Run hydra-provisioner on chef
Eelco Dolstra committed
Sep 4, 2017 at 18:04 UTC
70aee1b4231b060264f1b4cdfbc2590776561c92
3 files changed
+60
-3
delft/chef.nix
+1
@@ -7,6 +7,7 @@
7
./hydra-proxy.nix
8
./datadog.nix
9
./fstrim.nix
10
+ ./provisioner.nix
11
];
12
13
deployment.targetEnv = "hetzner";
delft/hydra.nix
+1
-3
@@ -17,11 +17,9 @@ in
17
users.extraUsers.hydra-www.openssh.authorizedKeys.keys =
18
with import ../ssh-keys.nix; [ eelco rob ];
19
users.extraUsers.hydra-queue-runner.openssh.authorizedKeys.keys =
20
- with import ../ssh-keys.nix; [ eelco rob provisioner ];
20
+ with import ../ssh-keys.nix; [ eelco rob ];
21
22
services.hydra-dev.enable = true;
23
- services.hydra-dev.buildMachinesFiles =
24
- [ "/etc/nix/machines" "/var/lib/hydra/provisioner/machines" ];
23
services.hydra-dev.package = hydra;
24
services.hydra-dev.logo = ./hydra-logo.png;
25
services.hydra-dev.hydraURL = "https://hydra.nixos.org";
delft/provisioner.nix
new
+58
@@ -0,0 +1,58 @@
1
+{ config, lib, pkgs, ... }:
2
+
3
+let
4
+
5
+ hydra-provisioner = import ../../hydra-provisioner { inherit pkgs; inherit nixops; };
6
+ nixops = pkgs.nixops;
7
+
8
+in
9
+
10
+{
11
+
12
+ users.extraUsers.hydra-provisioner =
13
+ { description = "Hydra provisioner";
14
+ group = "hydra";
15
+ home = "/var/lib/hydra-provisioner";
16
+ useDefaultShell = true;
17
+ createHome = true;
18
+ openssh.authorizedKeys.keys = [ (import ../ssh-keys.nix).eelco ];
19
+ };
20
+
21
+ system.activationScripts.hydra-provisioner = lib.stringAfter [ "users" ]
22
+ ''
23
+ mkdir -m 0755 -p /var/lib/hydra/provisioner
24
+ mkdir -m 0700 -p /var/lib/hydra-provisioner
25
+ chown hydra-provisioner.hydra /var/lib/hydra-provisioner /var/lib/hydra/provisioner
26
+ '';
27
+
28
+ environment.systemPackages =
29
+ [ hydra-provisioner
30
+ nixops
31
+ pkgs.awscli
32
+ ];
33
+
34
+ # FIXME: restrict PostgreSQL access.
35
+ services.postgresql.identMap =
36
+ ''
37
+ hydra-users hydra-provisioner hydra
38
+ '';
39
+
40
+ services.hydra-dev.buildMachinesFiles =
41
+ [ "/etc/nix/machines" "/var/lib/hydra/provisioner/machines" ];
42
+
43
+ systemd.services.hydra-provisioner =
44
+ { script =
45
+ ''
46
+ source /etc/profile
47
+ while true; do
48
+ timeout 3600 ${hydra-provisioner}/bin/hydra-provisioner /var/lib/hydra-provisioner/nixos-org-configurations/hydra-provisioner/conf.nix
49
+ sleep 300
50
+ done
51
+ '';
52
+ serviceConfig.User = "hydra-provisioner";
53
+ serviceConfig.Restart = "always";
54
+ serviceConfig.RestartSec = 60;
55
+ };
56
+
57
+ nix.nixPath = [ "${hydra-provisioner}/share/nix" ];
58
+}