tests: end-to-end install-keepnode install-mechanics check

[kwsantiago]

What

Add tests/install-keepnode.nix (check install-keepnode): run install-keepnode end-to-end on a blank disk and assert the install mechanics succeed — partitioning, nixos-install of the real bring-up appliance closure, systemd-boot written to the ESP, and the operator key enrolled into the runtime authorizedKeysFile.

Why

installer-guards.nix covers only the abort paths (bad disk, missing key) with a stubbed closure. The successful install path — the thing an operator actually runs on the hardware — was never exercised. This is the scariest untested path for a real bring-up: if partitioning/nixos-install/enrollment is broken, you'd only find out with the hardware in hand.

What it proves (deterministically, single VM)

• GPT ESP + nixos partitions created and labelled.
• nixos-install installed exactly the closure install-keepnode was handed (/mnt/nix/var/nix/profiles/system resolves to the shipped bring-up closure).
• systemd-boot on the ESP with generated loader entries → the target is bootable-configured.
• the operator pubkey enrolled into /mnt/etc/keepnode/admin_authorized_keys (exact bytes, 0644).

Scope / design notes

• Asserts against the installed /mnt rather than booting the installed disk. The full second-boot (nixpkgs makeInstallerTest two-node state_dir + OVMF) was prototyped but the actual boot is firmware/TPM-specific and is validated on real hardware (higher fidelity than an OVMF VM); the environment-independent install mechanics are what this proves. Second-boot coverage is a documented follow-up.
• The installed closure is the real keepnodeBringupSystem with one test-only accommodation, canTouchEfiVariables = false, so nixos-install's bootctl install needs no efivarfs in the BIOS installer VM (the appliance ships it true for the real UEFI box). Nothing else differs.
• The node provisions what the installation-CD provides (nixos-install-tools on PATH, an existing /mnt), mirroring reality rather than special-casing the installer.
• Heavy (nested install of the full appliance closure, ~6 min); enumerated as a check but excluded from the per-PR fast subset — runs on push-to-main / full-CI, like installer-iso.

Advances keep-node-8r2 (install mechanics; actual-boot coverage tracked as follow-up). Verified locally: passes (345s).

Summary by CodeRabbit

• Tests
  • Added an end-to-end automated test for installing the appliance onto a blank disk.
  • Verifies disk partitioning, installed system contents, bootloader generation, and administrator SSH key enrollment.
  • Added a CI check to ensure the installation workflow completes successfully in a BIOS-compatible environment.

[coderabbitai]

Warning

Review limit reached

@kwsantiago, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7e6fd8ae-7746-4c1b-9b5e-69edc2fdc4ef

📥 Commits

Reviewing files that changed from the base of the PR and between 04e04cd and 4437d8f.

📒 Files selected for processing (1)

• flake.nix

Walkthrough

Adds a flake CI check and NixOS VM test that install the keep-node appliance onto a blank disk, verify boot artifacts and the installed system path, and confirm administrator SSH key enrollment and permissions.

Changes

Keep-node installation validation

Layer / File(s)	Summary
Installation check wiring flake.nix	Adds checks.${system}.install-keepnode, builds the configured keep-node system closure, supplies the admin key fixture, and disables EFI variable writes for the installer VM.
End-to-end installation test tests/install-keepnode.nix	Runs install-keepnode against a blank disk and verifies partition labels, the installed system profile, systemd-boot artifacts, and administrator key enrollment with 0644 permissions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• privkeyio/keep-node#58: Introduces the administrator access module exercised by this installation test.
• privkeyio/keep-node#60: Adds installer SSH key provisioning behavior validated here.

Suggested labels: full-ci

Poem

I hopped through the installer, light and quick,
Onto a blank disk, partition by brick.
The boot files bloomed, the key found its place,
With tidy permissions and system profile grace.
CI now watches the appliance take flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is specific and accurately reflects the new end-to-end install-keepnode test added to CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch install-keepnode-e2e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}