rhea: Convert from NixOps
Eelco Dolstra committed
Aug 21, 2023 at 17:07 UTC
6fb7f1a6633c7462e3572d68f81100cf04a71ba8
6 files changed
+43
-41
delft/common.nix
+11
@@ -7,12 +7,20 @@ with lib;
7
[ ./diffoscope.nix
8
../modules/common.nix
9
../modules/prometheus
10
+ ../modules/wireguard.nix
11
+ ../modules/prometheus
12
];
13
14
system.stateVersion = "14.12";
15
16
nixpkgs.config.allowUnfree = true;
17
18
+ nixpkgs.overlays = [
19
+ (self: super: {
20
+ prometheus-postgres-exporter = self.callPackage ./prometheus/postgres-exporter.nix { };
21
+ })
22
+ ];
23
+
24
services.openssh.authorizedKeysFiles = mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
25
26
services.openssh.extraConfig =
@@ -89,4 +97,7 @@ with lib;
97
services.cron.mailto = "";
98
99
documentation.nixos.enable = false;
100
+
101
+ security.acme.acceptTerms = true;
102
+ security.acme.defaults.email = "webmaster@nixos.org";
103
}
delft/flake.nix
+26
@@ -6,6 +6,7 @@
6
inputs.nix-netboot-serve.url = "github:DeterminateSystems/nix-netboot-serve";
7
inputs.hydra-scale-equinix-metal.url = "github:DeterminateSystems/hydra-scale-equinix-metal";
8
#inputs.hydra.url = "github:DeterminateSystems/hydra/queue-runner-exporter";
9
+
10
outputs = flakes @ { self, nixpkgs, nix, hydra, nix-netboot-serve, hydra-scale-equinix-metal /*, dwarffs */ }:
11
let inherit (nixpkgs) lib;
12
in {
@@ -13,6 +14,7 @@
14
{ inherit nixpkgs; }
15
// import ./network.nix flakes;
16
17
+ /*
18
nixosConfigurations = builtins.removeAttrs (lib.mapAttrs (name: value: nixpkgs.lib.nixosSystem {
19
system = "x86_64-linux";
20
modules = [
@@ -28,5 +30,29 @@
30
}
31
];
32
}) self.nixopsConfigurations.default) ["defaults"];
33
+ */
34
+
35
+ nixosConfigurations.rhea = nixpkgs.lib.nixosSystem {
36
+ system = "x86_64-linux";
37
+
38
+ modules = [
39
+ self.nixosModules.common
40
+ ./rhea
41
+ hydra.nixosModules.hydra
42
+ hydra-scale-equinix-metal.nixosModules.default
43
+ ];
44
+ };
45
+
46
+ nixosModules.common =
47
+ { config, pkgs, lib, ... }:
48
+ {
49
+ system.configurationRevision = self.rev
50
+ or (throw "Cannot deploy from an unclean source tree!");
51
+ nix.registry.nixpkgs.flake = nixpkgs;
52
+ nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
53
+ nixpkgs.overlays = [
54
+ nix.overlays.default
55
+ ];
56
+ };
57
};
58
}
delft/hydra-scaler.nix
+4
-3
@@ -1,10 +1,11 @@
1
-{ config, pkgs, lib, ... }: {
2
- deployment.keys."hydra-scale-equinix-metal-env".keyFile = /home/deploy/src/nixos-org-configurations/keys/hydra-scale-equinix-metal-env;
1
+{ config, pkgs, lib, ... }:
2
+
3
+{
4
services.hydra-scale-equinix-metal = {
5
enable = true;
6
hydraRoot = "https://hydra.nixos.org/";
7
prometheusRoot = "https://status.nixos.org/prometheus";
7
- secretFile = "/run/keys/hydra-scale-equinix-metal-env";
8
+ secretFile = "/root/keys/hydra-scale-equinix-metal-env";
9
interval = ["*:0/5"];
10
config = let
11
netboot_base = https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main;
delft/network.nix
-21
@@ -1,30 +1,12 @@
1
flakes:
2
3
let
4
- networkoverlay = self: super: {
5
- prometheus-postgres-exporter = self.callPackage ./prometheus/postgres-exporter.nix { };
6
- };
4
in
5
{
6
defaults = {
10
- documentation.nixos.enable = false;
11
-
12
- security.acme.acceptTerms = true;
13
- security.acme.defaults.email = "webmaster@nixos.org";
14
-
7
imports = [
16
- ../modules/wireguard.nix
17
- ../modules/prometheus
8
# flakes.dwarffs.nixosModules.dwarffs # broken by Nix 2.6
9
{
20
- system.configurationRevision = flakes.self.rev
21
- or (throw "Cannot deploy from an unclean source tree!");
22
- nixpkgs.overlays = [
23
- flakes.nix.overlays.default
24
- networkoverlay
25
- ];
26
- nix.registry.nixpkgs.flake = flakes.nixpkgs;
27
- nix.nixPath = [ "nixpkgs=${flakes.nixpkgs}" ];
10
}
11
];
12
};
@@ -42,9 +24,6 @@ in
24
25
rhea = {
26
imports = [
45
- ./rhea
46
- flakes.hydra.nixosModules.hydra
47
- flakes.hydra-scale-equinix-metal.nixosModules.default
27
];
28
};
29
}
delft/packet-importer.nix
+1
-6
@@ -3,11 +3,6 @@ let
3
importer = pkgs.callPackage ../hydra-packet-importer { };
4
in
5
{
6
- deployment.keys."hydra-packet-import.json" = {
7
- keyFile = /home/deploy/src/nixos-org-configurations/hydra-packet-import.json;
8
- user = "hydra-packet";
9
- };
10
-
6
users.users.hydra-packet = {
7
description = "Hydra Packet Machine Importer";
8
group = "hydra";
@@ -25,7 +20,7 @@ in
20
21
systemd.services.hydra-packet-import = {
22
path = with pkgs; [ openssh moreutils ];
28
- script = "${importer}/bin/hydra-packet-importer /run/keys/hydra-packet-import.json | sort | sponge /var/lib/hydra-packet-import/machines";
23
+ script = "${importer}/bin/hydra-packet-importer /var/lib/hydra-packet-import/hydra-packet-import.json | sort | sponge /var/lib/hydra-packet-import/machines";
24
serviceConfig = {
25
User = "hydra-packet";
26
Group = "keys";
delft/rhea/default.nix
+1
-11
@@ -10,18 +10,8 @@
10
../packet-importer.nix
11
];
12
13
- # This is a Hetzner machine, but when trying to set this machine up
14
- # I found the Hetzner NixOps plugin isn't able to create robot
15
- # sub-accounts, and even if I can get past that with
16
- # `createSubAccount = false`, the bootstrap tarball doesn't work.
17
- #
18
- # See: ./rhea/install.md for documentation about how I set it up by
19
- # hand.
20
- #deployment.targetEnv = "hetzner";
21
- #deployment.hetzner.mainIPv4 = "5.9.122.43";
22
- deployment.targetHost = "5.9.122.43";
23
-
13
networking = {
14
+ hostName = "rhea";
15
firewall.allowedTCPPorts = [
16
80 443
17
9198 # hydra-queue-runner's prometheus