Move nixos.org to a t2.large instance
Also, move home directories and other stuff to the /data volume. Thus the root filesystem no longer contains anything important, so the instance can be trivially recreated. Also, provision a VPC and security group.
Eelco Dolstra committed
Jan 4, 2018 at 15:42 UTC
f771d8e5e2672f45a9a285a2854def212e055c90
2 files changed
+90
-17
nixos-org/network.nix
+85
-15
@@ -1,6 +1,6 @@
1
let
2
region = "eu-west-1";
3
- zone = "eu-west-1a"; # Do not change the zone, due to Reserved Instance.
3
+ zone = "eu-west-1a";
4
accessKeyId = "lb-nixos";
5
in
6
@@ -13,12 +13,19 @@ in
13
size = 1024;
14
};
15
16
+ # FIXME: remove
17
resources.ebsVolumes.data =
18
{ tags.Name = "Misc. NixOS.org data";
19
inherit region zone accessKeyId;
20
size = 10;
21
};
22
23
+ resources.ebsVolumes.data-new =
24
+ { tags.Name = "Misc. NixOS.org data";
25
+ inherit region zone accessKeyId;
26
+ size = 30;
27
+ };
28
+
29
resources.elasticIPs."nixos.org" =
30
{ inherit region accessKeyId;
31
};
@@ -121,6 +128,7 @@ in
128
'';
129
};
130
131
+ /*
132
resources.s3Buckets.nix-test-cache =
133
{ config, ... }:
134
{ inherit region accessKeyId;
@@ -148,6 +156,7 @@ in
156
}
157
'';
158
};
159
+ */
160
161
resources.s3Buckets.nix-releases =
162
{ config, ... }:
@@ -185,6 +194,68 @@ in
194
'';
195
};
196
197
+ resources.vpc.nixos-org-vpc =
198
+ {
199
+ inherit region accessKeyId;
200
+ instanceTenancy = "default";
201
+ enableDnsSupport = true;
202
+ enableDnsHostnames = true;
203
+ cidrBlock = "10.0.0.0/16";
204
+ };
205
+
206
+ resources.vpcSubnets.nixos-org-subnet =
207
+ { resources, lib, ... }:
208
+ {
209
+ inherit region zone accessKeyId;
210
+ vpcId = resources.vpc.nixos-org-vpc;
211
+ cidrBlock = "10.0.0.0/19";
212
+ mapPublicIpOnLaunch = true;
213
+ };
214
+
215
+ resources.ec2SecurityGroups.nixos-org-sg =
216
+ { resources, lib, ... }:
217
+ {
218
+ inherit region accessKeyId;
219
+ vpcId = resources.vpc.nixos-org-vpc;
220
+ rules =
221
+ [ { toPort = 22; fromPort = 22; sourceIp = "213.125.166.74/32"; } # Utrecht office
222
+ { toPort = 22; fromPort = 22; sourceIp = "131.180.119.77/32"; } # wendy
223
+ { toPort = 80; fromPort = 80; sourceIp = "0.0.0.0/0"; }
224
+ { toPort = 443; fromPort = 443; sourceIp = "0.0.0.0/0"; }
225
+ ];
226
+ };
227
+
228
+ resources.vpcRouteTables.nixos-org-route-table =
229
+ { resources, ... }:
230
+ {
231
+ inherit region accessKeyId;
232
+ vpcId = resources.vpc.nixos-org-vpc;
233
+ };
234
+
235
+ resources.vpcRouteTableAssociations.nixos-org-assoc =
236
+ { resources, ... }:
237
+ {
238
+ inherit region accessKeyId;
239
+ subnetId = resources.vpcSubnets.nixos-org-subnet;
240
+ routeTableId = resources.vpcRouteTables.nixos-org-route-table;
241
+ };
242
+
243
+ resources.vpcInternetGateways.nixos-org-igw =
244
+ { resources, ... }:
245
+ {
246
+ inherit region accessKeyId;
247
+ vpcId = resources.vpc.nixos-org-vpc;
248
+ };
249
+
250
+ resources.vpcRoutes.nixos-org-route =
251
+ { resources, ... }:
252
+ {
253
+ inherit region accessKeyId;
254
+ routeTableId = resources.vpcRouteTables.nixos-org-route-table;
255
+ destinationCidrBlock = "0.0.0.0/0";
256
+ gatewayId = resources.vpcInternetGateways.nixos-org-igw;
257
+ };
258
+
259
webserver =
260
{ config, pkgs, resources, ... }:
261
@@ -193,11 +264,15 @@ in
264
deployment.owners = [ "eelco.dolstra@logicblox.com" "rob.vermaas@logicblox.com" ];
265
deployment.ec2.region = region;
266
deployment.ec2.zone = zone;
196
- deployment.ec2.instanceType = "m3.medium";
267
+ deployment.ec2.instanceType = "t2.large";
268
deployment.ec2.accessKeyId = accessKeyId;
269
deployment.ec2.keyPair = resources.ec2KeyPairs.default;
199
- deployment.ec2.securityGroups = [ "public-web" "public-ssh" ];
270
+ deployment.ec2.securityGroups = [];
271
+ deployment.ec2.securityGroupIds = [ resources.ec2SecurityGroups.nixos-org-sg.name ];
272
+ deployment.ec2.subnetId = resources.vpcSubnets.nixos-org-subnet;
273
+ deployment.ec2.associatePublicIpAddress = true;
274
deployment.ec2.elasticIPv4 = resources.elasticIPs."nixos.org";
275
+ deployment.ec2.ebsInitialRootDiskSize = 30;
276
277
fileSystems."/releases" =
278
{ autoFormat = true;
@@ -210,7 +285,7 @@ in
285
{ autoFormat = true;
286
fsType = "ext4";
287
device = "/dev/xvdh";
213
- ec2.disk = resources.ebsVolumes.data;
288
+ ec2.disk = resources.ebsVolumes.data-new;
289
};
290
291
fileSystems."/data/releases" =
@@ -219,20 +294,15 @@ in
294
options = [ "bind" ];
295
};
296
222
- fileSystems."/scratch" =
223
- { autoFormat = true;
224
- fsType = "ext4";
225
- device = "/dev/xvdk";
226
- ec2.size = 64;
227
- ec2.volumeType = "gp2";
297
+ fileSystems."/home" =
298
+ { device = "/data/home";
299
+ fsType = "none";
300
+ options = [ "bind" ];
301
};
302
230
- swapDevices =
231
- [ { device = "/scratch/swapfile"; size = 8 * 1024; }
232
- ];
233
-
234
- system.stateVersion = "14.12";
303
+ system.stateVersion = "17.09";
304
305
imports = [ ./webserver.nix ./hydra-mirror.nix ./tarball-mirror.nix ];
306
};
307
+
308
}
nixos-org/webserver.nix
+5
-2
@@ -6,8 +6,8 @@ let
6
7
sshKeys = import ../ssh-keys.nix;
8
9
- acmeKeyDir = "/var/lib/acme/";
10
- acmeWebRoot = "/var/lib/httpd/acme";
9
+ acmeKeyDir = "/data/acme/";
10
+ acmeWebRoot = "/data/acme/httpd";
11
12
nixosVHostConfig =
13
{ hostName = "nixos.org";
@@ -222,6 +222,7 @@ in
222
isSystemUser = false;
223
useDefaultShell = true;
224
openssh.authorizedKeys.keys = [ sshKeys.eelco ];
225
+ uid = 1000;
226
};
227
228
users.extraUsers.rbvermaa =
@@ -233,6 +234,7 @@ in
234
isSystemUser = false;
235
useDefaultShell = true;
236
openssh.authorizedKeys.keys = [ sshKeys.rob ];
237
+ uid = 1001;
238
};
239
240
users.extraUsers.irclogs =
@@ -244,6 +246,7 @@ in
246
useDefaultShell = true;
247
openssh.authorizedKeys.keys =
248
[ "ssh-dss AAAAB3NzaC1kc3MAAACBAMrcUf4qQj8XcG1nfG5/6rbfb4a89nV13KcJLBOVWa3Tn4YHeVz1lQDRHvnLK9YKM7MybDXD2wVG5nKuMbJMW5aZPEGrVUM4SQFXtnaNBgmoACrbG978Da/vNjGY89Q7GS/YqA24ASKnc09cRFsTmU0e/9BCbz9zXO4sJ8GaGHz7AAAAFQDZrJCdxTQ8GVvoFjL9Q1s1VHiClwAAAIBK+6r/kP/9VUzfRepEHCVObTIRYIhC9YcIZe2pMyCQSUIAjkGd5hkA8XQecs5/ym5Ddm2j61Kvt2jtGXQVP2F04wIFDuGK4GAfPpYjvLJaXtVxj1Ho4K2W/+WgKG1NEh466myZNsHr3v1MufbxNIS03lg6s8oJI4TmCaWtVHNW+AAAAIEAqh+ablUfEZAr6" ];
249
+ uid = 1002;
250
};
251
252
systemd.services.update-homepage =