mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: revert tuwunel-admin to manual binary (outside nix-store)

Browse source 
Revert the fetchurl nix derivation. Keep the static binary at
/var/lib/tuwunel-admin/tuwunel-admin (copied from jul11, v0.0.0).
Service already runs this version on heather (nix derivation was pushed
but never deployed).
This commit is contained in:
mikl 2026-07-13 02:52:19 +03:00
parent 6c4f7daf42
commit 4830425107
1 changed files with 8 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
hosts/heather/tuwunel-admin.nix
View file

@ -8,46 +8,14 @@
# Слушает 127.0.0.1:8009 → Caddy admin.iscg.dev терминирует TLS (см. caddy.nix).
# Конфиг: /var/lib/tuwunel-admin/config.toml (вне git, root:root 0644).
#
# Бинарь: публичного docker-образа НЕТ, но есть prebuilt static musl бинарник
# в GitHub releases (v0.1.0, x86_64-unknown-linux-musl). Тащим через fetchurl +
# оборачиваем в nix-деривацию — воспроизводимо, переживает пересоздание VM.
# heather = x86_64-linux, поэтому берём x86_64-musl asset. При появлении aarch64
# хоста — добавить второй fetchurl или собирать из исходников (Cargo.toml + lock).
# Бинарь: публичного docker-образа НЕТ. Это статический x86_64 бинарник v0.0.0
# (скопирован с iscg-dev-jul11 2026-07-13), лежит ВНЕ nix-store:
# /var/lib/tuwunel-admin/tuwunel-admin
# При пересоздании heather с нуля — перескопировать с jul11 или скачать релиз
# https://github.com/knadh/tuwunel-admin/releases (v0.1.0+).
{ config, pkgs, lib, ... }:
let
tuwunel-admin = pkgs.stdenv.mkDerivation rec {
pname = "tuwunel-admin";
version = "0.1.0";
# Prebuilt static musl binary (x86_64 only). sha256 из checksums.txt релиза.
src = pkgs.fetchurl {
url = "https://github.com/knadh/tuwunel-admin/releases/download/v${version}/tuwunel-admin_${version}_x86_64-unknown-linux-musl.tar.gz";
sha256 = "a22c345f414f9af34d28f7b9166922b736e8774737f67038252d5422f47a2201";
};
# tar.gz с tuwunel-admin (бинарь) + LICENSE + README. Просто копируем бинарь.
dontBuild = true;
dontConfigure = true;
installPhase = ''
runHook preInstall
install -Dm555 tuwunel-admin $out/bin/tuwunel-admin
install -Dm444 LICENSE $out/share/licenses/tuwunel-admin/LICENSE
install -Dm444 README.md $out/share/doc/tuwunel-admin/README.md
runHook postInstall
'';
meta = with lib; {
description = "Web admin UI for tuwunel Matrix homeserver";
homepage = "https://github.com/knadh/tuwunel-admin";
license = licenses.asl20;
mainProgram = "tuwunel-admin";
platforms = [ "x86_64-linux" ];
};
};
in {
{
systemd.services.tuwunel-admin = {
description = "tuwunel-admin (Matrix admin web UI)";
after = [ "network-online.target" ];
@ -55,12 +23,11 @@ in {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
# Бинарь из nix-store (деривация выше), конфиг вне git на хосте.
ExecStart = "${tuwunel-admin}/bin/tuwunel-admin --config /var/lib/tuwunel-admin/config.toml";
ExecStart = "/var/lib/tuwunel-admin/tuwunel-admin --config /var/lib/tuwunel-admin/config.toml";
WorkingDirectory = "/var/lib/tuwunel-admin";
Restart = "on-failure";
RestartSec = 5;
# Статический бинарь, рут-запуск (биндит 127.0.0.1:8009, читает config.toml).
# Бинарь статический, рут-запуск ок (биндит 127.0.0.1:8009).
User = "root";
Environment = [ "HOME=/var/lib/tuwunel-admin" ];
};