Upload releases to S3
Eelco Dolstra committed
Sep 27, 2016 at 11:25 UTC
f408940b621cb45db9c4866ecd9fd82fb50e82dc
4 files changed
+45
-22
nixos-org/hydra-mirror.nix
+6
-20
@@ -20,8 +20,10 @@ let
20
path = [ channelScripts ];
21
script =
22
''
23
- exec mirror-nixos-branch ${channelName} https://hydra.nixos.org/job/${mainJob}/latest-finished \
24
- ${optionalString (channelName == "nixos-16.03") "1"}
23
+ # FIXME: use IAM role.
24
+ export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
25
+ export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
26
+ exec mirror-nixos-branch ${channelName} https://hydra.nixos.org/job/${mainJob}/latest-finished
27
''; # */
28
serviceConfig.User = "hydra-mirror";
29
};
@@ -38,30 +40,14 @@ in
40
uid = 497;
41
};
42
41
- /*
42
- systemd.services.mirror-nixpkgs =
43
- { description = "Mirror Nixpkgs";
44
- wantedBy = [ "multi-user.target" ];
45
- after = [ "networking.target" ];
46
- path = [ pkgs.su ];
47
- script =
48
- ''
49
- rm -rf /data/releases/nixpkgs/.tmp-*
50
- exec su - hydra-mirror -c 'cd nixos-channel-scripts; while true; do ./mirror-nixpkgs.sh; sleep 1200; done'
51
- '';
52
- serviceConfig.Restart = "always";
53
- serviceConfig.CPUShares = 100;
54
- };
55
- */
56
-
43
systemd =
44
fold recursiveUpdate {} [
45
(makeUpdateChannel "nixos-16.09" "nixos/release-16.09/tested")
46
(makeUpdateChannel "nixos-16.09-small" "nixos/release-16.09-small/tested")
47
(makeUpdateChannel "nixos-16.03" "nixos/release-16.03/tested")
48
(makeUpdateChannel "nixos-16.03-small" "nixos/release-16.03-small/tested")
63
- (makeUpdateChannel "nixos-15.09" "nixos/release-15.09/tested")
64
- (makeUpdateChannel "nixos-15.09-small" "nixos/release-15.09-small/tested")
49
+ #(makeUpdateChannel "nixos-15.09" "nixos/release-15.09/tested")
50
+ #(makeUpdateChannel "nixos-15.09-small" "nixos/release-15.09-small/tested")
51
(makeUpdateChannel "nixos-unstable" "nixos/trunk-combined/tested")
52
(makeUpdateChannel "nixos-unstable-small" "nixos/unstable-small/tested")
53
(makeUpdateChannel "nixpkgs-unstable" "nixpkgs/trunk/unstable")
nixos-org/network.nix
+37
-1
@@ -128,6 +128,42 @@ in
128
'';
129
};
130
131
+ resources.s3Buckets.nix-releases =
132
+ { config, ... }:
133
+ { inherit accessKeyId;
134
+ name = "nix-releases";
135
+ region = "eu-west-1";
136
+ policy =
137
+ ''
138
+ {
139
+ "Version": "2008-10-17",
140
+ "Statement": [
141
+ {
142
+ "Sid": "AllowPublicRead",
143
+ "Effect": "Allow",
144
+ "Principal": {"AWS": "*"},
145
+ "Action": ["s3:GetObject"],
146
+ "Resource": ["${config.arn}/*"]
147
+ },
148
+ {
149
+ "Sid": "AllowPublicList",
150
+ "Effect": "Allow",
151
+ "Principal": {"AWS": "*"},
152
+ "Action": ["s3:ListBucket"],
153
+ "Resource": ["${config.arn}"]
154
+ },
155
+ {
156
+ "Sid": "AllowUpload",
157
+ "Effect": "Allow",
158
+ "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"},
159
+ "Action": ["s3:PutObject", "s3:PutObjectAcl"],
160
+ "Resource": ["${config.arn}/*"]
161
+ }
162
+ ]
163
+ }
164
+ '';
165
+ };
166
+
167
webserver =
168
{ config, pkgs, resources, ... }:
169
@@ -162,7 +198,7 @@ in
198
options = [ "bind" ];
199
};
200
165
- swapDevices = [ { device = "/tmp/swapfile"; size = 1024; } ];
201
+ swapDevices = [ { device = "/tmp/swapfile"; size = 3 * 1024; } ];
202
203
system.stateVersion = "14.12";
204
nixos-org/tarball-mirror.nix
+1
@@ -33,6 +33,7 @@ in
33
cd /home/tarball-mirror/nixpkgs
34
git remote update channels
35
git checkout channels/nixos-${nixosRelease}
36
+ # FIXME: use IAM role.
37
export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
38
export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
39
NIX_PATH=nixpkgs=. ./maintainers/scripts/copy-tarballs.pl \
nixos-org/webserver.nix
+1
-1
@@ -75,7 +75,7 @@ in
75
76
environment.systemPackages = [ pkgs.perlPackages.XMLSimple pkgs.git pkgs.openssl ];
77
78
- nix.package = builtins.storePath /nix/store/mynhlpqzslmdx9svyp0ig61hvplxv039-nix-1.12pre1234_abcdef;
78
+ nix.package = pkgs.nixUnstable;
79
80
nix.nixPath = [ "nixpkgs=https://nixos.org/channels/nixos-16.03-small/nixexprs.tar.xz" ];
81