samueldr changed the topic of #nixops to: NixOps related talk | logs: https://logs.nix.samueldr.com/nixops/
DigitalKiwi has quit [Quit: quite.]
DigitalKiwi has joined #nixops
DigitalKiwi has quit [Quit: quite.]
DigitalKiwi has joined #nixops
<DigitalKiwi> what's the difference between what goes in the MachineState and MachineDefinitions?
<DigitalKiwi> there aren't as many of the settings in the MachineDefinition as there are in MachineState and i don't know why
lordcirth_ has quit [Remote host closed the connection]
lordcirth_ has joined #nixops
bhipple has quit [Remote host closed the connection]
<clever> DigitalKiwi: i think MachineDefinitions is what was defined in the deployment files, and gets translated from nix->xml->python
<clever> DigitalKiwi: and MachineState is what then manages state, and will deploy based on the latest definition
<DigitalKiwi> ok makes sense. thanks
lordcirth_ has quit [Remote host closed the connection]
lordcirth_ has joined #nixops
lordcirth__ has joined #nixops
lordcirth_ has quit [Read error: Connection reset by peer]
lordcirth__ has quit [Remote host closed the connection]
lordcirth__ has joined #nixops
lordcirth__ has quit [Read error: Connection reset by peer]
lordcirth__ has joined #nixops
lordcirth__ has quit [Read error: Connection reset by peer]
lordcirth__ has joined #nixops
nix-build has joined #nixops
{^_^} has quit [Read error: Connection reset by peer]
Cadey has quit [Ping timeout: 240 seconds]
Cadey has joined #nixops
lordcirth__ has quit [Read error: Connection reset by peer]
gleber_ has joined #nixops
monokrome has quit [*.net *.split]
monokrome has joined #nixops
aanderse has quit [Ping timeout: 246 seconds]
craige has quit [Ping timeout: 264 seconds]
craige has joined #nixops
aanderse has joined #nixops
nuncanada has joined #nixops
<gchristensen> adisbladis: nice work here: https://github.com/NixOS/nixops/pull/1270
<nix-build> nixops#1270 (by adisbladis, 21 hours ago, open): Add support for non-root deployments
<adisbladis> Thanks :)
<adisbladis> I don't really like that !root implies agent forwarding
<adisbladis> For my use case that's required, but you may use some other privelege escalation method that doesn't
<adisbladis> And agent forwarding comes with some risks
<gchristensen> I agree, I am not keen on that
<adisbladis> deployment.forwardAgent ?
<gchristensen> that should probably be its own tunable, or even fall back to ssh_config
<adisbladis> That could also help with https://github.com/NixOS/nixops/issues/1150
<gchristensen> I'm going to make some lunch, back shortly
<nix-build> nixops#1150 (by Nekroze, 45 weeks ago, open): Bastion/Jump host support
<gchristensen> what does morph do here?
<adisbladis> Good question :)
<adisbladis> They ask for sudo password
<adisbladis> Which we can't, we don't even allocate a tty
<gchristensen> wow what
<adisbladis> I'm leaning towards just making forwarding a separate configurable
<adisbladis> And as a separate follow-up we could relatively easily solve https://github.com/NixOS/nixops/issues/1150 too I think
<nix-build> nixops#1150 (by Nekroze, 45 weeks ago, open): Bastion/Jump host support
<gchristensen> it is quite hard actually
<gchristensen> because we use TCP ports as a hint for "is it up?"
<adisbladis> Ah, I didn't think of that
<adisbladis> Regardless forwardAgent is an easy addition that doesn't break that model
<gchristensen> maybe we shouldn't, though, maybe we should just connect
<gchristensen> i also wonder about terraform's model for configuring how to connect to a device
<adisbladis> gchristensen: deployment.forwardAgent sounds good to you ?
<gchristensen> I wonder a bit if creating a bunch of optinos like this means we're not understanding the problem right, but other than that it sounds okay -- I want to take a look at terraform's config though
<aminechikhaoui> adisbladis we have the same need for agent forwarding @work :/
<aminechikhaoui> btw rootless nixops won't work out of the box right ? you need to be a trusted-user in nix.conf I would guess
<adisbladis> aminechikhaoui: Yes, you need to be trusted.
<gchristensen> on that note I find it very uncomfortable that the bastion uses agent forwarding for Git operations
pbb has quit [Remote host closed the connection]
pbb has joined #nixops
pbb has quit [Excess Flood]
pbb has joined #nixops
<adisbladis> gchristensen: Ok
<adisbladis> Hm
<adisbladis> Anyway, I made agent forwarding configurable
<aminechikhaoui> what does terraform use connection for ? I thought it only does provisioning
<adisbladis> aminechikhaoui: They have a concept of "provisioners" which SSHs in to set things up
<adisbladis> You're supposed to hand off to some config management tool after the provisioning
<aminechikhaoui> yeah I always though terraform doesn't handle that at all
<aminechikhaoui> cool
<aminechikhaoui> thought*
<gchristensen> very poorly
<aminechikhaoui> so... there can be a nix provisioner :D
<aminechikhaoui> is this new i.e newer than your nixos-terraform experiments gchristensen ?
<gchristensen> we really don't want ot use terraform for its provisiner
<gchristensen> more thinking we can model our configuration after its own
<aminechikhaoui> seems https://www.terraform.io/docs/provisioners/local-exec.html can run a nix-copy-closure, nixops is always nicer of course but just thinking of this for e.g Azure
<aminechikhaoui> yeah totally unrelated questions to nixops
<adisbladis> All checks green on https://github.com/NixOS/nixops/pull/1270
<nix-build> nixops#1270 (by adisbladis, 23 hours ago, open): Add support for non-root deployments
<gchristensen> nice
<gchristensen> will look :P
<gchristensen> sorry, a couple things took precedent
<adisbladis> I'm not in a hurry or anything :)
<gchristensen> I mean, maybe we sohuld just stop checking if the port is open
<adisbladis> gchristensen: I'd be happy to do that in another PR
<adisbladis> I think we need to add some retry logic around SSH to make that work
<gchristensen> yeah
<gchristensen> and we should talk to aszlig about that too
<adisbladis> Considering that there is always a "master" socket created I think it can be quite elegant =)
<gchristensen> oh?
<adisbladis> gchristensen: We only have to retry when creating the master socket and assume we have a working socket when executing commands
aszlig has joined #nixops
syd has joined #nixops
syd has quit [Remote host closed the connection]