Add nexus.provisioning host option for provisioning env pointers #11

Merged

vnprc merged 3 commits from agent/provisioning-env-option into master

2026-07-15 21:15:41 +01:00

allod-agent commented

2026-07-15 19:34:26 +01:00

Member

Closes allod/nexus#10.

Adds nexus.provisioning.deployFlake and nexus.provisioning.inventoryCheckout to the host framework module (nixosModules.host, nix/configuration.nix). When set, each renders into environment.sessionVariables alongside the existing LIBVIRT_DEFAULT_URI, so the unwrapped rebuild-vm-from-host / provision-vm-from-host scripts read DEPLOY_FLAKE / INVENTORY_CHECKOUT from the operator session without per-shell exports. This matches the current script contract after issue #5/#6: rebuild-vm-from-host reads only DEPLOY_FLAKE; provision-vm-from-host reads both (and re-exports INVENTORY_CHECKOUT as INVENTORY to new-vm). SECRETS_CHECKOUT is intentionally not added (removed by #6). inventoryCheckout is documented as present only while provision-vm-from-host still reads INVENTORY_CHECKOUT, to be dropped in the same change that removes that read.

The module was a config-only function; it now carries an options block with all prior settings moved under config, preserving the nixosModules.host import interface (only the standard config/lib module args are added). Both options default to null and render nothing when unset, so the public template host and the scripts' own $HOME/work/allod/{profiles,inventory} fallbacks are unchanged. The option type is nullOr (strMatching "^/.+"), so a malformed (empty or non-absolute) value fails evaluation loudly rather than rendering an empty variable that the scripts' ${VAR:-default} fallback would silently replace with the baked default. This is the public option only; wiring a real deploy-flake/inventory location is a separate, private concern that composes nixosModules.host and sets these.

Risk

R1-R2. Single-repo, single-option change on the operator-convenience seam, no cross-repo interface change. The worst credible failure is a wrong rendered pointer aiming host-side rebuild/provision at the wrong deploy data, recoverable by reverting the host config or unsetting the variable for a manual run. No private host data is wired here, and host-side live rebuild/provision remains a human gate. Most useful human scrutiny: the option namespace/naming (nexus.provisioning.*) and the absolute-path constraint. This PR also carries a test-only fix to tests/registry-resolver.sh (see below), which adds no runtime or generated behavior.

Validation

nix flake check is green. A new host-provisioning-env check composes nixosModules.host on a minimal template host and asserts: (a) with the options set, environment.sessionVariables carries the configured DEPLOY_FLAKE and INVENTORY_CHECKOUT; (b) with them unset, neither variable is forced and LIBVIRT_DEFAULT_URI is unchanged; (c) an empty deployFlake and a relative inventoryCheckout each fail evaluation. Each assertion was confirmed to go red on sabotaged input (dropped renderer, weakened type) before reverting, so the check can actually catch a regression. The existing provisioning-contract and no-hardcoded-arch checks stay green, and the aarch64 check variant evaluates (build omitted on the x86_64 host).

An independent read-only review pass (subagent) found no correctness defects; its one substantive finding was that the malformed-pointer coverage exercised only deployFlake. That is addressed by commit 1f224ff, which adds the relative-inventoryCheckout rejection case above.

Also in this PR: fix for a master regression (`tests/registry-resolver.sh`)

This branch was rebased onto master 9168091 ("retire the on-VM self-rebuild; bootstrap is clone-only"), which dropped the profiles_checkout positional from bootstrap-vm.sh (so SELF_REBUILD is $6 with shift 6) and now refuses self_rebuild=true before any side effect. 9168091 re-pinned tests/bootstrap-orchestration.sh to the new vector but missed tests/registry-resolver.sh, leaving it red: bootstrap accepts valid triple args still passed the old seven-positional vector, so after shift 6 eleven trailing args (not a triple multiple) made the script exit on the triple-count check before mkdir ~/work, failing the assertion; bootstrap rejects non-triple args passed only by coincidence ("unknown source type 'true'"). Commit 96cc0fb moves both cases to the six-positional vector with self_rebuild=false, so each exercises its named behavior and nix flake check on this branch is green. It is a test-only change and is isolated in its own commit, so it can be cherry-picked to land independently on master if you'd rather not carry it here.

Closes allod/nexus#10. Adds `nexus.provisioning.deployFlake` and `nexus.provisioning.inventoryCheckout` to the host framework module (`nixosModules.host`, `nix/configuration.nix`). When set, each renders into `environment.sessionVariables` alongside the existing `LIBVIRT_DEFAULT_URI`, so the unwrapped `rebuild-vm-from-host` / `provision-vm-from-host` scripts read `DEPLOY_FLAKE` / `INVENTORY_CHECKOUT` from the operator session without per-shell exports. This matches the current script contract after issue #5/#6: `rebuild-vm-from-host` reads only `DEPLOY_FLAKE`; `provision-vm-from-host` reads both (and re-exports `INVENTORY_CHECKOUT` as `INVENTORY` to `new-vm`). `SECRETS_CHECKOUT` is intentionally not added (removed by #6). `inventoryCheckout` is documented as present only while `provision-vm-from-host` still reads `INVENTORY_CHECKOUT`, to be dropped in the same change that removes that read. The module was a config-only function; it now carries an `options` block with all prior settings moved under `config`, preserving the `nixosModules.host` import interface (only the standard `config`/`lib` module args are added). Both options default to `null` and render nothing when unset, so the public template host and the scripts' own `$HOME/work/allod/{profiles,inventory}` fallbacks are unchanged. The option type is `nullOr (strMatching "^/.+")`, so a malformed (empty or non-absolute) value fails evaluation loudly rather than rendering an empty variable that the scripts' `${VAR:-default}` fallback would silently replace with the baked default. This is the public option only; wiring a real deploy-flake/inventory location is a separate, private concern that composes `nixosModules.host` and sets these. ## Risk R1-R2. Single-repo, single-option change on the operator-convenience seam, no cross-repo interface change. The worst credible failure is a wrong rendered pointer aiming host-side rebuild/provision at the wrong deploy data, recoverable by reverting the host config or unsetting the variable for a manual run. No private host data is wired here, and host-side live rebuild/provision remains a human gate. Most useful human scrutiny: the option namespace/naming (`nexus.provisioning.*`) and the absolute-path constraint. This PR also carries a test-only fix to `tests/registry-resolver.sh` (see below), which adds no runtime or generated behavior. ## Validation `nix flake check` is green. A new `host-provisioning-env` check composes `nixosModules.host` on a minimal template host and asserts: (a) with the options set, `environment.sessionVariables` carries the configured `DEPLOY_FLAKE` and `INVENTORY_CHECKOUT`; (b) with them unset, neither variable is forced and `LIBVIRT_DEFAULT_URI` is unchanged; (c) an empty `deployFlake` and a relative `inventoryCheckout` each fail evaluation. Each assertion was confirmed to go red on sabotaged input (dropped renderer, weakened type) before reverting, so the check can actually catch a regression. The existing `provisioning-contract` and `no-hardcoded-arch` checks stay green, and the aarch64 check variant evaluates (build omitted on the x86_64 host). An independent read-only review pass (subagent) found no correctness defects; its one substantive finding was that the malformed-pointer coverage exercised only `deployFlake`. That is addressed by commit `1f224ff`, which adds the relative-`inventoryCheckout` rejection case above. ## Also in this PR: fix for a master regression (`tests/registry-resolver.sh`) This branch was rebased onto master `9168091` ("retire the on-VM self-rebuild; bootstrap is clone-only"), which dropped the `profiles_checkout` positional from `bootstrap-vm.sh` (so `SELF_REBUILD` is `$6` with `shift 6`) and now refuses `self_rebuild=true` before any side effect. `9168091` re-pinned `tests/bootstrap-orchestration.sh` to the new vector but missed `tests/registry-resolver.sh`, leaving it red: `bootstrap accepts valid triple args` still passed the old seven-positional vector, so after `shift 6` eleven trailing args (not a triple multiple) made the script exit on the triple-count check before `mkdir ~/work`, failing the assertion; `bootstrap rejects non-triple args` passed only by coincidence ("unknown source type 'true'"). Commit `96cc0fb` moves both cases to the six-positional vector with `self_rebuild=false`, so each exercises its named behavior and `nix flake check` on this branch is green. It is a test-only change and is isolated in its own commit, so it can be cherry-picked to land independently on master if you'd rather not carry it here.

allod-agent added 1 commit

2026-07-15 19:34:26 +01:00

Add nexus.provisioning host option for provisioning env pointers ae3dbbd79e

Render DEPLOY_FLAKE and INVENTORY_CHECKOUT into the operator session
environment from nexus.provisioning.{deployFlake,inventoryCheckout}, so a
host whose provisioning pointers differ from the baked $HOME/work/allod
defaults no longer needs per-shell exports before rebuild-vm-from-host /
provision-vm-from-host. Both options are unset by default and render
nothing when unset, leaving the public template host and the scripts' own
fallbacks unchanged; a malformed (non-absolute) value fails evaluation
loudly instead of silently substituting a default.

Add a host-provisioning-env flake check that composes nixosModules.host on
a template host and asserts the set, unset, and malformed-rejection cases;
the existing provisioning-contract and no-hardcoded-arch checks stay green.

vnprc approved these changes

2026-07-15 20:39:32 +01:00

Dismissed

vnprc force-pushed agent/provisioning-env-option from ae3dbbd79e to c7bfb0b3a7

2026-07-15 20:39:38 +01:00

Compare

allod-agent added 2 commits

2026-07-15 21:09:16 +01:00

Cover inventoryCheckout and the relative-path branch in host-provisioning-env check 1f224ff864

The malformed-pointer assertion previously exercised only an empty
deployFlake. Add a relative inventoryCheckout probe so the check covers
both options and both bad shapes (empty and non-absolute). Confirmed it
goes red when the probe is a value the type accepts.

tests/registry-resolver.sh: fix stale bootstrap arg vectors 96cc0fb97b

Commit 9168091 dropped the profiles_checkout positional from bootstrap-vm.sh
(SELF_REBUILD is now $6 with shift 6) and refuses self_rebuild=true before any
side effect, but the two bootstrap arg-vector cases here still passed the old
seven-positional vector. bootstrap_accepts_triple_args therefore left 11
trailing args (not a triple multiple), so the script exited on the triple
check before mkdir ~/work and the assertion failed; bootstrap_rejects_non_triple_args
passed only by coincidence (unknown source type 'true').

Drop the removed positional and set self_rebuild=false so both cases exercise
their named behavior: the accepts case reaches ~/work creation, the rejects
case is refused by the triple-count check.

allod-agent commented

2026-07-15 21:11:02 +01:00

Author

Member

Ran an independent read-only review pass (subagent) on this change — no correctness defects. Its one substantive finding, that the malformed-pointer coverage exercised only deployFlake, is applied as 1f224ff (adds a relative-inventoryCheckout rejection case to the host-provisioning-env check; verified to go red when the probe is a value the type accepts).

Note on the base: this branch was rebased onto master 9168091, which left tests/registry-resolver.sh red — its bootstrap arg-vector cases weren't updated for the dropped profiles_checkout positional and the new self_rebuild=true refusal. Per owner decision that regression is fixed here in 96cc0fb (test-only, isolated commit — cherry-pickable to master if you'd rather it land separately). nix flake check on the branch is now green.

Ran an independent read-only review pass (subagent) on this change — no correctness defects. Its one substantive finding, that the malformed-pointer coverage exercised only `deployFlake`, is applied as `1f224ff` (adds a relative-`inventoryCheckout` rejection case to the `host-provisioning-env` check; verified to go red when the probe is a value the type accepts). Note on the base: this branch was rebased onto master `9168091`, which left `tests/registry-resolver.sh` red — its bootstrap arg-vector cases weren't updated for the dropped `profiles_checkout` positional and the new `self_rebuild=true` refusal. Per owner decision that regression is fixed here in `96cc0fb` (test-only, isolated commit — cherry-pickable to master if you'd rather it land separately). `nix flake check` on the branch is now green.

vnprc approved these changes

2026-07-15 21:15:35 +01:00