{
system,
attic,
lib,
config,
pkgs,
hydra,
...
}: let
machines = pkgs.writeText "machines" ''
localhost armv7l-linux,powerpc-linux,powerpc64-linux,powerpc64le-linux,wasm32-wasi,x86_64-linux,i686-linux,riscv32-linux,riscv64-linux - 12 1 kvm,nixos-test,big-parallel,benchmark,gccarch-znver1,gccarch-skylake,ca-derivations -
build-aarch64 aarch64-linux,riscv32-linux,riscv64-linux - 4 1 nixos-test,benchmark,ca-derivations,gccarch-armv8-a,gccarch-armv8.1-a,gccarch-armv8.2-a,big-parallel -
build-riscv riscv64-linux,riscv32-linux - 4 2 nixos-test,benchmark,ca-derivations,gccarch-rv64gc_zba_zbb,gccarch-rv64gc_zba,gccarch-rv64gc_zbb,ccarch-rv64gc,gccarch-rv32gc_zba_zbb,gccarch-rv32gc_zba,gccarch-rv32gc_zbb,gccarch-rv32gc,big-parallel,native-riscv -
'';
sshConfig = pkgs.writeText "ssh-config" ''
Host build-aarch64
Port 22
IdentitiesOnly yes
User remote-build
HostName instance-20221213-1915.int.chir.rs
IdentityFile /var/lib/hydra/queue-runner/.ssh/builder_id_ed25519
Host build-nas
Port 22
IdentitiesOnly yes
User remote-build
HostName nas.int.chir.rs
IdentityFile /var/lib/hydra/queue-runner/.ssh/builder_id_ed25519
Host build-rainbow-resort
Port 22
IdentitiesOnly yes
User remote-build
HostName rainbow-resort.int.chir.rs
IdentityFile /var/lib/hydra/queue-runner/.ssh/builder_id_ed25519
Host build-riscv
Port 22
IdentitiesOnly yes
User remote-build
HostName vf2.int.chir.rs
IdentityFile /var/lib/hydra/queue-runner/.ssh/builder_id_ed25519
Host *
ForwardAgent no
Compression no
ServerAliveInterval 0
ServerAliveCountMax 3
HashKnownHosts no
UserKnownHostsFile ~/.ssh/known_hosts
ControlMaster auto
ControlPath ~/.ssh/master-%r@%n:%p
ControlPersist 10m
'';
in {
imports = [
./postgres.nix
../../modules/hydra.nix
hydra.nixosModules.hydra
];
nixpkgs.overlays = [
hydra.overlays.default
];
services.hydra-dev = {
enable = true;
package = hydra.packages.${system}.hydra.overrideAttrs (super: {
doCheck = false;
doInstallCheck = false;
patches =
super.patches
or []
++ [
./hydra/0001-add-gitea-pulls.patch
./hydra/0002-unlimit-output.patch
./hydra/0003-remove-pr-number-from-github-job-name.patch
./hydra/0004-use-pulls-instead-of-issues.patch
./hydra/0005-only-list-open-prs.patch
./hydra/0006-status-state.patch
./hydra/0007-hydra-server-findLog-fix-issue-with-ca-derivations-e.patch
];
});
hydraURL = "https://hydra.chir.rs/";
notificationSender = "hydra@chir.rs";
useSubstitutes = true;
port = 3001;
extraConfig = ''
darkkirb = #gitea_token#
ProcyOS = #gitea_token#
DarkKirb = Bearer #github_token#
jobs = .*
listen_address = 0.0.0.0
port = 8905
binary_cache_secret_key_file = ${config.sops.secrets."services/hydra/cache-key".path}
timeout = 3600
job = *:*:*
command = cat $HYDRA_JSON | ${pkgs.jq}/bin/jq -r '.drvPath' >> /var/lib/hydra/queue-runner/upload
max_concurrent_evals = 1
'';
giteaTokenFile = "/run/secrets/services/hydra/gitea_token";
githubTokenFile = "/run/secrets/services/hydra/github_token";
buildMachinesFiles = [
"${machines}"
"/run/hydra-machines"
];
};
nix.settings.allowed-uris = ["github:" "https://" "http://"];
sops.secrets."services/hydra/gitea_token" = {};
sops.secrets."services/hydra/github_token" = {};
sops.secrets."services/hydra/cache-key" = {
owner = "hydra-www";
mode = "0440";
};
services.caddy.virtualHosts."hydra.int.chir.rs" = {
useACMEHost = "int.chir.rs";
logFormat = pkgs.lib.mkForce "";
extraConfig = ''
import baseConfig
reverse_proxy http://127.0.0.1:${toString config.services.hydra-dev.port} {
trusted_proxies private_ranges
}
'';
};
sops.secrets."services/hydra/aws_credentials" = {
owner = "hydra-queue-runner";
path = "/var/lib/hydra/queue-runner/.aws/credentials";
restartUnits = ["hydra-notify.service"];
};
systemd.services.update-hydra-hosts = {
description = "Update hydra hosts";
serviceConfig = {
Type = "oneshot";
};
script = ''
if ${pkgs.iputils}/bin/ping -c 1 rainbow-resort.int.chir.rs; then
echo "build-rainbow-resort armv7l-linux,powerpc-linux,powerpc64-linux,powerpc64le-linux,wasm32-wasi,x86_64-linux,i686-linux,riscv32-linux,riscv64-linux - 16 1 kvm,nixos-test,big-parallel,benchmark,gccarch-znver4,gccarch-znver3,gccarch-znver2,gccarch-znver1,gccarch-skylake,gccarch-skylake-avx512,ca-derivations -" > /run/hydra-machines
else
rm -f /run/hydra-machines
fi
'';
};
systemd.timers.update-hydra-hosts = {
enable = true;
description = "Update hydra hosts";
requires = ["update-hydra-hosts.service"];
wantedBy = ["multi-user.target"];
timerConfig = {
OnBootSec = 300;
OnUnitActiveSec = 300;
};
};
nix.settings.trusted-users = ["@hydra"];
sops.secrets."hydra/ssh/builder_id_ed25519" = {
sopsFile = ../../secrets/shared.yaml;
owner = "hydra-queue-runner";
key = "ssh/builder_id_ed25519";
path = "/var/lib/hydra/queue-runner/.ssh/builder_id_ed25519";
};
system.activationScripts.setupHydraSshConfig = lib.stringAfter ["var"] ''
mkdir -p /var/lib/hydra/queue-runner/.ssh/
chown -Rv hydra-queue-runner /var/lib/hydra/queue-runner
ln -svf ${sshConfig} /var/lib/hydra/queue-runner/.ssh/config
'';
sops.secrets."attic/config.toml" = {
owner = "hydra-queue-runner";
key = "attic/config.toml";
path = "/var/lib/hydra/queue-runner/.config/attic/config.toml";
};
services.postgresql.ensureDatabases = [
"hydra-queue-runner"
];
services.postgresql.ensureUsers = [
{
name = "hydra-queue-runner";
ensureDBOwnership = true;
}
];
systemd.services."attic-queue" = {
description = "Upload build results";
wantedBy = ["multi-user.target"];
serviceConfig = {
User = "hydra-queue-runner";
Group = "hydra";
};
script = ''
export QUEUE_PATH=/var/lib/hydra/queue-runner/upload
export DATABASE_PATH=postgresql:///hydra-queue-runner
export RUST_LOG=info
exec ${attic.packages.${system}.attic-queue}/bin/attic-queue
'';
};
}