From d347a2a13918ed7a583247772ea302e49097a77f Mon Sep 17 00:00:00 2001
From: Floweynt <server-n0@mail.floweytf.com>
Date: Mon, 14 Sep 2026 06:54:44 +0000
Subject: [PATCH] bug: fix autodeploy

---
 configuration.nix              |  3 ++-
 modules/autodeploy.nix         | 12 ++++++++++++
 packages/server-autodeploy.nix |  4 ++++
 scripts/server-autodeploy.sh   | 18 ++++++++++--------
 4 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 97e6f37..7461aba 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,9 +19,10 @@ in
     giteaRepo = "server/server-config";
     tokenFile = "${hostInfo.paths.secrets}/gitea-autodeploy-token";
     allowedSigners = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi flowey@arch"
+      "flowey@arch namespaces=\"git\" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi"
     ];
     stateDir = hostInfo.paths.config;
+    repoOwner = "server";
   };
 
   assertions =
diff --git a/modules/autodeploy.nix b/modules/autodeploy.nix
index 4ed0af1..2d8c7d3 100644
--- a/modules/autodeploy.nix
+++ b/modules/autodeploy.nix
@@ -38,10 +38,20 @@ in
       type = lib.types.listOf lib.types.str;
       default = [ ];
     };
+    
+    repoOwner = lib.mkOption {
+      type = lib.types.str;
+      description = "User that owns the configuration checkout";
+    };
 
     stateDir = lib.mkOption {
       type = lib.types.str;
     };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -58,6 +68,8 @@ in
         DEPLOY_BRANCH = cfg.branch;
         STATE_DIR = cfg.stateDir;
         REPO_DIR = "/persist/@configuration";
+        REPO_OWNER = cfg.repoOwner;
+        HOSTNAME = cfg.hostname;
       };
 
       serviceConfig = {
diff --git a/packages/server-autodeploy.nix b/packages/server-autodeploy.nix
index 9023c97..5e0fe77 100644
--- a/packages/server-autodeploy.nix
+++ b/packages/server-autodeploy.nix
@@ -3,6 +3,8 @@
   git,
   curl,
   jq,
+  util-linux,
+  openssh,
 }:
 import ./mk-script.nix { inherit writeShellApplication; } {
   name = "server-autodeploy";
@@ -10,5 +12,7 @@ import ./mk-script.nix { inherit writeShellApplication; } {
     git
     curl
     jq
+    util-linux
+    openssh
   ];
 }
diff --git a/scripts/server-autodeploy.sh b/scripts/server-autodeploy.sh
index 63ca5a6..f2559f2 100644
--- a/scripts/server-autodeploy.sh
+++ b/scripts/server-autodeploy.sh
@@ -6,12 +6,15 @@ mkdir -p "$STATE_DIR"
 exec 9>"$STATE_DIR/lock"
 flock -n 9 || { echo "another deploy running"; exit 0; }
 
+runas() { runuser -u "$REPO_OWNER" -- "$@"; }
+
 report_status() {
+  echo "updating status to: $1 - $2"
   [[ -f "$TOKEN_FILE" ]] || return 0
   curl -sf -X POST \
     -H "Authorization: token $(<"$TOKEN_FILE")" \
     -H "Content-Type: application/json" \
-    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$(hostname)" \
+    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$HOSTNAME" \
       '{state:$s,description:$d,context:$c}')" \
     "$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
 }
@@ -24,9 +27,9 @@ export GIT_CONFIG_VALUE_0=ssh
 export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
 export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"
 
-git fetch origin --tags --prune-tags
+runas git fetch origin --tags --prune-tags
 
-latest=$(git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
+latest=$(runas git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
   echo "no tags on $BRANCH"
   exit 0
 }
@@ -36,17 +39,16 @@ current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
 
 echo "new tag: $latest (current: ${current:-none})"
 
-git tag -v "$latest" || {
-  sha=$(git rev-list -1 "$latest")
+runas git tag -v "$latest" || {
+  sha=$(runas git rev-list -1 "$latest")
   report_status "failure" "tag signature verification failed" "$sha"
   exit 1
 }
 
-sha=$(git rev-list -1 "$latest")
+sha=$(runas git rev-list -1 "$latest")
 report_status "pending" "deploying $latest" "$sha"
 
-# build from remote, pinned to the verified rev - no local checkout needed
-flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$(hostname)"
+flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME"
 
 if nixos-rebuild switch --flake "$flake_url"; then
   echo "$latest" > "$STATE_DIR/tag"