rhea: disable hydra
Martin Weinelt committed
Dec 5, 2024 at 12:02 UTC
1ba158df103699e05bba689f0ccf062a645f3b9c
5 files changed
+36
-33
build/common.nix
+3
@@ -71,6 +71,7 @@ with lib;
71
networking.firewall.rejectPackets = true;
72
networking.firewall.allowPing = true;
73
networking.firewall.allowedTCPPorts = [ 10050 ];
74
+ networking.firewall.logRefusedConnections = false;
75
76
services.resolved = {
77
enable = true;
@@ -114,4 +115,6 @@ with lib;
115
116
security.acme.acceptTerms = true;
117
security.acme.defaults.email = "infra@nixos.org";
118
+
119
+ services.zfs.autoScrub.enable = true;
120
}
build/haumea/postgresql.nix
-2
@@ -89,8 +89,6 @@
89
90
# FIXME: don't use 'trust'.
91
authentication = ''
92
- host hydra all 10.254.1.3/32 trust
93
- host hydra all 10.254.1.5/32 trust
92
local all root peer map=prometheus
93
'';
94
build/hydra-proxy.nix
+5
@@ -1,6 +1,11 @@
1
{ config, ... }:
2
3
{
4
+ networking.firewall.allowedTCPPorts = [
5
+ 80
6
+ 443
7
+ ];
8
+
9
services.nginx = {
10
enable = true;
11
enableReload = true;
build/hydra.nix
+24
@@ -7,8 +7,32 @@ let
7
in
8
9
{
10
+ networking.firewall.allowedTCPPorts = [
11
+ 9198 # queue-runnner metrics
12
+ 9199 # hydra-notify metrics
13
+ ];
14
+
15
+ # garbage collection
16
+ nix.gc = {
17
+ automatic = true;
18
+ options = ''--max-freed "$((400 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
19
+ dates = "03,09,15,21:15";
20
+ };
21
+
22
+ # gc outputs as well, since they are served from the cache
23
+ nix.settings.gc-keep-outputs = false;
24
+
25
+ # Don't rate-limit the journal.
26
+ services.journald.rateLimitBurst = 0;
27
+
28
+ systemd.services.hydra-queue-runner = {
29
+ serviceConfig.ManagedOOMPreference = "avoid";
30
+ };
31
+
32
services.hydra-dev.enable = true;
33
services.hydra-dev.package = pkgs.hydra;
34
+ services.hydra-dev.buildMachinesFiles = [ "/etc/nix/machines" ];
35
+ services.hydra-dev.dbi = "dbi:Pg:dbname=hydra;host=10.254.1.9;user=hydra;";
36
services.hydra-dev.logo = ./hydra-logo.png;
37
services.hydra-dev.hydraURL = "https://hydra.nixos.org";
38
services.hydra-dev.notificationSender = "edolstra@gmail.com";
build/rhea/configuration.nix
+4
-31
@@ -1,55 +1,28 @@
1
-{ pkgs, ... }:
1
{
2
imports = [
3
./hardware-configuration.nix
4
./hetzner.nix
5
./network.nix
6
../common.nix
8
- ../hydra.nix
9
- ../hydra-proxy.nix
10
- ../hydra-scaler.nix
11
- ../packet-importer.nix
7
];
8
9
networking = {
10
hostName = "rhea";
16
- firewall.allowedTCPPorts = [
17
- 80
18
- 443
19
- 9198 # hydra-queue-runner's prometheus
20
- 9199 # hydra-notify's prometheus
21
- ];
11
firewall.allowPing = true;
23
- firewall.logRefusedConnections = false;
12
};
13
14
+ users.users.root.openssh.authorizedKeys.keys = [
15
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIY0EGPGfXD1L+YdSJIKUzeFyuUfVW58kMh+mSflEFx1 root@mimas"
16
+ ];
17
+
18
system.stateVersion = "21.11";
19
28
- services.hydra-dev.dbi = "dbi:Pg:dbname=hydra;host=10.254.1.9;user=hydra;";
20
systemd.services.hydra-init = {
21
after = [ "wireguard-wg0.service" ];
22
requires = [ "wireguard-wg0.service" ];
23
};
33
- systemd.services.hydra-queue-runner = {
34
- serviceConfig.ManagedOOMPreference = "avoid";
35
- };
36
- services.hydra-dev.buildMachinesFiles = [ "/etc/nix/machines" ];
24
25
# hydra-evaluator causes very sharp spikes in RAM usage on trunk-combined
26
zramSwap.enable = true;
27
zramSwap.memoryPercent = 150;
41
-
42
- nix.gc.automatic = true;
43
- nix.gc.options = ''--max-freed "$((400 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
44
- nix.gc.dates = "03,09,15,21:15";
45
-
46
- nix.extraOptions = "gc-keep-outputs = false";
47
-
48
- #services.postfix.enable = true;
49
- #services.postfix.hostname = "hydra.nixos.org";
50
-
51
- # Don't rate-limit the journal.
52
- services.journald.rateLimitBurst = 0;
53
-
54
- services.zfs.autoScrub.enable = true;
28
}