@cryptotaxi247 / infra-1 / commits / 547b4c74

Move tarball mirror to bastion

Eelco Dolstra committed Jul 4, 2018 at 18:19 UTC 547b4c74b0be412176d789f8140676a78e14f2b2
6 files changed +52 -27
bastion/network.nix
+13
@@ -2,6 +2,7 @@ let
2 region = "eu-west-1";
3 zone = "eu-west-1a";
4 accessKeyId = "lb-nixos";
5 + sshKeys = import ../ssh-keys.nix;
6 in
7
8 {
@@ -91,5 +92,17 @@ in
92 deployment.ec2.associatePublicIpAddress = true;
93 deployment.ec2.ebsInitialRootDiskSize = 40;
94 deployment.ec2.elasticIPv4 = resources.elasticIPs."bastion.nixos.org";
95 +
96 + imports =
97 + [ ../modules/common.nix
98 + ../modules/tarball-mirror.nix
99 + ];
100 +
101 + users.extraUsers.tarball-mirror.openssh.authorizedKeys.keys = [ sshKeys.eelco ];
102 +
103 + environment.systemPackages = [ pkgs.git ];
104 +
105 + nix.gc.automatic = true;
106 + nix.gc.dates = "hourly";
107 };
108 }
delft/common.nix
+5 -19
@@ -1,25 +1,19 @@
1 -{ config, pkgs, ... }:
1 +{ config, pkgs, lib, ... }:
2
3 -with pkgs.lib;
3 +with lib;
4
5 {
6 imports =
7 [ ./static-net-config.nix
8 ./diffoscope.nix
9 (builtins.fetchGit https://github.com/edolstra/dwarffs + "/module.nix")
10 + ../modules/common.nix
11 ];
12
13 system.stateVersion = "14.12";
14
15 nixpkgs.config.allowUnfree = true;
16
16 - time.timeZone = "Europe/Amsterdam";
17 -
18 - users.mutableUsers = false;
19 -
20 - users.extraUsers.root.openssh.authorizedKeys.keys =
21 - with import ../ssh-keys.nix; [ eelco rob ];
22 -
17 services.openssh.authorizedKeysFiles = mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
18
19 services.openssh.extraConfig =
@@ -27,8 +21,6 @@ with pkgs.lib;
21 PubkeyAcceptedKeyTypes +ssh-dss
22 '';
23
30 - #boot.kernelPackages = pkgs.linuxPackages_3_14;
31 -
24 boot.kernelModules = [ "coretemp" ];
25
26 # Prevent "out of sync" errors on the KVM switch.
@@ -41,8 +33,8 @@ with pkgs.lib;
33 hardware.cpu.intel.updateMicrocode = true;
34
35 environment.systemPackages =
44 - [ pkgs.emacs pkgs.subversion pkgs.sysstat pkgs.hdparm pkgs.sdparm # pkgs.lsiutil
45 - pkgs.htop pkgs.sqlite pkgs.iotop pkgs.lm_sensors pkgs.gitFull pkgs.hwloc
36 + [ pkgs.emacs pkgs.sysstat pkgs.hdparm pkgs.sdparm # pkgs.lsiutil
37 + pkgs.htop pkgs.sqlite pkgs.iotop pkgs.lm_sensors pkgs.hwloc
38 pkgs.lsof pkgs.numactl pkgs.gcc pkgs.smartmontools pkgs.tcpdump pkgs.gdb
39 pkgs.elfutils
40 ];
@@ -54,19 +46,13 @@ with pkgs.lib;
46
47 nix.package = pkgs.nixUnstable;
48
57 - nix.useSandbox = true;
58 -
49 nix.nrBuildUsers = 100;
50
61 - nix.buildCores = 0;
62 -
51 nix.extraOptions =
52 ''
53 allowed-impure-host-deps = /etc/protocols /etc/services /etc/nsswitch.conf
54 '';
55
68 - nix.nixPath = [ "nixpkgs=channel:nixos-18.03-small" ];
69 -
56 networking.defaultMailServer = {
57 directDelivery = true;
58 hostName = "smtp.tudelft.nl";
modules/common.nix new
+23
@@ -0,0 +1,23 @@
1 +{ config, pkgs, lib, ... }:
2 +
3 +with lib;
4 +
5 +{
6 + time.timeZone = "Europe/Amsterdam";
7 +
8 + users.mutableUsers = false;
9 +
10 + users.extraUsers.root.openssh.authorizedKeys.keys =
11 + with import ../ssh-keys.nix; [ eelco rob ];
12 +
13 + nix.useSandbox = true;
14 + nix.buildCores = 0;
15 + nix.nixPath = [ "nixpkgs=channel:nixos-18.03-small" ];
16 +
17 + environment.systemPackages =
18 + [ pkgs.emacs
19 + pkgs.git
20 + pkgs.gdb
21 + ];
22 +
23 +}
modules/tarball-mirror.nix renamed
+9 -6
@@ -8,7 +8,7 @@ with lib;
8
9 let
10
11 - nixosRelease = "17.09";
11 + nixosRelease = "18.03";
12
13 in
14
@@ -18,7 +18,6 @@ in
18 { description = "Nixpkgs tarball mirroring user";
19 home = "/home/tarball-mirror";
20 isNormalUser = true;
21 - openssh.authorizedKeys.keys = with import ../ssh-keys.nix; [ eelco ];
21 };
22
23 systemd.services.mirror-tarballs =
@@ -30,14 +29,18 @@ in
29 serviceConfig.PrivateTmp = true;
30 script =
31 ''
33 - cd /home/tarball-mirror/nixpkgs
34 - git remote update channels
35 - git checkout channels/nixos-${nixosRelease}
32 + dir=/home/tarball-mirror/nixpkgs-channels
33 + if ! [[ -e $dir ]]; then
34 + git clone git://github.com/NixOS/nixpkgs-channels.git $dir
35 + fi
36 + cd $dir
37 + git remote update origin
38 + git checkout origin/nixos-${nixosRelease}
39 # FIXME: use IAM role.
40 export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
41 export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
42 NIX_PATH=nixpkgs=. ./maintainers/scripts/copy-tarballs.pl \
40 - --expr '(import <nixpkgs/pkgs/top-level/release.nix> { scrubJobs = false; })' \
43 + --expr 'import <nixpkgs/maintainers/scripts/all-tarballs.nix>' \
44 --exclude 'registry.npmjs.org|mirror://kde|mirror://xorg|mirror://kernel|mirror://hackage|mirror://gnome|mirror://apache|mirror://mozilla|pypi.python.org'
45 '';
46 startAt = "05:30";
nixos-org/network.nix
+1 -1
@@ -303,7 +303,7 @@ in
303
304 system.stateVersion = "17.09";
305
306 - imports = [ ./webserver.nix ./hydra-mirror.nix ./tarball-mirror.nix ];
306 + imports = [ ./webserver.nix ./hydra-mirror.nix ];
307 };
308
309 }
ssh-keys.nix
+1 -1
@@ -1,6 +1,6 @@
1 {
2
3 - eelco = "ssh-dss AAAAB3NzaC1kc3MAAACBAOo3foMFsYvc+LEVVTAeXpaxdOFG6O2NE9coxZYN6UtwE477GwkvZ4uKymAekq3TB8I6dDg4QFfE27fIip/rQHJ/Rus+KsxwnTbwPzE0WcZVpkKQsepsoqLkfwMpiPfn5/oxcnJsimwRY/E95aJmmOHdGaYWrc0t4ARa+6teUgdFAAAAFQCSQq2Wil0/X4hDypGGUKlKvYyaWQAAAIAy/0fSDnz1tZOQBGq7q78y406HfWghErrVlrW9g+foJQG5pgXXcdJs9JCIrlaKivUKITDsYnQaCjrZaK8eHnc4ksbkSLfDOxFnR5814ulCftrgEDOv9K1UU3pYketjFMvQCA2U48lR6jG/99CPNXPH55QEFs8H97cIsdLQw9wM4gAAAIEAmzWZlXLzIf3eiHQggXqvw3+C19QvxQITcYHYVTx/XYqZi1VZ/fkY8bNmdcJsWFyOHgEhpEca+xM/SNvH/14rXDmt0wtclLEx/4GVLi59hQCnnKqv7HzJg8RF4v6XTiROBAEEdb4TaFuFn+JCvqPzilTzXTexvZKJECOvfYcY+10= eelco.dolstra@logicblox.com";
3 + eelco = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAnI5L6oCgFyvEesL04LnbnH1TBhegq1Yery6TNlIRAA edolstra@gmail.com";
4
5 rob = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHp3/OZP2nRS5bM9E1xN8Q2L398kC+m4guORjKsmGjwnnHvYnTml5puE2ogl8Wdenbk7hf82+vKyB+Tktrhx+IBSym4lY+czR6W+39hlPYdLbi980yxYT9KEMSyMWJEgPVJ1BZvHqsHQiad/L3eoPmAIMDmcn4mLh9rya5/oMW/ZgsA6j28ClvWkDRyaTmTLOa0Im4nLoSbdo8kJqU+JX/YcXlMKUvFfdMcj4T9YYwV98LPWHnEHFmjtBBUXRUAIESMXS6pm3Pep3czkKUL4UF0u9f17b40OWlLOF4IQWE2jM9yK09DiIQUzeU2XKRNW116DnmDL5QIRNrYnhkYeeQI3U6WnVTPdTU9kBVTDjhM+6U6/LClGJaWiglwwrzHtVELHgMi280qRefQEftb4CI/IbcPNAxetJevV68I5NAjfdnmMx8YbhfIiEqAJtBi4TvoH7HjDH+72+ZFjQ10fpz/p+DgUtiNlRKz8tXSZ+mbLuhmOJOxtGQTH3viYbSpG/4F9uKW1ekX0RMyRxVvpjMxHtCL4daJI4RTHFXy4R16OKAlYe7gs9sqv7O0IujLJPex/rnN2U4syGaSH5q3UnGxci6qgn8yLEhSP+Gj0xdv5H3fVjr/kNNZGWDOz6nDUaJT+eWlmWU7hOvm0ricrz9GEPUTQ0Rh70sWTQFq3poWQ== cardno:000606167509";
6