@cryptotaxi247 / infra / commits / ed651bc9

reformat with treefmt

Jörg Thalheim committed Aug 17, 2024 at 10:01 UTC ed651bc9ab9dfc0388befd1041ae0766c6e533ae
87 files changed +2069 -1819
build/common.nix
+47 -22
@@ -1,14 +1,19 @@
1 -{ config, pkgs, lib, ... }:
1 +{
2 + config,
3 + pkgs,
4 + lib,
5 + ...
6 +}:
7
8 with lib;
9
10 {
6 - imports =
7 - [ ./diffoscope.nix
8 - ../modules/common.nix
9 - ../modules/prometheus
10 - ../modules/wireguard.nix
11 - ];
11 + imports = [
12 + ./diffoscope.nix
13 + ../modules/common.nix
14 + ../modules/prometheus
15 + ../modules/wireguard.nix
16 + ];
17
18 nixpkgs.config.allowUnfree = true;
19
@@ -18,19 +23,35 @@ with lib;
23
24 # Prevent "out of sync" errors on the KVM switch.
25 boot.vesa = false;
21 - boot.blacklistedKernelModules = [ "radeonfb" "radeon" "i915" ];
26 + boot.blacklistedKernelModules = [
27 + "radeonfb"
28 + "radeon"
29 + "i915"
30 + ];
31 boot.kernelParams = [ "nomodeset" ];
32
33 hardware.enableAllFirmware = true;
34 hardware.cpu.amd.updateMicrocode = true;
35 hardware.cpu.intel.updateMicrocode = true;
36
28 - environment.systemPackages =
29 - [ pkgs.emacs pkgs.sysstat pkgs.hdparm pkgs.sdparm # pkgs.lsiutil
30 - pkgs.htop pkgs.sqlite pkgs.iotop pkgs.lm_sensors pkgs.hwloc
31 - pkgs.lsof pkgs.numactl pkgs.gcc pkgs.smartmontools pkgs.tcpdump pkgs.gdb
32 - pkgs.elfutils
33 - ];
37 + environment.systemPackages = [
38 + pkgs.emacs
39 + pkgs.sysstat
40 + pkgs.hdparm
41 + pkgs.sdparm # pkgs.lsiutil
42 + pkgs.htop
43 + pkgs.sqlite
44 + pkgs.iotop
45 + pkgs.lm_sensors
46 + pkgs.hwloc
47 + pkgs.lsof
48 + pkgs.numactl
49 + pkgs.gcc
50 + pkgs.smartmontools
51 + pkgs.tcpdump
52 + pkgs.gdb
53 + pkgs.elfutils
54 + ];
55
56 services.openssh.enable = true;
57
@@ -39,11 +60,10 @@ with lib;
60
61 nix.nrBuildUsers = 100;
62
42 - nix.extraOptions =
43 - ''
44 - allowed-impure-host-deps = /etc/protocols /etc/services /etc/nsswitch.conf
45 - allowed-uris = https://github.com/ https://git.savannah.gnu.org/ github:
46 - '';
63 + nix.extraOptions = ''
64 + allowed-impure-host-deps = /etc/protocols /etc/services /etc/nsswitch.conf
65 + allowed-uris = https://github.com/ https://git.savannah.gnu.org/ github:
66 + '';
67
68 networking.useDHCP = false;
69
@@ -65,9 +85,14 @@ with lib;
85
86 # Bump the open files limit so that non-root users can run NixOS VM
87 # tests (Samba opens lot of files).
68 - security.pam.loginLimits =
69 - [ { domain = "*"; item = "nofile"; type = "-"; value = "16384"; }
70 - ];
88 + security.pam.loginLimits = [
89 + {
90 + domain = "*";
91 + item = "nofile";
92 + type = "-";
93 + value = "16384";
94 + }
95 + ];
96
97 # Enable Kernel Samepage Merging (reduces memory footprint of VMs).
98 hardware.ksm.enable = true;
build/datadog/hydra.nix
+13 -11
@@ -1,20 +1,22 @@
1 -{ pkgs, ...}:
1 +{ pkgs, ... }:
2 {
3 systemd.services.dd-agent.environment.PYTHONPATH = "${pkgs.pythonPackages.requests}/lib/python2.7/site-packages";
4 environment.etc =
5 let
6 - hydra-config =
7 - pkgs.writeText "hydra.yaml" ''
8 - init_config:
9 -
10 - instances:
11 - - check: 1
12 - '';
13 - in [
14 - { source = hydra-config;
6 + hydra-config = pkgs.writeText "hydra.yaml" ''
7 + init_config:
8 +
9 + instances:
10 + - check: 1
11 + '';
12 + in
13 + [
14 + {
15 + source = hydra-config;
16 target = "dd-agent/conf.d/hydra.yaml";
17 }
17 - { source = ./hydra.py;
18 + {
19 + source = ./hydra.py;
20 target = "dd-agent/checks.d/hydra.py";
21 }
22 ];
build/diffoscope.nix
+13 -15
@@ -4,25 +4,23 @@ with pkgs.lib;
4
5 let
6
7 - diffoscopeWrapper = pkgs.writeScript "diffoscope-wrapper"
8 - ''
9 - #! ${pkgs.stdenv.shell}
10 - exec >&2
11 - echo ""
12 - echo "non-determinism detected in $2; diff with previous round follows:"
13 - echo ""
14 - time ${pkgs.utillinux}/bin/runuser -u diffoscope -- ${pkgs.diffoscope}/bin/diffoscope "$1" "$2"
15 - exit 0
16 - '';
7 + diffoscopeWrapper = pkgs.writeScript "diffoscope-wrapper" ''
8 + #! ${pkgs.stdenv.shell}
9 + exec >&2
10 + echo ""
11 + echo "non-determinism detected in $2; diff with previous round follows:"
12 + echo ""
13 + time ${pkgs.utillinux}/bin/runuser -u diffoscope -- ${pkgs.diffoscope}/bin/diffoscope "$1" "$2"
14 + exit 0
15 + '';
16
17 in
18
19 {
20
22 - nix.extraOptions =
23 - ''
24 - diff-hook = ${diffoscopeWrapper}
25 - '';
21 + nix.extraOptions = ''
22 + diff-hook = ${diffoscopeWrapper}
23 + '';
24
25 # Don't run diffoscope as root.
26 users.extraUsers.diffoscope = {
@@ -30,6 +28,6 @@ in
28 group = "diffoscope";
29 isSystemUser = true;
30 };
33 - users.groups.diffoscope = {};
31 + users.groups.diffoscope = { };
32
33 }
build/flake.nix
+33 -18
@@ -26,7 +26,20 @@
26 inputs.rfc39.url = "github:NixOS/rfc39";
27 inputs.rfc39.inputs.nixpkgs.follows = "nixpkgs";
28
29 - outputs = { self, agenix, colmena, disko, hydra, hydra-scale-equinix-metal, nix, nixpkgs, nixos-channel-scripts, nix-netboot-serve, rfc39 }:
29 + outputs =
30 + {
31 + self,
32 + agenix,
33 + colmena,
34 + disko,
35 + hydra,
36 + hydra-scale-equinix-metal,
37 + nix,
38 + nixpkgs,
39 + nixos-channel-scripts,
40 + nix-netboot-serve,
41 + rfc39,
42 + }:
43 let
44 inherit (nixpkgs) lib;
45
@@ -45,7 +58,8 @@
58 rfc39.overlays.default
59 ];
60 };
48 - in {
61 + in
62 + {
63 nixosConfigurations.haumea = nixpkgs.lib.nixosSystem {
64 system = "x86_64-linux";
65
@@ -73,15 +87,14 @@
87 ];
88 };
89
76 - colmena = {
77 - meta = {
78 - description = "NixOS.org infrastructure";
79 - nixpkgs = import nixpkgs {
80 - system = "x86_64-linux";
90 + colmena =
91 + {
92 + meta = {
93 + description = "NixOS.org infrastructure";
94 + nixpkgs = import nixpkgs { system = "x86_64-linux"; };
95 };
82 - };
83 - } // builtins.mapAttrs
84 - (name: value: {
96 + }
97 + // builtins.mapAttrs (name: value: {
98 nixpkgs.system = value.config.nixpkgs.system;
99 imports = value._module.args.modules;
100 deployment = {
@@ -90,13 +103,15 @@
103 }) self.nixosConfigurations;
104
105 # TODO: flake-utils.lib.eachDefaultSystem
93 - devShell.x86_64-linux = let
94 - pkgs = import nixpkgs { system = "x86_64-linux"; };
95 - in pkgs.mkShell {
96 - buildInputs = with pkgs; [
97 - agenix.packages.x86_64-linux.agenix
98 - colmena.packages.x86_64-linux.colmena
99 - ];
100 - };
106 + devShell.x86_64-linux =
107 + let
108 + pkgs = import nixpkgs { system = "x86_64-linux"; };
109 + in
110 + pkgs.mkShell {
111 + buildInputs = with pkgs; [
112 + agenix.packages.x86_64-linux.agenix
113 + colmena.packages.x86_64-linux.colmena
114 + ];
115 + };
116 };
117 }
build/haumea/boot.nix
+5 -1
@@ -7,6 +7,10 @@
7 copyKernels = true;
8 configurationLimit = 10; # 230 MB /boot capacity
9 };
10 - boot.initrd.availableKernelModules = [ "ahci" "nvme" "usbhid" ];
10 + boot.initrd.availableKernelModules = [
11 + "ahci"
12 + "nvme"
13 + "usbhid"
14 + ];
15 boot.kernelModules = [ "kvm-amd" ];
16 }
build/haumea/default.nix
+25 -24
@@ -1,7 +1,8 @@
1 -{ lib
2 -, modulesPath
3 -, pkgs
4 -, ...
1 +{
2 + lib,
3 + modulesPath,
4 + pkgs,
5 + ...
6 }:
7
8 {
@@ -13,7 +14,7 @@
14 ./postgresql.nix
15 ./zrepl.nix
16 ];
16 -
17 +
18 networking = {
19 hostId = "83c81a23";
20 hostName = "haumea";
@@ -22,25 +23,25 @@
23
24 environment.systemPackages = [ pkgs.lz4 ];
25
25 - fileSystems."/" =
26 - { device = "rpool/safe/root";
27 - fsType = "zfs";
28 - };
29 -
30 - fileSystems."/boot" =
31 - { device = "/dev/disk/by-label/boot0";
32 - fsType = "ext4";
33 - };
34 -
35 - fileSystems."/nix" =
36 - { device = "rpool/local/nix";
37 - fsType = "zfs";
38 - };
39 -
40 - fileSystems."/var/db/postgresql" =
41 - { device = "rpool/safe/postgres";
42 - fsType = "zfs";
43 - };
26 + fileSystems."/" = {
27 + device = "rpool/safe/root";
28 + fsType = "zfs";
29 + };
30 +
31 + fileSystems."/boot" = {
32 + device = "/dev/disk/by-label/boot0";
33 + fsType = "ext4";
34 + };
35 +
36 + fileSystems."/nix" = {
37 + device = "rpool/local/nix";
38 + fsType = "zfs";
39 + };
40 +
41 + fileSystems."/var/db/postgresql" = {
42 + device = "rpool/safe/postgres";
43 + fsType = "zfs";
44 + };
45
46 services.zfs.autoScrub.enable = true;
47
build/haumea/network.nix
+4 -5
@@ -11,11 +11,10 @@
11 "46.4.89.205/27"
12 "2a01:4f8:212:41c9::1/64"
13 ];
14 - routes = [ {
15 - routeConfig.Gateway = "46.4.89.193";
16 - } {
17 - routeConfig.Gateway = "fe80::1";
18 - } ];
14 + routes = [
15 + { routeConfig.Gateway = "46.4.89.193"; }
16 + { routeConfig.Gateway = "fe80::1"; }
17 + ];
18 networkConfig.Description = "WAN";
19 linkConfig.RequiredForOnline = true;
20 };
build/haumea/postgresql.nix
+6 -8
@@ -1,7 +1,4 @@
1 -{ lib
2 -, pkgs
3 -, ...
4 -}:
1 +{ lib, pkgs, ... }:
2
3 {
4 systemd.services.postgresql = {
@@ -38,7 +35,7 @@
35 log_statement = "none";
36
37 # pgbadger-compatible logging
41 - log_transaction_sample_rate = 0.01;
38 + log_transaction_sample_rate = 1.0e-2;
39 log_min_duration_statement = 5000;
40 log_checkpoints = "on";
41 log_connections = "on";
@@ -83,8 +80,8 @@
80 # benefit from frequent vacuums, so this should
81 # help. In particular, I'm thinking the jobsets
82 # pages.
86 - autovacuum_vacuum_scale_factor = 0.02;
87 - autovacuum_analyze_scale_factor = 0.01;
83 + autovacuum_vacuum_scale_factor = 2.0e-2;
84 + autovacuum_analyze_scale_factor = 1.0e-2;
85
86 shared_preload_libraries = "pg_stat_statements";
87 compute_query_id = "on";
@@ -101,4 +98,5 @@
98 prometheus root root
99 prometheus postgres-exporter root
100 '';
104 - };}
101 + };
102 +}
build/haumea/zrepl.nix
+124 -113
@@ -1,12 +1,13 @@
1 -{ lib
2 -, ...
3 -}:
1 +{ lib, ... }:
2
3 {
4 programs.ssh = {
5 knownHosts = {
6 rsync-net = {
9 - hostNames = [ "zh2543b.rsync.net" "2001:1620:2019::324" ];
7 + hostNames = [
8 + "zh2543b.rsync.net"
9 + "2001:1620:2019::324"
10 + ];
11 publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlIcNwmx7id/XdYKZzVX2KtZQ4PAsEa9KVQ9N43L3PX";
12 };
13 hexa-backup-server = {
@@ -16,118 +17,128 @@
17 };
18 };
19
19 - services.zrepl = let
20 - defaultBackupJob = {
21 - type = "push";
22 - filesystems."rpool/safe<" = true;
23 - snapshotting = {
24 - type = "periodic";
25 - interval = "30m";
26 - prefix = "zrepl_snap_";
27 - hooks = [ {
28 - # https://zrepl.github.io/master/configuration/snapshotting.html#postgres-checkpoint-hook
29 - type = "postgres-checkpoint";
30 - dsn = "host=/run/postgresql dbname=hydra user=root sslmode=disable";
31 - filesystems."rpool/safe/postgres" = true;
32 - } ];
33 - };
20 + services.zrepl =
21 + let
22 + defaultBackupJob = {
23 + type = "push";
24 + filesystems."rpool/safe<" = true;
25 + snapshotting = {
26 + type = "periodic";
27 + interval = "30m";
28 + prefix = "zrepl_snap_";
29 + hooks = [
30 + {
31 + # https://zrepl.github.io/master/configuration/snapshotting.html#postgres-checkpoint-hook
32 + type = "postgres-checkpoint";
33 + dsn = "host=/run/postgresql dbname=hydra user=root sslmode=disable";
34 + filesystems."rpool/safe/postgres" = true;
35 + }
36 + ];
37 + };
38
35 - # The current pruning setup is an exponentially growing scheme, at both sides.
36 - pruning = {
37 - keep_sender = [
38 - { type = "not_replicated"; }
39 - {
40 - type = "grid";
41 - regex = "^zrepl_snap_.*";
42 - grid = lib.concatStringsSep " | " [
43 - "1x1h(keep=all)"
44 - "1x1h"
45 - "1x2h"
46 - "1x4h"
47 - # "grid" acts weird if an interval isn't a whole-number multiple
48 - # of the previous one, so we jump from 8h to 24h
49 - "2x8h"
50 - "1x1d"
51 - "1x2d"
52 - "1x4d"
53 - "1x8d"
54 - # At this point we keep ~10 snapshots spanning 8--16 days (depends on moment),
55 - # with exponentially increasing spacing (almost).
56 - ];
57 - }
58 - ];
59 - keep_receiver = [
60 - { type = "grid";
61 - regex = "^zrepl_snap_.*";
62 - grid = lib.concatStringsSep " | " [
63 - "2x1h(keep=all)"
64 - "2x1h"
65 - "2x2h"
66 - "2x4h"
67 - "4x8h"
68 - # At this point the grid spans 2 days by ~13 snapshots.
69 - # (See note above about 8h -> 24h.)
70 - "2x1d"
71 - "2x2d"
72 - "2x4d"
73 - "2x8d"
74 - "2x16d"
75 - "2x32d"
76 - "2x64d"
77 - "2x128d"
78 - # At this point we keep ~29 snapshots spanning 384--512 days (depends on moment),
79 - # with exponentially increasing spacing (almost).
80 - ];
81 - }
82 - ];
83 - };
84 - };
85 - in {
86 - enable = true;
87 - settings = {
88 - global = {
89 - logging = [
90 - {
91 - type = "syslog";
92 - level = "info";
93 - format = "human";
94 - }
95 - ];
39 + # The current pruning setup is an exponentially growing scheme, at both sides.
40 + pruning = {
41 + keep_sender = [
42 + { type = "not_replicated"; }
43 + {
44 + type = "grid";
45 + regex = "^zrepl_snap_.*";
46 + grid = lib.concatStringsSep " | " [
47 + "1x1h(keep=all)"
48 + "1x1h"
49 + "1x2h"
50 + "1x4h"
51 + # "grid" acts weird if an interval isn't a whole-number multiple
52 + # of the previous one, so we jump from 8h to 24h
53 + "2x8h"
54 + "1x1d"
55 + "1x2d"
56 + "1x4d"
57 + "1x8d"
58 + # At this point we keep ~10 snapshots spanning 8--16 days (depends on moment),
59 + # with exponentially increasing spacing (almost).
60 + ];
61 + }
62 + ];
63 + keep_receiver = [
64 + {
65 + type = "grid";
66 + regex = "^zrepl_snap_.*";
67 + grid = lib.concatStringsSep " | " [
68 + "2x1h(keep=all)"
69 + "2x1h"
70 + "2x2h"
71 + "2x4h"
72 + "4x8h"
73 + # At this point the grid spans 2 days by ~13 snapshots.
74 + # (See note above about 8h -> 24h.)
75 + "2x1d"
76 + "2x2d"
77 + "2x4d"
78 + "2x8d"
79 + "2x16d"
80 + "2x32d"
81 + "2x64d"
82 + "2x128d"
83 + # At this point we keep ~29 snapshots spanning 384--512 days (depends on moment),
84 + # with exponentially increasing spacing (almost).
85 + ];
86 + }
87 + ];
88 + };
89 };
90 + in
91 + {
92 + enable = true;
93 + settings = {
94 + global = {
95 + logging = [
96 + {
97 + type = "syslog";
98 + level = "info";
99 + format = "human";
100 + }
101 + ];
102 + };
103
98 - jobs = [
99 - # Covers 20240629+
100 - (defaultBackupJob // {
101 - name = "rsyncnet";
102 - connect = {
103 - identity_file = "/root/.ssh/id_ed25519";
104 - type = "ssh+stdinserver";
105 - host = "zh4461b.rsync.net";
106 - user = "root";
107 - port = 22;
108 - };
109 - })
110 - /* rsync.net provides a VM with FreeBSD
111 - - almost nothing is preserved on upgrades except this "data1" zpool
112 - $ scp ./zrepl.yml root@zh4461b.rsync.net:/usr/local/etc/zrepl/zrepl.yml
113 - # pkg install zrepl
114 - # service zrepl enable
115 - # service zrepl start
116 - */
104 + jobs = [
105 + # Covers 20240629+
106 + (
107 + defaultBackupJob
108 + // {
109 + name = "rsyncnet";
110 + connect = {
111 + identity_file = "/root/.ssh/id_ed25519";
112 + type = "ssh+stdinserver";
113 + host = "zh4461b.rsync.net";
114 + user = "root";
115 + port = 22;
116 + };
117 + }
118 + )
119 + /*
120 + rsync.net provides a VM with FreeBSD
121 + - almost nothing is preserved on upgrades except this "data1" zpool
122 + $ scp ./zrepl.yml root@zh4461b.rsync.net:/usr/local/etc/zrepl/zrepl.yml
123 + # pkg install zrepl
124 + # service zrepl enable
125 + # service zrepl start
126 + */
127
118 - /* Covered 2024: 0212 -- 0629
119 - (defaultBackupJob // {
120 - name = "hexa";
121 - connect = {
122 - identity_file = "/root/.ssh/id_ed25519";
123 - type = "ssh+stdinserver";
124 - host = "meduna.hexa-home.v6.army";
125 - user = "zrepl";
126 - port = 22;
127 - };
128 - })
129 - */
130 - ];
128 + /*
129 + Covered 2024: 0212 -- 0629
130 + (defaultBackupJob // {
131 + name = "hexa";
132 + connect = {
133 + identity_file = "/root/.ssh/id_ed25519";
134 + type = "ssh+stdinserver";
135 + host = "meduna.hexa-home.v6.army";
136 + user = "zrepl";
137 + port = 22;
138 + };
139 + })
140 + */
141 + ];
142 + };
143 };
132 - };
144 }
build/hydra-proxy.nix
+1 -1
@@ -1,4 +1,4 @@
1 -{ config, ...}:
1 +{ config, ... }:
2
3 {
4 services.nginx = {
build/hydra-scaler.nix
+54 -52
@@ -6,61 +6,63 @@
6 hydraRoot = "https://hydra.nixos.org/";
7 prometheusRoot = "https://status.nixos.org/prometheus";
8 secretFile = "/root/keys/hydra-scale-equinix-metal-env";
9 - interval = ["*:0/5"];
10 - config = let
11 - netboot_base = "https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main";
12 - in {
13 - metro = "any";
14 - tags = ["hydra"];
15 - categories = {
16 - # NOTE(cole-h): We don't autoscale arm64 anymore because EM asked us not to: the arm64 spot
17 - # market appears to be a little funky as of this comment (we would commonly spin up a
18 - # machine, only for it to be reclaimed before it was even able to boot into NixOS and run
19 - # even 1 build for Hydra).
20 - # As of 17 Feb 2024, we have 2 dedicated arm64 machines on EM -- one `small`
21 - # (`small-c3.large.arm64`) and one `big-parallel` (`big-parallel-c3.large.arm64`). Hopefully
22 - # this will be an improvement over "maybe we have no arm64 machines at all because they spin
23 - # down before they can do any work".
24 - # The netboot URL for arm64 big-parallel is: https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main/c3-large-arm--big-parallel ("Always PXE" enabled, "hydra" tag)
25 - # The netboot URL for arm64 small is: https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main/c3-large-arm ("Always PXE" enabled, "hydra" tag)
9 + interval = [ "*:0/5" ];
10 + config =
11 + let
12 + netboot_base = "https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main";
13 + in
14 + {
15 + metro = "any";
16 + tags = [ "hydra" ];
17 + categories = {
18 + # NOTE(cole-h): We don't autoscale arm64 anymore because EM asked us not to: the arm64 spot
19 + # market appears to be a little funky as of this comment (we would commonly spin up a
20 + # machine, only for it to be reclaimed before it was even able to boot into NixOS and run
21 + # even 1 build for Hydra).
22 + # As of 17 Feb 2024, we have 2 dedicated arm64 machines on EM -- one `small`
23 + # (`small-c3.large.arm64`) and one `big-parallel` (`big-parallel-c3.large.arm64`). Hopefully
24 + # this will be an improvement over "maybe we have no arm64 machines at all because they spin
25 + # down before they can do any work".
26 + # The netboot URL for arm64 big-parallel is: https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main/c3-large-arm--big-parallel ("Always PXE" enabled, "hydra" tag)
27 + # The netboot URL for arm64 small is: https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main/c3-large-arm ("Always PXE" enabled, "hydra" tag)
28
27 - x86_64-linux = rec {
28 - bigparallel = {
29 - divisor = 16;
30 - minimum = 1;
31 - maximum = 4;
32 - plans = [
33 - {
34 - bid = 2.0;
35 - netboot_url = "${netboot_base}/c3-medium-x86--big-parallel";
36 - plan = "c3.medium.x86";
37 - }
38 - {
39 - bid = 2.0;
40 - netboot_url = "${netboot_base}/m3-large-x86--big-parallel";
41 - plan = "m3.large.x86";
42 - }
43 - ];
44 - };
45 - small = {
46 - divisor = 2000;
47 - minimum = 1;
48 - maximum = 3;
49 - plans = [
50 - {
51 - bid = 2.0;
52 - netboot_url = "${netboot_base}/c3-medium-x86";
53 - plan = "c3.medium.x86";
54 - }
55 - {
56 - bid = 2.0;
57 - netboot_url = "${netboot_base}/m3-large-x86";
58 - plan = "m3.large.x86";
59 - }
60 - ];
29 + x86_64-linux = rec {
30 + bigparallel = {
31 + divisor = 16;
32 + minimum = 1;
33 + maximum = 4;
34 + plans = [
35 + {
36 + bid = 2.0;
37 + netboot_url = "${netboot_base}/c3-medium-x86--big-parallel";
38 + plan = "c3.medium.x86";
39 + }
40 + {
41 + bid = 2.0;
42 + netboot_url = "${netboot_base}/m3-large-x86--big-parallel";
43 + plan = "m3.large.x86";
44 + }
45 + ];
46 + };
47 + small = {
48 + divisor = 2000;
49 + minimum = 1;
50 + maximum = 3;
51 + plans = [
52 + {
53 + bid = 2.0;
54 + netboot_url = "${netboot_base}/c3-medium-x86";
55 + plan = "c3.medium.x86";
56 + }
57 + {
58 + bid = 2.0;
59 + netboot_url = "${netboot_base}/m3-large-x86";
60 + plan = "m3.large.x86";
61 + }
62 + ];
63 + };
64 };
65 };
66 };
64 - };
67 };
68 }
build/hydra.nix
+176 -112
@@ -13,71 +13,71 @@ in
13 services.hydra-dev.notificationSender = "edolstra@gmail.com";
14 services.hydra-dev.smtpHost = "localhost";
15 services.hydra-dev.useSubstitutes = false;
16 - services.hydra-dev.extraConfig =
17 - ''
18 - max_servers 30
16 + services.hydra-dev.extraConfig = ''
17 + max_servers 30
18
20 - enable_google_login = 1
21 - google_client_id = 816926039128-ia4s4rsqrq998rsevce7i09mo6a4nffg.apps.googleusercontent.com
19 + enable_google_login = 1
20 + google_client_id = 816926039128-ia4s4rsqrq998rsevce7i09mo6a4nffg.apps.googleusercontent.com
21
23 - github_client_id = b022c64ce4531ffc1031
24 - github_client_secret_file = /var/lib/hydra/www/keys/hydra-github-client-secret
22 + github_client_id = b022c64ce4531ffc1031
23 + github_client_secret_file = /var/lib/hydra/www/keys/hydra-github-client-secret
24
26 - store_uri = s3://nix-cache?secret-key=/var/lib/hydra/queue-runner/keys/cache.nixos.org-1/secret&write-nar-listing=1&ls-compression=br&log-compression=br
27 - server_store_uri = https://cache.nixos.org?local-nar-cache=${narCache}
28 - binary_cache_public_uri = https://cache.nixos.org
25 + store_uri = s3://nix-cache?secret-key=/var/lib/hydra/queue-runner/keys/cache.nixos.org-1/secret&write-nar-listing=1&ls-compression=br&log-compression=br
26 + server_store_uri = https://cache.nixos.org?local-nar-cache=${narCache}
27 + binary_cache_public_uri = https://cache.nixos.org
28
30 - <Plugin::Session>
31 - cache_size = 32m
32 - </Plugin::Session>
29 + <Plugin::Session>
30 + cache_size = 32m
31 + </Plugin::Session>
32
34 - # patchelf:master:3
35 - xxx-jobset-repeats = nixos:reproducibility:1
33 + # patchelf:master:3
34 + xxx-jobset-repeats = nixos:reproducibility:1
35
37 - upload_logs_to_binary_cache = true
38 - compress_build_logs = false # conflicts with upload_logs_to_binary_cache
36 + upload_logs_to_binary_cache = true
37 + compress_build_logs = false # conflicts with upload_logs_to_binary_cache
38
40 - log_prefix = https://cache.nixos.org/
39 + log_prefix = https://cache.nixos.org/
40
42 - evaluator_workers = 8
43 - evaluator_max_memory_size = 4096
41 + evaluator_workers = 8
42 + evaluator_max_memory_size = 4096
43
45 - max_concurrent_evals = 1
44 + max_concurrent_evals = 1
45
47 - max_unsupported_time = 86400
46 + max_unsupported_time = 86400
47
49 - allow_import_from_derivation = false
48 + allow_import_from_derivation = false
49
51 - max_output_size = 3421225472 # 3 << 30 + 200000000 = 3 GiB + 0.2 GB
52 - max_db_connections = 350
50 + max_output_size = 3421225472 # 3 << 30 + 200000000 = 3 GiB + 0.2 GB
51 + max_db_connections = 350
52
54 - queue_runner_metrics_address = [::]:9198
53 + queue_runner_metrics_address = [::]:9198
54
56 - <hydra_notify>
57 - <prometheus>
58 - listen_address = 0.0.0.0
59 - port = 9199
60 - </prometheus>
61 - </hydra_notify>
62 - '';
55 + <hydra_notify>
56 + <prometheus>
57 + listen_address = 0.0.0.0
58 + port = 9199
59 + </prometheus>
60 + </hydra_notify>
61 + '';
62
63 # Work around https://github.com/NixOS/hydra/issues/1337
65 - services.hydra-dev.package = pkgs.hydra.overrideAttrs(_final: prev: {
66 - postPatch = ''
67 - ${prev.postPatch or ""}
68 - rm src/lib/Hydra/Plugin/DeclarativeJobsets.pm
69 - rm t/Hydra/Plugin/DeclarativeJobsets/basic.t
70 - '';
71 - });
64 + services.hydra-dev.package = pkgs.hydra.overrideAttrs (
65 + _final: prev: {
66 + postPatch = ''
67 + ${prev.postPatch or ""}
68 + rm src/lib/Hydra/Plugin/DeclarativeJobsets.pm
69 + rm t/Hydra/Plugin/DeclarativeJobsets/basic.t
70 + '';
71 + }
72 + );
73
74 # eats memory as if it was free
75 systemd.services.hydra-notify.enable = false;
76
76 - systemd.tmpfiles.rules =
77 - [
78 - "d /var/cache/hydra 0755 hydra hydra - -"
79 - "d ${narCache} 0775 hydra hydra 1d -"
80 - ];
77 + systemd.tmpfiles.rules = [
78 + "d /var/cache/hydra 0755 hydra hydra - -"
79 + "d ${narCache} 0775 hydra hydra 1d -"
80 + ];
81
82 # users.extraUsers.hydra.home = mkForce "/home/hydra";
83
@@ -86,77 +86,141 @@ in
86 systemd.services.hydra-queue-runner.requires = mkForce [ ];
87 systemd.services.hydra-queue-runner.serviceConfig.LimitNOFILE = 65535;
88
89 - programs.ssh.hostKeyAlgorithms = [ "rsa-sha2-512-cert-v01@openssh.com" "ssh-ed25519" "ssh-rsa" "ecdsa-sha2-nistp256" ];
90 - programs.ssh.extraConfig = mkAfter
91 - ''
92 - ServerAliveInterval 120
93 - TCPKeepAlive yes
94 -
95 - Host mac-m1-1
96 - Hostname 10.254.2.101
97 - Compression yes
98 -
99 - Host mac-m1-2
100 - Hostname 10.254.2.102
101 - Compression yes
102 -
103 - Host mac-m1-3
104 - Hostname 10.254.2.103
105 - Compression yes
106 -
107 - Host mac-m1-4
108 - Hostname 10.254.2.104
109 - Compression yes
110 -
111 - Host mac-m1-5
112 - Hostname 10.254.2.105
113 - Compression yes
114 -
115 - Host mac-m1-6
116 - Hostname 10.254.2.106
117 - Compression yes
118 -
119 - Host macstadium-x86-44911507
120 - Hostname 208.83.1.186
121 - Compression yes
122 -
123 - Host macstadium-x86-44911362
124 - Hostname 208.83.1.175
125 - Compression yes
126 -
127 - Host macstadium-x86-44911305
128 - Hostname 208.83.1.173
129 - Compression yes
130 -
131 - Host macstadium-m1-44911104
132 - Hostname 208.83.1.181
133 - Compression yes
134 -
135 - Host macstadium-m1-44911207
136 - Hostname 208.83.1.145
137 - Compression yes
138 - '';
89 + programs.ssh.hostKeyAlgorithms = [
90 + "rsa-sha2-512-cert-v01@openssh.com"
91 + "ssh-ed25519"
92 + "ssh-rsa"
93 + "ecdsa-sha2-nistp256"
94 + ];
95 + programs.ssh.extraConfig = mkAfter ''
96 + ServerAliveInterval 120
97 + TCPKeepAlive yes
98 +
99 + Host mac-m1-1
100 + Hostname 10.254.2.101
101 + Compression yes
102 +
103 + Host mac-m1-2
104 + Hostname 10.254.2.102
105 + Compression yes
106 +
107 + Host mac-m1-3
108 + Hostname 10.254.2.103
109 + Compression yes
110 +
111 + Host mac-m1-4
112 + Hostname 10.254.2.104
113 + Compression yes
114 +
115 + Host mac-m1-5
116 + Hostname 10.254.2.105
117 + Compression yes
118 +
119 + Host mac-m1-6
120 + Hostname 10.254.2.106
121 + Compression yes
122 +
123 + Host macstadium-x86-44911507
124 + Hostname 208.83.1.186
125 + Compression yes
126 +
127 + Host macstadium-x86-44911362
128 + Hostname 208.83.1.175
129 + Compression yes
130 +
131 + Host macstadium-x86-44911305
132 + Hostname 208.83.1.173
133 + Compression yes
134 +
135 + Host macstadium-m1-44911104
136 + Hostname 208.83.1.181
137 + Compression yes
138 +
139 + Host macstadium-m1-44911207
140 + Hostname 208.83.1.145
141 + Compression yes
142 + '';
143
144 services.openssh.knownHosts = {
141 - "*.cloudscalehydra.detsys.dev" = { certAuthority = true; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6HhovazfX+rqm2YuOwgM1X16Z7bJpLLj4DXWUsuGGqG/OlwIyioVodKPd3dYwsltQD8W4YrWQCOXlqyV50xpngKJX6OXdDt0IWwwgHdW0bT/l+4Yd/B57PbSnXGKLwa7slBwMCGkxpivMwnkQm+1zfQEdVNX5UPiH6xwZSwgsaRHCpumpVUrLNWlWxI5+g3alez/mfp29bgSvMdnIu72Ykb8u0uKOvGVQY7UD9sVU00NSQ16m+NhvvFvVomIF6OXMinBkATuSsoa4jOIg4UTsS5mo8Up8RdZ1qyzxvqf874osn5sYkMVnRZ5G/0bmwdwyYs7mjKh3agt37Fnaj8obyfVRm9aRlKT+Gwc5U2XZF/AdhOq+TdRL2HgaNYwJspHYUQ2jm5YilOgcEfTOgunxDfMIGueqnM6nZoGe7EHA6affr8QLrOXEUVA9uwIMInpLWiDZXk74owDGhIpg8WBpWch+x3SqaLDwLlUYDseJR0BdH9al+UZW1eBinAiEVl6H7KzVLpLqYss38CWT9c7Cq/gltUuwIqgziXFCR4skXfpN5Ozg0Sr9OmkJbxHjGdOmMVT0VKC05KsUEkWW9J18WX3uN1O3Mqu7vWgK9VOqbsnsknP0oBSznniFZYblK0vRgcrKPMAGTZ7RMdTBbys28sj3HKY/CQPv08KV0xgOJQ=="; };
142 -
143 - mac-m1-1 = { hostNames = [ "10.254.2.101" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIpNE/evvR5mVLslm4G5AV6pQ2wdpIl7FPGDh5wZPLF"; };
144 - mac-m1-2 = { hostNames = [ "10.254.2.102" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDyGCqoDh+BWnV1NIV2ucyb0WsXz5fH2hKDgC1dhN+Wq"; };
145 - mac-m1-3 = { hostNames = [ "10.254.2.103" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtPVTcBWTENjQ3e9ry7pOTFHk316Ahm3VW1Ys0cMhVf"; };
146 - mac-m1-4 = { hostNames = [ "10.254.2.104" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOk2OLBHfCV3yxXzAsgX0r9cQ3KvpESak6s+tYGJq6J4"; };
147 - mac-m1-5 = { hostNames = [ "10.254.2.105" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbYjdeghSNg7bU/ER/pTSGwP7Fyd7+OteD06dP4gCfP"; };
148 - mac-m1-6 = { hostNames = [ "10.254.2.106" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8B5Ek8GhWCO5Qahl20CHn/txxvAweupuIbFmuLjciG"; };
145 + "*.cloudscalehydra.detsys.dev" = {
146 + certAuthority = true;
147 + publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6HhovazfX+rqm2YuOwgM1X16Z7bJpLLj4DXWUsuGGqG/OlwIyioVodKPd3dYwsltQD8W4YrWQCOXlqyV50xpngKJX6OXdDt0IWwwgHdW0bT/l+4Yd/B57PbSnXGKLwa7slBwMCGkxpivMwnkQm+1zfQEdVNX5UPiH6xwZSwgsaRHCpumpVUrLNWlWxI5+g3alez/mfp29bgSvMdnIu72Ykb8u0uKOvGVQY7UD9sVU00NSQ16m+NhvvFvVomIF6OXMinBkATuSsoa4jOIg4UTsS5mo8Up8RdZ1qyzxvqf874osn5sYkMVnRZ5G/0bmwdwyYs7mjKh3agt37Fnaj8obyfVRm9aRlKT+Gwc5U2XZF/AdhOq+TdRL2HgaNYwJspHYUQ2jm5YilOgcEfTOgunxDfMIGueqnM6nZoGe7EHA6affr8QLrOXEUVA9uwIMInpLWiDZXk74owDGhIpg8WBpWch+x3SqaLDwLlUYDseJR0BdH9al+UZW1eBinAiEVl6H7KzVLpLqYss38CWT9c7Cq/gltUuwIqgziXFCR4skXfpN5Ozg0Sr9OmkJbxHjGdOmMVT0VKC05KsUEkWW9J18WX3uN1O3Mqu7vWgK9VOqbsnsknP0oBSznniFZYblK0vRgcrKPMAGTZ7RMdTBbys28sj3HKY/CQPv08KV0xgOJQ==";
148 + };
149 +
150 + mac-m1-1 = {
151 + hostNames = [ "10.254.2.101" ];
152 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIpNE/evvR5mVLslm4G5AV6pQ2wdpIl7FPGDh5wZPLF";
153 + };
154 + mac-m1-2 = {
155 + hostNames = [ "10.254.2.102" ];
156 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDyGCqoDh+BWnV1NIV2ucyb0WsXz5fH2hKDgC1dhN+Wq";
157 + };
158 + mac-m1-3 = {
159 + hostNames = [ "10.254.2.103" ];
160 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtPVTcBWTENjQ3e9ry7pOTFHk316Ahm3VW1Ys0cMhVf";
161 + };
162 + mac-m1-4 = {
163 + hostNames = [ "10.254.2.104" ];
164 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOk2OLBHfCV3yxXzAsgX0r9cQ3KvpESak6s+tYGJq6J4";
165 + };
166 + mac-m1-5 = {
167 + hostNames = [ "10.254.2.105" ];
168 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbYjdeghSNg7bU/ER/pTSGwP7Fyd7+OteD06dP4gCfP";
169 + };
170 + mac-m1-6 = {
171 + hostNames = [ "10.254.2.106" ];
172 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8B5Ek8GhWCO5Qahl20CHn/txxvAweupuIbFmuLjciG";
173 + };
174
175 # These IPs and SSH public keys are specifically provisioned for Hydra
151 - "intense-heron.mac.nixos.org" = { hostNames = [ "intense-heron.mac.nixos.org" "23.88.75.215" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMXOk44SDOmkZNtOcviM5LIA6yVOmEclPRQTqndvIxyU"; };
152 - "sweeping-filly.mac.nixos.org" = { hostNames = [ "sweeping-filly.mac.nixos.org" "142.132.141.35" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+kukRUsxSBsW5xITI65pAixwoWx4b6LtASRzFqM2xX"; };
153 - "maximum-snail.mac.nixos.org" = { hostNames = [ "maximum-snail.mac.nixos.org" "23.88.76.161" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6Y9cfoJ+6TNS1EbE3OUocnyUtnTtJ0fJybK2+gyVmN"; };
154 - "growing-jennet.mac.nixos.org" = { hostNames = [ "growing-jennet.mac.nixos.org" "23.88.76.75" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEIUYnFY0tnASbzZOHruwj3n4nX5gT0Zco2Xjv7frINn"; };
155 - "enormous-catfish.mac.nixos.org" = { hostNames = [ "enormous-catfish.mac.nixos.org" "142.132.140.199" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINEevWFDXtUmbaZYiOmPL4uZVXVdHfQ2fMAMGunfDAAT"; };
156 -
157 - t2m = { hostNames = [ "t2m.cunat.cz" ]; publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP9351NRVeQYvNV1bBbC5MX0iSmrXhVcBYMcn6AMo11U2zlOYRqBPzGLPjz9u31t4FxHNovxCrkFTqJY9zbsmTs="; };
158 - t2a = { hostNames = [ "t2a.cunat.cz" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIu3itg4hn5e4KrnyoreAUN3RIbAcvqc7yWx5i6EWqAu"; };
159 - t4b = { hostNames = [ "t4b.cunat.cz" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/jE8c0lkc/DlK3R7A+zBr6j/lfEQrhqSD/YOEVs8za"; };
176 + "intense-heron.mac.nixos.org" = {
177 + hostNames = [
178 + "intense-heron.mac.nixos.org"
179 + "23.88.75.215"
180 + ];
181 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMXOk44SDOmkZNtOcviM5LIA6yVOmEclPRQTqndvIxyU";
182 + };
183 + "sweeping-filly.mac.nixos.org" = {
184 + hostNames = [
185 + "sweeping-filly.mac.nixos.org"
186 + "142.132.141.35"
187 + ];
188 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+kukRUsxSBsW5xITI65pAixwoWx4b6LtASRzFqM2xX";
189 + };
190 + "maximum-snail.mac.nixos.org" = {
191 + hostNames = [
192 + "maximum-snail.mac.nixos.org"
193 + "23.88.76.161"
194 + ];
195 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6Y9cfoJ+6TNS1EbE3OUocnyUtnTtJ0fJybK2+gyVmN";
196 + };
197 + "growing-jennet.mac.nixos.org" = {
198 + hostNames = [
199 + "growing-jennet.mac.nixos.org"
200 + "23.88.76.75"
201 + ];
202 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEIUYnFY0tnASbzZOHruwj3n4nX5gT0Zco2Xjv7frINn";
203 + };
204 + "enormous-catfish.mac.nixos.org" = {
205 + hostNames = [
206 + "enormous-catfish.mac.nixos.org"
207 + "142.132.140.199"
208 + ];
209 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINEevWFDXtUmbaZYiOmPL4uZVXVdHfQ2fMAMGunfDAAT";
210 + };
211 +
212 + t2m = {
213 + hostNames = [ "t2m.cunat.cz" ];
214 + publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP9351NRVeQYvNV1bBbC5MX0iSmrXhVcBYMcn6AMo11U2zlOYRqBPzGLPjz9u31t4FxHNovxCrkFTqJY9zbsmTs=";
215 + };
216 + t2a = {
217 + hostNames = [ "t2a.cunat.cz" ];
218 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIu3itg4hn5e4KrnyoreAUN3RIbAcvqc7yWx5i6EWqAu";
219 + };
220 + t4b = {
221 + hostNames = [ "t4b.cunat.cz" ];
222 + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/jE8c0lkc/DlK3R7A+zBr6j/lfEQrhqSD/YOEVs8za";
223 + };
224
225 };
226
build/packet-importer.nix
+9 -5
@@ -14,17 +14,21 @@ in
14 "f /var/lib/hydra-packet-import/machines 0644 hydra-packet hydra -"
15 ];
16
17 - services.hydra-dev.buildMachinesFiles = [
18 - "/var/lib/hydra-packet-import/machines"
19 - ];
17 + services.hydra-dev.buildMachinesFiles = [ "/var/lib/hydra-packet-import/machines" ];
18
19 systemd.services.hydra-packet-import = {
22 - path = with pkgs; [ openssh moreutils ];
20 + path = with pkgs; [
21 + openssh
22 + moreutils
23 + ];
24 script = "${importer}/bin/hydra-packet-importer /var/lib/hydra-packet-import/hydra-packet-import.json | sort | sponge /var/lib/hydra-packet-import/machines";
25 serviceConfig = {
26 User = "hydra-packet";
27 Group = "keys";
27 - SupplementaryGroups = [ "hydra" "keys" ];
28 + SupplementaryGroups = [
29 + "hydra"
30 + "keys"
31 + ];
32 Type = "oneshot";
33 RuntimeMaxSec = 1800;
34 };
build/pluto/boot.nix
+10 -7
@@ -7,13 +7,16 @@
7 enable = true;
8 efiSupport = true;
9 efiInstallAsRemovable = true;
10 - mirroredBoots = [ {
11 - devices = [ "nodev" ];
12 - path = "/efi/a";
13 - } {
14 - devices = [ "nodev" ];
15 - path = "/efi/b";
16 - } ];
10 + mirroredBoots = [
11 + {
12 + devices = [ "nodev" ];
13 + path = "/efi/a";
14 + }
15 + {
16 + devices = [ "nodev" ];
17 + path = "/efi/b";
18 + }
19 + ];
20 };
21 };
22 };
build/pluto/default.nix
+1 -3
@@ -1,6 +1,4 @@
1 -{ config
2 -, ...
3 -}:
1 +{ config, ... }:
2
3 {
4 imports = [
build/pluto/grafana.nix
+2 -6
@@ -1,7 +1,5 @@
1 {
2 - services.backup.includes = [
3 - "/var/lib/grafana"
4 - ];
2 + services.backup.includes = [ "/var/lib/grafana" ];
3
4 services.grafana = {
5 enable = true;
@@ -16,7 +14,5 @@
14 };
15 };
16
19 - systemd.services.nginx.serviceConfig.SupplementaryGroups = [
20 - "grafana"
21 - ];
17 + systemd.services.nginx.serviceConfig.SupplementaryGroups = [ "grafana" ];
18 }
build/pluto/network.nix
+4 -5
@@ -13,11 +13,10 @@
13 "37.27.99.100/26"
14 "2a01:4f9:3070:15e0::1/64"
15 ];
16 - routes = [ {
17 - routeConfig.Gateway = "37.27.99.65";
18 - } {
19 - routeConfig.Gateway = "fe80::1";
20 - } ];
16 + routes = [
17 + { routeConfig.Gateway = "37.27.99.65"; }
18 + { routeConfig.Gateway = "fe80::1"; }
19 + ];
20 };
21 };
22 };
build/pluto/nginx.nix
+5 -4
@@ -1,9 +1,10 @@
1 -{ config
2 -, ...
3 -}:
1 +{ config, ... }:
2
3 {
6 - networking.firewall.allowedTCPPorts = [ 80 443 ];
4 + networking.firewall.allowedTCPPorts = [
5 + 80
6 + 443
7 + ];
8
9 services.nginx = {
10 enable = true;
build/pluto/nixos-metrics.nix
+2 -7
@@ -1,7 +1,4 @@
1 -{ config
2 -, pkgs
3 -, ...
4 -}:
1 +{ config, pkgs, ... }:
2
3 {
4 systemd.services.pull-nixos-metrics = {
@@ -30,9 +27,7 @@
27 timerConfig.OnCalendar = "12:00:00";
28 };
29
33 - services.backup.includesZfsDatasets = [
34 - "/var/lib/victoriametrics"
35 - ];
30 + services.backup.includesZfsDatasets = [ "/var/lib/victoriametrics" ];
31
32 services.victoriametrics = {
33 enable = true;
build/pluto/prometheus/alertmanager.nix
+82 -73
@@ -1,19 +1,17 @@
1 -{ config
2 -, ...
3 -}:
1 +{ config, ... }:
2
3 {
6 - networking.firewall.interfaces.wg0.allowedTCPPorts = [
7 - 9093
8 - ];
4 + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9093 ];
5
6 services.prometheus = {
11 - alertmanagers = [ {
12 - scheme = "http";
13 - static_configs = [ {
14 - targets = [ "localhost:${toString config.services.prometheus.alertmanager.port}" ];
15 - } ];
16 - } ];
7 + alertmanagers = [
8 + {
9 + scheme = "http";
10 + static_configs = [
11 + { targets = [ "localhost:${toString config.services.prometheus.alertmanager.port}" ]; }
12 + ];
13 + }
14 + ];
15
16 alertmanager = {
17 enable = true;
@@ -32,22 +30,29 @@
30 repeat_interval = "24h";
31 group_by = [ "alertname" ];
32
35 - routes = [ {
36 - receiver = "go-neb";
37 - group_wait = "30s";
38 - match.severity = "warning";
39 - } ];
33 + routes = [
34 + {
35 + receiver = "go-neb";
36 + group_wait = "30s";
37 + match.severity = "warning";
38 + }
39 + ];
40 };
41 - receivers = [ {
42 - # with no *_config, this will drop all alerts directed to it
43 - name = "ignore";
44 - } {
45 - name = "go-neb";
46 - webhook_configs = [ {
47 - url = "${config.services.go-neb.baseUrl}:4050/services/hooks/YWxlcnRtYW5hZ2VyX3NlcnZpY2U";
48 - send_resolved = true;
49 - } ];
50 - } ];
41 + receivers = [
42 + {
43 + # with no *_config, this will drop all alerts directed to it
44 + name = "ignore";
45 + }
46 + {
47 + name = "go-neb";
48 + webhook_configs = [
49 + {
50 + url = "${config.services.go-neb.baseUrl}:4050/services/hooks/YWxlcnRtYW5hZ2VyX3NlcnZpY2U";
51 + send_resolved = true;
52 + }
53 + ];
54 + }
55 + ];
56 };
57 };
58 };
@@ -63,7 +68,7 @@
68 isSystemUser = true;
69 group = "go-neb";
70 };
66 - users.groups.go-neb = {};
71 + users.groups.go-neb = { };
72
73 systemd.services.go-neb.serviceConfig.SupplementaryGroups = [ "keys" ];
74
@@ -72,56 +77,60 @@
77 baseUrl = "http://localhost";
78 secretFile = config.age.secrets.alertmanager-matrix-forwarder.path;
79 config = {
75 - clients = [ {
76 - UserId = "@bot:nixos.org";
77 - AccessToken = "$CHANGEME";
78 - HomeServerUrl = "https://matrix.nixos.org";
79 - Sync = true;
80 - AutoJoinRooms = true;
81 - DisplayName = "Bot";
82 - } ];
83 - services = [ {
84 - ID = "alertmanager_service";
85 - Type = "alertmanager";
86 - UserId = "@bot:nixos.org";
87 - Config = {
88 - webhook_url = "http://localhost:4050/services/hooks/YWxlcnRtYW5hZ2VyX3NlcnZpY2U";
89 - rooms = {
90 - # infra-alerts:nixos.org
91 - "!QLQqibtFaVtDgurUAE:nixos.org" = {
92 - text_template = ''
93 - {{range .Alerts -}} [{{ .Status }}] {{index .Labels "alertname" }}: {{index .Annotations "description"}} {{ end -}}
94 - '';
80 + clients = [
81 + {
82 + UserId = "@bot:nixos.org";
83 + AccessToken = "$CHANGEME";
84 + HomeServerUrl = "https://matrix.nixos.org";
85 + Sync = true;
86 + AutoJoinRooms = true;
87 + DisplayName = "Bot";
88 + }
89 + ];
90 + services = [
91 + {
92 + ID = "alertmanager_service";
93 + Type = "alertmanager";
94 + UserId = "@bot:nixos.org";
95 + Config = {
96 + webhook_url = "http://localhost:4050/services/hooks/YWxlcnRtYW5hZ2VyX3NlcnZpY2U";
97 + rooms = {
98 + # infra-alerts:nixos.org
99 + "!QLQqibtFaVtDgurUAE:nixos.org" = {
100 + text_template = ''
101 + {{range .Alerts -}} [{{ .Status }}] {{index .Labels "alertname" }}: {{index .Annotations "description"}} {{ end -}}
102 + '';
103
96 - # $$severity otherwise envsubst replaces $severity with an empty string
97 - html_template = ''
98 - {{range .Alerts -}}
99 - {{ $$severity := index .Labels "severity" }}
100 - {{ if eq .Status "firing" }}
101 - {{ if eq $$severity "critical"}}
102 - <font color='red'><b>[FIRING - CRITICAL]</b></font>
103 - {{ else if eq $$severity "warning"}}
104 - <font color='orange'><b>[FIRING - WARNING]</b></font>
104 + # $$severity otherwise envsubst replaces $severity with an empty string
105 + html_template = ''
106 + {{range .Alerts -}}
107 + {{ $$severity := index .Labels "severity" }}
108 + {{ if eq .Status "firing" }}
109 + {{ if eq $$severity "critical"}}
110 + <font color='red'><b>[FIRING - CRITICAL]</b></font>
111 + {{ else if eq $$severity "warning"}}
112 + <font color='orange'><b>[FIRING - WARNING]</b></font>
113 + {{ else }}
114 + <b>[FIRING - {{ $$severity }}]</b>
115 + {{ end }}
116 {{ else }}
106 - <b>[FIRING - {{ $$severity }}]</b>
117 + <font color='green'><b>[RESOLVED]</b></font>
118 {{ end }}
108 - {{ else }}
109 - <font color='green'><b>[RESOLVED]</b></font>
110 - {{ end }}
111 - {{ index .Labels "alertname"}}: {{ index .Annotations "summary"}}
112 - (
113 - {{ if .Annotations.grafana }}
114 - <a href="{{ index .Annotations "grafana" }}">📈 Grafana</a>,
115 - {{ end }}
116 - <a href="{{ .GeneratorURL }}">🔥 Prometheus</a>,
117 - <a href="{{ .SilenceURL }}">🔕 Silence</a>
118 - )<br/>
119 - {{end -}}'';
120 - msg_type = "m.text"; # Must be either `m.text` or `m.notice`
119 + {{ index .Labels "alertname"}}: {{ index .Annotations "summary"}}
120 + (
121 + {{ if .Annotations.grafana }}
122 + <a href="{{ index .Annotations "grafana" }}">📈 Grafana</a>,
123 + {{ end }}
124 + <a href="{{ .GeneratorURL }}">🔥 Prometheus</a>,
125 + <a href="{{ .SilenceURL }}">🔕 Silence</a>
126 + )<br/>
127 + {{end -}}'';
128 + msg_type = "m.text"; # Must be either `m.text` or `m.notice`
129 + };
130 };
131 };
123 - };
124 - } ];
132 + }
133 + ];
134 };
135 };
136 }
build/pluto/prometheus/default.nix
+3 -8
@@ -1,5 +1,4 @@
1 -{ ...
2 -}:
1 +{ ... }:
2
3 {
4 imports = [
@@ -31,13 +30,9 @@
30 10.254.3.1 webserver
31 '';
32
34 - networking.firewall.allowedTCPPorts = [
35 - 9090
36 - ];
33 + networking.firewall.allowedTCPPorts = [ 9090 ];
34
38 - services.backup.includesZfsDatasets = [
39 - "/var/lib/prometheus2"
40 - ];
35 + services.backup.includesZfsDatasets = [ "/var/lib/prometheus2" ];
36
37 services.prometheus = {
38 enable = true;
build/pluto/prometheus/exporters/blackbox.nix
+43 -35
@@ -1,6 +1,4 @@
1 -{ pkgs
2 -, ...
3 -}:
1 +{ pkgs, ... }:
2
3 let
4 mkProbe = module: targets: {
@@ -9,19 +7,21 @@ let
7 params = {
8 module = [ module ];
9 };
12 - static_configs = [ {
13 - inherit targets;
14 - } ];
15 - relabel_configs = [ {
16 - source_labels = [ "__address__" ];
17 - target_label = "__param_target";
18 - } {
19 - source_labels = [ "__param_target" ];
20 - target_label = "instance";
21 - } {
22 - target_label = "__address__";
23 - replacement = "localhost:9115";
24 - } ];
10 + static_configs = [ { inherit targets; } ];
11 + relabel_configs = [
12 + {
13 + source_labels = [ "__address__" ];
14 + target_label = "__param_target";
15 + }
16 + {
17 + source_labels = [ "__param_target" ];
18 + target_label = "instance";
19 + }
20 + {
21 + target_label = "__address__";
22 + replacement = "localhost:9115";
23 + }
24 + ];
25 };
26 in
27
@@ -30,13 +30,15 @@ in
30 exporters.blackbox = {
31 enable = true;
32 listenAddress = "127.0.0.1";
33 - configFile = pkgs.writeText "probes.yml" (builtins.toJSON {
34 - modules.https_success = {
35 - prober = "http";
36 - tcp.tls = true;
37 - http.headers.User-Agent = "blackbox-exporter";
38 - };
39 - });
33 + configFile = pkgs.writeText "probes.yml" (
34 + builtins.toJSON {
35 + modules.https_success = {
36 + prober = "http";
37 + tcp.tls = true;
38 + http.headers.User-Agent = "blackbox-exporter";
39 + };
40 + }
41 + );
42 };
43
44 scrapeConfigs = [
@@ -63,18 +65,24 @@ in
65 ];
66
67 ruleFiles = [
66 - (pkgs.writeText "blackbox-exporter.rules" (builtins.toJSON {
67 - groups = [ {
68 - name = "blackbox";
69 - rules = [ {
70 - alert = "CertificateExpiry";
71 - expr = "probe_ssl_earliest_cert_expiry - time() < 86400 * 14";
72 - for = "10m";
73 - labels.severity = "warning";
74 - annotations.summary = "Certificate for {{ $labels.instance }} is expiring soon.";
75 - } ];
76 - } ];
77 - }))
68 + (pkgs.writeText "blackbox-exporter.rules" (
69 + builtins.toJSON {
70 + groups = [
71 + {
72 + name = "blackbox";
73 + rules = [
74 + {
75 + alert = "CertificateExpiry";
76 + expr = "probe_ssl_earliest_cert_expiry - time() < 86400 * 14";
77 + for = "10m";
78 + labels.severity = "warning";
79 + annotations.summary = "Certificate for {{ $labels.instance }} is expiring soon.";
80 + }
81 + ];
82 + }
83 + ];
84 + }
85 + ))
86 ];
87 };
88 }
build/pluto/prometheus/exporters/channel.nix
+34 -26
@@ -1,14 +1,22 @@
1 -{ lib
2 -, pkgs
3 -, ...
4 -}:
1 +{ lib, pkgs, ... }:
2
3 let
7 - channels = pkgs.writeText "channels.json" (builtins.toJSON (import ../../../../channels.nix).channels);
8 -in {
4 + channels = pkgs.writeText "channels.json" (
5 + builtins.toJSON (import ../../../../channels.nix).channels
6 + );
7 +in
8 +{
9 systemd.services.channel-update-exporter = {
10 description = "Check all active channels' last-update times";
11 - path = [ (pkgs.python3.withPackages (pypkgs: with pypkgs; [ requests dateutil prometheus_client ])) ];
11 + path = [
12 + (pkgs.python3.withPackages (
13 + pypkgs: with pypkgs; [
14 + requests
15 + dateutil
16 + prometheus_client
17 + ]
18 + ))
19 + ];
20 wantedBy = [ "multi-user.target" ];
21 serviceConfig = {
22 DynamicUser = true;
@@ -16,27 +24,27 @@ in {
24 };
25 };
26
19 - services.prometheus.scrapeConfigs = [ {
20 - job_name = "channel-updates";
21 - metrics_path = "/";
22 - static_configs = [ {
23 - targets = [
24 - "127.0.0.1:9402"
25 - ];
26 - } ];
27 - } ] ++ lib.mapAttrsToList
28 - (name: value: {
27 + services.prometheus.scrapeConfigs =
28 + [
29 + {
30 + job_name = "channel-updates";
31 + metrics_path = "/";
32 + static_configs = [ { targets = [ "127.0.0.1:9402" ]; } ];
33 + }
34 + ]
35 + ++ lib.mapAttrsToList (name: value: {
36 job_name = "channel-job-${name}";
37 scheme = "https";
38 scrape_interval = "5m";
39 metrics_path = "/job/${value.job}/prometheus";
33 - static_configs = [{
34 - labels = {
35 - current = if value.status != "unmaintained" then "1" else "0";
36 - channel = name;
37 - };
38 - targets = [ "hydra.nixos.org:443" ];
39 - }];
40 - })
41 - (import ../../../../channels.nix).channels;
40 + static_configs = [
41 + {
42 + labels = {
43 + current = if value.status != "unmaintained" then "1" else "0";
44 + channel = name;
45 + };
46 + targets = [ "hydra.nixos.org:443" ];
47 + }
48 + ];
49 + }) (import ../../../../channels.nix).channels;
50 }
build/pluto/prometheus/exporters/domain.nix
+45 -34
@@ -1,6 +1,4 @@
1 -{ pkgs
2 -, ...
3 -}:
1 +{ pkgs, ... }:
2
3 {
4 services.prometheus = {
@@ -9,40 +7,53 @@
7 listenAddress = "localhost";
8 };
9
12 - scrapeConfigs = [ {
13 - # https://github.com/caarlos0/domain_exporter#configuration
14 - job_name = "domain";
15 - metrics_path = "/probe";
16 - relabel_configs = [ {
17 - source_labels = [ "__address__" ];
18 - target_label = "__param_target";
19 - } {
20 - target_label = "__address__";
21 - replacement = "localhost:9222";
22 - } ];
23 - static_configs = [ {
24 - targets = [
25 - "nix.ci"
26 - "nix.dev"
27 - "nixos.org"
28 - "ofborg.org"
10 + scrapeConfigs = [
11 + {
12 + # https://github.com/caarlos0/domain_exporter#configuration
13 + job_name = "domain";
14 + metrics_path = "/probe";
15 + relabel_configs = [
16 + {
17 + source_labels = [ "__address__" ];
18 + target_label = "__param_target";
19 + }
20 + {
21 + target_label = "__address__";
22 + replacement = "localhost:9222";
23 + }
24 ];
30 - } ];
31 - } ];
25 + static_configs = [
26 + {
27 + targets = [
28 + "nix.ci"
29 + "nix.dev"
30 + "nixos.org"
31 + "ofborg.org"
32 + ];
33 + }
34 + ];
35 + }
36 + ];
37
38 ruleFiles = [
34 - (pkgs.writeText "domain-exporter.rules" (builtins.toJSON {
35 - groups = [ {
36 - name = "domain";
37 - rules = [ {
38 - alert = "DomainExpiry";
39 - expr = "domain_expiry_days < 30";
40 - for = "1h";
41 - labels.severity = "warning";
42 - annotations.summary = "Domain {{ $labels.domain }} will expire in less than 30 days";
43 - } ];
44 - } ];
45 - }))
39 + (pkgs.writeText "domain-exporter.rules" (
40 + builtins.toJSON {
41 + groups = [
42 + {
43 + name = "domain";
44 + rules = [
45 + {
46 + alert = "DomainExpiry";
47 + expr = "domain_expiry_days < 30";
48 + for = "1h";
49 + labels.severity = "warning";
50 + annotations.summary = "Domain {{ $labels.domain }} will expire in less than 30 days";
51 + }
52 + ];
53 + }
54 + ];
55 + }
56 + ))
57 ];
58 };
59 }
build/pluto/prometheus/exporters/fastly.nix
+8 -12
@@ -1,6 +1,4 @@
1 -{ config
2 -, ...
3 -}:
1 +{ config, ... }:
2
3 {
4 age.secrets.fastly-read-only-api-token.file = ../../../secrets/fastly-read-only-api-token.age;
@@ -12,14 +10,12 @@
10 tokenPath = config.age.secrets.fastly-read-only-api-token.path;
11 };
12
15 - scrapeConfigs = [ {
16 - job_name = "fastly";
17 - metrics_path = "/metrics";
18 - static_configs = [ {
19 - targets = [
20 - "127.0.0.1:9118"
21 - ];
22 - } ];
23 - } ];
13 + scrapeConfigs = [
14 + {
15 + job_name = "fastly";
16 + metrics_path = "/metrics";
17 + static_configs = [ { targets = [ "127.0.0.1:9118" ]; } ];
18 + }
19 + ];
20 };
21 }
build/pluto/prometheus/exporters/github.nix
+28 -31
@@ -1,6 +1,4 @@
1 -{ pkgs
2 -, ...
3 -}:
1 +{ pkgs, ... }:
2
3 let
4 exporter = pkgs.fetchFromGitHub {
@@ -10,46 +8,45 @@ let
8 sha256 = "sha256-Sk/ynhPeXQVIgyZJ3Gj1VynJhPWmBHjrRnGYLjnJvio=";
9 };
10
13 - config = pkgs.writeText "config.json" (builtins.toJSON {
14 - port = 9401;
15 - repos = [
16 - "NixOS/nixpkgs"
17 - "NixOS/nix"
18 - ];
19 - });
20 -in {
11 + config = pkgs.writeText "config.json" (
12 + builtins.toJSON {
13 + port = 9401;
14 + repos = [
15 + "NixOS/nixpkgs"
16 + "NixOS/nix"
17 + ];
18 + }
19 + );
20 +in
21 +{
22 systemd.services.prometheus-github-exporter = {
22 - wantedBy = [
23 - "multi-user.target"
24 - ];
25 - after = [
26 - "network.target"
27 - ];
23 + wantedBy = [ "multi-user.target" ];
24 + after = [ "network.target" ];
25 serviceConfig = {
26 DynamicUser = true;
27 User = "github-exporter";
28 Restart = "always";
29 RestartSec = "60s";
33 - PrivateTmp = true;
30 + PrivateTmp = true;
31 };
32
33 path = [
37 - (pkgs.python3.withPackages (ps: with ps; [
38 - prometheus_client
39 - requests
40 - ]))
34 + (pkgs.python3.withPackages (
35 + ps: with ps; [
36 + prometheus_client
37 + requests
38 + ]
39 + ))
40 ];
41
42 script = "exec python3 ${exporter}/scrape.py ${config}";
43 };
44
46 - services.prometheus.scrapeConfigs = [ {
47 - job_name = "prometheus-github-exporter";
48 - metrics_path = "/";
49 - static_configs = [ {
50 - targets = [
51 - "127.0.0.1:9401"
52 - ];
53 - } ];
54 - } ];
45 + services.prometheus.scrapeConfigs = [
46 + {
47 + job_name = "prometheus-github-exporter";
48 + metrics_path = "/";
49 + static_configs = [ { targets = [ "127.0.0.1:9401" ]; } ];
50 + }
51 + ];
52 }
build/pluto/prometheus/exporters/hydra.nix
+73 -85
@@ -1,105 +1,93 @@
1 -{ pkgs
2 -, ...
3 -}:
1 +{ pkgs, ... }:
2
3 {
4 networking.firewall.allowedTCPPorts = [ 9200 ];
5
6 systemd.services.prometheus-hydra-queue-runner-exporter = {
9 - wantedBy = [
10 - "multi-user.target"
11 - ];
12 - after = [
13 - "network.target"
14 - ];
15 - wants = [
16 - "network.target"
17 - ];
7 + wantedBy = [ "multi-user.target" ];
8 + after = [ "network.target" ];
9 + wants = [ "network.target" ];
10 serviceConfig = {
11 DynamicUser = true;
12 Restart = "always";
13 RestartSec = "60s";
14 PrivateTmp = true;
15 WorkingDirectory = "/tmp";
24 - ExecStart = let
25 - python = pkgs.python3.withPackages (ps: with ps; [
26 - requests
27 - prometheus_client
28 - ]);
29 - in
30 - ''
31 - ${python.interpreter} ${./hydra-queue-runner-reexporter.py}
32 - '';
16 + ExecStart =
17 + let
18 + python = pkgs.python3.withPackages (
19 + ps: with ps; [
20 + requests
21 + prometheus_client
22 + ]
23 + );
24 + in
25 + ''
26 + ${python.interpreter} ${./hydra-queue-runner-reexporter.py}
27 + '';
28 };
29 };
30
31 services.prometheus = {
37 - scrapeConfigs = [ {
38 - job_name = "hydra";
39 - metrics_path = "/prometheus";
40 - scheme = "https";
41 - static_configs = [ {
42 - targets = [
43 - "hydra.nixos.org:443"
44 - ];
45 - } ];
46 - } {
47 - job_name = "hydra_notify";
48 - metrics_path = "/metrics";
49 - scheme = "http";
50 - static_configs = [ {
51 - targets = [
52 - "hydra.nixos.org:9199"
53 - ];
54 - } ];
55 - } {
56 - job_name = "hydra_queue_runner";
57 - metrics_path = "/metrics";
58 - scheme = "http";
59 - static_configs = [ {
60 - targets = [
61 - "hydra.nixos.org:9198"
62 - ];
63 - } ];
64 - } {
65 - job_name = "hydra-webserver";
66 - metrics_path = "/metrics";
67 - scheme = "https";
68 - static_configs = [ {
69 - targets = [
70 - "hydra.nixos.org:443"
71 - ];
72 - } ];
73 - } {
74 - job_name = "hydra-reexport";
75 - metrics_path = "/";
76 - static_configs = [ {
77 - targets = [
78 - "monitoring.nixos.org:9200"
79 - ];
80 - } ];
81 - } ];
32 + scrapeConfigs = [
33 + {
34 + job_name = "hydra";
35 + metrics_path = "/prometheus";
36 + scheme = "https";
37 + static_configs = [ { targets = [ "hydra.nixos.org:443" ]; } ];
38 + }
39 + {
40 + job_name = "hydra_notify";
41 + metrics_path = "/metrics";
42 + scheme = "http";
43 + static_configs = [ { targets = [ "hydra.nixos.org:9199" ]; } ];
44 + }
45 + {
46 + job_name = "hydra_queue_runner";
47 + metrics_path = "/metrics";
48 + scheme = "http";
49 + static_configs = [ { targets = [ "hydra.nixos.org:9198" ]; } ];
50 + }
51 + {
52 + job_name = "hydra-webserver";
53 + metrics_path = "/metrics";
54 + scheme = "https";
55 + static_configs = [ { targets = [ "hydra.nixos.org:443" ]; } ];
56 + }
57 + {
58 + job_name = "hydra-reexport";
59 + metrics_path = "/";
60 + static_configs = [ { targets = [ "monitoring.nixos.org:9200" ]; } ];
61 + }
62 + ];
63
64 ruleFiles = [
84 - (pkgs.writeText "hydra-exporter.rules" (builtins.toJSON {
85 - groups = [ {
86 - name = "hydra";
87 - rules = [ {
88 - alert = "BuildsStuckOverTwoDays";
89 - expr = ''hydra_machine_build_duration_bucket{le="+Inf"} - ignoring(le) hydra_machine_build_duration_bucket{le="172800"} > 0'';
90 - for = "30m";
91 - labels.severity = "warning";
92 - annotations.summary = "{{ $labels.machine }} has {{ $value }} over-age jobs.";
93 - annotations.grafana = "https://monitoring.nixos.org/grafana/d/j0hJAY1Wk/in-progress-build-duration-heatmap";
94 - } {
95 - alert = "HydraQueueRunnerUp";
96 - expr = ''up{job="hydra_queue_runner"} == 0'';
97 - for = "30m";
98 - labels.severity = "warning";
99 - annotations.summary = "hydra-queue-runner's prometheus exporter is not up";
100 - } ];
101 - } ];
102 - }))
65 + (pkgs.writeText "hydra-exporter.rules" (
66 + builtins.toJSON {
67 + groups = [
68 + {
69 + name = "hydra";
70 + rules = [
71 + {
72 + alert = "BuildsStuckOverTwoDays";
73 + expr = ''hydra_machine_build_duration_bucket{le="+Inf"} - ignoring(le) hydra_machine_build_duration_bucket{le="172800"} > 0'';
74 + for = "30m";
75 + labels.severity = "warning";
76 + annotations.summary = "{{ $labels.machine }} has {{ $value }} over-age jobs.";
77 + annotations.grafana = "https://monitoring.nixos.org/grafana/d/j0hJAY1Wk/in-progress-build-duration-heatmap";
78 + }
79 + {
80 + alert = "HydraQueueRunnerUp";
81 + expr = ''up{job="hydra_queue_runner"} == 0'';
82 + for = "30m";
83 + labels.severity = "warning";
84 + annotations.summary = "hydra-queue-runner's prometheus exporter is not up";
85 + }
86 + ];
87 + }
88 + ];
89 + }
90 + ))
91 ];
92 };
93 }
build/pluto/prometheus/exporters/json.nix
+22 -18
@@ -6,7 +6,7 @@
6 enable = true;
7 listenAddress = "localhost";
8
9 - configFile = (pkgs.formats.yaml {}).generate "json-exporter-config.yml" {
9 + configFile = (pkgs.formats.yaml { }).generate "json-exporter-config.yml" {
10 modules.matrix-federation-checker = {
11 metrics = [
12 {
@@ -25,7 +25,9 @@
25 {
26 job_name = "matrix-federation-checker";
27 metrics_path = "/probe";
28 - params = { module = [ "matrix-federation-checker" ]; };
28 + params = {
29 + module = [ "matrix-federation-checker" ];
30 + };
31 relabel_configs = [
32 {
33 source_labels = [ "__address__" ];
@@ -51,22 +53,24 @@
53 ];
54
55 ruleFiles = [
54 - (pkgs.writeText "matrix-federation.rules" (builtins.toJSON {
55 - groups = [
56 - {
57 - name = "matrix-federation";
58 - rules = [
59 - {
60 - alert = "MatrixFederationFailure";
61 - expr = "matrix_homeserver_federation_ok < 1";
62 - for = "30m";
63 - labels.severity = "warning";
64 - annotations.summary = "Matrix federation for {{ $labels.matrix_instance }} appears to be failing.";
65 - }
66 - ];
67 - }
68 - ];
69 - }))
56 + (pkgs.writeText "matrix-federation.rules" (
57 + builtins.toJSON {
58 + groups = [
59 + {
60 + name = "matrix-federation";
61 + rules = [
62 + {
63 + alert = "MatrixFederationFailure";
64 + expr = "matrix_homeserver_federation_ok < 1";
65 + for = "30m";
66 + labels.severity = "warning";
67 + annotations.summary = "Matrix federation for {{ $labels.matrix_instance }} appears to be failing.";
68 + }
69 + ];
70 + }
71 + ];
72 + }
73 + ))
74 ];
75 };
76 }
build/pluto/prometheus/exporters/matrix-synapse.nix
+7 -9
@@ -1,11 +1,9 @@
1 {
2 - services.prometheus.scrapeConfigs = [ {
3 - job_name = "matrix_synapse";
4 - scheme = "https";
5 - static_configs = [ {
6 - targets = [
7 - "matrix.nixos.org:443"
8 - ];
9 - } ];
10 - } ];
2 + services.prometheus.scrapeConfigs = [
3 + {
4 + job_name = "matrix_synapse";
5 + scheme = "https";
6 + static_configs = [ { targets = [ "matrix.nixos.org:443" ]; } ];
7 + }
8 + ];
9 }
build/pluto/prometheus/exporters/nixos.nix
+18 -18
@@ -1,21 +1,21 @@
1 {
2 - services.prometheus.scrapeConfigs = [ {
3 - job_name = "nixos";
4 - static_configs = [ {
5 - labels.role = "hydra";
6 - targets = [
7 - "rhea:9300"
2 + services.prometheus.scrapeConfigs = [
3 + {
4 + job_name = "nixos";
5 + static_configs = [
6 + {
7 + labels.role = "hydra";
8 + targets = [ "rhea:9300" ];
9 + }
10 + {
11 + labels.role = "monitoring";
12 + targets = [ "pluto:9300" ];
13 + }
14 + {
15 + labels.role = "database";
16 + targets = [ "haumea:9300" ];
17 + }
18 ];
9 - } {
10 - labels.role = "monitoring";
11 - targets = [
12 - "pluto:9300"
13 - ];
14 - } {
15 - labels.role = "database";
16 - targets = [
17 - "haumea:9300"
18 - ];
19 - } ];
20 - } ];
19 + }
20 + ];
21 }
build/pluto/prometheus/exporters/node.nix
+89 -77
@@ -1,84 +1,96 @@
1 -{ pkgs
2 -, ...
3 -}:
1 +{ pkgs, ... }:
2
3 {
4 services.prometheus = {
7 - scrapeConfigs = [ {
8 - job_name = "node";
9 - static_configs = [ {
10 - labels.role = "hydra";
11 - targets = [
12 - "rhea:9100"
5 + scrapeConfigs = [
6 + {
7 + job_name = "node";
8 + static_configs = [
9 + {
10 + labels.role = "hydra";
11 + targets = [ "rhea:9100" ];
12 + }
13 + {
14 + labels.role = "database";
15 + targets = [ "haumea:9100" ];
16 + }
17 + {
18 + labels.role = "monitoring";
19 + targets = [ "pluto:9100" ];
20 + }
21 + {
22 + labels.role = "mac";
23 + targets = [
24 + "intense-heron.mac.nixos.org:9100"
25 + "sweeping-filly.mac.nixos.org:9100"
26 + "maximum-snail.mac.nixos.org:9100"
27 + "growing-jennet.mac.nixos.org:9100"
28 + "enormous-catfish.mac.nixos.org:9100"
29 + ];
30 + }
31 ];
14 - } {
15 - labels.role = "database";
16 - targets = [
17 - "haumea:9100"
18 - ];
19 - } {
20 - labels.role = "monitoring";
21 - targets = [
22 - "pluto:9100"
23 - ];
24 - } {
25 - labels.role = "mac";
26 - targets = [
27 - "intense-heron.mac.nixos.org:9100"
28 - "sweeping-filly.mac.nixos.org:9100"
29 - "maximum-snail.mac.nixos.org:9100"
30 - "growing-jennet.mac.nixos.org:9100"
31 - "enormous-catfish.mac.nixos.org:9100"
32 - ];
33 - } ];
34 - } ];
35 -
36 - ruleFiles = let
37 - diskSelector = ''mountpoint=~"(/|/scratch)",instance!~".*packethost.net"'';
38 - relevantLabels = "device,fstype,instance,mountpoint";
39 - in [
40 - (pkgs.writeText "node-exporter.rules" (builtins.toJSON {
41 - groups = [ {
42 - name = "node";
43 - rules = [ {
44 - alert = "PartitionLowInodes";
45 - expr = ''
46 - avg (node_filesystem_files_free{${diskSelector}} <= 10000) by (${relevantLabels})
47 - '';
48 - for = "30m";
49 - labels.severity = "warning";
50 - annotations.summary = "{{ $labels.device }} mounted to {{ $labels.mountpoint }} ({{ $labels.fstype }}) on {{ $labels.instance }} has {{ $value }} inodes free.";
51 - annotations.grafana = "https://monitoring.nixos.org/grafana/d/5LANB9pZk/per-instance-metrics?orgId=1&refresh=30s&var-instance={{ $labels.instance }}";
52 - } {
53 - alert = "PartitionLowDiskSpace";
54 - expr = ''
55 - (avg (round(node_filesystem_avail_bytes{${diskSelector}} * 10^(-9) <= 10)) by (${relevantLabels}))
56 - or
57 - (avg (((node_filesystem_avail_bytes{${diskSelector}} / node_filesystem_size_bytes) * 100) <= 10) by (${relevantLabels}))
58 - '';
59 - for = "30m";
60 - labels.severity = "warning";
61 - annotations.summary = "{{ $labels.device }} mounted to {{ $labels.mountpoint }} ({{ $labels.fstype }}) on {{ $labels.instance }} has {{ $value }} GB free.";
62 - annotations.grafana = "https://monitoring.nixos.org/grafana/d/5LANB9pZk/per-instance-metrics?orgId=1&refresh=30s&var-instance={{ $labels.instance }}";
63 - } {
64 - alert = "SystemdUnitFailed";
65 - expr = ''node_systemd_unit_state{state="failed"} == 1'';
66 - for = "15m";
67 - labels.severity = "warning";
68 - annotations.summary = "systemd unit {{ $labels.name }} on {{ $labels.instance }} has been down for more than 15 minutes.";
69 - } ];
70 - } {
71 - name = "scheduled-jobs";
72 - rules = [ {
73 - alert = "ChannelUpdateStuck";
74 - expr = ''max_over_time(node_systemd_unit_state{name=~"^update-nix.*.service$",state=~"failed"}[5m]) == 1'';
75 - for = "30m";
76 - labels.severity = "warning";
77 - annotations.summary = "{{ $labels.name }} on {{ $labels.instance }}";
78 - annotations.grafana = "https://monitoring.nixos.org/grafana/d/fBW4tL1Wz/scheduled-task-state-channels-website?orgId=1&refresh=10s";
79 - } ];
80 - } ];
81 - }))
32 + }
33 ];
34 +
35 + ruleFiles =
36 + let
37 + diskSelector = ''mountpoint=~"(/|/scratch)",instance!~".*packethost.net"'';
38 + relevantLabels = "device,fstype,instance,mountpoint";
39 + in
40 + [
41 + (pkgs.writeText "node-exporter.rules" (
42 + builtins.toJSON {
43 + groups = [
44 + {
45 + name = "node";
46 + rules = [
47 + {
48 + alert = "PartitionLowInodes";
49 + expr = ''
50 + avg (node_filesystem_files_free{${diskSelector}} <= 10000) by (${relevantLabels})
51 + '';
52 + for = "30m";
53 + labels.severity = "warning";
54 + annotations.summary = "{{ $labels.device }} mounted to {{ $labels.mountpoint }} ({{ $labels.fstype }}) on {{ $labels.instance }} has {{ $value }} inodes free.";
55 + annotations.grafana = "https://monitoring.nixos.org/grafana/d/5LANB9pZk/per-instance-metrics?orgId=1&refresh=30s&var-instance={{ $labels.instance }}";
56 + }
57 + {
58 + alert = "PartitionLowDiskSpace";
59 + expr = ''
60 + (avg (round(node_filesystem_avail_bytes{${diskSelector}} * 10^(-9) <= 10)) by (${relevantLabels}))
61 + or
62 + (avg (((node_filesystem_avail_bytes{${diskSelector}} / node_filesystem_size_bytes) * 100) <= 10) by (${relevantLabels}))
63 + '';
64 + for = "30m";
65 + labels.severity = "warning";
66 + annotations.summary = "{{ $labels.device }} mounted to {{ $labels.mountpoint }} ({{ $labels.fstype }}) on {{ $labels.instance }} has {{ $value }} GB free.";
67 + annotations.grafana = "https://monitoring.nixos.org/grafana/d/5LANB9pZk/per-instance-metrics?orgId=1&refresh=30s&var-instance={{ $labels.instance }}";
68 + }
69 + {
70 + alert = "SystemdUnitFailed";
71 + expr = ''node_systemd_unit_state{state="failed"} == 1'';
72 + for = "15m";
73 + labels.severity = "warning";
74 + annotations.summary = "systemd unit {{ $labels.name }} on {{ $labels.instance }} has been down for more than 15 minutes.";
75 + }
76 + ];
77 + }
78 + {
79 + name = "scheduled-jobs";
80 + rules = [
81 + {
82 + alert = "ChannelUpdateStuck";
83 + expr = ''max_over_time(node_systemd_unit_state{name=~"^update-nix.*.service$",state=~"failed"}[5m]) == 1'';
84 + for = "30m";
85 + labels.severity = "warning";
86 + annotations.summary = "{{ $labels.name }} on {{ $labels.instance }}";
87 + annotations.grafana = "https://monitoring.nixos.org/grafana/d/fBW4tL1Wz/scheduled-task-state-channels-website?orgId=1&refresh=10s";
88 + }
89 + ];
90 + }
91 + ];
92 + }
93 + ))
94 + ];
95 };
96 }
build/pluto/prometheus/exporters/packet-sd.nix
+72 -64
@@ -1,7 +1,4 @@
1 -{ config
2 -, pkgs
3 -, ...
4 -}:
1 +{ config, pkgs, ... }:
2
3 {
4 age.secrets.packet-sd-env = {
@@ -26,9 +23,7 @@
23 "multi-user.target"
24 "prometheus.service"
25 ];
29 - after = [
30 - "network.target"
31 - ];
26 + after = [ "network.target" ];
27
28 serviceConfig = {
29 User = "packet-sd";
@@ -41,63 +36,76 @@
36 };
37
38 services.prometheus = {
44 - scrapeConfigs = [ {
45 - job_name = "prometheus-packet-sd";
46 - metrics_path = "/metrics";
47 - static_configs = [ {
48 - targets = [
49 - "127.0.0.1:9465"
39 + scrapeConfigs = [
40 + {
41 + job_name = "prometheus-packet-sd";
42 + metrics_path = "/metrics";
43 + static_configs = [ { targets = [ "127.0.0.1:9465" ]; } ];
44 + }
45 + {
46 + job_name = "packet_nodes";
47 + file_sd_configs = [
48 + {
49 + files = [ "/var/lib/packet-sd/packet-sd.json" ];
50 + refresh_interval = "30s";
51 + }
52 + ];
53 + relabel_configs = [
54 + {
55 + source_labels = [ "__meta_packet_public_ipv4" ];
56 + target_label = "__address__";
57 + replacement = "\${1}:9100";
58 + action = "replace";
59 + }
60 + {
61 + source_labels = [ "__meta_packet_facility" ];
62 + target_label = "facility";
63 + }
64 + {
65 + source_labels = [ "__meta_packet_facility" ];
66 + target_label = "packet_facility";
67 + }
68 + {
69 + source_labels = [ "__meta_packet_plan" ];
70 + target_label = "plan";
71 + }
72 + {
73 + source_labels = [ "__meta_packet_plan" ];
74 + target_label = "packet_plan";
75 + }
76 + {
77 + # todo: change from _id to _uuid
78 + source_labels = [ "__meta_packet_switch_id" ];
79 + target_label = "packet_switch_id";
80 + }
81 + {
82 + source_labels = [ "__meta_packet_device_id" ];
83 + target_label = "packet_device_id";
84 + }
85 + {
86 + source_labels = [ "__meta_packet_state" ];
87 + target_label = "packet_device_state";
88 + }
89 + {
90 + source_labels = [ "__meta_packet_short_id" ];
91 + target_label = "instance";
92 + replacement = "\${1}.packethost.net";
93 + action = "replace";
94 + }
95 + {
96 + source_labels = [ "__meta_packet_tags" ];
97 + target_label = "role";
98 + regex = ".*hydra.*";
99 + replacement = "builder";
100 + action = "replace";
101 + }
102 + {
103 + source_labels = [ "__meta_packet_tags" ];
104 + regex = ".*prometheus-scraping-disabled.*";
105 + action = "drop";
106 + }
107 ];
51 - } ];
52 - } {
53 - job_name = "packet_nodes";
54 - file_sd_configs = [ {
55 - files = [ "/var/lib/packet-sd/packet-sd.json" ];
56 - refresh_interval = "30s";
57 - } ];
58 - relabel_configs = [ {
59 - source_labels = [ "__meta_packet_public_ipv4" ];
60 - target_label = "__address__";
61 - replacement = "\${1}:9100";
62 - action = "replace";
63 - } {
64 - source_labels = [ "__meta_packet_facility" ];
65 - target_label = "facility";
66 - } {
67 - source_labels = [ "__meta_packet_facility" ];
68 - target_label = "packet_facility";
69 - } {
70 - source_labels = [ "__meta_packet_plan" ];
71 - target_label = "plan";
72 - } {
73 - source_labels = [ "__meta_packet_plan" ];
74 - target_label = "packet_plan";
75 - } {
76 - # todo: change from _id to _uuid
77 - source_labels = [ "__meta_packet_switch_id" ];
78 - target_label = "packet_switch_id";
79 - } {
80 - source_labels = [ "__meta_packet_device_id" ];
81 - target_label = "packet_device_id";
82 - } {
83 - source_labels = [ "__meta_packet_state" ];
84 - target_label = "packet_device_state";
85 - } {
86 - source_labels = [ "__meta_packet_short_id" ];
87 - target_label = "instance";
88 - replacement = "\${1}.packethost.net";
89 - action = "replace";
90 - } {
91 - source_labels = [ "__meta_packet_tags" ];
92 - target_label = "role";
93 - regex = ".*hydra.*";
94 - replacement = "builder";
95 - action = "replace";
96 - } {
97 - source_labels = [ "__meta_packet_tags" ];
98 - regex = ".*prometheus-scraping-disabled.*";
99 - action = "drop";
100 - } ];
101 - } ];
108 + }
109 + ];
110 };
111 }
build/pluto/prometheus/exporters/packet-spot-market.nix
+18 -21
@@ -6,45 +6,42 @@ let
6 rev = "b894f5dc061e2ab2d0ef101c28fce390285ad492";
7 sha256 = "sha256-I2WolAAM+siE8JfZbEZ3Mmk7/XqVio/PzUKqZUYCBfE=";
8 };
9 -in {
9 +in
10 +{
11 age.secrets.prometheus-packet-spot-market-price-exporter.file = ../../../secrets/prometheus-packet-spot-market-price-exporter.age;
12
13 systemd.services.prometheus-packet-spot-market-price-exporter = {
13 - wantedBy = [
14 - "multi-user.target"
15 - ];
16 - after = [
17 - "network.target"
18 - ];
14 + wantedBy = [ "multi-user.target" ];
15 + after = [ "network.target" ];
16 serviceConfig = {
17 DynamicUser = true;
18 User = "spot-price-exporter";
19 Group = "keys";
20 Restart = "always";
21 RestartSec = "60s";
25 - PrivateTmp = true;
22 + PrivateTmp = true;
23 LoadCredential = [
24 "config:${config.age.secrets.prometheus-packet-spot-market-price-exporter.path}"
25 ];
26 };
27
28 path = [
32 - (pkgs.python3.withPackages (ps: with ps; [
33 - prometheus_client
34 - requests
35 - ]))
29 + (pkgs.python3.withPackages (
30 + ps: with ps; [
31 + prometheus_client
32 + requests
33 + ]
34 + ))
35 ];
36
37 script = "exec python3 ${exporter}/scrape.py $CREDENTIALS_DIRECTORY/config";
38 };
39
41 - services.prometheus.scrapeConfigs = [ {
42 - job_name = "prometheus-packet-spot-price-exporter";
43 - metrics_path = "/metrics";
44 - static_configs = [ {
45 - targets = [
46 - "127.0.0.1:9400"
47 - ];
48 - } ] ;
49 - } ];
40 + services.prometheus.scrapeConfigs = [
41 + {
42 + job_name = "prometheus-packet-spot-price-exporter";
43 + metrics_path = "/metrics";
44 + static_configs = [ { targets = [ "127.0.0.1:9400" ]; } ];
45 + }
46 + ];
47 }
build/pluto/prometheus/exporters/postgresql.nix
+7 -9
@@ -1,11 +1,9 @@
1 {
2 - services.prometheus.scrapeConfigs = [ {
3 - job_name = "haumea-postgresql";
4 - metrics_path = "/metrics";
5 - static_configs = [ {
6 - targets = [
7 - "haumea:9187"
8 - ];
9 - } ];
10 - } ];
2 + services.prometheus.scrapeConfigs = [
3 + {
4 + job_name = "haumea-postgresql";
5 + metrics_path = "/metrics";
6 + static_configs = [ { targets = [ "haumea:9187" ]; } ];
7 + }
8 + ];
9 }
build/pluto/prometheus/exporters/r13y.nix
+8 -10
@@ -1,12 +1,10 @@
1 {
2 - services.prometheus.scrapeConfigs = [ {
3 - job_name = "r13y";
4 - scheme = "https";
5 - metrics_path = "/metrics";
6 - static_configs = [ {
7 - targets = [
8 - "r13y.com"
9 - ];
10 - } ];
11 - } ];
2 + services.prometheus.scrapeConfigs = [
3 + {
4 + job_name = "r13y";
5 + scheme = "https";
6 + metrics_path = "/metrics";
7 + static_configs = [ { targets = [ "r13y.com" ]; } ];
8 + }
9 + ];
10 }
build/pluto/prometheus/exporters/rfc39.nix
+32 -24
@@ -1,33 +1,41 @@
1 -{ pkgs
2 -, ...
3 -}:
1 +{ pkgs, ... }:
2
3 {
4 services.prometheus = {
7 - scrapeConfigs = [ {
8 - job_name = "rfc39";
9 - metrics_path = "/";
10 - static_configs = [ {
11 - targets = [
12 - # intermittently available, when the rfc39-sync.service runs
13 - "127.0.0.1:9190"
5 + scrapeConfigs = [
6 + {
7 + job_name = "rfc39";
8 + metrics_path = "/";
9 + static_configs = [
10 + {
11 + targets = [
12 + # intermittently available, when the rfc39-sync.service runs
13 + "127.0.0.1:9190"
14 + ];
15 + }
16 ];
15 - } ];
16 - } ];
17 + }
18 + ];
19
20 ruleFiles = [
19 - (pkgs.writeText "rfc39-exporter.rules" (builtins.toJSON {
20 - groups = [ {
21 - name = "rfc39";
22 - rules = [ {
23 - alert = "RFC39MaintainerSync";
24 - expr = ''node_systemd_unit_state{name=~"^rfc39-sync.service$", state="failed"} == 1'';
25 - for = "30m";
26 - labels.severity = "warning";
27 - annotations.grafana = "https://monitoring.nixos.org/grafana/d/fBW4tL1Wz/scheduled-task-state-channels-website?orgId=1&refresh=10s";
28 - } ];
29 - } ];
30 - }))
21 + (pkgs.writeText "rfc39-exporter.rules" (
22 + builtins.toJSON {
23 + groups = [
24 + {
25 + name = "rfc39";
26 + rules = [
27 + {
28 + alert = "RFC39MaintainerSync";
29 + expr = ''node_systemd_unit_state{name=~"^rfc39-sync.service$", state="failed"} == 1'';
30 + for = "30m";
31 + labels.severity = "warning";
32 + annotations.grafana = "https://monitoring.nixos.org/grafana/d/fBW4tL1Wz/scheduled-task-state-channels-website?orgId=1&refresh=10s";
33 + }
34 + ];
35 + }
36 + ];
37 + }
38 + ))
39 ];
40 };
41 }
build/pluto/prometheus/exporters/zfs.nix
+13 -9
@@ -1,14 +1,18 @@
1 {
2 services.prometheus = {
3 - scrapeConfigs = [ {
4 - job_name = "zfs";
5 - static_configs = [ {
6 - targets = [
7 - "rhea:9134"
8 - "haumea:9134"
9 - "pluto:9134"
3 + scrapeConfigs = [
4 + {
5 + job_name = "zfs";
6 + static_configs = [
7 + {
8 + targets = [
9 + "rhea:9134"
10 + "haumea:9134"
11 + "pluto:9134"
12 + ];
13 + }
14 ];
11 - } ];
12 - } ];
15 + }
16 + ];
17 };
18 }
build/rhea/configuration.nix
+12 -11
@@ -1,20 +1,21 @@
1 { pkgs, ... }:
2 {
3 - imports =
4 - [ ./hardware-configuration.nix
5 - ./hetzner.nix
6 - ./network.nix
7 - ../common.nix
8 - ../hydra.nix
9 - ../hydra-proxy.nix
10 - ../hydra-scaler.nix
11 - ../packet-importer.nix
12 - ];
3 + imports = [
4 + ./hardware-configuration.nix
5 + ./hetzner.nix
6 + ./network.nix
7 + ../common.nix
8 + ../hydra.nix
9 + ../hydra-proxy.nix
10 + ../hydra-scaler.nix
11 + ../packet-importer.nix
12 + ];
13
14 networking = {
15 hostName = "rhea";
16 firewall.allowedTCPPorts = [
17 - 80 443
17 + 80
18 + 443
19 9198 # hydra-queue-runner's prometheus
20 9199 # hydra-notify's prometheus
21 ];
build/rhea/hardware-configuration.nix
+36 -30
@@ -1,40 +1,46 @@
1 -{ config, lib, modulesPath, ... }:
1 +{
2 + config,
3 + lib,
4 + modulesPath,
5 + ...
6 +}:
7
8 {
4 - imports =
5 - [ (modulesPath + "/installer/scan/not-detected.nix")
6 - ];
9 + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
10
8 - boot.initrd.availableKernelModules = [ "ahci" "nvme" ];
11 + boot.initrd.availableKernelModules = [
12 + "ahci"
13 + "nvme"
14 + ];
15 boot.initrd.kernelModules = [ ];
16 boot.kernelModules = [ "kvm-amd" ];
17 boot.extraModulePackages = [ ];
18
13 - fileSystems."/" =
14 - { device = "rpool/safe/root";
15 - fsType = "zfs";
16 - };
17 -
18 - fileSystems."/nix" =
19 - { device = "rpool/local/nix";
20 - fsType = "zfs";
21 - };
22 -
23 - fileSystems."/nix/var/nix/db" =
24 - { device = "rpool/local/nix/db";
25 - fsType = "zfs";
26 - neededForBoot = true;
27 - };
28 -
29 - fileSystems."/var" =
30 - { device = "rpool/local/var";
31 - fsType = "zfs";
32 - };
33 -
34 - fileSystems."/boot" =
35 - { device = "/dev/disk/by-uuid/073C-DDED";
36 - fsType = "vfat";
37 - };
19 + fileSystems."/" = {
20 + device = "rpool/safe/root";
21 + fsType = "zfs";
22 + };
23 +
24 + fileSystems."/nix" = {
25 + device = "rpool/local/nix";
26 + fsType = "zfs";
27 + };
28 +
29 + fileSystems."/nix/var/nix/db" = {
30 + device = "rpool/local/nix/db";
31 + fsType = "zfs";
32 + neededForBoot = true;
33 + };
34 +
35 + fileSystems."/var" = {
36 + device = "rpool/local/var";
37 + fsType = "zfs";
38 + };
39 +
40 + fileSystems."/boot" = {
41 + device = "/dev/disk/by-uuid/073C-DDED";
42 + fsType = "vfat";
43 + };
44
45 swapDevices = [ ];
46
build/rhea/network.nix
+4 -5
@@ -14,11 +14,10 @@
14 "5.9.122.43/27"
15 "2a01:4f8:162:71eb::/64"
16 ];
17 - routes = [ {
18 - routeConfig.Gateway = "5.9.122.33";
19 - } {
20 - routeConfig.Gateway = "fe80::1";
21 - } ];
17 + routes = [
18 + { routeConfig.Gateway = "5.9.122.33"; }
19 + { routeConfig.Gateway = "fe80::1"; }
20 + ];
21 };
22 };
23 }
build/scripts/nix-mac-installer.sh
+16 -16
@@ -3,14 +3,14 @@
3 set -e
4
5 if [[ $(id -u) != 0 ]]; then
6 - echo "$0: please run this script as root"
7 - exit 1
6 + echo "$0: please run this script as root"
7 + exit 1
8 fi
9
10 export HOME=/var/root
11
12 -if ! dscl . read /Groups/nixbld > /dev/null 2>&1; then
13 - dseditgroup -o create nixbld -q
12 +if ! dscl . read /Groups/nixbld >/dev/null 2>&1; then
13 + dseditgroup -o create nixbld -q
14 fi
15
16 gid=$(dscl . -read /Groups/nixbld | awk '($1 == "PrimaryGroupID:") {print $2 }')
@@ -18,24 +18,24 @@ gid=$(dscl . -read /Groups/nixbld | awk '($1 == "PrimaryGroupID:") {print $2 }')
18 echo "created nixbld group with gid $gid"
19
20 for i in $(seq 1 10); do
21 - user=/Users/nixbld$i
22 - uid="$((30000 + $i))"
23 - dscl . -create $user
24 - dscl . -create $user RealName "Nix build user $i"
25 - dscl . -create $user PrimaryGroupID "$gid"
26 - dscl . -create $user UserShell /usr/bin/false
27 - dscl . -create $user NFSHomeDirectory /var/empty
28 - dscl . -create $user UniqueID "$uid"
29 - dseditgroup -o edit -a nixbld$i -t user nixbld
30 - echo "created nixbld$i user with uid $uid"
21 + user=/Users/nixbld$i
22 + uid="$((30000 + i))"
23 + dscl . -create $user
24 + dscl . -create $user RealName "Nix build user $i"
25 + dscl . -create $user PrimaryGroupID "$gid"
26 + dscl . -create $user UserShell /usr/bin/false
27 + dscl . -create $user NFSHomeDirectory /var/empty
28 + dscl . -create $user UniqueID "$uid"
29 + dseditgroup -o edit -a nixbld$i -t user nixbld
30 + echo "created nixbld$i user with uid $uid"
31 done
32
33 curl https://nixos.org/nix/install | sh
34
35 mkdir -p /var/root/.ssh
36 touch /var/root/.ssh/authorized_keys
37 -grep -v "hydra-queue-runner@chef" /var/root/.ssh/authorized_keys > /var/root/.ssh/authorized_keys.tmp || true
38 -echo 'command="/nix/var/nix/profiles/default/bin/nix-store --serve --write" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyM48VC5fpjJssLI8uolFscP4/iEoMHfkPoT9R3iE3OEjadmwa1XCAiXUoa7HSshw79SgPKF2KbGBPEVCascdAcErZKGHeHUzxj7v3IsNjObouUOBbJfpN4DR7RQT28PZRsh3TvTWjWnA9vIrSY/BvAK1uezFRuObvatqAPMrw4c0DK+JuGuCNkKDGHLXNSxYBc5Pmr1oSU7/BDiHVjjyLIsAMIc20+q8SjWswKqL1mY193mN7FpUMBtZrd0Za9fMFRII9AofEIDTOayvOZM6+/1dwRWZXM6jhE6kaPPF++yromHvDPBnd6FfwODKLvSF9BkA3pO5CqrD8zs7ETmrV hydra-queue-runner@chef' >> /var/root/.ssh/authorized_keys.tmp
37 +grep -v "hydra-queue-runner@chef" /var/root/.ssh/authorized_keys >/var/root/.ssh/authorized_keys.tmp || true
38 +echo 'command="/nix/var/nix/profiles/default/bin/nix-store --serve --write" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyM48VC5fpjJssLI8uolFscP4/iEoMHfkPoT9R3iE3OEjadmwa1XCAiXUoa7HSshw79SgPKF2KbGBPEVCascdAcErZKGHeHUzxj7v3IsNjObouUOBbJfpN4DR7RQT28PZRsh3TvTWjWnA9vIrSY/BvAK1uezFRuObvatqAPMrw4c0DK+JuGuCNkKDGHLXNSxYBc5Pmr1oSU7/BDiHVjjyLIsAMIc20+q8SjWswKqL1mY193mN7FpUMBtZrd0Za9fMFRII9AofEIDTOayvOZM6+/1dwRWZXM6jhE6kaPPF++yromHvDPBnd6FfwODKLvSF9BkA3pO5CqrD8zs7ETmrV hydra-queue-runner@chef' >>/var/root/.ssh/authorized_keys.tmp
39 mv /var/root/.ssh/authorized_keys.tmp /var/root/.ssh/authorized_keys
40
41 service_plist=/Library/LaunchDaemons/org.nixos.nix-daemon.plist
build/scripts/nix-mac-nuke.sh
+1 -1
@@ -8,7 +8,7 @@ launchctl unload $service_plist
8 dscl . -delete /Groups/nixbld
9
10 for i in $(seq 1 20); do
11 - dscl . -delete /Users/nixbld$i
11 + dscl . -delete /Users/nixbld$i
12 done
13
14 sudo rm -f $service_plist
build/secrets.nix
+6 -6
@@ -16,9 +16,9 @@ let
16 tarball-mirror-aws-credentials = [ machines.pluto ];
17 };
18 in
19 - builtins.listToAttrs (
20 - map (secretName: {
21 - name = "secrets/${secretName}.age";
22 - value.publicKeys = secrets."${secretName}" ++ keys.infra-core;
23 - }) (builtins.attrNames secrets)
24 - )
19 +builtins.listToAttrs (
20 + map (secretName: {
21 + name = "secrets/${secretName}.age";
22 + value.publicKeys = secrets."${secretName}" ++ keys.infra-core;
23 + }) (builtins.attrNames secrets)
24 +)
flake.nix
+11 -10
@@ -6,15 +6,16 @@
6 flake-parts.url = "github:hercules-ci/flake-parts";
7 treefmt-nix.url = "github:numtide/treefmt-nix";
8 };
9 - outputs = inputs@{ flake-parts, ... }:
10 - flake-parts.lib.mkFlake { inherit inputs; } {
11 - systems = [
12 - "x86_64-linux"
13 - "aarch64-linux"
14 - "x86_64-darwin"
15 - "aarch64-darwin"
16 - ];
17 - imports = [ ./formatter/default.nix ];
18 - };
9 + outputs =
10 + inputs@{ flake-parts, ... }:
11 + flake-parts.lib.mkFlake { inherit inputs; } {
12 + systems = [
13 + "x86_64-linux"
14 + "aarch64-linux"
15 + "x86_64-darwin"
16 + "aarch64-darwin"
17 + ];
18 + imports = [ ./formatter/default.nix ];
19 + };
20
21 }
formatter/default.nix
+6 -3
@@ -1,4 +1,5 @@
1 -{ inputs, ... }: {
1 +{ inputs, ... }:
2 +{
3 imports = [ inputs.treefmt-nix.flakeModule ];
4
5 perSystem =
@@ -12,10 +13,12 @@
13 programs.deadnix.enable = true;
14 programs.nixfmt.enable = true;
15 programs.nixfmt.package = pkgs.nixfmt-rfc-style;
15 - programs.shellcheck.enable = true;
16 +
17 + # TODO: fix shellcheck errors in a follow up pr
18 + #programs.shellcheck.enable = true;
19
20 programs.shfmt.enable = true;
21 programs.rustfmt.enable = true;
22 };
20 - };
23 + };
24 }
hydra-packet-importer/default.nix
+1 -3
@@ -10,9 +10,7 @@ python3.pkgs.buildPythonApplication {
10 python3.pkgs.black
11 ];
12
13 - propagatedBuildInputs = [
14 - python3.pkgs.packet-python
15 - ];
13 + propagatedBuildInputs = [ python3.pkgs.packet-python ];
14
15 installPhase = ''
16 mypy ./import.py
hydra-packet-importer/shell.nix
+1 -1
@@ -1 +1 @@
1 -(import <nixpkgs> {}).callPackage ./default.nix {}
1 +(import <nixpkgs> { }).callPackage ./default.nix { }
lib/service-order.nix
+17 -21
@@ -32,30 +32,26 @@
32 # };
33 # }
34 #
35 - mkOrderedChain = jobs: let
36 - unitConfigFrom = job: job.unitConfig or {};
37 - afterFrom = job: (unitConfigFrom job).After or [];
38 - previousFrom = collector:
39 - if collector ? previous
40 - then [collector.previous]
41 - else [];
35 + mkOrderedChain =
36 + jobs:
37 + let
38 + unitConfigFrom = job: job.unitConfig or { };
39 + afterFrom = job: (unitConfigFrom job).After or [ ];
40 + previousFrom = collector: if collector ? previous then [ collector.previous ] else [ ];
41
43 - ordered = builtins.foldl'
44 - (collector: item: {
45 - services = collector.services
46 - ++ [{
42 + ordered = builtins.foldl' (collector: item: {
43 + services = collector.services ++ [
44 + {
45 inherit (item) name;
46 value = item.value // {
49 - unitConfig = (unitConfigFrom item.value) //
50 - {
51 - After = (afterFrom item.value) ++
52 - (previousFrom collector);
47 + unitConfig = (unitConfigFrom item.value) // {
48 + After = (afterFrom item.value) ++ (previousFrom collector);
49 };
50 };
55 - }];
56 - previous = "${item.name}.service";
57 - })
58 - { services = []; }
59 - jobs;
60 - in ordered.services;
51 + }
52 + ];
53 + previous = "${item.name}.service";
54 + }) { services = [ ]; } jobs;
55 + in
56 + ordered.services;
57 }
macs/flake.nix
+11 -10
@@ -3,23 +3,24 @@
3
4 inputs = {
5 nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
6 - darwin = { url = "github:LnL7/nix-darwin"; inputs.nixpkgs.follows = "nixpkgs"; };
6 + darwin = {
7 + url = "github:LnL7/nix-darwin";
8 + inputs.nixpkgs.follows = "nixpkgs";
9 + };
10 };
11
12 outputs =
10 - { darwin
11 - , ...
12 - }:
13 + { darwin, ... }:
14 {
15 darwinConfigurations =
16 let
16 - mac = system: darwin.lib.darwinSystem {
17 - inherit system;
17 + mac =
18 + system:
19 + darwin.lib.darwinSystem {
20 + inherit system;
21
19 - modules = [
20 - ./nix-darwin.nix
21 - ];
22 - };
22 + modules = [ ./nix-darwin.nix ];
23 + };
24 in
25 {
26 arm64 = mac "aarch64-darwin";
macs/nix-darwin.nix
+24 -20
@@ -1,5 +1,10 @@
1 # used with https://github.com/DeterminateSystems/macos-ephemeral
2 -{ config, lib, pkgs, ... }:
2 +{
3 + config,
4 + lib,
5 + pkgs,
6 + ...
7 +}:
8
9 with lib;
10
@@ -7,21 +12,17 @@ let
12 sshKeys = rec {
13 hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
14 };
10 - environment = concatStringsSep " "
11 - [
12 - "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
13 - ];
15 + environment = concatStringsSep " " [
16 + "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
17 + ];
18
15 - authorizedNixStoreKey = key:
16 - "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ${key}";
19 + authorizedNixStoreKey =
20 + key: "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ${key}";
21 in
22
23 {
24 environment.darwinConfig = "/nix/home/darwin-config/macs/nix-darwin.nix";
21 - environment.systemPackages =
22 - [
23 - config.nix.package
24 - ];
25 + environment.systemPackages = [ config.nix.package ];
26
27 programs.zsh.enable = true;
28 programs.zsh.enableCompletion = false;
@@ -33,14 +34,19 @@ in
34 services.nix-daemon.enable = true;
35
36 nix.settings = {
36 - "extra-experimental-features" = [ "nix-command" "flakes" ];
37 + "extra-experimental-features" = [
38 + "nix-command"
39 + "flakes"
40 + ];
41 max-jobs = 4;
42 cores = 2;
43 };
44
45 nix.gc.automatic = true;
46 nix.gc.user = "";
43 - nix.gc.interval = { Minute = 15; };
47 + nix.gc.interval = {
48 + Minute = 15;
49 + };
50 nix.gc.options =
51 let
52 gbFree = 50;
@@ -49,15 +55,13 @@ in
55
56 # If we drop below 20GiB during builds, free 20GiB
57 nix.extraOptions = ''
52 - min-free = ${toString (30*1024*1024*1024)}
53 - max-free = ${toString (50*1024*1024*1024)}
58 + min-free = ${toString (30 * 1024 * 1024 * 1024)}
59 + max-free = ${toString (50 * 1024 * 1024 * 1024)}
60 '';
61
56 - environment.etc."per-user/root/ssh/authorized_keys".text = concatStringsSep "\n"
57 - [
58 - (authorizedNixStoreKey sshKeys.hydra-queue-runner)
59 - ];
60 -
62 + environment.etc."per-user/root/ssh/authorized_keys".text = concatStringsSep "\n" [
63 + (authorizedNixStoreKey sshKeys.hydra-queue-runner)
64 + ];
65
66 system.activationScripts.postActivation.text = ''
67 printf "configuring ssh keys for hydra on the root account... "
metrics/fastly/cron.sh
+5 -5
@@ -4,18 +4,18 @@ export AWS_PROFILE=nixos-org
4
5 now=$(date +%s)
6 #now=$((now - 86400))
7 -prev_week=$((($now / 86400 / 7)))
7 +prev_week=$((now / 86400 / 7))
8
9 -from_date_incl=$(date +%F --date="@$(($prev_week * 86400 * 7 - 2 * 86400))")
10 -to_date_incl=$(date +%F --date="@$(($prev_week * 86400 * 7 + 5 * 86400))")
9 +from_date_incl=$(date +%F --date="@$((prev_week * 86400 * 7 - 2 * 86400))")
10 +to_date_incl=$(date +%F --date="@$((prev_week * 86400 * 7 + 5 * 86400))")
11
12 echo "Ingesting [$from_date_incl, $to_date_incl)."
13
14 marker="$HOME/weeks-done/$prev_week"
15
16 if [[ -e $marker ]]; then
17 - echo "Already done!"
18 - exit 0
17 + echo "Already done!"
18 + exit 0
19 fi
20
21 mkdir -p "$(dirname "$marker")"
metrics/fastly/flake.nix
+25 -22
@@ -1,28 +1,31 @@
1 {
2 - outputs = { nixpkgs }: {
3 - nixosModules.nix-metrics = { pkgs, ... }: {
2 + outputs =
3 + { nixpkgs }:
4 + {
5 + nixosModules.nix-metrics =
6 + { pkgs, ... }:
7 + {
8
5 - users.users.nix-metrics =
6 - { isNormalUser = true;
7 - description = "Nix Metrics Collection";
8 - };
9 + users.users.nix-metrics = {
10 + isNormalUser = true;
11 + description = "Nix Metrics Collection";
12 + };
13
10 - systemd.services.process-raw-nix-logs = {
11 - description = "Process Raw nixos.org Logs";
12 - serviceConfig.Type = "oneshot";
13 - serviceConfig.User = "nix-metrics";
14 - path =
15 - [ pkgs.awscli
16 - pkgs.jq
17 - ];
18 - script =
19 - ''
20 - cd ${./.}
21 - ./cron.sh
22 - '';
23 - startAt = "Tue 07:30";
24 - };
14 + systemd.services.process-raw-nix-logs = {
15 + description = "Process Raw nixos.org Logs";
16 + serviceConfig.Type = "oneshot";
17 + serviceConfig.User = "nix-metrics";
18 + path = [
19 + pkgs.awscli
20 + pkgs.jq
21 + ];
22 + script = ''
23 + cd ${./.}
24 + ./cron.sh
25 + '';
26 + startAt = "Tue 07:30";
27 + };
28
29 + };
30 };
27 - };
31 }
metrics/fastly/ingest-raw-logs.sh
+25 -25
@@ -9,35 +9,35 @@ to_date_excl="$2"
9 [[ -n $to_date_excl ]]
10
11 run_query() {
12 - local name="$1"
13 - local query="$2"
12 + local name="$1"
13 + local query="$2"
14
15 - res=$(aws athena start-query-execution \
16 - --region $region \
17 - --result-configuration OutputLocation=s3://nixos-athena/ingestion/$name/ \
18 - --query-string "$query")
15 + res=$(aws athena start-query-execution \
16 + --region $region \
17 + --result-configuration OutputLocation=s3://nixos-athena/ingestion/$name/ \
18 + --query-string "$query")
19
20 - execution_id="$(printf "%s" "$res" | jq -r -e .QueryExecutionId)"
21 - [[ -n $execution_id ]]
20 + execution_id="$(printf "%s" "$res" | jq -r -e .QueryExecutionId)"
21 + [[ -n $execution_id ]]
22
23 - echo "Started query $name as $execution_id."
23 + echo "Started query $name as $execution_id."
24
25 - printf "Waiting..."
26 - while true; do
27 - res="$(aws athena get-query-execution --region $region --query-execution-id $execution_id)"
28 - status="$(printf %s "$res" | jq -r -e .QueryExecution.Status.State)"
29 - if [[ $status = RUNNING || $status = QUEUED ]]; then
30 - printf "."
31 - sleep 1
32 - continue
33 - fi
34 - if [[ $status = SUCCEEDED ]]; then
35 - printf " done.\n"
36 - break
37 - fi
38 - printf "\nFailed: %s (%s)\n" "$status" "$res"
39 - exit 1
40 - done
25 + printf "Waiting..."
26 + while true; do
27 + res="$(aws athena get-query-execution --region $region --query-execution-id $execution_id)"
28 + status="$(printf %s "$res" | jq -r -e .QueryExecution.Status.State)"
29 + if [[ $status = RUNNING || $status = QUEUED ]]; then
30 + printf "."
31 + sleep 1
32 + continue
33 + fi
34 + if [[ $status = SUCCEEDED ]]; then
35 + printf " done.\n"
36 + break
37 + fi
38 + printf "\nFailed: %s (%s)\n" "$status" "$res"
39 + exit 1
40 + done
41 }
42
43 run_query fill-urls \
metrics/fastly/run-queries.sh
+35 -35
@@ -5,56 +5,56 @@ region=eu-west-1
5 report_date="$(date +%Y-%m-%d)"
6
7 run_query() {
8 - local name="$1"
9 - local query="$2"
8 + local name="$1"
9 + local query="$2"
10
11 - res=$(aws athena start-query-execution \
12 - --region $region \
13 - --result-configuration OutputLocation=s3://nixos-metrics/$report_date/$name/ \
14 - --query-string "$query")
11 + res=$(aws athena start-query-execution \
12 + --region $region \
13 + --result-configuration OutputLocation=s3://nixos-metrics/$report_date/$name/ \
14 + --query-string "$query")
15
16 - execution_id="$(printf "%s" "$res" | jq -r -e .QueryExecutionId)"
17 - [[ -n $execution_id ]]
16 + execution_id="$(printf "%s" "$res" | jq -r -e .QueryExecutionId)"
17 + [[ -n $execution_id ]]
18
19 - echo "Started query $name as $execution_id."
19 + echo "Started query $name as $execution_id."
20
21 - redirect=latest/$name.csv
22 - aws s3api put-object \
23 - --bucket nixos-metrics \
24 - --key $redirect \
25 - --website-redirect-location /$report_date/$name/$execution_id.csv > /dev/null
21 + redirect=latest/$name.csv
22 + aws s3api put-object \
23 + --bucket nixos-metrics \
24 + --key $redirect \
25 + --website-redirect-location /$report_date/$name/$execution_id.csv >/dev/null
26
27 - echo "Created redirect http://nixos-metrics.s3-website-eu-west-1.amazonaws.com/$redirect."
27 + echo "Created redirect http://nixos-metrics.s3-website-eu-west-1.amazonaws.com/$redirect."
28 }
29
30 if true; then
31
32 -run_query traffic-per-day \
33 - "
32 + run_query traffic-per-day \
33 + "
34 select day, host, sum(nr) as nr_requests, sum(total_bytes) as total_bytes
35 from urls
36 group by day, host
37 order by day, host
38 "
39
40 -run_query traffic-per-country \
41 - "
40 + run_query traffic-per-country \
41 + "
42 select geo_country, sum(nr) as nr_requests, sum(total_bytes) as total_bytes
43 from clients
44 group by geo_country
45 order by total_bytes desc
46 "
47
48 -run_query cache-info-requests-per-day \
49 - "
48 + run_query cache-info-requests-per-day \
49 + "
50 select day, sum(nr) as cache_info_requests
51 from nix_cache_info
52 group by day
53 order by day
54 "
55
56 -run_query cache-info-requests-per-day-not-hosted \
57 - "
56 + run_query cache-info-requests-per-day-not-hosted \
57 + "
58 select day, sum(nr) as cache_info_requests
59 from nix_cache_info
60 where asn not in (select asn_nr from hosting_asns)
@@ -62,8 +62,8 @@ run_query cache-info-requests-per-day-not-hosted \
62 order by day
63 "
64
65 -run_query cache-info-requests-per-day-per-ua \
66 - "
65 + run_query cache-info-requests-per-day-per-ua \
66 + "
67 with tmp as
68 (select *, regexp_replace(regexp_replace(request_user_agent, '.* Nix', 'Nix'), 'pre[^ ]*', 'pre*') as cleaned_ua from nix_cache_info)
69 select day, cleaned_ua, sum(nr) as cache_info_requests
@@ -72,8 +72,8 @@ run_query cache-info-requests-per-day-per-ua \
72 order by day, cache_info_requests desc
73 "
74
75 -run_query flake-registry-requests-per-day \
76 - "
75 + run_query flake-registry-requests-per-day \
76 + "
77 select day, sum(nr) as total_requests
78 from urls
79 where host = 'channels.nixos.org' and url like '%/flake-registry.json'
@@ -81,8 +81,8 @@ run_query flake-registry-requests-per-day \
81 order by day
82 "
83
84 -run_query top-store-paths \
85 - "
84 + run_query top-store-paths \
85 + "
86 select path, sum(nr) as total_requests
87 from urls
88 join all_paths on regexp_replace(regexp_replace(url, '.narinfo', ''), '/', '') = regexp_replace(regexp_replace(path, '/nix/store/', ''), '-.*', '')
@@ -94,8 +94,8 @@ run_query top-store-paths \
94 order by total_requests desc
95 "
96
97 -run_query narinfo-queries-per-release \
98 - "
97 + run_query narinfo-queries-per-release \
98 + "
99 with tmp as
100 (select distinct path, regexp_replace(regexp_replace(regexp_replace(regexp_replace(release_name, 'pre.*', 'pre'), 'alpha.*', ''), 'beta.*', 'beta'), '\.[0-9]+\.[0-9a-f][0-9a-f][0-9a-f][0-9a-f]+$', '') as release from release_paths)
101 select release, sum(nr) as total_requests
@@ -108,8 +108,8 @@ run_query narinfo-queries-per-release \
108 order by total_requests desc
109 "
110
111 -run_query nix-installer-downloads \
112 - "
111 + run_query nix-installer-downloads \
112 + "
113 select day, sum(nr)
114 from urls
115 where
@@ -119,8 +119,8 @@ run_query nix-installer-downloads \
119 order by day
120 "
121
122 -run_query nix-installer-architectures \
123 - "
122 + run_query nix-installer-architectures \
123 + "
124 select arch, sum(nr) as count from
125 (select url, nr, regexp_replace(regexp_replace(url, '/nix/nix-[^/]+/nix-[^-]+-(rc[^-]*-)?', ''), '.tar.xz', '') as arch
126 from urls
metrics/fastly/update-asn-list.sh
+2 -2
@@ -1,7 +1,7 @@
1 #! /bin/sh -e
2
3 -curl --fail https://ftp.ripe.net/ripe/asnames/asn.txt > /tmp/asn.txt
3 +curl --fail https://ftp.ripe.net/ripe/asnames/asn.txt >/tmp/asn.txt
4
5 -sed -e 's/^\([0-9]\+\) \(.\+\), \([A-Z][A-Z]\)$/\1\t\2\t\3/; t; d' < /tmp/asn.txt > /tmp/asn.tsv
5 +sed -e 's/^\([0-9]\+\) \(.\+\), \([A-Z][A-Z]\)$/\1\t\2\t\3/; t; d' </tmp/asn.txt >/tmp/asn.tsv
6
7 aws s3 cp /tmp/asn.tsv s3://nixos-athena/all-asns/list.tsv
modules/backup.nix
+103 -100
@@ -1,7 +1,8 @@
1 -{ lib
2 -, config
3 -, pkgs
4 -, ...
1 +{
2 + lib,
3 + config,
4 + pkgs,
5 + ...
6 }:
7
8 let
@@ -21,112 +22,115 @@ let
22 '';
23 in
24 {
24 - options.services.backup = with lib; with types; {
25 - user = mkOption {
26 - type = str;
27 - description = ''
28 - Username for the SSH remote host.
29 - '';
30 - };
25 + options.services.backup =
26 + with lib;
27 + with types;
28 + {
29 + user = mkOption {
30 + type = str;
31 + description = ''
32 + Username for the SSH remote host.
33 + '';
34 + };
35
32 - host = mkOption {
33 - type = str;
34 - description = ''
35 - Hostname of the SSH remote host.
36 - '';
37 - };
36 + host = mkOption {
37 + type = str;
38 + description = ''
39 + Hostname of the SSH remote host.
40 + '';
41 + };
42
39 - hostPublicKey = mkOption {
40 - type = str;
41 - example = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
42 - description = ''
43 - Public SSH host key of the remote host. Discoverable using e.g. `ssh-keyscan`.
44 - '';
45 - };
43 + hostPublicKey = mkOption {
44 + type = str;
45 + example = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
46 + description = ''
47 + Public SSH host key of the remote host. Discoverable using e.g. `ssh-keyscan`.
48 + '';
49 + };
50
47 - port = mkOption {
48 - type = port;
49 - default = 22;
50 - description = ''
51 - Port of the SSH remote host.
52 - '';
53 - apply = toString;
54 - };
51 + port = mkOption {
52 + type = port;
53 + default = 22;
54 + description = ''
55 + Port of the SSH remote host.
56 + '';
57 + apply = toString;
58 + };
59
56 - sshKey = mkOption {
57 - type = path;
58 - example = "/var/keys/ssh-key";
59 - description = ''
60 - Path to the SSH key required to access the remote host.
61 - '';
62 - };
60 + sshKey = mkOption {
61 + type = path;
62 + example = "/var/keys/ssh-key";
63 + description = ''
64 + Path to the SSH key required to access the remote host.
65 + '';
66 + };
67
64 - secretPath = mkOption {
65 - type = path;
66 - example = "/var/keys/borg-secret";
67 - description = ''
68 - Path to the secret used to encrypt backups in the repository.
69 - '';
70 - };
68 + secretPath = mkOption {
69 + type = path;
70 + example = "/var/keys/borg-secret";
71 + description = ''
72 + Path to the secret used to encrypt backups in the repository.
73 + '';
74 + };
75
72 - quota = mkOption {
73 - type = nullOr str;
74 - default = null;
75 - example = "90G";
76 - description = ''
77 - Quota for the borg repository. Useful to prevent the target disk from running full and ensuring borg keeps some space to work with.
78 - '';
79 - };
76 + quota = mkOption {
77 + type = nullOr str;
78 + default = null;
79 + example = "90G";
80 + description = ''
81 + Quota for the borg repository. Useful to prevent the target disk from running full and ensuring borg keeps some space to work with.
82 + '';
83 + };
84
81 - includes = mkOption {
82 - type = listOf path;
83 - default = [];
84 - description = ''
85 - Paths to include in the backup.
86 - '';
87 - };
88 - includesZfsDatasets = mkOption {
89 - type = listOf str;
90 - default = [];
91 - description = ''
92 - ZFS datasets referenced by mountpoint to snapshot and include
93 - '';
94 - };
85 + includes = mkOption {
86 + type = listOf path;
87 + default = [ ];
88 + description = ''
89 + Paths to include in the backup.
90 + '';
91 + };
92 + includesZfsDatasets = mkOption {
93 + type = listOf str;
94 + default = [ ];
95 + description = ''
96 + ZFS datasets referenced by mountpoint to snapshot and include
97 + '';
98 + };
99
96 - excludes = mkOption {
97 - type = listOf path;
98 - default = [];
99 - description = ''
100 - Paths to exclude in the backup.
101 - '';
102 - };
100 + excludes = mkOption {
101 + type = listOf path;
102 + default = [ ];
103 + description = ''
104 + Paths to exclude in the backup.
105 + '';
106 + };
107
104 - preHook = mkOption {
105 - type = lines;
106 - default = "";
107 - description = ''
108 - Shell commands to run before the backup.
109 - '';
110 - };
108 + preHook = mkOption {
109 + type = lines;
110 + default = "";
111 + description = ''
112 + Shell commands to run before the backup.
113 + '';
114 + };
115
112 - postHook = mkOption {
113 - type = lines;
114 - default = "";
115 - description = ''
116 - Shell commands to run after the backup.
117 - '';
118 - };
116 + postHook = mkOption {
117 + type = lines;
118 + default = "";
119 + description = ''
120 + Shell commands to run after the backup.
121 + '';
122 + };
123
120 - wantedUnits = mkOption {
121 - type = listOf str;
122 - default = [];
123 - description = ''
124 - List of units to require before starting the backup.
125 - '';
124 + wantedUnits = mkOption {
125 + type = listOf str;
126 + default = [ ];
127 + description = ''
128 + List of units to require before starting the backup.
129 + '';
130 + };
131 };
127 - };
132
129 - config = lib.mkIf (cfg.includes != [] || cfg.includesZfsDatasets != []) {
133 + config = lib.mkIf (cfg.includes != [ ] || cfg.includesZfsDatasets != [ ]) {
134 programs.ssh.knownHosts."${if cfg.port != 22 then "[${cfg.host}]:${cfg.port}" else cfg.host}" = {
135 publicKey = "${cfg.hostPublicKey}";
136 };
@@ -135,7 +139,7 @@ in
139 wants = cfg.wantedUnits;
140 after = cfg.wantedUnits;
141
138 - path = lib.optionals (cfg.includesZfsDatasets != []) [
142 + path = lib.optionals (cfg.includesZfsDatasets != [ ]) [
143 config.boot.zfs.package
144 pkgs.util-linux
145 ];
@@ -163,8 +167,7 @@ in
167 };
168
169 # What to backup
166 - paths = cfg.includes ++
167 - (map (mp: "${mp}/.zfs/snapshot/borg") cfg.includesZfsDatasets);
170 + paths = cfg.includes ++ (map (mp: "${mp}/.zfs/snapshot/borg") cfg.includesZfsDatasets);
171 exclude = cfg.excludes;
172
173 # Where to backup it to
modules/common.nix
+9 -12
@@ -3,16 +3,13 @@
3 with lib;
4
5 {
6 - imports = [
7 - ./backup.nix
8 - ];
6 + imports = [ ./backup.nix ];
7
8 time.timeZone = "UTC";
9
10 users.mutableUsers = false;
11
14 - users.extraUsers.root.openssh.authorizedKeys.keys =
15 - with import ../ssh-keys.nix; infra-core;
12 + users.extraUsers.root.openssh.authorizedKeys.keys = with import ../ssh-keys.nix; infra-core;
13
14 nix = {
15 settings = {
@@ -24,14 +21,14 @@ with lib;
21 };
22 };
23
27 - environment.systemPackages =
28 - [ pkgs.emacs
29 - pkgs.git
30 - pkgs.gdb
24 + environment.systemPackages = [
25 + pkgs.emacs
26 + pkgs.git
27 + pkgs.gdb
28
32 - # jq is required by numtide/terraform-deploy-nixos-flakes.
33 - pkgs.jq
34 - ];
29 + # jq is required by numtide/terraform-deploy-nixos-flakes.
30 + pkgs.jq
31 + ];
32
33 services.openssh.enable = true;
34 }
modules/hydra-mirror.nix
+50 -49
@@ -1,48 +1,53 @@
1 -{ config, lib, pkgs, ... }:
1 +{
2 + config,
3 + lib,
4 + pkgs,
5 + ...
6 +}:
7
8 let
9 channels = (import ../channels.nix).channels-with-urls;
10
11 orderLib = import ../lib/service-order.nix { inherit lib; };
12
8 - makeUpdateChannel = channelName: mainJob:
9 - {
10 - name = "update-${channelName}";
11 - value = {
12 - description = "Update Channel ${channelName}";
13 - path = with pkgs; [ git nixos-channel-scripts ];
14 - script =
15 - ''
16 - # Hardcoded in channel scripts.
17 - dir=/home/hydra-mirror/nixpkgs-channels
18 - if ! [[ -e $dir ]]; then
19 - git clone --bare https://github.com/NixOS/nixpkgs.git $dir
20 - fi
21 - GIT_DIR=$dir git config credential.helper 'store --file=${config.age.secrets.hydra-mirror-git-credentials.path}'
22 - GIT_DIR=$dir git config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
13 + makeUpdateChannel = channelName: mainJob: {
14 + name = "update-${channelName}";
15 + value = {
16 + description = "Update Channel ${channelName}";
17 + path = with pkgs; [
18 + git
19 + nixos-channel-scripts
20 + ];
21 + script = ''
22 + # Hardcoded in channel scripts.
23 + dir=/home/hydra-mirror/nixpkgs-channels
24 + if ! [[ -e $dir ]]; then
25 + git clone --bare https://github.com/NixOS/nixpkgs.git $dir
26 + fi
27 + GIT_DIR=$dir git config credential.helper 'store --file=${config.age.secrets.hydra-mirror-git-credentials.path}'
28 + GIT_DIR=$dir git config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
29
24 - # FIXME: use IAM role.
25 - export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
26 - export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
27 - exec mirror-nixos-branch ${channelName} https://hydra.nixos.org/job/${mainJob}/latest-finished
28 - '';
29 - serviceConfig = {
30 - Type = "oneshot";
31 - RemainAfterExit = false;
32 - User = "hydra-mirror";
33 - # Allow the unit to use 80% of the system's RAM and 100% of the system's swap
34 - MemoryHigh = "80%";
35 - };
36 - unitConfig = {
37 - After = [ "networking.target" ];
38 - };
39 - environment.TMPDIR = "/home/hydra-mirror/scratch";
40 - environment.GC_INITIAL_HEAP_SIZE = "4g";
30 + # FIXME: use IAM role.
31 + export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
32 + export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
33 + exec mirror-nixos-branch ${channelName} https://hydra.nixos.org/job/${mainJob}/latest-finished
34 + '';
35 + serviceConfig = {
36 + Type = "oneshot";
37 + RemainAfterExit = false;
38 + User = "hydra-mirror";
39 + # Allow the unit to use 80% of the system's RAM and 100% of the system's swap
40 + MemoryHigh = "80%";
41 + };
42 + unitConfig = {
43 + After = [ "networking.target" ];
44 };
45 + environment.TMPDIR = "/home/hydra-mirror/scratch";
46 + environment.GC_INITIAL_HEAP_SIZE = "4g";
47 };
48 + };
49
44 - updateJobs = orderLib.mkOrderedChain
45 - (lib.mapAttrsToList makeUpdateChannel channels);
50 + updateJobs = orderLib.mkOrderedChain (lib.mapAttrsToList makeUpdateChannel channels);
51
52 in
53
@@ -57,15 +62,15 @@ in
62 owner = "hydra-mirror";
63 };
64
60 - users.users.hydra-mirror =
61 - { description = "Channel mirroring user";
62 - home = "/home/hydra-mirror";
63 - createHome = true;
64 - isSystemUser = true;
65 - group = "hydra-mirror";
66 - };
65 + users.users.hydra-mirror = {
66 + description = "Channel mirroring user";
67 + home = "/home/hydra-mirror";
68 + createHome = true;
69 + isSystemUser = true;
70 + group = "hydra-mirror";
71 + };
72
68 - users.groups.hydra-mirror = {};
73 + users.groups.hydra-mirror = { };
74
75 systemd.tmpfiles.rules = [
76 ''
@@ -79,12 +84,8 @@ in
84 "update-all-channels" = {
85 description = "Start all channel updates.";
86 unitConfig = {
82 - After = builtins.map
83 - (service: "${service.name}.service")
84 - updateJobs;
85 - Wants = builtins.map
86 - (service: "${service.name}.service")
87 - updateJobs;
87 + After = builtins.map (service: "${service.name}.service") updateJobs;
88 + Wants = builtins.map (service: "${service.name}.service") updateJobs;
89 };
90 script = "true";
91 };
modules/netboot-serve.nix
+10 -3
@@ -7,8 +7,12 @@ let
7 # re: https://github.com/ipxe/ipxe/pull/116
8 # re: https://github.com/ipxe/ipxe/pull/112
9 # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
10 - legoFlags = [ "--preferred-chain" "ISRG Root X1" ];
11 -in {
10 + legoFlags = [
11 + "--preferred-chain"
12 + "ISRG Root X1"
13 + ];
14 +in
15 +{
16 services.nix-netboot-serve = {
17 enable = true;
18 listen = "127.0.0.1:${toString port}";
@@ -36,5 +40,8 @@ in {
40 };
41 };
42
39 - networking.firewall.allowedTCPPorts = [ 80 443 ];
43 + networking.firewall.allowedTCPPorts = [
44 + 80
45 + 443
46 + ];
47 }
modules/prometheus/default.nix
+6 -5
@@ -1,7 +1,7 @@
1 { pkgs, ... }:
2
3 let
4 - prometheus-nixos-exporter = pkgs.callPackage ./nixos-exporter {};
4 + prometheus-nixos-exporter = pkgs.callPackage ./nixos-exporter { };
5 in
6 {
7 networking.firewall.allowedTCPPorts = [
@@ -11,9 +11,7 @@ in
11 services.prometheus.exporters.node = {
12 enable = true;
13 enabledCollectors = [ "systemd" ];
14 - extraFlags = [
15 - "--collector.textfile.directory=/var/lib/prometheus-node-exporter-text-files"
16 - ];
14 + extraFlags = [ "--collector.textfile.directory=/var/lib/prometheus-node-exporter-text-files" ];
15 };
16
17 system.activationScripts.node-exporter-system-version = ''
@@ -26,7 +24,10 @@ in
24 systemd.services.prometheus-nixos-exporter = {
25 wantedBy = [ "multi-user.target" ];
26 after = [ "network.target" ];
29 - path= [ pkgs.nix pkgs.bash ];
27 + path = [
28 + pkgs.nix
29 + pkgs.bash
30 + ];
31 serviceConfig = {
32 Restart = "always";
33 RestartSec = "60s";
modules/prometheus/nixos-exporter/default.nix
+1 -3
@@ -9,9 +9,7 @@ buildPythonApplication {
9
10 src = ./.;
11
12 - nativeBuildInputs = [
13 - setuptools
14 - ];
12 + nativeBuildInputs = [ setuptools ];
13
14 propagatedBuildInputs = [
15 packaging
modules/prometheus/system-version-exporter.sh
-1
@@ -9,4 +9,3 @@ readonly DEPLOY_TIMESTAMP="$(stat -c '%y' "${CURRENT_SYSTEM_PROFILE}" | cut -c '
9 readonly DEPLOY_SECONDS="$(stat -c '%Y' "${CURRENT_SYSTEM_PROFILE}")"
10
11 echo "node_deployed{version=\"${VERSION}\",date=\"${DEPLOY_TIMESTAMP}\"} ${DEPLOY_SECONDS}"
12 -
modules/rfc39.nix
+52 -46
@@ -1,8 +1,12 @@
1 # This module fetches nixpkgs master and syncs the GitHub maintainer team.
2 { config, pkgs, ... }:
3 let
4 - rfc39Secret = f: { file = f; owner = "rfc39"; };
5 -in {
4 + rfc39Secret = f: {
5 + file = f;
6 + owner = "rfc39";
7 + };
8 +in
9 +{
10 age.secrets.rfc39-credentials = rfc39Secret ../build/secrets/rfc39-credentials.age;
11 age.secrets.rfc39-github = rfc39Secret ../build/secrets/rfc39-github.age;
12 age.secrets.rfc39-record-push = rfc39Secret ../build/secrets/rfc39-record-push.age;
@@ -14,64 +18,66 @@ in {
18 isSystemUser = true;
19 group = "rfc39";
20 };
17 - users.groups.rfc39 = {};
18 -
21 + users.groups.rfc39 = { };
22
20 - programs.ssh.knownHosts."github.com".publicKey =
21 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
23 + programs.ssh.knownHosts."github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
24
25 systemd.services.rfc39-sync = {
26 description = "Sync the Maintainer Team ";
25 - path = [ config.nix.package pkgs.git pkgs.openssh pkgs.rfc39 ];
27 + path = [
28 + config.nix.package
29 + pkgs.git
30 + pkgs.openssh
31 + pkgs.rfc39
32 + ];
33 startAt = "*:0/30";
34 serviceConfig.User = "rfc39";
35 serviceConfig.Group = "keys";
36 serviceConfig.Type = "oneshot";
37 serviceConfig.PrivateTmp = true;
31 - script =
32 - ''
33 - set -eux
38 + script = ''
39 + set -eux
40
35 - export GIT_SSH_COMMAND='ssh -i ${config.age.secrets.rfc39-record-push.path}'
36 - export GIT_AUTHOR_NAME="rfc39"
37 - export GIT_AUTHOR_EMAIL="rfc39@eris"
38 - export GIT_COMMITTER_NAME="rfc39"
39 - export GIT_COMMITTER_EMAIL="rfc39@eris"
41 + export GIT_SSH_COMMAND='ssh -i ${config.age.secrets.rfc39-record-push.path}'
42 + export GIT_AUTHOR_NAME="rfc39"
43 + export GIT_AUTHOR_EMAIL="rfc39@eris"
44 + export GIT_COMMITTER_NAME="rfc39"
45 + export GIT_COMMITTER_EMAIL="rfc39@eris"
46
41 - recordsdir=$HOME/rfc39-record
42 - if ! [[ -e "$recordsdir" ]]; then
43 - git clone git@github.com:NixOS/rfc39-record.git "$recordsdir"
44 - fi
45 - cd "$recordsdir"
46 - git fetch origin --no-auto-maintenance
47 - git checkout main
48 - git reset --hard origin/main
49 - git maintenance run --auto
47 + recordsdir=$HOME/rfc39-record
48 + if ! [[ -e "$recordsdir" ]]; then
49 + git clone git@github.com:NixOS/rfc39-record.git "$recordsdir"
50 + fi
51 + cd "$recordsdir"
52 + git fetch origin --no-auto-maintenance
53 + git checkout main
54 + git reset --hard origin/main
55 + git maintenance run --auto
56
51 - nixpkgsdir=$HOME/nixpkgs
52 - if ! [[ -e $nixpkgsdir ]]; then
53 - git clone https://github.com/NixOS/nixpkgs.git $nixpkgsdir
54 - fi
55 - cd $nixpkgsdir
56 - git fetch origin --no-auto-maintenance
57 - git checkout origin/master
58 - git maintenance run --auto
57 + nixpkgsdir=$HOME/nixpkgs
58 + if ! [[ -e $nixpkgsdir ]]; then
59 + git clone https://github.com/NixOS/nixpkgs.git $nixpkgsdir
60 + fi
61 + cd $nixpkgsdir
62 + git fetch origin --no-auto-maintenance
63 + git checkout origin/master
64 + git maintenance run --auto
65
60 - rfc39 \
61 - --dump-metrics --metrics-delay=240 --metrics-addr=0.0.0.0:9190 \
62 - --credentials ${config.age.secrets.rfc39-credentials.path} \
63 - --maintainers ./maintainers/maintainer-list.nix \
64 - sync-team NixOS 3345117 --limit 50 \
65 - --invited-list "$recordsdir/invitations"
66 + rfc39 \
67 + --dump-metrics --metrics-delay=240 --metrics-addr=0.0.0.0:9190 \
68 + --credentials ${config.age.secrets.rfc39-credentials.path} \
69 + --maintainers ./maintainers/maintainer-list.nix \
70 + sync-team NixOS 3345117 --limit 50 \
71 + --invited-list "$recordsdir/invitations"
72
67 - cd "$recordsdir"
73 + cd "$recordsdir"
74
69 - if ! git diff --quiet; then
70 - git add .
71 - git commit -m "Automated team sync results."
72 - git push origin main
73 - fi
74 - '';
75 - };
75 + if ! git diff --quiet; then
76 + git add .
77 + git commit -m "Automated team sync results."
78 + git push origin main
79 + fi
80 + '';
81 + };
82
83 }
modules/tarball-mirror.nix
+48 -39
@@ -2,7 +2,12 @@
2 # release.nix to the content-addressed tarball cache at
3 # tarballs.nixos.org.
4
5 -{ config, lib, pkgs, ... }:
5 +{
6 + config,
7 + lib,
8 + pkgs,
9 + ...
10 +}:
11
12 with lib;
13
@@ -11,12 +16,13 @@ let
16 # We take the current pirmary stable release.
17 inherit (import ../channels.nix) channels;
18 branches = lib.filter (p: p != null) (
14 - lib.mapAttrsToList
15 - (name: v: if v.variant or null == "primary" && v.status or null == "stable"
16 - then name else null)
17 - (import ../channels.nix).channels
19 + lib.mapAttrsToList (
20 + name: v: if v.variant or null == "primary" && v.status or null == "stable" then name else null
21 + ) (import ../channels.nix).channels
22 );
19 - branch = assert lib.length branches == 1; head branches;
23 + branch =
24 + assert lib.length branches == 1;
25 + head branches;
26 in
27
28 {
@@ -25,40 +31,43 @@ in
31 owner = "tarball-mirror";
32 };
33
28 - users.users.tarball-mirror =
29 - { description = "Nixpkgs tarball mirroring user";
30 - home = "/home/tarball-mirror";
31 - createHome = true;
32 - isSystemUser = true;
33 - group = "tarball-mirror";
34 - };
34 + users.users.tarball-mirror = {
35 + description = "Nixpkgs tarball mirroring user";
36 + home = "/home/tarball-mirror";
37 + createHome = true;
38 + isSystemUser = true;
39 + group = "tarball-mirror";
40 + };
41
36 - users.groups.tarball-mirror = {};
42 + users.groups.tarball-mirror = { };
43
38 - systemd.services.mirror-tarballs =
39 - { description = "Mirror Nixpkgs Tarballs";
40 - path = [ config.nix.package pkgs.git pkgs.bash ];
41 - environment.NIX_REMOTE = "daemon";
42 - serviceConfig.User = "tarball-mirror";
43 - serviceConfig.Type = "oneshot";
44 - serviceConfig.PrivateTmp = true;
45 - script =
46 - ''
47 - dir=/home/tarball-mirror/nixpkgs
48 - if ! [[ -e $dir ]]; then
49 - git clone https://github.com/NixOS/nixpkgs.git $dir
50 - fi
51 - cd $dir
52 - git remote update origin
53 - git checkout origin/${branch}
54 - # FIXME: use IAM role.
55 - export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path})
56 - export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path})
57 - NIX_PATH=nixpkgs=. ./maintainers/scripts/copy-tarballs.pl \
58 - --expr 'import <nixpkgs/maintainers/scripts/all-tarballs.nix>' \
59 - --exclude 'registry.npmjs.org|mirror://kde|mirror://xorg|mirror://kernel|mirror://hackage|mirror://gnome|mirror://apache|mirror://mozilla|pypi.python.org'
60 - '';
61 - startAt = "05:30";
62 - };
44 + systemd.services.mirror-tarballs = {
45 + description = "Mirror Nixpkgs Tarballs";
46 + path = [
47 + config.nix.package
48 + pkgs.git
49 + pkgs.bash
50 + ];
51 + environment.NIX_REMOTE = "daemon";
52 + serviceConfig.User = "tarball-mirror";
53 + serviceConfig.Type = "oneshot";
54 + serviceConfig.PrivateTmp = true;
55 + script = ''
56 + dir=/home/tarball-mirror/nixpkgs
57 + if ! [[ -e $dir ]]; then
58 + git clone https://github.com/NixOS/nixpkgs.git $dir
59 + fi
60 + cd $dir
61 + git remote update origin
62 + git checkout origin/${branch}
63 + # FIXME: use IAM role.
64 + export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path})
65 + export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path})
66 + NIX_PATH=nixpkgs=. ./maintainers/scripts/copy-tarballs.pl \
67 + --expr 'import <nixpkgs/maintainers/scripts/all-tarballs.nix>' \
68 + --exclude 'registry.npmjs.org|mirror://kde|mirror://xorg|mirror://kernel|mirror://hackage|mirror://gnome|mirror://apache|mirror://mozilla|pypi.python.org'
69 + '';
70 + startAt = "05:30";
71 + };
72
73 }
modules/wireguard.nix
+9 -7
@@ -2,11 +2,11 @@
2 let
3 inherit (builtins.fromTOML (builtins.readFile ./wireguard-hosts.toml)) network hosts;
4
5 - peerable = selfHost: lib.filterAttrs (hostname: hostcfg:
6 - (hostname != selfHost)
7 - && (hostcfg ? "publicKey")
8 - ) hosts;
9 -in lib.mkMerge [
5 + peerable =
6 + selfHost:
7 + lib.filterAttrs (hostname: hostcfg: (hostname != selfHost) && (hostcfg ? "publicKey")) hosts;
8 +in
9 +lib.mkMerge [
10 (lib.mkIf (hosts."${config.networking.hostName}" ? "port") {
11 networking.firewall.allowedUDPPorts = [ hosts."${config.networking.hostName}".port ];
12 })
@@ -17,11 +17,13 @@ in lib.mkMerge [
17 generatePrivateKeyFile = true;
18 listenPort = hosts."${config.networking.hostName}".port or null;
19
20 - peers = lib.mapAttrsToList (_hostname: hostcfg:
20 + peers = lib.mapAttrsToList (
21 + _hostname: hostcfg:
22 {
23 inherit (hostcfg) publicKey;
24 allowedIPs = [ "${hostcfg.ip}/32" ];
24 - } // (lib.optionalAttrs (hostcfg ? "endpoint") {
25 + }
26 + // (lib.optionalAttrs (hostcfg ? "endpoint") {
27 endpoint = "${hostcfg.endpoint}:${toString hostcfg.port}";
28 persistentKeepalive = 60;
29 })
non-critical-infra/flake.nix
+51 -32
@@ -37,51 +37,70 @@
37 };
38 };
39
40 - outputs = { self, nixpkgs, flake-utils, colmena, disko, first-time-contribution-tagger, sops-nix, ... }@inputs:
40 + outputs =
41 + {
42 + self,
43 + nixpkgs,
44 + flake-utils,
45 + colmena,
46 + disko,
47 + first-time-contribution-tagger,
48 + sops-nix,
49 + ...
50 + }@inputs:
51 let
42 - importConfig = path: (lib.mapAttrs (name: _value: import (path + "/${name}/default.nix")) (lib.filterAttrs (_: v: v == "directory") (builtins.readDir path)));
52 + importConfig =
53 + path:
54 + (lib.mapAttrs (name: _value: import (path + "/${name}/default.nix")) (
55 + lib.filterAttrs (_: v: v == "directory") (builtins.readDir path)
56 + ));
57 inherit (nixpkgs) lib;
58 in
59 {
60
47 - nixosConfigurations = builtins.mapAttrs
48 - (_name: value: nixpkgs.lib.nixosSystem {
61 + nixosConfigurations = builtins.mapAttrs (
62 + _name: value:
63 + nixpkgs.lib.nixosSystem {
64 inherit lib;
65 system = "x86_64-linux";
66 specialArgs = {
67 inherit inputs;
68 };
54 - modules = [ value disko.nixosModules.disko first-time-contribution-tagger.nixosModule sops-nix.nixosModules.sops ];
69 + modules = [
70 + value
71 + disko.nixosModules.disko
72 + first-time-contribution-tagger.nixosModule
73 + sops-nix.nixosModules.sops
74 + ];
75 extraModules = [ inputs.colmena.nixosModules.deploymentOptions ];
76
57 - })
58 - (importConfig ./hosts);
77 + }
78 + ) (importConfig ./hosts);
79
60 - colmena =
61 - {
62 - meta = {
63 - nixpkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
64 - nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
65 - nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs) self.nixosConfigurations;
66 - specialArgs.lib = lib;
67 - };
68 - } // builtins.mapAttrs
69 - (_: v: {
70 - imports = v._module.args.modules;
71 - })
72 - self.nixosConfigurations;
80 + colmena = {
81 + meta = {
82 + nixpkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
83 + nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
84 + nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs) self.nixosConfigurations;
85 + specialArgs.lib = lib;
86 + };
87 + } // builtins.mapAttrs (_: v: { imports = v._module.args.modules; }) self.nixosConfigurations;
88
74 - } // flake-utils.lib.eachDefaultSystem (system:
75 - let pkgs = nixpkgs.legacyPackages.${system};
76 - in {
77 - devShell =
78 - pkgs.mkShell {
79 - buildInputs = with pkgs; [
80 - colmena.packages.${system}.colmena
81 - sops
82 - ssh-to-age
83 - ];
84 - };
85 - });
89 + }
90 + // flake-utils.lib.eachDefaultSystem (
91 + system:
92 + let
93 + pkgs = nixpkgs.legacyPackages.${system};
94 + in
95 + {
96 + devShell = pkgs.mkShell {
97 + buildInputs = with pkgs; [
98 + colmena.packages.${system}.colmena
99 + sops
100 + ssh-to-age
101 + ];
102 + };
103 + }
104 + );
105
106 }
non-critical-infra/hosts/caliban.nixos.org/default.nix
+25 -18
@@ -1,26 +1,31 @@
1 { config, inputs, ... }:
2
3 {
4 - imports =
5 - [
6 - ./hardware.nix
7 - inputs.srvos.nixosModules.server
8 - inputs.srvos.nixosModules.hardware-hetzner-online-amd
9 - ../../modules/common.nix
10 - ../../modules/first-time-contribution-tagger.nix
11 - ../../modules/backup.nix
12 - ../../modules/element-web.nix
13 - ../../modules/matrix-synapse.nix
14 - ../../modules/owncast.nix
15 - ../../modules/vaultwarden.nix
16 - ./limesurvey-tmp.nix
17 - ];
4 + imports = [
5 + ./hardware.nix
6 + inputs.srvos.nixosModules.server
7 + inputs.srvos.nixosModules.hardware-hetzner-online-amd
8 + ../../modules/common.nix
9 + ../../modules/first-time-contribution-tagger.nix
10 + ../../modules/backup.nix
11 + ../../modules/element-web.nix
12 + ../../modules/matrix-synapse.nix
13 + ../../modules/owncast.nix
14 + ../../modules/vaultwarden.nix
15 + ./limesurvey-tmp.nix
16 + ];
17
18 # Bootloader.
19 boot.loader.grub.enable = true;
20 boot.loader.grub.mirroredBoots = [
22 - { path = "/boot-1"; devices = [ "/dev/disk/by-id/nvme-SAMSUNG_MZQL23T8HCLS-00A07_S64HNJ0T508051" ]; }
23 - { path = "/boot-2"; devices = [ "/dev/disk/by-id/nvme-SAMSUNG_MZQL23T8HCLS-00A07_S64HNJ0T508053" ]; }
21 + {
22 + path = "/boot-1";
23 + devices = [ "/dev/disk/by-id/nvme-SAMSUNG_MZQL23T8HCLS-00A07_S64HNJ0T508051" ];
24 + }
25 + {
26 + path = "/boot-2";
27 + devices = [ "/dev/disk/by-id/nvme-SAMSUNG_MZQL23T8HCLS-00A07_S64HNJ0T508053" ];
28 + }
29 ];
30 boot.loader.grub.useOSProber = true;
31
@@ -32,7 +37,10 @@
37
38 disko.devices = import ./disko.nix;
39
35 - networking.firewall.allowedTCPPorts = [ 80 443 ];
40 + networking.firewall.allowedTCPPorts = [
41 + 80
42 + 443
43 + ];
44 networking.firewall.allowedUDPPorts = [ ];
45
46 systemd.network.networks."10-uplink".networkConfig.Address = "2a01:4f9:5a:186c::2";
@@ -68,4 +76,3 @@
76 system.stateVersion = "23.05";
77
78 }
71 -
non-critical-infra/hosts/caliban.nixos.org/disko.nix
-2
@@ -76,5 +76,3 @@ in
76 };
77 };
78 }
79 -
80 -
non-critical-infra/hosts/caliban.nixos.org/hardware.nix
-1
@@ -11,4 +11,3 @@
11 nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
12 hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
13 }
14 -
non-critical-infra/hosts/caliban.nixos.org/limesurvey-tmp.nix
-1
@@ -27,5 +27,4 @@
27 sopsFile = ../../secrets/limesurvey-encryption-nonce.caliban;
28 };
29
30 -
30 }
non-critical-infra/hosts/umbriel.nixos.org/default.nix
+13 -13
@@ -1,14 +1,13 @@
1 { inputs, lib, ... }:
2
3 {
4 - imports =
5 - [
6 - ./hardware.nix
7 - inputs.srvos.nixosModules.server
8 - inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
9 - ../../modules/common.nix
10 - ../../modules/mjolnir.nix
11 - ];
4 + imports = [
5 + ./hardware.nix
6 + inputs.srvos.nixosModules.server
7 + inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
8 + ../../modules/common.nix
9 + ../../modules/mjolnir.nix
10 + ];
11
12 # Bootloader.
13 boot.loader.systemd-boot.enable = true;
@@ -36,14 +35,15 @@
35 ];
36 routes = [
37 { routeConfig.Gateway = "fe80::1"; }
39 - { routeConfig = {
40 - Gateway = "172.31.1.1";
41 - GatewayOnLink = true;
42 - }; }
38 + {
39 + routeConfig = {
40 + Gateway = "172.31.1.1";
41 + GatewayOnLink = true;
42 + };
43 + }
44 ];
45 linkConfig.RequiredForOnline = "routable";
46 };
47
48 system.stateVersion = "23.05";
49 }
49 -
non-critical-infra/hosts/umbriel.nixos.org/disko.nix
-1
@@ -59,4 +59,3 @@
59 };
60 };
61 }
62 -
non-critical-infra/hosts/umbriel.nixos.org/hardware.nix
+6 -2
@@ -2,7 +2,12 @@
2
3 {
4
5 - boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" "sr_mod" ];
5 + boot.initrd.availableKernelModules = [
6 + "xhci_pci"
7 + "virtio_pci"
8 + "usbhid"
9 + "sr_mod"
10 + ];
11 boot.initrd.kernelModules = [ "virtio_gpu" ];
12 boot.kernelModules = [ ];
13 boot.extraModulePackages = [ ];
@@ -11,4 +16,3 @@
16
17 nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
18 }
14 -
non-critical-infra/modules/backup.nix
+103 -100
@@ -1,7 +1,8 @@
1 -{ lib
2 -, config
3 -, pkgs
4 -, ...
1 +{
2 + lib,
3 + config,
4 + pkgs,
5 + ...
6 }:
7
8 let
@@ -21,112 +22,115 @@ let
22 '';
23 in
24 {
24 - options.services.backup = with lib; with types; {
25 - user = mkOption {
26 - type = str;
27 - description = ''
28 - Username for the SSH remote host.
29 - '';
30 - };
25 + options.services.backup =
26 + with lib;
27 + with types;
28 + {
29 + user = mkOption {
30 + type = str;
31 + description = ''
32 + Username for the SSH remote host.
33 + '';
34 + };
35
32 - host = mkOption {
33 - type = str;
34 - description = ''
35 - Hostname of the SSH remote host.
36 - '';
37 - };
36 + host = mkOption {
37 + type = str;
38 + description = ''
39 + Hostname of the SSH remote host.
40 + '';
41 + };
42
39 - hostPublicKey = mkOption {
40 - type = str;
41 - example = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
42 - description = ''
43 - Public SSH host key of the remote host. Discoverable using e.g. `ssh-keyscan`.
44 - '';
45 - };
43 + hostPublicKey = mkOption {
44 + type = str;
45 + example = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
46 + description = ''
47 + Public SSH host key of the remote host. Discoverable using e.g. `ssh-keyscan`.
48 + '';
49 + };
50
47 - port = mkOption {
48 - type = port;
49 - default = 22;
50 - description = ''
51 - Port of the SSH remote host.
52 - '';
53 - apply = toString;
54 - };
51 + port = mkOption {
52 + type = port;
53 + default = 22;
54 + description = ''
55 + Port of the SSH remote host.
56 + '';
57 + apply = toString;
58 + };
59
56 - sshKey = mkOption {
57 - type = path;
58 - example = "/var/keys/ssh-key";
59 - description = ''
60 - Path to the SSH key required to access the remote host.
61 - '';
62 - };
60 + sshKey = mkOption {
61 + type = path;
62 + example = "/var/keys/ssh-key";
63 + description = ''
64 + Path to the SSH key required to access the remote host.
65 + '';
66 + };
67
64 - secretPath = mkOption {
65 - type = path;
66 - example = "/var/keys/borg-secret";
67 - description = ''
68 - Path to the secret used to encrypt backups in the repository.
69 - '';
70 - };
68 + secretPath = mkOption {
69 + type = path;
70 + example = "/var/keys/borg-secret";
71 + description = ''
72 + Path to the secret used to encrypt backups in the repository.
73 + '';
74 + };
75
72 - quota = mkOption {
73 - type = nullOr str;
74 - default = null;
75 - example = "90G";
76 - description = ''
77 - Quota for the borg repository. Useful to prevent the target disk from running full and ensuring borg keeps some space to work with.
78 - '';
79 - };
76 + quota = mkOption {
77 + type = nullOr str;
78 + default = null;
79 + example = "90G";
80 + description = ''
81 + Quota for the borg repository. Useful to prevent the target disk from running full and ensuring borg keeps some space to work with.
82 + '';
83 + };
84
81 - includes = mkOption {
82 - type = listOf path;
83 - default = [];
84 - description = ''
85 - Paths to include in the backup.
86 - '';
87 - };
88 - includesZfsDatasets = mkOption {
89 - type = listOf str;
90 - default = [];
91 - description = ''
92 - ZFS datasets referenced by mountpoint to snapshot and include
93 - '';
94 - };
85 + includes = mkOption {
86 + type = listOf path;
87 + default = [ ];
88 + description = ''
89 + Paths to include in the backup.
90 + '';
91 + };
92 + includesZfsDatasets = mkOption {
93 + type = listOf str;
94 + default = [ ];
95 + description = ''
96 + ZFS datasets referenced by mountpoint to snapshot and include
97 + '';
98 + };
99
96 - excludes = mkOption {
97 - type = listOf path;
98 - default = [];
99 - description = ''
100 - Paths to exclude in the backup.
101 - '';
102 - };
100 + excludes = mkOption {
101 + type = listOf path;
102 + default = [ ];
103 + description = ''
104 + Paths to exclude in the backup.
105 + '';
106 + };
107
104 - preHook = mkOption {
105 - type = lines;
106 - default = "";
107 - description = ''
108 - Shell commands to run before the backup.
109 - '';
110 - };
108 + preHook = mkOption {
109 + type = lines;
110 + default = "";
111 + description = ''
112 + Shell commands to run before the backup.
113 + '';
114 + };
115
112 - postHook = mkOption {
113 - type = lines;
114 - default = "";
115 - description = ''
116 - Shell commands to run after the backup.
117 - '';
118 - };
116 + postHook = mkOption {
117 + type = lines;
118 + default = "";
119 + description = ''
120 + Shell commands to run after the backup.
121 + '';
122 + };
123
120 - wantedUnits = mkOption {
121 - type = listOf str;
122 - default = [];
123 - description = ''
124 - List of units to require before starting the backup.
125 - '';
124 + wantedUnits = mkOption {
125 + type = listOf str;
126 + default = [ ];
127 + description = ''
128 + List of units to require before starting the backup.
129 + '';
130 + };
131 };
127 - };
132
129 - config = lib.mkIf (cfg.includes != [] || cfg.includesZfsDatasets != []) {
133 + config = lib.mkIf (cfg.includes != [ ] || cfg.includesZfsDatasets != [ ]) {
134 programs.ssh.knownHosts."${if cfg.port != 22 then "[${cfg.host}]:${cfg.port}" else cfg.host}" = {
135 publicKey = "${cfg.hostPublicKey}";
136 };
@@ -135,7 +139,7 @@ in
139 wants = cfg.wantedUnits;
140 after = cfg.wantedUnits;
141
138 - path = lib.optionals (cfg.includesZfsDatasets != []) [
142 + path = lib.optionals (cfg.includesZfsDatasets != [ ]) [
143 config.boot.zfs.package
144 pkgs.util-linux
145 ];
@@ -163,8 +167,7 @@ in
167 };
168
169 # What to backup
166 - paths = cfg.includes ++
167 - (map (mp: "${mp}/.zfs/snapshot/borg") cfg.includesZfsDatasets);
170 + paths = cfg.includes ++ (map (mp: "${mp}/.zfs/snapshot/borg") cfg.includesZfsDatasets);
171 exclude = cfg.excludes;
172
173 # Where to backup it to
non-critical-infra/modules/common.nix
+2 -7
@@ -1,7 +1,4 @@
1 -{
2 - pkgs,
3 - ...
4 -}:
1 +{ pkgs, ... }:
2
3 {
4 boot.initrd.systemd.enable = true;
@@ -11,9 +8,7 @@
8 systemd.services.openssh.enable = true;
9 users.users.root.openssh.authorizedKeys.keys = (import ../../ssh-keys.nix).infra;
10
14 - environment.systemPackages = with pkgs; [
15 - neovim
16 - ];
11 + environment.systemPackages = with pkgs; [ neovim ];
12
13 security.acme.acceptTerms = true;
14 security.acme.defaults.email = "webmaster@nixos.org";
non-critical-infra/modules/limesurvey.nix
+100 -27
@@ -1,9 +1,30 @@
1 -{ config, lib, pkgs, inputs, ... }:
1 +{
2 + config,
3 + lib,
4 + pkgs,
5 + inputs,
6 + ...
7 +}:
8
9 let
10
5 - inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption mkPackageOption;
6 - inherit (lib) literalExpression mapAttrs optional optionalString types recursiveUpdate;
11 + inherit (lib)
12 + mkDefault
13 + mkEnableOption
14 + mkForce
15 + mkIf
16 + mkMerge
17 + mkOption
18 + mkPackageOption
19 + ;
20 + inherit (lib)
21 + literalExpression
22 + mapAttrs
23 + optional
24 + optionalString
25 + types
26 + recursiveUpdate
27 + ;
28
29 cfg = config.services.limesurvey;
30
@@ -11,9 +32,17 @@ let
32 group = config.services.nginx.group;
33 stateDir = "/var/lib/limesurvey";
34
14 - configType = with types; oneOf [ (attrsOf configType) str int bool ] // {
15 - description = "limesurvey config type (str, int, bool or attribute set thereof)";
16 - };
35 + configType =
36 + with types;
37 + oneOf [
38 + (attrsOf configType)
39 + str
40 + int
41 + bool
42 + ]
43 + // {
44 + description = "limesurvey config type (str, int, bool or attribute set thereof)";
45 + };
46
47 limesurveyConfig = pkgs.writeText "config.php" ''
48 <?php
@@ -83,14 +112,22 @@ in
112
113 database = {
114 type = mkOption {
86 - type = types.enum [ "mysql" "pgsql" "odbc" "mssql" ];
115 + type = types.enum [
116 + "mysql"
117 + "pgsql"
118 + "odbc"
119 + "mssql"
120 + ];
121 example = "pgsql";
122 default = "mysql";
123 description = "Database engine to use.";
124 };
125
126 dbEngine = mkOption {
93 - type = types.enum [ "MyISAM" "InnoDB" ];
127 + type = types.enum [
128 + "MyISAM"
129 + "InnoDB"
130 + ];
131 default = "InnoDB";
132 description = "Database storage engine to use.";
133 };
@@ -133,10 +170,12 @@ in
170 socket = mkOption {
171 type = types.nullOr types.path;
172 default =
136 - if mysqlLocal then "/run/mysqld/mysqld.sock"
137 - else if pgsqlLocal then "/run/postgresql"
138 - else null
139 - ;
173 + if mysqlLocal then
174 + "/run/mysqld/mysqld.sock"
175 + else if pgsqlLocal then
176 + "/run/postgresql"
177 + else
178 + null;
179 defaultText = literalExpression "/run/mysqld/mysqld.sock";
180 description = "Path to the unix socket file to use for authentication.";
181 };
@@ -154,9 +193,10 @@ in
193
194 virtualHost = mkOption {
195 type = types.submodule (
157 - recursiveUpdate
158 - (import "${inputs.nixpkgs}/nixos/modules/services/web-servers/nginx/vhost-options.nix" { inherit config lib; })
159 - { }
196 + recursiveUpdate (import
197 + "${inputs.nixpkgs}/nixos/modules/services/web-servers/nginx/vhost-options.nix"
198 + { inherit config lib; }
199 + ) { }
200 );
201 example = literalExpression ''
202 {
@@ -172,7 +212,13 @@ in
212 };
213
214 poolConfig = mkOption {
175 - type = with types; attrsOf (oneOf [ str int bool ]);
215 + type =
216 + with types;
217 + attrsOf (oneOf [
218 + str
219 + int
220 + bool
221 + ]);
222 default = {
223 "pm" = "dynamic";
224 "pm.max_children" = 32;
@@ -243,10 +289,15 @@ in
289 runtimePath = "${stateDir}/tmp/runtime";
290 components = {
291 db = {
246 - connectionString = "${cfg.database.type}:dbname=${cfg.database.name};host=${if pgsqlLocal then cfg.database.socket else cfg.database.host};port=${toString cfg.database.port}" +
247 - optionalString mysqlLocal ";socket=${cfg.database.socket}";
292 + connectionString =
293 + "${cfg.database.type}:dbname=${cfg.database.name};host=${
294 + if pgsqlLocal then cfg.database.socket else cfg.database.host
295 + };port=${toString cfg.database.port}"
296 + + optionalString mysqlLocal ";socket=${cfg.database.socket}";
297 username = cfg.database.user;
249 - password = mkIf (cfg.database.passwordFile != null) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
298 + password = mkIf (
299 + cfg.database.passwordFile != null
300 + ) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
301 tablePrefix = "limesurvey_";
302 };
303 assetManager.basePath = "${stateDir}/tmp/assets";
@@ -259,7 +310,9 @@ in
310 tempdir = "${stateDir}/tmp";
311 uploaddir = "${stateDir}/upload";
312 userquestionthemerootdir = "${stateDir}/upload/themes/question";
262 - force_ssl = mkIf (cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL) "on";
313 + force_ssl = mkIf (
314 + cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL
315 + ) "on";
316 config.defaultlang = "en";
317 };
318 };
@@ -299,12 +352,21 @@ in
352 chown ${user}:${group} "${stateDir}/credentials/encryption_nonce"
353 '';
354 LoadCredential = [
302 - "encryption_key:${if cfg.encryptionKeyFile != null then cfg.encryptionKeyFile else pkgs.writeText "key" cfg.encryptionKey}"
303 - "encryption_nonce:${if cfg.encryptionNonceFile != null then cfg.encryptionNonceFile else pkgs.writeText "nonce" cfg.encryptionKey}"
355 + "encryption_key:${
356 + if cfg.encryptionKeyFile != null then
357 + cfg.encryptionKeyFile
358 + else
359 + pkgs.writeText "key" cfg.encryptionKey
360 + }"
361 + "encryption_nonce:${
362 + if cfg.encryptionNonceFile != null then
363 + cfg.encryptionNonceFile
364 + else
365 + pkgs.writeText "nonce" cfg.encryptionKey
366 + }"
367 ];
368 };
369
307 -
370 services.nginx = {
371 enable = true;
372 virtualHosts.${cfg.virtualHost.serverName} = lib.mkMerge [
@@ -354,13 +416,25 @@ in
416 Group = group;
417 Type = "oneshot";
418 LoadCredential = [
357 - "encryption_key:${if cfg.encryptionKeyFile != null then cfg.encryptionKeyFile else pkgs.writeText "key" cfg.encryptionKey}"
358 - "encryption_nonce:${if cfg.encryptionNonceFile != null then cfg.encryptionNonceFile else pkgs.writeText "nonce" cfg.encryptionKey}"
419 + "encryption_key:${
420 + if cfg.encryptionKeyFile != null then
421 + cfg.encryptionKeyFile
422 + else
423 + pkgs.writeText "key" cfg.encryptionKey
424 + }"
425 + "encryption_nonce:${
426 + if cfg.encryptionNonceFile != null then
427 + cfg.encryptionNonceFile
428 + else
429 + pkgs.writeText "nonce" cfg.encryptionKey
430 + }"
431 ];
432 };
433 };
434
363 - systemd.services.nginx.after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
435 + systemd.services.nginx.after =
436 + optional mysqlLocal "mysql.service"
437 + ++ optional pgsqlLocal "postgresql.service";
438
439 users.users.${user} = {
440 group = group;
@@ -369,4 +443,3 @@ in
443
444 };
445 }
372 -
non-critical-infra/modules/matrix-synapse.nix
+41 -58
@@ -1,7 +1,4 @@
1 -{ config
2 -, pkgs
3 -, ...
4 -}:
1 +{ config, pkgs, ... }:
2
3 {
4 imports = [
@@ -12,38 +9,30 @@
9 fileSystems."/var/lib/matrix-synapse" = {
10 device = "zroot/root/matrix-synapse";
11 fsType = "zfs";
15 - options = [
16 - "zfsutil"
17 - ];
12 + options = [ "zfsutil" ];
13 };
14
15 services.postgresql = {
21 - ensureUsers = [ {
22 - name = "matrix-synapse";
23 - ensureDBOwnership = true;
24 - } ];
16 + ensureUsers = [
17 + {
18 + name = "matrix-synapse";
19 + ensureDBOwnership = true;
20 + }
21 + ];
22 # Insufficient to create the database with the correct collation
23 # https://github.com/element-hq/synapse/blob/develop/docs/postgres.md#set-up-database
27 - ensureDatabases = [
28 - "matrix-synapse"
29 - ];
24 + ensureDatabases = [ "matrix-synapse" ];
25 };
26
32 - services.postgresqlBackup.databases = [
33 - "matrix-synapse"
34 - ];
27 + services.postgresqlBackup.databases = [ "matrix-synapse" ];
28
29 services.redis.servers.matrix-synapse = {
30 enable = true;
31 };
32
40 - environment.systemPackages = with pkgs; [
41 - matrix-synapse-tools.synadm
42 - ];
33 + environment.systemPackages = with pkgs; [ matrix-synapse-tools.synadm ];
34
44 - services.backup.includesZfsDatasets = [
45 - "/var/lib/matrix-synapse"
46 - ];
35 + services.backup.includesZfsDatasets = [ "/var/lib/matrix-synapse" ];
36
37 sops.secrets.matrix-synapse-signing-key = {
38 sopsFile = ../secrets/matrix-synapse-signing-key.caliban;
@@ -63,18 +52,14 @@
52 group = "matrix-synapse";
53 };
54
66 - systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = [
67 - "redis-matrix-synapse"
68 - ];
55 + systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = [ "redis-matrix-synapse" ];
56
57 services.matrix-synapse = {
58 enable = true;
59 enableRegistrationScript = false; # not compatible with unix sockets
60 withJemalloc = true;
61
75 - extraConfigFiles = [
76 - config.sops.secrets.matrix-synapse-secrets.path
77 - ];
62 + extraConfigFiles = [ config.sops.secrets.matrix-synapse-secrets.path ];
63
64 # https://github.com/element-hq/synapse/blob/master/docs/usage/configuration/config_documentation.md
65 settings = {
@@ -108,35 +93,33 @@
93 path = config.services.redis.servers.matrix-synapse.unixSocket;
94 };
95
111 - listeners = [ {
112 - type = "http";
113 - path = "/run/matrix-synapse/matrix-synapse.sock";
114 - mode = "0660";
115 - resources = [ {
116 - compress = true;
117 - names = [
118 - "client"
96 + listeners = [
97 + {
98 + type = "http";
99 + path = "/run/matrix-synapse/matrix-synapse.sock";
100 + mode = "0660";
101 + resources = [
102 + {
103 + compress = true;
104 + names = [ "client" ];
105 + }
106 + {
107 + compress = false;
108 + names = [ "federation" ];
109 + }
110 ];
120 - } {
121 - compress = false;
122 - names = [
123 - "federation"
111 + }
112 + {
113 + type = "http";
114 + bind_addresses = [
115 + "127.0.0.1"
116 + "::1"
117 ];
125 - } ];
126 - } {
127 - type = "http";
128 - bind_addresses = [
129 - "127.0.0.1"
130 - "::1"
131 - ];
132 - port = 8090;
133 - tls = false;
134 - resources = [ {
135 - names = [
136 - "metrics"
137 - ];
138 - } ];
139 - } ];
118 + port = 8090;
119 + tls = false;
120 + resources = [ { names = [ "metrics" ]; } ];
121 + }
122 + ];
123 };
124 };
125
@@ -145,8 +128,8 @@
128 services.nginx = {
129 clientMaxBodySize = config.services.matrix-synapse.settings.max_upload_size;
130 upstreams."matrix-synapse".servers = {
148 - "unix:/run/matrix-synapse/matrix-synapse.sock" = {};
149 - };
131 + "unix:/run/matrix-synapse/matrix-synapse.sock" = { };
132 + };
133 virtualHosts."matrix.nixos.org" = {
134 forceSSL = true;
135 enableACME = true;
non-critical-infra/modules/mjolnir.nix
+1 -3
@@ -1,6 +1,4 @@
1 -{ lib
2 -, ...
3 -}:
1 +{ lib, ... }:
2 {
3 sops.secrets.first-time-contribution-tagger-env = {
4 sopsFile = ../secrets/mjolnir-password.umbriel;
non-critical-infra/modules/nginx.nix
+6 -7
@@ -1,17 +1,16 @@
1 {
2 networking.firewall = {
3 - allowedTCPPorts = [ 80 443 ];
3 + allowedTCPPorts = [
4 + 80
5 + 443
6 + ];
7 };
8
9 # Grant nginx access to certificates
7 - systemd.services.nginx.serviceConfig.SupplementaryGroup = [
8 - "acme"
9 - ];
10 + systemd.services.nginx.serviceConfig.SupplementaryGroup = [ "acme" ];
11
12 # Reload nginx after certificate renewal
12 - security.acme.defaults.reloadServices = [
13 - "nginx.service"
14 - ];
13 + security.acme.defaults.reloadServices = [ "nginx.service" ];
14
15 services.nginx = {
16 enable = true;
non-critical-infra/modules/owncast.nix
+3 -10
@@ -1,12 +1,7 @@
1 -{
2 - config,
3 - ...
4 -}:
1 +{ config, ... }:
2
3 {
7 - imports = [
8 - ./nginx.nix
9 - ];
4 + imports = [ ./nginx.nix ];
5
6 fileSystems."/var/lib/owncast" = {
7 device = "zroot/root/owncast";
@@ -14,9 +9,7 @@
9 options = [ "zfsutil" ];
10 };
11
17 - services.backup.includesZfsDatasets = [
18 - "/var/lib/owncast"
19 - ];
12 + services.backup.includesZfsDatasets = [ "/var/lib/owncast" ];
13
14 services.owncast = {
15 enable = true;
non-critical-infra/modules/postfix.nix
+1 -4
@@ -10,10 +10,7 @@
10 enable = true;
11 domains = config.networking.fqdn;
12 selector = "mail";
13 - inherit (config.services.postfix)
14 - user
15 - group
16 - ;
13 + inherit (config.services.postfix) user group;
14 keyPath = "/run/opendkim-keys";
15 };
16
non-critical-infra/modules/postgresql.nix
+9 -15
@@ -1,15 +1,10 @@
1 -{ config
2 -, pkgs
3 -, ...
4 -}:
1 +{ config, pkgs, ... }:
2
3 {
4 fileSystems."/var/lib/postgresql" = {
5 device = "zroot/root/postgresql";
6 fsType = "zfs";
10 - options = [
11 - "zfsutil"
12 - ];
7 + options = [ "zfsutil" ];
8 };
9
10 services.postgresql = {
@@ -23,17 +18,16 @@
18 enable = true;
19 compression = "zstd";
20 # pulled in through the backup job
26 - startAt = [];
21 + startAt = [ ];
22 };
23
24 # include postgres dumps in the backup
25 services.backup = {
31 - includes = [
32 - "/var/backup/postgresql"
33 - ];
34 - wantedUnits = if config.services.postgresqlBackup.databases == [] then
35 - [ "postgresqlBackup.service" ]
36 - else
37 - map (db: "postgresqlBackup-${db}.service") config.services.postgresqlBackup.databases;
26 + includes = [ "/var/backup/postgresql" ];
27 + wantedUnits =
28 + if config.services.postgresqlBackup.databases == [ ] then
29 + [ "postgresqlBackup.service" ]
30 + else
31 + map (db: "postgresqlBackup-${db}.service") config.services.postgresqlBackup.databases;
32 };
33 }
non-critical-infra/modules/vaultwarden.nix
-5
@@ -94,8 +94,3 @@
94 };
95
96 }
97 -
98 -
99 -
100 -
101 -
ssh-keys.nix
+1 -3
@@ -29,9 +29,7 @@ rec {
29 zimbatm
30 ];
31
32 - infra = infra-core ++ [
33 - julienmalka
34 - ];
32 + infra = infra-core ++ [ julienmalka ];
33
34 machines = {
35 haumea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBamzRwZmoLjBFoNruGSVJEahk02Ku7NrBOmqcRWxcPm";
terraform-iam/flake.nix
+22 -18
@@ -1,26 +1,30 @@
1 {
2 inputs.nixpkgs.url = "nixpkgs/master";
3
4 - outputs = { nixpkgs }: {
4 + outputs =
5 + { nixpkgs }:
6 + {
7
6 - devShell.x86_64-linux =
7 - with import nixpkgs { system = "x86_64-linux"; };
8 - mkShell {
9 - packages = [
10 - awscli2
11 - (terraform.withPlugins (p: with p; [
12 - aws
13 - fastly
14 - netlify
15 - secret
16 - ]))
17 - ];
8 + devShell.x86_64-linux =
9 + with import nixpkgs { system = "x86_64-linux"; };
10 + mkShell {
11 + packages = [
12 + awscli2
13 + (terraform.withPlugins (
14 + p: with p; [
15 + aws
16 + fastly
17 + netlify
18 + secret
19 + ]
20 + ))
21 + ];
22
19 - shellHook = ''
20 - alias tf=terraform
21 - '';
22 - };
23 + shellHook = ''
24 + alias tf=terraform
25 + '';
26 + };
27
24 - };
28 + };
29
30 }
terraform/cache/diagnostic.sh
+1 -1
@@ -30,7 +30,7 @@ curl_test() {
30 }
31
32 ix() {
33 - url=$(cat | curl -F 'f:1=<-' ix.io 2> /dev/null)
33 + url=$(cat | curl -F 'f:1=<-' ix.io 2>/dev/null)
34 echo "Pasted at: $url"
35 }
36
terraform/flake.nix
+22 -18
@@ -1,26 +1,30 @@
1 {
2 inputs.nixpkgs.url = "nixpkgs/master";
3
4 - outputs = { nixpkgs }: {
4 + outputs =
5 + { nixpkgs }:
6 + {
7
6 - devShell.x86_64-linux =
7 - with import nixpkgs { system = "x86_64-linux"; };
8 - mkShell {
9 - packages = [
10 - awscli2
11 - (opentofu.withPlugins (p: with p; [
12 - aws
13 - fastly
14 - netlify
15 - secret
16 - ]))
17 - ];
8 + devShell.x86_64-linux =
9 + with import nixpkgs { system = "x86_64-linux"; };
10 + mkShell {
11 + packages = [
12 + awscli2
13 + (opentofu.withPlugins (
14 + p: with p; [
15 + aws
16 + fastly
17 + netlify
18 + secret
19 + ]
20 + ))
21 + ];
22
19 - shellHook = ''
20 - alias tf=tofu
21 - '';
22 - };
23 + shellHook = ''
24 + alias tf=tofu
25 + '';
26 + };
27
24 - };
28 + };
29
30 }