Sridhar Ratnakumar 776c4425b0 incus-pet: shared /nix/store, restart-to-deploy, drop anywhen flake input ... The incus-pet CLI gains three big changes that together cut per-container disk usage by ~5GB, drop nix-rebuild + nix-copy from the deploy path, and make `deploy` actually pull latest on every invocation. anywhen migrates from a host-installed service to an incus-pet container in the process. * Shared /nix/store mount. Each container gets host's /nix/store bind-mounted read-only (with shift=true for idmapped unprivileged containers). Zero per-container duplication of nixpkgs closures. The CLI builds toplevels on the host; the container sees them via the shared mount, no `nix copy` needed. * Restart-to-deploy. switch-to-configuration is removed entirely (it was stalling on dbus-broker reload and hitting the same lock- contention bug across redeploys). New activation: update /nix/var/nix/profiles/system, repoint /sbin/init through the profile symlink, `incus restart`. The new toplevel's own init script handles /etc setup on boot. Trade-off: ~5s of container reboot per deploy. * Marshaling flake exposes only nixosModules.default. No nixpkgs input, no nixosConfigurations entry. The CLI picks nixpkgs at build time (pinned to nixos-25.11 — matches the LXC image baseline, dodges unstable regressions) and assembles the full nixosSystem via `nix build --impure --expr`. Lets us bump nixpkgs without touching per-deploy state. * `nix flake update --refresh` on every deploy. Was `nix flake lock`, which only locks first-seen inputs — re-deploying `github:srid/anywhen` stayed pinned at the first commit ever resolved. Now every deploy bumps the target input to the current tip of its ref and bypasses nix's fetcher cache. * /sbin/init repoint. The NixOS LXC image hard-links /sbin/init to its own toplevel's init path. Without switch-to-configuration, `incus restart` re-execs that old init, which sets up /etc from the old toplevel — running services keep using the OLD anywhen binary even though the profile pointer moved. CLI now also does `ln -sfn /nix/var/nix/profiles/system/init /sbin/init` so the profile actually drives boot. Idempotent. * Host gcroot via `nix-store --add-root --indirect`. Container's nix DB doesn't know about the path (it lives behind the shared mount), so without a host-side gcroot the host could nix-collect-garbage the running system out from under the container. Symlink at ~/.local/state/incus-pet/<name>/system. Only the LATEST toplevel is pinned per app — no rollback today (file a 5-line ring buffer when rollback matters). * anywhen flake input removed. `modules/nixos/linux/anywhen.nix` is gone; the host config no longer imports anywhen as a flake input. The deploy command takes the flake ref as an argument, so locking it here was just bloat. `just pureintent anywhen-deploy` runs the current invocation. * pureintent ops recipes. New `configurations/nixos/pureintent/mod.just` with anywhen-{deploy,rm,backup,restore,status,shell}. Namespaced via `mod pureintent` so each host's recipes live behind their own prefix. * Drop ssh from deploy path. Bootstrap still pushes the operator's pubkey (for interactive debugging), but activation goes through `incus exec` exclusively. No NIX_SSHOPTS, no nix-copy-via-ssh, no host-key TOFU dance during deploys. Tested end-to-end on pureintent: anywhen migrated from host-installed (21-task SQLite DB at /var/lib/anywhen) to an incus-pet container with the DB intact; hello-web deployed fresh with shared /nix/store; both serve over the tailscale proxy at 100.122.32.106:{6111,8081}; lock bumps + new toplevels confirmed after master advances.		2026-05-23 18:50:10 -04:00
..
naiveintent	nix-ld	2026-05-12 19:13:44 -04:00
pureintent	incus-pet: shared /nix/store, restart-to-deploy, drop anywhen flake input	2026-05-23 18:50:10 -04:00