infrastructure/.gitlab-ci.yml

68 lines
1.7 KiB
YAML

image: nixos/nix
variables:
NIXOS_VERSION: "unstable"
NIXPKGS_ALLOW_UNFREE: "1"
NIXPKGS_ALLOW_INSECURE: "1"
stages:
- test
- deploy
before_script:
- mv .gitlab/passwd /etc/passwd
- mv .gitlab/group /etc/group
- mv nix.conf /etc/nix/nix.conf
- nix-channel --add https://nixos.org/channels/nixos-${NIXOS_VERSION} nixos
- nix-channel --update
test:
stage: test
script:
- nix flake check
rules:
- if: $CI_PIPELINE_SOURCE == "schedule"
when: never
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
when: never
- when: always
deploy:
stage: deploy
script:
# Init OpenSSH
- nix-env -iA nixos.openssh
- eval "$(ssh-agent -s)"
- chmod 0600 $SSH_PRIVATE_KEY
- ssh-add $SSH_PRIVATE_KEY
# Deploy everything
- nix develop --command deploy
rules:
- if: $CI_PIPELINE_SOURCE == "schedule"
when: never
- if: $CI_COMMIT_BRANCH == "master"
check updates:
stage: test
script:
# Prepare git access
- nix-env -iA nixos.openssh
- eval "$(ssh-agent -s)"
- chmod 0600 $SSH_UPDATE_KEY
- ssh-add $SSH_UPDATE_KEY
- git config --global user.name "NixOS Flake Update"
- git config --global user.email "git@lewd.wtf"
- git remote rm origin && git remote add origin "git@git.lewd.wtf:${CI_PROJECT_PATH}.git"
# Update flakes
- nix flake update
# Push changes
- git branch -D flakes_update || true
- git checkout -b flakes_update
- git add flake.lock
- git commit -m 'Update NixOS Flakes'
- GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" git push -f --set-upstream origin flakes_update -o merge_request.create
rules:
- if: $CI_PIPELINE_SOURCE == "schedule"