fix: Move ragenix to externally managed, and ask for env file references

This commit is contained in:
2026-01-30 12:48:48 -05:00
parent f7c1d86244
commit 20a01c89af
4 changed files with 6 additions and 262 deletions

View File

@@ -4,15 +4,9 @@
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
flake-utils.url = "github:numtide/flake-utils";
# For secrets management
ragenix = {
url = "github:yaxitech/ragenix";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, flake-utils, ragenix }:
outputs = { self, nixpkgs, flake-utils }:
flake-utils.lib.eachDefaultSystem (system:
let
pkgs = import nixpkgs {
@@ -63,11 +57,6 @@
# Camera SDK
camera-sdk
# Secrets management
ragenix.packages.${system}.default
age
ssh-to-age
# Utilities
jq
yq
@@ -94,83 +83,18 @@
echo "Available commands:"
echo " - docker-compose: Manage containers"
echo " - supabase: Supabase CLI"
echo " - ragenix: Manage encrypted secrets"
echo " - age: Encrypt/decrypt files"
echo ""
echo "To activate Python venv: source .venv/bin/activate"
echo "To edit secrets: ragenix -e secrets/env.age"
echo ""
echo "NOTE: Secrets should be managed by ragenix in athenix for production deployments"
echo ""
'';
# Additional environment configuration
DOCKER_BUILDKIT = "1";
COMPOSE_DOCKER_CLI_BUILD = "1";
};
# NixOS module for easy integration
nixosModules.default = { config, lib, ... }: {
options.services.usda-vision = {
enable = lib.mkEnableOption "USDA Vision camera management system";
secretsFile = lib.mkOption {
type = lib.types.path;
description = "Path to the ragenix-managed secrets file";
};
dataDir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/usda-vision";
description = "Directory for USDA Vision application data";
};
};
config = lib.mkIf config.services.usda-vision.enable {
environment.systemPackages = [
usda-vision-package
camera-sdk
pkgs.docker-compose
];
environment.variables.LD_LIBRARY_PATH = "${camera-sdk}/lib";
virtualisation.docker = {
enable = true;
autoPrune.enable = true;
};
systemd.services.usda-vision = {
description = "USDA Vision Docker Compose Stack";
after = [ "docker.service" "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
preStart = ''
# Sync application code
${pkgs.rsync}/bin/rsync -av --delete \
--checksum \
--exclude='node_modules' \
--exclude='.env' \
--exclude='__pycache__' \
--exclude='.venv' \
${usda-vision-package}/opt/usda-vision/ ${config.services.usda-vision.dataDir}/
# Copy secrets if managed by ragenix
if [ -f "${config.services.usda-vision.secretsFile}" ]; then
cp "${config.services.usda-vision.secretsFile}" ${config.services.usda-vision.dataDir}/.env
fi
'';
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
WorkingDirectory = config.services.usda-vision.dataDir;
ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build";
ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
TimeoutStartSec = 300;
};
};
};
};
}
);
}