forked from the-distro/infra
122 lines
3.1 KiB
Nix
122 lines
3.1 KiB
Nix
{ pkgs, lib, config, ... }:
|
|
let
|
|
cfg = config.bagel.baremetal.builders;
|
|
in
|
|
{
|
|
options = {
|
|
|
|
bagel.baremetal.builders = {
|
|
enable = lib.mkEnableOption "baremetal bagel oven";
|
|
num = lib.mkOption {
|
|
type = lib.types.int;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
boot.initrd.availableKernelModules = [ "ahci" "ehci_pci" "usb_storage" "usbhid" "sd_mod" ];
|
|
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
|
|
|
users.users.builder = {
|
|
isSystemUser = true;
|
|
group = "nogroup";
|
|
home = "/var/empty";
|
|
shell = "/bin/sh";
|
|
openssh.authorizedKeys.keys = [
|
|
# Do not hardcode Hydra's public key, selectively
|
|
# add the keys of the coordinators that require us.
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvUT9YBig9LQPHgypIBHQuC32XqDKxlFZ2CfgDi0ZKx"
|
|
];
|
|
};
|
|
nix.settings.trusted-users = [ "builder" ];
|
|
|
|
|
|
nixpkgs.hostPlatform = "x86_64-linux";
|
|
hardware.cpu.intel.updateMicrocode = true;
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.initrd.systemd.enable = true;
|
|
|
|
boot.initrd.services.lvm.enable = true;
|
|
|
|
fileSystems."/" = {
|
|
device = "/dev/disk/by-label/root";
|
|
fsType = "xfs";
|
|
};
|
|
|
|
fileSystems."/boot" = {
|
|
device = "/dev/disk/by-label/BOOT";
|
|
fsType = "vfat";
|
|
options = [ "fmask=0022" "dmask=0022" ];
|
|
};
|
|
|
|
boot.kernelParams = [
|
|
"console=ttyS0,115200"
|
|
"console=tty1"
|
|
];
|
|
|
|
networking.useNetworkd = true;
|
|
networking.hostName = "builder-${toString cfg.num}";
|
|
networking.domain = "wob01.infra.forkos.org";
|
|
|
|
systemd.network = {
|
|
netdevs = {
|
|
"40-uplink" = {
|
|
netdevConfig = {
|
|
Kind = "bond";
|
|
Name = "uplink";
|
|
};
|
|
bondConfig = {
|
|
Mode = "802.3ad";
|
|
TransmitHashPolicy = "layer3+4";
|
|
};
|
|
};
|
|
};
|
|
networks = {
|
|
"40-eno1" = {
|
|
name = "eno1";
|
|
bond = [ "uplink" ];
|
|
};
|
|
"40-eno2" = {
|
|
name = "eno2";
|
|
bond = [ "uplink" ];
|
|
};
|
|
};
|
|
};
|
|
networking.interfaces.uplink.ipv6.addresses = [
|
|
{ address = "2a01:584:11::1:${toString cfg.num}"; prefixLength = 64; }
|
|
];
|
|
networking.defaultGateway6 = { interface = "uplink"; address = "2a01:584:11::1"; };
|
|
deployment.targetHost = "2a01:584:11::1:${toString cfg.num}";
|
|
deployment.tags = [ "builders" ];
|
|
|
|
# Why can't we have nice things? https://bugs.openjdk.org/browse/JDK-8170568
|
|
services.coredns = {
|
|
enable = true;
|
|
config = ''
|
|
. {
|
|
bind lo
|
|
forward . 2001:4860:4860::6464
|
|
template ANY A { rcode NOERROR }
|
|
}
|
|
'';
|
|
};
|
|
services.resolved.enable = false;
|
|
networking.resolvconf.useLocalResolver = true;
|
|
|
|
# Hydra blasts ssh connections and does not multiplex. Loosen some of the
|
|
# rate limiting.
|
|
services.openssh.settings = {
|
|
MaxStartups = "500:30:1000";
|
|
};
|
|
|
|
|
|
bagel.sysadmin.enable = true;
|
|
|
|
environment.systemPackages = [ pkgs.ipmitool ];
|
|
|
|
system.stateVersion = "24.05";
|
|
};
|
|
}
|