macs: reuse shared code with ofborg macs
This deduplicates code, simplifies maintenance and applies important workarounds to make Macs healthy builders with high throughput. Co-Authored-By: Jörg Thalheim <joerg@thalheim.io>
Martin Weinelt committed
May 17, 2026 at 16:37 UTC
57f225b1246625a4172ce9fac7e4df1ed5dff3e2
9 files changed
+120
-168
checks/flake-module.nix
+3
-2
@@ -6,8 +6,9 @@
6
# forcing evaluation of every configuration just to learn its system.
7
flake.ciSystems =
8
let
9
- nixos = names: lib.genAttrs names (n: self.nixosConfigurations.${n}.config.system.build.toplevel);
10
- darwin = names: lib.genAttrs names (n: self.darwinConfigurations.${n}.config.system.build.toplevel);
9
+ nixos = names: lib.genAttrs names (n: self.nixosConfigurations."${n}".config.system.build.toplevel);
10
+ darwin =
11
+ names: lib.genAttrs names (n: self.darwinConfigurations."${n}".config.system.build.toplevel);
12
in
13
{
14
ofborg-x86_64-linux = nixos [
keys.nix
+10
@@ -42,12 +42,22 @@ rec {
42
brianmcgee = [
43
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKHHl5kgMDNQA/zqK+AzT4SO09rfAp+y/EeUC+Ow5XqyNid5lm6sgLGM+AqZDx0jOrMKWhd5lhzGDdtsSf0Y8g4= brian@saturn"
44
];
45
+
46
+ janne = [
47
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35Bq87SBWrEcoDqrZFOXyAmV/PJrSSu3hl3TdVvo4C janne"
48
+ ];
49
+
50
+ conni2461 = [
51
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPK/3rYhlIzoPCsPK38PMdK1ivqPaJgUqWwRtmxdKZrO ✏️"
52
+ ];
53
};
54
55
groups = with ssh.users; {
56
infra-core = arianvp ++ hexa ++ mic92 ++ vcunat;
57
58
infra = ssh.groups.infra-core ++ jfly;
59
+
60
+ ofborg = ssh.groups.infra-core ++ janne ++ conni2461;
61
};
62
63
machines = {
macs/common/ofborg-queue-builder.nix
renamed
+2
-2
@@ -15,7 +15,7 @@
15
maxJobs = 2;
16
mtls = {
17
serverRootCaCertPath = ../non-critical-infra/hosts/staging-hydra/ca.crt;
18
- clientCertPath = "${./ofborg-ca/client-${config.networking.hostName}.crt}";
18
+ clientCertPath = "${../ofborg-ca/client-${config.networking.hostName}.crt}";
19
clientKeyPath = config.sops.secrets."queue-runner-client.key".path;
20
domainName = "queue-runner.staging-hydra.nixos.org";
21
};
@@ -23,6 +23,6 @@
23
24
sops.secrets."queue-runner-client.key" = {
25
owner = "hydra-queue-builder";
26
- sopsFile = ./secrets/${config.networking.hostName}.yml;
26
+ sopsFile = ../secrets/${config.networking.hostName}.yml;
27
};
28
}
macs/common/ofborg.nix
new
+41
@@ -0,0 +1,41 @@
1
+{
2
+ config,
3
+ inputs,
4
+ pkgs,
5
+ ...
6
+}:
7
+
8
+{
9
+ imports = [
10
+ ../../non-critical-infra/modules/ofborg/ofborg-config.nix
11
+ ];
12
+
13
+ # Manage user for ofborg, this enables creating/deleting users
14
+ # depending on what modules are enabled.
15
+ users = {
16
+ users.ofborg.home = "/private/var/lib/ofborg";
17
+ users.root = {
18
+ # bash doesn't export /run/current-system/sw/bin to $PATH,
19
+ # which we need for nix-store
20
+ shell = "/bin/zsh";
21
+ openssh.authorizedKeys.keys = (import ../../keys.nix).ssh.groups.ofborg;
22
+ };
23
+ };
24
+
25
+ services.ofborg = {
26
+ enable = true;
27
+ package = pkgs.ofborg;
28
+ configFile = "/etc/ofborg.json";
29
+ };
30
+
31
+ nixpkgs.overlays = [
32
+ (_self: super: {
33
+ ofborg = inputs.ofborg.packages.${super.stdenv.hostPlatform.system}.pkg;
34
+ })
35
+ ];
36
+
37
+ sops.secrets."ofborg/builder-rabbitmq-password" = {
38
+ owner = "ofborg";
39
+ sopsFile = ../secrets/${config.networking.hostName}.yml;
40
+ };
41
+}
macs/flake-module.nix
+45
-66
@@ -3,9 +3,9 @@
3
flake.darwinConfigurations =
4
let
5
mkNixDarwin =
6
- hostname: entrypoint:
6
+ hostname: entrypoint: args:
7
inputs.darwin.lib.darwinSystem {
8
- system = "aarch64-darwin";
8
+ system = args.system or "aarch64-darwin";
9
10
specialArgs = {
11
inherit inputs;
@@ -23,79 +23,58 @@
23
system.stateVersion = 5;
24
}
25
entrypoint
26
- ];
26
+ ]
27
+ ++ (args.extraModules or [ ]);
28
};
29
in
30
{
30
- bootstrap = mkNixDarwin "bootstrap" ./profiles/bootstrap.nix;
31
+ bootstrap = mkNixDarwin "bootstrap" ./profiles/bootstrap.nix { };
32
33
# M1 8C, 16G, 256G (Hetzner)
33
- enormous-catfish = mkNixDarwin "enormous-catfish" ./profiles/m1.nix;
34
- growing-jennet = mkNixDarwin "growing-jennet" ./profiles/m1.nix;
35
- intense-heron = mkNixDarwin "intense-heron" ./profiles/m1.nix;
36
- maximum-snail = mkNixDarwin "maximum-snail" ./profiles/m1.nix;
37
- sweeping-filly = mkNixDarwin "sweeping-filly" ./profiles/m1.nix;
34
+ enormous-catfish = mkNixDarwin "enormous-catfish" ./profiles/m1.nix { };
35
+ growing-jennet = mkNixDarwin "growing-jennet" ./profiles/m1.nix { };
36
+ intense-heron = mkNixDarwin "intense-heron" ./profiles/m1.nix { };
37
+ maximum-snail = mkNixDarwin "maximum-snail" ./profiles/m1.nix { };
38
+ sweeping-filly = mkNixDarwin "sweeping-filly" ./profiles/m1.nix { };
39
40
# M1 8C, 16G, 256G (Hosted by Flying-Circus)
40
- norwegian-blue = mkNixDarwin "norwegian-blue" ./profiles/m1.nix;
41
+ norwegian-blue = mkNixDarwin "norwegian-blue" ./profiles/m1.nix { };
42
43
# M2 8C, 24G, 1TB (Oakhost)
43
- eager-heisenberg = mkNixDarwin "eager-heisenberg" ./profiles/m2.large.nix;
44
- kind-lumiere = mkNixDarwin "kind-lumiere" ./profiles/m2.large.nix;
45
- }
46
- // inputs.nixpkgs.lib.listToAttrs (
47
- map
48
- (cfg: {
49
- name = cfg.hostname;
50
- value = inputs.darwin.lib.darwinSystem {
51
- system = "${cfg.system}-darwin";
44
+ eager-heisenberg = mkNixDarwin "eager-heisenberg" ./profiles/m2.large.nix { };
45
+ kind-lumiere = mkNixDarwin "kind-lumiere" ./profiles/m2.large.nix { };
46
53
- specialArgs = {
54
- inherit inputs;
55
- };
47
+ # x86_64, 12C, 32GB, 500G (Macstadium)
48
+ # 12 CPU cores, 32 GB RAM, 500 GB disk
49
+ nixos-foundation-macstadium-44911305 = mkNixDarwin "mac01.ofborg.org" ./profiles/ofborg-x86_64.nix {
50
+ system = "x86_64-darwin";
51
+ extraModules = [
52
+ { networking.hostName = "nixos-foundation-macstadium-44911305"; }
53
+ ];
54
+ };
55
+ nixos-foundation-macstadium-44911362 = mkNixDarwin "mac02.ofborg.org" ./profiles/ofborg-x86_64.nix {
56
+ system = "x86_64-darwin";
57
+ extraModules = [
58
+ { networking.hostName = "nixos-foundation-macstadium-44911362"; }
59
+ ];
60
+ };
61
+ nixos-foundation-macstadium-44911507 = mkNixDarwin "mac03.ofborg.org" ./profiles/ofborg-x86_64.nix {
62
+ system = "x86_64-darwin";
63
+ extraModules = [
64
+ { networking.hostName = "nixos-foundation-macstadium-44911507"; }
65
+ ];
66
+ };
67
57
- modules = [
58
- ./ofborg-common.nix
59
- ./profiles/${cfg.profile or "ofborg-${cfg.system}"}.nix
60
- "${inputs.sops-nix}/modules/nix-darwin"
61
- { networking.hostName = cfg.hostname; }
62
- ];
63
- };
64
- })
65
- [
66
- # MacStadium ofborg builders
67
- {
68
- hostname = "nixos-foundation-macstadium-44911305";
69
- system = "x86_64";
70
- ip = "208.83.1.173";
71
- # 12 CPU cores, 32 GB RAM, 500 GB disk
72
- }
73
- {
74
- hostname = "nixos-foundation-macstadium-44911362";
75
- system = "x86_64";
76
- ip = "208.83.1.175";
77
- # 12 CPU cores, 32 GB RAM, 500 GB disk
78
- }
79
- {
80
- hostname = "nixos-foundation-macstadium-44911507";
81
- system = "x86_64";
82
- ip = "208.83.1.186";
83
- # 12 CPU cores, 32 GB RAM, 500 GB disk
84
- }
85
- {
86
- hostname = "nixos-foundation-macstadium-44911207";
87
- system = "aarch64";
88
- profile = "ofborg-m1";
89
- ip = "208.83.1.145";
90
- # 8 CPU cores, 16 GB RAM, 256 GB disk
91
- }
92
- {
93
- hostname = "nixos-foundation-macstadium-44911104";
94
- system = "aarch64";
95
- profile = "ofborg-m1";
96
- ip = "208.83.1.181";
97
- # 8 CPU cores, 16 GB RAM, 256 GB disk
98
- }
99
- ]
100
- );
68
+ # M1 8C, 16G, 256M (Macstadium)
69
+ nixos-foundation-macstadium-44911207 = mkNixDarwin "mac04.ofborg.org" ./profiles/ofborg-m1.nix {
70
+ extraModules = [
71
+ { networking.hostName = "nixos-foundation-macstadium-44911207"; }
72
+ ];
73
+ };
74
+ nixos-foundation-macstadium-44911104 = mkNixDarwin "mac05.ofborg.org" ./profiles/ofborg-m1.nix {
75
+ extraModules = [
76
+ { networking.hostName = "nixos-foundation-macstadium-44911104"; }
77
+ ];
78
+ };
79
+ };
80
}
macs/ofborg-common.nix
deleted
-79
@@ -1,79 +0,0 @@
1
-{
2
- config,
3
- pkgs,
4
- lib,
5
- ...
6
-}:
7
-{
8
- imports = [
9
- ./ofborg.nix
10
- ./ofborg-queue-builder.nix
11
- ];
12
-
13
- environment.systemPackages = [
14
- config.nix.package
15
- pkgs.nix-top
16
- ];
17
-
18
- system.stateVersion = 5;
19
- ids.gids.nixbld = 30000;
20
-
21
- programs = {
22
- zsh = {
23
- enable = true;
24
- enableCompletion = false;
25
- };
26
- bash = {
27
- enable = true;
28
- completion.enable = true;
29
- };
30
- };
31
-
32
- nix = {
33
- settings = {
34
- extra-experimental-features = [
35
- "nix-command"
36
- "flakes"
37
- ];
38
- max-silent-time = 7200; # 2h
39
- timeout = 43200; # 12h
40
- };
41
- gc = {
42
- automatic = true;
43
- interval = {
44
- # hourly at the 15th minute
45
- Minute = 15;
46
- };
47
- # ensure up to 125G free space every hour
48
- options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=125*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
49
- };
50
- };
51
-
52
- # Manage user for ofborg, this enables creating/deleting users
53
- # depending on what modules are enabled.
54
- users = {
55
- users.ofborg.home = "/private/var/lib/ofborg";
56
- users.root = {
57
- # bash doesn't export /run/current-system/sw/bin to $PATH,
58
- # which we need for nix-store
59
- shell = "/bin/zsh";
60
- # Not part of the infra team
61
- openssh.authorizedKeys.keys = (import ../keys.nix).ssh.groups.infra ++ [
62
- # Not part of the infra team
63
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35Bq87SBWrEcoDqrZFOXyAmV/PJrSSu3hl3TdVvo4C janne"
64
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPK/3rYhlIzoPCsPK38PMdK1ivqPaJgUqWwRtmxdKZrO ✏️"
65
- ];
66
- };
67
- };
68
-
69
- system.activationScripts.postActivation.text = ''
70
- printf "disabling spotlight indexing... "
71
- mdutil -i off -d / &> /dev/null
72
- mdutil -E / &> /dev/null
73
- echo "ok"
74
- '';
75
-
76
- services.prometheus.exporters.node.enable = true;
77
- # https://github.com/LnL7/nix-darwin/issues/1256
78
- users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
79
-}
macs/ofborg.nix
+11
-19
@@ -1,29 +1,21 @@
1
{
2
- config,
2
inputs,
4
- pkgs,
3
...
4
}:
5
6
{
7
imports = [
10
- ../non-critical-infra/modules/ofborg/ofborg-config.nix
8
+ "${inputs.sops-nix}/modules/nix-darwin"
9
+ ./common/nix.nix
10
+ ./common/node-exporter.nix
11
+ ./common/ofborg.nix
12
+ ./common/ofborg-queue-builder.nix
13
+ ./common/shells.nix
14
+ ./common/spotlight.nix
15
+ ./common/ssh.nix
16
+ ./common/tools.nix
17
+ ./common/workarounds.nix
18
];
19
13
- services.ofborg = {
14
- enable = true;
15
- package = pkgs.ofborg;
16
- configFile = "/etc/ofborg.json";
17
- };
18
-
19
- nixpkgs.overlays = [
20
- (_self: super: {
21
- ofborg = inputs.ofborg.packages.${super.stdenv.hostPlatform.system}.pkg;
22
- })
23
- ];
24
-
25
- sops.secrets."ofborg/builder-rabbitmq-password" = {
26
- owner = "ofborg";
27
- sopsFile = ./secrets/${config.networking.hostName}.yml;
28
- };
20
+ ids.gids.nixbld = 30000;
21
}
macs/profiles/ofborg-m1.nix
+4
@@ -1,4 +1,8 @@
1
{
2
+ imports = [
3
+ ../ofborg.nix
4
+ ];
5
+
6
# 8 Cores, 16 GB RAM, 256 GB Disk
7
# split into 4 jobs with 2C/4G
8
nix.settings = {
macs/profiles/ofborg-x86_64.nix
+4
@@ -1,4 +1,8 @@
1
{
2
+ imports = [
3
+ ../ofborg.nix
4
+ ];
5
+
6
# 12 Cores, 32GB RAM, 1 TB Disk
7
# split into 4 jobs with 3C/8G
8
nix.settings = {