Add OCI credentials and deploy script for NixOracle

- Encrypt OCI API key and config with age (secrets/oci_key.age, oci_config.age)
- Auto-restore ~/.oci/ via home.activation on nixos-rebuild
- Add deploy-oracle.sh: creates boot volume snapshot (max 4) before deploying

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy-oracle.sh

@@ -0,0 +1,75 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p oci-cli
+
+set -euo pipefail
+
+MAX_BACKUPS=4
+
+oci_cmd() {
+  oci "$@" --auth api_key
+}
+
+# Lê tenancy do config local (criptografado no repo)
+COMPARTMENT_ID=$(awk -F'=' '/^tenancy/ { gsub(/ /, "", $2); print $2 }' ~/.oci/config)
+
+echo "==> Localizando instância..."
+INSTANCE_ID=$(oci_cmd compute instance list \
+  --compartment-id "$COMPARTMENT_ID" \
+  --display-name "vm" \
+  --lifecycle-state RUNNING \
+  --query 'data[0].id' \
+  --raw-output)
+
+AD=$(oci_cmd compute instance get \
+  --instance-id "$INSTANCE_ID" \
+  --query 'data."availability-domain"' \
+  --raw-output)
+
+BOOT_VOLUME_ID=$(oci_cmd compute boot-volume-attachment list \
+  --compartment-id "$COMPARTMENT_ID" \
+  --instance-id "$INSTANCE_ID" \
+  --availability-domain "$AD" \
+  --query 'data[0]."boot-volume-id"' \
+  --raw-output)
+
+echo "    Boot volume: $BOOT_VOLUME_ID"
+
+# --- Pruning ---
+echo "==> Verificando snapshots existentes..."
+mapfile -t OLD_IDS < <(
+  oci_cmd bv boot-volume-backup list \
+    --compartment-id "$COMPARTMENT_ID" \
+    --boot-volume-id "$BOOT_VOLUME_ID" \
+    --sort-by TIMECREATED \
+    --sort-order ASC \
+    --query 'data[].id' \
+    --raw-output | python3 -c "import sys,json; [print(x) for x in json.load(sys.stdin)]"
+)
+
+COUNT=${#OLD_IDS[@]}
+echo "    $COUNT snapshot(s) encontrada(s)."
+
+if [ "$COUNT" -ge "$MAX_BACKUPS" ]; then
+  DELETE_COUNT=$(( COUNT - MAX_BACKUPS + 1 ))
+  echo "==> Removendo $DELETE_COUNT snapshot(s) antiga(s)..."
+  for id in "${OLD_IDS[@]:0:$DELETE_COUNT}"; do
+    echo "    Deletando: $id"
+    oci_cmd bv boot-volume-backup delete --boot-volume-backup-id "$id" --force
+  done
+fi
+
+# --- Backup ---
+BACKUP_NAME="nixoracle-$(date +%Y-%m-%d-%H%M)"
+echo "==> Criando snapshot: $BACKUP_NAME"
+oci_cmd bv boot-volume-backup create \
+  --boot-volume-id "$BOOT_VOLUME_ID" \
+  --display-name "$BACKUP_NAME" \
+  --type INCREMENTAL \
+  --query 'data.id' \
+  --raw-output
+echo "    Snapshot solicitada (processamento em segundo plano)."
+
+# --- Deploy ---
+echo "==> Fazendo deploy do NixOracle..."
+nixos-rebuild switch --flake .#NixOracle --target-host root@tadix.dev
+echo "==> Deploy concluído."

home/ltadeu6.nix

@@ -375,6 +375,18 @@ in
     ".config/wofi/menu.css".source = ../configs/wofi/menu.css;
   };
 
+  home.activation.ociCredentials = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    set -euo pipefail
+    key_file="/run/agenix/oci_key"
+    config_file="/run/agenix/oci_config"
+    if [ -r "$key_file" ] && [ -r "$config_file" ]; then
+      mkdir -p "$HOME/.oci"
+      chmod 700 "$HOME/.oci"
+      ln -sf "$key_file" "$HOME/.oci/key.pem"
+      ln -sf "$config_file" "$HOME/.oci/config"
+    fi
+  '';
+
   home.activation.openclawGatewayEnv = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
     set -euo pipefail
     token_file="/run/agenix/openclaw_gateway_token"

hosts/Nixos/configuration.nix

@@ -337,6 +337,22 @@ in {
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/oci_key.age) {
+        oci_key = {
+          file = ../../secrets/oci_key.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/oci_config.age) {
+        oci_config = {
+          file = ../../secrets/oci_config.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
       };
   };
 

secrets/secrets.nix

@@ -19,4 +19,6 @@ in {
   "secrets/cloudflare_worker_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/cloudflare_dns_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/oci_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/oci_config.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
 }