feat(nixos): add control center host with hypervisor gitops service

scripts/hypervisor-sync.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+# This script pulls the latest changes from the Git repository 
+# and runs OpenTofu to provision the hypervisor state.
+# Usage: ./hypervisor-sync.sh <REPO_URL> <OPENTOFU_DIR>
+
+REPO_URL=${1:-"https://git.depeuter.dev/Bos55/nix-config.git"}
+OPENTOFU_DIR=${2:-"opentofu/nodes/mikoshi"}
+
+echo "Starting Hypervisor GitOps sync..."
+
+if [ ! -d "nix-config" ]; then
+  echo "Cloning repository from $REPO_URL..."
+  git clone "$REPO_URL" nix-config
+fi
+
+cd nix-config || exit
+
+git fetch origin main
+
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse origin/main)
+
+if [ "$LOCAL" = "$REMOTE" ]; then
+  echo "Already up to date. Nothing to do."
+  exit 0
+fi
+
+echo "Changes detected. Updating from $LOCAL to $REMOTE..."
+git reset --hard origin/main
+
+echo "Applying OpenTofu changes in $OPENTOFU_DIR..."
+cd "$OPENTOFU_DIR" || exit
+
+tofu init -upgrade
+
+tofu apply -auto-approve
+
+echo "Hypervisor GitOps sync completed successfully."

scripts/nixos-sync.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# This script checks the remote Git repository for changes 
+# and triggers a nixos-rebuild if a new commit is found.
+# Usage: ./nixos-sync.sh <REPO_URL> <BRANCH>
+
+set -euo pipefail
+
+REPO_URL=${1:-"https://git.depeuter.dev/Bos55/nix-config.git"}
+BRANCH=${2:-"main"}
+
+echo "Checking remote hash for $REPO_URL branch $BRANCH..."
+
+# Fetch remote hash, fallback to unknown if it fails
+REMOTE_HASH=$(git ls-remote "$REPO_URL" "refs/heads/$BRANCH" | awk '{print $1}' || true)
+
+if [ -z "$REMOTE_HASH" ]; then
+  echo "WARNING: Could not fetch remote hash. Forcing rebuild to be safe."
+  REMOTE_HASH="unknown_remote"
+fi
+
+LOCAL_HASH="unknown_local"
+if [ -f /run/current-system/configurationRevision ]; then
+  LOCAL_HASH=$(cat /run/current-system/configurationRevision)
+fi
+
+echo "Remote hash: $REMOTE_HASH"
+echo "Local hash:  $LOCAL_HASH"
+
+if [ "$REMOTE_HASH" = "$LOCAL_HASH" ] && [ "$REMOTE_HASH" != "unknown_remote" ] && [ "$LOCAL_HASH" != "unknown" ]; then
+  echo "Hashes match. No update needed."
+  exit 0
+fi
+
+echo "Hashes differ or unknown. Triggering nixos-rebuild..."
+
+# Trigger the build and switch
+nixos-rebuild switch --flake "git+$REPO_URL?dir=nixos&ref=$BRANCH"
+
+echo "Update successful."