feat(gerrit): run git-gc-preserve on a daily timer

flake.nix

@@ -63,7 +63,6 @@
         modules = [
           ./terraform
           {
-            bagel.dnsimple.enable = true;
             bagel.gandi.enable = true;
             bagel.hydra.enable = true;
           }

services/gerrit/default.nix

@@ -41,6 +41,7 @@ in
   imports = [
     ./www.nix
     ./one-way-sync.nix
+    ./git-gc-preserve.nix
   ];
 
   config = mkIf cfg.enable {
@@ -318,6 +319,13 @@ in
       environment.REVWALK_USE_PRIORITY_QUEUE = "true";
     };
 
+    bagel.services.git-gc-preserve = {
+      nixpkgs = {
+        enable = true;
+        repoPath = "/var/lib/gerrit/git/nixpkgs.git";
+      };
+    };
+
     age.secrets.gerrit-prometheus-bearer-token.file = ../../secrets/gerrit-prometheus-bearer-token.age;
     bagel.monitoring.grafana-agent.exporters.gerrit = {
       port = 4778;  # grrt

services/gerrit/git-gc-preserve.nix

@@ -0,0 +1,86 @@
+{ lib, utils, config, pkgs, ... }: let
+  inherit (lib) mkOption mkEnableOption types;
+  cfg = config.bagel.services.git-gc-preserve;
+  enabledServices = lib.filterAttrs (_: gcConfig: gcConfig.enable) cfg;
+in
+{
+  options.bagel.services.git-gc-preserve = mkOption {
+    default = { };
+    description = "Repositories that should be garbage collected";
+    type = types.attrsOf (types.submodule {
+      options = {
+        enable = mkEnableOption "git-gc-preserve";
+        user = mkOption {
+          type = types.str;
+          default = "git";
+          description = "The user which will run the garbage collection script";
+          example = "forgejo";
+        };
+        group = mkOption {
+          type = types.str;
+          default = "git";
+          description = "The group which will run the garbage collection script";
+          example = "forgejo";
+        };
+        repoPath = mkOption {
+          type = types.path;
+          description = "The path to the git repository that should be garbage collected";
+          example = "/var/lib/gerrit/git/nixpkgs";
+        };
+        timeoutSec = mkOption {
+          type = types.str;
+          default = "1h";
+          description = "Garbage collection Systemd unit timeout";
+          example = "infinity";
+        };
+        timerConfig = mkOption {
+          type = types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+          default = {
+            OnCalendar = "daily";
+          };
+          description = ''
+            When to run the git-gc-preserve. See {manpage}`systemd.timer(5)` for details.
+          '';
+          example = {
+            OnCalendar = "00:05";
+            RandomizedDelaySec = "5h";
+            Persistent = true;
+          };
+        };
+      };
+    });
+  };
+  config = {
+    systemd.services =
+      let
+        mkGCService = name: gcConfig: {
+          name = "git-gc-preserve-${name}";
+          value = {
+            description = "Git-GC-Preserve Service - ${name}";
+            serviceConfig = {
+              WorkingDirectory = gcConfig.repoPath;
+              Type = "oneshot";
+              User = gcConfig.user;
+              Group = gcConfig.group;
+              ExecStart = lib.getExe pkgs.git-gc-preserve;
+              TimeoutSec = gcConfig.timeoutSec;
+            };
+          };
+        };
+        mkServices = lib.mapAttrs' mkGCService;
+      in
+        mkServices enabledServices;
+
+    systemd.timers = let
+      mkGCTimer = name: gcConfig: {
+        name = "git-gc-preserve-${name}";
+        value = {
+          wantedBy = [ "timers.target" ];
+          after = [ "multi-user.target" ];
+          timerConfig = gcConfig.timerConfig;
+        };
+      };
+      mkTimer = lib.mapAttrs' mkGCTimer;
+    in mkTimer enabledServices;
+  };
+}

terraform/default.nix

@@ -2,7 +2,6 @@
   imports = [
     ./common.nix
     ./gandi.nix
-    ./dnsimple.nix
     ./hydra.nix
     ./state.nix
   ];

terraform/dnsimple.nix

@@ -1,147 +0,0 @@
-{ lib, config, ... }:
-let
-  inherit (lib) mkEnableOption mkIf tf genList;
-  cfg = config.bagel.dnsimple;
-in
-{
-  options.bagel.dnsimple = {
-    enable = mkEnableOption "the DNSimple configuration";
-  };
-
-  config = mkIf cfg.enable {
-    terraform.required_providers.dnsimple = {
-      version = "~> 1.7.0";
-      source = "dnsimple/dnsimple";
-    };
-
-    resource.secret_resource.dnsimple_token.lifecycle.prevent_destroy = true;
-    resource.secret_resource.dnsimple_account.lifecycle.prevent_destroy = true;
-
-    provider.dnsimple = {
-      token = tf.ref "resource.secret_resource.dnsimple_token.value";
-      account = tf.ref "resource.secret_resource.dnsimple_account.value";
-    };
-
-    resource.dnsimple_zone.forkos_org = {
-      name = "forkos.org";
-    };
-
-    resource.dnsimple_zone.fleurixos_org = {
-      name = "fleurixos.org";
-    };
-
-    resource.dnsimple_zone.floral_systems = {
-      name = "floral.systems";
-    };
-
-    resource.dnsimple_zone.flowery_systems = {
-      name = "flowery.systems";
-    };
-
-    resource.dnsimple_zone.petalpkgs_org = {
-      name = "petalpkgs.org";
-    };
-
-    resource.dnsimple_zone.vzfdfp_de = {
-      name = "vzfdfp.de";
-    };
-
-    resource.dnsimple_zone_record = let
-      # https://registry.terraform.io/providers/dnsimple/dnsimple/latest/docs/resources/zone_record
-      canonicalName = zoneName: record: let
-        # TODO: make less fragile and have actual unique and stable names
-        normalize = builtins.replaceStrings ["." "@"] ["_" "_root_"];
-        zone = normalize zoneName;
-        name = normalize record.name;
-      in "${zone}_${record.type}_${name}";
-
-      record = name: ttl: type: value: {
-        inherit name ttl type value;
-      };
-
-      proxyRecords = name: ttl: type: value: [
-        # kurisu.lahfa.xyz running a sniproxy:
-        (record name ttl "A" "163.172.69.160")
-        (record name ttl type value)
-      ];
-
-      # Creates a extra *.p record pointing to the sniproxy
-      dualProxyRecords = name: ttl: type: value: lib.flatten [
-        (record name ttl type value)
-        (proxyRecords "${name}.p" ttl type value)
-      ];
-
-      domain = zoneName: records:
-        builtins.listToAttrs (map (record: {
-          name = canonicalName zoneName record;
-          value = record // {
-            zone_name = zoneName;
-          };
-        }
-      ) (lib.flatten records));
-      zones = domains: lib.zipAttrs (lib.mapAttrsToList (zoneName: records: domain zoneName records) domains);
-    in zones {
-        "forkos.org" = ([
-          # (record "@" 300 "A" "163.172.69.160")
-          (record "@" 300 "AAAA" "2001:bc8:38ee:100:1000::20")
-
-          (dualProxyRecords "bagel-box.infra" 300 "AAAA" "2001:bc8:38ee:100:100::1")
-          (dualProxyRecords "gerrit01.infra" 300 "AAAA" "2001:bc8:38ee:100:1000::10")
-          (dualProxyRecords "meta01.infra" 300 "AAAA" "2001:bc8:38ee:100:1000::20")
-          (dualProxyRecords "fodwatch.infra" 300 "AAAA" "2001:bc8:38ee:100:1000::30")
-          # git.infra.forkos.org exposes opensshd
-          (dualProxyRecords "git.infra" 300 "AAAA" "2001:bc8:38ee:100:1000::41")
-          # git.p.forkos.org exposes forgejo ssh server.
-          (proxyRecords "git.p" 300 "AAAA" "2001:bc8:38ee:100:1000::40")
-          (dualProxyRecords "buildbot.infra" 300 "AAAA" "2001:bc8:38ee:100:1000::50")
-          (dualProxyRecords "public01.infra" 300 "AAAA" "2001:bc8:38ee:100:1000::60")
-
-          (record "cl" 300 "CNAME" "gerrit01.infra.p.forkos.org")
-          (record "fodwatch" 300 "CNAME" "fodwatch.infra.p.forkos.org")
-          # git.p.forkos.org is the proxy variant of the Forgejo server.
-          (record "git" 300 "CNAME" "git.p.forkos.org")
-          (record "netbox" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "amqp" 300 "CNAME" "bagel-box.infra.p.forkos.org")
-          (record "grafana" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "hydra" 300 "CNAME" "build-coord.wob01.infra.p.forkos.org")
-          (record "loki" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "mimir" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "pyroscope" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "tempo" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "matrix" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "alerts" 300 "CNAME" "meta01.infra.p.forkos.org")
-          (record "buildbot" 300 "CNAME" "buildbot.infra.p.forkos.org")
-          (record "b" 300 "CNAME" "public01.infra.p.forkos.org")
-          (record "postgres" 300 "CNAME" "bagel-box.infra.p.forkos.org")
-          (record "news" 3600 "CNAME" "public01.infra.p.forkos.org")
-
-          # S3 in delroth's basement
-          (record "cache" 300 "AAAA" "2a02:168:6426::12") # smol.delroth.net
-          (record "cache" 300 "A" "195.39.247.161") # sni proxy
-
-          (record "vpn-gw.wob01.infra" 300 "AAAA" "2a01:584:11::2")
-
-          (dualProxyRecords "build-coord.wob01.infra" 300 "AAAA" "2a01:584:11::1:11")
-          # TODO: do not hardcode, just reuse the Colmena hive module outputs to generate all the required details.
-        ]
-        ++ (map (index: record "builder-${toString index}.wob01.infra" 300 "AAAA" "2a01:584:11::1:${toString index}") (genList lib.id 11))
-        ++ (
-          let
-            # FIXME: figure out a way to poke `config.services.s3-revproxy` and
-            # automate the DNS part away?
-            buckets = [
-              "channels"
-              "releases"
-              "channel-scripts-test"
-            ];
-          in
-          map (bucket: record "${bucket}" 300 "CNAME" "public01.infra.p.forkos.org") buckets
-        ));
-        "flowery.systems" = [
-          (record "" 300 "ALIAS" "news.forkos.org")
-        ];
-        "vzfdfp.de" = [
-        ];
-    };
-  };
-}