Add nixos.org EC2 infrastructure
For the moment, the releases and the source tarball mirror are in EBS volumes. We'll want to move them to S3 eventually, but that requires updating various scripts...
Eelco Dolstra committed
May 31, 2013 at 18:31 UTC
42d87345f54885a78170e1c88e1b67f6db152b63
2 files changed
+289
nixos-org/network.nix
new
+78
@@ -0,0 +1,78 @@
1
+let
2
+ region = "eu-west-1";
3
+ zone = "eu-west-1a";
4
+ accessKeyId = "lb-nixos";
5
+in
6
+
7
+{
8
+ network.description = "Nixos.org Infrastructure";
9
+
10
+ resources.ebsVolumes.tarballs =
11
+ { name = "Nixpkgs source tarball mirror";
12
+ inherit region zone accessKeyId;
13
+ size = 100;
14
+ };
15
+
16
+ resources.ebsVolumes.releases =
17
+ { name = "Nix/Nixpkgs/NixOS releases";
18
+ inherit region zone accessKeyId;
19
+ size = 250;
20
+ };
21
+
22
+ resources.ebsVolumes.data =
23
+ { name = "Misc. data";
24
+ inherit region zone accessKeyId;
25
+ size = 10;
26
+ };
27
+
28
+ resources.elasticIPs."nixos.org" =
29
+ { inherit region accessKeyId;
30
+ };
31
+
32
+ resources.ec2KeyPairs.default =
33
+ { inherit region accessKeyId;
34
+ };
35
+
36
+ webserver =
37
+ { config, pkgs, resources, ... }:
38
+
39
+ { deployment.targetEnv = "ec2";
40
+ deployment.ec2.region = region;
41
+ deployment.ec2.zone = zone;
42
+ deployment.ec2.instanceType = "m1.medium";
43
+ deployment.ec2.accessKeyId = accessKeyId;
44
+ deployment.ec2.keyPair = resources.ec2KeyPairs.default.name;
45
+ deployment.ec2.securityGroups = [ "public-web" "public-ssh" ];
46
+ deployment.ec2.elasticIPv4 = "54.217.220.47";
47
+ #deployment.ec2.elasticIPv4 = resources.elasticIPs."nixos.org".address;
48
+
49
+ fileSystems."/tarballs" =
50
+ { autoFormat = true;
51
+ fsType = "ext4";
52
+ device = "/dev/xvdf";
53
+ ec2.disk = "vol-29618e05";
54
+ };
55
+
56
+ fileSystems."/releases" =
57
+ { autoFormat = true;
58
+ fsType = "ext4";
59
+ device = "/dev/xvdg";
60
+ ec2.disk = "vol-93af41bf";
61
+ };
62
+
63
+ fileSystems."/data" =
64
+ { autoFormat = true;
65
+ fsType = "ext4";
66
+ device = "/dev/xvdh";
67
+ ec2.disk = "vol-63957b4f";
68
+ };
69
+
70
+ fileSystems."/data/releases" =
71
+ { device = "/releases";
72
+ fsType = "none";
73
+ options = "bind";
74
+ };
75
+
76
+ require = [ ./webserver.nix ];
77
+ };
78
+}
nixos-org/webserver.nix
new
+211
@@ -0,0 +1,211 @@
1
+{ config, pkgs, resources, ... }:
2
+
3
+with pkgs.lib;
4
+
5
+let
6
+
7
+ nixosVHostConfig =
8
+ { hostName = "nixos.org";
9
+ serverAliases = [ "test.nixos.org" "test2.nixos.org" "ipv6.nixos.org" ];
10
+ documentRoot = "/home/eelco/nix-homepage";
11
+ enableUserDir = true;
12
+ servedDirs =
13
+ [ { urlPath = "/tarballs";
14
+ dir = "/tarballs";
15
+ }
16
+ /*
17
+ { urlPath = "/irc";
18
+ dir = "/data/webserver/irc";
19
+ }
20
+ { urlPath = "/update";
21
+ dir = "/data/webserver/update";
22
+ }
23
+ */
24
+ # Backwards compatibility.
25
+ { urlPath = "/releases/nixpkgs/channels";
26
+ dir = "/releases/channels";
27
+ }
28
+ # Backwards compatibility.
29
+ { urlPath = "/releases/nixos/channels";
30
+ dir = "/releases/channels";
31
+ }
32
+ { urlPath = "/channels";
33
+ dir = "/releases/channels";
34
+ }
35
+ { urlPath = "/releases";
36
+ dir = "/releases";
37
+ }
38
+ /*
39
+ { urlPath = "/binary-cache";
40
+ dir = "/data/releases/binary-cache";
41
+ }
42
+ */
43
+ ];
44
+
45
+ extraConfig =
46
+ ''
47
+ #<Proxy *>
48
+ # Order deny,allow
49
+ # Allow from all
50
+ #</Proxy>
51
+ #
52
+ #ProxyPreserveHost On
53
+ #
54
+ #ProxyPass /mturk http://wendy:3000/mturk retry=5
55
+ #ProxyPassReverse /mturk http://wendy:3000/mturk
56
+ #ProxyPass /mturk-sandbox http://wendy:3001/mturk-sandbox retry=5
57
+ #ProxyPassReverse /mturk-sandbox http://wendy:3001/mturk-sandbox
58
+
59
+ MaxKeepAliveRequests 0
60
+
61
+ # Use a very short error message for 404s in the binary
62
+ # cache, since those are very frequent and not generally
63
+ # seen by humans.
64
+ <Location /releases/binary-cache>
65
+ ErrorDocument 404 "No such file."
66
+ </Location>
67
+ '';
68
+
69
+ extraSubservices =
70
+ [ { serviceType = "mediawiki";
71
+ siteName = "Nix Wiki";
72
+ logo = "/logo/nix-wiki.png";
73
+ #defaultSkin = "nixos";
74
+ #skins = [ ./wiki-skins ];
75
+ extraConfig =
76
+ ''
77
+ #$wgEmailConfirmToEdit = true;
78
+
79
+ # Use a reCAPTCHA to prevent spam.
80
+ require_once("$IP/extensions/ConfirmEdit/ConfirmEdit.php");
81
+ require_once("$IP/extensions/ConfirmEdit/ReCaptcha.php");
82
+ $wgCaptchaClass = 'ReCaptcha';
83
+ $wgReCaptchaPublicKey = '6Ldevd8SAAAAAFR6MwnU01FOWJ3O4II3aRJpMQ8F';
84
+ $wgReCaptchaPrivateKey = '${builtins.readFile ./nixos.org-recaptcha-private-key}';
85
+ $wgCaptchaTriggers['edit'] = true;
86
+ $wgCaptchaTriggers['create'] = true;
87
+ '';
88
+ enableUploads = true;
89
+ uploadDir = "/data/nixos-mediawiki-upload";
90
+ }
91
+ { function = import <services/subversion>;
92
+ id = "nix";
93
+ urlPrefix = "";
94
+ toplevelRedirect = false;
95
+ dataDir = "/data/subversion-nix";
96
+ notificationSender = "svn@svn.nixos.org";
97
+ organisation = {
98
+ name = "Nix";
99
+ url = http://nixos.org/;
100
+ logo = "/logo/nixos-lores.png";
101
+ };
102
+ }
103
+ ];
104
+ };
105
+
106
+in
107
+
108
+{
109
+ security.pam.enableSSHAgentAuth = true;
110
+
111
+ services.httpd = {
112
+ enable = true;
113
+ multiProcessingModule = "worker";
114
+ logPerVirtualHost = true;
115
+ adminAddr = "eelco.dolstra@logicblox.com";
116
+ hostName = "localhost";
117
+
118
+ extraConfig =
119
+ ''
120
+ AddType application/nix-package .nixpkg
121
+
122
+ <Location /server-status>
123
+ SetHandler server-status
124
+ Allow from 127.0.0.1 # If using a remote host for monitoring replace 127.0.0.1 with its IP.
125
+ Order deny,allow
126
+ Deny from all
127
+ </Location>
128
+
129
+ ExtendedStatus On
130
+
131
+ StartServers 15
132
+ '';
133
+
134
+ phpOptions =
135
+ ''
136
+ #max_execution_time = 2
137
+ memory_limit = "32M"
138
+ '';
139
+
140
+ virtualHosts =
141
+ [ { # Catch-all site.
142
+ hostName = "www.nixos.org";
143
+ globalRedirect = "http://nixos.org/";
144
+ }
145
+
146
+ nixosVHostConfig
147
+
148
+ { hostName = "tarballs.nixos.org";
149
+ documentRoot = "/tarballs";
150
+ }
151
+
152
+ # Obsolete, kept for backwards compatibility.
153
+ { hostName = "svn.nixos.org";
154
+ globalRedirect = "https://nixos.org/repoman";
155
+ }
156
+
157
+ # Obsolete, kept for backwards compatibility.
158
+ { hostName = "wiki.nixos.org";
159
+ extraConfig = ''
160
+ RedirectMatch ^/$ https://nixos.org/wiki
161
+ Redirect / https://nixos.org/
162
+ '';
163
+ }
164
+ ];
165
+ };
166
+
167
+ users.extraUsers.eelco =
168
+ { createHome = true;
169
+ description = "Eelco Dolstra";
170
+ extraGroups = [ "wheel" ];
171
+ group = "users";
172
+ home = "/home/eelco";
173
+ isSystemUser = false;
174
+ useDefaultShell = true;
175
+ openssh.authorizedKeys.keys =
176
+ [ "ssh-dss AAAAB3NzaC1kc3MAAACBAOo3foMFsYvc+LEVVTAeXpaxdOFG6O2NE9coxZYN6UtwE477GwkvZ4uKymAekq3TB8I6dDg4QFfE27fIip/rQHJ/Rus+KsxwnTbwPzE0WcZVpkKQsepsoqLkfwMpiPfn5/oxcnJsimwRY/E95aJmmOHdGaYWrc0t4ARa+6teUgdFAAAAFQCSQq2Wil0/X4hDypGGUKlKvYyaWQAAAIAy/0fSDnz1tZOQBGq7q78y406HfWghErrVlrW9g+foJQG5pgXXcdJs9JCIrlaKivUKITDsYnQaCjrZaK8eHnc4ksbkSLfDOxFnR5814ulCftrgEDOv9K1UU3pYketjFMvQCA2U48lR6jG/99CPNXPH55QEFs8H97cIsdLQw9wM4gAAAIEAmzWZlXLzIf3eiHQggXqvw3+C19QvxQITcYHYVTx/XYqZi1VZ/fkY8bNmdcJsWFyOHgEhpEca+xM/SNvH/14rXDmt0wtclLEx/4GVLi59hQCnnKqv7HzJg8RF4v6XTiROBAEEdb4TaFuFn+JCvqPzilTzXTexvZKJECOvfYcY+10= eelco.dolstra@logicblox.com" ];
177
+ };
178
+
179
+ users.extraUsers.tarball-mirror =
180
+ { description = "Nixpkg starball mirroring user";
181
+ home = "/home/tarball-mirror";
182
+ createHome = true;
183
+ useDefaultShell = true;
184
+ openssh.authorizedKeys.keys = singleton "ssh-dss AAAAB3NzaC1kc3MAAACBAOo3foMFsYvc+LEVVTAeXpaxdOFG6O2NE9coxZYN6UtwE477GwkvZ4uKymAekq3TB8I6dDg4QFfE27fIip/rQHJ/Rus+KsxwnTbwPzE0WcZVpkKQsepsoqLkfwMpiPfn5/oxcnJsimwRY/E95aJmmOHdGaYWrc0t4ARa+6teUgdFAAAAFQCSQq2Wil0/X4hDypGGUKlKvYyaWQAAAIAy/0fSDnz1tZOQBGq7q78y406HfWghErrVlrW9g+foJQG5pgXXcdJs9JCIrlaKivUKITDsYnQaCjrZaK8eHnc4ksbkSLfDOxFnR5814ulCftrgEDOv9K1UU3pYketjFMvQCA2U48lR6jG/99CPNXPH55QEFs8H97cIsdLQw9wM4gAAAIEAmzWZlXLzIf3eiHQggXqvw3+C19QvxQITcYHYVTx/XYqZi1VZ/fkY8bNmdcJsWFyOHgEhpEca+xM/SNvH/14rXDmt0wtclLEx/4GVLi59hQCnnKqv7HzJg8RF4v6XTiROBAEEdb4TaFuFn+JCvqPzilTzXTexvZKJECOvfYcY+10= eelco.dolstra@logicblox.com";
185
+ };
186
+
187
+ system.activationScripts.setShmMax =
188
+ ''
189
+ ${pkgs.procps}/sbin/sysctl -q -w kernel.shmmax=$((1 * 1024**3))
190
+ '';
191
+
192
+ services.postgresql = {
193
+ enable = true;
194
+ package = pkgs.postgresql92;
195
+ extraConfig = ''
196
+ max_connections = 10
197
+ work_mem = 16MB
198
+ shared_buffers = 512MB
199
+ # We can risk losing some transactions.
200
+ synchronous_commit = off
201
+ '';
202
+ authentication = pkgs.lib.mkOverride 10 ''
203
+ local mediawiki all ident map=mwusers
204
+ local all all ident
205
+ '';
206
+ identMap = ''
207
+ mwusers root mediawiki
208
+ mwusers wwwrun mediawiki
209
+ '';
210
+ };
211
+}