From 1814173e3c9bc23d7eab016c7ab3e9d703f838e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=9C=BF=20corey=20=28they/them=29?= <c@rey.foo>
Date: Tue, 10 Mar 2026 22:50:04 -0700
Subject: [PATCH 1/2] feat: add deploy-rs for automated NixOS deployments via
 GitHub Actions

Integrates deploy-rs to enable push-based deployments to glyph, spore,
and zeta after CI passes on main. Uses Tailscale for connectivity and
Attic cache for pre-built closures. Magic rollback is enabled for safety.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/deploy.yml | 68 ++++++++++++++++++++++++++++++++
 flake.lock                   | 76 +++++++++++++++++++++++++++++++++++-
 flake.nix                    | 50 ++++++++++++++++++++++++
 lib/deploy.pub               |  1 +
 lib/keys.nix                 |  1 +
 modules/nixos/ssh.nix        |  1 +
 6 files changed, 195 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/deploy.yml
 create mode 100644 lib/deploy.pub

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 00000000..6f12d88b
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,68 @@
+name: Deploy
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event.workflow_run.conclusion == 'success'
+    strategy:
+      max-parallel: 1
+      matrix:
+        include:
+          - host: glyph
+            system: x86_64-linux
+            runner: ubuntu-latest
+          - host: spore
+            system: x86_64-linux
+            runner: ubuntu-latest
+          - host: zeta
+            system: aarch64-linux
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          extra_nix_config: |
+            extra-substituters = https://cache.zx.dev/main
+            extra-trusted-public-keys = main:mu0jkxdJTGWC3djDSEQb3rvZgqlhA8WVMulcTo5IW6c=
+
+      - name: Configure Attic cache
+        run: |
+          nix profile install --inputs-from . attic#attic-client
+          attic login rc https://cache.zx.dev ${{ secrets.ATTIC_TOKEN }}
+          attic use rc:main
+
+      - name: Connect to Tailscale
+        uses: tailscale/github-action@v3
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: tag:ci
+
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          cat >> ~/.ssh/config <<EOF
+          Host glyph spore zeta
+            User root
+            IdentityFile ~/.ssh/deploy_key
+            StrictHostKeyChecking accept-new
+          EOF
+
+      - name: Deploy to ${{ matrix.host }}
+        run: |
+          nix run --inputs-from . deploy-rs -- \
+            .#${{ matrix.host }} \
+            --skip-checks
diff --git a/flake.lock b/flake.lock
index 3eb36f80..7b636fc8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -102,6 +102,28 @@
         "type": "github"
       }
     },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1770019181,
+        "narHash": "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -139,6 +161,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -197,7 +235,7 @@
     },
     "git-hooks-nix": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
@@ -476,6 +514,7 @@
       "inputs": {
         "agenix": "agenix",
         "attic": "attic",
+        "deploy-rs": "deploy-rs",
         "disko": "disko",
         "flake-parts": "flake-parts_2",
         "git-hooks-nix": "git-hooks-nix",
@@ -490,11 +529,26 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixpkgs-stable": "nixpkgs-stable_2",
-        "systems": "systems",
+        "systems": "systems_2",
         "zx-dev": "zx-dev"
       }
     },
     "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
       "flake": false,
       "locked": {
         "path": "./flake.systems.nix",
@@ -506,6 +560,24 @@
       },
       "parent": []
     },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "zx-dev": {
       "inputs": {
         "anemone": "anemone",
diff --git a/flake.nix b/flake.nix
index 72d01cf6..bca57ebf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -33,6 +33,12 @@
     };
     nixos-hardware.url = "github:NixOS/nixos-hardware";
 
+    # Deployment
+    deploy-rs = {
+      url = "github:serokell/deploy-rs";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Linux
     disko = {
       url = "github:nix-community/disko";
@@ -116,6 +122,50 @@
           };
         };
 
+        deploy = {
+          remoteBuild = false;
+
+          nodes = {
+            glyph = {
+              hostname = "glyph";
+              sshUser = "root";
+              profiles.system = {
+                user = "root";
+                path =
+                  inputs.deploy-rs.lib.x86_64-linux.activate.nixos
+                  inputs.self.nixosConfigurations.glyph;
+              };
+            };
+
+            spore = {
+              hostname = "spore";
+              sshUser = "root";
+              profiles.system = {
+                user = "root";
+                path =
+                  inputs.deploy-rs.lib.x86_64-linux.activate.nixos
+                  inputs.self.nixosConfigurations.spore;
+              };
+            };
+
+            zeta = {
+              hostname = "zeta";
+              sshUser = "root";
+              profiles.system = {
+                user = "root";
+                path =
+                  inputs.deploy-rs.lib.aarch64-linux.activate.nixos
+                  inputs.self.nixosConfigurations.zeta;
+              };
+            };
+          };
+        };
+
+        checks =
+          builtins.mapAttrs
+          (system: deployLib: deployLib.deployChecks inputs.self.deploy)
+          inputs.deploy-rs.lib;
+
         nixConfig = {
           experimental-features = ["nix-command" "flakes"];
           extra-substituters = [
diff --git a/lib/deploy.pub b/lib/deploy.pub
new file mode 100644
index 00000000..ee8d7c38
--- /dev/null
+++ b/lib/deploy.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHoM/DCNtytZ/RlLaRYedKrL3ffuGlN7RywrROPx6Wp0 deploy@github-actions
diff --git a/lib/keys.nix b/lib/keys.nix
index 39dd1f30..2ebbd147 100644
--- a/lib/keys.nix
+++ b/lib/keys.nix
@@ -16,4 +16,5 @@ in
   builtins.listToAttrs hostKeyPairs
   // {
     home = firstLine (builtins.readFile ./../home/key.pub);
+    deploy = firstLine (builtins.readFile ./deploy.pub);
   }
diff --git a/modules/nixos/ssh.nix b/modules/nixos/ssh.nix
index 3dd1e1be..ed2f7e7d 100644
--- a/modules/nixos/ssh.nix
+++ b/modules/nixos/ssh.nix
@@ -9,6 +9,7 @@
   users.users.root.openssh.authorizedKeys.keys = [
     keys.Rhizome
     keys.glyph
+    keys.deploy
   ];
 
   users.users.mu.openssh.authorizedKeys.keys = [

From fe954d76b98907b214dfd202ec1498b7d2b45a28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=9C=BF=20corey=20=28they/them=29?= <c@rey.foo>
Date: Wed, 11 Mar 2026 08:41:57 -0700
Subject: [PATCH 2/2] fix: remove nix flake check from CI

nix flake check evaluates all flake outputs across all systems,
causing cross-platform build failures (e.g. aarch64-linux derivations
on x86_64-linux runners). The per-host build step already validates
each configuration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7043af25..fcc53c17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,6 @@ jobs:
         nix profile install --inputs-from . attic#attic-client
         attic login rc https://cache.zx.dev ${{ secrets.ATTIC_TOKEN }}
         attic use rc:main
-    - run: nix flake check
     - name: Build system configuration
       run: |
         if [ "${{ matrix.system }}" = "aarch64-darwin" ]; then