Simon Gardling
aef99e7365
- modules/server-deploy-guard.nix: extendable aggregator registered via
services.deployGuard.checks.<name>.{description,command}. Installs
deploy-guard-check with per-check timeout, pass/block reporting, JSON
output, DEPLOY_GUARD_BYPASS / /run/deploy-guard-bypass (single-shot).
- services/jellyfin/jellyfin-deploy-guard.nix: curl+jq on /Sessions,
blocks when any session carries NowPlayingItem; soft-fails when unreachable.
- services/minecraft-deploy-guard.nix: mcstatus SLP query on 25565, blocks
when players.online > 0; soft-fails when unreachable.
- flake.nix: wrap deploy.nodes.muffin activation with activate.custom so
deploy-guard-check runs before switch-to-configuration. Auto-rollback
catches the failure. dryActivate/boot branches preserved.
- deploy.sh: SSH preflight for ./deploy.sh muffin with --force /
DEPLOY_GUARD_FORCE=1 (touches remote bypass marker). Connectivity
failure is soft; activation still enforces.
- tests/deploy-guard.nix: aggregator contract, bypass mechanics, timeout,
JSON output.
44 lines
1.3 KiB
Nix
44 lines
1.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}@args:
|
|
let
|
|
handleTest = file: import file (args);
|
|
in
|
|
{
|
|
zfsTest = handleTest ./zfs.nix;
|
|
testTest = handleTest ./testTest.nix;
|
|
minecraftTest = handleTest ./minecraft.nix;
|
|
jellyfinQbittorrentMonitorTest = handleTest ./jellyfin-qbittorrent-monitor.nix;
|
|
deployGuardTest = handleTest ./deploy-guard.nix;
|
|
filePermsTest = handleTest ./file-perms.nix;
|
|
|
|
# fail2ban tests
|
|
fail2banSshTest = handleTest ./fail2ban/ssh.nix;
|
|
fail2banCaddyTest = handleTest ./fail2ban/caddy.nix;
|
|
fail2banGiteaTest = handleTest ./fail2ban/gitea.nix;
|
|
fail2banVaultwardenTest = handleTest ./fail2ban/vaultwarden.nix;
|
|
fail2banImmichTest = handleTest ./fail2ban/immich.nix;
|
|
fail2banJellyfinTest = handleTest ./fail2ban/jellyfin.nix;
|
|
fail2banLlamaCppTest = handleTest ./fail2ban/llama-cpp.nix;
|
|
|
|
# jellyfin annotation service test
|
|
jellyfinAnnotationsTest = handleTest ./jellyfin-annotations.nix;
|
|
|
|
# zfs scrub annotations test
|
|
zfsScrubAnnotationsTest = handleTest ./zfs-scrub-annotations.nix;
|
|
|
|
# xmrig auto-pause test
|
|
xmrigAutoPauseTest = handleTest ./xmrig-auto-pause.nix;
|
|
# ntfy alerts test
|
|
ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
|
|
|
|
# torrent audit test
|
|
torrentAuditTest = handleTest ./torrent-audit.nix;
|
|
|
|
# gitea runner test
|
|
giteaRunnerTest = handleTest ./gitea-runner.nix;
|
|
}
|