| 1 | { |
| 2 | config, |
| 3 | lib, |
| 4 | pkgs, |
| 5 | inputs, |
| 6 | ... |
| 7 | }: |
| 8 | |
| 9 | let |
| 10 | channels = (import ../channels.nix).channels-with-urls; |
| 11 | |
| 12 | orderLib = import ../lib/service-order.nix { }; |
| 13 | |
| 14 | makeUpdateChannel = channelName: mainJob: { |
| 15 | name = "update-${channelName}"; |
| 16 | value = { |
| 17 | description = "Update Channel ${channelName}"; |
| 18 | path = [ |
| 19 | pkgs.git |
| 20 | (pkgs.callPackage ../pkgs/nixos-channel-scripts { |
| 21 | # nixpkgs nix-index cannot read zstd-compressed .ls listings yet |
| 22 | nix-index = inputs.nix-index.packages.${pkgs.stdenv.hostPlatform.system}.default; |
| 23 | }) |
| 24 | ]; |
| 25 | script = '' |
| 26 | # Hardcoded in channel scripts. |
| 27 | dir=/home/hydra-mirror/nixpkgs-channels |
| 28 | |
| 29 | export GIT_SSH_COMMAND="ssh -i $CREDENTIALS_DIRECTORY/hydra-mirror-git-credentials -o IdentitiesOnly=yes" |
| 30 | if ! [[ -e $dir ]]; then |
| 31 | git clone --bare git@github.com:NixOS/nixpkgs.git $dir |
| 32 | fi |
| 33 | GIT_DIR=$dir git config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*' |
| 34 | |
| 35 | # FIXME: use IAM role. |
| 36 | export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path}) |
| 37 | export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path}) |
| 38 | exec mirror-nixos-branch ${channelName} https://hydra.nixos.org/job/${mainJob}/latest-finished |
| 39 | ''; |
| 40 | serviceConfig = { |
| 41 | Type = "oneshot"; |
| 42 | RemainAfterExit = false; |
| 43 | User = "hydra-mirror"; |
| 44 | # Allow the unit to use 80% of the system's RAM and 100% of the system's swap |
| 45 | MemoryHigh = "80%"; |
| 46 | LoadCredential = [ |
| 47 | "hydra-mirror-git-credentials:${config.age.secrets.hydra-mirror-git-credentials.path}" |
| 48 | ]; |
| 49 | }; |
| 50 | unitConfig = { |
| 51 | After = [ "networking.target" ]; |
| 52 | }; |
| 53 | environment.TMPDIR = "/home/hydra-mirror/scratch"; |
| 54 | environment.GC_INITIAL_HEAP_SIZE = "4g"; |
| 55 | }; |
| 56 | }; |
| 57 | |
| 58 | updateJobs = orderLib.mkOrderedChain (lib.mapAttrsToList makeUpdateChannel channels); |
| 59 | |
| 60 | in |
| 61 | |
| 62 | { |
| 63 | age.secrets.hydra-mirror-aws-credentials = { |
| 64 | file = ../build/secrets/hydra-mirror-aws-credentials.age; |
| 65 | owner = "hydra-mirror"; |
| 66 | }; |
| 67 | |
| 68 | age.secrets.hydra-mirror-git-credentials = { |
| 69 | file = ../build/secrets/hydra-mirror-git-credentials.age; |
| 70 | }; |
| 71 | |
| 72 | users.users.hydra-mirror = { |
| 73 | description = "Channel mirroring user"; |
| 74 | home = "/home/hydra-mirror"; |
| 75 | createHome = true; |
| 76 | isSystemUser = true; |
| 77 | group = "hydra-mirror"; |
| 78 | }; |
| 79 | |
| 80 | users.groups.hydra-mirror = { }; |
| 81 | |
| 82 | systemd.tmpfiles.rules = [ |
| 83 | '' |
| 84 | d /home/hydra-mirror/scratch 0755 hydra-mirror users 10d |
| 85 | F /home/hydra-mirror/scratch/nixos-files.sqlite - - - 8d |
| 86 | e /home/hydra-mirror/scratch/release-*/* - - - 1d - |
| 87 | '' |
| 88 | ]; |
| 89 | |
| 90 | systemd.services = (lib.listToAttrs updateJobs) // { |
| 91 | "update-all-channels" = { |
| 92 | description = "Start all channel updates."; |
| 93 | unitConfig = { |
| 94 | After = builtins.map (service: "${service.name}.service") updateJobs; |
| 95 | Wants = builtins.map (service: "${service.name}.service") updateJobs; |
| 96 | }; |
| 97 | script = "true"; |
| 98 | }; |
| 99 | }; |
| 100 | |
| 101 | systemd.timers."update-all-channels" = { |
| 102 | description = "Start all channel updates."; |
| 103 | wantedBy = [ "timers.target" ]; |
| 104 | timerConfig = { |
| 105 | OnUnitInactiveSec = 600; |
| 106 | OnBootSec = 900; |
| 107 | AccuracySec = 300; |
| 108 | }; |
| 109 | }; |
| 110 | } |