Convert bastion / buildfarm networks to a flake
Eelco Dolstra committed
Oct 23, 2019 at 20:06 UTC
85f0489c3fd98f0596ae97e6c6475fc410c70ae1
10 files changed
+146
-20
bastion/flake.lock
new
+49
@@ -0,0 +1,49 @@
1
+{
2
+ "inputs": {
3
+ "nix": {
4
+ "inputs": {
5
+ "nixpkgs": {
6
+ "inputs": {},
7
+ "narHash": "sha256-ALTr2z3J1mE/2OAuEIALIq5pxgADfKvq7rF7gqxT4c0=",
8
+ "originalUrl": "nixpkgs/release-19.09",
9
+ "url": "github:edolstra/nixpkgs/bcceb882ccdfa818c1e18f4c1e88f2db68964305"
10
+ }
11
+ },
12
+ "narHash": "sha256-Y1cdnCNoJmjqyC/a+Nt2N+5L3Ttg7K7zOD7gmtg1QzA=",
13
+ "originalUrl": "nix",
14
+ "url": "github:NixOS/nix/9cac895406724e0304dff140379783c4d786e855"
15
+ },
16
+ "nixops": {
17
+ "inputs": {
18
+ "nixops-aws": {
19
+ "inputs": {},
20
+ "narHash": "sha256-ptjXve2UWSR7K8/QMUu8J5ybzZfuuPlxp24YxZtBiCU=",
21
+ "originalUrl": "github:NixOS/nixops-aws",
22
+ "url": "github:NixOS/nixops-aws/48a97f5b4825ff136d06340306d43996ff1fac5b"
23
+ },
24
+ "nixops-hetzner": {
25
+ "inputs": {},
26
+ "narHash": "sha256-Qf2XY0S59CXy3UvjqM8OuQdX3yHNmTMRdfKxg5OOlpU=",
27
+ "originalUrl": "github:NixOS/nixops-hetzner",
28
+ "url": "github:NixOS/nixops-hetzner/ef99acaa329476beb45fc10753d9de3d2d257671"
29
+ },
30
+ "nixpkgs": {
31
+ "inputs": {},
32
+ "narHash": "sha256-ALTr2z3J1mE/2OAuEIALIq5pxgADfKvq7rF7gqxT4c0=",
33
+ "originalUrl": "nixpkgs/release-19.09",
34
+ "url": "github:edolstra/nixpkgs/bcceb882ccdfa818c1e18f4c1e88f2db68964305"
35
+ }
36
+ },
37
+ "narHash": "sha256-qy9Kx5/I1inue43i2gR8nSZYVjnOo/oNjRuW5/8OJPk=",
38
+ "originalUrl": "nixops",
39
+ "url": "github:NixOS/nixops/a9d9996c3564c4b34c92f97e6e658ffe6140460c"
40
+ },
41
+ "nixpkgs": {
42
+ "inputs": {},
43
+ "narHash": "sha256-ALTr2z3J1mE/2OAuEIALIq5pxgADfKvq7rF7gqxT4c0=",
44
+ "originalUrl": "nixpkgs/release-19.09",
45
+ "url": "github:edolstra/nixpkgs/bcceb882ccdfa818c1e18f4c1e88f2db68964305"
46
+ }
47
+ },
48
+ "version": 3
49
+}
bastion/flake.nix
new
+14
@@ -0,0 +1,14 @@
1
+{
2
+ edition = 201909;
3
+
4
+ inputs.nixpkgs.uri = "nixpkgs/release-19.09";
5
+ #inputs.nixops.uri = "/home/deploy/src/nixops";
6
+
7
+ outputs = { self, nixpkgs, nix, nixops }: {
8
+
9
+ nixopsConfigurations.default =
10
+ { inherit nixpkgs; }
11
+ // import ./network.nix { inherit self nix nixops; };
12
+
13
+ };
14
+}
bastion/network.nix
+13
-1
@@ -1,3 +1,5 @@
1
+{ self, nix, nixops }:
2
+
3
let
4
region = "eu-west-1";
5
zone = "eu-west-1a";
@@ -42,7 +44,7 @@ in
44
protocol = "udp";
45
}
46
] ++
45
- (with import ../ip-addresses.nix;
47
+ (with import /home/deploy/src/nixos-org-configurations/ip-addresses.nix; # FIXME
48
map
49
(ip: { toPort = 22; fromPort = 22; sourceIp = "${ip}/32"; })
50
[ eelcoHome
@@ -122,6 +124,11 @@ in
124
../modules/hydra-mirror.nix
125
];
126
127
+ nixpkgs.overlays =
128
+ [ nix.overlay
129
+ nixops.overlay
130
+ ];
131
+
132
users.extraUsers.tarball-mirror.openssh.authorizedKeys.keys = [ sshKeys.eelco ];
133
134
users.extraUsers.deploy =
@@ -144,6 +151,11 @@ in
151
#nix.gc.automatic = true;
152
nix.gc.dates = "daily";
153
154
+ nix.extraOptions =
155
+ ''
156
+ experimental-features = nix-command flakes ca-references
157
+ '';
158
+
159
# Temporary hack until we have proper users/roles.
160
services.openssh.extraConfig =
161
''
delft/datadog.nix
+1
-1
@@ -1,4 +1,4 @@
1
{
2
services.dd-agent.enable = true;
3
- services.dd-agent.api_key = builtins.readFile ./datadog.secret;
3
+ services.dd-agent.api_key = builtins.readFile /home/deploy/src/nixos-org-configurations/delft/datadog.secret;
4
}
delft/flake.lock
new
+37
@@ -0,0 +1,37 @@
1
+{
2
+ "inputs": {
3
+ "hydra": {
4
+ "inputs": {
5
+ "nix": {
6
+ "inputs": {
7
+ "nixpkgs": {
8
+ "inputs": {},
9
+ "narHash": "sha256-ALTr2z3J1mE/2OAuEIALIq5pxgADfKvq7rF7gqxT4c0=",
10
+ "originalUrl": "nixpkgs/release-19.09",
11
+ "url": "github:edolstra/nixpkgs/bcceb882ccdfa818c1e18f4c1e88f2db68964305"
12
+ }
13
+ },
14
+ "narHash": "sha256-Y1cdnCNoJmjqyC/a+Nt2N+5L3Ttg7K7zOD7gmtg1QzA=",
15
+ "originalUrl": "nix",
16
+ "url": "github:NixOS/nix/9cac895406724e0304dff140379783c4d786e855"
17
+ },
18
+ "nixpkgs": {
19
+ "inputs": {},
20
+ "narHash": "sha256-ALTr2z3J1mE/2OAuEIALIq5pxgADfKvq7rF7gqxT4c0=",
21
+ "originalUrl": "nixpkgs/release-19.09",
22
+ "url": "github:edolstra/nixpkgs/bcceb882ccdfa818c1e18f4c1e88f2db68964305"
23
+ }
24
+ },
25
+ "narHash": "sha256-cOwNDkeFcJ3JCWIGup7fgUzW6iDca9C29OS59MiVO2s=",
26
+ "originalUrl": "hydra",
27
+ "url": "github:NixOS/hydra/43d4bc910890e251cebb9216891924eb08e19236"
28
+ },
29
+ "nixpkgs": {
30
+ "inputs": {},
31
+ "narHash": "sha256-ALTr2z3J1mE/2OAuEIALIq5pxgADfKvq7rF7gqxT4c0=",
32
+ "originalUrl": "nixpkgs/release-19.09",
33
+ "url": "github:edolstra/nixpkgs/bcceb882ccdfa818c1e18f4c1e88f2db68964305"
34
+ }
35
+ },
36
+ "version": 3
37
+}
delft/flake.nix
new
+13
@@ -0,0 +1,13 @@
1
+{
2
+ edition = 201909;
3
+
4
+ inputs.nixpkgs.uri = "nixpkgs/release-19.09";
5
+
6
+ outputs = { self, nixpkgs, hydra }: {
7
+
8
+ nixopsConfigurations.default =
9
+ { inherit nixpkgs; }
10
+ // import ./network.nix { inherit self nixpkgs hydra; };
11
+
12
+ };
13
+}
delft/hydra.nix
+1
-14
@@ -3,16 +3,10 @@
3
with lib;
4
5
let
6
- hydraSrc = ../../hydra;
7
- hydra = (import (hydraSrc + "/release.nix") { nixpkgs = pkgs.path; }).build.x86_64-linux;
6
narCache = "/var/cache/hydra/nar-cache";
7
in
8
9
{
12
- imports =
13
- [ (hydraSrc + "/hydra-module.nix")
14
- ];
15
-
10
users.extraUsers.hydra.openssh.authorizedKeys.keys =
11
with import ../ssh-keys.nix; [ eelco rob ];
12
users.extraUsers.hydra-www.openssh.authorizedKeys.keys =
@@ -21,7 +15,6 @@ in
15
with import ../ssh-keys.nix; [ eelco rob ];
16
17
services.hydra-dev.enable = true;
24
- services.hydra-dev.package = hydra;
18
services.hydra-dev.logo = ./hydra-logo.png;
19
services.hydra-dev.hydraURL = "https://hydra.nixos.org";
20
services.hydra-dev.notificationSender = "edolstra@gmail.com";
@@ -38,12 +31,6 @@ in
31
server_store_uri = https://cache.nixos.org?local-nar-cache=${narCache}
32
binary_cache_public_uri = https://cache.nixos.org
33
41
- #<hipchat>
42
- # jobs = (hydra|nixops):.*:.*
43
- # room = 182482
44
- # token = ${builtins.readFile ./hipchat-lb-token}
45
- #</hipchat>
46
-
34
<Plugin::Session>
35
cache_size = 32m
36
</Plugin::Session>
@@ -62,7 +49,7 @@ in
49
50
evaluator_initial_heap_size = ${let gb = 20; in toString (gb * 1024 * 1024 * 1024)}
51
65
- max_concurrent_evals = 2
52
+ max_concurrent_evals = 1
53
'';
54
55
systemd.tmpfiles.rules =
delft/network.nix
+16
-2
@@ -1,3 +1,5 @@
1
+flakes:
2
+
3
let
4
makeMac = { ip, extra }: {
5
deployment = {
@@ -39,9 +41,21 @@ in {
41
lucifer = { deployment.targetHost = "lucifer.ewi.tudelft.nl"; imports = [ ./lucifer.nix ]; };
42
wendy = { deployment.targetHost = "wendy.ewi.tudelft.nl"; imports = [ ./wendy.nix ]; };
43
ike = { deployment.targetHost = "ike.ewi.tudelft.nl"; imports = [ ./build-machines-dell-r815.nix ]; };
42
- chef = import ./chef.nix;
44
+
45
+ chef = {
46
+ system.configurationRevision = flakes.self.rev;
47
+ imports = [./chef.nix ];
48
+ };
49
+
50
eris = import ./eris.nix;
44
- ceres = import ./ceres.nix;
51
+
52
+ ceres = {
53
+ system.configurationRevision = flakes.self.rev;
54
+ imports =
55
+ [ ./ceres.nix
56
+ flakes.hydra.nixosModules.hydra
57
+ ];
58
+ };
59
60
mac1 = makeMac {
61
ip = "10.254.2.1";
delft/packet-importer.nix
+1
-1
@@ -4,7 +4,7 @@ let
4
in
5
{
6
deployment.keys."hydra-packet-import.json" = {
7
- keyFile = ../hydra-packet-import.json;
7
+ keyFile = /home/deploy/src/nixos-org-configurations/hydra-packet-import.json;
8
user = "hydra-packet";
9
};
10
modules/hydra-mirror.nix
+1
-1
@@ -20,7 +20,7 @@ let
20
"nixpkgs-18.09-darwin" = "nixpkgs/nixpkgs-18.09-darwin/darwin-tested";
21
};
22
23
- channelScripts = import <nixos-channel-scripts> { inherit pkgs; };
23
+ channelScripts = import /home/deploy/src/nixos-channel-scripts { inherit pkgs; }; # FIXME
24
orderLib = import ../lib/service-order.nix { inherit lib; };
25
26
makeUpdateChannel = channelName: mainJob: