Remove netboot.nixos.org
The netboot infrastructure was used for the equinix metal builders that booted over PXE over HTTPS. Since they are now going we can remove this part of our infrastructure.
Martin Weinelt committed
Jan 6, 2025 at 01:12 UTC
c68b0158259cf618bbe183fee68ef452446a0c8d
6 files changed
+1
-116
build/flake.lock
+1
-57
@@ -47,24 +47,6 @@
47
"type": "github"
48
}
49
},
50
- "cpiotools": {
51
- "inputs": {
52
- "nixpkgs": "nixpkgs"
53
- },
54
- "locked": {
55
- "lastModified": 1702755016,
56
- "narHash": "sha256-avRrxBjC+z3XcKjosv6vzRlyDRNIKt/Dw7/pEzcTvYY=",
57
- "owner": "DeterminateSystems",
58
- "repo": "cpiotools",
59
- "rev": "189f7f5f672eb496bbba441aca1cdb208cb592ec",
60
- "type": "github"
61
- },
62
- "original": {
63
- "owner": "DeterminateSystems",
64
- "repo": "cpiotools",
65
- "type": "github"
66
- }
67
- },
50
"darwin": {
51
"inputs": {
52
"nixpkgs": [
@@ -279,27 +261,6 @@
261
"type": "github"
262
}
263
},
282
- "nix-netboot-serve": {
283
- "inputs": {
284
- "cpiotools": "cpiotools",
285
- "nixpkgs": [
286
- "nixpkgs"
287
- ]
288
- },
289
- "locked": {
290
- "lastModified": 1721830768,
291
- "narHash": "sha256-VCEmUyS4amTlQsDH79gDks3Zx1cw8B0+HL7/MkPpSbQ=",
292
- "owner": "DeterminateSystems",
293
- "repo": "nix-netboot-serve",
294
- "rev": "bab81b39988394061c4ef487a14846f1097804c4",
295
- "type": "github"
296
- },
297
- "original": {
298
- "owner": "DeterminateSystems",
299
- "repo": "nix-netboot-serve",
300
- "type": "github"
301
- }
302
- },
264
"nixos-channel-scripts": {
265
"inputs": {
266
"nixpkgs": [
@@ -321,22 +282,6 @@
282
}
283
},
284
"nixpkgs": {
324
- "locked": {
325
- "lastModified": 1655567057,
326
- "narHash": "sha256-Cc5hQSMsTzOHmZnYm8OSJ5RNUp22bd5NADWLHorULWQ=",
327
- "owner": "nixos",
328
- "repo": "nixpkgs",
329
- "rev": "e0a42267f73ea52adc061a64650fddc59906fc99",
330
- "type": "github"
331
- },
332
- "original": {
333
- "owner": "nixos",
334
- "ref": "nixos-unstable",
335
- "repo": "nixpkgs",
336
- "type": "github"
337
- }
338
- },
339
- "nixpkgs_2": {
285
"locked": {
286
"lastModified": 1736080869,
287
"narHash": "sha256-M4+plf7HjYOAvmZ3rpMHz5rZF+ExNyTnm/7F1iBK2Jg=",
@@ -383,9 +328,8 @@
328
"hydra",
329
"nix"
330
],
386
- "nix-netboot-serve": "nix-netboot-serve",
331
"nixos-channel-scripts": "nixos-channel-scripts",
388
- "nixpkgs": "nixpkgs_2",
332
+ "nixpkgs": "nixpkgs",
333
"rfc39": "rfc39"
334
}
335
},
build/flake.nix
-5
@@ -14,9 +14,6 @@
14
inputs.hydra.inputs.nixpkgs.follows = "nixpkgs";
15
inputs.nix.follows = "hydra/nix";
16
17
- inputs.nix-netboot-serve.url = "github:DeterminateSystems/nix-netboot-serve";
18
- inputs.nix-netboot-serve.inputs.nixpkgs.follows = "nixpkgs";
19
-
17
inputs.nixos-channel-scripts.url = "github:NixOS/nixos-channel-scripts";
18
inputs.nixos-channel-scripts.inputs.nixpkgs.follows = "nixpkgs";
19
@@ -33,7 +30,6 @@
30
nix,
31
nixpkgs,
32
nixos-channel-scripts,
36
- nix-netboot-serve,
33
rfc39,
34
}:
35
let
@@ -44,7 +40,6 @@
40
agenix.nixosModules.age
41
disko.nixosModules.disko
42
hydra.nixosModules.hydra
47
- nix-netboot-serve.nixosModules.nix-netboot-serve
43
];
44
45
nixpkgs.overlays = [
build/pluto/default.nix
-1
@@ -13,7 +13,6 @@
13
./prometheus
14
15
../../modules/hydra-mirror.nix
16
- ../../modules/netboot-serve.nix
16
../../modules/rfc39.nix
17
../../modules/tarball-mirror.nix
18
];
build/pluto/prometheus/exporters/blackbox.nix
-1
@@ -60,7 +60,6 @@ in
60
"https://weekly.nixos.org"
61
"https://wiki.nixos.org"
62
"https://www.nixos.org"
63
- "https://netboot.nixos.org"
63
"https://tracker.security.nixos.org"
64
])
65
];
modules/netboot-serve.nix
deleted
-47
@@ -1,47 +0,0 @@
1
-{ options, ... }:
2
-
3
-let
4
- port = 3001;
5
-
6
- # re: https://community.letsencrypt.org/t/production-chain-changes/150739/1
7
- # re: https://github.com/ipxe/ipxe/pull/116
8
- # re: https://github.com/ipxe/ipxe/pull/112
9
- # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
10
- legoFlags = [
11
- "--preferred-chain"
12
- "ISRG Root X1"
13
- ];
14
-in
15
-{
16
- services.nix-netboot-serve = {
17
- enable = true;
18
- listen = "127.0.0.1:${toString port}";
19
- };
20
-
21
- security.acme = {
22
- # These cert parameters are very specifically & carefully chosen for iPXE compatibility.
23
- certs."netboot.nixos.org" = {
24
- keyType = "rsa4096";
25
- extraLegoRunFlags = legoFlags;
26
- extraLegoRenewFlags = legoFlags;
27
- };
28
- };
29
-
30
- services.nginx = {
31
- enable = true;
32
-
33
- sslProtocols = "TLSv1.2 TLSv1.3"; # iPXE only supports TLSv1.2
34
- sslCiphers = options.services.nginx.sslCiphers.default + ":AES256-SHA256"; # iPXE needs AES256-SHA256
35
-
36
- virtualHosts."netboot.nixos.org" = {
37
- enableACME = true;
38
- forceSSL = true;
39
- locations."/".proxyPass = "http://127.0.0.1:${toString port}/";
40
- };
41
- };
42
-
43
- networking.firewall.allowedTCPPorts = [
44
- 80
45
- 443
46
- ];
47
-}
terraform/dns.tf
-5
@@ -46,11 +46,6 @@ locals {
46
type = "CNAME"
47
value = "mimas.nixos.org"
48
},
49
- {
50
- hostname = "netboot.nixos.org"
51
- type = "CNAME"
52
- value = "pluto.nixos.org"
53
- },
49
{
50
hostname = "monitoring.nixos.org"
51
type = "CNAME"