Compare commits

...

3 commits

48 changed files with 1320 additions and 823 deletions

1
.gitignore vendored
View file

@ -6,3 +6,4 @@ config.tf.json
.terraform.lock.hcl
secrets/*
!secrets/*.age
.pre-commit-config.yaml

View file

@ -1,16 +1,17 @@
let
keys = import ./ssh-keys.nix;
in {
in
{
users.users.root.openssh.authorizedKeys.keys =
keys.users.delroth ++
keys.users.emilylange ++
keys.users.hexchen ++
keys.users.jade ++
keys.users.janik ++
keys.users.k900 ++
keys.users.lukegb ++
keys.users.maxine ++
keys.users.raito ++
keys.users.thubrecht ++
keys.users.yuka;
keys.users.delroth
++ keys.users.emilylange
++ keys.users.hexchen
++ keys.users.jade
++ keys.users.janik
++ keys.users.k900
++ keys.users.lukegb
++ keys.users.maxine
++ keys.users.raito
++ keys.users.thubrecht
++ keys.users.yuka;
}

View file

@ -1,7 +1,6 @@
{ lib, pkgs, ... }: {
imports = [
./known-ssh-keys.nix
];
{ lib, pkgs, ... }:
{
imports = [ ./known-ssh-keys.nix ];
nixpkgs.overlays = import ../overlays;
@ -36,7 +35,8 @@
services.journald.extraConfig = "SystemMaxUse=512M";
boot.kernelParams = [
"panic=30" "boot.panic_on_fail"
"panic=30"
"boot.panic_on_fail"
];
boot.kernel.sysctl = {

View file

@ -3,9 +3,9 @@
{
nix.settings.allowed-users = [ "root" ];
boot.specialFileSystems = lib.mkIf (!config.security.rtkit.enable && !config.security.polkit.enable) {
"/proc".options = [ "hidepid=2" ];
};
boot.specialFileSystems = lib.mkIf (
!config.security.rtkit.enable && !config.security.polkit.enable
) { "/proc".options = [ "hidepid=2" ]; };
boot.kernel.sysctl."kernel.dmesg_restrict" = 1;
@ -14,9 +14,7 @@
settings.KbdInteractiveAuthentication = false;
# prevents mutable /home/$user/.ssh/authorized_keys from being loaded to ensure that all user keys are config managed
authorizedKeysFiles = lib.mkForce [
"/etc/ssh/authorized_keys.d/%u"
];
authorizedKeysFiles = lib.mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
};
users.mutableUsers = false;

View file

@ -11,12 +11,33 @@ in
services.nginx = {
# IPv6-only server
defaultListen = [
{ addr = "[::0]"; proxyProtocol = true; port = 444; ssl = true; }
{ addr = "[::0]"; port = 443; ssl = true; }
{ addr = "[::0]"; port = 80; ssl = false; }
{
addr = "[::0]";
proxyProtocol = true;
port = 444;
ssl = true;
}
{
addr = "[::0]";
port = 443;
ssl = true;
}
{
addr = "[::0]";
port = 80;
ssl = false;
}
# Private networking
{ addr = "127.0.0.1"; port = 80; ssl = false; }
{ addr = "[::1]"; port = 80; ssl = false; }
{
addr = "127.0.0.1";
port = 80;
ssl = false;
}
{
addr = "[::1]";
port = 80;
ssl = false;
}
];
appendHttpConfig = ''

View file

@ -1,7 +1,12 @@
{ lib, config, ... }:
let
cfg = config.bagel.hardware.raito-vm;
inherit (lib) mkEnableOption mkIf mkOption types;
inherit (lib)
mkEnableOption
mkIf
mkOption
types
;
in
{
options.bagel.hardware.raito-vm = {

View file

@ -23,7 +23,9 @@
users = {
delroth = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII3tjB4KYDok3KlWxdBp/yEmqhhmybd+w0VO4xUwLKKV" ];
emilylange = [ "no-touch-required sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIL7jgq3i+N3gVJhs4shm7Kmw6dIocs2OuR0GBMG1RxfKAAAABHNzaDo=" ];
emilylange = [
"no-touch-required sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIL7jgq3i+N3gVJhs4shm7Kmw6dIocs2OuR0GBMG1RxfKAAAABHNzaDo="
];
hexchen = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINJ0tCxsEilAzV6LaNpUpcjzyEn4ptw8kFz3R+Z3YjEF hexchen@backup"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDI3T1eFS77URHZ/HVWkMOqx7W1U54zJtn9C7QWsHOtyH72i/4EVj8SxYqLllElh1kuKUXSUipPeEzVsipFVvfH0wEuTDgFffiSQ3a8lfUgdEBuoySwceEoPgc5deapkOmiDIDeeWlrRe3nqspLRrSWU1DirMxoFPbwqJXRvpl6qJPxRg+2IolDcXlZ6yxB4Vv48vzRfVzZNUz7Pjmy2ebU8PbDoFWL/S3m7yOzQpv3L7KYBz7+rkjuF3AU2vy6CAfIySkVpspZZLtkTGCIJF228ev0e8NvhuN6ZnjzXxVTQOy32HCdPdbBbicu0uHfZ5O7JX9DjGd8kk1r2dnZwwy/ hexchen@yubi5"
@ -40,7 +42,9 @@
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLZxVITpJ8xbiCa/u2gjSSIupeiqOnRh+8tFIoVhCON"
];
k900 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOi9vgVGs+S5kEsUqHPvyMMh1Q9gqL4TcbHoe5d73tun" ];
lukegb = [ ''cert-authority,principals="lukegb" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEqNOwlR7Qa8cbGpDfSCOweDPbAGQOZIcoRgh6s/J8DR'' ];
lukegb = [
''cert-authority,principals="lukegb" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEqNOwlR7Qa8cbGpDfSCOweDPbAGQOZIcoRgh6s/J8DR''
];
maxine = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILpWQfhNFdrxMTP/1DwBVuk49f3df9iH7Tbdu8ltIKjr" ];
raito = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICaw9ihTG7ucB8P38XdalEWev8+q96e2yNm4B+/I9IJp"
@ -49,6 +53,8 @@
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU"
];
thubrecht = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn" ];
yuka = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKath4/fDnlv/4fzxkPrQN1ttmoPRNu/m9bEtdPJBDfY cardno:16_933_242" ];
yuka = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKath4/fDnlv/4fzxkPrQN1ttmoPRNu/m9bEtdPJBDfY cardno:16_933_242"
];
};
}

View file

@ -1,4 +1,9 @@
{ pkgs, config, lib, ... }:
{
pkgs,
config,
lib,
...
}:
let
inherit (lib) mkIf mkEnableOption;
cfg = config.bagel.sysadmin;

View file

@ -1,4 +1,10 @@
{ lib, pkgs, config, ... }: {
{
lib,
pkgs,
config,
...
}:
{
users.defaultUserShell = pkgs.zsh;
programs.zsh = {
enable = true;

View file

@ -278,6 +278,22 @@
"type": "github"
}
},
"flake-compat_5": {
"flake": false,
"locked": {
"lastModified": 1696426674,
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-parts": {
"inputs": {
"nixpkgs-lib": [
@ -385,6 +401,27 @@
"type": "github"
}
},
"gitignore": {
"inputs": {
"nixpkgs": [
"pre-commit-hooks",
"nixpkgs"
]
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
}
},
"grapevine": {
"inputs": {
"attic": "attic",
@ -631,6 +668,22 @@
"type": "github"
}
},
"nixpkgs-stable_2": {
"locked": {
"lastModified": 1720386169,
"narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "194846768975b7ad2c4988bdb82572c00222c0d7",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1723151389,
@ -678,6 +731,29 @@
"type": "github"
}
},
"pre-commit-hooks_2": {
"inputs": {
"flake-compat": "flake-compat_5",
"gitignore": "gitignore",
"nixpkgs": [
"nixpkgs"
],
"nixpkgs-stable": "nixpkgs-stable_2"
},
"locked": {
"lastModified": 1723202784,
"narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "c7012d0c18567c889b948781bc74a501e92275d1",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
@ -691,6 +767,7 @@
],
"nix-gerrit": "nix-gerrit",
"nixpkgs": "nixpkgs_2",
"pre-commit-hooks": "pre-commit-hooks_2",
"terranix": "terranix"
}
},

View file

@ -29,15 +29,33 @@
repo = "grapevine-fork";
inputs.nixpkgs.follows = "nixpkgs";
};
pre-commit-hooks.url = "github:cachix/pre-commit-hooks.nix";
pre-commit-hooks.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = { self, nixpkgs, terranix, colmena, ... } @ inputs:
outputs =
{
self,
nixpkgs,
terranix,
colmena,
pre-commit-hooks,
...
}@inputs:
let
supportedSystems = [ "x86_64-linux" "aarch64-linux" ];
forEachSystem = f: builtins.listToAttrs (map (system: {
supportedSystems = [
"x86_64-linux"
"aarch64-linux"
];
forEachSystem =
f:
builtins.listToAttrs (
map (system: {
name = system;
value = f system;
}) supportedSystems);
}) supportedSystems
);
systemBits = forEachSystem (system: rec {
inherit system;
pkgs = import nixpkgs {
@ -64,20 +82,33 @@
inherit (nixpkgs) lib;
in
{
apps = forEachSystem' ({ system, pkgs, terraformCfg, terraform, ... }: {
apps = forEachSystem' (
{
system,
pkgs,
terraformCfg,
terraform,
...
}:
{
tf = {
type = "app";
program = toString (pkgs.writers.writeBash "tf" ''
program = toString (
pkgs.writers.writeBash "tf" ''
set -eo pipefail
ln -snf ${terraformCfg} config.tf.json
exec ${lib.getExe terraform} "$@"
'');
''
);
};
default = self.apps.${system}.tf;
});
}
);
devShells = forEachSystem' ({ system, pkgs, ... }: {
devShells = forEachSystem' (
{ system, pkgs, ... }:
{
default = pkgs.mkShell {
packages = [
inputs.agenix.packages.${system}.agenix
@ -86,12 +117,29 @@
(pkgs.callPackage ./lib/colmena-wrapper.nix { })
];
inherit (inputs.self.checks.${system}.pre-commit) shellHook;
};
});
}
);
checks = forEachSystem' (
{ system, pkgs, ... }:
{
pre-commit = pre-commit-hooks.lib.${system}.run {
src = ./.;
hooks.nixfmt = {
enable = true;
package = pkgs.nixfmt-rfc-style;
};
};
}
);
nixosConfigurations = (colmena.lib.makeHive self.outputs.colmena).nodes;
colmena = let
colmena =
let
commonModules = [
inputs.agenix.nixosModules.default
inputs.hydra.nixosModules.hydra
@ -102,13 +150,20 @@
./common
];
makeBuilder = i: lib.nameValuePair "builder-${toString i}" {
makeBuilder =
i:
lib.nameValuePair "builder-${toString i}" {
imports = commonModules;
bagel.baremetal.builders = { enable = true; num = i; netboot = i >= 6; };
bagel.baremetal.builders = {
enable = true;
num = i;
netboot = i >= 6;
};
};
builders = lib.listToAttrs (lib.genList makeBuilder 12);
in {
in
{
meta.nixpkgs = systemBits.x86_64-linux.pkgs;
meta.specialArgs.inputs = inputs;
@ -120,9 +175,12 @@
wob-vpn-gw.imports = commonModules ++ [ ./hosts/wob-vpn-gw ];
buildbot.imports = commonModules ++ [ ./hosts/buildbot ];
public01.imports = commonModules ++ [ ./hosts/public01 ];
} // builders;
}
// builders;
hydraJobs = builtins.mapAttrs (n: v: v.config.system.build.netbootDir or v.config.system.build.toplevel) self.nixosConfigurations;
hydraJobs = builtins.mapAttrs (
n: v: v.config.system.build.netbootDir or v.config.system.build.toplevel
) self.nixosConfigurations;
buildbotJobs = builtins.mapAttrs (_: v: v.config.system.build.toplevel) self.nixosConfigurations;
};
}

View file

@ -9,7 +9,11 @@
boot.specialFileSystems = lib.mkForce {
"/run/wrappers" = {
fsType = "tmpfs";
options = [ "nodev" "mode=755" "size=${config.security.wrapperDirSize}" ];
options = [
"nodev"
"mode=755"
"size=${config.security.wrapperDirSize}"
];
};
};
@ -24,13 +28,22 @@
nameservers = [ "2001:4860:4860::8844" ];
interfaces.host0.ipv6.addresses = [
{ address = "2001:bc8:38ee:100:100::1"; prefixLength = 64; }
{
address = "2001:bc8:38ee:100:100::1";
prefixLength = 64;
}
];
interfaces.host1.ipv4.addresses = [
{ address = "172.16.100.2"; prefixLength = 24; }
{
address = "172.16.100.2";
prefixLength = 24;
}
];
defaultGateway = { address = "172.16.100.1"; interface = "host1"; };
defaultGateway = {
address = "172.16.100.1";
interface = "host1";
};
firewall.allowPing = true;
};

View file

@ -32,9 +32,7 @@
bagel.services.gerrit = {
enable = true;
domains = [
"cl.forkos.org"
];
domains = [ "cl.forkos.org" ];
canonicalDomain = "cl.forkos.org";
data = "/gerrit-data";
};
@ -47,11 +45,23 @@
};
bagel.nixpkgs.one-way-sync =
let
mkNixpkgsJob = { timer, fromRefspec, localRefspec ? fromRefspec }: {
mkNixpkgsJob =
{
timer,
fromRefspec,
localRefspec ? fromRefspec,
}:
{
fromUri = "https://github.com/NixOS/nixpkgs";
inherit fromRefspec localRefspec timer;
};
mkLocalJob = { timer, fromRefspec, localRefspec }: {
mkLocalJob =
{
timer,
fromRefspec,
localRefspec,
}:
{
fromUri = "https://cl.forkos.org/nixpkgs";
inherit fromRefspec localRefspec timer;
};

View file

@ -27,9 +27,7 @@ in
# Add one additional IPv6, so we can have both OpenSSH and
# Forgejo's built-in server bind on port :22.
systemd.network.networks."10-wan".networkConfig.Address = [ "${ipv6.openssh}/64" ];
services.openssh.listenAddresses = [{
addr = "[${ipv6.openssh}]";
}];
services.openssh.listenAddresses = [ { addr = "[${ipv6.openssh}]"; } ];
# Defaults to network.target, but networkd may take a while to settle and set up
# the required (additional) IPv6 address, leading to sshd to not being able to
# bind to the requested IP, crashing 5 times and running into the default

View file

@ -27,9 +27,7 @@
bagel.services.grapevine.enable = true;
bagel.services.hookshot = {
enable = true;
admins = [
"@k900:0upti.me"
];
admins = [ "@k900:0upti.me" ];
};
i18n.defaultLocale = "fr_FR.UTF-8";

View file

@ -1,23 +1,27 @@
{ pkgs, lib, ... }:
{
imports = [
./netboot.nix
];
imports = [ ./netboot.nix ];
###### Hardware ######
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "sd_mod" "sdhci_pci" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"ehci_pci"
"sd_mod"
"sdhci_pci"
];
boot.kernelModules = [ "kvm-amd" ];
boot.loader.grub.device = "/dev/sda";
fileSystems."/" =
{ device = "/dev/disk/by-uuid/58688a5c-e3ce-4868-804b-4e34d1370f36";
fileSystems."/" = {
device = "/dev/disk/by-uuid/58688a5c-e3ce-4868-804b-4e34d1370f36";
fsType = "f2fs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/38caa628-3b6d-4fb4-8767-beee09a196a6";
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/38caa628-3b6d-4fb4-8767-beee09a196a6";
fsType = "ext2";
};
@ -65,7 +69,8 @@
};
};
};
networks = {
networks =
{
"40-enp1s0" = {
name = "enp1s0";
bond = [ "uplink" ];
@ -82,12 +87,18 @@
name = "enp4s0";
bond = [ "oob" ];
};
} // lib.listToAttrs (map (x: lib.nameValuePair "40-bmc${toString x}" {
}
// lib.listToAttrs (
map (
x:
lib.nameValuePair "40-bmc${toString x}" {
name = "bmc${toString x}";
address = [ "192.168.1.${toString (x * 4 + 1)}/30" ];
#address = [ "192.168.${toString x}.1/24" ];
networkConfig.DHCPServer = true;
}) (lib.genList lib.id 12));
}
) (lib.genList lib.id 12)
);
};
networking.nftables.enable = true;
@ -95,10 +106,15 @@
iifname { "bmc*" } meta nfproto ipv4 udp dport 67 accept comment "DHCP server"
'';
networking.vlans = lib.listToAttrs (map (x: lib.nameValuePair "bmc${toString x}" {
networking.vlans = lib.listToAttrs (
map (
x:
lib.nameValuePair "bmc${toString x}" {
interface = "oob";
id = 101 + x;
}) (lib.genList lib.id 12));
}
) (lib.genList lib.id 12)
);
networking.interfaces = {
uplink = {
@ -111,7 +127,10 @@
};
};
networking.defaultGateway6 = { interface = "uplink"; address = "2a01:584:11::1"; };
networking.defaultGateway6 = {
interface = "uplink";
address = "2a01:584:11::1";
};
networking.hostName = "vpn-gw";
networking.domain = "wob01.infra.forkos.org";

View file

@ -1,4 +1,11 @@
{ config, lib, pkgs, nodes, modulesPath, ... }:
{
config,
lib,
pkgs,
nodes,
modulesPath,
...
}:
# The way the connection is established is specific to the wob01 site and the Intel S2600KPR blades.
# Proper netboot is not possible, because while the blades and the APU board (which is the netboot
@ -10,8 +17,11 @@
let
netboot-server-ip = "2a01:584:11::2";
netbootNodes = lib.filterAttrs (_: node: node.config.bagel.baremetal.builders.enable && node.config.bagel.baremetal.builders.netboot) nodes;
in {
netbootNodes = lib.filterAttrs (
_: node: node.config.bagel.baremetal.builders.enable && node.config.bagel.baremetal.builders.netboot
) nodes;
in
{
assertions = [
{
@ -23,10 +33,13 @@ in {
}
];
systemd.services = lib.mapAttrs' (nodename: node: let
systemd.services = lib.mapAttrs' (
nodename: node:
let
bmcIp = "192.168.1.${toString (node.config.bagel.baremetal.builders.num * 4 + 2)}";
notipxe = node.config.system.build.notipxe.config.system.build.usbImage;
in lib.nameValuePair "iusb-spoof-${nodename}" {
in
lib.nameValuePair "iusb-spoof-${nodename}" {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Restart = "always";
@ -35,7 +48,8 @@ in {
AUTH_TOKEN=$(${pkgs.iusb-spoof}/bin/make-token ${bmcIp})
exec ${pkgs.iusb-spoof}/bin/iusb-spoof -r ${bmcIp} 5123 $AUTH_TOKEN ${notipxe}
'';
}) netbootNodes;
}
) netbootNodes;
# Since the builders are stateless, they can not store their ssh hostkeys
networking.firewall.allowedTCPPorts = [ 80 ]; # for ACME
@ -49,15 +63,19 @@ in {
virtualHosts."vpn-gw.wob01.infra.forkos.org" = {
enableACME = true;
forceSSL = true;
locations = lib.mapAttrs' (nodename: node: let
locations = lib.mapAttrs' (
nodename: node:
let
ip = "2a01:584:11::1:${toString node.config.bagel.baremetal.builders.num}";
in lib.nameValuePair "/${nodename}/" {
in
lib.nameValuePair "/${nodename}/" {
root = "/var/www";
extraConfig = ''
allow ${ip};
deny all;
'';
}) netbootNodes;
}
) netbootNodes;
};
};
}

View file

@ -1,10 +1,7 @@
# A wrapper for colmena that prevents accidentally deploying changes without
# having pulled.
{ colmena, runCommandNoCC }:
runCommandNoCC "colmena-wrapper"
{
env.colmena = "${colmena}/bin/colmena";
} ''
runCommandNoCC "colmena-wrapper" { env.colmena = "${colmena}/bin/colmena"; } ''
mkdir -p $out
ln -s ${colmena}/share $out/share
mkdir $out/bin

View file

@ -1,4 +1,8 @@
{ rustPlatform, python3, makeWrapper }:
{
rustPlatform,
python3,
makeWrapper,
}:
let
pythonEnv = python3.withPackages (p: with p; [ requests ]);
in

View file

@ -11,9 +11,7 @@ buildGoModule rec {
hash = "sha256-8zA3pHf45MdUcq/MA/mf0KCTxB1viHieU/oigYwIPgo=";
};
patches = [
./u-root-allow-https.patch
];
patches = [ ./u-root-allow-https.patch ];
vendorHash = null;
doCheck = false;

View file

@ -12,7 +12,10 @@ let
mimir-webhook-url = [ machines.meta01 ];
grafana-oauth-secret = [ machines.meta01 ];
loki-environment = [ machines.meta01 ];
gerrit-prometheus-bearer-token = [ machines.gerrit01 machines.meta01 ];
gerrit-prometheus-bearer-token = [
machines.gerrit01
machines.meta01
];
buildbot-worker-password = [ machines.buildbot ];
buildbot-oauth-secret = [ machines.buildbot ];

View file

@ -1,29 +1,61 @@
# This file contains information on which builder(s) are providing how many
# job slots and providing which nix features
let
genBuilders = { offset ? 0, count, f }: builtins.genList (x: rec { name = "builder-${toString (offset + x)}"; value = f name; }) count;
in builtins.listToAttrs (
genBuilders =
{
offset ? 0,
count,
f,
}:
builtins.genList (x: rec {
name = "builder-${toString (offset + x)}";
value = f name;
}) count;
in
builtins.listToAttrs (
# The first 8 builders are general purpose hydra builders
genBuilders { count = 8; f = name: {
genBuilders {
count = 8;
f = name: {
cores = 8;
max-jobs = 8;
supported-features = [ "kvm" "nixos-test" ];
supported-features = [
"kvm"
"nixos-test"
];
required-features = [ ];
}; }
};
}
++
# The last 2 builders are exclusively for big-parallel
genBuilders { offset = 8; count = 2; f = name: {
genBuilders {
offset = 8;
count = 2;
f = name: {
cores = 20;
max-jobs = 1;
supported-features = [ "kvm" "nixos-test" "big-parallel" ];
supported-features = [
"kvm"
"nixos-test"
"big-parallel"
];
required-features = [ "big-parallel" ];
}; }
};
}
++
# These are not currently used for hydra
genBuilders { offset = 10; count = 2; f = name: {
genBuilders {
offset = 10;
count = 2;
f = name: {
cores = 8;
max-jobs = 8;
supported-features = [ "kvm" "nixos-test" "big-parallel" ];
supported-features = [
"kvm"
"nixos-test"
"big-parallel"
];
required-features = [ ];
}; }
};
}
)

View file

@ -1,4 +1,9 @@
{ pkgs, lib, config, ... }:
{
pkgs,
lib,
config,
...
}:
let
cfg = config.bagel.baremetal.builders;
in
@ -10,14 +15,18 @@ in
bagel.baremetal.builders = {
enable = lib.mkEnableOption "baremetal bagel oven";
netboot = lib.mkEnableOption "netboot";
num = lib.mkOption {
type = lib.types.int;
};
num = lib.mkOption { type = lib.types.int; };
};
};
config = lib.mkIf cfg.enable {
boot.initrd.availableKernelModules = [ "ahci" "ehci_pci" "usb_storage" "usbhid" "sd_mod" ];
boot.initrd.availableKernelModules = [
"ahci"
"ehci_pci"
"usb_storage"
"usbhid"
"sd_mod"
];
boot.initrd.kernelModules = [ "dm-snapshot" ];
users.users.builder = {
@ -44,7 +53,10 @@ in
];
};
nix.settings = {
trusted-users = [ "builder" "buildbot" ];
trusted-users = [
"builder"
"buildbot"
];
inherit ((import ./assignments.nix).${config.networking.hostName}) max-jobs cores;
};
@ -68,7 +80,10 @@ in
"/boot" = {
device = "/dev/disk/by-label/BOOT";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
options = [
"fmask=0022"
"dmask=0022"
];
};
})
{
@ -132,9 +147,15 @@ in
};
};
networking.interfaces.uplink.ipv6.addresses = [
{ address = "2a01:584:11::1:${toString cfg.num}"; prefixLength = 64; }
{
address = "2a01:584:11::1:${toString cfg.num}";
prefixLength = 64;
}
];
networking.defaultGateway6 = { interface = "uplink"; address = "2a01:584:11::1"; };
networking.defaultGateway6 = {
interface = "uplink";
address = "2a01:584:11::1";
};
deployment.targetHost = "2a01:584:11::1:${toString cfg.num}";
deployment.tags = [ "builders" ];

View file

@ -1,4 +1,11 @@
{ modulesPath, pkgs, lib, config, extendModules, ... }@node:
{
modulesPath,
pkgs,
lib,
config,
extendModules,
...
}@node:
let
cfg = config.bagel.baremetal.builders;
in
@ -32,8 +39,20 @@ in
{
system.stateVersion = "24.11";
boot.initrd.availableKernelModules = [ "ahci" "ehci_pci" "usb_storage" "usbhid" "sd_mod" "igb" "bonding" ];
boot.kernelParams = [ "console=ttyS0,115200" "panic=1" "boot.panic_on_fail" ];
boot.initrd.availableKernelModules = [
"ahci"
"ehci_pci"
"usb_storage"
"usbhid"
"sd_mod"
"igb"
"bonding"
];
boot.kernelParams = [
"console=ttyS0,115200"
"panic=1"
"boot.panic_on_fail"
];
#boot.initrd.systemd.emergencyAccess = true;
networking.hostName = "${node.config.networking.hostName}-boot";
nixpkgs.overlays = import ../../overlays;
@ -72,11 +91,32 @@ in
'';
# Provide a bootable USB drive image
system.build.usbImage = pkgs.callPackage ({ stdenv, runCommand, dosfstools, e2fsprogs, mtools, libfaketime, util-linux, nukeReferences }:
runCommand "boot-img-${node.config.networking.hostName}" {
nativeBuildInputs = [ dosfstools e2fsprogs libfaketime mtools util-linux ];
outputs = [ "out" "firmware_part" ];
} ''
system.build.usbImage = pkgs.callPackage (
{
stdenv,
runCommand,
dosfstools,
e2fsprogs,
mtools,
libfaketime,
util-linux,
nukeReferences,
}:
runCommand "boot-img-${node.config.networking.hostName}"
{
nativeBuildInputs = [
dosfstools
e2fsprogs
libfaketime
mtools
util-linux
];
outputs = [
"out"
"firmware_part"
];
}
''
export img=$out
truncate -s 40M $img
@ -128,8 +168,7 @@ in
cp firmware_part.img $firmware_part
''
) { };
}
;
};
};
# This is the config which will actually be booted
@ -145,7 +184,8 @@ in
];
};
# A derivation combining all the artifacts required for netbooting for the hydra job
netbootDir = let
netbootDir =
let
kernelTarget = pkgs.stdenv.hostPlatform.linux-kernel.target;
build = config.system.build.netbootVariant.config.system.build;
in

View file

@ -9,24 +9,33 @@ let
cfg = config.bagel.services.buildbot;
cfgGerrit = nodes.gerrit01.config.bagel.services.gerrit;
ssh-keys = import ../../common/ssh-keys.nix;
inherit (lib) mkEnableOption mkOption mkIf types;
inherit (lib)
mkEnableOption
mkOption
mkIf
types
;
in
{
options.bagel.services.buildbot = {
enable = mkEnableOption "Buildbot";
domain = mkOption {
type = types.str;
};
domain = mkOption { type = types.str; };
builders = mkOption {
type = types.listOf types.str;
description = "List of builders to configure for Buildbot";
example = [ "builder-2" "builder-3" ];
example = [
"builder-2"
"builder-3"
];
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [
80
443
];
age.secrets.buildbot-worker-password.file = ../../secrets/buildbot-worker-password.age;
age.secrets.buildbot-oauth-secret.file = ../../secrets/buildbot-oauth-secret.age;
age.secrets.buildbot-workers.file = ../../secrets/buildbot-workers.age;
@ -59,15 +68,14 @@ in
{
# nix-eval-jobs runs under a lock, error reports do not (but are cheap)
other = 8;
} // (
lib.filterAttrs
(n: v: lib.elem n config.services.buildbot-nix.coordinator.buildSystems)
(lib.zipAttrsWith
(_: lib.foldl' lib.add 0)
(lib.concatMap
(m: map (s: { ${s} = m.maxJobs; }) m.systems)
config.services.buildbot-nix.coordinator.buildMachines))
);
}
// (lib.filterAttrs (n: v: lib.elem n config.services.buildbot-nix.coordinator.buildSystems) (
lib.zipAttrsWith (_: lib.foldl' lib.add 0) (
lib.concatMap (
m: map (s: { ${s} = m.maxJobs; }) m.systems
) config.services.buildbot-nix.coordinator.buildMachines
)
));
};
services.buildbot-nix.coordinator = {
@ -90,14 +98,10 @@ in
# we can replace all of this with automatic localworker generation on buildbot-nix side.
workersFile = config.age.secrets.buildbot-workers.path;
allowedOrigins = [
"*.forkos.org"
];
allowedOrigins = [ "*.forkos.org" ];
# TODO(raito): is that really necessary when we can just collect buildMachines' systems?
buildSystems = [
"x86_64-linux"
];
buildSystems = [ "x86_64-linux" ];
buildMachines = map (n: {
hostName = nodes.${n}.config.networking.fqdn;
@ -110,8 +114,7 @@ in
supportedFeatures = nodes.${n}.config.nix.settings.system-features;
# Contrary to how Nix works, here we can specify non-base64 public host keys.
publicHostKey = ssh-keys.machines.${n};
}
) cfg.builders;
}) cfg.builders;
gerrit = {
domain = cfgGerrit.canonicalDomain;

View file

@ -1,18 +1,25 @@
{ pkgs, lib, config, ... }:
{
pkgs,
lib,
config,
...
}:
let
cfg = config.bagel.services.forgejo;
inherit (lib) mkIf mkEnableOption mkOption types;
inherit (lib)
mkIf
mkEnableOption
mkOption
types
;
domain = "git.forkos.org";
in
{
options.bagel.services.forgejo = {
enable = mkEnableOption "Forgejo";
sshBindAddr = mkOption {
type = types.str;
};
sshBindAddr = mkOption { type = types.str; };
};
config = mkIf cfg.enable {
@ -116,8 +123,14 @@ in
# start Forgejo *after* sshd.service, so in case Forgejo tries to wildcard bind :22 due to
# a bug or whatever, we don't lose OpenSSH in a race.
wants = [ "sshd.service" "redis-forgejo.service" ];
requires = [ "sshd.service" "redis-forgejo.service" ];
wants = [
"sshd.service"
"redis-forgejo.service"
];
requires = [
"sshd.service"
"redis-forgejo.service"
];
};
services.redis.servers.forgejo = {

View file

@ -1,9 +1,20 @@
# Gerrit configuration for the Nixpkgs monorepo
# Inspired from TVL configuration.
{ pkgs, config, lib, ... }:
{
pkgs,
config,
lib,
...
}:
let
inherit (lib) mkEnableOption mkIf mkOption types head;
inherit (lib)
mkEnableOption
mkIf
mkOption
types
head
;
cfgGerrit = config.services.gerrit;
cfg = config.bagel.services.gerrit;
@ -74,7 +85,8 @@ in
oauth
metrics-reporter-prometheus
# Buildbot checks plugin (writeText because services.gerrit.plugins expects packages)
(pkgs.runCommand "checks.js" {
(pkgs.runCommand "checks.js"
{
BASE_URI = builtins.toJSON "https://buildbot.forkos.org";
SUPPORTED_PROJECTS = builtins.toJSON [
"infra"
@ -87,7 +99,8 @@ in
substitute ${./checks.js} $out \
--replace-fail "@BASE_URI@" "$BASE_URI" \
--replace-fail "@SUPPORTED_PROJECTS@" "$SUPPORTED_PROJECTS"
'')
''
)
];
package = pkgs.gerrit;

View file

@ -1,9 +1,23 @@
{ lib, config, pkgs, ... }:
{
lib,
config,
pkgs,
...
}:
let
cfg = config.bagel.nixpkgs.one-way-sync;
inherit (lib) mkIf mkOption mkEnableOption types mapAttrs';
inherit (lib)
mkIf
mkOption
mkEnableOption
types
mapAttrs'
;
mkSyncTimer = name: { timer, ... }: {
mkSyncTimer =
name:
{ timer, ... }:
{
wantedBy = [ "timers.target" ];
timerConfig = {
@ -12,9 +26,22 @@ let
Unit = "ows-${name}.service";
};
};
mkSyncService = name: { fromUri, fromRefspec, localRefspec, ... }: {
path = [ pkgs.gitFull pkgs.openssh pkgs.lix ];
script = ''
mkSyncService =
name:
{
fromUri,
fromRefspec,
localRefspec,
...
}:
{
path = [
pkgs.gitFull
pkgs.openssh
pkgs.lix
];
script =
''
set -xe
RUNTIME_DIRECTORY="/run/onewaysync-${name}"
trap "git worktree remove -f "$RUNTIME_DIRECTORY"/${name}" EXIT
@ -34,15 +61,19 @@ let
git config user.name Fork-o-Tron
git config user.email noreply@forkos.org
git fetch ${fromUri} ${fromRefspec}
'' + lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
''
+ lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
OLD_STDENV=$(nix eval -f . stdenv.outPath --store "$RUNTIME_DIRECTORY")
'' + ''
''
+ ''
git merge FETCH_HEAD
'' + lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
''
+ lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
NEW_STDENV=$(nix eval -f . stdenv.outPath --store "$RUNTIME_DIRECTORY")
# Do not allow auto-merging a staging iteration
test "$OLD_STDENV" = "$NEW_STDENV"
'' + ''
''
+ ''
GIT_SSH_COMMAND='ssh -i ${cfg.deployKeyPath}' git push ${cfg.pushUrl} HEAD:refs/heads/${localRefspec}
'';
serviceConfig = {
@ -84,7 +115,9 @@ in
};
branches = mkOption {
type = types.attrsOf (types.submodule ({ ... }:
type = types.attrsOf (
types.submodule (
{ ... }:
{
options = {
name = mkOption {
@ -112,7 +145,9 @@ in
description = "Calendar format everytime we need to run the sync";
};
};
}));
}
)
);
description = "Set of branches mapping from cl.forkos.org to other Git repositories";
};

View file

@ -36,6 +36,9 @@ in
'';
};
networking.firewall.allowedTCPPorts = [ 443 80 ];
networking.firewall.allowedTCPPorts = [
443
80
];
};
}

View file

@ -1,4 +1,10 @@
{ nodes, config, lib, pkgs, ... }:
{
nodes,
config,
lib,
pkgs,
...
}:
let
cfg = config.bagel.services.hydra;
@ -7,46 +13,66 @@ let
narCacheDir = "/var/cache/hydra/nar-cache";
port = 3000;
mkCacheSettings = settings: builtins.concatStringsSep "&" (
lib.mapAttrsToList (k: v: "${k}=${v}") settings
);
mkCacheSettings =
settings: builtins.concatStringsSep "&" (lib.mapAttrsToList (k: v: "${k}=${v}") settings);
# XXX: to support Nix's dumb public host key syntax (base64'd), this outputs
# a string with shell-style command interpolations: $(...).
mkBaremetalBuilder = {
mkBaremetalBuilder =
{
parallelBuilds,
publicHostKey,
host,
speedFactor ? 1,
user ? "builder",
supportedSystems ? [ "i686-linux" "x86_64-linux" ],
supportedFeatures ? [ "big-parallel" "kvm" "nixos-test" ],
requiredFeatures ? [ ]
supportedSystems ? [
"i686-linux"
"x86_64-linux"
],
supportedFeatures ? [
"big-parallel"
"kvm"
"nixos-test"
],
requiredFeatures ? [ ],
}:
let
supportedFeatures_ = if (supportedFeatures != []) then lib.concatStringsSep "," supportedFeatures else "-";
requiredFeatures_ = if (requiredFeatures != []) then lib.concatStringsSep "," requiredFeatures else "-";
supportedFeatures_ =
if (supportedFeatures != [ ]) then lib.concatStringsSep "," supportedFeatures else "-";
requiredFeatures_ =
if (requiredFeatures != [ ]) then lib.concatStringsSep "," requiredFeatures else "-";
in
"ssh://${user}@${host}?remote-store=/mnt ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString parallelBuilds} ${toString speedFactor} ${supportedFeatures_} ${requiredFeatures_} $(echo -n '${publicHostKey}' | base64 -w0)";
# TODO:
# - generalize to new architectures
# - generalize to new features
baremetalBuilders = lib.concatStringsSep "\n"
(map (n: let
assignments = (import ../baremetal-builder/assignments.nix).${n} or {
baremetalBuilders = lib.concatStringsSep "\n" (
map (
n:
let
assignments =
(import ../baremetal-builder/assignments.nix).${n} or {
inherit (nodes.${n}.config.nix.settings) max-jobs;
supported-features = [ "big-parallel" "kvm" "nixos-test" ];
supported-features = [
"big-parallel"
"kvm"
"nixos-test"
];
required-features = [ ];
};
in mkBaremetalBuilder {
in
mkBaremetalBuilder {
parallelBuilds = assignments.max-jobs;
supportedFeatures = assignments.supported-features;
requiredFeatures = assignments.required-features;
publicHostKey = ssh-keys.machines.${n};
host = nodes.${n}.config.networking.fqdn;
}) cfg.builders);
in {
}
) cfg.builders
);
in
{
options.bagel.services.hydra = with lib; {
enable = mkEnableOption "Hydra coordinator";
@ -58,7 +84,10 @@ in {
builders = mkOption {
type = types.listOf types.str;
description = "List of builders to configure for Hydra";
example = [ "builder-0" "builder-1" ];
example = [
"builder-0"
"builder-1"
];
};
};
@ -83,7 +112,12 @@ in {
# XXX: Otherwise services.hydra-dev overwrites it to only hydra-queue-runner...
#
# Can be removed once this is added to some common config template.
nix.settings.trusted-users = [ "root" "hydra" "hydra-www" "@wheel" ];
nix.settings.trusted-users = [
"root"
"hydra"
"hydra-www"
"@wheel"
];
# Because Hydra can't fetch flake inputs otherwise... also yes, this
# prefix-based matching is absurdly bad.
@ -119,7 +153,8 @@ in {
];
extraConfig = ''
store_uri = s3://bagel-cache?${mkCacheSettings {
store_uri = s3://bagel-cache?${
mkCacheSettings {
endpoint = "s3.delroth.net";
region = "garage";
@ -130,7 +165,8 @@ in {
ls-compression = "br";
write-nar-listing = "1";
}}
}
}
server_store_uri = https://bagel-cache.s3-web.delroth.net?local-nar-cache=${narCacheDir}
binary_cache_public_url = https://bagel-cache.s3-web.delroth.net
@ -186,6 +222,9 @@ in {
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [
80
443
];
};
}

View file

@ -6,7 +6,12 @@
}:
let
cfg = config.bagel.services.hookshot;
inherit (lib) mkEnableOption mkIf mkOption types;
inherit (lib)
mkEnableOption
mkIf
mkOption
types
;
keyPath = "/var/lib/matrix-hookshot/key.pem";
in
{
@ -50,21 +55,25 @@ in
bindAddress = "127.0.0.1";
};
passFile = keyPath;
listeners = [{
listeners = [
{
port = 9994;
bindAddress = "127.0.0.1";
resources = [ "webhooks" ];
}];
}
];
generic = {
enabled = true;
urlPrefix = "https://alerts.forkos.org/webhook";
};
permissions = map (mxid: {
actor = mxid;
services = [{
services = [
{
service = "*";
level = "admin";
}];
}
];
}) cfg.admins;
};

View file

@ -1,16 +1,19 @@
{
config,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.bagel.monitoring.grafana-agent;
inherit (lib) mkEnableOption mkOption mkIf types;
inherit (lib)
mkEnableOption
mkOption
mkIf
types
;
passwordAsCredential = "\${CREDENTIALS_DIRECTORY}/password";
in
{
options.bagel.monitoring.grafana-agent = {
enable = (mkEnableOption "Grafana Agent") // { default = true; };
enable = (mkEnableOption "Grafana Agent") // {
default = true;
};
exporters = mkOption {
description = ''
@ -20,7 +23,10 @@ in
internally, which ends up exported as `job` label
on all metrics of that exporter.
'';
type = types.attrsOf (types.submodule ({ config, name, ... }: {
type = types.attrsOf (
types.submodule (
{ config, name, ... }:
{
options.port = mkOption {
description = "Exporter port";
type = types.int;
@ -35,14 +41,15 @@ in
description = "Prometheus scrape config";
type = types.attrs;
};
config.scrapeConfig = lib.mkMerge [{
config.scrapeConfig = lib.mkMerge [
{
job_name = name;
static_configs = [
{ targets = [ "localhost:${toString config.port}" ]; }
];
} (lib.mkIf (config.bearerTokenFile != null) {
static_configs = [ { targets = [ "localhost:${toString config.port}" ]; } ];
}
(lib.mkIf (config.bearerTokenFile != null) {
authorization.credentials_file = "\${CREDENTIALS_DIRECTORY}/${name}-bearer-token";
})];
})
];
options.secrets = mkOption {
description = "Secrets required for scrape config";
@ -53,7 +60,9 @@ in
config.secrets = lib.mkIf (config.bearerTokenFile != null) {
"${name}-bearer-token" = config.bearerTokenFile;
};
}));
}
)
);
default = { };
};
};
@ -63,8 +72,10 @@ in
services.grafana-agent = {
enable = true;
credentials = lib.mkMerge ([{ password = config.age.secrets.grafana-agent-password.path; }] ++
lib.mapAttrsToList (name: value: value.secrets) config.bagel.monitoring.grafana-agent.exporters);
credentials = lib.mkMerge (
[ { password = config.age.secrets.grafana-agent-password.path; } ]
++ lib.mapAttrsToList (name: value: value.secrets) config.bagel.monitoring.grafana-agent.exporters
);
settings = {
metrics = {
global.remote_write = [
@ -80,7 +91,9 @@ in
configs = [
{
name = config.networking.hostName;
scrape_configs = lib.mapAttrsToList (name: value: value.scrapeConfig) config.bagel.monitoring.grafana-agent.exporters;
scrape_configs = lib.mapAttrsToList (
name: value: value.scrapeConfig
) config.bagel.monitoring.grafana-agent.exporters;
}
];
};

View file

@ -1,14 +1,12 @@
{
config,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.bagel.monitoring.exporters.cadvisor;
inherit (lib) mkEnableOption mkIf;
in
{
options.bagel.monitoring.exporters.cadvisor.enable = (mkEnableOption "Standard cAdvisor") // { default = !config.boot.isContainer; };
options.bagel.monitoring.exporters.cadvisor.enable = (mkEnableOption "Standard cAdvisor") // {
default = !config.boot.isContainer;
};
config = mkIf cfg.enable {
services.cadvisor = {

View file

@ -1,15 +1,13 @@
{
config,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.bagel.monitoring.exporters.nginx;
inherit (lib) mkEnableOption mkIf;
logFormat = ''$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" rt=$request_time uct="$upstream_connect_time" uht="$upstream_header_time" urt="$upstream_response_time"'';
in
{
options.bagel.monitoring.exporters.nginx.enable = (mkEnableOption "Nginx access.log exporter") // { default = config.services.nginx.enable; };
options.bagel.monitoring.exporters.nginx.enable = (mkEnableOption "Nginx access.log exporter") // {
default = config.services.nginx.enable;
};
config = mkIf cfg.enable {
services.nginx.appendHttpConfig = ''

View file

@ -1,14 +1,12 @@
{
config,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.bagel.monitoring.exporters.postgres;
inherit (lib) mkEnableOption mkIf;
in
{
options.bagel.monitoring.exporters.postgres.enable = (mkEnableOption "Postgres exporter") // { default = config.services.postgresql.enable; };
options.bagel.monitoring.exporters.postgres.enable = (mkEnableOption "Postgres exporter") // {
default = config.services.postgresql.enable;
};
config = mkIf cfg.enable {
services.prometheus.exporters.postgres = {

View file

@ -1,8 +1,4 @@
{
config,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.bagel.services.grafana;
inherit (lib) mkEnableOption mkIf;
@ -133,9 +129,11 @@ in
];
};
nginx = let
nginx =
let
scfg = config.services.grafana.settings.server;
in {
in
{
enable = true;
virtualHosts."${scfg.domain}" = {
enableACME = true;

View file

@ -1,8 +1,4 @@
{
config,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.bagel.services.loki;
inherit (lib) mkEnableOption mkIf;

View file

@ -76,11 +76,13 @@ in
receivers = [
{
name = "matrix";
webhook_configs = [{
webhook_configs = [
{
# Mimir can't expand environment variables in external config files,
# so work around it.
url_file = "/run/credentials/mimir.service/webhook-url";
}];
}
];
}
];
};

View file

@ -8,15 +8,18 @@
let
EnvironmentFile = [ config.age.secrets.netbox-environment.path ];
cfg = config.bagel.services.netbox;
inherit (lib) mkEnableOption mkOption mkIf types;
inherit (lib)
mkEnableOption
mkOption
mkIf
types
;
in
{
options.bagel.services.netbox = {
enable = mkEnableOption "Netbox";
domain = mkOption {
type = types.str;
};
domain = mkOption { type = types.str; };
};
config = mkIf cfg.enable {

View file

@ -5,7 +5,8 @@ let
amqpHost = "amqp.forkos.org";
amqpPort = 5671;
in {
in
{
options.bagel.services.ofborg = with lib; {
enable = mkEnableOption "ofborg coordinator";
};
@ -26,8 +27,7 @@ in {
webroot = "/var/lib/acme/.challenges";
group = "rabbitmq";
};
services.nginx.virtualHosts.${amqpHost}.locations."/.well-known/acme-challenge".root =
"/var/lib/acme/.challenges";
services.nginx.virtualHosts.${amqpHost}.locations."/.well-known/acme-challenge".root = "/var/lib/acme/.challenges";
systemd.services.rabbitmq.requires = [ "acme-finished-${amqpHost}.target" ];
networking.firewall.allowedTCPPorts = [ amqpPort ];

View file

@ -1,10 +1,16 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.bagel.services.postgres;
dataDir = "/var/db/postgresql/16";
in {
in
{
options.bagel.services.postgres = with lib; {
enable = mkEnableOption "PostgreSQL server";
};

View file

@ -1,6 +1,11 @@
{ lib, config, ... }:
let
inherit (lib) mkEnableOption mkIf tf genList;
inherit (lib)
mkEnableOption
mkIf
tf
genList
;
cfg = config.bagel.gandi;
in
{
@ -24,9 +29,15 @@ in
name = "forkos.org";
};
resource.gandi_livedns_record = let
resource.gandi_livedns_record =
let
record = name: ttl: type: values: {
inherit name ttl type values;
inherit
name
ttl
type
values
;
};
proxyRecords = name: ttl: type: values: [
@ -36,26 +47,45 @@ in
];
# Creates a extra *.p record pointing to the sniproxy
dualProxyRecords = name: ttl: type: values: lib.flatten [
dualProxyRecords =
name: ttl: type: values:
lib.flatten [
(record name ttl type values)
(proxyRecords "${name}.p" ttl type values)
];
# TODO: make less fragile and have actual unique and stable names
canonicalName = record: let
name = builtins.replaceStrings ["." "@"] ["_" "_root_"] record.name;
canonicalName =
record:
let
name =
builtins.replaceStrings
[
"."
"@"
]
[
"_"
"_root_"
]
record.name;
in
"forkos_org_${record.type}_${name}";
forkosRecords = records:
builtins.listToAttrs (map (record: {
forkosRecords =
records:
builtins.listToAttrs (
map (record: {
name = canonicalName record;
value = record // {
zone = tf.ref "resource.gandi_livedns_domain.forkos_org.id";
};
}) (lib.flatten records));
}) (lib.flatten records)
);
in forkosRecords ([
in
forkosRecords (
[
# (record "@" 3600 "A" ["163.172.69.160"])
(record "@" 3600 "AAAA" [ "2001:bc8:38ee:100:1000::20" ])
@ -90,6 +120,11 @@ in
(record "vpn-gw.wob01.infra" 3600 "AAAA" [ "2a01:584:11::2" ])
# TODO: do not hardcode, just reuse the Colmena hive module outputs to generate all the required details.
] ++ map (index: record "builder-${toString index}.wob01.infra" 3600 "AAAA" [ "2a01:584:11::1:${toString index}" ]) (genList lib.id 12));
]
++ map (
index:
record "builder-${toString index}.wob01.infra" 3600 "AAAA" [ "2a01:584:11::1:${toString index}" ]
) (genList lib.id 12)
);
};
}

View file

@ -1,6 +1,12 @@
{ lib, config, ... }:
let
inherit (lib) mkEnableOption mkIf types mkOption tf;
inherit (lib)
mkEnableOption
mkIf
types
mkOption
tf
;
cfg = config.bagel.hydra;
in
{