@cryptotaxi247 / infra / commits / 41563317

ngi0: Run Hydra

Eelco Dolstra committed Feb 25, 2020 at 17:33 UTC 41563317d93ca9012a85a1a7d465c17ffb1230c8
4 files changed +271 -4
ngi0/hydra/flake.lock
+108
@@ -1,5 +1,113 @@
1 {
2 "inputs": {
3 + "hydra": {
4 + "info": {
5 + "lastModified": 1582143022,
6 + "narHash": "sha256-AZB2nAoNjD7NUANUDCW1SfDv2n260aU2bUHazjk81K4="
7 + },
8 + "inputs": {
9 + "nix": {
10 + "info": {
11 + "lastModified": 1582125169,
12 + "narHash": "sha256-rgoyhvUVM78gLkvviTA/9f6esC7ZJtnDLt1hzAaq2Ds="
13 + },
14 + "inputs": {
15 + "nixpkgs": {
16 + "info": {
17 + "lastModified": 1580555706,
18 + "narHash": "sha256-ly5Gxl9yZgW2w1F3aDU5bvg34Ct+juUaOg8vue+Mkbo="
19 + },
20 + "inputs": {},
21 + "locked": {
22 + "owner": "edolstra",
23 + "repo": "nixpkgs",
24 + "rev": "43e283790fbe330b723ac44b584824cf6d85c1ee",
25 + "type": "github"
26 + },
27 + "original": {
28 + "id": "nixpkgs",
29 + "ref": "release-19.09",
30 + "type": "indirect"
31 + }
32 + }
33 + },
34 + "locked": {
35 + "owner": "NixOS",
36 + "repo": "nix",
37 + "rev": "4ad5826a182f8eeb4cbc61e27d2128b08050b0d4",
38 + "type": "github"
39 + },
40 + "original": {
41 + "id": "nix",
42 + "type": "indirect"
43 + }
44 + },
45 + "nixpkgs": {
46 + "info": {
47 + "lastModified": 1581348815,
48 + "narHash": "sha256-ZYGphR59gsdFhtZYDoeuCtULm8ym/qJSHIslih9b1s8="
49 + },
50 + "inputs": {},
51 + "locked": {
52 + "owner": "edolstra",
53 + "repo": "nixpkgs",
54 + "rev": "d959778e0934c4c93896d509a65de798909c7cdd",
55 + "type": "github"
56 + },
57 + "original": {
58 + "id": "nixpkgs",
59 + "ref": "release-19.09",
60 + "type": "indirect"
61 + }
62 + }
63 + },
64 + "locked": {
65 + "owner": "NixOS",
66 + "repo": "hydra",
67 + "rev": "be8eb9d00d6a3fcac520bc7dfd5740c0b3ade746",
68 + "type": "github"
69 + },
70 + "original": {
71 + "id": "hydra",
72 + "type": "indirect"
73 + }
74 + },
75 + "nix": {
76 + "info": {
77 + "lastModified": 1582238822,
78 + "narHash": "sha256-QMm+HqYMZM+krNF/Q/nLGMCUOuDdHD/PWZ5p2fwJMZs="
79 + },
80 + "inputs": {
81 + "nixpkgs": {
82 + "info": {
83 + "lastModified": 1580555706,
84 + "narHash": "sha256-ly5Gxl9yZgW2w1F3aDU5bvg34Ct+juUaOg8vue+Mkbo="
85 + },
86 + "inputs": {},
87 + "locked": {
88 + "owner": "edolstra",
89 + "repo": "nixpkgs",
90 + "rev": "43e283790fbe330b723ac44b584824cf6d85c1ee",
91 + "type": "github"
92 + },
93 + "original": {
94 + "id": "nixpkgs",
95 + "ref": "release-19.09",
96 + "type": "indirect"
97 + }
98 + }
99 + },
100 + "locked": {
101 + "owner": "NixOS",
102 + "repo": "nix",
103 + "rev": "4a4521f46253e87a06af9333381c050e983b3c2f",
104 + "type": "github"
105 + },
106 + "original": {
107 + "id": "nix",
108 + "type": "indirect"
109 + }
110 + },
111 "nixpkgs": {
112 "info": {
113 "lastModified": 1582398521,
ngi0/hydra/flake.nix
+24 -4
@@ -3,7 +3,7 @@
3
4 inputs.nixpkgs.uri = "nixpkgs/release-19.09";
5
6 - outputs = { self, nixpkgs }: {
6 + outputs = { self, nixpkgs, nix, hydra }: {
7
8 nixopsConfigurations.default = {
9 inherit nixpkgs;
@@ -11,7 +11,20 @@
11 makemake =
12 { config, lib, pkgs, ... }:
13
14 - {
14 + { imports =
15 + [ ../../modules/common.nix
16 + hydra.nixosModules.hydra
17 + ./hydra.nix
18 + ./hydra-proxy.nix
19 + ];
20 +
21 + nixpkgs.overlays =
22 + [ nix.overlay
23 + ];
24 +
25 + #system.configurationRevision = flakes.self.rev
26 + # or (throw "Cannot deploy from an unclean source tree!");
27 +
28 deployment.targetEnv = "hetzner";
29 deployment.hetzner.mainIPv4 = "116.202.113.248"; # 2a01:4f8:231:4187::2
30 deployment.hetzner.createSubAccount = false;
@@ -71,12 +84,19 @@
84 fsType = "zfs";
85 };
86
74 - networking.hostId = "5240310e";
87 + networking = {
88 + hostId = "5240310e";
89 + firewall.allowedTCPPorts = [ 80 443 ];
90 + firewall.allowPing = true;
91 + firewall.logRefusedConnections = true;
92 + };
93
94 boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ];
95 boot.loader.grub.copyKernels = true;
78 - };
96
97 + users.extraUsers.root.openssh.authorizedKeys.keys =
98 + with import ../../ssh-keys.nix; [ zimbatm ];
99 + };
100 };
101
102 };
ngi0/hydra/hydra-proxy.nix new
+99
@@ -0,0 +1,99 @@
1 +{ config, lib, pkgs, ...}:
2 +
3 +let
4 +
5 + hydraProxyConfig =
6 + ''
7 + TimeOut 900
8 +
9 + <Proxy *>
10 + Order deny,allow
11 + Allow from all
12 + </Proxy>
13 +
14 + ProxyRequests Off
15 + ProxyPreserveHost On
16 + ProxyPass /apache-errors !
17 + ProxyPass /.well-known !
18 + ErrorDocument 503 /apache-errors/503.html
19 + ProxyPass / http://127.0.0.1:3000/ retry=5 disablereuse=on
20 + ProxyPassReverse / http://127.0.0.1:3000/
21 +
22 + <Location />
23 + SetOutputFilter DEFLATE
24 + BrowserMatch ^Mozilla/4\.0[678] no-gzip\
25 + BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
26 + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|narinfo)$ no-gzip dont-vary
27 + SetEnvIfNoCase Request_URI /api/ no-gzip dont-vary
28 + SetEnvIfNoCase Request_URI /download/ no-gzip dont-vary
29 + SetEnvIfNoCase Request_URI /nar/ no-gzip dont-vary
30 + </Location>
31 + '';
32 +
33 + acmeKeyDir = "/var/lib/acme/hydra.ngi0.nixos.org";
34 + acmeWebRoot = "/var/lib/httpd/acme";
35 +
36 +in
37 +
38 +{
39 +
40 + services.httpd = {
41 + enable = true;
42 + adminAddr = "ngi@nixos.org";
43 + hostName = "hydra.ngi0.nixos.org";
44 + logFormat = ''"%h %l %u %t \"%r\" %>s %b %D"'';
45 + extraConfig = hydraProxyConfig +
46 + ''
47 + RewriteEngine On
48 + RewriteCond %{HTTPS} off
49 + RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
50 + '';
51 +
52 + servedDirs =
53 + [ { urlPath = "/apache-errors";
54 + dir = ../../delft/apache-errors;
55 + }
56 + { urlPath = "/.well-known/acme-challenge";
57 + dir = "${acmeWebRoot}/.well-known/acme-challenge";
58 + }
59 + ];
60 +
61 + virtualHosts = [
62 + { hostName = "hydra.nixos.org";
63 + enableSSL = true;
64 + sslServerKey = "${acmeKeyDir}/key.pem";
65 + sslServerCert = "${acmeKeyDir}/fullchain.pem";
66 + extraConfig = ''
67 + # Required by Catalyst.
68 + RequestHeader set X-Forwarded-Proto https
69 + RequestHeader set X-Forwarded-Port 443
70 + Header always set Strict-Transport-Security "max-age=15552000"
71 + '';
72 + }
73 + ];
74 +
75 + };
76 +
77 + # Let's Encrypt configuration.
78 + security.acme.certs."hydra.ngi0.nixos.org" =
79 + { email = "ngi@nixos.org";
80 + webroot = acmeWebRoot;
81 + postRun = "systemctl reload httpd.service";
82 + };
83 +
84 + # Generate a dummy self-signed certificate until we get one from
85 + # Let's Encrypt.
86 + system.activationScripts.createDummyKey =
87 + ''
88 + dir=${acmeKeyDir}
89 + mkdir -m 0700 -p $dir
90 + if ! [[ -e $dir/key.pem ]]; then
91 + ${pkgs.openssl}/bin/openssl genrsa -passout pass:foobar -des3 -out $dir/key-in.pem 1024
92 + ${pkgs.openssl}/bin/openssl req -passin pass:foobar -new -key $dir/key-in.pem -out $dir/key.csr \
93 + -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
94 + ${pkgs.openssl}/bin/openssl rsa -passin pass:foobar -in $dir/key-in.pem -out $dir/key.pem
95 + ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
96 + fi
97 + '';
98 +
99 +}
ngi0/hydra/hydra.nix new
+40
@@ -0,0 +1,40 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + services.hydra-dev.enable = true;
5 + #services.hydra-dev.logo = ./hydra-logo.png;
6 + services.hydra-dev.hydraURL = "https://hydra.ngi0.nixos.org";
7 + services.hydra-dev.notificationSender = "ngi@nixos.org";
8 + services.hydra-dev.smtpHost = "localhost";
9 + services.hydra-dev.useSubstitutes = true;
10 + services.hydra-dev.extraConfig =
11 + ''
12 + max_servers 15
13 +
14 + #store_uri = s3://nix-cache?secret-key=/var/lib/hydra/queue-runner/keys/cache.nixos.org-1/secret&write-nar-listing=1&ls-compression=br&log-compression=br
15 + #server_store_uri = https://cache.nixos.org?local-nar-cache=$ {narCache}
16 + #binary_cache_public_uri = https://cache.nixos.org
17 +
18 + <Plugin::Session>
19 + cache_size = 32m
20 + </Plugin::Session>
21 +
22 + # patchelf:master:3
23 + xxx-jobset-repeats = nixos:reproducibility:1
24 +
25 + # https://status.nixos.org/prometheus/graph?g0.range_input=2w&g0.expr=hydra_memory_tokens_in_use&g0.tab=0
26 + nar_buffer_size = ${let gb = 8; in toString (gb * 1024 * 1024 * 1024)}
27 +
28 + #upload_logs_to_binary_cache = true
29 +
30 + # FIXME: Cloudfront messes up CORS
31 + #log_prefix = https://cache.nixos.org/
32 +
33 + #log_prefix = https://nix-cache.s3.amazonaws.com/
34 +
35 + evaluator_workers = 4
36 + evaluator_max_memory_size = 4096
37 +
38 + max_concurrent_evals = 2
39 + '';
40 +}
\ No newline at end of file