chore(comin): remove comin

deploy/colmena.nix

@@ -6,13 +6,20 @@
 let
   inherit (inputs.nixpkgs) lib;
   utils = import ../utils { inherit lib; };
-  hostnames = utils.dirNames ../hosts;
+  # exclude hosts that need auto rollback (until `colmena` supports it) for
+  # now, we use `deploy-rs` (which has magic rollback) for those (also see ./deploy-rs.nix)
+  #
+  # see <https://github.com/nix-community/colmena/issues/38>
+  #     <https://github.com/nix-community/colmena/issues/344>
+  hostnames = lib.filter (
+    hostname: !((utils.hostMeta ../hosts/${hostname}).deploy.autoRollback or false)
+  ) (utils.dirNames ../hosts);
 
   mkNode =
     hostname:
     let
       meta = utils.hostMeta ../hosts/${hostname};
-      isLocal = builtins.elem "local" meta.tags;
+      isArm = meta.system == "aarch64-linux";
     in
     {
       imports = [ ../hosts/${hostname} ];
@@ -20,8 +27,9 @@ let
       deployment = {
         inherit (meta) tags;
         targetUser = meta.host.username;
-        targetHost = if isLocal then "" else hostname;
+        targetHost = hostname;
-        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
+        allowLocalDeployment = meta.host.admin or false;
+        buildOnTarget = !isArm;
       };
     };
 

deploy/deploy-rs.nix

@@ -0,0 +1,34 @@
+{
+  self,
+  inputs,
+}:
+
+let
+  inherit (inputs.nixpkgs) lib;
+  utils = import ../utils { inherit lib; };
+
+  # only include hosts that need auto rollback (until `colmena` supports it)
+  # `colmena` is used for other hosts (see ./colmena.nix)
+  hostnames = lib.filter (
+    hostname: (utils.hostMeta ../hosts/${hostname}).deploy.autoRollback or false
+  ) (utils.dirNames ../hosts);
+
+  mkNode =
+    hostname:
+    let
+      meta = utils.hostMeta ../hosts/${hostname};
+    in
+    {
+      inherit hostname;
+      sshUser = meta.host.username;
+      magicRollback = true;
+      autoRollback = true;
+      profiles.system = {
+        user = "root";
+        path = inputs.deploy-rs.lib.${meta.system}.activate.nixos self.nixosConfigurations.${hostname};
+      };
+    };
+in
+{
+  nodes = lib.genAttrs hostnames mkNode;
+}

flake.lock

@@ -79,11 +79,11 @@
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1762034856,
+        "lastModified": 1782904768,
-        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
+        "narHash": "sha256-tu/otndlmVoSxoQVkNL5cvMFAMyekO2mCVYTl0DRlfs=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
+        "rev": "1ebe1b5526099a3b108a599c59ce0e6422a1a663",
         "type": "github"
       },
       "original": {
@@ -92,25 +92,25 @@
         "type": "github"
       }
     },
-    "comin": {
+    "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat_2",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "treefmt-nix": "treefmt-nix"
+        "utils": "utils"
       },
       "locked": {
-        "lastModified": 1780200954,
+        "lastModified": 1781627888,
-        "narHash": "sha256-3476T026t+XSpOvgBGzKSG6J4swuRLnPO9dR+OATtq8=",
+        "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
-        "owner": "nlewo",
+        "owner": "serokell",
-        "repo": "comin",
+        "repo": "deploy-rs",
-        "rev": "4f14d338d755239c27131cbf6b466be4bbb20f91",
+        "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
         "type": "github"
       },
       "original": {
-        "owner": "nlewo",
+        "owner": "serokell",
-        "repo": "comin",
+        "repo": "deploy-rs",
         "type": "github"
       }
     },
@@ -176,11 +176,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1650374568,
+        "lastModified": 1767039857,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
@@ -192,15 +192,15 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1765121682,
+        "lastModified": 1733328505,
-        "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=",
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "NixOS",
+        "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "edolstra",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -265,12 +265,15 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1659877975,
+        "lastModified": 1731533236,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -281,7 +284,7 @@
     },
     "flake-utils_2": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -316,17 +319,16 @@
     "git-hooks": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
+        "lastModified": 1782908218,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "narHash": "sha256-wLMOrPgVyeF3XmP+qfYcLqnVdTxikdcSvbIY7rA9jTA=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "9f7e99119ece7705299595299f3b031f39356de1",
         "type": "github"
       },
       "original": {
@@ -335,27 +337,6 @@
         "type": "github"
       }
     },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
     "gnome-shell": {
       "flake": false,
       "locked": {
@@ -396,7 +377,7 @@
     "mcp-hub": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
         "lastModified": 1755841689,
@@ -420,11 +401,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729742964,
+        "lastModified": 1737420293,
-        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
         "owner": "nix-community",
         "repo": "nix-github-actions",
-        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
         "type": "github"
       },
       "original": {
@@ -489,7 +470,7 @@
     },
     "nixos-hardware": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1780065812,
@@ -507,22 +488,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1770107345,
-        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1767892417,
         "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
@@ -535,13 +500,13 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_2": {
       "locked": {
-        "lastModified": 1779560665,
+        "lastModified": 1782723713,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
         "type": "github"
       },
       "original": {
@@ -551,13 +516,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1743689281,
+        "lastModified": 1779560665,
-        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
         "type": "github"
       },
       "original": {
@@ -715,7 +680,7 @@
     "root": {
       "inputs": {
         "colmena": "colmena",
-        "comin": "comin",
+        "deploy-rs": "deploy-rs",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
@@ -723,7 +688,7 @@
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "nvim": "nvim",
         "sops-nix": "sops-nix",
         "stylix": "stylix"
@@ -751,16 +716,16 @@
     },
     "stable": {
       "locked": {
-        "lastModified": 1750133334,
+        "lastModified": 1782851755,
-        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "narHash": "sha256-91ODtG9bUk4AMsgPfGlHzHxh+3r64DClTRxaiTHevIQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "rev": "f3fb8f32d52b627190abb82438bdcc75a9c77b4e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "release-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -778,7 +743,7 @@
           "nixpkgs"
         ],
         "nur": "nur",
-        "systems": "systems_2",
+        "systems": "systems_4",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
@@ -828,6 +793,36 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -892,21 +887,21 @@
         "type": "github"
       }
     },
-    "treefmt-nix": {
+    "utils": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1770228511,
+        "lastModified": 1731533236,
-        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
-        "repo": "treefmt-nix",
+        "repo": "flake-utils",
-        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
         "owner": "numtide",
-        "repo": "treefmt-nix",
+        "repo": "flake-utils",
         "type": "github"
       }
     }

flake.nix

@@ -22,8 +22,8 @@
       url = "github:zhaofengli/colmena";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    comin = {
+    deploy-rs = {
-      url = "github:nlewo/comin";
+      url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     git-hooks = {
@@ -164,7 +164,14 @@
           ;
       };
 
-      checks.${system} = gitHooks.checks;
+      deploy = import ./deploy/deploy-rs.nix {
+        inherit
+          self
+          inputs
+          ;
+      };
+
+      checks.${system} = gitHooks.checks // inputs.deploy-rs.lib.${system}.deployChecks self.deploy;
       formatter.${system} = gitHooks.formatter;
       devShells.${system} = gitHooks.devShells;
 

home/hosts/andromache/default.nix

@@ -45,6 +45,7 @@
   taskwarrior.enable = true;
   audio.enable = true;
   ssh.enable = true;
+  deploy.enable = true;
   music.enable = true;
   terminal.enable = true;
   devenv.enable = true;

home/hosts/astyanax/default.nix

@@ -50,6 +50,7 @@
     bash.addBinToPath = true;
   };
   ssh.enable = true;
+  deploy.enable = true;
   taskwarrior.enable = true;
   terminal.enable = true;
   reference-manager.enable = true;

home/modules/deploy/colmena-wrapper.bash

@@ -0,0 +1,68 @@
+# `colmena` wrapper script that opens a short-lived SSH master process for
+# `colmena` to use so it works with hardware-backed key touch+PIN. assumes
+# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+
+selector=""
+want_on=0
+on_given=0
+deploy_cmd=0
+nodes=()
+on_nodes=()
+master_processes=()
+
+# build node list from `--on` value, a comma-separated string (e.g. "host-01,host-02")
+for arg in "$@"; do
+  if ((want_on)); then
+    selector="$arg"
+    want_on=0
+    continue
+  fi
+  case "$arg" in
+    --on=*)
+      selector="${arg#--on=}"
+      on_given=1
+      ;;
+    --on) want_on=1 on_given=1 ;;
+    apply | exec | upload-keys) deploy_cmd=1 ;;
+  esac
+done
+
+# shellcheck disable=SC2154
+if ((deploy_cmd)) && ! ((on_given)); then
+  on_nodes=("${!_colmena_node_tags[@]}")
+else
+  IFS=',' read -ra nodes <<< "$selector"
+  for node in "${nodes[@]}"; do
+    for node_tag in "${!_colmena_node_tags[@]}"; do
+      if [[ "$node" == @* ]]; then
+        for tag in ${_colmena_node_tags[$node_tag]}; do
+          # shellcheck disable=SC2053
+          [[ "$tag" == ${node#@} ]] && on_nodes+=("$node_tag")
+        done
+      else
+        # shellcheck disable=SC2053
+        [[ "$node_tag" == $node ]] && on_nodes+=("$node_tag")
+      fi
+    done
+  done
+fi
+
+for node in "${on_nodes[@]}"; do
+  # check if master process is running (see `man ssh`)
+  ssh -O check "$node" 2>/dev/null && continue
+
+  # place ssh client into "master" mode for connection sharing (see `man ssh`)
+  if ssh -fNM "$node"; then
+    master_processes+=("$node")
+  fi
+done
+
+rc=0
+@colmena@ "$@" || rc=$?
+
+# request master processes to exit (see `man ssh`)
+for process in "${master_processes[@]}"; do
+  ssh -O exit "$process" 2>/dev/null || true
+done
+
+exit "$rc"

home/modules/deploy/default.nix

@@ -0,0 +1,76 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  myUtils,
+  ...
+}:
+
+let
+  cfg = config.deploy;
+
+  hostDir = ../../../hosts;
+  hostNames = myUtils.dirNames hostDir;
+  hostsWithKeys = lib.filter (
+    hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")
+  ) hostNames;
+
+  colmena = inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena;
+  deployRs = inputs.deploy-rs.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+  hostTags = hostname: (myUtils.hostMeta (hostDir + "/${hostname}")).tags;
+  nodeTagsDecl = ''
+    declare -A _colmena_node_tags=(
+    ${lib.concatMapStringsSep "\n" (
+      hostname: "  [${hostname}]=${lib.escapeShellArg (lib.concatStringsSep " " (hostTags hostname))}"
+    ) hostsWithKeys}
+    )
+  '';
+
+  colmenaWrapped = pkgs.writeShellApplication {
+    name = "colmena";
+    runtimeInputs = [ pkgs.openssh ];
+    text =
+      nodeTagsDecl
+      + lib.replaceStrings [ "@colmena@" ] [ "${colmena}/bin/colmena" ] (
+        builtins.readFile ./colmena-wrapper.bash
+      );
+  };
+
+  deployRsWrapped = pkgs.writeShellApplication {
+    name = "deploy";
+    runtimeInputs = [ pkgs.openssh ];
+    text = lib.replaceStrings [ "@deploy@" ] [ "${deployRs}/bin/deploy" ] (
+      builtins.readFile ./deploy-rs-wrapper.bash
+    );
+  };
+in
+{
+  options.deploy.enable = lib.mkEnableOption "deploy";
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.ssh.enable;
+        message = "'home/modules/deploy' requires 'home/modules/ssh'";
+      }
+    ];
+
+    home.packages = [
+      colmenaWrapped
+      deployRsWrapped
+    ];
+    programs.ssh.settings = lib.genAttrs hostsWithKeys (
+      hostname:
+      let
+        meta = myUtils.hostMeta (hostDir + "/${hostname}");
+      in
+      {
+        User = meta.host.username;
+        HostName = hostname;
+        ControlPath = "~/.ssh/socket-%r@%h:%p";
+      }
+    );
+  };
+}

home/modules/deploy/deploy-rs-wrapper.bash

@@ -0,0 +1,34 @@
+# `deploy` wrapper script that opens a short-lived SSH master process for
+# `deploy-rs` to use so it works with hardware-backed key touch+PIN. assumes
+# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+
+# extract the target host from the `deploy-rs` flake target (e.g. `.#hecuba`)
+node=""
+for arg in "$@"; do
+  case "$arg" in
+    -*) ;;
+    *'#'*)
+      node="${arg#*#}"   # strip flake ref up to '#'
+      node="${node%%@*}" # strip '@user'
+      node="${node%%.*}" # strip '.profile'
+      ;;
+  esac
+done
+
+master=0
+if [[ -n "$node" ]] && ! ssh -O check "$node" 2>/dev/null; then
+  # place ssh client into "master" mode for connection sharing (see `man ssh`)
+  if ssh -fNM "$node"; then
+    master=1
+  fi
+fi
+
+rc=0
+@deploy@ "$@" || rc=$?
+
+# request the master process to exit (see `man ssh`)
+if ((master)); then
+  ssh -O exit "$node" 2>/dev/null || true
+fi
+
+exit "$rc"

home/modules/ssh/default.nix

@@ -2,17 +2,11 @@
   config,
   lib,
   pkgs,
-  myUtils,
   ...
 }:
 
 let
   cfg = config.ssh;
-  hostDir = ../../hosts;
-  hostNames = myUtils.dirNames hostDir;
-  hostsWithKeys = lib.filter (
-    hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")
-  ) hostNames;
 in
 {
   options.ssh.enable = lib.mkEnableOption "ssh";
@@ -24,21 +18,7 @@ in
       enable = true;
       enableDefaultConfig = false;
 
-      settings =
+      settings = {
-        lib.genAttrs hostsWithKeys (
-          hostname:
-          let
-            meta = myUtils.hostMeta (hostDir + "/${hostname}");
-            isLocal = builtins.elem "local" meta.tags;
-          in
-          {
-            User = meta.host.username;
-          }
-          // lib.optionalAttrs (!isLocal) {
-            HostName = hostname;
-          }
-        )
-        // {
         "*" = {
           AddKeysToAgent = "yes";
           ForwardAgent = false;

hosts/andromache/default.nix

@@ -99,10 +99,6 @@ in
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-  environment.systemPackages = [
-    inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
-  ];
-
   services.locate = {
     enable = true;
     package = pkgs.plocate;

hosts/andromache/meta.nix

@@ -1,7 +1,7 @@
 {
   system = "x86_64-linux";
   role = "desktop";
-  tags = [ "local" ];
+  tags = [ "personal" ];
   host = {
     username = "h";
     highRam = true;

hosts/astyanax/default.nix

@@ -82,7 +82,6 @@ in
   };
 
   environment.systemPackages = [
-    inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
     (pkgs.writeShellApplication {
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];

hosts/astyanax/meta.nix

@@ -1,7 +1,7 @@
 {
   system = "x86_64-linux";
   role = "laptop";
-  tags = [ "local" ];
+  tags = [ "personal" ];
   host = {
     username = "h";
     highRam = true;

hosts/eetion-02/meta.nix

@@ -1,7 +1,7 @@
 {
   system = "aarch64-linux";
   role = "embedded";
-  tags = [ "arm" ];
+  tags = [ "lab" ];
   host = {
     username = "h";
   };

hosts/eetion/meta.nix

@@ -1,7 +1,7 @@
 {
   system = "aarch64-linux";
   role = "embedded";
-  tags = [ "arm" ];
+  tags = [ "lab" ];
   host = {
     username = "h";
   };

hosts/hecuba/default.nix

@@ -14,7 +14,6 @@ in
   imports = [
     inputs.disko.nixosModules.disko
     "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
-    inputs.comin.nixosModules.comin
     ../../modules
   ];
 
@@ -70,17 +69,6 @@ in
   ];
 
   services = {
-    comin = {
-      enable = false;
-      machineId = "4c0a7f7726a845859ce9375e88b87642";
-      remotes = [
-        {
-          name = "origin";
-          url = "https://git.hektormisplon.xyz/hektor/nix";
-          branches.main.name = "main";
-        }
-      ];
-    };
     fail2ban = {
       enable = true;
       maxretry = 5;

hosts/hecuba/meta.nix

@@ -1,7 +1,8 @@
 {
   system = "x86_64-linux";
   role = "server";
-  tags = [ "cloud" ];
+  tags = [ "lab" ];
+  deploy.autoRollback = true;
   host = {
     username = "username";
   };

hosts/vm/meta.nix

@@ -1,7 +1,7 @@
 {
   system = "x86_64-linux";
   role = "vm";
-  tags = [ "local" ];
+  tags = [ "lab" ];
   host = {
     username = "h";
   };