feat: try out colmena

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

flake.lock

@@ -35,10 +35,32 @@
         "type": "github"
       }
     },
-    "deploy-rs": {
+    "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nix-github-actions": "nix-github-actions",
         "nixpkgs": "nixpkgs_2",
+        "stable": "stable"
+      },
+      "locked": {
+        "lastModified": 1755272288,
+        "narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=",
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "type": "github"
+      }
+    },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_3",
         "utils": "utils"
       },
       "locked": {
@@ -115,11 +137,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
+        "lastModified": 1650374568,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
         "type": "github"
       },
       "original": {
@@ -131,11 +153,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
+        "lastModified": 1733328505,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -161,6 +183,22 @@
       }
     },
     "flake-compat_4": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_5": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -217,6 +255,21 @@
       }
     },
     "flake-utils": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": "systems_2"
       },
@@ -234,7 +287,7 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
+    "flake-utils_3": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -325,7 +378,7 @@
     "headplane": {
       "inputs": {
         "devshell": "devshell",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -395,10 +448,31 @@
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "colmena",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "git-hooks": "git-hooks",
         "nixpkgs": [
           "nixpkgs"
@@ -422,8 +496,8 @@
     },
     "nixos-wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
         "lastModified": 1758123407,
@@ -504,6 +578,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1750134718,
+        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1743014863,
         "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
@@ -519,7 +609,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1757745802,
         "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=",
@@ -535,7 +625,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1758070117,
         "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=",
@@ -551,7 +641,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
       "locked": {
         "lastModified": 1751011381,
         "narHash": "sha256-krGXKxvkBhnrSC/kGBmg5MyupUUT5R6IBCLEzx9jhMM=",
@@ -567,7 +657,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1750811787,
         "narHash": "sha256-rD/978c35JXz6JLAzciTIOCMenPumF6zrQOj4rVZeHE=",
@@ -583,7 +673,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_8": {
       "locked": {
         "lastModified": 1730768919,
         "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=",
@@ -599,7 +689,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
+    "nixpkgs_9": {
       "locked": {
         "lastModified": 1722813957,
         "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=",
@@ -618,7 +708,7 @@
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "nixvim": "nixvim_2",
         "pre-commit-hooks": "pre-commit-hooks"
       },
@@ -639,7 +729,7 @@
     "nixvim_2": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_7",
         "nuschtosSearch": "nuschtosSearch",
         "systems": "systems_4"
       },
@@ -659,7 +749,7 @@
     },
     "nuschtosSearch": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
         "ixx": "ixx",
         "nixpkgs": [
           "nixvim",
@@ -683,9 +773,9 @@
     },
     "pre-commit-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_5",
         "gitignore": "gitignore_2",
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_8"
       },
       "locked": {
         "lastModified": 1750779888,
@@ -704,13 +794,14 @@
     "root": {
       "inputs": {
         "catppuccin": "catppuccin",
+        "colmena": "colmena",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
         "headplane": "headplane",
         "home-manager": "home-manager",
         "nixos-mailserver": "nixos-mailserver",
         "nixos-wsl": "nixos-wsl",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
         "sops-nix": "sops-nix",
@@ -737,6 +828,22 @@
         "type": "github"
       }
     },
+    "stable": {
+      "locked": {
+        "lastModified": 1750133334,
+        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "superdirt-src": {
       "flake": false,
       "locked": {
@@ -833,7 +940,7 @@
     "tidalcycles": {
       "inputs": {
         "dirt-samples-src": "dirt-samples-src",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_9",
         "superdirt-src": "superdirt-src",
         "tidal-src": "tidal-src",
         "vim-tidal-src": "vim-tidal-src",

flake.nix

@@ -26,6 +26,9 @@
     # deploy-rs
     deploy-rs.url = "github:serokell/deploy-rs";
 
+    # colmena
+    colmena.url = "github:zhaofengli/colmena";
+
     # nixos-wsl
     nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
 
@@ -58,6 +61,7 @@
       nixpkgs,
       tidalcycles,
       deploy-rs,
+      colmena,
       ...
     }@inputs:
     let
@@ -92,6 +96,20 @@
       nixosModules = import ./modules/nixos;
       homeManagerModules = import ./modules/home-manager;
 
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        {
+          default = pkgs.mkShell {
+            buildInputs = [
+              colmena.packages.${system}.colmena
+            ];
+          };
+        }
+      );
+
       nixosConfigurations =
         let
           hetzner = import ./lib/hetzner.nix { inherit inputs nixpkgs; };
@@ -136,7 +154,7 @@
           };
 
           # servers
-          db-01 = hetzner.mkHetznerMachine "db-01" {
+          db-01 = hetzner.mkMachine "db-01" {
             ipv6Address = "2a01:4f8:c012:15d4::/64";
           };
           hosting-01 = nixpkgs.lib.nixosSystem {
@@ -146,7 +164,7 @@
               ./hosts/hosting-01
             ];
           };
-          hosting-02 = hetzner.mkHetznerMachine "hosting-02" {
+          hosting-02 = hetzner.mkMachine "hosting-02" {
             ipv6Address = "2a01:4f8:c013:7fc0::/64";
           };
           mail-01 = nixpkgs.lib.nixosSystem {
@@ -166,6 +184,55 @@
         };
       }) { inherit (self.nixosConfigurations) db-01 hosting-02; };
 
+      colmenaHive =
+        let
+          servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) (
+            builtins.filter (file: file != "common.nix" && nixpkgs.lib.hasSuffix ".nix" file) (
+              builtins.attrNames (builtins.readDir ./hosts/servers)
+            )
+          );
+
+          colmenaConfig = nixpkgs.lib.genAttrs servers (
+            name:
+            { ... }:
+            let
+              diskConfig = import ./lib/disk-config.nix { inherit nixpkgs; };
+              machineConfig = import ./hosts/servers/${name}.nix;
+            in
+            {
+              imports = [
+                inputs.disko.nixosModules.disko
+                inputs.sops-nix.nixosModules.sops
+                inputs.self.nixosModules.namespaced-vpn
+                inputs.self.nixosModules.storagebox
+
+                ./hosts/servers/common.nix
+
+                diskConfig
+                machineConfig
+              ];
+
+              deployment = {
+                targetHost = "${name}.escapeangle.com";
+                targetPort = 22;
+                targetUser = "root";
+                buildOnTarget = true;
+              };
+            }
+          );
+        in
+        colmena.lib.makeHive (
+          {
+            meta = {
+              nixpkgs = import nixpkgs {
+                system = "aarch64-linux";
+                overlays = [ ];
+              };
+            };
+          }
+          // colmenaConfig
+        );
+
       checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
     };
 }

hosts/servers/common.nix

@@ -0,0 +1,88 @@
+{
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    loader.grub = {
+      devices = [ "/dev/sda" ];
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
+
+    initrd.kernelModules = [ "virtio_gpu" ];
+
+    kernelParams = [ "console=tty" ];
+  };
+
+  time.timeZone = lib.mkDefault "Europe/Berlin";
+
+  networking = {
+    useNetworkd = true;
+  };
+
+  systemd.network = {
+    enable = true;
+
+    networks = {
+      "30-wan" = {
+        matchConfig.Name = "enp1s0";
+        networkConfig.DHCP = "ipv4";
+        routes = [
+          { Gateway = "fe80::1"; }
+        ];
+      };
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    extraConfig = ''
+      PrintLastLog no
+    '';
+  };
+
+  programs.zsh.enable = true;
+  environment.pathsToLink = [ "/share/zsh" ];
+  environment.shells = [ pkgs.zsh ];
+  environment.enableAllTerminfo = true;
+
+  users.users.lander = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    extraGroups = [
+      "wheel"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
+    ];
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
+  ];
+
+  nix = {
+    settings = {
+      trusted-users = [ "lander" ];
+      accept-flake-config = true;
+      auto-optimise-store = true;
+    };
+
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''experimental-features = nix-command flakes'';
+
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 7d";
+    };
+  };
+}

lib/hetzner.nix

@@ -4,7 +4,7 @@
   ...
 }:
 {
-  mkHetznerMachine =
+  mkMachine =
     hostname:
     {
       system ? "aarch64-linux",
@@ -154,4 +154,23 @@
         machineConfig
       ] ++ extraModules;
     };
+
+  mkColmena =
+    {
+      system ? "aarch64-linux",
+      user ? "lander",
+      timeZone ? "Europe/Berlin",
+      disks ? [ "/dev/sda" ],
+      ipv6Address,
+      tailscale ? true,
+      extraModules ? [ ],
+    }:
+    {
+      deployment = {
+        targetHost = "hosting-02.escapeangle.com";
+        targetPort = 22;
+        targetUser = "root";
+        buildOnTarget = true;
+      };
+    };
 }