macs: create darwin bootstrap closure
Martin Weinelt committed
Apr 2, 2026 at 18:36 UTC
a68d2286bd239ac9792c39c534f85fa1a795f3f5
6 files changed
+109
-93
macs/common.nix
+1
-92
@@ -1,97 +1,6 @@
1
-# used with https://github.com/DeterminateSystems/macos-ephemeral
2
-{
3
- config,
4
- lib,
5
- pkgs,
6
- ...
7
-}:
8
-
9
-let
10
- sshKeys = {
11
- hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
12
- };
13
- environment = lib.concatStringsSep " " [
14
- "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
15
- ];
16
-
17
- authorizedNixStoreKey =
18
- key:
19
- "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
20
-in
21
-
1
{
2
imports = [
3
./hydra-queue-builder.nix
4
+ ./minimal.nix
5
];
26
-
27
- environment.darwinConfig = "/nix/home/darwin-config/macs/nix-darwin.nix";
28
- environment.systemPackages = [
29
- config.nix.package
30
- pkgs.nix-top
31
- ];
32
-
33
- system.stateVersion = 5;
34
-
35
- programs = {
36
- zsh = {
37
- enable = true;
38
- enableCompletion = false;
39
- };
40
- bash = {
41
- enable = true;
42
- completion.enable = true;
43
- };
44
- };
45
-
46
- nix = {
47
- settings = {
48
- extra-experimental-features = [
49
- "nix-command"
50
- "flakes"
51
- ];
52
- max-silent-time = 7200; # 2h
53
- timeout = 43200; # 12h
54
- };
55
- gc = {
56
- automatic = true;
57
- interval = [
58
- {
59
- Minute = 15;
60
- }
61
- {
62
- Minute = 45;
63
- }
64
- ];
65
- # ensure up to 100G free space every half hour
66
- options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=100*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
67
- };
68
- };
69
-
70
- users.users.root.openssh.authorizedKeys.keys = [
71
- (authorizedNixStoreKey sshKeys.hydra-queue-runner)
72
- ]
73
- ++ (import ../keys.nix).ssh.groups.infra-core;
74
-
75
- system.activationScripts.postActivation.text = ''
76
- printf "disabling spotlight indexing... "
77
- mdutil -i off -d / &> /dev/null
78
- mdutil -E / &> /dev/null
79
- echo "ok"
80
- '';
81
-
82
- services.prometheus.exporters.node.enable = true;
83
-
84
- # https://github.com/LnL7/nix-darwin/issues/1256
85
- users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
86
-
87
- launchd.daemons.rosetta2-gc = {
88
- script = ''
89
- date
90
- exec /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -P -minsize 0 /System/Volumes/Data
91
- '';
92
- serviceConfig.StartInterval = 3600 * 2;
93
- serviceConfig.RunAtLoad = true;
94
- serviceConfig.StandardErrorPath = "/var/log/rosetta2-gc.log";
95
- serviceConfig.StandardOutPath = "/var/log/rosetta2-gc.log";
96
- };
6
}
macs/flake-module.nix
+2
-1
@@ -15,12 +15,13 @@
15
{
16
networking = { inherit localHostName; };
17
}
18
- ./common.nix
18
entrypoint
19
];
20
};
21
in
22
{
23
+ bootstrap = mkNixDarwin "bootstrap" ./profiles/bootstrap.nix;
24
+
25
# M1 8C, 16G, 256G (Hetzner)
26
enormous-catfish = mkNixDarwin "enormous-catfish" ./profiles/m1.nix;
27
growing-jennet = mkNixDarwin "growing-jennet" ./profiles/m1.nix;
macs/minimal.nix
new
+93
@@ -0,0 +1,93 @@
1
+# used with https://github.com/DeterminateSystems/macos-ephemeral
2
+{
3
+ config,
4
+ lib,
5
+ pkgs,
6
+ ...
7
+}:
8
+
9
+let
10
+ sshKeys = {
11
+ hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
12
+ };
13
+ environment = lib.concatStringsSep " " [
14
+ "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
15
+ ];
16
+
17
+ authorizedNixStoreKey =
18
+ key:
19
+ "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
20
+in
21
+
22
+{
23
+ environment.darwinConfig = "/nix/home/darwin-config/macs/nix-darwin.nix";
24
+ environment.systemPackages = [
25
+ config.nix.package
26
+ pkgs.nix-top
27
+ ];
28
+
29
+ system.stateVersion = 5;
30
+
31
+ programs = {
32
+ zsh = {
33
+ enable = true;
34
+ enableCompletion = false;
35
+ };
36
+ bash = {
37
+ enable = true;
38
+ completion.enable = true;
39
+ };
40
+ };
41
+
42
+ nix = {
43
+ settings = {
44
+ extra-experimental-features = [
45
+ "nix-command"
46
+ "flakes"
47
+ ];
48
+ max-silent-time = 7200; # 2h
49
+ timeout = 43200; # 12h
50
+ };
51
+ gc = {
52
+ automatic = true;
53
+ interval = [
54
+ {
55
+ Minute = 15;
56
+ }
57
+ {
58
+ Minute = 45;
59
+ }
60
+ ];
61
+ # ensure up to 100G free space every half hour
62
+ options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=100*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
63
+ };
64
+ };
65
+
66
+ users.users.root.openssh.authorizedKeys.keys = [
67
+ (authorizedNixStoreKey sshKeys.hydra-queue-runner)
68
+ ]
69
+ ++ (import ../keys.nix).ssh.groups.infra-core;
70
+
71
+ system.activationScripts.postActivation.text = ''
72
+ printf "disabling spotlight indexing... "
73
+ mdutil -i off -d / &> /dev/null
74
+ mdutil -E / &> /dev/null
75
+ echo "ok"
76
+ '';
77
+
78
+ services.prometheus.exporters.node.enable = true;
79
+
80
+ # https://github.com/LnL7/nix-darwin/issues/1256
81
+ users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
82
+
83
+ launchd.daemons.rosetta2-gc = {
84
+ script = ''
85
+ date
86
+ exec /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -P -minsize 0 /System/Volumes/Data
87
+ '';
88
+ serviceConfig.StartInterval = 3600 * 2;
89
+ serviceConfig.RunAtLoad = true;
90
+ serviceConfig.StandardErrorPath = "/var/log/rosetta2-gc.log";
91
+ serviceConfig.StandardOutPath = "/var/log/rosetta2-gc.log";
92
+ };
93
+}
macs/profiles/bootstrap.nix
new
+5
@@ -0,0 +1,5 @@
1
+{
2
+ imports = [
3
+ ../minimal.nix
4
+ ];
5
+}
macs/profiles/m1.nix
+4
@@ -1,4 +1,8 @@
1
{
2
+ imports = [
3
+ ../common.nix
4
+ ];
5
+
6
# 8 Cores, 16 GB RAM, 256 GB Disk
7
# split into 4 jobs with 2C/4G
8
nix.settings = {
macs/profiles/m2.large.nix
+4
@@ -1,4 +1,8 @@
1
{
2
+ imports = [
3
+ ../common.nix
4
+ ];
5
+
6
# 8 Cores, 24 GB RAM, 1 TB Disk
7
# split into 2 jobs with 4C/12G
8
nix.settings = {