builders: init shared config
Martin Weinelt committed
Dec 31, 2024 at 22:05 UTC
7d61f17dc61d4568822a7ede3e15ba86773addcc
14 files changed
+313
builders/boot/efi-grub.nix
new
+20
@@ -0,0 +1,20 @@
1
+{
2
+ boot.loader = {
3
+ efi.canTouchEfiVariables = false;
4
+ grub = {
5
+ enable = true;
6
+ efiSupport = true;
7
+ efiInstallAsRemovable = true;
8
+ mirroredBoots = [
9
+ {
10
+ devices = [ "nodev" ];
11
+ path = "/efi/a";
12
+ }
13
+ {
14
+ devices = [ "nodev" ];
15
+ path = "/efi/b";
16
+ }
17
+ ];
18
+ };
19
+ };
20
+}
builders/common/hardening.nix
new
+11
@@ -0,0 +1,11 @@
1
+{
2
+ # no priviledge escalation through sudo or polkit
3
+ security.sudo.execWheelOnly = true;
4
+ security.polkit.enable = false;
5
+
6
+ # no password authentication
7
+ services.openssh.settings = {
8
+ KbdInteractiveAuthentication = false;
9
+ PasswordAuthentication = false;
10
+ };
11
+}
builders/common/network.nix
new
+13
@@ -0,0 +1,13 @@
1
+{
2
+ networking = {
3
+ domain = "builders.nixos.org";
4
+
5
+ firewall = {
6
+ # too spammy, rotates dmesg too quickly
7
+ logRefusedConnections = false;
8
+ };
9
+
10
+ # we use networkd instead
11
+ useDHCP = false;
12
+ };
13
+}
builders/common/nix.nix
new
+41
@@ -0,0 +1,41 @@
1
+{
2
+ config,
3
+ pkgs,
4
+ ...
5
+}:
6
+
7
+{
8
+ nix = {
9
+ package = pkgs.lix;
10
+ nrBuildUsers = config.nix.settings.max-jobs + 32;
11
+
12
+ gc =
13
+ let
14
+ maxFreed = 100; # GB
15
+ in
16
+ {
17
+ automatic = true;
18
+ dates = "*:0/30"; # every 30 minutes
19
+ options = "--max-freed \"$((${toString maxFreed} * 1024**3 - 1024 * $(df --output=avail /nix/store | tail -n 1)))\"";
20
+ };
21
+
22
+ settings = {
23
+ builders-use-substitutes = true;
24
+ extra-experimental-features = [
25
+ "cgroups"
26
+ "nix-command"
27
+ "no-url-literals"
28
+ "flakes"
29
+ ];
30
+ system-features = [
31
+ "kvm"
32
+ "nixos-test"
33
+ ];
34
+ trusted-users = [
35
+ "build"
36
+ "root"
37
+ ];
38
+ use-cgroups = true;
39
+ };
40
+ };
41
+}
builders/common/node-exporter.nix
new
+15
@@ -0,0 +1,15 @@
1
+{
2
+ config,
3
+ ...
4
+}:
5
+
6
+{
7
+ networking.firewall.allowedTCPPorts = [
8
+ config.services.prometheus.exporters.node.port
9
+ ];
10
+
11
+ services.prometheus.exporters.node = {
12
+ enable = true;
13
+ enabledCollectors = [ "systemd" ];
14
+ };
15
+}
builders/common/ssh.nix
new
+11
@@ -0,0 +1,11 @@
1
+{
2
+ lib,
3
+ ...
4
+}:
5
+
6
+{
7
+ services.openssh = {
8
+ enable = true;
9
+ authorizedKeysFiles = lib.mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
10
+ };
11
+}
builders/common/system.nix
new
+20
@@ -0,0 +1,20 @@
1
+{
2
+ pkgs,
3
+ ...
4
+}:
5
+
6
+{
7
+ # apply microcode to fix functional and security issues
8
+ hardware.enableRedistributableFirmware = true;
9
+ hardware.cpu.amd.updateMicrocode = pkgs.stdenv.isx86_64;
10
+ hardware.cpu.intel.updateMicrocode = pkgs.stdenv.isx86_64;
11
+
12
+ # enable kernel same-page merging for improved vm test performance
13
+ hardware.ksm.enable = true;
14
+
15
+ # discard blocks weekly
16
+ services.fstrim.enable = true;
17
+
18
+ # use memory more efficiently at the cost of some compute
19
+ zramSwap.enable = true;
20
+}
builders/common/tools.nix
new
+17
@@ -0,0 +1,17 @@
1
+{
2
+ pkgs,
3
+ ...
4
+}:
5
+
6
+{
7
+ environment.systemPackages = with pkgs; [
8
+ atop
9
+ ethtool
10
+ htop
11
+ lm_sensors
12
+ nvme-cli
13
+ pciutils
14
+ smartmontools
15
+ usbutils
16
+ ];
17
+}
builders/common/update.nix
new
+8
@@ -0,0 +1,8 @@
1
+{
2
+ system.autoUpgrade = {
3
+ enable = true;
4
+ dates = "daily";
5
+ flake = "git+https://github.com/nixos/infra.git?ref=master";
6
+ allowReboot = true;
7
+ };
8
+}
builders/common/users.nix
new
+37
@@ -0,0 +1,37 @@
1
+{
2
+ config,
3
+ lib,
4
+ pkgs,
5
+ ...
6
+}:
7
+let
8
+ sshKeys = {
9
+ hydra-queue-runner-rhea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
10
+ };
11
+
12
+ authorizedNixStoreKey =
13
+ key:
14
+ let
15
+ environment = lib.concatStringsSep " " [
16
+ "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
17
+ ];
18
+ in
19
+ "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ${key}";
20
+in
21
+
22
+{
23
+ users = {
24
+ mutableUsers = false;
25
+ users = {
26
+ build = {
27
+ isNormalUser = true;
28
+ uid = 2000;
29
+ openssh.authorizedKeys.keys = [
30
+ (authorizedNixStoreKey sshKeys.hydra-queue-runner-rhea)
31
+ ];
32
+ };
33
+
34
+ root.openssh.authorizedKeys.keys = (import ../../ssh-keys.nix).infra-core;
35
+ };
36
+ };
37
+}
builders/disk-layouts/efi-zfs-raid0.nix
new
+69
@@ -0,0 +1,69 @@
1
+{
2
+ disk1 ? "/dev/nvme0n1",
3
+ disk2 ? "/dev/nvme1n1",
4
+}:
5
+let
6
+ mkDiskLayout = id: {
7
+ type = "gpt";
8
+ partitions = {
9
+ esp = {
10
+ type = "EF00";
11
+ size = "512M";
12
+ content = {
13
+ type = "filesystem";
14
+ format = "vfat";
15
+ mountpoint = "/efi/${id}";
16
+ };
17
+ };
18
+ zdev = {
19
+ size = "100%";
20
+ content = {
21
+ type = "zfs";
22
+ pool = "zroot";
23
+ };
24
+ };
25
+ };
26
+ };
27
+in
28
+{
29
+ disk = {
30
+ a = {
31
+ type = "disk";
32
+ device = disk1;
33
+ content = mkDiskLayout "a";
34
+ };
35
+
36
+ b = {
37
+ type = "disk";
38
+ device = disk2;
39
+ content = mkDiskLayout "b";
40
+ };
41
+ };
42
+
43
+ zpool.zroot = {
44
+ mode = ""; # RAID 0
45
+ options.ashift = "12"; # 4k blocks
46
+
47
+ rootFsOptions = {
48
+ acltype = "posixacl";
49
+ atime = "off";
50
+ compression = "on";
51
+ mountpoint = "none";
52
+ xattr = "sa";
53
+ };
54
+
55
+ datasets = {
56
+ root = {
57
+ type = "zfs_fs";
58
+ mountpoint = "/";
59
+ };
60
+ reserved = {
61
+ type = "zfs_fs";
62
+ options = {
63
+ canmount = "off";
64
+ refreservation = "16G"; # roughly one system closure
65
+ };
66
+ };
67
+ };
68
+ };
69
+}
builders/flake-module.nix
new
+31
@@ -0,0 +1,31 @@
1
+{ inputs, ... }:
2
+{
3
+ flake.nixosConfigurations =
4
+ let
5
+ mkNixOS =
6
+ system: config:
7
+ inputs.nixpkgs.lib.nixosSystem {
8
+ inherit system;
9
+
10
+ modules = [
11
+ inputs.disko.nixosModules.disko
12
+
13
+ ./common/hardening.nix
14
+ ./common/network.nix
15
+ ./common/nix.nix
16
+ ./common/node-exporter.nix
17
+ ./common/system.nix
18
+ ./common/tools.nix
19
+ ./common/update.nix
20
+ ./common/users.nix
21
+ ./common/ssh.nix
22
+
23
+ ../modules/rasdaemon.nix
24
+
25
+ config
26
+ ];
27
+ };
28
+ in
29
+ {
30
+ };
31
+}
builders/network/autoconfig.nix
new
+19
@@ -0,0 +1,19 @@
1
+{
2
+ networking.useDHCP = false;
3
+
4
+ systemd.network = {
5
+ enable = true;
6
+ networks = {
7
+ "99-autoconfig" = {
8
+ matchConfig = {
9
+ Kind = "!*";
10
+ Type = "ether";
11
+ };
12
+ networkConfig = {
13
+ DHCP = "yes";
14
+ IPv6AcceptRA = true;
15
+ };
16
+ };
17
+ };
18
+ };
19
+}
flake.nix
+1
@@ -54,6 +54,7 @@
54
"aarch64-darwin"
55
];
56
imports = [
57
+ ./builders/flake-module.nix
58
./formatter/flake-module.nix
59
./checks/flake-module.nix
60
./terraform/flake-module.nix