Compare commits
43 Commits
| Author | SHA1 | Date |
|---|---|---|
 Linus Heckemann
|
86ae720a2a | 1 year ago |
 Julien Malka
|
df7c5aa2f9 | 1 year ago |
Raito Bezarius
|
80099f64ab | 1 year ago |
|
Raito Bezarius
|
5a1aa0eef7 | 1 year ago |
|
Raito Bezarius
|
8d57383bc3 | 1 year ago |
|
Julien Malka
|
3dcb366c3b | 1 year ago |
|
Julien Malka
|
b152bd7826 | 1 year ago |
|
Raito Bezarius
|
279344c454 | 1 year ago |
|
Raito Bezarius
|
39134145c0 | 1 year ago |
|
Raito Bezarius
|
07e223048d | 1 year ago |
 gabriel-doriath-dohler
|
eff88f398d | 1 year ago |
|
Raito Bezarius
|
47e322b416 | 1 year ago |
|
Raito Bezarius
|
6228f5a2df | 1 year ago |
|
Raito Bezarius
|
6eec25d2bb | 1 year ago |
|
Raito Bezarius
|
69aac159fa | 1 year ago |
|
Raito Bezarius
|
7c1ab12829 | 1 year ago |
|
Julien Malka
|
6ae5f622fb | 1 year ago |
|
Julien Malka
|
e460e8ca8a | 1 year ago |
|
Raito Bezarius
|
62e37c45ea | 1 year ago |
|
Raito Bezarius
|
a812707b62 | 1 year ago |
|
Raito Bezarius
|
85154e3d19 | 1 year ago |
|
Raito Bezarius
|
38e86907c8 | 1 year ago |
|
Raito Bezarius
|
0e8785863e | 1 year ago |
|
Raito Bezarius
|
ada25e575f | 1 year ago |
|
Raito Bezarius
|
14ec5cc6fe | 1 year ago |
|
Julien Malka
|
65c58a00bb | 1 year ago |
|
Raito Bezarius
|
88873083d5 | 1 year ago |
|
Raito Bezarius
|
d9d32e0194 | 1 year ago |
|
Raito Bezarius
|
567b99aa57 | 1 year ago |
|
Raito Bezarius
|
81cf3e0769 | 1 year ago |
|
Julien Malka
|
ebea10d242 | 1 year ago |
|
Julien Malka
|
c208537f49 | 1 year ago |
|
Raito Bezarius
|
8d187d1ef0 | 1 year ago |
|
Raito Bezarius
|
444a655fec | 1 year ago |
|
Raito Bezarius
|
e3f59ee35f | 1 year ago |
|
Julien Malka
|
147ca052d4 | 1 year ago |
|
Julien Malka
|
c898d56781 | 1 year ago |
|
Raito Bezarius
|
5e9b7b7732 | 1 year ago |
|
Raito Bezarius
|
7fd10c28cb | 1 year ago |
|
Raito Bezarius
|
02fa2102d6 | 1 year ago |
 Tom Hubrecht
|
820adcfa31 | 1 year ago |
|
Tom Hubrecht
|
379d764490 | 1 year ago |
|
Raito Bezarius
|
696929edb4 | 1 year ago |
@ -0,0 +1 @@
|
||||
.direnv
|
||||
@ -1,13 +1,53 @@
|
||||
{ lib, ... }:
|
||||
let
|
||||
gcc-system-features = arch: lib.optionals (arch != null) ([ "gccarch-${arch}" ]
|
||||
++ map (x: "gccarch-${x}") lib.systems.architectures.inferiors.${arch});
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../modules/ipmi-supermicro.nix
|
||||
../modules/hardware/supermicro-H12SSL-i.nix
|
||||
../modules/iperf-server.nix
|
||||
../modules/hypervisor.nix
|
||||
../modules/hydra/coordinator.nix
|
||||
../modules/android-cache.nix
|
||||
../modules/garage.nix
|
||||
../modules/users/friends.nix
|
||||
];
|
||||
|
||||
networking.hostName = "epyc";
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Open public access to our PostgreSQL.
|
||||
services.postgresql.enableTCPIP = true;
|
||||
services.postgresql.authentication = ''
|
||||
host hydra-nixos-org hydra_ro ::/0 trust
|
||||
'';
|
||||
networking.firewall.allowedTCPPorts = [ 5432 ];
|
||||
|
||||
virtualisation.nvisor.vms = {
|
||||
vm01 = {
|
||||
config = { pkgs, ... }: {
|
||||
environment.systemPackages = [ pkgs.hello ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nix.buildMachines = [
|
||||
{ hostName = "localhost";
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"riscv64-linux"
|
||||
];
|
||||
supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ] ++ gcc-system-features "znver3";
|
||||
maxJobs = 2;
|
||||
}
|
||||
];
|
||||
|
||||
boot.binfmt.emulatedSystems = [ "riscv64-linux" "aarch64-linux" "riscv64-linux" ];
|
||||
|
||||
simd.arch = "znver3";
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
||||
@ -0,0 +1,14 @@
|
||||
{ lib, ... }:
|
||||
let
|
||||
mirrors = {
|
||||
"https://android.googlesource.com" = "/var/lib/src/aosp/mirror";
|
||||
"https://github.com/LineageOS" = "/var/lib/src/lineageos/LineageOS";
|
||||
"https://github.com/TheMuppets" = "/var/lib/src/themuppets/TheMuppets";
|
||||
};
|
||||
in
|
||||
{
|
||||
nix.envVars.ROBOTNIX_GIT_MIRRORS = lib.concatStringsSep "|" (lib.mapAttrsToList (local: remote: "${local}=${remote}") mirrors);
|
||||
|
||||
# Also add local mirrors to nix sandbox exceptions
|
||||
nix.sandboxPaths = lib.attrValues mirrors;
|
||||
}
|
||||
@ -0,0 +1,59 @@
|
||||
{ lib, pkgs, config, inputs, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.luj.buildbot;
|
||||
port = "1810";
|
||||
package = pkgs.buildbot-worker;
|
||||
python = package.pythonModule;
|
||||
home = "/var/lib/buildbot-worker";
|
||||
buildbotDir = "${home}/worker";
|
||||
in
|
||||
{
|
||||
#buildbot worker
|
||||
|
||||
# nix.settings.allowed-users = [ "buildbot-worker" ];
|
||||
nix.settings.trusted-users = [ "buildbot-worker" ];
|
||||
users.users.buildbot-worker = {
|
||||
description = "Buildbot Worker User.";
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
home = "/var/lib/buildbot-worker";
|
||||
group = "buildbot-worker";
|
||||
useDefaultShell = true;
|
||||
};
|
||||
users.groups.buildbot-worker = { };
|
||||
|
||||
systemd.services.buildbot-worker = {
|
||||
reloadIfChanged = true;
|
||||
description = "Buildbot Worker.";
|
||||
after = [ "network.target" "buildbot-master.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = [
|
||||
pkgs.nix-eval-jobs
|
||||
pkgs.git
|
||||
pkgs.gh
|
||||
pkgs.nix
|
||||
pkgs.nix-output-monitor
|
||||
inputs.attic.packages.x86_64-linux.attic
|
||||
];
|
||||
environment.PYTHONPATH = "${python.withPackages (_: [package])}/${python.sitePackages}";
|
||||
environment.MASTER_URL = ''TCP:2a01\\:e34\\:ec2a\\:8e60\\:8ec7\\:b5d2\\:f663\\:a67a:9989'';
|
||||
environment.BUILDBOT_DIR = buildbotDir;
|
||||
environment.WORKER_PASSWORD_FILE = "/var/lib/buildbot-worker/password.txt";
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "buildbot-worker";
|
||||
Group = "buildbot-worker";
|
||||
WorkingDirectory = home;
|
||||
|
||||
# Restart buildbot with a delay. This time way we can use buildbot to deploy itself.
|
||||
ExecReload = "+${pkgs.systemd}/bin/systemd-run --on-active=60 ${pkgs.systemd}/bin/systemctl restart buildbot-worker";
|
||||
ExecStart = "${python.pkgs.twisted}/bin/twistd --nodaemon --pidfile= --logfile - --python ${./worker.py}";
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,58 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import multiprocessing
|
||||
import os
|
||||
import socket
|
||||
from io import open
|
||||
|
||||
from buildbot_worker.bot import Worker
|
||||
from twisted.application import service
|
||||
|
||||
|
||||
def require_env(key: str) -> str:
|
||||
val = os.environ.get(key)
|
||||
assert val is not None, "val is not set"
|
||||
return val
|
||||
|
||||
|
||||
def setup_worker(application: service.Application, id: int) -> None:
|
||||
basedir = f"{require_env('BUILDBOT_DIR')}-{id}"
|
||||
os.makedirs(basedir, mode=0o700, exist_ok=True)
|
||||
|
||||
master_url = require_env("MASTER_URL")
|
||||
hostname = socket.gethostname()
|
||||
workername = f"{hostname}-{id}"
|
||||
|
||||
with open(
|
||||
require_env("WORKER_PASSWORD_FILE"), "r", encoding="utf-8"
|
||||
) as passwd_file:
|
||||
passwd = passwd_file.read().strip("\r\n")
|
||||
keepalive = 600
|
||||
umask = None
|
||||
maxdelay = 300
|
||||
numcpus = None
|
||||
allow_shutdown = None
|
||||
|
||||
s = Worker(
|
||||
"2a01:e34:ec2a:8e60:8ec7:b5d2:f663:a67a",
|
||||
9989,
|
||||
workername,
|
||||
passwd,
|
||||
basedir,
|
||||
keepalive,
|
||||
umask=umask,
|
||||
maxdelay=maxdelay,
|
||||
numcpus=numcpus,
|
||||
allow_shutdown=allow_shutdown,
|
||||
)
|
||||
s.setServiceParent(application)
|
||||
|
||||
|
||||
# note: this line is matched against to check that this is a worker
|
||||
# directory; do not edit it.
|
||||
application = service.Application("buildbot-worker")
|
||||
|
||||
for i in range(14):
|
||||
setup_worker(application, i)
|
||||
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
{ pkgs, ... }: {
|
||||
services.garage = {
|
||||
enable = true;
|
||||
package = pkgs.garage_0_8;
|
||||
settings = {
|
||||
db_engine = "lmdb";
|
||||
block_size = (10 * 1024 * 1024); # 10MB
|
||||
replication_mode = "none";
|
||||
rpc_bind_addr = "[::1]:3901";
|
||||
rpc_public_addr = "[::1]:3901";
|
||||
rpc_secret = "f5b8ede0abe0a3d454d96e8b352e29a1d94522b64274d23b256d57482441ccc1";
|
||||
|
||||
s3_api = {
|
||||
s3_region = "garage";
|
||||
api_bind_addr = "[::1]:3900";
|
||||
root_domain = ".s3.infra.newtype.fr";
|
||||
};
|
||||
|
||||
s3_web = {
|
||||
bind_addr = "[::1]:3902";
|
||||
root_domain = ".web.infra.newtype.fr";
|
||||
index = "index.html";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."s3.infra.newtype.fr" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/".proxyPass = "http://[::1]:3900/";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
}
|
||||
@ -0,0 +1,81 @@
|
||||
{ pkgs, ... }: {
|
||||
services.hydra = {
|
||||
enable = true;
|
||||
hydraURL = "https://hydra.newtype.fr";
|
||||
notificationSender = "hydra@localhost";
|
||||
buildMachinesFiles = [ "/etc/nix/machines" ];
|
||||
useSubstitutes = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = [ pkgs.nix-prefetch-git ];
|
||||
nix.trustedUsers = [ "hydra" "hydra-www" ];
|
||||
|
||||
services.postgresql = {
|
||||
enableJIT = true;
|
||||
settings = {
|
||||
checkpoint_completion_target = "0.9";
|
||||
default_statistics_target = 100;
|
||||
|
||||
max_connections = 500;
|
||||
work_mem = "20MB";
|
||||
maintenance_work_mem = "2GB";
|
||||
|
||||
shared_buffers = "8GB";
|
||||
|
||||
min_wal_size = "1GB";
|
||||
max_wal_size = "2GB";
|
||||
wal_buffers = "16MB";
|
||||
|
||||
max_worker_processes = 16;
|
||||
max_parallel_workers_per_gather = 8;
|
||||
max_parallel_workers = 16;
|
||||
|
||||
# NVMe related performance tuning
|
||||
effective_io_concurrency = 200;
|
||||
random_page_cost = "1.1";
|
||||
|
||||
# We can risk losing some transactions.
|
||||
synchronous_commit = "off";
|
||||
|
||||
effective_cache_size = "16GB";
|
||||
|
||||
# autovacuum and autoanalyze much more frequently:
|
||||
# at these values vacuum should run approximately
|
||||
# every 2 mass rebuilds, or a couple times a day
|
||||
# on the builds table. Some of those queries really
|
||||
# benefit from frequent vacuums, so this should
|
||||
# help. In particular, I'm thinking the jobsets
|
||||
# pages.
|
||||
autovacuum_vacuum_scale_factor = 0.002;
|
||||
autovacuum_analyze_scale_factor = 0.001;
|
||||
|
||||
shared_preload_libraries = "pg_stat_statements";
|
||||
compute_query_id = "on";
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "ryan@lahfa.xyz";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
recommendedZstdSettings = true;
|
||||
recommendedBrotliSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation =true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."hydra.newtype.fr" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
# TODO: remove compression for some locations
|
||||
locations."/".proxyPass = "http://localhost:3000";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
}
|
||||
@ -0,0 +1,5 @@
|
||||
{ ... }: {
|
||||
virtualisation.nvisor = {
|
||||
enable = true;
|
||||
};
|
||||
}
|
||||
@ -0,0 +1,6 @@
|
||||
{ ... }: {
|
||||
services.iperf3 = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
}
|
||||
@ -0,0 +1,36 @@
|
||||
{
|
||||
programs.ssh.extraConfig = ''
|
||||
Host telecom-bastion
|
||||
HostName ssh.enst.fr
|
||||
User jmalka
|
||||
IdentityFile /home/luj/.ssh/id_ed25519
|
||||
|
||||
Host lame11
|
||||
Hostname lame11.enst.fr
|
||||
User nix-remote-builder
|
||||
ProxyJump telecom-bastion
|
||||
IdentityFile /home/luj/.ssh/id_ed25519
|
||||
Host lame10
|
||||
Hostname lame10.enst.fr
|
||||
User nix-remote-builder
|
||||
ProxyJump telecom-bastion
|
||||
IdentityFile /home/luj/.ssh/id_ed25519
|
||||
Host lame12
|
||||
Hostname lame12.enst.fr
|
||||
User nix-remote-builder
|
||||
ProxyJump telecom-bastion
|
||||
IdentityFile /home/luj/.ssh/id_ed25519
|
||||
Host lame16
|
||||
Hostname lame16.enst.fr
|
||||
User nix-remote-builder
|
||||
ProxyJump telecom-bastion
|
||||
IdentityFile /home/luj/.ssh/id_ed25519
|
||||
Host lame17
|
||||
Hostname lame17.enst.fr
|
||||
User nix-remote-builder
|
||||
ProxyJump telecom-bastion
|
||||
IdentityFile /home/luj/.ssh/id_ed25519
|
||||
|
||||
'';
|
||||
|
||||
}
|
||||
@ -0,0 +1,28 @@
|
||||
{ ... }:
|
||||
let
|
||||
trustedFriendGroups = [
|
||||
"production-hydra-db"
|
||||
];
|
||||
in
|
||||
{
|
||||
users.users = {
|
||||
ninjatrappeur = {
|
||||
isNormalUser = true;
|
||||
home = "/home/ninjatrappeur";
|
||||
shell = "/run/current-system/sw/bin/zsh";
|
||||
uid = 2000;
|
||||
extraGroups = trustedFriendGroups;
|
||||
openssh.authorizedKeys.keyFiles = [ ./keys/ninjatrappeur.keys ];
|
||||
};
|
||||
linus = {
|
||||
isNormalUser = true;
|
||||
home = "/home/linus";
|
||||
shell = "/run/current-system/sw/bin/zsh";
|
||||
uid = 2001;
|
||||
# Raito: I allowed linus to be root to get some stuff done
|
||||
# on behalf of me.
|
||||
extraGroups = [ "wheel" ] ++ trustedFriendGroups;
|
||||
openssh.authorizedKeys.keyFiles = [ ./keys/linus.keys ];
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1 +1,2 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICE7TN5NQKGojNGIeTFiHjLHTDQGT8i05JFqX/zLW2zc
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIqnCNhMl5KgERtpFAVUjd11JDsf0uQ/8NY5sj4tnjw5
|
||||
|
||||
@ -0,0 +1,4 @@
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDf7hGFfUHhtgYY0G/Dh9isjIxkvUjlAKAMvLIZs5NLXwEfnxDTVZW/ijfF2qDozAmYQHZqbeyhJX7YlO6nYjWRBxqBeqAMHhtu3PkiysSCCUymhJ2uDHUAox+BT8IGE3sCKYIXRdmSFoibgQad9AHsQ6OLoIaNgMV7rspdBcO/CjyCkHN440XhQKz/Sq2SyygI9Qkuz0qDdQOgIraVi//EXDAvij0QXlkmh+3xBJwEqt8Pe1KP9itwvGyzGX/aAheCBSf7HPcLzJUgcWymW6FL4AE0KqNVb8Q8ahaEM5UgbXUCauDON8H4OR1Zngszw128wklwxOr7q5gB++Ks1OQlHMGgiVYZ2wC0DXlx68BKSMNnJRHWCI4r63a3bAWGCqKbcCHpimjPAHisPoaoHffVUaIpj65klj+GkoHAgo/pl0S6o4OqVpOau3Qkn95D1KDbUiE1l0HdgZaRmOKRvTKec1V3tfB2rA83Q1cZCWC5ZSwk3wihYPywMyIo6G8f2M2bFot7k/sS9ZMSle6oZDrc6A8qWnaxMZYbEXdFGy02550vdymshJ9RpSLfK1oBKoKk7yL2hk1UHm6obXYXn/F0KvDr7nAM6gOf9NnOrPHKt14WDb0GsZwNd34g1RCcBUcXewh4ZJOHerzsS2h3D30BNQUNCaF8ZQr6FYXp7v9gnQ==
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN3EmXYSXsimS+vlGYtfTkOGuwvkXU0uHd2yYKLOxD2F
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIJWYrcu8usyqdLv4XO4i5TPaQhB+lH3Xbu2uz64hQe3
|
||||
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICDgQA1A1uHJsqLsSLLkuWNlxXrpGRD6Qx11WBbfP+SmAAAAEXNzaDpsaW51c0BiZWl3ZXJr
|
||||
@ -0,0 +1,3 @@
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClF9ko5u4zf0CEvleEeRbo9r6BMNgXEGO/rDNZOEHcKxVaeIi+/xF6ZQ5MZbcmH08lswq32hb1XwXg7Gk+ofUdEvCD/kC/vJijt7IFkardy6BNOSWQJLEf6/BpL3LzDQhi7iZXPF46VYoPVGHBh8fKQaAtOCrhbf/8JutfTwCglEztjoiQxY5b8OMfntjBSl6TJwZPJAoQllbJJz9q90sBetvqx6Y08eqIzsSZw6pznpvivRR+TSKU0EkVYS2y2zBAvPK6oyunj5zi01/FACT+Qn70dUkumZAvcPssbl0hCs/xDLgEL6hCEvoszodyMYVn7HS0KwfUlfiGdNUOFHIl
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHzd1XAB7Pc8Tplur5iV3llOXtvlHru8pLtQlbvHzmt1
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOE7oDtq+xt5RuvMigDZMeZQODFr5Otz6HCO8wnI80oo
|
||||
@ -1 +1,2 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn thubrecht@dell-xps
|
||||
|
||||
Loading…
Reference in New Issue