| `radiantwavekiosk-rpi` | Raspberry Pi 5 (SD image) | — | `radiantwave` (main) |
|
||||
| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | `radiantwave` (tag 1.8) |
|
||||
| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | `radiantwave` (tag 1.8) |
|
||||
| `radiantwavekiosk-android` | Intel NUC 14, rotated display | `/dev/nvme0n1` | `radiantwave` (tag 1.8) |
|
||||
| `radiantwavekiosk-rpi` | Raspberry Pi 5 (SD image) | — | `radiantwave` (tag 1.8) |
|
||||
|
||||
On the `dev` branch, the same four configs use `radiantwave-dev` and track `?ref=dev`.
|
||||
|
||||
@@ -92,12 +94,13 @@ Regenerate when major hardware changes, not on a schedule — reports are snapsh
|
||||
|
||||
- **Disk device differs by variant**: `disk-config.nix` uses `/dev/nvme0n1`, `commercial-disk-config.nix` uses `/dev/sda`. `mkIso` pairs each ISO with the correct layout automatically — keep new ISOs paired correctly.
|
||||
- **Changing a config name** requires updating that config's `upgradeFlakeRef` in `flake.nix` (it embeds the name).
|
||||
- **The `channel` block is the dev/prod toggle** in `flake.nix` — `appInput`, `atticRepo`, `gitRef`. When merging `dev`→`main`, keep this block's values for the target branch; only this block differs between branches.
|
||||
- **The `channel` block is the dev/prod toggle** in `flake.nix` — `appInput`, `atticRepo`, `gitRef`, `appVersion`. When merging `dev`→`main`, keep this block's values for the target branch; only this block differs between branches.
|
||||
- **`rotated_display.nix` uses `mkForce`** on `loginShellInit` — it replaces the entire kiosk startup script from `configuration.nix`; don't edit both.
|
||||
- **Auto-update**: `system.autoUpgrade` runs every 10 min (`*:00/10`) with `--refresh`, operation `switch`, no auto-reboot. A `radiantwave-backup` rsync runs before each attempt. The health-check/rollback service is written but commented out in `configuration.nix`.
|
||||
- **Live app updater**: each config's `radiantwaveUpdaterModule` points at a per-arch manifest — x86 uses `<repo>/manifest.json`, RPi uses `<repo>/aarch64-manifest.json` (via the `manifestFile` arg). A 2-min timer polls it and fetches the announced closure from the channel's Attic repo. RPi live updates require RadiantWave CI to publish both an aarch64 closure and `aarch64-manifest.json`; until then the RPi stays on the baked baseline.
|
||||
- **No binary cache**: kiosks fetch from cache.nixos.org only and compile RadiantWave itself from source during upgrades. Attic integration was planned (see `PLAN-update-system.md`) but never wired; the old netrc/JWT setup has been removed.
|
||||
- **Secrets**: none in-tree anymore (gitea repos are public). If either repo goes private, re-add auth via `nix.settings.access-tokens` in `configuration.nix`.
|
||||
- **Flake inputs**: `radiantwave` tracks main, `radiantwave-dev` tracks `?ref=dev`. The `channel` block picks which one the configs consume. Updating them independently is intentional.
|
||||
- **Flake inputs**: `radiantwave` is pinned to tag `1.8` (`?ref=refs/tags/1.8`); `radiantwave-dev` tracks `?ref=dev`. The `channel` block picks which one the configs consume. Bump the pinned tag and `channel.appVersion` together.
|
||||
- **SSH keys on machines are inbound-only** (`authorizedKeys` for admin access); outbound git is HTTPS. The root key in `zero-touch-installer.nix` must stay in sync with `myKey` in `configuration.nix`.
|
||||
|
||||
## File map
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
{ config, pkgs, radiantwave, upgradeFlakeRef, radiantwavePlymouth, ... }:
|
||||
{ config, pkgs, radiantwaveApp, upgradeFlakeRef, radiantwavePlymouth, ... }:
|
||||
|
||||
let
|
||||
radiantApp = radiantwave.packages.${pkgs.system}.default;
|
||||
radiantApp = radiantwaveApp;
|
||||
# When the live-updater module is enabled, RadiantWave launches through the
|
||||
# mutable /var/lib/radiantwave/current
|
||||
# pointer so it can be swapped without a full nixos-rebuild. Otherwise it
|
||||
|
||||
Generated
+6
-6
@@ -220,16 +220,16 @@
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1787675420,
|
||||
"narHash": "sha256-2Hq9IcgdDXQc2uQ4yC/5NZVjcZaFCcVS78vj+ee+y/Q=",
|
||||
"ref": "main",
|
||||
"rev": "43cd93bbd7dde69c55c00a28c1691e1a192eda39",
|
||||
"revCount": 47,
|
||||
"lastModified": 1790803867,
|
||||
"narHash": "sha256-HRGQQlmn/kCsZIq1wBMFaW6q1xfSvwPhUS5CpG1mm+Q=",
|
||||
"ref": "refs/tags/1.8",
|
||||
"rev": "34c72b51ddc3da8d46d994e787ffd1f8e8dda77c",
|
||||
"revCount": 85,
|
||||
"type": "git",
|
||||
"url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"ref": "refs/tags/1.8",
|
||||
"type": "git",
|
||||
"url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
|
||||
}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
|
||||
radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=main";
|
||||
radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=refs/tags/1.8";
|
||||
radiantwave-dev.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=dev";
|
||||
nixos-raspberrypi.url = "github:nvmd/nixos-raspberrypi/main";
|
||||
};
|
||||
@@ -62,28 +62,49 @@
|
||||
# this channel, so a `dev`-to-`main` merge carries your changes with it
|
||||
# automatically. There are no more `-dev` sibling configs to copy.
|
||||
#
|
||||
# main: appInput = radiantwave (main), atticRepo = "radiantwave",
|
||||
# gitRef = "" (default branch)
|
||||
# dev: appInput = radiantwave-dev, atticRepo = "radiantwave-dev",
|
||||
# gitRef = "?ref=dev"
|
||||
# main: appInput = radiantwave (tag 1.8), atticRepo = "radiantwave",
|
||||
# gitRef = "", appVersion = "1.8"
|
||||
# dev: appInput = radiantwave-dev, atticRepo = "radiantwave-dev",
|
||||
# gitRef = "?ref=dev", appVersion = <dev fingerprint>
|
||||
#
|
||||
# To flip branches, change ONLY these three values (then push/merge).
|
||||
# To flip branches, change ONLY these four values (then push/merge).
|
||||
channel = {
|
||||
appInput = radiantwave-dev; # dev
|
||||
atticRepo = "radiantwave-dev"; # dev
|
||||
gitRef = "?ref=dev"; # dev
|
||||
appVersion = "2917d33"; # dev
|
||||
};
|
||||
|
||||
# Exposed so CI (see .gitea/workflows/build-prod-*.yml) and humans can
|
||||
# verify which channel this checkout resolves to. On `main` this must be
|
||||
# "radiantwave"; on `dev` it must be "radiantwave-dev". The prod
|
||||
# workflows fail fast if this isn't the production channel, so a merge
|
||||
# that brings a dev-pointing channel block into `main` breaks the build
|
||||
# instead of silently shipping dev builds as prod ISOs.
|
||||
channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev";
|
||||
|
||||
# The App package, pinned to the channel's declared version. RadiantWave's
|
||||
# own flake only injects its version from the ambient APP_VERSION env var
|
||||
# on impure evals; pure evals (local `nix build`, build-rpi.sh) fall back
|
||||
# to its 0.1.0 default. Overriding the version here makes the baked
|
||||
# baseline correct regardless of eval purity, and matches the Attic
|
||||
# closure when RadiantWave CI built it with the same version string.
|
||||
appPackage = system: channel.appInput.packages.${system}.default.override {
|
||||
version = channel.appVersion;
|
||||
};
|
||||
|
||||
# Live app-update side channel. The manifest is served by the
|
||||
# fileserver; closures are fetched (never built) from the channel's
|
||||
# Attic cache. `repo` selects the channel — "radiantwave" (main) or
|
||||
# "radiantwave-dev" (dev). All variants follow this same update
|
||||
# procedure; only the channel differs.
|
||||
radiantwaveUpdaterModule = { repo, baseline }: {
|
||||
# "radiantwave-dev" (dev) — and `manifestFile` selects the per-arch
|
||||
# manifest (default "manifest.json"; Raspberry Pi uses
|
||||
# "aarch64-manifest.json"). All variants follow this same update
|
||||
# procedure; only the channel/arch differ.
|
||||
radiantwaveUpdaterModule = { repo, baseline, manifestFile ? "manifest.json" }: {
|
||||
services.radiantwaveUpdater = {
|
||||
enable = true;
|
||||
baselinePackage = baseline;
|
||||
manifestUrl = "https://files.radiantwavetech.com/${repo}/manifest.json";
|
||||
manifestUrl = "https://files.radiantwavetech.com/${repo}/${manifestFile}";
|
||||
atticUrl = "https://attic.radiantwavetech.com/${repo}";
|
||||
};
|
||||
};
|
||||
@@ -100,8 +121,8 @@
|
||||
inherit system;
|
||||
|
||||
specialArgs = {
|
||||
inherit radiantwave;
|
||||
inherit upgradeFlakeRef;
|
||||
inherit radiantwave upgradeFlakeRef;
|
||||
radiantwaveApp = appPackage system;
|
||||
radiantwavePlymouth = mkRadiantwavePlymouth;
|
||||
};
|
||||
|
||||
@@ -137,10 +158,12 @@
|
||||
specialArgs = {
|
||||
inherit radiantwave upgradeFlakeRef;
|
||||
inherit nixos-raspberrypi;
|
||||
radiantwaveApp = appPackage "aarch64-linux";
|
||||
radiantwavePlymouth = mkRadiantwavePlymouth;
|
||||
};
|
||||
|
||||
modules = [
|
||||
{ nixpkgs.config.allowUnfree = true; }
|
||||
({ ... }: {
|
||||
imports = with nixos-raspberrypi.nixosModules; [
|
||||
sd-image
|
||||
@@ -201,6 +224,8 @@
|
||||
};
|
||||
in
|
||||
{
|
||||
inherit channelName;
|
||||
|
||||
packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
|
||||
packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
|
||||
packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
|
||||
@@ -222,7 +247,7 @@
|
||||
diskModule = ./disk-config.nix;
|
||||
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk";
|
||||
extraModules = [
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.x86_64-linux.default; })
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = appPackage "x86_64-linux"; })
|
||||
];
|
||||
};
|
||||
radiantwavekiosk-commercial = mkKioskSystem {
|
||||
@@ -232,7 +257,7 @@
|
||||
diskModule = ./commercial-disk-config.nix;
|
||||
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-commercial";
|
||||
extraModules = [
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.x86_64-linux.default; })
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = appPackage "x86_64-linux"; })
|
||||
];
|
||||
};
|
||||
# Rotated screen for android-style displays.
|
||||
@@ -244,7 +269,7 @@
|
||||
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-android";
|
||||
extraModules = [
|
||||
./rotated_display.nix
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.x86_64-linux.default; })
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = appPackage "x86_64-linux"; })
|
||||
];
|
||||
};
|
||||
# Raspberry Pi 5.
|
||||
@@ -253,7 +278,11 @@
|
||||
hostName = "radiantwavekiosk-rpi";
|
||||
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-rpi";
|
||||
extraModules = [
|
||||
(radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.aarch64-linux.default; })
|
||||
(radiantwaveUpdaterModule {
|
||||
repo = channel.atticRepo;
|
||||
baseline = appPackage "aarch64-linux";
|
||||
manifestFile = "aarch64-manifest.json";
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
+10
-3
@@ -1,6 +1,13 @@
|
||||
{ pkgs, radiantwave, ...}:
|
||||
{ config, pkgs, radiantwaveApp, ...}:
|
||||
let
|
||||
radiantApp = radiantwave.packages.${pkgs.system}.default;
|
||||
radiantApp = radiantwaveApp;
|
||||
# Match configuration.nix: when the live updater is enabled, launch through
|
||||
# the mutable /var/lib/radiantwave/current pointer so Android kiosks receive
|
||||
# app updates instead of always running the baked baseline.
|
||||
launchBin =
|
||||
if config.services.radiantwaveUpdater.enable or false
|
||||
then "/var/lib/radiantwave/current/bin/radiantwave"
|
||||
else "${radiantApp}/bin/radiantwave";
|
||||
kioskscript = pkgs.writeShellScript "kiosk-start" ''
|
||||
# Wait for the Wayland display to be ready
|
||||
for i in {1..10}; do
|
||||
@@ -13,7 +20,7 @@ let
|
||||
OUTPUT=$(${pkgs.wlr-randr}/bin/wlr-randr | grep -m1 '^\S' | awk '{print $1}')
|
||||
echo "Rotating output: $OUTPUT" >> /tmp/kiosk.log
|
||||
${pkgs.wlr-randr}/bin/wlr-randr --output "$OUTPUT" --transform 90 >> /tmp/kiosk.log 2>&1 || echo "wlr-randr failed" >> /tmp/kiosk.log
|
||||
exec ${radiantApp}/bin/radiantwave -d -s
|
||||
exec ${launchBin} -d -s
|
||||
'';
|
||||
in
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user