Colmena | 309 Members | |
| A simple, stateless NixOS deployment tool - https://github.com/zhaofengli/colmena | 104 Servers |
| Sender | Message | Time |
|---|---|---|
| 15 Jan 2025 | ||
| Using a decent key size with public key only logins for root is pretty secure. You only emit an authorized keys on the remote and, depending on settings, you need to use ssh-add to unlock it before deploying. | 13:07:33 | |
| Yeah this issue bugs me too... AFAIU colmena runs ssh non-interactive hence anything that would require you to enter infos into an SSH session just fails. There's `pam_ssh_agent` which can be configured to authorize sudo prompts via SSH keys & remotely by accessing the ssh agent on the client side. https://www.teaparty.net/technotes/yubikey-sudo-ssh.html looks like a fairly decent write-up (minus the Yubikey which just gets added to the SSH agent). Not sure if that's good enough for your scenario. | 14:47:13 | |
| 22:06:41 | ||
| 22:07:25 | ||
| This is pretty much exactly what I was looking for! I've done something similar in the past so I think this could work I'll play around with it and see if it works in practice. | 22:48:51 | |
You bring up a good point if I can't get the pam_ssh_agent to do it I'll likely relax my hangup with this one | 22:54:28 | |
| 16 Jan 2025 | ||
In reply to @lotallia:matrix.orgI'm also curious but dont have the time to investigate/ collaborate on it right now. Please report any results back if you can 🙏 | 15:15:01 | |
| 17 Jan 2025 | ||
| 08:11:14 | ||
| The last few days got super busy so I actually haven't had a chance to really look at this I plan on doing so later today but as I'm in the middle of a massive rewrite of my nix config any change means putting out several smaller fires first. I will report back once I have something to report :) | 18:05:39 | |
| 20 Jan 2025 | ||
| 10:17:17 | ||
| For anyone interested, I just published a blog article regarding setting up Colmena, with passwordless reboot (with full-disk-encryption). https://log.pfad.fr/2025/fde-nixos-colmena-passwordless-reboot/ | 11:15:15 | |
(I would be interested to know if the step scp -r user@remote: /etc/nixos/ ./host-a correct is for the setup. If yes, it would probably make sense to update the documentation) | 11:17:02 | |
(I would be interested to know if the step scp -r user@remote: /etc/nixos/ ./host-a is correct, for the initial setup. If yes, it would probably make sense to update the documentation) | 11:17:21 | |
| 11:17:25 | ||
(I would be interested to know if the step scp -r user@remote: /etc/nixos/ ./host-a is correct, for the initial setup. If yes, it would probably make sense to update the official documentation) | 11:17:29 | |
| 17:44:52 | ||
| 21 Jan 2025 | ||
| 19:25:43 | ||
| 22 Jan 2025 | ||
| 06:52:00 | ||
| 26 Jan 2025 | ||
| 14:57:35 | ||
| 17:27:16 | ||
| Hello, I can't get my remote builder to work with colmena. I added "ssh://quentin@xxx x86_64-linux ~/.ssh/quentin-offen" to my error: a 'x86_64-linux' with features {} is required to build '/nix/store/zszyc30901qn2b7kqx6wwp0hxbwm9kzl-haskell-generic-builder-test-wrapper.sh.drv', but I am a 'aarch64-darwin' with features {apple-virt, benchmark, big-parallel, nixos-test} | 17:29:00 | |
| 27 Jan 2025 | ||
| 11:17:24 | ||
| 28 Jan 2025 | ||
| Quentin Le Guennec: does the following work? ie, does not prompt for password or to accept key fingerprint sudo su | 08:54:15 | |
| 19:26:43 | ||
| 8 Feb 2025 | ||
| 20:28:59 | ||
| Hi, does anyone have any working example of using colmena in a flake with disko? Passing inputs via
| 20:40:29 | |
| * Hi, does anyone have any working example of using colmena in a flake with disko? Passing inputs via
| 20:40:52 | |
| * Hi, does anyone have any working example of using colmena in a flake with disko? Passing inputs via As a minimum config:
| 20:41:47 | |
| judging from others in this chat also using disko, I think at some point a template in the docs would be good, otherwise a point about incompatibility to save time | 20:42:32 | |
| 9 Feb 2025 | ||
| 22:50:18 | ||