torjus/nixos-servers
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

docs: update nix-cache-reprovision plan with Harmonia progress
Some checks failed
Run nix flake check / flake-check (push) Failing after 52s
Details

Browse Source 
- Phase 4 now in progress
- Harmonia configured on nix-cache02 with new signing key
- Trusted public key deployed to all hosts
- Cache tested successfully from testvm01
- Actions runner removed from scope

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Torjus Håkestad
2026-02-10 23:17:51 +01:00
parent 49f7e3ae2e
commit afff3f28ca
1 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/plans/nix-cache-reprovision.md
View File

@@ -11,7 +11,7 @@ Reprovision `nix-cache01` using the OpenTofu workflow, and improve the build/cac
**Phase 1: New Build Host** - COMPLETE **Phase 1: New Build Host** - COMPLETE
**Phase 2: NATS Build Triggering** - COMPLETE **Phase 2: NATS Build Triggering** - COMPLETE
**Phase 3: Safe Flake Update Workflow** - NOT STARTED **Phase 3: Safe Flake Update Workflow** - NOT STARTED
**Phase 4: Decommission Old System** - NOT STARTED **Phase 4: Complete Migration** - IN PROGRESS (Harmonia configured, DNS cutover pending)
## Completed Work ## Completed Work
@@ -54,6 +54,14 @@ The `homelab-deploy` tool was extended with a builder mode:
- Single host build: `build nixos-servers testvm01` (~30s) - Single host build: `build nixos-servers testvm01` (~30s)
- All hosts build: `build nixos-servers all` (16 hosts in ~226s) - All hosts build: `build nixos-servers all` (16 hosts in ~226s)
### Harmonia Binary Cache
- Parameterized `services/nix-cache/harmonia.nix` to use hostname-based Vault paths
- Parameterized `services/nix-cache/proxy.nix` for hostname-based domain
- New signing key: `nix-cache02.home.2rjus.net-1`
- Vault secret: `hosts/nix-cache02/cache-secret`
- Removed unused Gitea Actions runner from nix-cache01
## Current State ## Current State
### Old System (nix-cache01) ### Old System (nix-cache01)
@@ -66,9 +74,10 @@ The `homelab-deploy` tool was extended with a builder mode:
- Running at 10.69.13.25 - Running at 10.69.13.25
- Builder service active, responding to NATS build requests - Builder service active, responding to NATS build requests
- Metrics exposed on port 9973 (`homelab-deploy-builder` job) - Metrics exposed on port 9973 (`homelab-deploy-builder` job)
- Does NOT yet have: - Harmonia binary cache server running
- Harmonia (binary cache server) - New signing key configured (`nix-cache02.home.2rjus.net-1`)
- Cache signing key - Currently serving at `https://nix-cache02.home.2rjus.net` (for testing)
- Trusted public key deployed to all hosts
## Remaining Work ## Remaining Work
@@ -81,13 +90,16 @@ The `homelab-deploy` tool was extended with a builder mode:
### Phase 4: Complete Migration ### Phase 4: Complete Migration
1. **Add Harmonia to nix-cache02** - Copy cache signing key, configure service 1. ~~**Add Harmonia to nix-cache02**~~ ✅ Done - new signing key, parameterized service
2. **Update DNS** - Point `nix-cache.home.2rjus.net` to nix-cache02 2. ~~**Add trusted public key to all hosts**~~ ✅ Done - `system/nix.nix` updated
3. **Increase RAM** - Bump to 24GB after nix-cache01 is gone 3. ~~**Test cache from other hosts**~~ ✅ Done - verified from testvm01
4. **Decommission nix-cache01**: 4. **Update proxy** - Add `nix-cache.home.2rjus.net` to nix-cache02's Caddy config
5. **Increase RAM** - Bump to 24GB after nix-cache01 is gone
6. **Decommission nix-cache01**:
- Remove from `terraform/vms.tf` - Remove from `terraform/vms.tf`
- Remove old build script (`services/nix-cache/build-flakes.nix`, `build-flakes.sh`) - Remove old build script (`services/nix-cache/build-flakes.nix`, `build-flakes.sh`)
- Archive or delete host config - Archive or delete host config
- Remove old signing key from `system/nix.nix` trusted-public-keys
### Phase 5: Scheduled Builds (Optional) ### Phase 5: Scheduled Builds (Optional)