security for deployment on prod

deploy_nixos

@@ -11,8 +11,17 @@ if [ "$CLUSTER" = "staging" ]; then
 	copy nix/nomad-driver-nix2.nix /etc/nixos/nomad-driver-nix2.nix
 fi
 
-# use ./upgrade_nixos instead to upgrade NixOS
-#cmd "nix-channel --add https://nixos.org/channels/nixos-22.05 nixos"
-#cmd nixos-rebuild switch --upgrade --show-trace
 
+if [ "$CLUSTER" = "prod" ]; then
+	cmd nixos-rebuild boot
+	message "-------------------------------------------------------------------------------------"
+	message "New NixOS configuration hasn't been applied, to avoid disturbing production services."
+	message "Please apply the following procedure to node '$NIXHOST':"
+	message "1. Drain node in Nomad so that all jobs are relocated elsewhere"
+	message "2. Reboot node manually. You can also take the opportunity to upgrade with:"
+	message "         REBOOT_NODES=yes ./upgrade_nixos prod $NIXHOST"
+	message "3. Mark node as eligible again in Nomad"
+	message "-------------------------------------------------------------------------------------"
+else
 	cmd nixos-rebuild switch
+fi

sshtool

@@ -45,7 +45,9 @@ function footer {
 }
 
 function message {
-	echo "echo '$@'"
+	echo "base64 -d <<EOG"
+	echo "$@" | base64
+	echo "EOG"
 }
 
 function cmd {