configuration.nix

@@ -19,9 +19,10 @@ in
     giteaRepo = "server/server-config";
     tokenFile = "${hostInfo.paths.secrets}/gitea-autodeploy-token";
     allowedSigners = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi flowey@arch"
+      "flowey@arch namespaces=\"git\" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi"
     ];
     stateDir = hostInfo.paths.config;
+    repoOwner = "server";
   };
 
   assertions =

modules/autodeploy.nix

@@ -38,10 +38,20 @@ in
       type = lib.types.listOf lib.types.str;
       default = [ ];
     };
+    
+    repoOwner = lib.mkOption {
+      type = lib.types.str;
+      description = "User that owns the configuration checkout";
+    };
 
     stateDir = lib.mkOption {
       type = lib.types.str;
     };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -58,6 +68,8 @@ in
         DEPLOY_BRANCH = cfg.branch;
         STATE_DIR = cfg.stateDir;
         REPO_DIR = "/persist/@configuration";
+        REPO_OWNER = cfg.repoOwner;
+        HOSTNAME = cfg.hostname;
       };
 
       serviceConfig = {

packages/server-autodeploy.nix

@@ -3,6 +3,8 @@
   git,
   curl,
   jq,
+  util-linux,
+  openssh,
 }:
 import ./mk-script.nix { inherit writeShellApplication; } {
   name = "server-autodeploy";
@@ -10,5 +12,7 @@ import ./mk-script.nix { inherit writeShellApplication; } {
     git
     curl
     jq
+    util-linux
+    openssh
   ];
 }

scripts/server-autodeploy.sh

@@ -6,12 +6,15 @@ mkdir -p "$STATE_DIR"
 exec 9>"$STATE_DIR/lock"
 flock -n 9 || { echo "another deploy running"; exit 0; }
 
+runas() { runuser -u "$REPO_OWNER" -- "$@"; }
+
 report_status() {
+  echo "updating status to: $1 - $2"
   [[ -f "$TOKEN_FILE" ]] || return 0
   curl -sf -X POST \
     -H "Authorization: token $(<"$TOKEN_FILE")" \
     -H "Content-Type: application/json" \
-    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$(hostname)" \
+    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$HOSTNAME" \
       '{state:$s,description:$d,context:$c}')" \
     "$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
 }
@@ -24,9 +27,9 @@ export GIT_CONFIG_VALUE_0=ssh
 export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
 export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"
 
-git fetch origin --tags --prune-tags
+runas git fetch origin --tags --prune-tags
 
-latest=$(git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
+latest=$(runas git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
   echo "no tags on $BRANCH"
   exit 0
 }
@@ -36,17 +39,16 @@ current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
 
 echo "new tag: $latest (current: ${current:-none})"
 
-git tag -v "$latest" || {
-  sha=$(git rev-list -1 "$latest")
+runas git tag -v "$latest" || {
+  sha=$(runas git rev-list -1 "$latest")
   report_status "failure" "tag signature verification failed" "$sha"
   exit 1
 }
 
-sha=$(git rev-list -1 "$latest")
+sha=$(runas git rev-list -1 "$latest")
 report_status "pending" "deploying $latest" "$sha"
 
-# build from remote, pinned to the verified rev - no local checkout needed
-flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$(hostname)"
+flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME"
 
 if nixos-rebuild switch --flake "$flake_url"; then
   echo "$latest" > "$STATE_DIR/tag"