0m.ax
42b2ce4d1d
Self-hostable OTA update system for NixOS fleets: a control server, device agent, publisher CLI, and NixOS modules that ship prebuilt system closures from a binary cache to devices that don't have the flake. - crates/common: signed manifest types (ed25519), store-path validator - crates/server: axum + sqlite + HTMX dashboard, channel/device API - crates/agent: poll, verify signature + revision, nix copy, switch, health check, magic-rollback on failure - crates/publisher: keygen + sign + publish CLI for operators/CI - nix/modules: NixOS modules for server and agent - nix/tests/ota.nix: end-to-end VM test exercising publish A -> B -> broken C -> rollback to B (passes) The control server never holds the signing key; manifests are signed offline and verified against a pinned public key on each device.
22 lines
555 B
TOML
22 lines
555 B
TOML
[package]
|
|
name = "nix-ota-publisher"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "nix-ota"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
nix-ota-common = { path = "../common" }
|
|
anyhow.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
clap.workspace = true
|
|
reqwest = { version = "0.12", features = ["json", "rustls-tls", "blocking"], default-features = false }
|
|
ed25519-dalek.workspace = true
|
|
base64.workspace = true
|