hydra: output machine host key as base64 in the generated machines.conf

services/hydra/default.nix

@@ -11,13 +11,15 @@ let
     lib.mapAttrsToList (k: v: "${k}=${v}") settings
     );
 
-  mkBaremetalBuilder = { nrCores, publicHostKey, host, speedFactor ? 1, user ? "builder", supportedSystems ? [ "i686-linux" "x86_64-linux" ], supportedFeatures ? [ "big-parallel" "kvm" "nixos-test" ] }: 
-  "ssh://${user}@${host} ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString nrCores} ${toString speedFactor} ${lib.concatStringsSep "," supportedFeatures} - ${publicHostKey}";
+  # XXX: to support Nix's dumb public host key syntax (base64'd), this outputs
+  # a string with shell-style command interpolations: $(...).
+  mkBaremetalBuilder = { nrCores, publicHostKey, host, speedFactor ? 1, user ? "builder", supportedSystems ? [ "i686-linux" "x86_64-linux" ], supportedFeatures ? [ "big-parallel" "kvm" "nixos-test" ] }:
+  "ssh://${user}@${host} ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString nrCores} ${toString speedFactor} ${lib.concatStringsSep "," supportedFeatures} - $(echo -n '${publicHostKey}' | base64 -w0)";
 
   # TODO:
   # - generalize to new architectures
   # - generalize to new features
-  baremetalBuilders = lib.concatStringsSep "\n" 
+  baremetalBuilders = lib.concatStringsSep "\n"
     (map (n: mkBaremetalBuilder {
       nrCores = 40; # TODO: do not hardcode this, use the node's builder configuration.
       publicHostKey = ssh-keys.machines.${n};
@@ -57,7 +59,7 @@ in {
     # XXX: Otherwise services.hydra-dev overwrites it to only hydra-queue-runner...
     #
     # Can be removed once this is added to some common config template.
-    nix.settings.trusted-users = [ "root" "@wheel" ];
+    nix.settings.trusted-users = [ "root" "hydra" "@wheel" ];
 
     services.hydra-dev = {
       enable = true;
@@ -76,7 +78,11 @@ in {
       package = pkgs.hydra;
 
       buildMachinesFiles = [
-        (pkgs.writeText "hydra-builders.conf" baremetalBuilders)
+        (pkgs.runCommandNoCC "hydra-builders.conf" {} ''
+          cat >$out <<EOF
+          ${baremetalBuilders}
+          EOF
+        '')
       ];
 
       extraConfig = ''

terraform/hydra.nix

@@ -71,5 +71,45 @@ in
         }
       ];
     };
+
+    resource.hydra_jobset.delroth-nixpkgs-staging-small = {
+      project = config.resource.hydra_project.forkos.name;
+      state = "enabled";
+      visible = true;
+      name = "delroth-nixpkgs-staging-small";
+      type = "legacy";
+      description = "small eval of nixpkgs staging for testing";
+
+      nix_expression = {
+        file = "pkgs/top-level/release-small.nix";
+        input = "nixpkgs";
+      };
+
+      check_interval = 0;
+      scheduling_shares = 3000;
+      keep_evaluations = 3;
+
+      email_notifications = false;
+
+      input = [
+        {
+          name = "nixpkgs";
+          type = "git";
+          value = "https://github.com/nixos/nixpkgs staging";
+          notify_committers = false;
+        }
+        {
+          name = "officialRelease";
+          type = "boolean";
+          value = "false";
+          notify_committers = false;
+        }
+        {
+          name = "supportedSystems";
+          type = "nix";
+          value = ''[ "x86_64-linux" ]'';
+        }
+      ];
+    };
   };
 }