bug: fix autodeploy

Co-authored-by: Floweynt <50057682+Floweynt@users.noreply.github.com>
Reviewed-on: #7

configuration.nix

@@ -19,9 +19,10 @@ in
     giteaRepo = "server/server-config";
     tokenFile = "${hostInfo.paths.secrets}/gitea-autodeploy-token";
     allowedSigners = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi flowey@arch"
+      "flowey@arch namespaces=\"git\" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi"
     ];
     stateDir = hostInfo.paths.config;
+    repoOwner = "server";
   };
 
   assertions =

dsl.nix

@@ -222,13 +222,15 @@ rec {
     : Bind mounts, keyed by mount point.
 
     `resources.devices`
-    : Host device nodes to expose, as paths, added to the unit's
+    : Host device nodes to expose, as paths. Bound into the container at the
-      `DeviceAllow=`. nspawn populates a handful of privileged devices
+      same path and added to the unit's `DeviceAllow=` - the cgroup
-      (`/dev/kvm`, `/dev/net/tun`, ...) into the container's own `/dev` once
+      permission alone doesn't get you a working node (nothing can `mknod` a
-      the cgroup allows it, and silently skips ones the host doesn't have -
+      device inside a user namespace), and the bind alone leaves the cgroup
-      no `resources.fs` bind mount needed. Nodes keep their host ownership,
+      denying `open()`, so both are needed. The bind is unconditional, so
-      so a consumer inside needs `isolation.privateUsers = "identity"` for
+      the device must actually exist on whatever host runs the container.
-      the owning gid to mean anything.
+      Nodes keep their host ownership, so a consumer inside needs
+      `isolation.privateUsers = "identity"` for the owning gid to mean
+      anything.
 
     `isolation.nixDaemon`
     : Whether the Nix daemon and CLI are available inside the container.
@@ -295,6 +297,10 @@ rec {
         + lib.optionalString useIdmap ":idmap"
       ) allBindMounts;
       bindMountHostPaths = map (bm: bm.hostPath) (lib.attrValues allBindMounts);
+      # DeviceAllow= alone only grants cgroup permission - nspawn can't
+      # mknod a device node inside a user namespace, so the node still
+      # needs an explicit bind from the host.
+      deviceFlags = map (d: "--bind=${d}") devices;
       inherit (deriveIdentity ifPrefix.nspawn name)
         iface
         mac
@@ -381,7 +387,7 @@ rec {
       nixosContainer = {
         inherit autoStart privateUsers;
         bindMounts = { };
-        extraFlags = bindMountExtraFlags;
+        extraFlags = bindMountExtraFlags ++ deviceFlags;
         privateNetwork = true;
         extraVeths = linkVeths;
         config =

modules/autodeploy.nix

@@ -38,10 +38,20 @@ in
       type = lib.types.listOf lib.types.str;
       default = [ ];
     };
+    
+    repoOwner = lib.mkOption {
+      type = lib.types.str;
+      description = "User that owns the configuration checkout";
+    };
 
     stateDir = lib.mkOption {
       type = lib.types.str;
     };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -58,6 +68,8 @@ in
         DEPLOY_BRANCH = cfg.branch;
         STATE_DIR = cfg.stateDir;
         REPO_DIR = "/persist/@configuration";
+        REPO_OWNER = cfg.repoOwner;
+        HOSTNAME = cfg.hostname;
       };
 
       serviceConfig = {

packages/server-autodeploy.nix

@@ -3,6 +3,8 @@
   git,
   curl,
   jq,
+  util-linux,
+  openssh,
 }:
 import ./mk-script.nix { inherit writeShellApplication; } {
   name = "server-autodeploy";
@@ -10,5 +12,7 @@ import ./mk-script.nix { inherit writeShellApplication; } {
     git
     curl
     jq
+    util-linux
+    openssh
   ];
 }

scripts/server-autodeploy.sh

@@ -6,12 +6,15 @@ mkdir -p "$STATE_DIR"
 exec 9>"$STATE_DIR/lock"
 flock -n 9 || { echo "another deploy running"; exit 0; }
 
+runas() { runuser -u "$REPO_OWNER" -- "$@"; }
+
 report_status() {
+  echo "updating status to: $1 - $2"
   [[ -f "$TOKEN_FILE" ]] || return 0
   curl -sf -X POST \
     -H "Authorization: token $(<"$TOKEN_FILE")" \
     -H "Content-Type: application/json" \
-    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$(hostname)" \
+    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$HOSTNAME" \
       '{state:$s,description:$d,context:$c}')" \
     "$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
 }
@@ -24,9 +27,9 @@ export GIT_CONFIG_VALUE_0=ssh
 export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
 export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"
 
-git fetch origin --tags --prune-tags
+runas git fetch origin --tags --prune-tags
 
-latest=$(git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
+latest=$(runas git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
   echo "no tags on $BRANCH"
   exit 0
 }
@@ -36,17 +39,16 @@ current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
 
 echo "new tag: $latest (current: ${current:-none})"
 
-git tag -v "$latest" || {
+runas git tag -v "$latest" || {
-  sha=$(git rev-list -1 "$latest")
+  sha=$(runas git rev-list -1 "$latest")
   report_status "failure" "tag signature verification failed" "$sha"
   exit 1
 }
 
-sha=$(git rev-list -1 "$latest")
+sha=$(runas git rev-list -1 "$latest")
 report_status "pending" "deploying $latest" "$sha"
 
-# build from remote, pinned to the verified rev - no local checkout needed
+flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME"
-flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$(hostname)"
 
 if nixos-rebuild switch --flake "$flake_url"; then
   echo "$latest" > "$STATE_DIR/tag"

tests/server-n0/integration.py

@@ -336,9 +336,28 @@ with subtest("(functional): published ports follow the container's lifetime"):
 with subtest("(functional): declared devices are usable in-container"):
     for name, devices in DEVICES.items():
         for dev in devices:
+            # opened, not stat'd: without DeviceAllow= the node is still visible
             server.succeed(ct_cmd(name, f"exec 3<> {dev}"))
 
 
+with subtest("(functional): /dev/kvm actually initializes, not just opens"):
+    # a wrong-gid or unmapped node still opens but fails the ioctls qemu
+    # needs, so boot with no disk (never completes) and kill it - the
+    # failure mode this catches is qemu refusing to start at all.
+    for name, devices in DEVICES.items():
+        if "/dev/kvm" not in devices:
+            continue
+        out = server.succeed(
+            ct_cmd(
+                name,
+                f"{TIMEOUT} 3 qemu-system-x86_64 -enable-kvm -m 256 -nographic -no-reboot "
+                ">/tmp/qemu.out 2>&1; cat /tmp/qemu.out",
+            )
+        )
+        assert "Permission denied" not in out, f"{name}: qemu couldn't use /dev/kvm:\n{out}"
+        assert "Could not access KVM" not in out, f"{name}: qemu couldn't use /dev/kvm:\n{out}"
+
+
 with subtest("(isolation): devices reach only the container that declared them"):
     for name in enterable:
         for dev in {d for ds in DEVICES.values() for d in ds} - set(DEVICES.get(name, [])):