This repository has no description
feat: deploy blog to homelab via deploy-rs (ankarhem.dev) (#1)
authored by
Jakob Ankarhem
and committed by
GitHub
(Jun 8, 2026, 12:04 PM +0200)
0c7a565a
d713aef0
+182
-3
+69
.github/workflows/deploy.yml
+69
.github/workflows/deploy.yml
···
1
+
name: Deploy
2
+
3
+
on:
4
+
push:
5
+
branches: [main]
6
+
workflow_dispatch:
7
+
8
+
# Never run two deploys at once; let an in-flight deploy finish.
9
+
concurrency:
10
+
group: deploy-blog
11
+
cancel-in-progress: false
12
+
13
+
permissions:
14
+
contents: read
15
+
id-token: write # required for the Tailscale OAuth (OIDC) step
16
+
17
+
jobs:
18
+
deploy:
19
+
runs-on: ubuntu-latest
20
+
steps:
21
+
- name: Checkout (with theme submodule)
22
+
uses: actions/checkout@v4
23
+
with:
24
+
submodules: recursive
25
+
26
+
- name: Install Nix
27
+
uses: cachix/install-nix-action@v31
28
+
with:
29
+
extra_nix_config: |
30
+
experimental-features = nix-command flakes
31
+
accept-flake-config = true
32
+
33
+
- name: Connect to Tailscale
34
+
uses: tailscale/github-action@v3
35
+
with:
36
+
oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
37
+
oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
38
+
tags: tag:ci
39
+
40
+
- name: Configure SSH for deploy
41
+
run: |
42
+
mkdir -p ~/.ssh
43
+
chmod 700 ~/.ssh
44
+
printf '%s\n' "${{ secrets.BLOG_DEPLOY_SSH_KEY }}" > ~/.ssh/id_blog_deploy
45
+
chmod 600 ~/.ssh/id_blog_deploy
46
+
cat >> ~/.ssh/config <<'EOF'
47
+
Host homelab
48
+
User root
49
+
IdentityFile ~/.ssh/id_blog_deploy
50
+
IdentitiesOnly yes
51
+
StrictHostKeyChecking accept-new
52
+
EOF
53
+
chmod 600 ~/.ssh/config
54
+
55
+
- name: Wait for homelab over Tailscale
56
+
run: |
57
+
# MagicDNS + SSH may not be ready the instant the tailnet comes up.
58
+
for i in $(seq 1 10); do
59
+
if ssh -o BatchMode=yes -o ConnectTimeout=5 homelab true 2>/dev/null; then
60
+
echo "homelab reachable"; exit 0
61
+
fi
62
+
echo "attempt $i: homelab not reachable yet, retrying..."; sleep 3
63
+
done
64
+
echo "::error::homelab not reachable over Tailscale"; exit 1
65
+
66
+
- name: Deploy blog to homelab
67
+
# Use the deploy-rs pinned in flake.lock (via the devShell) so the
68
+
# CLI matches the lib that built the activation profile.
69
+
run: nix develop --command deploy .#homelab.blog
+73
-1
flake.lock
+73
-1
flake.lock
···
1
1
{
2
2
"nodes": {
3
+
"deploy-rs": {
4
+
"inputs": {
5
+
"flake-compat": "flake-compat",
6
+
"nixpkgs": [
7
+
"nixpkgs"
8
+
],
9
+
"utils": "utils"
10
+
},
11
+
"locked": {
12
+
"lastModified": 1770019181,
13
+
"narHash": "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=",
14
+
"owner": "serokell",
15
+
"repo": "deploy-rs",
16
+
"rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
17
+
"type": "github"
18
+
},
19
+
"original": {
20
+
"owner": "serokell",
21
+
"repo": "deploy-rs",
22
+
"type": "github"
23
+
}
24
+
},
3
25
"flake-compat": {
4
26
"flake": false,
5
27
"locked": {
28
+
"lastModified": 1733328505,
29
+
"narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
30
+
"owner": "edolstra",
31
+
"repo": "flake-compat",
32
+
"rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
33
+
"type": "github"
34
+
},
35
+
"original": {
36
+
"owner": "edolstra",
37
+
"repo": "flake-compat",
38
+
"type": "github"
39
+
}
40
+
},
41
+
"flake-compat_2": {
42
+
"flake": false,
43
+
"locked": {
6
44
"lastModified": 1767039857,
7
45
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
8
46
"owner": "NixOS",
···
36
74
},
37
75
"git-hooks": {
38
76
"inputs": {
39
-
"flake-compat": "flake-compat",
77
+
"flake-compat": "flake-compat_2",
40
78
"gitignore": "gitignore",
41
79
"nixpkgs": [
42
80
"nixpkgs"
···
126
164
},
127
165
"root": {
128
166
"inputs": {
167
+
"deploy-rs": "deploy-rs",
129
168
"flake-parts": "flake-parts",
130
169
"git-hooks": "git-hooks",
131
170
"nixpkgs": "nixpkgs",
132
171
"treefmt-nix": "treefmt-nix"
172
+
}
173
+
},
174
+
"systems": {
175
+
"locked": {
176
+
"lastModified": 1681028828,
177
+
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
178
+
"owner": "nix-systems",
179
+
"repo": "default",
180
+
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
181
+
"type": "github"
182
+
},
183
+
"original": {
184
+
"owner": "nix-systems",
185
+
"repo": "default",
186
+
"type": "github"
133
187
}
134
188
},
135
189
"treefmt-nix": {
···
147
201
"original": {
148
202
"owner": "numtide",
149
203
"repo": "treefmt-nix",
204
+
"type": "github"
205
+
}
206
+
},
207
+
"utils": {
208
+
"inputs": {
209
+
"systems": "systems"
210
+
},
211
+
"locked": {
212
+
"lastModified": 1731533236,
213
+
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
214
+
"owner": "numtide",
215
+
"repo": "flake-utils",
216
+
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
217
+
"type": "github"
218
+
},
219
+
"original": {
220
+
"owner": "numtide",
221
+
"repo": "flake-utils",
150
222
"type": "github"
151
223
}
152
224
}
+40
-2
flake.nix
+40
-2
flake.nix
···
2
2
description = "Zola development environment";
3
3
4
4
inputs = {
5
+
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
6
+
deploy-rs.url = "github:serokell/deploy-rs";
5
7
flake-parts.url = "github:hercules-ci/flake-parts";
8
+
git-hooks.inputs.nixpkgs.follows = "nixpkgs";
9
+
git-hooks.url = "github:cachix/git-hooks.nix";
6
10
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
7
-
git-hooks.url = "github:cachix/git-hooks.nix";
8
-
git-hooks.inputs.nixpkgs.follows = "nixpkgs";
11
+
self.submodules = true;
9
12
treefmt-nix.url = "github:numtide/treefmt-nix";
10
13
};
11
14
···
39
42
pre-commit.settings.hooks = {
40
43
treefmt.enable = true;
41
44
};
45
+
46
+
packages.blog = pkgs.stdenvNoCC.mkDerivation {
47
+
pname = "ankarhem-blog-site";
48
+
version = "0";
49
+
src = ./.;
50
+
nativeBuildInputs = [ pkgs.zola ];
51
+
buildPhase = ''
52
+
runHook preBuild
53
+
mkdir -p "$out"
54
+
zola --config zola.toml build --output-dir "$out/public"
55
+
runHook postBuild
56
+
'';
57
+
dontInstall = true;
58
+
};
59
+
checks = lib.optionalAttrs (system == "x86_64-linux") (
60
+
inputs.deploy-rs.lib.${system}.deployChecks self.deploy
61
+
);
62
+
42
63
devShells.default = pkgs.mkShell {
43
64
inherit (config.pre-commit) shellHook;
44
65
packages =
45
66
with pkgs;
46
67
[
47
68
zola
69
+
inputs.deploy-rs.packages.${system}.default
48
70
]
49
71
++ config.pre-commit.settings.enabledPackages;
50
72
};
···
53
75
overlays = lib.attrValues self.overlays;
54
76
};
55
77
};
78
+
79
+
flake.deploy.nodes.homelab = {
80
+
hostname = "homelab";
81
+
sshUser = "root";
82
+
user = "root";
83
+
profiles.blog = {
84
+
path =
85
+
let
86
+
p = self.packages.x86_64-linux.blog;
87
+
in
88
+
inputs.deploy-rs.lib.x86_64-linux.activate.custom p ''
89
+
ln -sfn "${p}/public" /var/www/ankarhem.dev
90
+
'';
91
+
};
92
+
};
93
+
56
94
flake.overlays.default = final: prev: {
57
95
};
58
96
};