passwordless deploys

flake.lock

@@ -39,6 +39,30 @@
         "type": "github"
       }
     },
+    "colmena": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "stable": "stable"
+      },
+      "locked": {
+        "lastModified": 1762034856,
+        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1765739568,
@@ -95,6 +119,22 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
@@ -135,6 +175,21 @@
       }
     },
     "flake-utils": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -224,6 +279,27 @@
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "colmena",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nix-homebrew": {
       "inputs": {
         "brew-src": "brew-src"
@@ -343,6 +419,7 @@
     },
     "root": {
       "inputs": {
+        "colmena": "colmena",
         "darwin": "darwin",
         "disko": "disko",
         "flake-parts": "flake-parts",
@@ -398,6 +475,22 @@
         "type": "github"
       }
     },
+    "stable": {
+      "locked": {
+        "lastModified": 1750133334,
+        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -467,7 +560,7 @@
     "zjstatus": {
       "inputs": {
         "crane": "crane",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs_4",
         "rust-overlay": "rust-overlay"
       },

flake.nix

@@ -32,6 +32,10 @@
 			url = "github:nix-community/disko";
 			inputs.nixpkgs.follows = "nixpkgs";
 		};
+		colmena = {
+			url = "github:zhaofengli/colmena";
+			inputs.nixpkgs.follows = "nixpkgs";
+		};
 	};
 
 	outputs = inputs @ {flake-parts, ...}:
@@ -52,7 +56,6 @@
 					inputs.nixpkgs.lib.genAttrs darwinHosts (
 						hostname:
 							inputs.darwin.lib.darwinSystem {
-								system = "aarch64-darwin";
 								specialArgs = {
 									inherit inputs user hostname constants;
 								};
@@ -60,6 +63,7 @@
 									inputs.home-manager.darwinModules.home-manager
 									inputs.nix-homebrew.darwinModules.nix-homebrew
 									{
+										nixpkgs.hostPlatform = "aarch64-darwin";
 										nixpkgs.overlays = overlays;
 
 										nix-homebrew = {
@@ -81,13 +85,13 @@
 					inputs.nixpkgs.lib.genAttrs nixosHosts (
 						hostname:
 							inputs.nixpkgs.lib.nixosSystem {
-								system = "x86_64-linux";
 								specialArgs = {
 									inherit inputs user hostname constants;
 								};
 								modules = [
 									inputs.home-manager.nixosModules.home-manager
 									{
+										nixpkgs.hostPlatform = "x86_64-linux";
 										nixpkgs.overlays = overlays;
 									}
 									./hosts/${hostname}
@@ -95,10 +99,33 @@
 							}
 					);
 
+				flake.colmena =
+					{
+						meta = {
+							nixpkgs = import inputs.nixpkgs {system = "x86_64-linux";};
+							specialArgs = {inherit inputs user constants;};
+						};
+					}
+					// inputs.nixpkgs.lib.genAttrs nixosHosts (
+						hostname: {
+							deployment = {
+								targetHost = hostname;
+								targetUser = user;
+							};
+							imports = [
+								inputs.home-manager.nixosModules.home-manager
+								{
+									nixpkgs.overlays = overlays;
+									_module.args.hostname = hostname;
+								}
+								./hosts/${hostname}
+							];
+						}
+					);
+
 				perSystem = {
 					pkgs,
 					system,
-					inputs',
 					...
 				}: let
 					mkApp = name: {
@@ -117,17 +144,6 @@
 						"rollback"
 					];
 				in {
-					devShells.default =
-						pkgs.mkShell {
-							nativeBuildInputs = with pkgs; [
-								bashInteractive
-								git
-								age
-								age-plugin-yubikey
-							];
-							shellHook = ''export EDITOR=nvim'';
-						};
-
 					apps =
 						builtins.listToAttrs (
 							map (n: {
@@ -137,7 +153,6 @@
 							appNames
 						);
 				};
-				flake.overlays = overlays;
 			}
 		);
 }

profiles/nixos.nix

@@ -6,6 +6,21 @@
 	...
 }: {
 	security.sudo.enable = true;
+	security.sudo.extraRules = [
+		{
+			users = [user];
+			commands = [
+				{
+					command = "/run/current-system/sw/bin/nix-env";
+					options = ["NOPASSWD"];
+				}
+				{
+					command = "/nix/store/*/bin/switch-to-configuration";
+					options = ["NOPASSWD"];
+				}
+			];
+		}
+	];
 
 	system.stateVersion = constants.stateVersions.nixos;
 	time.timeZone = "UTC";

profiles/packages.nix

@@ -10,6 +10,7 @@ with pkgs;
 		alejandra
 		ast-grep
 		bun
+		colmena
 		delta
 		devenv
 		dig