Move Hydra to a new server
Eelco Dolstra committed
Jul 19, 2019 at 11:07 UTC
0fbb3159d5d0236a1c9cfe0d14ae587816ab1da8
5 files changed
+67
-25
delft/ceres.nix
new
+49
@@ -0,0 +1,49 @@
1
+{ nodes, config, lib, pkgs, ... }:
2
+
3
+{
4
+ imports =
5
+ [ ./common.nix
6
+ ./hydra.nix
7
+ ./hydra-proxy.nix
8
+ ./fstrim.nix
9
+ ../modules/wireguard.nix
10
+ ./packet-importer.nix
11
+ ];
12
+
13
+ deployment.targetEnv = "hetzner";
14
+ deployment.hetzner.mainIPv4 = "46.4.66.184";
15
+
16
+ deployment.hetzner.partitions = ''
17
+ clearpart --all --initlabel --drives=nvme0n1,nvme1n1
18
+
19
+ part raid.1 --ondisk=nvme0n1 --size=16384
20
+ part raid.2 --ondisk=nvme1n1 --size=16384
21
+
22
+ part raid.3 --grow --ondisk=nvme0n1
23
+ part raid.4 --grow --ondisk=nvme1n1
24
+
25
+ raid swap --level=1 --device=md0 --fstype=swap --label=root raid.1 raid.2
26
+ raid / --level=1 --device=md1 --fstype=ext4 --label=root raid.3 raid.4
27
+ '';
28
+
29
+ networking = {
30
+ firewall.allowedTCPPorts = [ 80 443 ];
31
+ firewall.allowPing = true;
32
+ firewall.logRefusedConnections = true;
33
+ };
34
+
35
+ services.hydra-dev.dbi = "dbi:Pg:dbname=hydra;host=10.254.1.2;user=hydra;";
36
+
37
+ nix.gc.automatic = true;
38
+ nix.gc.options = ''--max-freed "$((100 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
39
+ nix.gc.dates = "03,09,15,21:15";
40
+
41
+ nix.extraOptions = "gc-keep-outputs = false";
42
+
43
+ networking.defaultMailServer.directDelivery = lib.mkForce false;
44
+ #services.postfix.enable = true;
45
+ #services.postfix.hostname = "hydra.nixos.org";
46
+
47
+ # Don't rate-limit the journal.
48
+ services.journald.rateLimitBurst = 0;
49
+}
delft/chef.nix
+7
-21
@@ -3,13 +3,9 @@
3
{
4
imports =
5
[ ./common.nix
6
- ./hydra.nix
7
- ./hydra-proxy.nix
6
./datadog.nix
7
./fstrim.nix
10
- ./provisioner.nix
8
../modules/wireguard.nix
12
- ./packet-importer.nix
9
];
10
11
deployment.targetEnv = "hetzner";
@@ -19,6 +15,8 @@
15
enable = true;
16
package = pkgs.postgresql95;
17
extraConfig = ''
18
+ listen_addresses = '10.254.1.2'
19
+
20
log_min_duration_statement = 5000
21
log_duration = off
22
log_statement = 'none'
@@ -35,32 +33,20 @@
33
34
effective_cache_size = 16GB
35
'';
36
+ # FIXME: don't use 'trust'.
37
+ authentication = ''
38
+ host hydra all 10.254.1.3/32 trust
39
+ '';
40
};
41
42
networking = {
41
-
42
- firewall.allowedTCPPorts = [ 80 443 ];
43
+ firewall.interfaces.wg0.allowedTCPPorts = [ 5432 ];
44
firewall.allowPing = true;
45
firewall.logRefusedConnections = true;
45
-
46
};
47
48
- nix.gc.automatic = true;
49
- nix.gc.options = ''--max-freed "$((100 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
50
- nix.gc.dates = "03,09,15,21:15";
51
-
52
- nix.extraOptions = "gc-keep-outputs = false";
53
-
54
- networking.defaultMailServer.directDelivery = lib.mkForce false;
55
- #services.postfix.enable = true;
56
- #services.postfix.hostname = "hydra.nixos.org";
57
-
58
- # Don't rate-limit the journal.
59
- services.journald.rateLimitBurst = 0;
60
-
48
fileSystems."/data" =
49
{ device = "/dev/disk/by-label/data";
50
fsType = "ext4";
51
};
65
-
52
}
delft/hydra.nix
+3
-4
@@ -51,7 +51,7 @@ in
51
# patchelf:master:3
52
xxx-jobset-repeats = nixos:reproducibility:1
53
54
- nar_buffer_size = 6442450944
54
+ nar_buffer_size = ${let gb = 10; in toString (gb * 1024 * 1024 * 1024)}
55
56
upload_logs_to_binary_cache = true
57
@@ -60,10 +60,9 @@ in
60
61
log_prefix = https://nix-cache.s3.amazonaws.com/
62
63
- evaluator_initial_heap_size = ${let gb = 11; in toString (gb * 1000 * 1000 * 1000)}
64
- evaluator_max_heap_size = ${let gb = 12; in toString (gb * 1000 * 1000 * 1000)}
63
+ evaluator_initial_heap_size = ${let gb = 20; in toString (gb * 1024 * 1024 * 1024)}
64
66
- max_concurrent_evals = 1
65
+ max_concurrent_evals = 2
66
'';
67
68
systemd.tmpfiles.rules =
delft/network.nix
+1
@@ -36,6 +36,7 @@ in {
36
packet-t2-4 = { deployment.targetHost = "147.75.98.145"; imports = [ ./packet/packet-t2-4.nix ./build-machines-common.nix ]; };
37
chef = import ./chef.nix;
38
eris = import ./eris.nix;
39
+ ceres = import ./ceres.nix;
40
41
mac1 = makeMac {
42
ip = "10.254.2.1";
modules/wireguard.nix
+7
@@ -20,6 +20,13 @@ let
20
publicKey = "Y/RHgJ7Znh9vyWlXd2g8p9Zz1YEE50TYgqDduluhjmU=";
21
};
22
23
+ ceres = {
24
+ ip = "10.254.1.3";
25
+ endpoint = "ceres.nixos.org";
26
+ port = 51820;
27
+ publicKey = "wkUjkjJtJ9yC1xh2pSbTfyuPkeUnvgxGIHFKxVCGJT8=";
28
+ };
29
+
30
mac1 = {
31
ip = "10.254.2.1";
32
publicKey = "IiGbZ3l+IYWP/nOjPBhUL0oBh2XJAtUD5DToM9FhTTE=";