freshlybakedca.ke
a.starrysky.fyi
+22
.tangled/workflows/github.yml
+22
.tangled/workflows/github.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push"]
7
+
branch: ["release"]
8
+
9
+
engine: nixery
10
+
11
+
steps:
12
+
- name: Write SSH Key
13
+
command: |
14
+
echo $GITHUB_SSH_KEY > ssh_key
15
+
chmod 600 ssh_key
16
+
- name: Push to GitHub
17
+
command: |
18
+
export GIT_SSH_COMMAND="ssh -i $(realpath ./ssh_key) -o StrictHostKeyChecking=no"
19
+
git remote add github git@github.com:freshlybakedca.ke/Patisserie
20
+
git fetch --unshallow origin
21
+
git fetch github
22
+
git push tangled HEAD
+111
.tangled/workflows/packetmix-build.yml
+111
.tangled/workflows/packetmix-build.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
when:
5
+
- event: ["push", "pull_request"]
6
+
branch: ["main"]
7
+
8
+
engine: nixery
9
+
10
+
dependencies:
11
+
nixpkgs:
12
+
- lix
13
+
- gnugrep
14
+
- openssh
15
+
16
+
steps:
17
+
- name: Get remote builds SSH key
18
+
command: |
19
+
echo "$KEY_SSH_REMOTE_BUILD" > /tmp/key-ssh-remote-build
20
+
chmod 600 /tmp/key-ssh-remote-build
21
+
- name: Add base system files
22
+
command: |
23
+
# Let us SSH to midnight by name
24
+
echo "192.168.0.6 midnight" >> /etc/hosts
25
+
26
+
# Avoid missing user with UID 0 error on ssh...
27
+
echo "root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash" >> /etc/passwd
28
+
29
+
# Turn off SSH host key checking
30
+
echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config
31
+
echo "UserKnownHostsFile /dev/null" >> /etc/ssh/ssh_config
32
+
33
+
echo "Host midnight" >> /etc/ssh/ssh_config
34
+
echo " User remoteBuilds" >> /etc/ssh/ssh_config
35
+
echo " IdentityFile /tmp/key-ssh-remote-build" >> /etc/ssh/ssh_config
36
+
37
+
echo "extra-experimental-features = nix-command" >> /etc/nix/nix.conf
38
+
echo "max-jobs = 0" >> /etc/nix/nix.conf
39
+
echo "builders = ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build x86_64-linux" >> /etc/nix/nix.conf
40
+
- name: Evaluate all systems
41
+
command: |
42
+
set +e
43
+
set -o pipefail
44
+
45
+
eval_out=$(nix eval \
46
+
-f ./packetmix/nilla.nix packages.allNixOSSystems.result.x86_64-linux.drvPath \
47
+
--show-trace --raw \
48
+
2>&1 >/tmp/systems-drv-path | tee /dev/stderr)
49
+
eval_status=$?
50
+
51
+
if [ $eval_status -ne 0 ]; then
52
+
echo "Evaluating your configuration failed with exit code $eval_status"
53
+
echo "Please fix this and squash into your existing commits"
54
+
exit $eval_status
55
+
fi
56
+
57
+
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
58
+
59
+
if [ -n "$eval_warns" ]; then
60
+
echo "There were some warnings while evaluating your systems:"
61
+
echo "$eval_warns"
62
+
echo "Please fix these and squash into your existing commits"
63
+
exit 1
64
+
fi
65
+
- name: Evaluate all homes
66
+
command: |
67
+
set +e
68
+
set -o pipefail
69
+
70
+
eval_out=$(nix eval \
71
+
-f ./packetmix/nilla.nix packages.allHomes.result.x86_64-linux.drvPath \
72
+
--show-trace --raw \
73
+
2>&1 >/tmp/homes-drv-path | tee /dev/stderr)
74
+
eval_status=$?
75
+
76
+
if [ $eval_status -ne 0 ]; then
77
+
echo "Evaluating your configuration failed with exit code $eval_status"
78
+
echo "Please fix this and squash into your existing commits"
79
+
exit $eval_status
80
+
fi
81
+
82
+
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
83
+
84
+
if [ -n "$eval_warns" ]; then
85
+
echo "There were some warnings while evaluating your homes:"
86
+
echo "$eval_warns"
87
+
echo "Please fix these and squash into your existing commits"
88
+
exit 1
89
+
fi
90
+
- name: Build all systems
91
+
command: |
92
+
set -e
93
+
nix-copy-closure \
94
+
--to 'midnight' \
95
+
"$(cat /tmp/systems-drv-path)"
96
+
nix build \
97
+
"$(cat /tmp/systems-drv-path)"'^*' \
98
+
--store 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
99
+
--eval-store auto \
100
+
--show-trace --print-out-paths
101
+
- name: Build all homes
102
+
command: |
103
+
set -e
104
+
nix-copy-closure \
105
+
--to 'midnight' \
106
+
"$(cat /tmp/homes-drv-path)"
107
+
nix build \
108
+
"$(cat /tmp/homes-drv-path)"'^*' \
109
+
--store 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
110
+
--eval-store auto \
111
+
--show-trace --print-out-paths
+25
.tangled/workflows/packetmix-npins-duplicate-check.yml
+25
.tangled/workflows/packetmix-npins-duplicate-check.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push", "pull_request"]
7
+
branch: ["main"]
8
+
9
+
engine: nixery
10
+
11
+
dependencies:
12
+
nixpkgs:
13
+
- jq
14
+
15
+
steps:
16
+
- name: Check for duplicate npins keys
17
+
command: |
18
+
dupes=$(jq --stream 'select((.[0] | length == 3) and (.[0][2] == "type")) | .[0][1]' ./packetmix/npins/sources.json | sort | uniq -d)
19
+
# We have to use the stream parser else jq will get rid of the duplicates
20
+
21
+
if [ ! -z "$dupes" ]; then
22
+
echo "The following keys are duplicated in your npins pins. By default, npins will take *the later definition*:"
23
+
echo "$dupes"
24
+
exit 1
25
+
fi
+63
.tangled/workflows/packetmix-treefmt.yaml
+63
.tangled/workflows/packetmix-treefmt.yaml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push", "pull_request"]
7
+
branch: ["main"]
8
+
9
+
engine: nixery
10
+
11
+
dependencies:
12
+
nixpkgs:
13
+
- lix
14
+
- openssh
15
+
16
+
steps:
17
+
- name: Get remote builds SSH key
18
+
command: |
19
+
echo "$KEY_SSH_REMOTE_BUILD" > /tmp/key-ssh-remote-build
20
+
chmod 600 /tmp/key-ssh-remote-build
21
+
- name: Add base system files
22
+
command: |
23
+
# Let us SSH to midnight by name
24
+
echo "192.168.0.6 midnight" >> /etc/hosts
25
+
26
+
# Avoid missing user with UID 0 error on ssh...
27
+
echo "root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash" >> /etc/passwd
28
+
29
+
# Turn off SSH host key checking
30
+
echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config
31
+
echo "UserKnownHostsFile /dev/null" >> /etc/ssh/ssh_config
32
+
33
+
echo "Host midnight" >> /etc/ssh/ssh_config
34
+
echo " User remoteBuilds" >> /etc/ssh/ssh_config
35
+
echo " IdentityFile /tmp/key-ssh-remote-build" >> /etc/ssh/ssh_config
36
+
37
+
echo "extra-experimental-features = nix-command" >> /etc/nix/nix.conf
38
+
echo "sandbox = false" >> /etc/nix/nix.conf
39
+
echo "max-jobs = 0" >> /etc/nix/nix.conf
40
+
- name: Ensure files are formatted with treefmt
41
+
command: |
42
+
set -e
43
+
44
+
treefmt=$(nix build \
45
+
-f ./packetmix/nilla.nix packages.treefmt.result.x86_64-linux \
46
+
--store 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
47
+
--eval-store auto \
48
+
--show-trace --print-out-paths)
49
+
nix copy \
50
+
--from 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
51
+
--no-check-sigs \
52
+
"$treefmt"
53
+
54
+
set +e
55
+
56
+
"${treefmt}/bin/treefmt" --ci -C packetmix
57
+
exitCode=$?
58
+
59
+
if [ $exitCode -ne 0 ]; then
60
+
echo "Your code isn't formatted correctly, please run 'nilla fmt' and squash it into each commit"
61
+
fi
62
+
63
+
exit $exitCode
+17
.tangled/workflows/reuse.yml
+17
.tangled/workflows/reuse.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push", "pull_request"]
7
+
branch: ["main"]
8
+
9
+
engine: nixery
10
+
11
+
dependencies:
12
+
nixpkgs:
13
+
- reuse
14
+
15
+
steps:
16
+
- name: Check for REUSE compliance
17
+
command: reuse lint
-51
packetmix/.github/workflows/eval.yml
-51
packetmix/.github/workflows/eval.yml
···
1
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
-
#
3
-
# SPDX-License-Identifier: MIT
4
-
5
-
name: Evaluate NixOS systems and Homes
6
-
7
-
on:
8
-
push:
9
-
branches: [ "main" ]
10
-
pull_request:
11
-
branches: [ "main" ]
12
-
13
-
workflow_dispatch:
14
-
15
-
jobs:
16
-
evaluate:
17
-
runs-on: ubuntu-latest
18
-
19
-
steps:
20
-
- uses: actions/checkout@v4
21
-
22
-
- name: Install Lix
23
-
uses: samueldr/lix-gha-installer-action@8dc19fbd6451fa106a68ecb2dafeeeb90dff3a29
24
-
with:
25
-
extra_nix_config: "experimental-features = nix-command"
26
-
27
-
- run: cd $GITHUB_WORKSPACE
28
-
29
-
- name: Evaluate all systems
30
-
run: |
31
-
eval_out=$(nix-instantiate ./ci.nix -A packages.allNixOSSystems.result.x86_64-linux --add-root ./system-root 2>&1 | tee /dev/stderr)
32
-
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
33
-
34
-
if [ -n "$eval_warns" ]; then
35
-
echo "There were some warnings while evaluating your systems:"
36
-
echo "$eval_warns"
37
-
echo "Please fix these and squash into your existing commits"
38
-
exit 1
39
-
fi
40
-
41
-
- name: Evaluate all homes
42
-
run: |
43
-
eval_out=$(nix-instantiate ./ci.nix -A packages.allNixOSSystems.result.x86_64-linux --add-root ./home-root 2>&1 | tee /dev/stderr)
44
-
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
45
-
46
-
if [ -n "$eval_warns" ]; then
47
-
echo "There were some warnings while evaluating your homes:"
48
-
echo "$eval_warns"
49
-
echo "Please fix these and squash into your existing commits"
50
-
exit 1
51
-
fi
-69
packetmix/.github/workflows/nixos.yml
-69
packetmix/.github/workflows/nixos.yml
···
1
-
# SPDX-FileCopyrightText: 2025 Collabora Productivity Limited
2
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
3
-
# SPDX-FileCopyrightText: 2022 Markus Dobel
4
-
#
5
-
# SPDX-License-Identifier: MIT
6
-
7
-
name: Build and cache NixOS systems and Homes
8
-
9
-
on:
10
-
push:
11
-
branches: [ "main" ]
12
-
pull_request:
13
-
branches: [ "main" ]
14
-
15
-
workflow_dispatch:
16
-
17
-
concurrency: # Since as this check is expensive, it's a bad idea to keep running it when we push new commits...
18
-
group: ${{ github.workflow }}-${{ github.ref }}
19
-
cancel-in-progress: true
20
-
21
-
jobs:
22
-
build:
23
-
runs-on: ubuntu-latest
24
-
25
-
steps:
26
-
- name: Clean up runner
27
-
uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794
28
-
with:
29
-
overprovision-lvm: true # needed for our mount path to be /nix - we'll cope with the weird errors this option suggests may arise as it'd be untenable to constantly readjust root-reserve-mb
30
-
remove-dotnet: true
31
-
remove-android: true
32
-
remove-haskell: true
33
-
remove-codeql: true
34
-
remove-docker-images: true
35
-
build-mount-path: /nix
36
-
build-mount-path-ownership: root:root
37
-
38
-
- uses: actions/checkout@v4
39
-
40
-
- name: Install Lix
41
-
uses: samueldr/lix-gha-installer-action@8dc19fbd6451fa106a68ecb2dafeeeb90dff3a29
42
-
with:
43
-
extra_nix_config: "experimental-features = nix-command"
44
-
45
-
- run: cd $GITHUB_WORKSPACE
46
-
47
-
- name: Set up a cachix cache
48
-
uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad
49
-
with:
50
-
# Name of a cachix cache to push and pull/substitute
51
-
name: "freshlybakedcake"
52
-
authToken: "${{ secrets.CACHIX_TOKEN }}"
53
-
54
-
# see https://git.lix.systems/lix-project/lix/issues/545
55
-
- name: Fix apparmor configuration for building Lix
56
-
run: |
57
-
sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
58
-
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
59
-
60
-
- name: Build all systems
61
-
run: nix build -f ./ci.nix packages.allNixOSSystems.result.x86_64-linux --show-trace
62
-
63
-
- name: Build all homes
64
-
run: nix build -f ./ci.nix packages.allHomes.result.x86_64-linux --show-trace
65
-
66
-
- if: github.event_name == 'push'
67
-
name: Push to release branch
68
-
run: |
69
-
git push -f origin HEAD:release
-38
packetmix/.github/workflows/npins-duplicate-check.yml
-38
packetmix/.github/workflows/npins-duplicate-check.yml
···
1
-
# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
2
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
3
-
#
4
-
# SPDX-License-Identifier: CC0-1.0
5
-
6
-
name: Check for npins duplicate keys
7
-
# As it's possible to specify duplicate keys in npins, we need to route them
8
-
# out... Duplicated npins keys cause the earlier definition of a pin to be
9
-
# silently ignored, potentially causing confusion about what version is being
10
-
# used
11
-
12
-
on:
13
-
push:
14
-
branches: [ "main" ]
15
-
pull_request:
16
-
branches: [ "main" ]
17
-
workflow_dispatch:
18
-
19
-
permissions:
20
-
contents: read
21
-
22
-
jobs:
23
-
npins-duplicate-checker:
24
-
runs-on: ubuntu-latest
25
-
steps:
26
-
- name: Checkout
27
-
uses: actions/checkout@v4
28
-
29
-
- name: Check for duplicate npins keys
30
-
run: |
31
-
dupes=$(jq --stream 'select((.[0] | length == 3) and (.[0][2] == "type")) | .[0][1]' $GITHUB_WORKSPACE/npins/sources.json | sort | uniq -d)
32
-
# We have to use the stream parser else jq will get rid of the duplicates
33
-
34
-
if [ ! -z "$dupes" ]; then
35
-
echo "The following keys are duplicated in your npins pins. By default, npins will take *the later definition*:"
36
-
echo "$dupes"
37
-
exit 1
38
-
fi
-24
packetmix/.github/workflows/reuse.yml
-24
packetmix/.github/workflows/reuse.yml
···
1
-
# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
2
-
#
3
-
# SPDX-License-Identifier: CC0-1.0
4
-
5
-
name: Check REUSE compliance
6
-
7
-
on:
8
-
push:
9
-
branches: [ "main" ]
10
-
pull_request:
11
-
branches: [ "main" ]
12
-
13
-
permissions:
14
-
contents: read
15
-
16
-
jobs:
17
-
reuse:
18
-
runs-on: ubuntu-latest
19
-
steps:
20
-
- name: Checkout
21
-
uses: actions/checkout@v4
22
-
23
-
- name: Check REUSE compliance
24
-
uses: fsfe/reuse-action@a46482ca367aef4454a87620aa37c2be4b2f8106
-33
packetmix/.github/workflows/tangled.yml
-33
packetmix/.github/workflows/tangled.yml
···
1
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
-
#
3
-
# SPDX-License-Identifier: MIT
4
-
5
-
name: Mirror to tangled.sh
6
-
7
-
on:
8
-
push:
9
-
branches: [ "main", "release" ]
10
-
11
-
jobs:
12
-
tangled-push:
13
-
runs-on: ubuntu-latest
14
-
15
-
steps:
16
-
- uses: actions/checkout@v4
17
-
18
-
- run: cd $GITHUB_WORKSPACE
19
-
20
-
- name: Write out SSH key
21
-
env:
22
-
TANGLED_SSH_KEY: ${{ secrets.TANGLED_SSH_KEY }}
23
-
run: |
24
-
echo "$TANGLED_SSH_KEY" > ../tangled_ssh_key
25
-
chmod 600 ../tangled_ssh_key
26
-
27
-
- name: Push to tangled
28
-
run: |
29
-
git remote add tangled git@tangled.sh:freshlybakedca.ke/packetmix
30
-
export GIT_SSH_COMMAND="ssh -i $(realpath ../tangled_ssh_key) -o StrictHostKeyChecking=no"
31
-
git fetch --unshallow origin
32
-
git fetch tangled
33
-
git push tangled HEAD
-51
packetmix/.github/workflows/treefmt.yaml
-51
packetmix/.github/workflows/treefmt.yaml
···
1
-
# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
2
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
3
-
#
4
-
# SPDX-License-Identifier: CC0-1.0
5
-
6
-
name: Ensure files are formatted with treefmt
7
-
8
-
on:
9
-
push:
10
-
branches: [ "main" ]
11
-
pull_request:
12
-
branches: [ "main" ]
13
-
workflow_dispatch:
14
-
15
-
permissions:
16
-
contents: read
17
-
18
-
jobs:
19
-
treefmt-check:
20
-
runs-on: ubuntu-latest
21
-
steps:
22
-
- name: Checkout
23
-
uses: actions/checkout@v4
24
-
25
-
- name: Install Nix
26
-
uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641
27
-
with:
28
-
extra_nix_config: "experimental-features = nix-command"
29
-
30
-
- run: cd $GITHUB_WORKSPACE
31
-
32
-
- name: Set up a cachix cache
33
-
uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad
34
-
with:
35
-
# Name of a cachix cache to push and pull/substitute
36
-
name: "freshlybakedcake"
37
-
authToken: "${{ secrets.CACHIX_TOKEN }}"
38
-
39
-
- name: Ensure all files are formatted
40
-
run: |
41
-
set +e
42
-
43
-
nix-shell ./ci.nix -A shells.default.result.x86_64-linux --run 'treefmt --ci'
44
-
45
-
exitCode=$?
46
-
47
-
if [ $exitCode -ne 0 ]; then
48
-
echo "Your code isn't formatted correctly, please run 'nilla fmt' and squash it into each commit"
49
-
fi
50
-
51
-
exit $exitCode
-63
packetmix/.github/workflows/update-npins.yml
-63
packetmix/.github/workflows/update-npins.yml
···
1
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
-
#
3
-
# SPDX-License-Identifier: MIT
4
-
5
-
name: Update npins dependencies
6
-
# This is inspired by https://github.com/getchoo/update-npins - though I wrote it from scratch
7
-
# I'm not using it as I need to run the npins command in a shell
8
-
9
-
on:
10
-
schedule:
11
-
- cron: "48 02 * * *" # Time is pretty arbitrary - the only important thing is that it's unlikely to be a peak time...
12
-
13
-
workflow_dispatch:
14
-
15
-
jobs:
16
-
update-npins:
17
-
runs-on: ubuntu-latest
18
-
19
-
steps:
20
-
- name: Generate GitHub token for RoboPâtissière
21
-
uses: actions/create-github-app-token@v1
22
-
id: generate-token
23
-
with:
24
-
app-id: ${{ secrets.CUSTOM_GITHUB_APP_ID }}
25
-
private-key: ${{ secrets.CUSTOM_GITHUB_APP_PRIVATE_KEY }}
26
-
27
-
- uses: actions/checkout@v4
28
-
29
-
- name: Install Nix
30
-
uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641
31
-
with:
32
-
extra_nix_config: "experimental-features = nix-command"
33
-
34
-
- run: cd $GITHUB_WORKSPACE
35
-
36
-
- name: Set up a cachix cache
37
-
uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad
38
-
with:
39
-
# Name of a cachix cache to push and pull/substitute
40
-
name: "freshlybakedcake"
41
-
authToken: "${{ secrets.CACHIX_TOKEN }}"
42
-
43
-
- name: Run npins update
44
-
run: nix-shell ./ci.nix -A shells.default.result.x86_64-linux --run 'npins update'
45
-
46
-
- name: Create a pull request
47
-
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
48
-
id: pull-request
49
-
with:
50
-
branch: auto/update-npins
51
-
commit-message: "chore: bump npins dependencies"
52
-
token: ${{ steps.generate-token.outputs.token }}
53
-
title: "chore: bump npins dependencies"
54
-
author: "RoboPâtissière[bot] <213641064+robopatissiere[bot]@users.noreply.github.com>"
55
-
committer: "RoboPâtissière[bot] <213641064+robopatissiere[bot]@users.noreply.github.com>"
56
-
body: |
57
-
This is an automated npins dependency bump
58
-
59
-
- if: steps.pull-request.outputs.pull-request-operation == 'created'
60
-
name: Automerge pull request
61
-
run: gh pr merge --rebase --auto "${{ steps.pull-request.outputs.pull-request-number }}"
62
-
env:
63
-
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+26
packetmix/systems/midnight/packetmix-update.nix
+26
packetmix/systems/midnight/packetmix-update.nix
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
{
6
+
systemd.services."update-packetmix-npins" = {
7
+
script = ''
8
+
export WORKING_DIR=mktemp -d
9
+
export GIT_SSH_COMMAND="ssh -i /etc/ssh/ssh_host_ed25519_key"
10
+
git clone git@tangled.sh:freshlybakedca.ke/patisserie $WORKING_DIR
11
+
cd $WORKING_DIR/packetmix
12
+
git checkout -b auto/update-npins
13
+
npins update
14
+
git add .
15
+
git commit -am "chore: bump npins dependencies"
16
+
git push
17
+
# TODO: Make web request to create PR
18
+
rm -rf $WORKING_DIR
19
+
'';
20
+
serviceConfig = {
21
+
Type = "oneshot";
22
+
User = "root";
23
+
};
24
+
startAt = "*-*-* 00:00:00";
25
+
};
26
+
}