This repository has no description
tools.deploy: add deploy tool with pass sync and bulk key management
Adds a deploy wrapper around `clan machines update` that:
- Syncs the password store (pull/push) around deploys
- Extracts the bulk age key into a secure tmpdir for fast decryption
- Cleans up key material on exit
Co-Authored-By: Claude (claude-opus-4-6) <noreply@anthropic.com>
author
Vibe Kanban
co-author
Claude (claude-opus-4-6)
date
(Mar 9, 2026, 11:43 PM CET)
commit
0ab04982
0ab049827d617fa7122a5ea889659dff30da18ed
parent
119be338
119be33849d5e971a3c3a6c85dc52482d9582761
+61
+24
tools/deploy/deploy.usage.kdl
+24
tools/deploy/deploy.usage.kdl
···
1
+
bin "deploy"
2
+
about "Deploy machines via clan, with passage sync and bulk key management"
3
+
4
+
arg "<machine>" help="Machine(s) to deploy" var=#true
5
+
6
+
flag "--tags" help="Tags to query machines for" {
7
+
arg "<tags>"
8
+
var=#true
9
+
}
10
+
flag "--target-host" help="Address of the machine to update (user@host:1234)" {
11
+
arg "<target_host>"
12
+
}
13
+
flag "--build-host" help="Machine to build the configuration on" {
14
+
arg "<build_host>"
15
+
}
16
+
flag "--host-key-check" help="SSH host key check mode" {
17
+
arg "<mode>"
18
+
choices "strict" "ask" "accept-new" "tofu" "none"
19
+
}
20
+
flag "--upload-inputs" help="Upload all flake inputs from local machine"
21
+
flag "--debug" help="Enable debug logging"
22
+
flag "--flake" help="Path to the flake" {
23
+
arg "<path>"
24
+
}
+37
tools/deploy/flake-module.nix
+37
tools/deploy/flake-module.nix
···
1
+
{ self, inputs, ... }:
2
+
{
3
+
perSystem =
4
+
{
5
+
pkgs,
6
+
system,
7
+
...
8
+
}:
9
+
{
10
+
packages.deploy = pkgs.writeShellApplication {
11
+
name = "deploy";
12
+
runtimeInputs = [
13
+
self.packages.${system}.pass
14
+
inputs.clan-core.packages.${system}.clan-cli
15
+
];
16
+
text = ''
17
+
DEPLOY_TMPDIR=$(mktemp -d)
18
+
chmod 700 "$DEPLOY_TMPDIR"
19
+
trap 'rm -rf "$DEPLOY_TMPDIR"' EXIT
20
+
21
+
export PASS_BULK_KEY_FILE="$DEPLOY_TMPDIR/bulk-key"
22
+
23
+
# Sync password store before deploy
24
+
pass git pull --rebase
25
+
26
+
# Extract bulk key for fast decryption during deploy
27
+
pass show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
28
+
29
+
# Deploy
30
+
clan machines update "$@"
31
+
32
+
# Push any secret changes after deploy
33
+
pass git push
34
+
'';
35
+
};
36
+
};
37
+
}