This is basically
<af7ce9b8ed>,
but with support for deploying locally.
This failed to install secrets to `/var/lib/sops-nix`. That's because
our `LocalHost` didn't have support for sudo yet. I fixed that.
I had concurrency issues with `nix copy` and the ssh:// protocol when
using a machine both as the build host/target host (for different
machines), where it make the result path partially available to a
different update command thread.
Now the user can pass `--build-host local`, to select the local machine as a build host, in which case no ssh is used.
This means the admin machine does not necessarily have ssh set up to itself, which was confusing for many users.
Also this makes it easier to re-use a well configured nix remote build setup which is only available on the local machine. Eg if `--build-host local` nix' defaults for remote builds on that machine will be utilized.
Motivation: local builds and deployments without ssh
Add a new interface `Host` which is implemented bei either `Remote` or `Localhost`
This simplifies all interactions with hosts. THe caller does ot need to know if the Host is remote or local in mot cases anymore
The documentation currently lists setting targetHost in the NixOS
configuration as a slower, but valid option. Especially for dynamic
values, this is the recommended way but it results in a lot of annyoing
warnings.
This lowers the warning level, so it will only get printed on --debug
Despite using `root` as the ssh user, `ssh-ng` still fails with:
`error: cannot add path '/nix/store/...' because it lacks a signature by a trusted key
`
This does not happen with `ssh` instead of `ssh-ng`
since this code is used as a default in the cli parser, we should not
crash on OSError because we wouldn't be abe to perform basic tasks such
as --help.
pathlib.Path("git+file:///foo").resolve() might resolve to urls like
PosixPath('/home/joerg/work/clan/clan-core/git+file:/foo'). If those
then actually exist, this can have weird behavior. We should in general
avoid changing directories for everything except for subprocess.run.
This is an attempt to reduce cognitive load when trying to understand the host related logic in run_machine_update.
The change should not affect behavior.
Done:
- make it very clear early on, that build_host == target_host if build_host is not set.
- rename some variables to make relations more clear
- remove `deploy_host` variable. unnecessary complexity
- remove `become_root` variable. After simplifying via boolean algebra, this boils down to `build_host == target_host`.
