dotfiles/nixng/containers/hydra/hydra.nix

135 lines
4 KiB
Nix
Raw Normal View History

{ makeSystem
, nixpkgs
, hydra
}:
makeSystem {
system = "x86_64-linux";
name = "nixng-hydra";
inherit nixpkgs;
config = { pkgs, config, lib, nglib, ... }:
{
config = {
dumb-init = {
enable = true;
type.services = {};
};
nix = {
package = pkgs.nixUnstable;
loadNixDb = true;
persistNix = "/nix-persist";
config = {
experimental-features = [ "nix-command" "flakes" ];
sandbox = true;
trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
substituters = [ "https://cache.nixos.org/" ];
ignored-acls = [ "system.nfs4_acl" ];
allowed-uris = [
"https://gitea.redalder.org"
"https://github.com"
"https://gitlab.com"
"https://git.sr.ht"
"https://raw.githubusercontent.com"
"https://media.forgecdn.net"
];
builders-use-substitutes = true;
builders = "@/etc/nix/machines";
};
};
services.hydra = {
enable = true;
package = hydra.packages.x86_64-linux.hydra;
hydraURL = "https://hydra.redalder.org";
notificationSender = "hydra@redalder.org";
useSubstitutes = true;
adjustNiceness = true;
minimumDiskFree = 200;
minimumDiskFreeEvaluator = 100;
dbiFile = "/local/dbi";
config.evaluator_max_memory_size = "2048M";
};
services.socklog = {
enable = true;
unix = "/dev/log";
};
init.services.pgpass = {
script = pkgs.writeShellScript "pgpass" ''
ln -nsf /secrets/pgpass /var/lib/hydra/pgpass
ln -nsf /secrets/pgpass-www /var/lib/hydra/pgpass-www
ln -nsf /secrets/pgpass-queue-runner /var/lib/hydra/pgpass-queue-runner
chown hydra:hydra /secrets/pgpass
chown hydra-www:hydra /secrets/pgpass-www
chown hydra-queue-runner:hydra /secrets/pgpass-queue-runner
sv down pgpass
'';
enabled = true;
};
services.crond.crontabs.autogc = {
jobs =
let
storegc = pkgs.writeShellScript "storegc"
''
nix-collect-garbage -d
'';
in
[
"0 4 * * * ${storegc}"
];
};
init.services.nix-daemon.environment.PATH = with pkgs; lib.makeBinPath [
utillinux
runit
busybox
openssh
gzip
];
system.activation =
let
machines = pkgs.writeText "machines" ''
eu.nixbuild.net x86_64-linux - 100 5 benchmark,big-parallel
'';
nix-machines = nglib.dag.dagEntryAnywhere ''
export PATH=${pkgs.busybox}/bin
mkdir -p /etc/nix
ln -s ${machines} /etc/nix/machines
'';
ssh_config = pkgs.writeText "ssh_config" ''
Host eu.nixbuild.net
PubkeyAcceptedKeyTypes ssh-ed25519
IdentityFile /ssh-key
'';
ssh_known_hosts = pkgs.writeText "ssh_known_hosts" ''
eu.nixbuild.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIQCZc54poJ8vqawd8TraNryQeJnvH1eLpIDgbiqymM
'';
ssh = nglib.dag.dagEntryAnywhere ''
export PATH=${pkgs.busybox}/bin
mkdir -p /etc/ssh
ln -s ${ssh_config} /etc/ssh/ssh_config
ln -s ${ssh_known_hosts} /etc/ssh/ssh_known_hosts
'';
ssh-key = nglib.dag.dagEntryAfter ["users"] ''
export PATH=${pkgs.busybox}/bin
cp /secrets/ssh-key /ssh-key
chmod 600 /ssh-key
chown hydra-queue-runner:root /ssh-key
'';
in
{
inherit ssh-key ssh nix-machines;
};
};
};
}