---
# System prepended metadata

title: Tweag / Bevuta

---

# Tweag / Bevuta

Taeer: Vacation 21.3 - 25.4

## Secrets

- [x] age selected
- [x] service restart when secrets change (@Taeer)
    look into path units in systemd
- [x] collect public keys from machines (@Wanja)
    one pub key per machine
    include public keys from developers
    in secrets.nix will be specified what a pub key has access to
- [x] Associate pub keys with hosts (@Wanja)
- [ ] Moving all the secrets from GitLab/morph to agenix (@Wanja) https://projects.bevuta.com/issues/18836
    This includes cleaning up of all the gitlab jobs.
- [ ] Upstream agenix features -> restart services when secrets change (@Taeer) https://projects.bevuta.com/issues/18837
    - [ ] [actions on secret change](https://github.com/ryantm/agenix/pull/87)
    - [ ] [templates](https://github.com/ryantm/agenix/pull/96)
        - age-template wrapper around age (same cli options as age)
        - use ageBin options in agenix to set age-template to decrypt files
        - TODO: how do you edit the template with all the secrets


## Nixification (server and psap-app) https://projects.bevuta.com/issues/17224

- [x] try out npmlock2nix for psap-app (@Taeer)
    - [x] New issue, how to handle fetching private npm dependency
        @Sebastian will take over the issue to psap-app team
    - [x] use gitignore.nix to filter not needed stuff from `src` (@Taeer)
    - [x] revert the shell back to `mkShell` (@Taeer)
    - [x] set the build variables, talk to the devs and see how we should use
          them in ops (@Wanja ops part, @Sebastian devs part)
    - [ ] we have both ways how to build psap-app, once psap-app reaches all
          the environments is going to be time to switch to use pure nix
          build approach
- [x] admin-app (@sebastian, @Silvan)
    - changes also broke psap-app
    - [ ] upstreaming changes https://projects.bevuta.com/issues/18840
        - https://github.com/nix-community/npmlock2nix/pull/151
        - https://github.com/nix-community/npmlock2nix/pull/152
    - PR that cleans up the Nix fixes:
        - https://dev.bevuta.com/salus/psap-app/-/merge_requests/533
- [ ] salus-server (@Wanja) https://projects.bevuta.com/issues/18868
- [ ] admin-server (@Taeer) https://projects.bevuta.com/issues/18288
- [x] salus-loadcli
    - [x] package clojure project with clj2nix (@Taeer)
    - [x] provision the base NixOS AMI image with stuff (@Wanja with Leon)
    - [x] use terraform to provision AWS account (@Wanja with Christian)
    - [x] CI job to run the terraform (actually turned out to be packer instead)
- [x] salus cli client
    - building is using shadow-cljs to turn cljs into js
    - [x] no way to pass it a class path (which we need for clj2nix)
        - could smuggle it in a patched clojure
    - uses :extra-paths and :paths in deps.edn, which runs into [clj2nix #13](https://github.com/hlolli/clj2nix/issues/13)
    - alternate solutions:
        - convert to pom.xml first, then use nix maven infrastructure
        - clojure -P
    - [x] Next meeting, invite a clojure dev (@Wanja)
        - so we can discuss clj2nix and ask questions back and forth

## clj2nix https://projects.bevuta.com/issues/18869

Taeer's fork: https://github.com/Radvendii/clj2nix

- [ ] link farm derivation that acts as maven repo (@Wanja, @Taeer)
- [ ] make clj2nix assume all aliases are set to produce a single "full" deps.nix (@Wanja, @Adam)
- [x] example clojure project to test packaging stuff on (@Adam?)
- [ ] Taeer made https://ask.clojure.org/index.php/11644/re-building-without-internet-access-with-nix - investigate whether clojure 1087 actually fixes it!

## Production gitlab runner (Sebastian)

Done, but not yet tested.

- [x] Postponed until GitLab is redeployed (@Wanja)

## Zammad
- [x] upstream
- [ ] use the upstream version (@Taeer)
  - we're not on a recent enough version of nixpkgs

## Diffing options before deploying (@Rok, @infisil) https://projects.bevuta.com/issues/18844

- [ ] try to go configuration.nix -> configuration.json
- https://code.tvl.fyi/tree/ops/deploy-whitby/deploy-whitby.sh#n34 <- worth a look?
    - diffs derivation (versions), not options

## Release graph unification (Deploy salus services on each commit like) https://projects.bevuta.com/issues/18873
Waiting on nixification to be done
- could upstream the production of the artifact

## Flakify

- [x] flake just for inputs

Waiting for nixification

## Switch away from Morph

Features:
- flakes & non-flakes
- different nixpkgs version in different deployments
- access to other hosts at evaluation time (node mutual recursion)
- Magic rollbacks (deadman switch)
- push approach
- pull approach is bonus

- [ ] experiment with deploy-rs/colmena/nixos-rebuild/... (with salus-loadcli?) (@Taeer) https://projects.bevuta.com/issues/18871

## Bumping NixOS version

- [x] auxilary services
- [ ] Salus apps are not bumped
- [ ] monitoring if there is something to be updated
- [ ] update script for other things that nixos


## NixOS test for configurations

IN-PROGRESS: start with Mailserver (@Sebastian with @Taeer) 
- postponed, test are running. looking for a way to switch to new mailserver.