use dedicated store partition for hydra builds

Flake lock file updates:

• Updated input 'hydra':
    'git+https://git.lix.systems/lix-project/hydra.git?ref=refs/heads/main&rev=b0e9b4b2f99f9d8f5c4e780e89f955c394b5ced4' (2024-07-17)
  → 'git+https://git.lix.systems/lix-project/hydra.git?ref=refs/heads/main&rev=9a4a5dd624a1cedc7cdc40687815739b228e5c77' (2024-07-20)

flake.lock

@@ -64,10 +64,10 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1721397579,
+        "lastModified": 1721409873,
         "narHash": "sha256-h0njWQRvtkjK0NJ/Kgj76sXBhWwq5HGJm7OMcigmNw4=",
         "ref": "refs/heads/refactor",
-        "rev": "c49e591ae59b5d01d3f5d8e59310244dd5da7446",
+        "rev": "54bba654d4279dfd112345b6470547851feb1457",
         "revCount": 267,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/buildbot-nix.git"
@@ -258,11 +258,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721210741,
+        "lastModified": 1721473779,
-        "narHash": "sha256-jAFXbe8CA6S25NmAwncidyPgBvLK7a8dcj8AdRGaxUY=",
+        "narHash": "sha256-J8LFEasbW6qr7jrUxd0+SWWqNvU7uYEXzzTHI/MBKWA=",
         "ref": "refs/heads/main",
-        "rev": "b0e9b4b2f99f9d8f5c4e780e89f955c394b5ced4",
+        "rev": "9a4a5dd624a1cedc7cdc40687815739b228e5c77",
-        "revCount": 4181,
+        "revCount": 4185,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/hydra.git"
       },

hosts/bagel-box/default.nix

@@ -40,8 +40,8 @@
 
     hydra.enable = true;
     hydra.dbi = "dbi:Pg:dbname=hydra;user=hydra";
-    # Takes 4 builders (0 → 3).
+    # Takes 10 builders (0 → 9).
-    hydra.builders = lib.genList (i: "builder-${builtins.toString i}") 4;
+    hydra.builders = lib.genList (i: "builder-${builtins.toString i}") 10;
 
     ofborg.enable = true;
   };

services/baremetal-builder/default.nix

@@ -57,6 +57,11 @@ in
       fsType = "xfs";
     };
 
+    fileSystems."/mnt" = {
+      device = "/dev/disk/by-label/hydra";
+      fsType = "xfs";
+    };
+
     fileSystems."/boot" = {
       device = "/dev/disk/by-label/BOOT";
       fsType = "vfat";
@@ -135,6 +140,13 @@ in
       MaxStartups = "500:30:1000";
     };
 
+    systemd.services.hydra-gc = {
+      description = "Nix Garbage Collector";
+      script = "exec ${config.nix.package.out}/bin/nix-store --gc --store /mnt";
+      serviceConfig.Type = "oneshot";
+      startAt = "hourly";
+    };
+    systemd.timers.hydra-gc.timerConfig.Persistent = true;
 
     bagel.sysadmin.enable = true;
 

services/gerrit/one-way-sync.nix

@@ -13,9 +13,9 @@ let
     };
   };
   mkSyncService = targetRef: { name, fromUri, fromRefspec, localRefspec, ... }: {
-    path = [ pkgs.gitFull pkgs.openssh ];
+    path = [ pkgs.gitFull pkgs.openssh pkgs.lix ];
     script = ''
-      set -x
+      set -xe
       trap "git worktree prune && git worktree remove -f ${name}" EXIT
 
       if [ ! -d "/var/lib/onewaysync/nixpkgs" ]; then
@@ -30,9 +30,19 @@ let
       cd ${cfg.workingDir}/${name}
       git pull origin ${fromRefspec}
       EXPECTED_REF=$(git rev-list ${localRefspec} | head -1)
+      git config user.name Fork-o-Tron
+      git config user.email noreply@forkos.org
       git fetch ${fromUri} ${fromRefspec}
-      git rebase FETCH_HEAD
+    '' + lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
-      GIT_SSH_COMMAND='ssh -i ${cfg.deployKeyPath}' git push ${cfg.pushUrl} HEAD:${targetRef} --force-with-lease=${targetRef}:$EXPECTED_REF --force-if-includes
+      OLD_STDENV=$(nix eval -f . stdenv.outPath --store /run/onewaysync)
+    '' + ''
+      git merge FETCH_HEAD
+    '' + lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
+      NEW_STDENV=$(nix eval -f . stdenv.outPath --store /run/onewaysync)
+      # Do not allow auto-merging a staging iteration
+      test "$OLD_STDENV" = "$NEW_STDENV"
+    '' + ''
+      GIT_SSH_COMMAND='ssh -i ${cfg.deployKeyPath}' git push ${cfg.pushUrl} HEAD:${targetRef}
     '';
     serviceConfig = {
       User = "git";

services/hydra/default.nix

@@ -14,7 +14,7 @@ let
   # XXX: to support Nix's dumb public host key syntax (base64'd), this outputs
   # a string with shell-style command interpolations: $(...).
   mkBaremetalBuilder = { parallelBuilds, publicHostKey, host, speedFactor ? 1, user ? "builder", supportedSystems ? [ "i686-linux" "x86_64-linux" ], supportedFeatures ? [ "big-parallel" "kvm" "nixos-test" ] }:
-  "ssh://${user}@${host} ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString parallelBuilds} ${toString speedFactor} ${lib.concatStringsSep "," supportedFeatures} - $(echo -n '${publicHostKey}' | base64 -w0)";
+  "ssh://${user}@${host}?remote-store=/mnt ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString parallelBuilds} ${toString speedFactor} ${lib.concatStringsSep "," supportedFeatures} - $(echo -n '${publicHostKey}' | base64 -w0)";
 
   # TODO:
   # - generalize to new architectures

terraform/hydra.nix

@@ -165,5 +165,45 @@ in
 
       email_notifications = false;
     };
+
+    resource.hydra_jobset.yureka-staging-test = {
+      project = config.resource.hydra_project.forkos.name;
+      state = "enabled";
+      visible = true;
+      name = "yureka-staging-test";
+      type = "legacy";
+      description = "staging branch for yureka-nixos";
+
+      nix_expression = {
+        file = "pkgs/top-level/release.nix";
+        input = "nixpkgs";
+      };
+
+      check_interval = 0;
+      scheduling_shares = 3000;
+      keep_evaluations = 3;
+
+      email_notifications = false;
+
+      input = [
+        {
+          name = "nixpkgs";
+          type = "git";
+          value = "https://cl.forkos.org/nixpkgs sandbox/yureka/staging-test";
+          notify_committers = false;
+        }
+        {
+          name = "officialRelease";
+          type = "boolean";
+          value = "false";
+          notify_committers = false;
+        }
+        {
+          name = "supportedSystems";
+          type = "nix";
+          value = ''[ "x86_64-linux" ]'';
+        }
+      ];
+    };
   };
 }