Move Hydra to new server
Eelco Dolstra committed
Mar 8, 2016 at 14:20 UTC
15f4fd850e5b9ff98dafff5e2e39e1c35023f040
7 files changed
+239
-273
delft/chef.nix
new
+39
@@ -0,0 +1,39 @@
1
+{ config, lib, pkgs, ...}:
2
+
3
+{
4
+ imports = [ ./common.nix ./hydra.nix ./hydra-proxy.nix ];
5
+
6
+ deployment.targetEnv = "hetzner";
7
+ deployment.hetzner.mainIPv4 = "46.4.67.10";
8
+
9
+ services.postgresql = {
10
+ enable = true;
11
+ package = pkgs.postgresql95;
12
+ extraConfig = ''
13
+ log_min_duration_statement = 5000
14
+ log_duration = off
15
+ log_statement = 'none'
16
+ max_connections = 250
17
+ work_mem = 16MB
18
+ shared_buffers = 4GB
19
+
20
+ # Checkpoint every 256 MB.
21
+ min_wal_size = 128MB
22
+ max_wal_size = 256MB
23
+
24
+ # We can risk losing some transactions.
25
+ synchronous_commit = off
26
+
27
+ effective_cache_size = 16GB
28
+ '';
29
+ };
30
+
31
+ networking = {
32
+
33
+ firewall.allowedTCPPorts = [ 80 443 ];
34
+ firewall.allowPing = true;
35
+ firewall.logRefusedConnections = true;
36
+
37
+ };
38
+
39
+}
delft/delft-webserver.nix
-80
@@ -54,40 +54,6 @@ let
54
'';
55
};
56
57
- hydraCacheDir = "/var/cache/hydra-binary-cache";
58
-
59
- hydraProxyConfig =
60
- ''
61
- TimeOut 900
62
-
63
- <Proxy *>
64
- Order deny,allow
65
- Allow from all
66
- </Proxy>
67
-
68
- ProxyRequests Off
69
- ProxyPreserveHost On
70
- ProxyPass /apache-errors !
71
- ErrorDocument 503 /apache-errors/503.html
72
- ProxyPass / http://lucifer:3000/ retry=5 disablereuse=on
73
- ProxyPassReverse / http://lucifer:3000/
74
-
75
- CacheEnable disk /
76
- CacheRoot ${hydraCacheDir}
77
- CacheMaxFileSize 64000000
78
- CacheIgnoreHeaders Set-Cookie
79
-
80
- <Location />
81
- SetOutputFilter DEFLATE
82
- BrowserMatch ^Mozilla/4\.0[678] no-gzip\
83
- BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
84
- SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|narinfo)$ no-gzip dont-vary
85
- SetEnvIfNoCase Request_URI /api/ no-gzip dont-vary
86
- SetEnvIfNoCase Request_URI /download/ no-gzip dont-vary
87
- SetEnvIfNoCase Request_URI /nar/ no-gzip dont-vary
88
- </Location>
89
- '';
90
-
57
in
58
59
{
@@ -237,46 +203,6 @@ in
203
];
204
}
205
240
- { hostName = "hydra.nixos.org";
241
-
242
- logFormat = ''"%h %l %u %t \"%r\" %>s %b %D"'';
243
- extraConfig = hydraProxyConfig;
244
- }
245
-
246
- { hostName = "hydra.nixos.org";
247
-
248
- enableSSL = true;
249
- sslServerCert = "/root/ssl-secrets/ssl-nixos.org.crt";
250
- sslServerKey = "/root/ssl-secrets/ssl-nixos.org.key";
251
-
252
- logFormat = ''"%h %l %u %t \"%r\" %>s %b %D"'';
253
- extraConfig = ''
254
- SSLCertificateChainFile /root/ssl-secrets/startssl-class1.pem
255
- SSLCACertificateFile /root/ssl-secrets/startssl-ca.pem
256
-
257
- # Required by Catalyst.
258
- RequestHeader set X-Forwarded-Proto https
259
- RequestHeader set X-Forwarded-Port 443
260
-
261
- ${hydraProxyConfig}
262
- '';
263
- }
264
-
265
- { hostName = "hydra-test.nixos.org";
266
- logFormat = ''"%h %l %u %t \"%r\" %>s %b %D"'';
267
- extraConfig = ''
268
- <Proxy *>
269
- Order deny,allow
270
- Allow from all
271
- </Proxy>
272
-
273
- ProxyRequests Off
274
- ProxyPreserveHost On
275
- ProxyPass / http://lucifer:4000/ retry=5 disablereuse=off
276
- ProxyPassReverse / http://lucifer:4000/
277
- '';
278
- }
279
-
206
{ hostName = "planet.strategoxt.org";
207
serverAliases = ["planet.stratego.org"];
208
documentRoot = "/home/karltk/public_html/planet";
@@ -288,12 +214,6 @@ in
214
215
environment.systemPackages = [ zabbixMail ];
216
291
- system.activationScripts.createHydraCache =
292
- ''
293
- mkdir -p ${hydraCacheDir}
294
- chown wwwrun ${hydraCacheDir}
295
- '';
296
-
217
nixpkgs.config.packageOverrides = pkgs: {
218
php = pkgs.php56;
219
};
delft/hydra-proxy.nix
new
+88
@@ -0,0 +1,88 @@
1
+{ config, lib, pkgs, ...}:
2
+
3
+let
4
+
5
+ hydraCacheDir = "/var/cache/hydra-binary-cache";
6
+
7
+ hydraProxyConfig =
8
+ ''
9
+ TimeOut 900
10
+
11
+ <Proxy *>
12
+ Order deny,allow
13
+ Allow from all
14
+ </Proxy>
15
+
16
+ ProxyRequests Off
17
+ ProxyPreserveHost On
18
+ ProxyPass /apache-errors !
19
+ ErrorDocument 503 /apache-errors/503.html
20
+ ProxyPass / http://localhost:3000/ retry=5 disablereuse=on
21
+ ProxyPassReverse / http://localhost:3000/
22
+
23
+ CacheEnable disk /
24
+ CacheRoot ${hydraCacheDir}
25
+ CacheMaxFileSize 64000000
26
+ CacheIgnoreHeaders Set-Cookie
27
+
28
+ <Location />
29
+ SetOutputFilter DEFLATE
30
+ BrowserMatch ^Mozilla/4\.0[678] no-gzip\
31
+ BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
32
+ SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|narinfo)$ no-gzip dont-vary
33
+ SetEnvIfNoCase Request_URI /api/ no-gzip dont-vary
34
+ SetEnvIfNoCase Request_URI /download/ no-gzip dont-vary
35
+ SetEnvIfNoCase Request_URI /nar/ no-gzip dont-vary
36
+ </Location>
37
+ '';
38
+
39
+in
40
+
41
+{
42
+
43
+ services.httpd = {
44
+ enable = true;
45
+ adminAddr = "edolstra@gmail.com";
46
+ hostName = "hydra.nixos.org";
47
+ logFormat = ''"%h %l %u %t \"%r\" %>s %b %D"'';
48
+ extraConfig = hydraProxyConfig;
49
+
50
+ servedDirs =
51
+ [ { urlPath = "/apache-errors";
52
+ dir = ./apache-errors;
53
+ }
54
+ ];
55
+
56
+ virtualHosts = [
57
+ { hostName = "hydra.nixos.org";
58
+ enableSSL = true;
59
+ sslServerCert = "/root/ssl-secrets/ssl-nixos.org.crt";
60
+ sslServerKey = "/root/ssl-secrets/ssl-nixos.org.key";
61
+ extraConfig = ''
62
+ SSLCertificateChainFile /root/ssl-secrets/startssl-class1.pem
63
+ SSLCACertificateFile /root/ssl-secrets/startssl-ca.pem
64
+
65
+ # Required by Catalyst.
66
+ RequestHeader set X-Forwarded-Proto https
67
+ RequestHeader set X-Forwarded-Port 443
68
+ '';
69
+ }
70
+ ];
71
+
72
+ };
73
+
74
+ system.activationScripts.createHydraCache =
75
+ ''
76
+ mkdir -p ${hydraCacheDir}
77
+ chown wwwrun ${hydraCacheDir}
78
+ '';
79
+
80
+ systemd.services.htcacheclean =
81
+ { description = "Clean httpd Cache";
82
+ serviceConfig.ExecStart =
83
+ "${config.services.httpd.package}/bin/htcacheclean " +
84
+ "-v -t -l 32G -p /var/cache/hydra-binary-cache";
85
+ startAt = "Sat 05:45";
86
+ };
87
+
88
+}
delft/hydra.nix
new
+102
@@ -0,0 +1,102 @@
1
+{ config, lib, pkgs, ... }:
2
+
3
+with lib;
4
+
5
+let
6
+ hydra = builtins.storePath /nix/store/913ls6qhzcyylnfqc5dd627j2l8c4jmq-hydra-0.1pre1234-abcdef;
7
+ hydraDebug = builtins.storePath /nix/store/nwgjbc1qifyw1bz7jw4hw4j7zai15bqx-hydra-0.1pre1234-abcdef-debug;
8
+in
9
+
10
+{
11
+ imports =
12
+ [ "${hydra}/share/nix/hydra-module.nix"
13
+ ];
14
+
15
+ users.extraUsers.hydra.openssh.authorizedKeys.keys =
16
+ with import ../ssh-keys.nix; [ eelco rob ];
17
+ users.extraUsers.hydra-www.openssh.authorizedKeys.keys =
18
+ with import ../ssh-keys.nix; [ eelco rob ];
19
+ users.extraUsers.hydra-queue-runner.openssh.authorizedKeys.keys =
20
+ with import ../ssh-keys.nix; [ eelco rob provisioner ];
21
+
22
+ services.hydra.enable = true;
23
+ services.hydra.package = hydra;
24
+ services.hydra.logo = ./hydra-logo.png;
25
+ services.hydra.hydraURL = "https://hydra.nixos.org";
26
+ services.hydra.notificationSender = "edolstra@gmail.com";
27
+ services.hydra.extraConfig =
28
+ ''
29
+ max_servers 50
30
+ enable_persona 1
31
+
32
+ enable_google_login = 1
33
+ google_client_id = 816926039128-ia4s4rsqrq998rsevce7i09mo6a4nffg.apps.googleusercontent.com
34
+
35
+ binary_cache_secret_key_file = /var/lib/hydra/queue-runner/keys/cache.nixos.org-1/secret
36
+ binary_cache_public_key_file = /var/lib/hydra/queue-runner/keys/cache.nixos.org-1/public
37
+
38
+ store_mode = s3-binary-cache
39
+ binary_cache_s3_bucket = nix-cache
40
+ binary_cache_public_uri = https://cache.nixos.org
41
+
42
+ <hipchat>
43
+ jobs = (hydra|nixops):.*:.*
44
+ room = 182482
45
+ token = ${builtins.readFile ./hipchat-lb-token}
46
+ </hipchat>
47
+
48
+ <Plugin::Session>
49
+ cache_size = 32m
50
+ </Plugin::Session>
51
+ '';
52
+
53
+ users.extraUsers.hydra.home = mkForce "/home/hydra";
54
+
55
+ programs.ssh.extraConfig = mkAfter
56
+ ''
57
+ ServerAliveInterval 120
58
+ TCPKeepAlive yes
59
+
60
+ Host mac1
61
+ Hostname 83.87.124.39
62
+ Port 15022
63
+ Compression yes
64
+
65
+ Host mac2
66
+ Hostname 94.211.55.77
67
+ Port 6001
68
+ Compression yes
69
+
70
+ Host mac3
71
+ Hostname 94.211.55.77
72
+ Port 6002
73
+ Compression yes
74
+
75
+ Host mac4
76
+ Hostname 94.211.55.77
77
+ Port 6003
78
+ Compression yes
79
+
80
+ Host mac5
81
+ Hostname 94.211.55.77
82
+ Port 6004
83
+ Compression yes
84
+ '';
85
+
86
+ services.openssh.knownHosts =
87
+ [
88
+ { hostNames = [ "83.87.124.39" ]; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVTkY4tQ6V29XTW1aKtoFJoF4uyaEy0fms3HqmI56av8UCg3MN5G6CL6EDIvbe46mBsI3++V3uGiOr0pLPbM9fkWC92LYGk5f7fNvCoy9bvuZy5bHwFQ5b5S9IJ1o3yDlCToc9CppmPVbFMMMLgKF06pQiGBeMCUG/VoCfiUBq+UgEGhAifWcuWIOGmdua6clljH5Dcc+7S0HTLoVtrxmPPXBVZUvW+lgAJTM6FXYIZiIqMSC2uZHGVstY87nPcZFXIbzhlYQqxx5H0um2bL3mbS7vdKhSsIWWaUZeck9ghNyUV1fVRLUhuXkQHe/8Z58cAhTv5dDd42YLB0fgjETV"; }
89
+ { hostNames = [ "[94.211.55.77]:6001" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4oeixXSB/Ovl3kewykJ2vV82ATOLqPgZDXPdLCmkPRHYt7dy7GNbWrESv3gQvgjEtKaZavthf7aQsJHNa8aKc="; }
90
+ { hostNames = [ "[94.211.55.77]:6002" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO45JPJIqbQVs3I4RmO01ExRv6krTEnuheAvumgKeb6NwUo6oD1kP4/x8KazoMd4LRAFtdWdwnN3Z7IYmqlmd20="; }
91
+ { hostNames = [ "[94.211.55.77]:6003" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIMKd1aV7ktAMIZUQV151dbZu/AM7Hszb4dMqwqQ7F8uLOmO+qyyS3nQHrGG6I5VAKbRkbTCn3l0DhYFj7sS6U="; }
92
+ { hostNames = [ "[94.211.55.77]:6004" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLeZFijo43wK8V2/9lXt7OH3axZb4kyZBV7Hn11YdmjPn8KHNkiRNiq9x/AuEhWmpY//9K1XU8RezV5LkGgyirU="; }
93
+ { hostNames = [ "hydra.ewi.tudelft.nl" "131.180.119.69" ]; publicKey = "ssh-dss AAAAB3NzaC1kc3MAAACBAJBHaP+SAMm/eTYciPpQi8x5NULRV8D9/xQPd/SU7s+mQP/TlvLCmgpuHudZMrLgUDWjKclFQThBuhElCvZzHmBcWPP64wzlZdxsizub9525FPAMnhbK5bqQHgji+ilXGTwv+ZvwEC1LJEQz4H5jgXlIgwNzvED4xo8IyLTxKw6TAAAAFQCQE8H+w6xYFMiDLK7tpGaweLj04QAAAIAuES8pfxge4UrDAnKyYEN/IZwTMLznAHoldaa+E+8KYVs7QnhMztJr9kIZWOJOsmEcQ/1SwFJPSU04FbJ25Z25B8jUG6UqMYidiQnzjHqKc29AYo3ZS9xWJ62VS7cW+UeC4zUFMA8jtlaVCfU95uharu+lzM4SecC9+35ObWpn1wAAAIAzgtOQhC7udZJPnvqc4L6AATMoaAQQ3x95nher6oyL3N6Yi6+Sy10v3u5c5uccaDQ/oVjQHBeaFnciNXYTqF0z4u3MmsQ+RtnElJ2+rqqxzvuOUkCms5yNdNq+Ag79MVd5ESlgowtivtZ+p8aH7cIJFab+YkfUpTrZnGDrUl/kEQ=="; }
94
+ { hostNames = [ "ike.ewi.tudelft.nl" "131.180.119.70" ]; publicKey = "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGNzlom/R/lJ0TZb2HLm19V+BoifFoENHocIJ4MiV9FQCOUlLLQh7kZMKtzVJdM+n1q1BqLp6bll6U7PsLUKAg+rgDU2saHd8ScaeZqhdmWpO4lMMxpNreAETsY1txpSatT4aHvjJMTlT1pmaLiqfhCenqxaqeH3/3XPkVfK48Nk+mo8w=="; }
95
+ { hostNames = [ "kenny.ewi.tudelft.nl" "131.180.119.71" ]; publicKey = "ssh-dss AAAAB3NzaC1kc3MAAACBANmEz1UzFCfab/a/VjWFr/mrwB/trcMPXg15U6vy6iprg34vKbanefX0BJOyBUdueNenSAcuC18mDH/aYrCb7Y5CyhLQH8w7YaTpehbpMIS4SJGC3hRd4LSE7mYBUQf396Syp5coA0CHZJZ6lhLYspZCHDonm1vAfVyMqJOSubPlAAAAFQCNFpbZrLGfyPcWss7e+iF/i/xszwAAAIBONlTGHQpDNadffT9NQ3l8hFe8P9MJvRIUW1q/VEzRRBcbBWQnYh35YXMYPyrZaXaGILv6ma462PUu23VBoF9/twxMRBkKEuWfe1c+YM0w7wd6BA5L99GMhQGsy8ahSyD3FN3sW9kqqzryYt0KgCqCTDo/HAp51UYCeXuflABv8QAAAIB3lV9cSaUrso1jMhkPJU+oIuUjGyd+8stWGp2lXc0+ccud+tkx9rpTr2oZOcM6/2NKSvz6XXQ+9l/iTQxSIlrJpi337Hpv4qkjB2R0cID+xxKT5Y9NLxMtaEipwvpAX4GRtpzK0KJB9x4CM8jiF1SIRPQkBKZme8XPq8B3kdCEIA=="; }
96
+ { hostNames = [ "kyle.ewi.tudelft.nl" "131.180.119.72" ]; publicKey = "ssh-dss AAAAB3NzaC1kc3MAAACBAJtmR7tVnalxWtoAc7Xewomickd5qB4Zc7U/+P3OAweqdmYB9uzJPOIfKcuw3o02du1exalgtcUKeqGCPWB8uAwScDB/sbMuN9vxIoogYsT4aZFlgzUM9Nvan9Q4jJ9fi9wBD0KJWSTf3WSQm18p/NQ7hwXqHA5ry2HFCrP005oBAAAAFQDRK3bgyIpLB0gQnRwSK9RScmekvQAAAIEAhZVMQBUW13XAMHQxPVMug9kW6uAp/Dk/nm124KIeeCDgV+SMCSntwdE7opz+CfR2GbMVOKYRlx8TJJhuI4ubPYT0HrcmP9snAgidwXME8DZCdxfdz7c04ggTrww3Z/yc0dS5rDv7OF3dO/44WXFzOwWV8rV6ihf4lY+WrhDeITwAAACBAIbOt7wn5moefey3ZIZQ3Ls7neP69b35oYpAjtb/8rOMMe+umg2jACMP/G/pGn77cZ8XTN6eVA6oJTSKAzJQhxQBQeBMk96cJHKOtstAMTW++5PK0x0iMehn/NMxVf905oTlTNPyNuf2xOK3u0MtzFAn03qWFFeIXT8db2NKckvs"; }
97
+ { hostNames = [ "lucifer.ewi.tudelft.nl" "131.180.119.73" ]; publicKey = "ssh-dss AAAAB3NzaC1kc3MAAACBAPrrqKNWZX/3uDOpxrIiiw25uiyWdoxw6KBqLB073Pa6wCttMEzNMHRXYZ8DeKYu4wme0b0siST+sXHDAiuYfyeTpr0IIQSoSCmVkEbV+qddSQG3j1nsQS/UoOa9+NLeT1A/VjvHLY+84OfCj2cIsH8K5pq2kRgzO8mPMCiBqIvVAAAAFQDM7cuqhTdSz19NPFFTLsxumhDsywAAAIBEnvmdidhrWcyJ8PFn65IaRnU5wrxbfza/+yWXQzsEo83ROIJn9rsa497fm1ZIEddD0GjJcQDYhHRoS1M3Yd4NuPSd4677FnRZwU1oVC+KvjslOfdaWCrSpBZ9Ku6vc8/27gF+HgLdG2mXIqkKMbtEiREOB1RD1C3+1fJ2o2BjjgAAAIEA+uPTp8aZIu9o/E0jyIDQXT6LZ37jTSK2M2LJw9kT1GWpJfLjnntUfvAUmJOoWAaEKuy2abafHLPrefnqKzIWy8OKPUzfwW+Kqre6SUNyKxeEXN+rdqR7LIZhYweoX8tHxbNCf2HkwJvZQw7lx9ACfeOkA5N56krb7kZqtCP6N6I="; }
98
+ { hostNames = [ "stan.ewi.tudelft.nl" "131.180.119.74" ]; publicKey = "ssh-dss AAAAB3NzaC1kc3MAAACBAL0SlYpGjDjPKrLIwoltYHHTYo/d6Ct2FQZKh4ltKOszWPYYAbs/YNSm2eFkvj0CGc3aastFuebz6+pRfvGMvqi4q6IoHwVvOkbWMadyuqrWIO+Z1YemZP/GAG69pLy+UyoydiSI83ycwPe4YARAU/cpBMNKJZbSxyrO80XatmtRAAAAFQC291WK+9M8+zI4KAtk6EqX0vqQ1QAAAIBd1YgRfdfRdu60BpR+3/YMbSYZMjRLFPyoSgmEQR2TtKfqsuKTsTREzB20iMgFlhEWb6C4r5y6jYDU85OOnvpf7zne22j6bKFDIiAbgsjUFHK1EB7+TBltf5yqq0FyNOy/PnLqVzOeGaUeCOc3Ris71Lxkm60oVF4mjut2d2UJ6AAAAIByuCH1bIIRb4za4yiiFQUz2CBX1XHhBn/h/LhNMLuyCTciG6tkppGBAgq5rWrNhjaEc7dIFgZR+E1wE5PQzWG/TBiXctwCOqOOErDB5b95jO2EntIhi8x5PO9Ef6jgis4QRsBIZiENDDeQHxFHCv4q+10TpyV+625O8TXkkcxl0g=="; }
99
+ { hostNames = [ "wendy.ewi.tudelft.nl" "131.180.119.77" ]; publicKey = "ssh-dss AAAAB3NzaC1kc3MAAACBAIDHVZ/xtcBsNHJ6qYxa3f1RX5k+SaRwgemCfIBSOgL8AGnsvD+OomlGg/eDhJU60AzFSZBQjKtrgRYWmAnzqSMOtfb9IIT5JfG5h/27LVjaaq29Mv+PcDpuPLuFNW3G50hDD1gA0hQhrZdZBkBv9MBaJgizFUjV9tb8KZIRS+MDAAAAFQC8YJViwihyk0oIHOgBfBifiTku6QAAAIBHadEeonXcbDWH6Q5esR1IU7dFMw/zS/wg9IgH0b7lRZBkyVkS0yxfJ7r8swCQ0Loh9dvLtbHLXMlegNfEFv3nbmZqE4copO/2wOM7SqhJRykByMFEhY28t1O1M4rYmzqXs92VUtc5xiTR/lv93C05KSkOl7rUfw43jsWgQAzIkgAAAIB3s4ntqW4H0TdNJFOpaVq1wgRJi768BAVq7MnuIKpFfjGiO7P1Wtk+6/8rzP3gx4cFELZWfJiDHZO5pJE2UGtx5yioQihg4nnZPxTw4FJS/Olf15S2CB/EsYgn9NlUAfOR29ApwasHAy8uP89iOv94cP3YMnWoSi0jkq8iSrSy7Q=="; }
100
+ ];
101
+
102
+}
delft/lucifer.nix
+1
-130
@@ -4,16 +4,10 @@ with lib;
4
5
{
6
imports =
7
- [ ./common.nix
8
- ../../hydra/hydra-module.nix
9
- ./hydra-mirror.nix
7
+ [ ./build-machines-common.nix
8
./megacli.nix
11
- ./datadog.nix
12
- ./datadog/hydra.nix
9
];
10
15
- nixpkgs.system = "x86_64-linux";
16
-
11
environment.systemPackages =
12
[ pkgs.wget pkgs.megacli config.boot.kernelPackages.sysdig ];
13
@@ -55,138 +49,15 @@ with lib;
49
50
fileSystems."/data".device = "/dev/disk/by-label/data";
51
58
-
52
fileSystems."/backup-tud" =
53
{ device = "172.16.26.5://vol/vol_backup_linux_fbs_ewi_buildfarm_lucifer/qt_backup_linux_fbs_ewi_buildfarm_lucifer";
54
fsType = "nfs4";
55
};
56
64
- services.nfs.server.enable = true;
65
- services.nfs.server.exports =
66
- ''
67
- /data/releases 192.168.1.0/255.255.255.0(ro,no_root_squash,fsid=0,no_subtree_check)
68
- '';
69
-
70
- nixpkgs.config.subversion.pythonBindings = true;
71
-
72
- services.cron.systemCronJobs =
73
- let
74
- # Run the garbage collector on ‘machine’ to ensure that at least
75
- # ‘gbFree’ GiB are free.
76
- gcRemote = { machine, gbFree ? 8, df ? "df" }:
77
- "15 03 * * * root ssh -x -i /var/lib/hydra/queue-runner/.ssh/id_buildfarm ${machine} " +
78
- ''nix-store --gc --max-freed '$((${toString gbFree} * 1024**3 - 1024 * $(${df} -P -k /nix/store | tail -n 1 | awk "{ print \$4 }")))' > "/var/log/gc-${machine}.log" 2>&1'';
79
- in
80
- [ (gcRemote { machine = "nix@butters"; gbFree = 50; })
81
- #(gcRemote { machine = "nix@garrison"; })
82
- #(gcRemote { machine = "nix@demon"; })
83
- #(gcRemote { machine = "nix@beastie"; })
84
- #(gcRemote { machine = "nix@tweek"; gbFree = 3; df = "/usr/gnu/bin/df"; })
85
- ];
86
-
87
- # Set some cgroup limits.
88
- systemd.services.sshd.serviceConfig.CPUShares = 2000;
89
- systemd.services.sshd.serviceConfig.BlockIOWeight = 1000;
90
- systemd.services.nix-daemon.serviceConfig.CPUShares = 200;
91
- systemd.services.nix-daemon.serviceConfig.BlockIOWeight = 500;
92
- systemd.services.hydra-queue-runner.serviceConfig.CPUShares = 200;
93
- systemd.services.hydra-queue-runner.serviceConfig.BlockIOWeight = 700;
94
- systemd.services.hydra-evaluator.serviceConfig.CPUShares = 100;
95
- systemd.services.hydra-evaluator.serviceConfig.BlockIOWeight = 100;
96
- systemd.services.hydra-server.serviceConfig.CPUShares = 700;
97
- systemd.services.hydra-server.serviceConfig.BlockIOWeight = 200;
98
-
99
- nix.sshServe.enable = true;
100
- nix.sshServe.keys = with import ../ssh-keys.nix; [ eelco rob ];
101
-
102
- users.extraUsers.hydra.openssh.authorizedKeys.keys = with import ../ssh-keys.nix; [ eelco rob ];
103
- users.extraUsers.hydra-www.openssh.authorizedKeys.keys = with import ../ssh-keys.nix; [ eelco rob ];
104
- users.extraUsers.hydra-queue-runner.openssh.authorizedKeys.keys = with import ../ssh-keys.nix; [ eelco rob provisioner ];
105
-
57
users.extraUsers.rbvermaa =
58
{ description = "Rob Vermaas";
59
home = "/home/rbvermaa";
60
isNormalUser = true;
61
openssh.authorizedKeys.keys = [ (import ../ssh-keys.nix).rob ];
62
};
112
-
113
- nix.gc.automatic = true;
114
- nix.gc.options = ''--max-freed "$((700 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
115
-
116
- # Hydra configuration.
117
- services.hydra.enable = true;
118
- services.hydra.logo = ./hydra-logo.png;
119
- services.hydra.dbi = "dbi:Pg:dbname=hydra;host=wendy;user=hydra;";
120
- services.hydra.hydraURL = "http://hydra.nixos.org";
121
- services.hydra.notificationSender = "e.dolstra@tudelft.nl"; # FIXME
122
- services.hydra.extraConfig =
123
- ''
124
- max_servers 50
125
- enable_persona 1
126
-
127
- enable_google_login = 1
128
- google_client_id = 816926039128-ia4s4rsqrq998rsevce7i09mo6a4nffg.apps.googleusercontent.com
129
-
130
- binary_cache_secret_key_file = /var/lib/hydra/queue-runner/keys/cache.nixos.org-1/secret
131
- binary_cache_public_key_file = /var/lib/hydra/queue-runner/keys/cache.nixos.org-1/public
132
-
133
- store_mode = s3-binary-cache
134
- binary_cache_s3_bucket = nix-cache
135
- binary_cache_public_uri = https://cache.nixos.org
136
-
137
- <hipchat>
138
- jobs = (hydra|nixops):.*:.*
139
- room = 182482
140
- token = ${builtins.readFile ./hipchat-lb-token}
141
- </hipchat>
142
-
143
- <Plugin::Session>
144
- cache_size = 32m
145
- </Plugin::Session>
146
- '';
147
-
148
- #services.hydra.package = builtins.storePath /nix/store/qrd493zbpnk8hqs2pc01jac0l715xsd4-hydra-0.1pre1234-abcdef;
149
-
150
- users.extraUsers.hydra.home = mkForce "/home/hydra";
151
-
152
- programs.ssh.extraConfig = mkAfter
153
- ''
154
- ServerAliveInterval 120
155
- TCPKeepAlive yes
156
-
157
- Host mac1
158
- Hostname 83.87.124.39
159
- Port 15022
160
- Compression yes
161
-
162
- Host mac2
163
- Hostname 94.211.55.77
164
- Port 6001
165
- Compression yes
166
-
167
- Host mac3
168
- Hostname 94.211.55.77
169
- Port 6002
170
- Compression yes
171
-
172
- Host mac4
173
- Hostname 94.211.55.77
174
- Port 6003
175
- Compression yes
176
-
177
- Host mac5
178
- Hostname 94.211.55.77
179
- Port 6004
180
- Compression yes
181
- '';
182
-
183
- services.openssh.knownHosts =
184
- [
185
- { hostNames = [ "83.87.124.39" ]; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVTkY4tQ6V29XTW1aKtoFJoF4uyaEy0fms3HqmI56av8UCg3MN5G6CL6EDIvbe46mBsI3++V3uGiOr0pLPbM9fkWC92LYGk5f7fNvCoy9bvuZy5bHwFQ5b5S9IJ1o3yDlCToc9CppmPVbFMMMLgKF06pQiGBeMCUG/VoCfiUBq+UgEGhAifWcuWIOGmdua6clljH5Dcc+7S0HTLoVtrxmPPXBVZUvW+lgAJTM6FXYIZiIqMSC2uZHGVstY87nPcZFXIbzhlYQqxx5H0um2bL3mbS7vdKhSsIWWaUZeck9ghNyUV1fVRLUhuXkQHe/8Z58cAhTv5dDd42YLB0fgjETV"; }
186
- { hostNames = [ "[94.211.55.77]:6001" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4oeixXSB/Ovl3kewykJ2vV82ATOLqPgZDXPdLCmkPRHYt7dy7GNbWrESv3gQvgjEtKaZavthf7aQsJHNa8aKc="; }
187
- { hostNames = [ "[94.211.55.77]:6002" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO45JPJIqbQVs3I4RmO01ExRv6krTEnuheAvumgKeb6NwUo6oD1kP4/x8KazoMd4LRAFtdWdwnN3Z7IYmqlmd20="; }
188
- { hostNames = [ "[94.211.55.77]:6003" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIMKd1aV7ktAMIZUQV151dbZu/AM7Hszb4dMqwqQ7F8uLOmO+qyyS3nQHrGG6I5VAKbRkbTCn3l0DhYFj7sS6U="; }
189
- { hostNames = [ "[94.211.55.77]:6004" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLeZFijo43wK8V2/9lXt7OH3axZb4kyZBV7Hn11YdmjPn8KHNkiRNiq9x/AuEhWmpY//9K1XU8RezV5LkGgyirU="; }
190
- ];
191
-
63
}
delft/network.nix
+1
@@ -7,4 +7,5 @@
7
wendy = import ./wendy.nix;
8
ike = import ./build-machines-dell-r815.nix;
9
#shelley = import ./build-machines-dell-r815.nix;
10
+ chef = import ./chef.nix;
11
}
delft/wendy.nix
+8
-63
@@ -1,6 +1,7 @@
1
-{ config, pkgs, ... }:
1
+{ config, lib, pkgs, ... }:
2
+
3
+with lib;
4
3
-with pkgs.lib;
5
let
6
duplicityBackup = pkgs.writeScript "backup-duplicity" ''
7
#! /bin/sh
@@ -42,14 +43,9 @@ in
43
password: ${builtins.readFile ./datadog.secret}
44
'';
45
45
- services.postgresqlBackup = {
46
- enable = true;
47
- databases = [ "hydra" ];
48
- };
49
-
46
services.postgresql = {
47
enable = true;
52
- enableTCPIP = true;
48
+ #enableTCPIP = true;
49
package = pkgs.postgresql92;
50
dataDir = "/data/postgresql";
51
extraConfig = ''
@@ -58,38 +54,17 @@ in
54
log_statement = 'none'
55
max_connections = 250
56
work_mem = 16MB
61
- shared_buffers = 4GB
57
+ shared_buffers = 2GB
58
# Checkpoint every 256 MB.
59
checkpoint_segments = 16
60
# We can risk losing some transactions.
61
synchronous_commit = off
66
- effective_cache_size = 24GB
67
- '';
68
- authentication = ''
69
- host all all 131.180.119.77/32 md5
70
- host hydra hydra 131.180.119.73/32 md5
71
- host hydra_test hydra 131.180.119.73/32 md5
72
- host zabbix zabbix 131.180.119.73/32 md5
62
+ effective_cache_size = 8GB
63
'';
64
};
65
76
- # Bump kernel.shmmax for PostgreSQL. FIXME: this should be a NixOS
77
- # option around systemd-sysctl.
78
- system.activationScripts.setShmMax =
79
- ''
80
- ${pkgs.procps}/sbin/sysctl -q -w kernel.shmmax=$((6 * 1024**3))
81
- '';
82
-
83
- services.zabbixAgent.extraConfig = ''
84
- UserParameter=hydra.evaluations.timesincelast,${pkgs.postgresql}/bin/psql hydra -At -c 'select round(EXTRACT(EPOCH FROM now()) - timestamp) from jobsetevals order by id desc limit 1'
85
- UserParameter=hydra.queue.total,${pkgs.postgresql}/bin/psql hydra -At -c 'select count(*) from builds where finished = 0'
86
- UserParameter=hydra.queue.building,${pkgs.postgresql}/bin/psql hydra -At -c 'select count(*) from builds where finished = 0 and busy = 1'
87
- UserParameter=hydra.queue.buildsteps,${pkgs.postgresql}/bin/psql hydra -At -c 'select count(*) from BuildSteps s join Builds i on s.build = i.id where i.finished = 0 and i.busy = 1 and s.busy = 1'
88
- UserParameter=hydra.builds,${pkgs.postgresql}/bin/psql hydra -At -c 'select count(*) from Builds'
89
- '';
90
-
66
services.cron.systemCronJobs =
92
- [ "15 4 * * * root cp -v /var/backup/postgresql/* /backup/wendy/postgresql/ &> /var/log/backup-db.log"
67
+ [ #"15 4 * * * root cp -v /var/backup/postgresql/* /backup/wendy/postgresql/ &> /var/log/backup-db.log"
68
# Force the sixxs tunnel to stay alive by periodically
69
# pinging the other side. This is necessary to remain
70
# reachable from the outside.
@@ -111,12 +86,6 @@ in
86
87
firewall.allowedTCPPorts = [ 80 443 10051 5432 5999 ];
88
firewall.allowedUDPPorts = [ 53 67 ];
114
- /*
115
- firewall.extraCommands =
116
- ''
117
- iptables -A nixos-fw -p tcp --dport 5432 -i internal -j nixos-fw-accept
118
- '';
119
- */
89
90
localCommands =
91
''
@@ -144,9 +113,7 @@ in
113
dhcpcd.denyInterfaces = [ "sixxs" ];
114
};
115
147
- # Needed for the Nixpkgs mirror script.
148
- environment.pathsToLink = [ "/libexec" ];
149
- environment.systemPackages = [ pkgs.dnsmasq pkgs.duplicity pkgs.db4 ];
116
+ environment.systemPackages = [ pkgs.duplicity ];
117
118
# Use cgroups to limit Apache's resources.
119
systemd.services.httpd.serviceConfig.CPUShares = 1000;
@@ -157,19 +124,6 @@ in
124
#services.zabbixServer.dbServer = "wendy";
125
#services.zabbixServer.dbPassword = import ./zabbix-password.nix;
126
160
- # Poor man's time sync for the non-NixOS machines.
161
- /*
162
- systemd.services.fix-time =
163
- { path = [ pkgs.openssh ];
164
- script =
165
- ''
166
- ssh root@beastie "date $(date +'%Y%m%d%H%M.%S')" || true
167
- ssh root@demon "date $(date +'%Y%m%d%H%M.%S')" || true
168
- '';
169
- startAt = "*:03";
170
- };
171
- */
172
-
127
services.logrotate.enable = true;
128
services.logrotate.config = ''
129
/var/log/httpd/access_log
@@ -190,15 +144,6 @@ in
144
}
145
'';
146
193
- systemd.services.htcacheclean =
194
- { path = [ ];
195
- description = "Clean httpd Cache";
196
- serviceConfig.ExecStart =
197
- "${config.services.httpd.package}/bin/htcacheclean " +
198
- "-v -t -l 32G -p /var/cache/hydra-binary-cache";
199
- startAt = "Sat 05:45";
200
- };
201
-
147
users.extraUsers.eelco =
148
{ description = "Eelco Dolstra";
149
home = "/home/eelco";