hydra: cleanup
- Merge options - Clean up stale SSH hosts - Update *.foundation.detsys.dev SSH CA
Martin Weinelt committed
Dec 11, 2024 at 02:25 UTC
270871c5736e603cc1d1b503de8a41a29a4fe624
1 file changed
+27
-137
build/hydra.nix
+27
-137
@@ -46,10 +46,6 @@ in
46
# Don't rate-limit the journal.
47
services.journald.rateLimitBurst = 0;
48
49
- systemd.services.hydra-queue-runner = {
50
- serviceConfig.ManagedOOMPreference = "avoid";
51
- };
52
-
49
age.secrets.hydra-aws-credentials = {
50
file = ./secrets/hydra-aws-credentials.age;
51
path = "/var/lib/hydra/queue-runner/.aws/credentials";
@@ -122,18 +118,22 @@ in
118
</hydra_notify>
119
'';
120
125
- # eats memory as if it was free
126
- systemd.services.hydra-notify.enable = false;
127
-
121
systemd.tmpfiles.rules = [
122
"d /var/cache/hydra 0755 hydra hydra - -"
123
"d ${narCache} 0775 hydra hydra 1d -"
124
];
125
133
- systemd.services.hydra-queue-runner.restartIfChanged = false;
134
- systemd.services.hydra-queue-runner.wantedBy = lib.mkForce [ ];
135
- systemd.services.hydra-queue-runner.requires = lib.mkForce [ ];
136
- systemd.services.hydra-queue-runner.serviceConfig.LimitNOFILE = 65535;
126
+ # eats memory as if it was free
127
+ systemd.services.hydra-notify.enable = false;
128
+
129
+ systemd.services.hydra-queue-runner = {
130
+ # restarting the scheduler is very expensive
131
+ restartIfChanged = false;
132
+ serviceConfig = {
133
+ ManagedOOMPreference = "avoid";
134
+ LimitNOFILE = 65535;
135
+ };
136
+ };
137
138
programs.ssh.hostKeyAlgorithms = [
139
"rsa-sha2-512-cert-v01@openssh.com"
@@ -144,140 +144,30 @@ in
144
programs.ssh.extraConfig = lib.mkAfter ''
145
ServerAliveInterval 120
146
TCPKeepAlive yes
147
-
148
- Host mac-m1-1
149
- Hostname 10.254.2.101
150
- Compression yes
151
-
152
- Host mac-m1-2
153
- Hostname 10.254.2.102
154
- Compression yes
155
-
156
- Host mac-m1-3
157
- Hostname 10.254.2.103
158
- Compression yes
159
-
160
- Host mac-m1-4
161
- Hostname 10.254.2.104
162
- Compression yes
163
-
164
- Host mac-m1-5
165
- Hostname 10.254.2.105
166
- Compression yes
167
-
168
- Host mac-m1-6
169
- Hostname 10.254.2.106
170
- Compression yes
171
-
172
- Host macstadium-x86-44911507
173
- Hostname 208.83.1.186
174
- Compression yes
175
-
176
- Host macstadium-x86-44911362
177
- Hostname 208.83.1.175
178
- Compression yes
179
-
180
- Host macstadium-x86-44911305
181
- Hostname 208.83.1.173
182
- Compression yes
183
-
184
- Host macstadium-m1-44911104
185
- Hostname 208.83.1.181
186
- Compression yes
187
-
188
- Host macstadium-m1-44911207
189
- Hostname 208.83.1.145
190
- Compression yes
147
'';
148
149
+ # These IPs and SSH public keys are specifically provisioned for Hydra
150
services.openssh.knownHosts = {
194
- "*.cloudscalehydra.detsys.dev" = {
151
+ # M1 Macs in North America
152
+ "*.foundation.detsys.dev" = {
153
certAuthority = true;
196
- publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6HhovazfX+rqm2YuOwgM1X16Z7bJpLLj4DXWUsuGGqG/OlwIyioVodKPd3dYwsltQD8W4YrWQCOXlqyV50xpngKJX6OXdDt0IWwwgHdW0bT/l+4Yd/B57PbSnXGKLwa7slBwMCGkxpivMwnkQm+1zfQEdVNX5UPiH6xwZSwgsaRHCpumpVUrLNWlWxI5+g3alez/mfp29bgSvMdnIu72Ykb8u0uKOvGVQY7UD9sVU00NSQ16m+NhvvFvVomIF6OXMinBkATuSsoa4jOIg4UTsS5mo8Up8RdZ1qyzxvqf874osn5sYkMVnRZ5G/0bmwdwyYs7mjKh3agt37Fnaj8obyfVRm9aRlKT+Gwc5U2XZF/AdhOq+TdRL2HgaNYwJspHYUQ2jm5YilOgcEfTOgunxDfMIGueqnM6nZoGe7EHA6affr8QLrOXEUVA9uwIMInpLWiDZXk74owDGhIpg8WBpWch+x3SqaLDwLlUYDseJR0BdH9al+UZW1eBinAiEVl6H7KzVLpLqYss38CWT9c7Cq/gltUuwIqgziXFCR4skXfpN5Ozg0Sr9OmkJbxHjGdOmMVT0VKC05KsUEkWW9J18WX3uN1O3Mqu7vWgK9VOqbsnsknP0oBSznniFZYblK0vRgcrKPMAGTZ7RMdTBbys28sj3HKY/CQPv08KV0xgOJQ==";
154
+ publicKey = "@cert-authority *.foundation.detsys.dev ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDBQ55ccEXJHIY9Cde6hSx26zTOju0RIXzuJL2uxmKrSc6l2SsZV3RsejfY3vp4Zhs/UVhk9VBkaiYY6bMg1SW6f9A0fBrPOSSytRwKgW/XCO605bdpNlGC5sKFGQAuOZfhFEeW9mInhjn1Pkz63gINrI3jWEM1mWJMKwLpstC2P0wXX3kWxQutPjIQrGqKP+TRiYdWcy+dWUFItXcBQkBRk+2xC24PL4s5JLGJffx/pNt+WnZqADIEu42WgrQiiz5OPGoGwlzDNgcWltuHdYaDtKU7bDY4wZxWa/HZGNju1vqLbVPai/Fo4EpONjKr4+EJpInxTpmjm4rcXHmCNmf2fEjZvbpXVcocj/NHp0IuusSLfMo3JfUTo6Vo5gyDjEETWDm1y++pWp5aZ0Dss1mJAbkUN/arMqIIj1RcmLFYf7p9Y1mE7axHZL3BFIlsHxAnZle+ouxPUSIstq9GrD1b3rIC03lTqEH0eTikEpoJAU3OIK5Eoi7vuJyDTtd8rzxPhsv3ScxBGJF6BRbyaaBsqjXWphxzlmzKvwH0psLoE3NuS46EQ5VXq4A4p0KgcuybccuxYMDSf81u96LSIm4f7yWZcE7+iXTollc3tn48uxWFSFNLxzo7RixmJ0R/cRPY6KlOUUJyurWO/bMxSc9rxCJpVrrr/0cMbBbEggICEw==";
155
};
156
199
- mac-m1-1 = {
200
- hostNames = [ "10.254.2.101" ];
201
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIpNE/evvR5mVLslm4G5AV6pQ2wdpIl7FPGDh5wZPLF";
202
- };
203
- mac-m1-2 = {
204
- hostNames = [ "10.254.2.102" ];
205
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDyGCqoDh+BWnV1NIV2ucyb0WsXz5fH2hKDgC1dhN+Wq";
206
- };
207
- mac-m1-3 = {
208
- hostNames = [ "10.254.2.103" ];
209
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtPVTcBWTENjQ3e9ry7pOTFHk316Ahm3VW1Ys0cMhVf";
210
- };
211
- mac-m1-4 = {
212
- hostNames = [ "10.254.2.104" ];
213
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOk2OLBHfCV3yxXzAsgX0r9cQ3KvpESak6s+tYGJq6J4";
214
- };
215
- mac-m1-5 = {
216
- hostNames = [ "10.254.2.105" ];
217
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbYjdeghSNg7bU/ER/pTSGwP7Fyd7+OteD06dP4gCfP";
218
- };
219
- mac-m1-6 = {
220
- hostNames = [ "10.254.2.106" ];
221
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8B5Ek8GhWCO5Qahl20CHn/txxvAweupuIbFmuLjciG";
222
- };
157
+ # M1 Macs at Hetzner
158
+ "intense-heron.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICeSgOe/cr1yVAJOl30t3AZOLtvzeQa5rnrHGceKeBue";
159
+ "sweeping-filly.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE6b/coXQEcFZW1eG4zFyCMCF0mZFahqmadz6Gk9DWMF";
160
+ "maximum-snail.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEs+fK4hH8UKo+Pa7u1VYltkMufBHHH5uC93RQ2S6Xy9";
161
+ "growing-jennet.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAQGthkSSOnhxrIUCMlRQz8FOo5Y5Nk9f9WnVLNeRJpm";
162
+ "enormous-catfish.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlg7NXxeG5L3s0YqSQIsqVG0MTyvyWDHUyYEfFPazLe";
163
224
- # These IPs and SSH public keys are specifically provisioned for Hydra
225
- "intense-heron.mac.nixos.org" = {
226
- hostNames = [
227
- "intense-heron.mac.nixos.org"
228
- "23.88.75.215"
229
- ];
230
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICeSgOe/cr1yVAJOl30t3AZOLtvzeQa5rnrHGceKeBue";
231
- };
232
- "sweeping-filly.mac.nixos.org" = {
233
- hostNames = [
234
- "sweeping-filly.mac.nixos.org"
235
- "142.132.141.35"
236
- ];
237
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE6b/coXQEcFZW1eG4zFyCMCF0mZFahqmadz6Gk9DWMF";
238
- };
239
- "maximum-snail.mac.nixos.org" = {
240
- hostNames = [
241
- "maximum-snail.mac.nixos.org"
242
- "23.88.76.161"
243
- ];
244
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEs+fK4hH8UKo+Pa7u1VYltkMufBHHH5uC93RQ2S6Xy9";
245
- };
246
- "growing-jennet.mac.nixos.org" = {
247
- hostNames = [
248
- "growing-jennet.mac.nixos.org"
249
- "23.88.76.75"
250
- ];
251
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAQGthkSSOnhxrIUCMlRQz8FOo5Y5Nk9f9WnVLNeRJpm";
252
- };
253
- "enormous-catfish.mac.nixos.org" = {
254
- hostNames = [
255
- "enormous-catfish.mac.nixos.org"
256
- "142.132.140.199"
257
- ];
258
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlg7NXxeG5L3s0YqSQIsqVG0MTyvyWDHUyYEfFPazLe";
259
- };
260
-
261
- "kind-lumiere.mac.nixos.org" = {
262
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFoqn1AAcOqtG65milpBtWVXP5VcBmTUSMGNfJzPwW8Q";
263
- };
264
- "eager-heisenberg.mac.nixos.org" = {
265
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBp9NStfEPu7HdeK8f2KEnynyirjG9BUk+6w2SgJtQyS";
266
- };
267
-
268
- t2m = {
269
- hostNames = [ "t2m.cunat.cz" ];
270
- publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP9351NRVeQYvNV1bBbC5MX0iSmrXhVcBYMcn6AMo11U2zlOYRqBPzGLPjz9u31t4FxHNovxCrkFTqJY9zbsmTs=";
271
- };
272
- t2a = {
273
- hostNames = [ "t2a.cunat.cz" ];
274
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIu3itg4hn5e4KrnyoreAUN3RIbAcvqc7yWx5i6EWqAu";
275
- };
276
- t4b = {
277
- hostNames = [ "t4b.cunat.cz" ];
278
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/jE8c0lkc/DlK3R7A+zBr6j/lfEQrhqSD/YOEVs8za";
279
- };
164
+ # M2 Macs at Oakhost
165
+ "kind-lumiere.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFoqn1AAcOqtG65milpBtWVXP5VcBmTUSMGNfJzPwW8Q";
166
+ "eager-heisenberg.mac.nixos.org".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBp9NStfEPu7HdeK8f2KEnynyirjG9BUk+6w2SgJtQyS";
167
168
+ # vcunat
169
+ "t2a.cunat.cz".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIu3itg4hn5e4KrnyoreAUN3RIbAcvqc7yWx5i6EWqAu";
170
+ "t4b.cunat.cz".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/jE8c0lkc/DlK3R7A+zBr6j/lfEQrhqSD/YOEVs8za";
171
};
172
173
}