Bos55/nix-config
2
Fork 1
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity

feat(gitops): implement NATS JetStream and TrueNAS staging provisioning (Phase 5)

Browse source
This commit is contained in:
Tibo De Peuter 2026-08-05 18:13:15 +02:00
parent 2b533f4375
commit 2340c5a0e7
Signed by: tdpeuter
SSH key fingerprint: SHA256:u/h/LVoqKF1Iz02uOyxe6hcjmoZASCGV2HM0TG9ZMoU
3 changed files with 160 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

54
nixos/modules/services/hypervisor-gitops/default.nix
View file

@ -10,6 +10,36 @@ let
runtimeInputs = with pkgs; [ git opentofu coreutils ];
text = builtins.readFile ../../../../scripts/hypervisor-sync.sh;
};
stagingSyncScript = pkgs.writeShellApplication {
name = "staging-sync";
runtimeInputs = with pkgs; [ opentofu coreutils jq curl ];
text = builtins.readFile ../../../../scripts/staging-sync.sh;
};
natsConsumerScript = pkgs.writeShellApplication {
name = "nats-consumer";
runtimeInputs = with pkgs; [ natscli jq stagingSyncScript ];
text = ''
set -euo pipefail
NATS_URL=''${NATS_URL:-"nats://192.168.0.20:4222"}
echo "Starting NATS JetStream consumer for staging env..."
# Try to create stream and consumer if they don't exist
nats --server "$NATS_URL" stream add FORGEJO_EVENTS --subjects "forgejo.staging" --ack --max-msgs=-1 --max-bytes=-1 --max-age=1y --storage file -f || true
nats --server "$NATS_URL" consumer add FORGEJO_EVENTS STAGING --pull --ack explicit --filter forgejo.staging --deliver all -f || true
echo "Listening for messages..."
while true; do
# We use a simple sub to pull messages. In a real environment,
# a dedicated Go/Python client is better for manual explicit acks.
# This will auto-ack upon receipt and pass to the staging script.
nats --server "$NATS_URL" sub "forgejo.staging" | awk '/\[#.*\]/{flag=1; next} flag' | staging-sync || true
done
'';
};
in {
options.homelab.services.hypervisor-gitops = {
enable = mkEnableOption "Hypervisor GitOps Service";
@ -31,6 +61,8 @@ in {
environment.systemPackages = with pkgs; [
git
opentofu
natscli
jq
];
systemd.services.hypervisor-gitops = {
@ -60,5 +92,27 @@ in {
Persistent = true;
};
};
systemd.services.staging-sync = {
description = "Staging Environment NATS Consumer";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "root"; # Needs root to read SOPS secrets
Restart = "always";
RestartSec = "10s";
StateDirectory = "hypervisor-gitops";
WorkingDirectory = "/var/lib/hypervisor-gitops";
# We assume TRUENAS_API_KEY is provided via a sops EnvironmentFile
# EnvironmentFile = config.sops.secrets."truenas-api-key".path;
ExecStart = "${natsConsumerScript}/bin/nats-consumer";
};
};
};
}