Skip to content

Commit 013da19

Browse files
syscod3syscod3
committed
port deploy/secrets operations to mise tasks and update README
1 parent 8112224 commit 013da19

11 files changed

Lines changed: 189 additions & 20 deletions

File tree

‎README.md‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -140,39 +140,40 @@ Build without switching (test configuration):
140140
sudo nixos-rebuild build --flake .#laptop
141141
```
142142

143-
### Legacy operational commands (migration pending)
143+
### Operational commands (mise-first)
144144

145-
Host install/deploy and secret operations are still `just`-based while task migration is in progress.
145+
Use `mise` tasks for deploy and secrets workflows.
146146

147147
### Remote Deployment (from central laptop)
148148

149149
Deploy to a remote machine:
150150
```bash
151-
just deploy <hostname>
151+
HOST=<hostname> mise run deploy
152152

153153
# Examples
154-
just deploy spark
155-
just deploy vps-alpha
154+
HOST=spark mise run deploy
155+
HOST=vps-alpha mise run deploy
156156
```
157157

158158
Pull latest changes and deploy:
159159
```bash
160-
just pull-deploy <hostname>
160+
HOST=<hostname> mise run pull-deploy
161161
```
162162

163163
Sync changes made on remote machine back to central repo:
164164
```bash
165-
just sync-remote <hostname>
165+
HOST=<hostname> mise run sync-remote
166166
# Then review, commit, and push
167167
```
168168

169169
### Update flake inputs (update nixpkgs, home-manager, etc.)
170170
```bash
171-
just update
171+
mise run update
172172
```
173173

174-
### List all available legacy operational commands
174+
### Legacy compatibility commands
175175
```bash
176+
# Still available during migration window:
176177
just --list
177178
```
178179

@@ -213,18 +214,18 @@ This repository uses **sops-nix** with GPG and age for secrets encryption.
213214

214215
### Edit encrypted secrets:
215216
```bash
216-
just secrets # Edit common secrets
217-
just secrets secrets/vps/knock-sequences.yaml # Edit specific file
217+
mise run secrets # Edit common secrets
218+
FILE=secrets/vps/knock-sequences.yaml mise run secrets
218219
```
219220

220221
### View decrypted secrets:
221222
```bash
222-
just secrets-view secrets/common/secrets.yaml
223+
FILE=secrets/common/secrets.yaml mise run secrets-view
223224
```
224225

225226
### Update encryption keys (after adding new host):
226227
```bash
227-
just secrets-update
228+
mise run secrets-update
228229
```
229230

230231
**See `docs/SOPS_GPG_SETUP.md` for complete setup guide.**
@@ -311,13 +312,21 @@ mise tasks ls
311312
mise run ci-validate
312313
mise run ci-security
313314

314-
# Legacy ops path (still just-based while migration is in progress)
315+
# Deploy + sync operations
316+
HOST=<hostname> mise run deploy
317+
HOST=<hostname> mise run pull-deploy
318+
HOST=<hostname> mise run sync-remote
319+
HOST=<hostname> BRANCH=main mise run remote-push
320+
321+
# Secrets operations
322+
mise run secrets
323+
FILE=secrets/common/secrets.yaml mise run secrets-view
324+
mise run secrets-update
325+
326+
# Flake input update
327+
mise run update
328+
329+
# Legacy path for host bootstrap/install (until migrated)
315330
just --list
316331
just install <host> <category> <ip>
317-
just deploy <hostname>
318-
just deploy-all
319-
just update
320-
just secrets
321-
just knock <vps-hostname>
322-
just sync-remote <hostname>
323332
```

‎mise.toml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
[tools]
22
python = "3.13"
33

4+
[tasks.check]
5+
description = "Alias for flake check"
6+
depends = ["flake-check"]
7+
run = "echo 'check complete'"
8+
49
[tasks.fmt]
510
description = "Format Nix files"
611
run = '''
@@ -53,3 +58,66 @@ if find . -type f -exec grep -l "BEGIN.*PRIVATE KEY" {} \\; | grep -v ".secrets.
5358
exit 1
5459
fi
5560
'''
61+
62+
[tasks.update]
63+
description = "Update flake inputs"
64+
run = '''
65+
set -euo pipefail
66+
./scripts/mise/update.sh
67+
'''
68+
69+
[tasks.deploy]
70+
description = "Deploy to host (set HOST=<name>)"
71+
run = '''
72+
set -euo pipefail
73+
./scripts/mise/deploy.sh
74+
'''
75+
76+
[tasks.deploy-all]
77+
description = "Deploy to standard host set"
78+
run = '''
79+
set -euo pipefail
80+
./scripts/mise/deploy-all.sh
81+
'''
82+
83+
[tasks.pull-deploy]
84+
description = "git pull then deploy (set HOST=<name>)"
85+
run = '''
86+
set -euo pipefail
87+
./scripts/mise/pull-deploy.sh
88+
'''
89+
90+
[tasks.sync-remote]
91+
description = "Sync changed files from remote host (set HOST=<name>)"
92+
run = '''
93+
set -euo pipefail
94+
./scripts/mise/sync-remote.sh
95+
'''
96+
97+
[tasks.remote-push]
98+
description = "Commit/push from remote host via agent forwarding (HOST, optional BRANCH)"
99+
run = '''
100+
set -euo pipefail
101+
./scripts/mise/remote-push.sh
102+
'''
103+
104+
[tasks.secrets]
105+
description = "Edit encrypted secrets (optional FILE=secrets/...yaml)"
106+
run = '''
107+
set -euo pipefail
108+
./scripts/mise/secrets-edit.sh
109+
'''
110+
111+
[tasks.secrets-view]
112+
description = "View decrypted secrets (optional FILE=secrets/...yaml)"
113+
run = '''
114+
set -euo pipefail
115+
./scripts/mise/secrets-view.sh
116+
'''
117+
118+
[tasks.secrets-update]
119+
description = "Run sops updatekeys on secrets/*.yaml"
120+
run = '''
121+
set -euo pipefail
122+
./scripts/mise/secrets-update.sh
123+
'''

‎scripts/mise/deploy-all.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
hosts=(bit spark hermes vps-alpha server-alpha)
4+
for host in "${hosts[@]}"; do
5+
echo "deploying $host"
6+
deploy ".#$host"
7+
done

‎scripts/mise/deploy.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
host="${HOST:-${1:-}}"
4+
if [ -z "$host" ]; then
5+
echo "usage: HOST=<host> mise run deploy"
6+
exit 1
7+
fi
8+
exec deploy ".#$host"

‎scripts/mise/pull-deploy.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
host="${HOST:-${1:-}}"
4+
if [ -z "$host" ]; then
5+
echo "usage: HOST=<host> mise run pull-deploy"
6+
exit 1
7+
fi
8+
git pull --ff-only
9+
deploy ".#$host"

‎scripts/mise/remote-push.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
host="${HOST:-${1:-}}"
4+
branch="${BRANCH:-${2:-main}}"
5+
remote_path="${REMOTE_PATH:-/etc/nixos}"
6+
if [ -z "$host" ]; then
7+
echo "usage: HOST=<host> [BRANCH=main] mise run remote-push"
8+
exit 1
9+
fi
10+
11+
ssh -A "$host" bash -s <<EOS
12+
set -euo pipefail
13+
cd "$remote_path"
14+
if [[ -z \\$(git status --porcelain) ]]; then
15+
echo "no changes to commit on $host"
16+
exit 0
17+
fi
18+
git add .
19+
git commit -m "chore: update from $host [\\$(date +%Y-%m-%d)]"
20+
git push origin "$branch"
21+
EOS

‎scripts/mise/secrets-edit.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
file="${FILE:-${1:-secrets/common/secrets.yaml}}"
4+
exec sops "$file"

‎scripts/mise/secrets-update.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
while IFS= read -r file; do
4+
[ -n "$file" ] || continue
5+
echo "updating keys: $file"
6+
sops updatekeys "$file"
7+
done < <(find secrets -type f \( -name '*.yaml' -o -name '*.yml' \) | sort)

‎scripts/mise/secrets-view.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
file="${FILE:-${1:-secrets/common/secrets.yaml}}"
4+
exec sops -d "$file"

‎scripts/mise/sync-remote.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
host="${HOST:-${1:-}}"
4+
remote_path="${REMOTE_PATH:-/etc/nixos}"
5+
if [ -z "$host" ]; then
6+
echo "usage: HOST=<host> mise run sync-remote"
7+
exit 1
8+
fi
9+
10+
tmp_dir="$(mktemp -d)"
11+
trap 'rm -rf "$tmp_dir"' EXIT
12+
13+
ssh "$host" "cd '$remote_path' && git diff --name-only" > "$tmp_dir/changed_files.txt"
14+
if [ ! -s "$tmp_dir/changed_files.txt" ]; then
15+
echo "no changes on $host"
16+
exit 0
17+
fi
18+
19+
echo "changed files:"
20+
cat "$tmp_dir/changed_files.txt"
21+
22+
while IFS= read -r file; do
23+
[ -n "$file" ] || continue
24+
mkdir -p "$(dirname "$file")"
25+
scp "$host:$remote_path/$file" "$file"
26+
done < "$tmp_dir/changed_files.txt"
27+
28+
echo "sync complete; review with git diff"

0 commit comments

Comments
 (0)