feat(wpcarro/diogenes): Support rebuild-diogenes

- deploy-diogenes: terraform updates + NixOS rebuilds
- rebuild-diogenes: NixOS rebuilds

Change-Id: Ibd6db7115d9919fa44ee9d318f88e1bf29e2bdce
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5160
Tested-by: BuildkiteCI
Reviewed-by: wpcarro <wpcarro@gmail.com>
Autosubmit: wpcarro <wpcarro@gmail.com>

users/wpcarro/bin/__dispatch.sh

@@ -12,6 +12,9 @@ case "${TARGET_TOOL}" in
   deploy-diogenes)
     attr="users.wpcarro.nixos.deploy-diogenes"
     ;;
+  rebuild-diogenes)
+    attr="users.wpcarro.nixos.rebuild-diogenes"
+    ;;
   import-gpg)
     attr="users.wpcarro.configs.import-gpg"
     ;;

users/wpcarro/bin/rebuild-diogenes

@@ -0,0 +1 @@
+__dispatch.sh

users/wpcarro/nixos/default.nix

@@ -1,22 +1,48 @@
 { depot, pkgs, ... }:
 
-let systemFor = sys: (depot.ops.nixos.nixosFor sys).system;
-in {
+let
+  inherit (depot.users.wpcarro.nixos) diogenes;
+  systemFor = sys: (depot.ops.nixos.nixosFor sys).system;
+in
+{
   marcusSystem = systemFor depot.users.wpcarro.nixos.marcus;
+
+  # Apply terraform updates and rebuild NixOS for diogenes.
   deploy-diogenes = pkgs.writeShellScriptBin "deploy-diogenes" ''
     set -euo pipefail
     readonly TF_STATE_DIR=/depot/users/wpcarro/terraform
     rm -f $TF_STATE_DIR/*.json
-    readonly STORE_PATH="$(nix-build /depot -A users.wpcarro.nixos.diogenes)"
+    readonly STORE_PATH="${diogenes.json}"
+    # We can't use the result symlink because terraform looks for a *.json file
+    # in the current working directory.
     cp $STORE_PATH $TF_STATE_DIR
 
-    function cleanup() {
-      rm -f "$TF_STATE_DIR/$(basename $STORE_PATH)"
-    }
+    if [ ! -d $TF_STATE_DIR/.terraform ]; then
+      ${pkgs.terraform}/bin/terraform -chdir="$TF_STATE_DIR" init
+    fi
+
+    # function cleanup() {
+    #   rm -f "$TF_STATE_DIR/$(basename $STORE_PATH)"
+    # }
+    # trap cleanup EXIT
 
-    trap cleanup EXIT
     ${pkgs.terraform}/bin/terraform -chdir="$TF_STATE_DIR" apply
   '';
 
+  # Rebuild NixOS for diogenes without applying terraform updates.
+  rebuild-diogenes = pkgs.writeShellScriptBin "rebuild-diogenes" ''
+    set -euo pipefail
+    readonly target="root@''${1}"
+
+    # We need to call nix-build here on the drvPath because it may not be in
+    # /nix/store yet.
+    readonly STORE_PATH="$(nix-build ${diogenes.drvPath} --no-out-link --show-trace)"
+    nix-copy-closure --to $target ${diogenes.osPath} \
+      --gzip --use-substitutes $STORE_PATH
+
+    ssh $target 'nix-env --profile /nix/var/nix/profiles/system --set ${diogenes.osPath}'
+    ssh $target '${diogenes.osPath}/bin/switch-to-configuration switch'
+  '';
+
   meta.ci.targets = [ "marcusSystem" ];
 }

users/wpcarro/terraform/default.nix

@@ -47,7 +47,9 @@ in
       osPath = unsafeDiscardStringContext (toString osRoot.outPath);
       drvPath = unsafeDiscardStringContext (toString osRoot.drvPath);
     in
-    writeText "terraform.tf.json" (toJSON (lib.recursiveUpdate extraConfig {
+    {
+      inherit drvPath osPath;
+      json = writeText "terraform.tf.json" (toJSON (lib.recursiveUpdate extraConfig {
         provider.google = {
           inherit project region zone;
         };
@@ -186,4 +188,5 @@ in
           ];
         };
       }));
+    };
 }