“Towards Guix for DevOps”

“Towards Guix for DevOps”

[Ludovic Courtès]

Hello Guix!

Jakob wrote a lovely post about the ongoing work implementing ‘guix
deploy’ as part of GSoC:

  https://gnu.org/s/guix/blog/2019/towards-guix-for-devops/

Check it out!

Ludo’.

Re: “Towards Guix for DevOps”

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 108 bytes --]

This is fantastic, thanks for the outstanding work, Jakob!

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: “Towards Guix for DevOps”

[Jakob L. Kreuze]

[-- Attachment #1: Type: text/plain, Size: 383 bytes --]

Pierre Neidhardt <mail@ambrevar.xyz> writes:

> This is fantastic, thanks for the outstanding work, Jakob!

Thank you for the kind words :)  I'm happy to be hearing them
from you -- the articles on your website are what inspired me to try
Guix, and I especially enjoy feedback on things I've written when it
comes from those whose writing I myself admire.

Regards,
Jakob

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: “Towards Guix for DevOps”

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 444 bytes --]

zerodaysfordays@sdf.lonestar.org (Jakob L. Kreuze) writes:

> Thank you for the kind words :)  I'm happy to be hearing them
> from you -- the articles on your website are what inspired me to try
> Guix, and I especially enjoy feedback on things I've written when it
> comes from those whose writing I myself admire.

Ha! :)
Thanks back, then!

Oh, sweet beauty of free knowledge... :D

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: “Towards Guix for DevOps”

[zimoun]

Dear,

The link to the manual seems broken.
http://guix.gnu.org/manual/en/html_node/Invoking-guix-deploy.html#Invoking-guix-deploy
Because the manual online is the one of the version 1.0.1 and not the
one of master, right?

Thank you for this interesting work.


All the best,
simon

Re: “Towards Guix for DevOps”

[Jakob L. Kreuze]

[-- Attachment #1: Type: text/plain, Size: 480 bytes --]

Hi Zimoun,

zimoun <zimon.toutoune@gmail.com> writes:

> Dear,
>
> The link to the manual seems broken.
> http://guix.gnu.org/manual/en/html_node/Invoking-guix-deploy.html#Invoking-guix-deploy
> Because the manual online is the one of the version 1.0.1 and not the
> one of master, right?

Yes, that's right. What's unusual is that the link worked when I sent
this off for feedback.

Anyway, should we remove the link? Perhaps the mention of the manual is
enough.

Regards,
Jakob

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: “Towards Guix for DevOps”

[Ricardo Wurmus]

Jakob L. Kreuze <zerodaysfordays@sdf.lonestar.org> writes:

> Yes, that's right. What's unusual is that the link worked when I sent
> this off for feedback.

That’s not your fault.  We changed the website so that it again displays
the documentation matching the most recent release (as it was when
gnu.org/s/guix was the home page).

When you asked for feedback guix.gnu.org still served an arbitrary later
version of the manual.

--
Ricardo

Re: “Towards Guix for DevOps”

[Jakob L. Kreuze]

[-- Attachment #1: Type: text/plain, Size: 404 bytes --]

Ricardo Wurmus <rekado@elephly.net> writes:

> That’s not your fault. We changed the website so that it again
> displays the documentation matching the most recent release (as it was
> when gnu.org/s/guix was the home page).
>
> When you asked for feedback guix.gnu.org still served an arbitrary
> later version of the manual.
>
> --
> Ricardo

Glad to hear that I'm not losing my mind :)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: “Towards Guix for DevOps”

[Ludovic Courtès]

zimoun <zimon.toutoune@gmail.com> skribis:

> The link to the manual seems broken.
> http://guix.gnu.org/manual/en/html_node/Invoking-guix-deploy.html#Invoking-guix-deploy
> Because the manual online is the one of the version 1.0.1 and not the
> one of master, right?

I fixed it a few days ago.

Ludo’.

Re: “Towards Guix for DevOps”

[zimoun]

On Wed, 24 Jul 2019 at 19:11, Ludovic Courtès <ludo@gnu.org> wrote:
>
> zimoun <zimon.toutoune@gmail.com> skribis:
>
> > The link to the manual seems broken.
> > http://guix.gnu.org/manual/en/html_node/Invoking-guix-deploy.html#Invoking-guix-deploy
> > Because the manual online is the one of the version 1.0.1 and not the
> > one of master, right?
>
> I fixed it a few days ago.

Ok, nice!

Even if I do not understand which Guix commiy (version) the /devel/ serves.

Cheers,
simon

Re: “Towards Guix for DevOps”

[Jakob L. Kreuze]

[-- Attachment #1: Type: text/plain, Size: 99 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> I fixed it a few days ago.
>
> Ludo’.

Thanks!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: “Towards Guix for DevOps”

[Alex Sassmannshausen]

Hello,

I just wanted to drop a quick note on the guix deploy work carried out
by Jakob.

I've started using it to manage servers, and it seems to work an
absolute charm.  Congratulations to all involved.

I did hit the following small stumbling blocks:

- When first running guix deploy it complained about a missing
  /etc/guix/signing-key.sec.  I fairly quickly realised that deploy
  probably used archive infrastructure, so figured out how to generate
  the keys.  But maybe the manual should contain a line about this?

- The machine-ssh-configuration allows for the specification of users
  other than root, but my understanding is that only root will allow for
  a successful deployment (because root is required to actually
  reconfigure the target system).  I don't know what conclusions to draw
  from this, as I'm not 100% on the roadmap for development.  But maybe
  for now, this could be a gotcha for new users.

Best wishes,

Alex

Ludovic Courtès <ludo@gnu.org> writes:

> Hello Guix!
>
> Jakob wrote a lovely post about the ongoing work implementing ‘guix
> deploy’ as part of GSoC:
>
>   https://gnu.org/s/guix/blog/2019/towards-guix-for-devops/
>
> Check it out!
>
> Ludo’.

Re: “Towards Guix for DevOps”

[Jakob L. Kreuze]

[-- Attachment #1: Type: text/plain, Size: 1816 bytes --]

Hi Alex,

Alex Sassmannshausen <alex.sassmannshausen@gmail.com> writes:

> Hello,
>
> I just wanted to drop a quick note on the guix deploy work carried out
> by Jakob.
>
> I've started using it to manage servers, and it seems to work an
> absolute charm. Congratulations to all involved.

That's awesome. Hearing another success story with 'guix deploy'
absolutely made my day.

> I did hit the following small stumbling blocks:
>
> - When first running guix deploy it complained about a missing
>   /etc/guix/signing-key.sec. I fairly quickly realised that deploy
>   probably used archive infrastructure, so figured out how to generate
>   the keys. But maybe the manual should contain a line about this?

Excellent suggestion, I'll see about submitting a patch to mention that
in the manual.

The idea to automatically authorize the coordinator machine's signing
key has been rolling around in my mind since I started on this, since it
that something like that would fall into the category of "provisioning".

> - The machine-ssh-configuration allows for the specification of users
>   other than root, but my understanding is that only root will allow for
>   a successful deployment (because root is required to actually
>   reconfigure the target system). I don't know what conclusions to draw
>   from this, as I'm not 100% on the roadmap for development. But maybe
>   for now, this could be a gotcha for new users.

That's correct. This is another area where I'm not quite sure what the
optimal solution would be; conventional wisdom suggests that a server's
SSH daemon should be configured to disallow root login, which makes me
think that we should implement some sort of privilege escalation with
'sudo', but I'm open to additional suggestions.

Thank you very much for your comments :)

Regards,
Jakob

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: “Towards Guix for DevOps”

[Jan Nieuwenhuizen]

[-- Attachment #1: Type: text/plain, Size: 2740 bytes --]

Ludovic Courtès writes:

> Jakob wrote a lovely post about the ongoing work implementing ‘guix
> deploy’ as part of GSoC:
>
>   https://gnu.org/s/guix/blog/2019/towards-guix-for-devops/
>
> Check it out!

Yes, this is excellent.  I started playing with it using a deploy-vm.sh
script (see attached).  It took me a few iterations to get all bits
right; I mistook the host's signing-key's error message for an ssh
authentication problem, e.g.

This works great so I am already using it now; together with channels it
simplifies my deployments a lot.

I found that I cannot deploy to older machines, running 0.16 or earlier.
Not really a problem but it should at least be documented, I think.

Here's what deploying to a 0.16 machine gives me

--8<---------------cut here---------------start------------->8---
+ guix deploy deploy-vm.scm
substitute: updating substitutes from 'http://guix1.oban.verum.com:8181'... 100.0%
substitute: updating substitutes from 'http://guix3.oban.verum.com:8181'... 100.0%
substitute: updating substitutes from 'http://janneke.lilypond.org:8080'... 100.0%
sending 142 store items (745 MiB) to 'localhost'...
sending 3 store items (0 MiB) to 'localhost'...
Backtrace:
           7 (primitive-load "/gnu/store/rl2fvwwdj9n82yjhc8v1yygy5c0zwnkb-profile/bin/guix")
In guix/ui.scm:
  1659:12  6 (run-guix-command _ . _)
In guix/store.scm:
   623:10  5 (call-with-store _)
In srfi/srfi-1.scm:
    640:9  4 (for-each #<procedure 19c9020 at guix/scripts/deploy.scm:81:16 (machine)> (#<<machine> system: #…>))
In guix/store.scm:
  1803:24  3 (run-with-store #<store-connection 256.99 10e3a80> _ #:guile-for-build _ #:system _ #:target _)
In gnu/machine/ssh.scm:
    339:2  2 (_ _)
In guix/remote.scm:
   122:20  1 (_ _)
    66:17  0 (%remote-eval _ _)

guix/remote.scm:66:17: In procedure %remote-eval:
Throw to key `srfi-34' with args `(#<inferior-object #<condition &action-exception-error [service: user-homes action: start key: match-error args: ("match" "no matching pattern" "#<<user-account> name: \"root\" password: \"\" uid: 0 group: \"root\" supplementary-groups: () comment: \"System administrator\" home-directory: #<procedure home-directory (x)> create-home-directory?: #t shell: \"/gnu/store/qn1ax1fkj16x280m1rv7mcimfmn9l2pf-bash-4.4.23/bin/bash\" system?: #f>")] 716f00>>)'.
+ ssh -i id_rsa -p 10022 root@localhost guix system list-generations
--8<---------------cut here---------------end--------------->8---

After manually reconfiguring the machine to 1.0 it works, but that
already starts to feel clumsy :)

Anyway, very impressive and a big thank you Jakob!

Greetings,
janneke

I've also put this up on https://gitlab/janneke/deploy


[-- Attachment #2: deploy-vm.sh --]
[-- Type: application/x-sh, Size: 900 bytes --]

[-- Attachment #3: bare-bones.scm --]
[-- Type: application/octet-stream, Size: 1395 bytes --]

(define-module (bare-bones)
  #:use-module (ice-9 rdelim)
  #:use-module (gnu)
  #:use-module (gnu services networking)
  #:use-module (gnu services ssh)
  #:export (%bare-bones))

(define %bare-bones
  (operating-system
    (host-name "baar")
    (timezone "Europe/Amsterdam")
    (bootloader (bootloader-configuration
                 (bootloader grub-bootloader)
                 (target "/dev/vda")))
    (file-systems (cons (file-system
                          ;; after reboot: no such device: guix
                          ;; (device (file-system-label "guix"))
                          (device "/dev/vda1")
                          (mount-point "/")
                          (type "ext4"))
                        %base-file-systems))
    (services
     (cons*
      (service dhcp-client-service-type)
      (service openssh-service-type
               (openssh-configuration
                (permit-root-login #t)
                (authorized-keys
                 `(("root" ,(local-file "id_rsa.pub"))))
                (port-number 22)))
      (modify-services %base-services
        (guix-service-type
         config => (guix-configuration
                    (inherit config)
                    (authorized-keys
                     (cons
                      (local-file "/etc/guix/signing-key.pub")
                      %default-authorized-guix-keys)))))))))

%bare-bones

[-- Attachment #4: deploy-vm.scm --]
[-- Type: application/octet-stream, Size: 913 bytes --]

(use-modules (gnu))
(use-modules (bare-bones))
(use-service-modules shepherd)

(define %system
  (operating-system
    (inherit %bare-bones)
    (host-name "deployable")

    (packages (cons* hello %base-packages))

    (services
     (cons* (service (shepherd-service-type
                      'hello
                      (lambda _
                        (shepherd-service
                         (provision '(hello))
                         (start '(lambda _ (display "hello\n")))
                         (stop '(lambda _ (display "goodbye\n"))))))
                     #t)
            (operating-system-user-services %bare-bones)))))

(list (machine
       (system %system)
       (environment managed-host-environment-type)
       (configuration (machine-ssh-configuration
                       (host-name "localhost")
                       (identity "id_rsa")
                       (port 10022)))))

[-- Attachment #5: channels.scm --]
[-- Type: application/octet-stream, Size: 139 bytes --]

(list
 (channel
  (name 'guix)
  (url "https://git.savannah.gnu.org/git/guix.git")
  (commit "53f21642729e4786141c072dd835b04cb85dfe28")))

[-- Attachment #6: Type: text/plain, Size: 152 bytes --]


-- 
Jan Nieuwenhuizen <janneke@gnu.org> | GNU LilyPond http://lilypond.org
Freelance IT http://JoyofSource.com | Avatar® http://AvatarAcademy.com

Re: “Towards Guix for DevOps”

[Jakob L. Kreuze]

[-- Attachment #1: Type: text/plain, Size: 3154 bytes --]

Hi Jan,

Jan Nieuwenhuizen <janneke@gnu.org> writes:

> Yes, this is excellent.  I started playing with it using a deploy-vm.sh
> script (see attached).  It took me a few iterations to get all bits
> right; I mistook the host's signing-key's error message for an ssh
> authentication problem, e.g.
>
> This works great so I am already using it now; together with channels it
> simplifies my deployments a lot.

Glad to hear you were able to get it working! And thanks for sharing
those scripts. I spin up GuixSD virtual machines very frequently to work
on this, and these look like they'd make that workflow much easier.

> I found that I cannot deploy to older machines, running 0.16 or earlier.
> Not really a problem but it should at least be documented, I think.
>
> Here's what deploying to a 0.16 machine gives me
>
> + guix deploy deploy-vm.scm
> substitute: updating substitutes from 'http://guix1.oban.verum.com:8181'... 100.0%
> substitute: updating substitutes from 'http://guix3.oban.verum.com:8181'... 100.0%
> substitute: updating substitutes from 'http://janneke.lilypond.org:8080'... 100.0%
> sending 142 store items (745 MiB) to 'localhost'...
> sending 3 store items (0 MiB) to 'localhost'...
> Backtrace:
>            7 (primitive-load "/gnu/store/rl2fvwwdj9n82yjhc8v1yygy5c0zwnkb-profile/bin/guix")
> In guix/ui.scm:
>   1659:12  6 (run-guix-command _ . _)
> In guix/store.scm:
>    623:10  5 (call-with-store _)
> In srfi/srfi-1.scm:
>     640:9  4 (for-each #<procedure 19c9020 at guix/scripts/deploy.scm:81:16 (machine)> (#<<machine> system: #…>))
> In guix/store.scm:
>   1803:24  3 (run-with-store #<store-connection 256.99 10e3a80> _ #:guile-for-build _ #:system _ #:target _)
> In gnu/machine/ssh.scm:
>     339:2  2 (_ _)
> In guix/remote.scm:
>    122:20  1 (_ _)
>     66:17  0 (%remote-eval _ _)
>
> guix/remote.scm:66:17: In procedure %remote-eval:
> Throw to key `srfi-34' with args `(#<inferior-object #<condition &action-exception-error [service: user-homes action: start key: match-error args: ("match" "no matching pattern" "#<<user-account> name: \"root\" password: \"\" uid: 0 group: \"root\" supplementary-groups: () comment: \"System administrator\" home-directory: #<procedure home-directory (x)> create-home-directory?: #t shell: \"/gnu/store/qn1ax1fkj16x280m1rv7mcimfmn9l2pf-bash-4.4.23/bin/bash\" system?: #f>")] 716f00>>)'.
> + ssh -i id_rsa -p 10022 root@localhost guix system list-generations
>
> After manually reconfiguring the machine to 1.0 it works, but that
> already starts to feel clumsy :)

I believe this is the same issue that Ricardo ran into when deploying to
ci.guix.gnu.org. Sorry about that. Better error handling is something
I'm working on at the moment.

Though, I'm not quite sure what to do about this issue in particular, as
(if I understand correctly) we concluded that this was a problem with
the 'user-homes' service, and the idea of rolling out a workaround
specific to that in 'guix deploy' doesn't sit particularly well with me.

> Anyway, very impressive and a big thank you Jakob!

Thank you!

Regards,
Jakob

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: “Towards Guix for DevOps”

[Jan Nieuwenhuizen]

Jakob L. Kreuze writes:

Hi Jakob,

> Glad to hear you were able to get it working! And thanks for sharing
> those scripts. I spin up GuixSD virtual machines very frequently to work
> on this, and these look like they'd make that workflow much easier.

Oh, good.  Yes, I wanted to try it for a while already but didn't get to
it and it's worth for anyone to give it a try.

>> Here's what deploying to a 0.16 machine gives me

>> guix/remote.scm:66:17: In procedure %remote-eval:
>> Throw to key `srfi-34' with args `(#<inferior-object #<condition &action-exception-error [service: user-homes action: start key: match-error args: ("match" "no matching pattern" "#<<user-account> name: \"root\" password: \"\" uid: 0 group: \"root\" supplementary-groups: () comment: \"System administrator\" home-directory: #<procedure home-directory (x)> create-home-directory?: #t shell: \"/gnu/store/qn1ax1fkj16x280m1rv7mcimfmn9l2pf-bash-4.4.23/bin/bash\" system?: #f>")] 716f00>>)'.
>> + ssh -i id_rsa -p 10022 root@localhost guix system list-generations
>>
>> After manually reconfiguring the machine to 1.0 it works, but that
>> already starts to feel clumsy :)
>
> I believe this is the same issue that Ricardo ran into when deploying to
> ci.guix.gnu.org. Sorry about that. Better error handling is something
> I'm working on at the moment.

Ah, right.  I think I even saw that.  Sorry for the noise.

> Though, I'm not quite sure what to do about this issue in particular, as
> (if I understand correctly) we concluded that this was a problem with
> the 'user-homes' service, and the idea of rolling out a workaround
> specific to that in 'guix deploy' doesn't sit particularly well with me.

Yes.

Greetings,
janneke

-- 
Jan Nieuwenhuizen <janneke@gnu.org> | GNU LilyPond http://lilypond.org
Freelance IT http://JoyofSource.com | Avatar® http://AvatarAcademy.com