Skip to content

Use Tailscale SSH for in-place deploys #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ngalaiko merged 1 commit into from
Sep 1, 2026
Merged

Use Tailscale SSH for in-place deploys #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,15 @@ jobs:
# DEPLOY_FLAKE points at the built commit on GitHub, so the box fetches +
# builds the generation itself — nothing is pushed from the runner (which
# the box would reject as unsigned). `.#deploy` is still the local app.
- name: Diagnose Tailscale connectivity
if: steps.check.outputs.exists == 'true'
run: |
tailscale status
tailscale ping computer || true
getent ahostsv4 computer || true
nc -vz -w10 computer 22 || true
tailscale ssh nikita@computer true

- name: Activate in place
if: steps.check.outputs.exists == 'true'
env:
Expand Down
15 changes: 9 additions & 6 deletions packages/release/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,10 @@ rec {
# the box's store to build there (needs a trusted user — nikita is).
deploy = pkgs.writeShellApplication {
name = "deploy";
runtimeInputs = [ pkgs.openssh ];
runtimeInputs = [
pkgs.openssh
pkgs.tailscale
];
text = ''
node="''${DEPLOY_NODE:-computer}"
target="''${DEPLOY_SYSTEM:-x86_64-linux}"
Expand All @@ -111,7 +114,7 @@ rec {
*)
echo "deploy: $node fetches + builds $ref"
# shellcheck disable=SC2029 # $ref/$target expand client-side, by design
gen="$(ssh "''${ssh_opts[@]}" nikita@"$node" \
gen="$(tailscale ssh nikita@"$node" \
"nix build '$ref#packages.$target.system' --no-link --print-out-paths")"
;;
esac
Expand All @@ -123,13 +126,13 @@ rec {
echo "deploy: dispatching detached 'activate switch' on $node"
# one round-trip: clear the prior status, then launch detached.
# shellcheck disable=SC2029 # $gen must expand here (client side), by design
ssh "''${ssh_opts[@]}" nikita@"$node" \
tailscale ssh nikita@"$node" \
"sudo sh -c 'rm -f /run/activate.status; setsid \"$gen/activate\" switch </dev/null >/run/activate.log 2>&1 &'"

echo "deploy: waiting for activation (tailscaled may bounce mid-switch)…"
ok=""
for _ in $(seq 1 90); do
st="$(ssh "''${ssh_opts[@]}" nikita@"$node" 'cat /run/activate.status 2>/dev/null' 2>/dev/null || true)"
st="$(tailscale ssh nikita@"$node" 'cat /run/activate.status 2>/dev/null' 2>/dev/null || true)"
case "$st" in
"ok $gen"*)
echo "deploy: $st"
Expand All @@ -138,15 +141,15 @@ rec {
;;
fail*)
echo "deploy: activation FAILED: $st" >&2
ssh "''${ssh_opts[@]}" nikita@"$node" 'sudo tail -n 40 /run/activate.log' 2>/dev/null || true
tailscale ssh nikita@"$node" 'sudo tail -n 40 /run/activate.log' 2>/dev/null || true
exit 1
;;
esac
sleep 2
done
if [ -z "$ok" ]; then
echo "deploy: timed out waiting for status; last activate.log:" >&2
ssh "''${ssh_opts[@]}" nikita@"$node" 'sudo tail -n 40 /run/activate.log' 2>/dev/null || true
tailscale ssh nikita@"$node" 'sudo tail -n 40 /run/activate.log' 2>/dev/null || true
exit 1
fi
echo "deploy: done — $node switched to $gen"
Expand Down