example `system` doesn't work.

[wucke13]

To Reproduce

I ran these commands:

git clone https://github.com/serokell/deploy-rs
cd deploy-rs/examples/system/
nix build .#nixosConfigurations.bare.config.system.build.vm
QEMU_NET_OPTS=hostfwd=tcp::2221-:22 ./result/bin/run-bare-system-vm &
nix run github:serokell/deploy-rs 

Error

And got this error:

🚀 ℹ️ [deploy] [INFO] Running checks for flake in .
warning: unknown flake output 'deploy'
error: attribute 'activate' missing

       at /nix/store/frx9n1lwlhvl6ab3hm6mnq69yid117xz-source/examples/system/flake.nix:38:18:

           37|           sshUser = "hello";
           38|           path = deploy-rs.lib.x86_64-linux.activate.custom self.defaultPackage.x86_64-linux "./bin/activate";
             |                  ^
           39|           user = "hello";
(use '--show-trace' to show detailed location information)
🚀 ❌ [deploy] [ERROR] Failed to check deployment: Nix checking command resulted in a bad exit code: Some(1)

About my system

• system: "x86_64-linux"
• host os: Linux 5.11.11, NixOS, 20.09.4021.2685792d396 (Nightingale)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.4pre20210326_dd77f71
• channels(root): "nixos-20.09.4021.2685792d396, nixos-unstable-21.05pre285574.8e4fe32876c"
• channels(wucke13): ""
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

[wucke13]

Update: Running nix flake update in this folder makes the error go away. Something seems to not have worked so well with pinpointing only half the stack...
However, it still does not work:

🚀 ℹ️ [deploy] [INFO] The following profiles are going to be deployed:
[example.system]
user = "root"
ssh_user = "admin"
path = "/nix/store/01fgc4jsfcxvbhi539n8pi770wrsh313-activatable-nixos-system-example-nixos-system-21.05.20210502.9775b39"
hostname = "localhost"
ssh_opts = ["-p", "2221"]

[example.hello]
user = "hello"
ssh_user = "hello"
path = "/nix/store/r9i39b86fd6pxbyzvjnqmgki7whil313-activatable-activate"
hostname = "localhost"
ssh_opts = ["-p", "2221"]

🚀 ℹ️ [deploy] [INFO] Building profile `system` for node `example`
warning: Git tree '/tmp/deploy-rs' is dirty
(admin@localhost) Password:
[5/2/521 copied (0.2/16.6 MiB)] copying path '/nix/store/0fismrxa4p116k247h5p2938qcnl error: cannot add path '/nix/store/0y0rcz0b7nif503wglwzjyffgsrhigzj-login.defs' because it lacks a valid signature
error (ignored): error: writing to file: Broken pipe
error (ignored): error: interrupted by the user
error (ignored): error: interrupted by the user
error (ignored): error: interrupted by the user
error: unexpected end-of-file
🚀 ❌ [deploy] [ERROR] Failed to push profile: Nix copy command resulted in a bad exit code: Some(1)

[wucke13]

Update 2: When rerunning, I got again different results: now deploying to bare seems to work, but not to the hello user, as I'm asked for a PW:

🚀 ℹ️ [deploy] [INFO] Running checks for flake in .
warning: Git tree '/tmp/deploy-rs' is dirty
warning: unknown flake output 'deploy'
🚀 ℹ️ [deploy] [INFO] Evaluating flake in .
warning: Git tree '/tmp/deploy-rs' is dirty
🚀 ℹ️ [deploy] [INFO] The following profiles are going to be deployed:
[example.hello]
user = "hello"
ssh_user = "hello"
path = "/nix/store/r9i39b86fd6pxbyzvjnqmgki7whil313-activatable-activate"
hostname = "localhost"
ssh_opts = ["-p", "2221"]

[example.system]
user = "root"
ssh_user = "admin"
path = "/nix/store/01fgc4jsfcxvbhi539n8pi770wrsh313-activatable-nixos-system-example-nixos-system-21.05.20210502.9775b39"
hostname = "localhost"
ssh_opts = ["-p", "2221"]

🚀 ℹ️ [deploy] [INFO] Building profile `hello` for node `example`
warning: Git tree '/tmp/deploy-rs' is dirty
The authenticity of host '[localhost]:2221 ([127.0.0.1]:2221)' can't be established.
ED25519 key fingerprint is SHA256:6SlShnrJXzGqAaLvlz1mcv/BGr2YxuLz5j0vkviNxmk.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:2221' (ED25519) to the list of known hosts.
(hello@localhost) Password:
(hello@localhost) Password:

Honestly, this does not feel very stateless to me.

[wucke13]

Update, even when setting specific password for the hello user, it's still not working.

[balsoft]

These examples were copied verbatim from serokell/deploy, and I'm not sure anybody bothered to check if they are correct :/ I'll look into this some time.

[brprice]

FWIW, I have looked into this a bit, and have recorded my findings in the commits on https://github.com/brprice/deploy-rs/tree/brprice/testing-2. This was originally done as personal notes, so I'm not sure how clear they will be to anyone else! (I have put a bunch of notes in commit messages attached to empty commits. It seems github elides these when looking at the history, which makes things rather confusing)

To summarise my understanding:
There are a few separate issues here:

• As @wucke13 said, the flake pins the deploy-rs that we build against but not the deploy-rs binary.
• We cannot deploy both 'system' and 'hello' profiles in the same command, because the 'hello' user does not exist until 'system' is fully deployed, but we use it before then when copying 'hello'
• Non-root deploys run into sshd.conf-validated "lacks valid signature" #25
• We try to deploy into a .#nixosConfigurations.bare.config.system.build.vm, but deploy-rs writes to /boot/loader/loader.conf, which does not exist in a bootloader-less vm. This has an annoying interaction with nixos-rebuild build-vm-with-bootloader does not share the host's nix store properly NixOS/nixpkgs#128216
• Password-based ssh auth is a bit broken Password-based ssh authentication does not work #107

There are workarounds for each of these in my fork.