Nix Deploy

Deploy NixOS or Darwin configuration to a local or remote host.

Parameter Handling

If parameters are missing from $ARGUMENTS, use mcp_question to gather them:

mcp_question({
  questions: [
    {
      question: "Which host do you want to deploy to?",
      header: "Host",
      options: [
        { label: "Current host (default)", description: "Deploy to this machine" },
        { label: "chassis", description: "AI development workstation (NixOS)" },
        { label: "framework", description: "NixOS laptop" },
        { label: "monolith", description: "Infrastructure hub" },
        { label: "pilaster", description: "Container server" },
        { label: "zenith", description: "AI containers" },
        { label: "obelisk", description: "GPU compute" },
        { label: "jbookpro", description: "MacBook Pro (Darwin)" },
        { label: "jmacmini", description: "Mac Mini (Darwin)" }
      ]
    },
    {
      question: "Perform dry-build verification first?",
      header: "Dry Run",
      options: [
        { label: "Yes (Recommended)", description: "Verify build before deploying" },
        { label: "No", description: "Deploy directly" }
      ]
    }
  ]
})

Expected $ARGUMENTS format: [hostname] [--no-dry-run]

• Example: (empty) - deploy to current host with dry-build
• Example: pilaster - deploy to pilaster with dry-build
• Example: monolith --no-dry-run - deploy directly without verification

Steps

1. Dry-build verification (recommended)

Smart check (auto-detects Darwin vs NixOS, local vs remote):

just check [hostname]

If hostname is omitted, uses current host.

2. Deploy

Smart deploy (auto-detects local vs remote, Darwin vs Linux):

just deploy [hostname]

If hostname is omitted, uses current host.

3. Verify deployment

After deployment completes:

# For remote hosts, SSH and check
ssh <hostname>.meskill.farm "systemctl status" | head -20

# For services, verify they're running
ssh <hostname>.meskill.farm "systemctl status docker-caddy"

Host Reference

Container Hosts

Workstations

Common Deployment Scenarios

After changing container configuration

# 1. Verify the build
just check pilaster

# 2. Deploy
just deploy pilaster

# 3. Verify container is running
ssh pilaster.meskill.farm "docker ps | grep <container-name>"

After changing Caddy routes

# 1. Deploy host with Caddy changes
just deploy <hostname>

# 2. Caddy auto-reloads when Caddyfile changes (via systemd trigger)

After changing secrets

# 1. Rekey secrets first
just rekey

# 2. Deploy to host
just deploy <hostname>

Full container deployment workflow

Use /deploy-container skill for the complete workflow, which includes:

1. Create encrypted env
2. Add DNS record
3. Configure Caddy routes
4. Deploy with this skill

Pre-Deployment Checklist

• Changes committed (or stashed) - deployment reads from working directory
• No unencrypted secrets in configuration
• Container images pinned (no :latest)
• just check [host] passes

Troubleshooting

Build fails with "attribute not found"

# Check the host configuration exists
ls hosts/<hostname>/configuration.nix
ls hosts/<hostname>/darwin-configuration.nix

Remote deploy times out

# Verify SSH connectivity
ssh <hostname>.meskill.farm "hostname"

# Check if rebuild is stuck
ssh <hostname>.meskill.farm "journalctl -f"

Darwin deploy permission denied

# Darwin rebuilds need sudo
sudo --preserve-env=SSH_AUTH_SOCK darwin-rebuild switch --flake .#<hostname>

Example

# Deploy to current host with verification
/nix-deploy

# Deploy to pilaster with verification
/nix-deploy pilaster

# Deploy to chassis without dry-run
/nix-deploy chassis --no-dry-run

# Deploy to monolith after container changes
/nix-deploy monolith