deploy

Estrelas15

Forks1

Atualizado27 de março de 2026 às 22:06

Deploy tsurf NixOS config to a server

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Fonte

dangirsh

dangirsh/tsurf

Abrir repositório GitHub Ver repositórios do creator

Download

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Administradores de redes e sistemas de computadorInformática e Matemática·SOC 15-1244

SKILL.md

readonly

name	deploy
description	Deploy tsurf NixOS config to a server
user_invocable	true

Deploy Skill

Deploy the tsurf NixOS configuration via deploy-rs.

CRITICAL: ALL deploys MUST run from the private overlay. The public repo's deploy.sh refuses all deploys because hosts run the private overlay config.

How to Deploy

When the user asks to deploy (or invokes /deploy), follow these steps:

Always use the private overlay:
```
cd /path/to/private-overlay
```
If public tsurf was updated, refresh the input first:
```
nix flake lock --update-input tsurf
```

Execute the deploy script:

# Deploy a specific host:
./scripts/deploy.sh --node <hostname>

# Local build fallback (if server can't build):
./scripts/deploy.sh --node <hostname> --mode local

# Fast mode (local build, single eval):
./scripts/deploy.sh --node <hostname> --fast

# First migration deploy from nixos-rebuild:
./scripts/deploy.sh --node <hostname> --first-deploy

Monitor output:
- Shows progress inline (build, activate, health check).
Verify deployment:
- deploy.sh runs service health checks automatically.
- On success, prints duration and service status.
Commit flake.lock if updated:
- If you ran --update-input tsurf, commit the updated flake.lock in the private overlay.

Targeting Rules

User says	Action
"deploy" (no qualifier)	Ask which node, or deploy the node relevant to current work
"deploy to "	`--node <hostname>`
"deploy both" / "deploy all"	Deploy each node separately in sequence

Never deploy a host when only a different host's changes were made. Hosts are independent -- deploy only what changed.

Flags

Flag	Description
`--node NAME`	Flake node to deploy (required)
`--mode remote`	(default) Build on target host via deploy-rs `--remote-build`
`--mode local`	Build locally, push closure + switch remotely
`--target USER@HOST`	Override SSH target (default: `root@<node>`)
`--first-deploy`	Disable magic rollback for one-time migration
`--fast`	Local build, single evaluation
`--magic-rollback`	Enable deploy-rs magic rollback (300s confirm timeout)
`--public-ip IP`	Public IP for post-deploy connectivity check
`--post-hook PATH`	Run script at absolute PATH after successful deploy

What It Does

Safety guard -- Refuses to deploy from the public repo (no tsurf.url in flake.nix)
Remote lock -- Prevents concurrent deploys via remote directory lock
Nix build -- Builds the full NixOS system closure (remote by default, local if --mode local)
deploy-rs switch -- Atomically switches the server to the new config
Service verification -- Checks tailscaled/headscale and sshd are running
SSH connectivity -- Verifies fresh SSH connection (non-multiplexed)

Troubleshooting

Rollback: ssh root@<hostname> nixos-rebuild switch --rollback
Service logs: ssh root@<hostname> journalctl -u <service> -n 50
Lock stuck: If a previous deploy crashed, remove the remote lock:
```
ssh root@<hostname> rm -rf /var/lock/deploy-<node>.lock
```
Build failures: Check Nix build output for derivation errors.
Stale tsurf input: Run nix flake lock --update-input tsurf in the private overlay.

Mais deste repositório

mesmo repositório

tsurf-overlay-authoring

dangirsh/tsurf

Create or update a private tsurf overlay from discovered host facts. Use when an agent needs to author NixOS modules, choose public tsurf role modules, or preserve private services.

2026-07-0715

tsurf-deploy-validation

dangirsh/tsurf

Validate a tsurf public repo or private overlay before deployment. Use when an agent is about to run checks, prepare a deploy, override a deploy target, verify rollback/recovery safety, or decide whether a tsurf host change is safe enough to push.

2026-07-0115

tsurf-host-discovery

dangirsh/tsurf

Inspect an existing or prospective NixOS host before applying tsurf. Use when an agent needs to choose a safe tsurf setup path, adapt to unknown disk/network/provider details, determine whether a host can use the public roles directly, or collect facts for a private overlay.

2026-07-0115

nix-test

dangirsh/tsurf

Run tests and manage .test-status for the tsurf repo

2026-03-2315

nix-module

dangirsh/tsurf

Create a new NixOS module for the tsurf repo

2026-03-2115

Deploy Skill

Deploy the tsurf NixOS configuration via deploy-rs.

CRITICAL: ALL deploys MUST run from the private overlay. The public repo's deploy.sh refuses all deploys because hosts run the private overlay config.

How to Deploy

When the user asks to deploy (or invokes /deploy), follow these steps:

Always use the private overlay:

cd /path/to/private-overlay

If public tsurf was updated, refresh the input first:

nix flake lock --update-input tsurf

Execute the deploy script:

# Deploy a specific host:
./scripts/deploy.sh --node <hostname>

# Local build fallback (if server can't build):
./scripts/deploy.sh --node <hostname> --mode local

# Fast mode (local build, single eval):
./scripts/deploy.sh --node <hostname> --fast

# First migration deploy from nixos-rebuild:
./scripts/deploy.sh --node <hostname> --first-deploy

Monitor output:

Shows progress inline (build, activate, health check).

Verify deployment:

deploy.sh runs service health checks automatically.
On success, prints duration and service status.

Commit flake.lock if updated:

If you ran --update-input tsurf, commit the updated flake.lock in the private overlay.

Targeting Rules

User says

Action

"deploy" (no qualifier)

Ask which node, or deploy the node relevant to current work

"deploy to "

--node <hostname>

"deploy both" / "deploy all"

Deploy each node separately in sequence

Never deploy a host when only a different host's changes were made. Hosts are independent -- deploy only what changed.

Flags

Flag

Description

--node NAME

Flake node to deploy (required)

--mode remote

(default) Build on target host via deploy-rs --remote-build

--mode local

Build locally, push closure + switch remotely

--target USER@HOST

Override SSH target (default: root@<node>)

--first-deploy

Disable magic rollback for one-time migration

--fast

Local build, single evaluation

--magic-rollback

Enable deploy-rs magic rollback (300s confirm timeout)

--public-ip IP

Public IP for post-deploy connectivity check

--post-hook PATH

Run script at absolute PATH after successful deploy

What It Does

Safety guard -- Refuses to deploy from the public repo (no tsurf.url in flake.nix)

Remote lock -- Prevents concurrent deploys via remote directory lock

Nix build -- Builds the full NixOS system closure (remote by default, local if --mode local)

deploy-rs switch -- Atomically switches the server to the new config

Service verification -- Checks tailscaled/headscale and sshd are running

SSH connectivity -- Verifies fresh SSH connection (non-multiplexed)

Troubleshooting

Rollback: ssh root@<hostname> nixos-rebuild switch --rollback

Service logs: ssh root@<hostname> journalctl -u <service> -n 50

Lock stuck: If a previous deploy crashed, remove the remote lock:

ssh root@<hostname> rm -rf /var/lock/deploy-<node>.lock

Build failures: Check Nix build output for derivation errors.

Stale tsurf input: Run nix flake lock --update-input tsurf in the private overlay.