nix/justfile at main · fred-drake/nix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# List all commands
default:
    @just --list

_rebuild-pre:
    git add *.nix

# Switch the system in its current form (auto-updates secrets)
switch: _rebuild-pre update-secrets
    sudo system-flake-rebuild switch

# Build the system in its current form (auto-updates secrets)
build: _rebuild-pre update-secrets
    sudo system-flake-rebuild build

# Update everything
update-all: update update-npm-packages update-herdr update-container-digests update-secrets update-claude update-pi update-pi-packages update-graphify update-pyicloud

# Pull the latest hashes and shas from the repos in apps/fetcher/repos.toml
update-repos:
    update-fetcher-repos

# Update herdr source and hashes
update-herdr: update-repos
    ./apps/fetcher/update-herdr.sh

# Update the SHA digests of container images
update-container-digests:
    update-container-digests

# Update NPM packages
update-npm-packages:
    update-npm-packages
    ./apps/fetcher/update-codex-acp.sh

# Update Claude Code binary and plugin repos
update-claude:
    update-claude-plugins
    ./apps/fetcher/update-claude-code.sh

# Update the pinned pi-coding-agent release (source + npm deps hashes)
update-pi:
    ./apps/fetcher/update-pi.sh

# Update the pinned pi packages/extensions managed via nix
update-pi-packages:
    ./apps/fetcher/update-pi-web-access.sh
    ./apps/fetcher/update-pi-mcp-adapter.sh

# Upgrade Graphify (graphifyy) to its latest release by re-resolving its uv.lock
update-graphify:
    cd apps/graphify && uv lock --upgrade

# Upgrade PyiCloud CLI to the latest upstream git revision by re-resolving its uv.lock
update-pyicloud:
    cd apps/pyicloud && uv lock --upgrade

# Format all .nix files with alejandra
format:
    alejandra .

# Linting for the project
lint:
    statix check

# Update input definitions from remote resources
update:
    nix flake update

# Update the secrets flake
update-secrets:
    nix flake update secrets

# Import iOS code signing identity (.p12) into the login keychain. One-time per Darwin host.
bootstrap-signing:
    #!/usr/bin/env bash
    set -euo pipefail
    if [[ "$(uname)" != "Darwin" ]]; then
        echo "bootstrap-signing only runs on macOS" >&2
        exit 1
    fi
    p12="$HOME/.config/sops-nix/secrets/apple-distribution-p12"
    pass="$HOME/.config/sops-nix/secrets/apple-distribution-p12-passphrase"
    if [[ ! -f "$p12" || ! -f "$pass" ]]; then
        echo "Decrypted secrets not found. Run 'just switch' first so sops-nix deploys them." >&2
        echo "Expected: $p12" >&2
        echo "Expected: $pass" >&2
        exit 1
    fi
    if security find-identity -v -p codesigning | grep -q "Apple Distribution"; then
        echo "Apple Distribution identity already present in login keychain — nothing to do."
        exit 0
    fi
    security import "$p12" \
        -k "$HOME/Library/Keychains/login.keychain-db" \
        -P "$(cat "$pass")" \
        -T /usr/bin/codesign \
        -T /usr/bin/security
    echo "Imported. Verify with: security find-identity -v -p codesigning"

# Run colmena remote switch on given host
colmena HOST:
    colmena apply --on {{ HOST }} --impure

# Check nixpkgs age on a colmena host
colmena-age HOST:
    @colmena exec --on {{ HOST }} --impure -- 'jq -r ".nixpkgs | \"nixpkgs: \(.shortRev) (\(((now - .lastModified) / 86400) | floor) days old)\"" /etc/nixos/version.json 2>/dev/null || echo "unknown"' 2>&1 | grep -E "^\s*{{ HOST }} \|" | grep -v "Succeeded" | sed "s/^[[:space:]]*{{ HOST }} | //"