| 1 | { |
| 2 | config, |
| 3 | lib, |
| 4 | pkgs, |
| 5 | inputs, |
| 6 | ... |
| 7 | }: |
| 8 | |
| 9 | let |
| 10 | narCache = "/var/cache/hydra/nar-cache"; |
| 11 | in |
| 12 | |
| 13 | { |
| 14 | imports = [ |
| 15 | inputs.hydra.nixosModules.hydra |
| 16 | ]; |
| 17 | |
| 18 | nix = { |
| 19 | package = config.services.hydra-dev.package.nix; |
| 20 | |
| 21 | settings = { |
| 22 | # gc outputs as well, since they are served from the cache |
| 23 | keep-outputs = lib.mkForce false; |
| 24 | |
| 25 | # retry uploads (yes, uploads) harder; defaults to 5 otherwise |
| 26 | download-attempts = 32; |
| 27 | }; |
| 28 | |
| 29 | gc = { |
| 30 | automatic = true; |
| 31 | options = ''--max-freed "$((400 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"''; |
| 32 | dates = "03,09,15,21:15"; |
| 33 | }; |
| 34 | }; |
| 35 | |
| 36 | systemd.services.hydra-prune-build-logs = { |
| 37 | description = "Clean up old build logs"; |
| 38 | startAt = "weekly"; |
| 39 | serviceConfig = { |
| 40 | User = "hydra-queue-runner"; |
| 41 | Group = "hydra"; |
| 42 | ExecStart = lib.concatStringsSep " " [ |
| 43 | (lib.getExe pkgs.findutils) |
| 44 | "/var/lib/hydra/build-logs/" |
| 45 | "-ignore_readdir_race" |
| 46 | "-type" |
| 47 | "f" |
| 48 | "-mtime" |
| 49 | "+213" # days (~7 months, roughly one release cycle) |
| 50 | "-delete" |
| 51 | ]; |
| 52 | }; |
| 53 | }; |
| 54 | |
| 55 | # Don't rate-limit the journal. |
| 56 | services.journald.rateLimitBurst = 0; |
| 57 | |
| 58 | age.secrets.hydra-github-client-secret = { |
| 59 | file = ./secrets/hydra-github-client-secret.age; |
| 60 | owner = "hydra-www"; |
| 61 | group = "hydra"; |
| 62 | }; |
| 63 | |
| 64 | services.hydra-dev.enable = true; |
| 65 | services.hydra-dev.logo = ./hydra-logo.png; |
| 66 | services.hydra-dev.hydraURL = "https://hydra.nixos.org"; |
| 67 | services.hydra-dev.notificationSender = "edolstra@gmail.com"; |
| 68 | services.hydra-dev.smtpHost = "localhost"; |
| 69 | services.hydra-dev.useSubstitutes = false; |
| 70 | services.hydra-dev.extraConfig = '' |
| 71 | max_servers 30 |
| 72 | |
| 73 | enable_google_login = 1 |
| 74 | google_client_id = 816926039128-ia4s4rsqrq998rsevce7i09mo6a4nffg.apps.googleusercontent.com |
| 75 | |
| 76 | github_client_id = Ov23liat892hkVARixsT |
| 77 | github_client_secret_file = ${config.age.secrets.hydra-github-client-secret.path} |
| 78 | |
| 79 | store_uri = s3://nix-cache?secret-key=/var/lib/hydra/queue-runner/keys/cache.nixos.org-1/secret&write-nar-listing=1&compression=zstd&ls-compression=zstd&log-compression=zstd&index-debug-info=true |
| 80 | server_store_uri = https://cache.nixos.org?local-nar-cache=${narCache} |
| 81 | binary_cache_public_uri = https://cache.nixos.org |
| 82 | |
| 83 | <Plugin::Session> |
| 84 | cache_size = 32m |
| 85 | </Plugin::Session> |
| 86 | |
| 87 | # patchelf:master:3 |
| 88 | xxx-jobset-repeats = nixos:reproducibility:1 |
| 89 | |
| 90 | upload_logs_to_binary_cache = true |
| 91 | compress_build_logs = false # conflicts with upload_logs_to_binary_cache |
| 92 | |
| 93 | log_prefix = https://cache.nixos.org/ |
| 94 | |
| 95 | evaluator_workers = 16 |
| 96 | evaluator_max_memory_size = 4096 |
| 97 | |
| 98 | queue_runner_endpoint = http://${config.services.hydra-queue-runner-dev.rest.address}:${toString config.services.hydra-queue-runner-dev.rest.port} |
| 99 | |
| 100 | max_concurrent_evals = 1 |
| 101 | |
| 102 | # increase the number of active compress slots (CPU is 48*2 on mimas) |
| 103 | max_local_worker_threads = 144 |
| 104 | |
| 105 | max_unsupported_time = 86400 |
| 106 | |
| 107 | allow_import_from_derivation = false |
| 108 | |
| 109 | max_db_connections = 350 |
| 110 | |
| 111 | <hydra_notify> |
| 112 | <prometheus> |
| 113 | listen_address = 0.0.0.0 |
| 114 | port = 9199 |
| 115 | </prometheus> |
| 116 | </hydra_notify> |
| 117 | ''; |
| 118 | |
| 119 | systemd.tmpfiles.rules = [ |
| 120 | "d /var/cache/hydra 0755 hydra hydra - -" |
| 121 | "d ${narCache} 0775 hydra hydra 1d -" |
| 122 | ]; |
| 123 | |
| 124 | # wait for the network before starting hydra, since we require a network |
| 125 | # connection to the remote postgresql database |
| 126 | systemd.services.hydra-init = { |
| 127 | wants = [ |
| 128 | "network-online.target" |
| 129 | ]; |
| 130 | after = [ |
| 131 | "network-online.target" |
| 132 | ]; |
| 133 | }; |
| 134 | |
| 135 | # eats memory as if it was free |
| 136 | systemd.services.hydra-notify.enable = false; |
| 137 | |
| 138 | # replaced by hydra-queue-runner-dev |
| 139 | systemd.services.hydra-queue-runner = { |
| 140 | enable = false; |
| 141 | # restarting the scheduler is very expensive |
| 142 | restartIfChanged = false; |
| 143 | serviceConfig = { |
| 144 | ManagedOOMPreference = "avoid"; |
| 145 | LimitNOFILE = 65535; |
| 146 | }; |
| 147 | }; |
| 148 | |
| 149 | programs.ssh.hostKeyAlgorithms = [ |
| 150 | "rsa-sha2-512-cert-v01@openssh.com" |
| 151 | "ssh-ed25519" |
| 152 | "ssh-rsa" |
| 153 | "ecdsa-sha2-nistp256" |
| 154 | ]; |
| 155 | programs.ssh.extraConfig = lib.mkAfter '' |
| 156 | ServerAliveInterval 120 |
| 157 | TCPKeepAlive yes |
| 158 | ''; |
| 159 | |
| 160 | # These IPs and SSH public keys are specifically provisioned for Hydra |
| 161 | services.openssh.knownHosts = { |
| 162 | # x86_64-linux at Hetzner |
| 163 | "elated-minsky.builder.nixos.org".publicKey = |
| 164 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIvrJpd3aynfPVGGG/s7MtRFz/S6M4dtqvqKI3Da7O7+"; |
| 165 | "sleepy-brown.builder.nixos.org".publicKey = |
| 166 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOh4/3m7o6H3J5QG711aJdlSUVvlC8yW6KoqAES3Fy6I"; |
| 167 | # aarch64-linux at Hetzner |
| 168 | "goofy-hopcroft.builder.nixos.org".publicKey = |
| 169 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTJEi+nQNd7hzNYN3cLBK/0JCkmwmyC1I+b5nMI7+dd"; |
| 170 | "hopeful-rivest.builder.nixos.org".publicKey = |
| 171 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgjwpQaNAWdEdnk1YG7JWThM4xQdKNJ3h3arhF7+iFm"; |
| 172 | |
| 173 | # M1 Macs at Hetzner |
| 174 | "intense-heron.mac.nixos.org".publicKey = |
| 175 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICeSgOe/cr1yVAJOl30t3AZOLtvzeQa5rnrHGceKeBue"; |
| 176 | "sweeping-filly.mac.nixos.org".publicKey = |
| 177 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE6b/coXQEcFZW1eG4zFyCMCF0mZFahqmadz6Gk9DWMF"; |
| 178 | "maximum-snail.mac.nixos.org".publicKey = |
| 179 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEs+fK4hH8UKo+Pa7u1VYltkMufBHHH5uC93RQ2S6Xy9"; |
| 180 | "growing-jennet.mac.nixos.org".publicKey = |
| 181 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAQGthkSSOnhxrIUCMlRQz8FOo5Y5Nk9f9WnVLNeRJpm"; |
| 182 | "enormous-catfish.mac.nixos.org".publicKey = |
| 183 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlg7NXxeG5L3s0YqSQIsqVG0MTyvyWDHUyYEfFPazLe"; |
| 184 | |
| 185 | # M1 Macs at Flying Circus |
| 186 | "norwegian-blue.mac.nixos.org".publicKey = |
| 187 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQ6Cjvoq5VBYfXl6ZV/ijQ1q4UxbWRYYfkXe0rzmJjf"; |
| 188 | |
| 189 | # M2 Macs at Oakhost |
| 190 | "kind-lumiere.mac.nixos.org".publicKey = |
| 191 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFoqn1AAcOqtG65milpBtWVXP5VcBmTUSMGNfJzPwW8Q"; |
| 192 | "eager-heisenberg.mac.nixos.org".publicKey = |
| 193 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBp9NStfEPu7HdeK8f2KEnynyirjG9BUk+6w2SgJtQyS"; |
| 194 | |
| 195 | # vcunat |
| 196 | "t2a.cunat.cz".publicKey = |
| 197 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIu3itg4hn5e4KrnyoreAUN3RIbAcvqc7yWx5i6EWqAu"; |
| 198 | "t4b.cunat.cz".publicKey = |
| 199 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/jE8c0lkc/DlK3R7A+zBr6j/lfEQrhqSD/YOEVs8za"; |
| 200 | }; |
| 201 | |
| 202 | } |