In reply to @colemickens:matrix.org
when using nix cli 2, you can often structure things such that your commands are actually arch amiguous. nix run .#install-secrets does the right thing because it auto-coerces that to (a number of things including) .apps.{archs}.install-secrets. The {arch} it tries during the coercion is based on the host executing nix.

In reply to @aciceri:nixos.dev
Sorry but what is nix cli 2? And is nix run .# install-secrets standard or you meant a particular flake? I'm really interested but I really can't understand what are you talking about

In reply to @balsoft:balsoft.ru
(2) Sadly examples aren't public, but I can provide you with a snippet if you want

In reply to @aciceri:nixos.dev
If it's not a problem and you've a working example at hand I would like to see it.

{ config, pkgs, lib, inputs, ... }: {
  vault-secrets.secrets.update-daemon = {
    secretsAreBase64 = true;
  };

  services.update-daemon = {
    enable = true;
    secretFile = "${config.vault-secrets.secrets.update-daemon}/environment";
    agentSetup = ''
      export PATH="$PATH":${lib.makeBinPath [ pkgs.openssh ]}
      if [[ -z "''${SSH_AGENT_PID:-}" ]] ; then
        echo "Starting an ephemeral ssh-agent" >&2;
        eval "$(ssh-agent -s)"
      fi
      cat ${config.vault-secrets.secrets.update-daemon}/private_ssh_key | env SSH_ASKPASS="$(command -v false)" ssh-add -
    '';
    repos = {
      github = {
        serokell = {
          gemini-infra = {};
          pegasus-infra = {};
        };
      };
    };
    settings = {
      author.email = "operations@serokell.io";
      extra_body = "CC @serokell/operations";
    };
  };
}

In reply to @balsoft:balsoft.ru
nix cli 2 is the experimental nix-command feature, I suppose

In reply to @balsoft:balsoft.ru

{ config, pkgs, lib, inputs, ... }: {
  vault-secrets.secrets.update-daemon = {
    secretsAreBase64 = true;
  };

  services.update-daemon = {
    enable = true;
    secretFile = "${config.vault-secrets.secrets.update-daemon}/environment";
    agentSetup = ''
      export PATH="$PATH":${lib.makeBinPath [ pkgs.openssh ]}
      if [[ -z "''${SSH_AGENT_PID:-}" ]] ; then
        echo "Starting an ephemeral ssh-agent" >&2;
        eval "$(ssh-agent -s)"
      fi
      cat ${config.vault-secrets.secrets.update-daemon}/private_ssh_key | env SSH_ASKPASS="$(command -v false)" ssh-add -
    '';
    repos = {
      github = {
        serokell = {
          gemini-infra = {};
          pegasus-infra = {};
        };
      };
    };
    settings = {
      author.email = "operations@serokell.io";
      extra_body = "CC @serokell/operations";
    };
  };
}

In reply to @aciceri:nixos.dev
What you mean with noisy?

If I understand correctly, the bot pushes to a branch called automatic-update in the same repository, I suppose I have to create it before, right?
And the ssh key must be that of the bot user on Github (I've to give it the write permissions in the automatic-update branch). However could I use also my ssh key specifying a custom author.name? In this case giving permissions wouldn't be necessary since I would have a single GIthub account.

However I understand the problem you exposed, I hope you solve it soon, it's a nice project that could be used by many since the increment of people passing to Flake.

In reply to @aciceri:nixos.dev

If I understand correctly, the bot pushes to a branch called automatic-update in the same repository, I suppose I have to create it before, right?
And the ssh key must be that of the bot user on Github (I've to give it the write permissions in the automatic-update branch). However could I use also my ssh key specifying a custom author.name? In this case giving permissions wouldn't be necessary since I would have a single GIthub account.

However I understand the problem you exposed, I hope you solve it soon, it's a nice project that could be used by many since the increment of people passing to Flake.

1. The bot will automatically create the update branch if it doesn't exist
2. Yes, the ssh key must have push permission to the repository. You can use author.name but that would only affect commits, not the github interface (e.g. the pull requests will still show you as the initiator)

In case any of the flakes fail to update, update-daemon will exit with a non-zero exit code (but still finish updating all the other flakes);

But what does this (from README) mean?
It fails only if the strings replacement in flake.lock fails or is it also running tests/checks?

In reply to @aciceri:nixos.dev

In case any of the flakes fail to update, update-daemon will exit with a non-zero exit code (but still finish updating all the other flakes);

But what does this (from README) mean?
It fails only if the strings replacement in flake.lock fails or is it also running tests/checks?