nix-deploy

name: nix-deploy description: Deploy NixOS/Darwin configuration to local or remote host using justfile commands compatibility: Requires nix, just metadata: author: ruinous.ai version: "2.0" domain: deployment parameters: hostname: type: select description: Target host to deploy to (defaults to current host if omitted) required: false options: - label: "chassis" description: "AI development workstation (NixOS)" - label: "framework" description: "NixOS laptop" - label: "monolith" description: "Infrastructure hub" - label: "pilaster" description: "Container server" - label: "zenith" description: "AI containers" - label: "obelisk" description: "GPU compute" - label: "jbookpro" description: "MacBook Pro (Darwin)" - label: "jmacmini" description: "Mac Mini (Darwin)" - label: "Enter other..." description: "Specify a different host" dry_run: type: select description: Whether to perform a dry-build first required: false default: "Yes" options: - label: "Yes (Recommended)" description: "Verify build before deploying" - label: "No" description: "Deploy directly"

Nix Deploy

Deploy NixOS or Darwin configuration to a local or remote host.

Parameter Handling

If parameters are missing from $ARGUMENTS, use mcp_question to gather them:

mcp_question({
  questions: [
    {
      question: "Which host do you want to deploy to?",
      header: "Host",
      options: [
        { label: "Current host (default)", description: "Deploy to this machine" },
        { label: "chassis", description: "AI development workstation (NixOS)" },
        { label: "framework", description: "NixOS laptop" },
        { label: "monolith", description: "Infrastructure hub" },
        { label: "pilaster", description: "Container server" },
        { label: "zenith", description: "AI containers" },
        { label: "obelisk", description: "GPU compute" },
        { label: "jbookpro", description: "MacBook Pro (Darwin)" },
        { label: "jmacmini", description: "Mac Mini (Darwin)" }
      ]
    },
    {
      question: "Perform dry-build verification first?",
      header: "Dry Run",
      options: [
        { label: "Yes (Recommended)", description: "Verify build before deploying" },
        { label: "No", description: "Deploy directly" }
      ]
    }
  ]
})

Expected $ARGUMENTS format: [hostname] [--no-dry-run]

• Example: (empty) - deploy to current host with dry-build
• Example: pilaster - deploy to pilaster with dry-build
• Example: monolith --no-dry-run - deploy directly without verification

Steps

1. Dry-build verification (recommended)

Smart check (auto-detects Darwin vs NixOS, local vs remote):

just check [hostname]

If hostname is omitted, uses current host.

2. Deploy

Smart deploy (auto-detects local vs remote, Darwin vs Linux):

just deploy [hostname]

If hostname is omitted, uses current host.

3. Verify deployment

After deployment completes:

# For remote hosts, SSH and check
ssh <hostname>.meskill.farm "systemctl status" | head -20

# For services, verify they're running
ssh <hostname>.meskill.farm "systemctl status docker-caddy"

Host Reference

Container Hosts

Workstations

Common Deployment Scenarios

After changing container configuration

# 1. Verify the build
just check pilaster

# 2. Deploy
just deploy pilaster

# 3. Verify container is running
ssh pilaster.meskill.farm "docker ps | grep <container-name>"

After changing Caddy routes

# 1. Deploy host with Caddy changes
just deploy <hostname>

# 2. Caddy auto-reloads when Caddyfile changes (via systemd trigger)

After changing secrets

# 1. Rekey secrets first
just rekey

# 2. Deploy to host
just deploy <hostname>

Full container deployment workflow

Use /deploy-container skill for the complete workflow, which includes:

1. Create encrypted env
2. Add DNS record
3. Configure Caddy routes
4. Deploy with this skill

Pre-Deployment Checklist

• Changes committed (or stashed) - deployment reads from working directory
• No unencrypted secrets in configuration
• Container images pinned (no :latest)
• just check [host] passes

Troubleshooting

Build fails with "attribute not found"

# Check the host configuration exists
ls hosts/<hostname>/configuration.nix
ls hosts/<hostname>/darwin-configuration.nix

Remote deploy times out

# Verify SSH connectivity
ssh <hostname>.meskill.farm "hostname"

# Check if rebuild is stuck
ssh <hostname>.meskill.farm "journalctl -f"

Darwin deploy permission denied

# Darwin rebuilds need sudo
sudo --preserve-env=SSH_AUTH_SOCK darwin-rebuild switch --flake .#<hostname>

Example

# Deploy to current host with verification
/nix-deploy

# Deploy to pilaster with verification
/nix-deploy pilaster

# Deploy to chassis without dry-run
/nix-deploy chassis --no-dry-run

# Deploy to monolith after container changes
/nix-deploy monolith