TELEICU/Path B: NixOS: Difference between revisions

Newer edit →

Content deleted Content added

VisualWikitext

Inline

@@ Line 12: / Line 12: @@
 Every hospital PC runs NixOS with identical, pinned system configuration. A flake repository defines the full OS state — packages, services, users, firewall, K3s agent — and nodes converge to the declared state via <code>comin</code> (pull-based, primary) or <code>deploy-rs</code> (push-based, backup).
+<pre>
-syntaxhighlight lang="text"
+{{#mermaid:flowchart TB
-┌──────────────────────┐
+    subgraph Repo["Flake Repository"]
-│   Flake repository    │
+        FLAKE["flake.nix<br/>all node configs"]
-│   (Nix flake,         │
+    end
-│    all node configs)  │
-└──────────┬───────────┘
+    subgraph Primary["Primary Path"]
-           │
-           ├── comin (pull) ──── primary path
+        COMIN["comin (pull)<br/>each node polls<br/>for new generation"]
+    end
-           │     └─ each node polls for new generation
-           │
+    subgraph Backup["Backup Path"]
-           └── deploy-rs (push) ── backup path
-                 └─ triggered from CI for urgent deploys
+        DEPLOY["deploy-rs (push)<br/>triggered from CI<br/>for urgent deploys"]
+    end
-syntaxhighlight
+    FLAKE --> COMIN
+    FLAKE --> DEPLOY
+    COMIN --> N1["Spoke Node<br/>NixOS + K3s agent"]
+    COMIN --> N2["Hub Node<br/>NixOS + K3s agent"]
+    COMIN --> NM["... (200 more)"]
+    DEPLOY --> N1
+    DEPLOY --> N2
+}}
+</pre>
 == Provisioning (zero-touch) ==
@@ Line 85: / Line 97: @@
 == Repository structure ==
+<pre>
-syntaxhighlight lang="text"
+{{#mermaid:flowchart LR
-teleicu-nixos/
+    subgraph Flake["teleicu-nixos/"]
-├── flake.nix                # inputs + outputs
-├── flake.lock
+        FLAKE_NIX["flake.nix<br/>flake.lock"]
+        HOSTS["hosts/<br/>cp-1/<br/>cp-2/<br/>cp-3/<br/>spoke-template/<br/>hub-template/"]
-├── hosts/
+        MODULES["modules/<br/>tailscale.nix<br/>k3s-agent.nix<br/>cloudflared.nix<br/>zfs.nix<br/>openebs.nix<br/>monitoring.nix<br/>downtime-classifier.nix"]
-│   ├── cp-1/                # control plane VM 1
+        PROFILES["profiles/<br/>base.nix<br/>spoke.nix<br/>hub.nix"]
-│   │   ├── configuration.nix
+        SECRETS["secrets/"]
-│   │   └── hardware-configuration.nix
+        ISO["iso/<br/>bootstrap.nix"]
-│   ├── cp-2/
+        COMIN_CFG["comin/<br/>configuration.nix"]
-│   ├── cp-3/
+    end
-│   ├── spoke-template/      # template for spoke nodes
+}}
-│   │   ├── configuration.nix
+</pre>
-│   │   └── hardware-configuration.nix
-│   └── hub-template/        # template for hub nodes
-├── modules/
-│   ├── tailscale.nix
-│   ├── k3s-agent.nix
-│   ├── cloudflared.nix
-│   ├── zfs.nix
-│   ├── openebs.nix
-│   ├── monitoring.nix
-│   └── downtime-classifier.nix
-├── profiles/
-│   ├── base.nix             # shared across all nodes
-│   ├── spoke.nix            # spoke-specific additions
-│   └── hub.nix              # hub-specific additions
-├── secrets/                  # encrypted via sops-nix
-│   └── …
-├── iso/
-│   └── bootstrap.nix        # nixos-generator config for install ISO
-└── comin/
-    └── configuration.nix     # comin poll config
-syntaxhighlight
 == Flake structure ==