titan: remove postgresql and zrepl
The dataset will be cleaned up at a later stage, when we are confident that moving the database was the correct choice.
Martin Weinelt committed
Jul 15, 2026 at 23:54 UTC
9ea8d94ed9474c7ee2461e1e335189890d872332
6 files changed
-293
build/pluto/prometheus/exporters/postgresql.nix
-1
@@ -7,7 +7,6 @@
7
{
8
targets = [
9
"haumea.nixos.org:9187"
10
- "titan.nixos.org:9187"
10
"mimas.nixos.org:9187"
11
"tracker.security.nixos.org:9187"
12
];
build/pluto/prometheus/exporters/zrepl.nix
-1
@@ -10,7 +10,6 @@
10
labels.role = "database";
11
targets = [
12
"mimas.nixos.org:9811"
13
- "titan.nixos.org:9811"
13
];
14
}
15
];
build/titan/default.nix
-2
@@ -3,8 +3,6 @@
3
../common.nix
4
./boot.nix
5
./network.nix
6
- ./postgresql.nix
7
- ./zrepl.nix
6
];
7
8
disko.devices = import ./disko.nix;
build/titan/postgresql.nix
deleted
-114
@@ -1,114 +0,0 @@
1
-{
2
- config,
3
- lib,
4
- pkgs,
5
- ...
6
-}:
7
-
8
-{
9
- services.prometheus.exporters.postgres = {
10
- enable = true;
11
- dataSourceName = "user=root database=hydra host=/run/postgresql sslmode=disable";
12
- openFirewall = true;
13
- firewallRules = ''
14
- ip6 saddr $prometheus_inet6 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept
15
- ip saddr $prometheus_inet4 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept
16
- '';
17
- };
18
-
19
- networking.firewall.interfaces."vlan4000".allowedTCPPorts = [ 5432 ];
20
-
21
- systemd.services.postgresql = {
22
- wants = [ "network-online.target" ];
23
- after = [ "network-online.target" ];
24
- };
25
-
26
- services.postgresql = {
27
- enable = true;
28
- enableJIT = true;
29
- package = pkgs.postgresql_18;
30
- # https://pgtune.leopard.in.ua/#/
31
- settings = {
32
- listen_addresses = lib.mkForce "10.0.40.3";
33
-
34
- # https://vadosware.io/post/everything-ive-seen-on-optimizing-postgres-on-zfs-on-linux/#zfs-related-tunables-on-the-postgres-side
35
- full_page_writes = "off";
36
-
37
- wal_init_zero = "off";
38
- wal_recycle = "off";
39
-
40
- checkpoint_completion_target = "0.9";
41
- default_statistics_target = 100;
42
-
43
- log_duration = "off";
44
- log_statement = "none";
45
-
46
- # pgbadger-compatible logging
47
- log_transaction_sample_rate = 0.01;
48
- log_min_duration_statement = 5000;
49
- log_checkpoints = "on";
50
- log_connections = "on";
51
- log_disconnections = "on";
52
- log_lock_waits = "on";
53
- log_temp_files = 0;
54
- log_autovacuum_min_duration = 0;
55
- log_line_prefix = "user=%u,db=%d,app=%a,client=%h ";
56
-
57
- max_connections = 500;
58
- work_mem = "20MB";
59
- maintenance_work_mem = "2GB";
60
-
61
- # 25% of memory
62
- shared_buffers = "32GB";
63
-
64
- # Checkpoint every 1GB. (default)
65
- # increased after seeing many warnings about frequent checkpoints
66
- min_wal_size = "1GB";
67
- max_wal_size = "4GB";
68
- wal_buffers = "16MB";
69
-
70
- max_worker_processes = 32;
71
- max_parallel_workers_per_gather = 4;
72
- max_parallel_workers = 32;
73
-
74
- # NVMe related performance tuning
75
- effective_io_concurrency = 200;
76
- random_page_cost = "1.1";
77
-
78
- # We can risk losing some transactions.
79
- synchronous_commit = "off";
80
-
81
- effective_cache_size = "64GB";
82
-
83
- # try to allocate huge pages, if possible
84
- huge_pages = "try";
85
-
86
- # Enable JIT compilation if possible.
87
- jit = "on";
88
-
89
- # autovacuum and autoanalyze much more frequently:
90
- # at these values vacuum should run approximately
91
- # every 2 mass rebuilds, or a couple times a day
92
- # on the builds table. Some of those queries really
93
- # benefit from frequent vacuums, so this should
94
- # help. In particular, I'm thinking the jobsets
95
- # pages.
96
- autovacuum_vacuum_scale_factor = 0.02;
97
- autovacuum_analyze_scale_factor = 0.01;
98
-
99
- shared_preload_libraries = "pg_stat_statements";
100
- compute_query_id = "on";
101
- };
102
-
103
- # FIXME: don't use 'trust'.
104
- authentication = ''
105
- host hydra all 10.0.40.2/32 trust
106
- local all root peer map=prometheus
107
- '';
108
-
109
- identMap = ''
110
- prometheus root root
111
- prometheus postgres-exporter root
112
- '';
113
- };
114
-}
build/titan/zrepl.nix
deleted
-151
@@ -1,151 +0,0 @@
1
-{
2
- config,
3
- lib,
4
- ...
5
-}:
6
-
7
-let
8
- metricsPort = 9811;
9
-in
10
-{
11
- age.secrets."zrepl-ssh-key" = {
12
- file = ../secrets/zrepl-ssh-key.age;
13
- mode = "0400";
14
- };
15
-
16
- programs.ssh = {
17
- knownHosts = {
18
- rsync-net = {
19
- hostNames = [
20
- "zh4461b.rsync.net"
21
- "2001:1620:2019::336"
22
- ];
23
- publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILtF46LwRn+hC9vuw0vedXBKGNPMSIqrXdxl+EQOI/8J";
24
- };
25
- };
26
- };
27
-
28
- services.zrepl =
29
- let
30
- defaultBackupJob = {
31
- type = "push";
32
- filesystems."zroot/pg<" = true;
33
- snapshotting = {
34
- type = "periodic";
35
- interval = "30m";
36
- prefix = "zrepl_snap_";
37
- hooks = [
38
- {
39
- # https://zrepl.github.io/configuration/snapshotting.html#postgres-checkpoint-hook
40
- type = "postgres-checkpoint";
41
- dsn = "host=/run/postgresql dbname=hydra user=root sslmode=disable";
42
- filesystems."zroot/pg" = true;
43
- }
44
- ];
45
- };
46
-
47
- # The current pruning setup is an exponentially growing scheme, at both sides.
48
- pruning = {
49
- keep_sender = [
50
- { type = "not_replicated"; }
51
- {
52
- type = "grid";
53
- regex = "^zrepl_snap_.*";
54
- grid = lib.concatStringsSep " | " [
55
- "1x1h(keep=all)"
56
- "1x1h"
57
- "1x2h"
58
- "1x4h"
59
- # "grid" acts weird if an interval isn't a whole-number multiple
60
- # of the previous one, so we jump from 8h to 24h
61
- "2x8h"
62
- "1x1d"
63
- "1x2d"
64
- "1x4d"
65
- "1x8d"
66
- # At this point we keep ~10 snapshots spanning 8--16 days (depends on moment),
67
- # with exponentially increasing spacing (almost).
68
- ];
69
- }
70
- ];
71
- keep_receiver = [
72
- {
73
- type = "grid";
74
- regex = "^zrepl_snap_.*";
75
- grid = lib.concatStringsSep " | " [
76
- "2x1h(keep=all)"
77
- "2x1h"
78
- "2x2h"
79
- "2x4h"
80
- "4x8h"
81
- # At this point the grid spans 2 days by ~13 snapshots.
82
- # (See note above about 8h -> 24h.)
83
- "2x1d"
84
- "2x2d"
85
- "2x4d"
86
- "2x8d"
87
- "2x16d"
88
- "2x32d"
89
- "2x64d"
90
- "2x128d"
91
- # At this point we keep ~29 snapshots spanning 384--512 days (depends on moment),
92
- # with exponentially increasing spacing (almost).
93
- ];
94
- }
95
- ];
96
- };
97
- };
98
- in
99
- {
100
- enable = true;
101
- settings = {
102
- global = {
103
- logging = [
104
- {
105
- type = "syslog";
106
- level = "info";
107
- format = "human";
108
- }
109
- ];
110
-
111
- # https://zrepl.github.io/configuration/monitoring.html
112
- monitoring = [
113
- {
114
- type = "prometheus";
115
- listen = ":${toString metricsPort}";
116
- }
117
- ];
118
- };
119
-
120
- jobs = [
121
- # Covers 20240629+
122
- (
123
- defaultBackupJob
124
- // {
125
- name = "rsyncnet";
126
- connect = {
127
- identity_file = config.age.secrets."zrepl-ssh-key".path;
128
- type = "ssh+stdinserver";
129
- host = "zh4461b.rsync.net";
130
- user = "root";
131
- port = 22;
132
- };
133
- }
134
- )
135
- /*
136
- rsync.net provides a VM with FreeBSD
137
- - almost nothing is preserved on upgrades except this "data1" zpool
138
- $ scp ./zrepl.yml root@zh4461b.rsync.net:/usr/local/etc/zrepl/zrepl.yml
139
- # pkg install zrepl
140
- # service zrepl enable
141
- # service zrepl start
142
- */
143
- ];
144
- };
145
- };
146
-
147
- networking.firewall.extraInputRules = ''
148
- ip6 saddr $prometheus_inet6 tcp dport ${toString metricsPort} accept
149
- ip saddr $prometheus_inet4 tcp dport ${toString metricsPort} accept
150
- '';
151
-}
build/titan/zrepl.yml
deleted
-24
@@ -1,24 +0,0 @@
1
-# root@zh4461b.rsync.net:/usr/local/etc/zrepl/zrepl.yml
2
-# zrepl main configuration file.
3
-# For documentation, refer to https://zrepl.github.io/
4
-#
5
-global:
6
- logging:
7
- - type: "stdout"
8
- level: "error"
9
- format: "human"
10
- - type: "syslog"
11
- level: "info"
12
- format: "logfmt"
13
-
14
-# mostly from https://blog.lenny.ninja/zrepl-on-rsync-net.html
15
-jobs:
16
- - name: sink
17
- type: sink
18
- serve:
19
- type: stdinserver
20
- client_identities: [titan]
21
- recv:
22
- placeholder:
23
- encryption: off
24
- root_fs: "data1"