From bc7189651993fc905b1a5cdd0a4cd69dba783cb3 Mon Sep 17 00:00:00 2001
From: toufic ar <contact@toufy.me>
Date: Tue, 23 Jun 2026 02:05:05 +0300
Subject: add msci

---
 .makeshiftci/1.json       |  8 ++++++++
 .makeshiftci/2.json       |  8 ++++++++
 aphrodite/devops/msci.nix |  6 +++---
 deploy.sh                 | 23 +++++++++++++++++++++++
 secrets.yaml              | 11 +++++------
 ssh_setup.sh              |  8 ++++++++
 update.sh                 | 17 +++++++++++++++++
 7 files changed, 72 insertions(+), 9 deletions(-)
 create mode 100644 .makeshiftci/1.json
 create mode 100644 .makeshiftci/2.json
 create mode 100755 deploy.sh
 create mode 100755 ssh_setup.sh
 create mode 100755 update.sh

diff --git a/.makeshiftci/1.json b/.makeshiftci/1.json
new file mode 100644
index 0000000..8be3bbb
--- /dev/null
+++ b/.makeshiftci/1.json
@@ -0,0 +1,8 @@
+{
+	"name": "update flake.nix",
+	"image": "nixos:latest",
+	"secrets": {
+		"SECRET_SSH": "/run/secrets/msci/sshkey"
+	},
+	"run": ["./update.sh"]
+}
diff --git a/.makeshiftci/2.json b/.makeshiftci/2.json
new file mode 100644
index 0000000..ea25ac8
--- /dev/null
+++ b/.makeshiftci/2.json
@@ -0,0 +1,8 @@
+{
+	"name": "deploy",
+	"image": "nixos:latest",
+	"secrets": {
+		"SECRET_SSH": "/run/secrets/msci/sshkey"
+	},
+	"run": ["./deploy.sh"]
+}
diff --git a/aphrodite/devops/msci.nix b/aphrodite/devops/msci.nix
index 489a986..fd69784 100644
--- a/aphrodite/devops/msci.nix
+++ b/aphrodite/devops/msci.nix
@@ -2,9 +2,9 @@
   buildDomain = "build.${config.customOps.domain.fqdn}";
 in {
   sops.secrets = {
-    "msci/taur/sshkey" = {};
-    "msci/taur/gpgkey" = {};
-    "msci/taur/gpgpwd" = {};
+    "msci/sshkey" = {};
+    "msci/gpgkey" = {};
+    "msci/gpgpwd" = {};
   };
   makeshiftci = {
     enable = true;
diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..2db441c
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -e
+
+./ssh_setup.sh
+
+echo "updating adonis"
+
+ssh root@adonis.toufy.me -C <<EOF
+	git -C /etc/nixos pull
+	nixos-rebuild dry-activate --flake /etc/nixos --upgrade
+	nixos-rebuild switch --flake /etc/nixos --upgrade
+	nix-collect-garbage -d
+EOF
+
+echo "updating aphrodite"
+
+ssh root@aphrodite.toufy.me -C <<EOF
+	git -C /etc/nixos pull
+	nixos-rebuild dry-activate --flake /etc/nixos --upgrade
+	nixos-rebuild switch --flake /etc/nixos --upgrade
+	nix-collect-garbage -d
+EOF
diff --git a/secrets.yaml b/secrets.yaml
index 2d12e12..4b04d04 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -5,10 +5,9 @@ mailserver:
 searx: ENC[AES256_GCM,data:n451XLvOi2D2YvL0/+ko+HyXWEU7uuVlivkFsKxIzq1EWqMVEhFgEAt1k8W15AdgLY1xo455fUbL6/W1uSFO8w==,iv:QfX7s4l4QuZ8/85Q/+0OWezDGqOKXdY7B5M6wq/5tAM=,tag:ppZXewIAN0IdRMgrIIKTmg==,type:str]
 gitolite-sshkey: ENC[AES256_GCM,data:eAjtnbhPkRN0tvVkQiYJkxhqZxjxLniv4DQokHtJzoCpxuqzfetSLXYk//p0Me9Irt6N1UJQ9xygtO9z+v5fz/sjTJAOg5yqGHwNEeLGdJdJfP8hBBI/5g4G4lNELh6hXeqy8a5lQRXmSi5nf3pQ8va8jDTr+qE5SsKB0ypQmS2fK2T8UyobYWRAy6XKfOd15QfheqWwYaiKAh8jp2VQyixcRkE9IPOE5bHwnzYvhVOZESwq4sogXeCaOOq7IjFfVZ6i5CFjJelL4sU8Og13XJYe0KnB8Q3aFXDroLkImW/GEL1ISGHOFZRMX1Wmx2IJzCpWLrnhRHFGDksfPDfI9CBB5+DfoyvFE0bQDISi/72R1g5wu29H5gtiGYhgtedCIhoQ+YVjswZ0xD3Oi071InRrm6qtPY2PilLorlMsSZ3sV6sunZ8TijwJzcWLK8b4jd7hztMNSEyCgxJGOG78//NcI+8amE7Hq4GH4THFgX+eG8RL9QU3lnJ33Km9agAlqnd6+MJXWmAi75tHugMz,iv:5G1gNkhLeDmo3t3SRYHOAcHhTJZS2aZTR7zeoXOimQ8=,tag:XBnh4Q2IAQyour5ddD05/g==,type:str]
 msci:
-    taur:
-        sshkey: ENC[AES256_GCM,data:iqyKTDoOfbdbEpPB5Yh0K/kz4DSHj0Gutrtdvvtj/MzCLKLWFi2fqf/W78YWjdooaliUMcbnYOVzn/6Uy9mRK1vL8Tx7qUBtqxOBMDFirdJe/6FmuFldYq62Jm6GWtvtB1gG2cmk+ZXhi39BPAJ7k9PWRI4nMKMdY81kVYR6cPSOnoUXkBfXAE5lX/XxT0jKiEgUTE6HGQ/o1HongtK3mfDvUfNPdJrAqKIJF/zsxEFRQKDpelGA8Oymr+x7cALmkNteZb5mV+XVSVeiHw45ejEUulNW+XYNcW82FjmIycM4XZ94SyO+5ucRpa0rRlFa2veqcN8FWiHOT/om9LQo8AQ3vMxj3fqquI9AHHrfEMbnsa3P502rzWdyU9f0KH8TCde/Ki6ZtPap6B0IaOBz+fNY8Vv0dRNs+ZclitYKTNkpDI50CZl17LwSNIBFQH+6ZWzPQo0XNIxyLZ8rQS7PZrQZJHSPNF1OivNEwhuUM7JKHK/LG1U2XTqkdTMljKX2uNLSSfNGxXZZPo7BiJYU,iv:rpSJDwJnfKqpXCWv3GvAnuteF0B0ZxssO36OkE2k5V0=,tag:zC/2tTxFI/4UvQMfooU/Ng==,type:str]
-        gpgkey: ENC[AES256_GCM,data:v/CqXy5jkSuJHDvgT5Daolw9En+jLbBuJTsa7C1GvZhU5VKNhhr05TVTuotYqbcoAkXTeTpEwWWWku8DSo8i+sHovqJ5081r6I0q0uSrvz8ESS9KeYNaxwOGVRgLCYeJmoSp8m4q+CcKWEuMiyPhI8UAF1AjtouO/G3sR0KYPbIiPateO/NiAjmwX6iilcnctlj5LN7gO4srBTHO+NVXZSgkFh2zm4pWZGqC0jrbV91a+tZyMGZaJ9v6mqeb+umBBIFTg/KvM0zg5NA4e8sWc8MYZaDyJdw+7iYn0m6KmjkOKuluNCBgyKp03vGS4AjKtGZwfr6W22pu6hvNDlUxXhtDBmyqbGhfYMMHSdA1H6vky1WU+xue195eoa6cggykKTUepxDdo+LCU+l8qE9/7BD683ouDAn2ao+9icQQ2q5Bi9ZJg1oLiTD+IpB1plECZKjyaoxtv4w5/u/ytgnr/AZPbmrjUgkbupXMJxP6JaVsAFQhTgZDr+/wz6z6mJ0BUZImbH5gBGEoeIKhLQuNwrvIxBROTvCtSBdMlZ6bQ13MTBDo/SNrY08310qnXgqD95WCETJG7JIgoMI4W0of+FtKAogDe9izsFVxoCDCoJW5kH2ZucNLtiJ1y1N0/bQNAp+hO9pynM0jCu1oeLzGOgbAzVK7xZg6NtUjUInoSXJgBmn9ely0s/kse9den1BULz/sD3/5S1kr7kvLix3Pyr9i/jSpH57dj7XE7yZZJGCbI84DPpUQwKjjQTdlFWcEUXe7H9YQ3/Pgn5DfS1YpOP2eVyT2M2ChDjXNiPTHez6cJ1STJiJ1bUnHUXgHhixWG01kr4Ya4Ku2vDEndL0Wpjg6K3Yn8Ehv3EpUuTlJ73RLMkDm7UxP7l6NDxPsBCjNsj0HsCS2KuFkzqjDnqA3fd2XZyIK+zXyBLSHVeCBuzkPOxrNHrmxongAhrbv00oh78nkgoMtfa5ZZUJ+eWyRnuZc/gEiwitKh2i+XfewWi/jLwnvZwtVlb5/EF9oBxi8cc6HPKLOimZIFIFsqJSfxg==,iv:Wn+dVURWl8p4J+wu8eoYqNbBBN7GvUYu7Q5dsRZ6fmo=,tag:BhIx7Txo+yYBvQPV2vJfmQ==,type:str]
-        gpgpwd: ENC[AES256_GCM,data:5tFH+DDpE0gv9+7Pm6LMfqf58qU3PH36D4s+gb1TcGN1xnICVsT8y0PMmTaiAyOMaQ==,iv:5njC3GuA3qZiPv0dMRylS3sQ1QNXeDEUeoVlGdmpLVU=,tag:2B05LT4R1z8XABchVuAl1g==,type:str]
+    sshkey: ENC[AES256_GCM,data:b4xHoTnmkCYghRylcV2U63Sh/l7sM2YQ76GgHFxHp2HKxo3slRQkgEe6GSgEXD0vYHGoXDCBo7x4Vhvf58nvKOOveHtg+l4w+ypFQ+5DRIl4gLnHBEyIMFm3IXlwKnSV+qAxODKFWkbv9yIatWpJa2K8uXJ5+VbQ2tdDoWi4C51cuhDA7mRydxT4xcKdOFN6ajufFIeYeu867Pr8qUy53j8rYCsBaCIphtv/UW7r1noWKz7P8tt6pU+hpht7BrKu6sUq6lDG7GHnlQjp7Ypj7OQhm1isHHp/5uSabcJ+nkW6MOw39QUDgUEdtka1KN1FTdLaYnzr4OYXKmbvBATEgamgVwYVEbPWgc/0aIDgzn9hQhRII3x/VsoWKB4+TnMaUgvbRJ1ZU9FztMqeX4+gzvXta7ANwzESUvS8ce/kwMKbEAPvbc11YcAYdnxZEoPZ1qVQ3W72WZM6jBd45aDH8wOUxhVAJnw7pPx0xLqb68lFnT+tS2yavHRTUFovdCO3fBu6hl5P2pRe5S2kmkVG,iv:MvmVhJPFMegABugWuXUS3iNU5R26ZaaQARdXeye5Bzs=,tag:59ZGDZSQ+3RovxsgngQy7A==,type:str]
+    gpgkey: ENC[AES256_GCM,data:9H3NfqjWiH7N1W6/4jQcfH8ML69V3Pt+8M1KyLvo2ITvX892x/ymvHS6df8JQ2NGzoPia/oZ9cFiDhku8mCX8rcH5o2Dn7CefEMeXpr5MpiZQj83Kz02a5VowbJcEx71ByIdosQl6y1qWFSomjv4xpdlJ1qI7eY168crjkBn/O/P12zDBC+rw6qiGWRsIKufHn+kLcVaw/Z5n0Gt0H2OvtKioyAcZGn1LIWWyzRCIe3UHUtI/6X4AKGuKDGr6kJQfe0xfSRIc1lancjpcvlHIIpJ5QCdbr2jj4Mx26tfgEHidCNAZQH0tckQUvnQGlrGo2eQwAG7CF1W0c1LAXq9N26yhvZRkrAfbGb1nOLJ8njYJR1UEre40TnPcP7sPn8j1z1XvBmPSF5fsTXL9+qvbvT2PBBrXrP6408oHHVLFUm9g50hoYVvf4ZxVXG65pxpN+wyB03vQTvPT/O27Y1ZWfanODWfdUfcSgkYMLS/AysnUmT3Mzbzn1WHBfvwLF1nNY1vC0tRdgfpvXs9XxT/YVPK5WvM1MDSfPvLDyR0BpwfM045bt24ieWU+zSNL9rb16A+F6sjj9JVvEEaRoxV+vP5kGmCx7+jr780RI6GGHXlPn1l1LNnRL3htycSxB6/XBi1sAcM01Ft4b6mOYnCHpFXRLpT82YlL0VqM2ysGDSiC3ROxktowcY5gc1ncvRldn1SpeTKlDTiNwWYDx2YcZrIZICNaSumZRavPiE3hIQiPlGixbj3LvknzV8HwaFXXFO7/50s5E7KFcMbpKEA2sRQVGggyy1gt8YKaW+twk+TKMRoVTqHHSmiPja1HIHbL/qfWx3zABoADeLL5d197yZmm8tzmZd3kbxSg4INtiBYcVqumoTKjcsDM0FkubisLVmUgiDJA1LztH2t/Q8XWipi+JFSmau27n+1g7o3Ev9JLAaVhVz/CXqJkyKXPTolHOO6BNQ2aKHc4yV6IkeXHFUHaq7SX/qApPchW+YPikkdbaSguBQ5j0hpoguj+0VZc02IxMVNUlhHcT0ivNHbtg==,iv:WIiNQzwBB5NShl3kmES0klcsvx5hDk1y/o1TMCscb8E=,tag:U41TaRxxrWgnK3FJfMEXsw==,type:str]
+    gpgpwd: ENC[AES256_GCM,data:Mawtj2lOmKRk1jUtSWUb+oFoHTC/dXPkEi3iYiqaNoAms7GSKOPMikdzg0WUBtvTmQ==,iv:qZg4PBCv8Q6YtRygTsnLu/D9VzK4nVRgPET7qbII4xc=,tag:Ux6syzVGySLIwPcfJtDriA==,type:str]
 sops:
     age:
         - enc: |
@@ -38,7 +37,7 @@ sops:
             AjeKUiRMROq4PMJYmWXDjToBlvdOFq9oYNl+1mNlcQTMbEkCoqIfrw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ra6vn99y233pxrlpcwpuwl7vc8ma5y4ucg5jlkfylh6kudsxzehqznqmet
-    lastmodified: "2026-05-22T14:07:49Z"
-    mac: ENC[AES256_GCM,data:Y3Ty0e96p6+225JIPvtpCEsEcFgCJCt+CwFdFHimhAKCfBEHRKretpU3xTQCvkC45J/Aq9trRCbGKLJq69hqweo548Rc2S12LFYWucTm+lvDyI+8pWxiw5EeOAkEegzDfm1SmBVCGhlsoc/KqRiiRzq9iWLQIsrA9EHESyJrWoQ=,iv:JbwSxx1g29tgGFUPQxC5P71Y66vfnCLCkFk2FXl1/Vg=,tag:ftYbwwNzuxouiLSD2TapXg==,type:str]
+    lastmodified: "2026-06-22T21:20:27Z"
+    mac: ENC[AES256_GCM,data:LdF9oiBmbwnCUeIZOF25h11k/V8t4etJovKHlwMzNgMVbj1ZFxYwCkv8iTjVluYZM4rq1DPcNuDM2guAda08XUiIODoJWtvoHTvvX5pEQ6a0BAspFOJUJ4oFnNmABh1WJ0gUnN85s1QYpqB0r3UtT2ZyeFoYtfmkFW5Ujv2z+yg=,iv:vSKE2jTSvzlbqytD2qtjWBznI7HQBhpCycRQl5/PE3M=,tag:O8AC6W6Jzf1W7svdZUs88A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1
diff --git a/ssh_setup.sh b/ssh_setup.sh
new file mode 100755
index 0000000..fdb7172
--- /dev/null
+++ b/ssh_setup.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+mkdir -p ~/.ssh
+chmod -R 755 ~/.ssh
+cp "$SECRET_SSH" ~/.ssh/id_ed25519
+chmod 600 ~/.ssh/id_ed25519
+echo "aphrodite.toufy.me adonis.toufy.me" |
+	xargs ssh-keyscan >~/.ssh/known_hosts
diff --git a/update.sh b/update.sh
new file mode 100755
index 0000000..da1a763
--- /dev/null
+++ b/update.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -e
+
+./ssh_setup.sh
+
+git config --global user.email "msci@toufy.me"
+git config --global user.name "makeshiftci"
+
+nix-channel --update
+
+nix --extra-experimental-features "nix-command flakes" flake update
+
+git diff --exit-code flake.lock && exit 0
+git add .
+git commit -m "update flake.lock"
+git push ssh://git@git.toufy.me:servers
-- 
cgit v1.3.1