common/base-server.nix

@@ -57,7 +57,4 @@
   ];
 
   time.timeZone = "UTC";
-
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "infra@forkos.org";
 }

common/raito-vm.nix

@@ -30,6 +30,8 @@ in
   config = mkIf cfg.enable {
     services.qemuGuest.enable = true;
     systemd.network.enable = true;
+    security.acme.defaults.email = "bagel-acme@lahfa.xyz";
+    security.acme.acceptTerms = true;
     networking.useDHCP = lib.mkDefault false;
 
     systemd.network.networks."10-nat-lan" = {

hosts/bagel-box/default.nix

@@ -37,11 +37,19 @@
 
   bagel.services = {
     postgres.enable = true;
+
+    hydra.enable = true;
+    # Takes 10 builders (0 → 9).
+    hydra.builders = lib.genList (i: "builder-${builtins.toString i}") 10;
+
     ofborg.enable = true;
   };
 
   bagel.sysadmin.enable = true;
 
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "infra@forkos.org";
+
   services.openssh.enable = true;
 
   system.stateVersion = "24.11";

hosts/build-coord/default.nix

@@ -1,4 +1,3 @@
-{ lib, ... }:
 {
   imports = [ ./hardware.nix ];
 
@@ -7,12 +6,6 @@
 
   bagel.sysadmin.enable = true;
 
-  bagel.services = {
-    hydra.enable = true;
-    # Takes 10 builders (0 → 9).
-    hydra.builders = lib.genList (i: "builder-${builtins.toString i}") 10;
-  };
-
   system.stateVersion = "24.05";
   deployment.targetHost = "build-coord.wob01.infra.forkos.org";
 }

hosts/wob-vpn-gw/netboot.nix

@@ -42,6 +42,8 @@ in {
   networking.firewall.extraInputRules = ''
     ip6 saddr 2a01:584:11::/64 tcp sport < 1024 tcp dport 443 accept;
   '';
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "infra@forkos.org";
   services.nginx = {
     enable = true;
     virtualHosts."vpn-gw.wob01.infra.forkos.org" = {

secrets.nix

@@ -4,10 +4,10 @@ let
   commonKeys = keys.users.delroth ++ keys.users.raito;
 
   secrets = with keys; {
-    hydra-postgres-key = [ machines.build-coord ];
-    hydra-s3-credentials = [ machines.build-coord ];
-    hydra-signing-priv = [ machines.build-coord ];
-    hydra-ssh-key-priv = [ machines.build-coord ];
+    hydra-postgres-key = [ machines.bagel-box ];
+    hydra-s3-credentials = [ machines.bagel-box ];
+    hydra-signing-priv = [ machines.bagel-box ];
+    hydra-ssh-key-priv = [ machines.bagel-box ];
 
     netbox-environment = [ machines.meta01 ];
     mimir-environment = [ machines.meta01 ];

services/hydra/default.nix

@@ -100,7 +100,7 @@ in {
     services.hydra-dev = {
       enable = true;
 
-      listenHost = "127.0.0.1";
+      listenHost = "localhost";
       port = port;
 
       dbi = "dbi:Pg:${mkPgConnString {

terraform/gandi.nix

@@ -56,43 +56,43 @@ in
         }) (lib.flatten records));
 
     in forkosRecords ([
-      # (record "@" 300 "A" ["163.172.69.160"])
-      (record "@" 300 "AAAA" ["2001:bc8:38ee:100:1000::20"])
+      # (record "@" 3600 "A" ["163.172.69.160"])
+      (record "@" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
 
-      (dualProxyRecords "bagel-box.infra" 300 "AAAA" ["2001:bc8:38ee:100:100::1"])
-      (dualProxyRecords "gerrit01.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::10"])
-      (dualProxyRecords "meta01.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::20"])
-      (dualProxyRecords "fodwatch.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::30"])
+      (dualProxyRecords "bagel-box.infra" 3600 "AAAA" ["2001:bc8:38ee:100:100::1"])
+      (dualProxyRecords "gerrit01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
+      (dualProxyRecords "meta01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
+      (dualProxyRecords "fodwatch.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
       # git.infra.forkos.org exposes opensshd
-      (dualProxyRecords "git.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::41"])
+      (dualProxyRecords "git.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::41"])
       # git.p.forkos.org exposes forgejo ssh server.
-      (proxyRecords "git.p" 300 "AAAA" ["2001:bc8:38ee:100:1000::40"])
-      (dualProxyRecords "buildbot.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::50"])
-      (dualProxyRecords "public01.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::60"])
+      (proxyRecords "git.p" 3600 "AAAA" ["2001:bc8:38ee:100:1000::40"])
+      (dualProxyRecords "buildbot.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::50"])
+      (dualProxyRecords "public01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::60"])
 
-      (record "cl" 300 "CNAME" ["gerrit01.infra.p"])
-      (record "fodwatch" 300 "CNAME" ["fodwatch.infra.p"])
+      (record "cl" 3600 "CNAME" ["gerrit01.infra.p"])
+      (record "fodwatch" 3600 "CNAME" ["fodwatch.infra.p"])
       # git.p.forkos.org is the proxy variant of the Forgejo server.
-      (record "git" 300 "CNAME" ["git.p"])
-      (record "netbox" 300 "CNAME" ["meta01.infra.p"])
-      (record "amqp" 300 "CNAME" ["bagel-box.infra.p"])
-      (record "grafana" 300 "CNAME" ["meta01.infra.p"])
-      (record "hydra" 300 "CNAME" ["build-coord.wob01.infra.p"])
-      (record "loki" 300 "CNAME" ["meta01.infra.p"])
-      (record "mimir" 300 "CNAME" ["meta01.infra.p"])
-      (record "matrix" 300 "CNAME" ["meta01.infra.p"])
-      (record "alerts" 300 "CNAME" ["meta01.infra.p"])
-      (record "buildbot" 300 "CNAME" ["buildbot.infra.p"])
-      (record "b" 300 "CNAME" ["public01.infra.p"])
-      (record "postgres" 300 "CNAME" ["bagel-box.infra.p"])
+      (record "git" 3600 "CNAME" ["git.p"])
+      (record "netbox" 3600 "CNAME" ["meta01.infra.p"])
+      (record "amqp" 3600 "CNAME" ["bagel-box.infra.p"])
+      (record "grafana" 3600 "CNAME" ["meta01.infra.p"])
+      (record "hydra" 3600 "CNAME" ["bagel-box.infra.p"])
+      (record "loki" 3600 "CNAME" ["meta01.infra.p"])
+      (record "mimir" 3600 "CNAME" ["meta01.infra.p"])
+      (record "matrix" 3600 "CNAME" ["meta01.infra.p"])
+      (record "alerts" 3600 "CNAME" ["meta01.infra.p"])
+      (record "buildbot" 3600 "CNAME" ["buildbot.infra.p"])
+      (record "b" 3600 "CNAME" ["public01.infra.p"])
+      (record "postgres" 3600 "CNAME" ["bagel-box.infra.p"])
 
       # S3 in delroth's basement
-      (record "cache" 300 "CNAME" ["smol.delroth.net."])
+      (record "cache" 3600 "CNAME" ["smol.delroth.net."])
 
-      (record "vpn-gw.wob01.infra" 300 "AAAA" [ "2a01:584:11::2" ])
+      (record "vpn-gw.wob01.infra" 3600 "AAAA" [ "2a01:584:11::2" ])
 
-      (dualProxyRecords "build-coord.wob01.infra" 300 "AAAA" [ "2a01:584:11::1:11" ])
+      (record "build-coord.wob01.infra" 3600 "AAAA" [ "2a01:584:11::1:11" ])
       # TODO: do not hardcode, just reuse the Colmena hive module outputs to generate all the required details.
-    ] ++ map (index: record "builder-${toString index}.wob01.infra" 300 "AAAA" [ "2a01:584:11::1:${toString index}" ]) (genList lib.id 11));
+    ] ++ map (index: record "builder-${toString index}.wob01.infra" 3600 "AAAA" [ "2a01:584:11::1:${toString index}" ]) (genList lib.id 11));
   };
 }