feat(gitops): implement native custom gitops solution with webhooks

modules/common/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./docker.nix
+    ./gitops.nix
     ./monitoring.nix
     ./nfs.nix
     ./traefik.nix
@@ -11,6 +12,7 @@
     homelab = {
       services.openssh.enable = true;
       users.admin.enable = true;
+      gitops.enable = true;
     };
 
     nix.settings.experimental-features = [

modules/common/gitops.nix

@@ -0,0 +1,141 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.homelab.gitops;
+
+  updateScript = pkgs.writeShellApplication {
+    name = "homelab-gitops-update";
+    runtimeInputs = [ pkgs.git pkgs.nixos-rebuild pkgs.jq pkgs.coreutils ];
+    text = ''
+      set -euo pipefail
+
+      REMOTE_URL="${cfg.repoUrl}"
+      BRANCH="${cfg.branch}"
+
+      echo "Checking remote hash for $REMOTE_URL branch $BRANCH..."
+      
+      # Fetch remote hash, fallback to unknown if it fails
+      REMOTE_HASH=$(git ls-remote "$REMOTE_URL" "refs/heads/$BRANCH" | awk '{print $1}' || true)
+
+      if [ -z "$REMOTE_HASH" ]; then
+        echo "WARNING: Could not fetch remote hash. Forcing rebuild to be safe."
+        REMOTE_HASH="unknown_remote"
+      fi
+
+      LOCAL_HASH="unknown_local"
+      if [ -f /run/current-system/configurationRevision ]; then
+        LOCAL_HASH=$(cat /run/current-system/configurationRevision)
+      fi
+
+      echo "Remote hash: $REMOTE_HASH"
+      echo "Local hash:  $LOCAL_HASH"
+
+      if [ "$REMOTE_HASH" = "$LOCAL_HASH" ] && [ "$REMOTE_HASH" != "unknown_remote" ] && [ "$LOCAL_HASH" != "unknown" ]; then
+        echo "Hashes match. No update needed."
+        exit 0
+      fi
+
+      echo "Hashes differ or unknown. Triggering nixos-rebuild..."
+
+      # Trigger the build and switch
+      nixos-rebuild switch --flake "git+$REMOTE_URL?ref=$BRANCH"
+
+      echo "Update successful."
+    '';
+  };
+
+in {
+  options.homelab.gitops = {
+    enable = lib.mkEnableOption "Custom GitOps native deployment system";
+    
+    repoUrl = lib.mkOption {
+      type = lib.types.str;
+      default = "https://git.depeuter.dev/Bos55/nix-config.git";
+      description = "The repository URL to pull configurations from.";
+    };
+    
+    branch = lib.mkOption {
+      type = lib.types.str;
+      default = "v2";
+      description = "The branch to deploy.";
+    };
+
+    useBuilder = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to use the central Builder host to compile packages.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # 1. Systemd Service and Timer for polling
+    systemd.services.homelab-gitops = {
+      description = "Homelab GitOps Update Service";
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${updateScript}/bin/homelab-gitops-update";
+        # Must run as root to rebuild the system
+        User = "root";
+      };
+    };
+
+    systemd.timers.homelab-gitops = {
+      description = "Timer for Homelab GitOps Update Service";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "5m";
+        OnUnitActiveSec = "5m";
+        RandomizedDelaySec = "30s";
+      };
+    };
+
+    # 2. Webhook listener for instant trigger
+    sops.secrets."webhook-secret" = {};
+
+    services.webhook = {
+      enable = true;
+      port = 9000;
+      hooks = {
+        gitops = {
+          execute-command = "${pkgs.systemd}/bin/systemctl";
+          pass-arguments-to-command = [
+            { source = "string"; name = "start"; }
+            { source = "string"; name = "homelab-gitops.service"; }
+          ];
+          trigger-rule = {
+            match = {
+              type = "payload-hash-sha256";
+              secret = "{{ getenv \"WEBHOOK_SECRET\" }}";
+              parameter = {
+                source = "header";
+                name = "X-Forgejo-Signature";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    # Inject the secret as an environment variable into the webhook service
+    systemd.services.webhook.serviceConfig.EnvironmentFile = config.sops.secrets."webhook-secret".path;
+
+    # 3. Builder Configuration
+    sops.secrets."builder-ssh-key" = lib.mkIf cfg.useBuilder {};
+
+    nix.buildMachines = lib.mkIf cfg.useBuilder [
+      {
+        hostName = "builder.depeuter.dev"; # Must be routable from nodes
+        system = "x86_64-linux";
+        sshUser = "builder";
+        sshKey = config.sops.secrets."builder-ssh-key".path;
+        maxJobs = 4;
+        speedFactor = 2;
+        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+      }
+    ];
+
+    nix.distributedBuilds = lib.mkIf cfg.useBuilder true;
+  };
+}