Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Richie
|
2d9dcc8a7e |
No files matched your search
@@ -8,23 +8,8 @@ on:
|
||||
- cron: "0 22 * * *"
|
||||
|
||||
jobs:
|
||||
prebuild-common:
|
||||
name: prebuild-common-x86-64-v3
|
||||
runs-on: nix-cache-builder
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
# portal-1 is the smallest system closure: 95% of its derivations are
|
||||
# shared by all five systems, so it is a maintainable common cache seed.
|
||||
# Keep going so one failing package does not stop unrelated cache entries
|
||||
# from being built.
|
||||
- name: Build common packages
|
||||
run: nixos-rebuild build --keep-going --accept-flake-config --flake ./#portal-1
|
||||
- name: Copy common packages to nix-cache
|
||||
run: nix copy --accept-flake-config --to unix:///host-nix/var/nix/daemon-socket/socket .#nixosConfigurations.portal-1.config.system.build.toplevel
|
||||
|
||||
build:
|
||||
name: build-${{ matrix.system }}
|
||||
needs: prebuild-common
|
||||
runs-on: self-hosted
|
||||
strategy:
|
||||
matrix:
|
||||
@@ -33,7 +18,6 @@ jobs:
|
||||
- "brain"
|
||||
- "jeeves"
|
||||
- "rhapsody-in-green"
|
||||
- "portal-1"
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
@@ -15,6 +15,7 @@ jobs:
|
||||
steps:
|
||||
- name: merge_flake_lock_update
|
||||
run: >-
|
||||
nix develop .#devShells.x86_64-linux.default -c
|
||||
python -m python.gitea_flake_lock merge
|
||||
--repo "${{ github.repository }}"
|
||||
env:
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
name: pytest
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
pytest:
|
||||
runs-on: self-hosted
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Run tests
|
||||
run: nix develop .#devShells.x86_64-linux.default -c pytest tests
|
||||
@@ -21,5 +21,6 @@ jobs:
|
||||
JEEVES_BOT_TOKEN: ${{ secrets.JEEVES_BOT_TOKEN }}
|
||||
GITEA_URL: https://gitea.tmmworkshop.com
|
||||
run: >-
|
||||
nix develop .#devShells.x86_64-linux.default -c
|
||||
python -m python.gitea_flake_lock update
|
||||
--repo "${{ github.repository }}"
|
||||
Vendored
+3
@@ -10,6 +10,7 @@
|
||||
"aiounifi",
|
||||
"alsa",
|
||||
"apiclient",
|
||||
"apscheduler",
|
||||
"archlinux",
|
||||
"ashift",
|
||||
"asrouter",
|
||||
@@ -336,6 +337,8 @@
|
||||
"yubioath",
|
||||
"yzhang",
|
||||
"zeroconf",
|
||||
"zerotier",
|
||||
"zerotierone",
|
||||
"zoxide",
|
||||
"zram",
|
||||
"zstd"
|
||||
|
||||
@@ -31,10 +31,6 @@ in
|
||||
"flakes"
|
||||
"ca-derivations"
|
||||
];
|
||||
system-features = lib.mkAfter [
|
||||
"gccarch-x86-64-v2"
|
||||
"gccarch-x86-64-v3"
|
||||
];
|
||||
warn-dirty = false;
|
||||
flake-registry = ""; # disable global flake registries
|
||||
connect-timeout = 10;
|
||||
|
||||
@@ -2,5 +2,6 @@
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
my_python
|
||||
];
|
||||
}
|
||||
@@ -17,7 +17,6 @@
|
||||
logDriver = "local";
|
||||
storageDriver = "overlay2";
|
||||
daemon.settings = {
|
||||
live-restore = false;
|
||||
experimental = true;
|
||||
exec-opts = [ "native.cgroupdriver=systemd" ];
|
||||
log-opts = {
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.signal-cli
|
||||
];
|
||||
|
||||
users = {
|
||||
groups.signal-cli = { };
|
||||
users.signal-cli = {
|
||||
isSystemUser = true;
|
||||
group = "signal-cli";
|
||||
home = "/var/lib/signal-cli";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/signal-cli 0700 signal-cli signal-cli - -"
|
||||
"Z /var/lib/signal-cli - signal-cli signal-cli - -"
|
||||
];
|
||||
|
||||
systemd.services.signal-cli = {
|
||||
description = "Signal CLI JSON-RPC service";
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
unitConfig.RequiresMountsFor = [ "/var/lib/signal-cli" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "signal-cli";
|
||||
Group = "signal-cli";
|
||||
ExecStart = "${pkgs.signal-cli}/bin/signal-cli --data-dir /var/lib/signal-cli daemon --socket /run/signal-cli/socket";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
SuccessExitStatus = 143;
|
||||
RuntimeDirectory = "signal-cli";
|
||||
RuntimeDirectoryMode = "0750";
|
||||
UMask = "0007";
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectHome = true;
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = [ "/var/lib/signal-cli" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
nixpkgs = {
|
||||
hostPlatform = {
|
||||
system = "x86_64-linux";
|
||||
gcc = {
|
||||
arch = "x86-64-v3";
|
||||
tune = "generic";
|
||||
};
|
||||
};
|
||||
|
||||
# These patches repair tests and bundled dependencies that are sensitive
|
||||
# to the compiler flags used by the x86-64-v3 package set.
|
||||
overlays = [ (import ./patches) ];
|
||||
};
|
||||
}
|
||||
@@ -1,20 +0,0 @@
|
||||
Subject: [PATCH] abseil: include BMI2 intrinsics through the public header
|
||||
|
||||
GCC and Clang reject direct inclusion of bmi2intrin.h. Include immintrin.h
|
||||
instead so that the compiler supplies the required intrinsic setup when
|
||||
BMI2 is enabled, including builds targeting x86-64-v3.
|
||||
|
||||
This patch is shared by the vendored Abseil copies in Electron, rusty_v8
|
||||
(Deno), and Signal's WebRTC build.
|
||||
|
||||
--- a/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
|
||||
+++ b/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
|
||||
@@ -226,7 +226,7 @@
|
||||
#endif
|
||||
|
||||
#ifdef __BMI2__
|
||||
-#include <bmi2intrin.h>
|
||||
+#include <immintrin.h>
|
||||
#endif // __BMI2__
|
||||
|
||||
namespace absl {
|
||||
@@ -1,38 +0,0 @@
|
||||
# Abseil accepted the upstream fix: https://github.com/abseil/abseil-cpp/pull/2071
|
||||
# Keep this workaround until Electron, Deno's rusty_v8, and Signal's WebRTC
|
||||
# update their bundled Abseil copies to include it.
|
||||
{ prev }:
|
||||
let
|
||||
patchAbseilBmi2Include =
|
||||
package:
|
||||
package.overrideAttrs (old: {
|
||||
# GCC and Clang require the public umbrella header for BMI2 intrinsics.
|
||||
patches = (old.patches or [ ]) ++ [ ./bmi2-public-header.patch ];
|
||||
});
|
||||
|
||||
electron43Unwrapped = patchAbseilBmi2Include prev.electron_43.unwrapped;
|
||||
electron43 = prev.electron_43.override {
|
||||
electron-unwrapped = electron43Unwrapped;
|
||||
};
|
||||
|
||||
signalCallPackage =
|
||||
path: args:
|
||||
let
|
||||
package = prev.callPackage path args;
|
||||
in
|
||||
if builtins.baseNameOf path == "webrtc.nix" then patchAbseilBmi2Include package else package;
|
||||
in
|
||||
prev.lib.optionalAttrs ((prev.stdenv.hostPlatform.gcc.arch or null) == "x86-64-v3") {
|
||||
deno =
|
||||
let
|
||||
librusty_v8 = patchAbseilBmi2Include prev.deno.passthru.librusty_v8;
|
||||
in
|
||||
prev.deno.override { inherit librusty_v8; };
|
||||
|
||||
electron_43 = electron43;
|
||||
|
||||
signal-desktop = prev.signal-desktop.override {
|
||||
electron_43 = electron43;
|
||||
callPackage = signalCallPackage;
|
||||
};
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
Subject: [PATCH] Compare font content in the overlap-removal regression
|
||||
|
||||
PFA_SKIP ends with a separator, producing an empty prefix that matches every
|
||||
line. Remove the empty prefix for this test so glyph differences are checked,
|
||||
and assert that tx exits successfully before inspecting the output.
|
||||
|
||||
--- a/tests/tx_test.py
|
||||
+++ b/tests/tx_test.py
|
||||
@@ -1064,6 +1064,8 @@
|
||||
output_path = get_temp_file_path()
|
||||
args = [TOOL, '-t1', '+V', '-o', output_path, input_path]
|
||||
- subprocess.call(args)
|
||||
- assert differ([expected_path, output_path, '-s', PFA_SKIP[0]])
|
||||
+ subprocess.check_call(args)
|
||||
+ # An empty skip prefix matches every line and hides font differences.
|
||||
+ skip_headers = SPLIT_MARKER.join(filter(None, PFA_SKIP[0].split(SPLIT_MARKER)))
|
||||
+ assert differ([expected_path, output_path, '-s', skip_headers])
|
||||
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
{ afdko }:
|
||||
afdko.overridePythonAttrs (old: {
|
||||
# FMA changes overlap-removal coordinates by 0.01 units on x86-64-v3.
|
||||
# Separate multiply/add rounding reproduces the reference Type 1 font exactly.
|
||||
env = (old.env or { }) // {
|
||||
NIX_CFLAGS_COMPILE = (old.env.NIX_CFLAGS_COMPILE or "") + " -ffp-contract=off";
|
||||
};
|
||||
|
||||
patches = (old.patches or [ ]) ++ [ ./check-overlap-font-content.patch ];
|
||||
})
|
||||
@@ -1,19 +0,0 @@
|
||||
{ prev }:
|
||||
let
|
||||
buildRedistHook = prev.runCommand "buildRedistHook.bash" { } ''
|
||||
cp ${prev.path}/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash "$out"
|
||||
chmod u+w "$out"
|
||||
patch "$out" < ${./propagated-build-output-arrays.patch}
|
||||
'';
|
||||
in
|
||||
prev.cudaPackages_12_9.overrideScope (
|
||||
_cudaFinal: cudaPrev: {
|
||||
buildRedist =
|
||||
args:
|
||||
(cudaPrev.buildRedist args).overrideAttrs (old: {
|
||||
nativeBuildInputs = map (
|
||||
input: if builtins.baseNameOf input == "buildRedistHook.bash" then buildRedistHook else input
|
||||
) old.nativeBuildInputs;
|
||||
});
|
||||
}
|
||||
)
|
||||
@@ -1,44 +0,0 @@
|
||||
Subject: [PATCH] Preserve structured CUDA output arrays
|
||||
|
||||
The multiple-outputs hook now accepts arrays. The old compatibility export
|
||||
collapses include and lib into one array element, breaking indirect expansion.
|
||||
Keep the array and iterate over each output when propagating to out.
|
||||
|
||||
--- a/buildRedistHook.bash
|
||||
+++ b/buildRedistHook.bash
|
||||
@@ -23,9 +23,6 @@
|
||||
|
||||
postInstallCheckHooks+=(checkCudaNonEmptyOutputs)
|
||||
nixLog "added checkCudaNonEmptyOutputs to postInstallCheckHooks"
|
||||
-
|
||||
- preFixupHooks+=(fixupPropagatedBuildOutputsForMultipleOutputs)
|
||||
- nixLog "added fixupPropagatedBuildOutputsForMultipleOutputs to preFixupHooks"
|
||||
|
||||
postFixupHooks+=(fixupCudaPropagatedBuildOutputsToOut)
|
||||
nixLog "added fixupCudaPropagatedBuildOutputsToOut to postFixupHooks"
|
||||
@@ -193,16 +190,6 @@
|
||||
return 0
|
||||
}
|
||||
|
||||
-# TODO(@connorbaker): https://github.com/NixOS/nixpkgs/issues/323126.
|
||||
-# _multioutPropagateDev() currently expects a space-separated string rather than an array.
|
||||
-# NOTE: Because _multioutPropagateDev is a postFixup hook, we correct it in preFixup.
|
||||
-fixupPropagatedBuildOutputsForMultipleOutputs() {
|
||||
- nixLog "converting propagatedBuildOutputs to a space-separated string"
|
||||
- # shellcheck disable=SC2124
|
||||
- export propagatedBuildOutputs="${propagatedBuildOutputs[@]}"
|
||||
- return 0
|
||||
-}
|
||||
-
|
||||
# The multiple outputs setup hook only propagates build outputs to dev.
|
||||
# We want to propagate them to out as well, in case the user interpolates
|
||||
# the package into a string -- in such a case, the dev output is not selected
|
||||
@@ -217,7 +204,7 @@
|
||||
mkdir -p "${out:?}/nix-support"
|
||||
|
||||
# NOTE: We must use printWords to ensure the output is a single line.
|
||||
- for output in $propagatedBuildOutputs; do
|
||||
+ for output in "${propagatedBuildOutputs[@]}"; do
|
||||
# Propagate the other components to the out output
|
||||
nixLog "adding ${!output:?} to propagatedBuildInputs of ${out:?}"
|
||||
printWords "${!output:?}" >>"${out:?}/nix-support/propagated-build-inputs"
|
||||
@@ -1,18 +0,0 @@
|
||||
_final: prev:
|
||||
(import ./abseil { inherit prev; })
|
||||
// {
|
||||
cudaPackages_12_9 = import ./cuda { inherit prev; };
|
||||
trunk = import ./trunk { inherit (prev) trunk jq; };
|
||||
gnutls = import ./gnutls { inherit (prev) gnutls; };
|
||||
prometheus = import ./prometheus { inherit (prev) prometheus; };
|
||||
zopfli = import ./zopfli { inherit (prev) zopfli; };
|
||||
|
||||
pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
|
||||
(_pythonFinal: pythonPrev: {
|
||||
afdko = import ./afdko { inherit (pythonPrev) afdko; };
|
||||
psutil = import ./psutil { inherit (pythonPrev) psutil; };
|
||||
pytest-xdist = import ./pytest-xdist { inherit (pythonPrev) pytest-xdist; };
|
||||
scipy = import ./scipy { inherit (pythonPrev) scipy; };
|
||||
})
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{ gnutls }:
|
||||
gnutls.overrideAttrs (old: {
|
||||
# Keep the UDP handshake test enabled on loaded builders by waiting for
|
||||
# the server to bind its socket. Kept as a standalone patch for upstream.
|
||||
patches = (old.patches or [ ]) ++ [ ./udp-server-readiness.patch ];
|
||||
})
|
||||
@@ -1,70 +0,0 @@
|
||||
Subject: [PATCH] tests: wait for the UDP server socket before connecting
|
||||
|
||||
A fixed four-second sleep does not guarantee that gnutls-serv has bound
|
||||
its UDP socket on a busy builder. Poll the local IPv4 UDP endpoint using
|
||||
the existing ss/netstat discovery, with the same retry budget as the TCP
|
||||
helper. Fail early if the server exits, and retain the original handshake
|
||||
checks in serv-udp.sh.
|
||||
|
||||
Use flags common to ss and BSD/Linux netstat. Match the local endpoint
|
||||
and complete port number, excluding TCP, IPv6-only and peer endpoints.
|
||||
|
||||
--- a/tests/scripts/common.sh
|
||||
+++ b/tests/scripts/common.sh
|
||||
@@ -185,10 +185,55 @@
|
||||
fi
|
||||
}
|
||||
|
||||
+check_if_udp_port_bound() {
|
||||
+ local PORT=$1
|
||||
+ have_port_finder
|
||||
+ # Use only -an, which is shared by ss and BSD/Linux netstat. UDP has
|
||||
+ # no LISTEN state. Match the local IPv4 endpoint, not a peer port or
|
||||
+ # a longer port number. serv-udp.sh connects to 127.0.0.1;
|
||||
+ # listen_socket() in serv.c binds IPv4 separately and requests
|
||||
+ # IPV6_V6ONLY=1 for its IPv6 socket.
|
||||
+ $PFCMD -an | awk -v port="$PORT" '
|
||||
+ $1 == "udp" || $1 == "udp4" {
|
||||
+ # ss includes a state column; netstat does not.
|
||||
+ address = ($2 == "UNCONN" || $2 == "ESTAB") ? $5 : $4
|
||||
+ if (address ~ ("^[0-9.]+[.:]" port "$") ||
|
||||
+ address == "*." port)
|
||||
+ found = 1
|
||||
+ }
|
||||
+ END { exit !found }
|
||||
+ '
|
||||
+}
|
||||
+
|
||||
wait_udp_server() {
|
||||
local PID=$1
|
||||
+ local ret
|
||||
trap "test -n \"${PID}\" && kill ${PID};exit 1" 1 15 2
|
||||
- sleep 4
|
||||
+ local i=0
|
||||
+ # Use the same retry budget as wait_for_port(), but also stop if the
|
||||
+ # server exits before binding its socket.
|
||||
+ while test $i -lt 90; do
|
||||
+ if ! kill -0 "$PID" 2>/dev/null; then
|
||||
+ fail "" "UDP server $PID exited before binding port $PORT"
|
||||
+ fi
|
||||
+ # Contain have_port_finder's exit so a skip also stops the server.
|
||||
+ if (check_if_udp_port_bound "$PORT"); then
|
||||
+ return 0
|
||||
+ else
|
||||
+ ret=$?
|
||||
+ if test "$ret" = 77; then
|
||||
+ kill "$PID" 2>/dev/null || :
|
||||
+ wait "$PID" 2>/dev/null || :
|
||||
+ exit 77
|
||||
+ fi
|
||||
+ fi
|
||||
+ i=$((i + 1))
|
||||
+ if test $i -lt 90; then
|
||||
+ echo "try $i: waiting for UDP port $PORT"
|
||||
+ sleep 2
|
||||
+ fi
|
||||
+ done
|
||||
+ fail "$PID" "UDP server $PORT did not come up"
|
||||
}
|
||||
|
||||
create_testdir() {
|
||||
@@ -1,180 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Exercise patched common.sh without building GnuTLS (Python standard library only).
|
||||
|
||||
Usage: python3 verify-readiness.py /path/to/patched/tests/scripts/common.sh
|
||||
Set SHELL to test another shell, and NETSTAT to test a netstat outside PATH.
|
||||
"""
|
||||
|
||||
# Use unittest so this upstream companion tool needs no pytest installation.
|
||||
# ruff: noqa: PT009
|
||||
|
||||
import os
|
||||
import shutil
|
||||
import socket
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import time
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
COMMON = str(Path(sys.argv.pop(1)).resolve())
|
||||
SHELL = os.environ.get("SHELL", "/bin/sh")
|
||||
|
||||
|
||||
class ReadinessTests(unittest.TestCase):
|
||||
"""Check endpoint parsing and the server startup lifecycle."""
|
||||
|
||||
def setUp(self) -> None:
|
||||
"""Create a socket-listing fixture for each check."""
|
||||
self.tmp = tempfile.TemporaryDirectory()
|
||||
self.addCleanup(self.tmp.cleanup)
|
||||
self.root = Path(self.tmp.name)
|
||||
self.fixture = self.root / "sockets"
|
||||
self.fixture.write_text("")
|
||||
self.finder = self.root / "port-finder"
|
||||
self.finder.write_text('#!/bin/sh\ncat "$SOCKET_FIXTURE"\n')
|
||||
self.finder.chmod(0o755)
|
||||
|
||||
def run_shell(self, body: str, **env: str) -> subprocess.CompletedProcess[str]:
|
||||
"""Source the actual helper and run a shell scenario."""
|
||||
return subprocess.run(
|
||||
[SHELL, "-c", '. "$COMMON"\n' + body],
|
||||
env={
|
||||
**os.environ,
|
||||
"COMMON": COMMON,
|
||||
"SOCKET_FIXTURE": str(self.fixture),
|
||||
"PFCMD": str(self.finder),
|
||||
"PORT": "12345",
|
||||
**env,
|
||||
},
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=20,
|
||||
check=False,
|
||||
)
|
||||
|
||||
def test_socket_formats_and_false_matches(self) -> None:
|
||||
"""Accept IPv4 UDP local endpoints and reject unrelated sockets."""
|
||||
cases = [
|
||||
("udp UNCONN 0 0 0.0.0.0:12345 0.0.0.0:*", True),
|
||||
("udp UNCONN 0 0 127.0.0.1:12345 0.0.0.0:*", True),
|
||||
("udp 0 0 0.0.0.0:12345 0.0.0.0:*", True),
|
||||
("udp4 0 0 *.12345 *.*", True),
|
||||
("udp 0 0 127.0.0.1.12345 *.*", True),
|
||||
("udp 0 0 *.12345 *.*", True),
|
||||
("udp UNCONN 0 0 0.0.0.0:123456 0.0.0.0:*", False),
|
||||
("udp 0 0 0.0.0.0:123456 0.0.0.0:*", False),
|
||||
("udp ESTAB 0 0 127.0.0.1:54321 127.0.0.1:12345", False),
|
||||
("udp 0 0 127.0.0.1:54321 127.0.0.1:12345", False),
|
||||
("tcp LISTEN 0 128 0.0.0.0:12345 0.0.0.0:*", False),
|
||||
("tcp 0 0 0.0.0.0:12345 0.0.0.0:* LISTEN", False),
|
||||
("udp UNCONN 0 0 [::]:12345 [::]:*", False),
|
||||
("udp UNCONN 0 0 *:12345 *:*", False),
|
||||
("udp6 0 0 :::12345 :::*", False),
|
||||
("udp6 0 0 *.12345 *.*", False),
|
||||
("", False),
|
||||
]
|
||||
for row, ready in cases:
|
||||
with self.subTest(row=row):
|
||||
self.fixture.write_text(row + "\n")
|
||||
result = self.run_shell('check_if_udp_port_bound "$PORT"')
|
||||
self.assertEqual(result.returncode, 0 if ready else 1, result.stderr)
|
||||
|
||||
def test_exited_server_fails_immediately(self) -> None:
|
||||
"""Fail without sleeping when the server has already exited."""
|
||||
result = self.run_shell(
|
||||
'true &\npid=$!\nwait "$pid"\nsleep() { echo "unexpected sleep" >&2; }\nwait_udp_server "$pid"'
|
||||
)
|
||||
self.assertEqual(result.returncode, 1)
|
||||
self.assertIn("exited before binding", result.stderr)
|
||||
self.assertNotIn("unexpected sleep", result.stderr)
|
||||
|
||||
def test_ready_socket_does_not_sleep(self) -> None:
|
||||
"""Check readiness before the first sleep."""
|
||||
self.fixture.write_text("udp UNCONN 0 0 0.0.0.0:12345 0.0.0.0:*\n")
|
||||
result = self.run_shell('sleep() { echo "unexpected sleep" >&2; }\nwait_udp_server "$$"')
|
||||
self.assertEqual(result.returncode, 0, result.stderr)
|
||||
self.assertNotIn("unexpected sleep", result.stderr)
|
||||
|
||||
def test_missing_port_finders_skip(self) -> None:
|
||||
"""Skip and stop the live server when no finder is available."""
|
||||
# have_port_finder also tries these paths independently of PATH.
|
||||
if any(os.access(f"{directory}/ss", os.X_OK) for directory in ("/sbin", "/usr/sbin", "/usr/local/sbin")):
|
||||
self.skipTest("an absolute ss path cannot be hidden by this PATH-only fixture")
|
||||
with subprocess.Popen(["sleep", "60"]) as server:
|
||||
try:
|
||||
result = self.run_shell(
|
||||
'unset PFCMD\nPATH=/nonexistent\nwait_udp_server "$SERVER_PID"',
|
||||
SERVER_PID=str(server.pid),
|
||||
)
|
||||
self.assertEqual(result.returncode, 77)
|
||||
self.assertIn("neither ss nor netstat found", result.stderr)
|
||||
server.wait(timeout=3)
|
||||
self.assertLess(server.returncode, 0)
|
||||
finally:
|
||||
if server.poll() is None:
|
||||
server.kill()
|
||||
|
||||
def test_timeout_is_bounded_and_cleans_up(self) -> None:
|
||||
"""Stop polling after the retry budget and terminate the server."""
|
||||
# Only accelerate the polling delay; keep a real live server process.
|
||||
self.finder.write_text('#!/bin/sh\necho probe >&2\ncat "$SOCKET_FIXTURE"\n')
|
||||
with subprocess.Popen(["sleep", "60"]) as server:
|
||||
try:
|
||||
result = self.run_shell(
|
||||
'sleep() { echo polling-sleep; }\nwait_udp_server "$SERVER_PID"',
|
||||
SERVER_PID=str(server.pid),
|
||||
)
|
||||
self.assertEqual(result.returncode, 1)
|
||||
self.assertIn("did not come up", result.stderr)
|
||||
self.assertEqual(result.stderr.count("probe\n"), 90)
|
||||
self.assertEqual(result.stdout.count("polling-sleep"), 89)
|
||||
server.wait(timeout=3)
|
||||
self.assertLess(server.returncode, 0)
|
||||
finally:
|
||||
if server.poll() is None:
|
||||
server.kill()
|
||||
|
||||
def test_server_exits_while_waiting(self) -> None:
|
||||
"""Detect a startup failure that happens after polling begins."""
|
||||
result = self.run_shell('sleep 1 &\npid=$!\nwait_udp_server "$pid"')
|
||||
self.assertEqual(result.returncode, 1)
|
||||
self.assertIn("exited before binding", result.stderr)
|
||||
self.assertIn("waiting for UDP port", result.stdout)
|
||||
|
||||
def test_real_socket_delayed_beyond_four_seconds(self) -> None:
|
||||
"""Wait for a real delayed bind with each installed port finder."""
|
||||
finders = [shutil.which("ss"), os.environ.get("NETSTAT") or shutil.which("netstat")]
|
||||
finders = [finder for finder in finders if finder]
|
||||
if not finders:
|
||||
self.skipTest("neither ss nor netstat available")
|
||||
for finder in finders:
|
||||
with self.subTest(finder=finder):
|
||||
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
|
||||
sock.bind(("127.0.0.1", 0))
|
||||
port = sock.getsockname()[1]
|
||||
code = (
|
||||
"import socket,time,sys; time.sleep(6); "
|
||||
"s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); "
|
||||
"s.bind(('127.0.0.1',int(sys.argv[1]))); time.sleep(30)"
|
||||
)
|
||||
with subprocess.Popen([sys.executable, "-c", code, str(port)]) as server:
|
||||
try:
|
||||
started = time.monotonic()
|
||||
result = self.run_shell(
|
||||
'wait_udp_server "$SERVER_PID"',
|
||||
SERVER_PID=str(server.pid),
|
||||
PORT=str(port),
|
||||
PFCMD=finder,
|
||||
)
|
||||
self.assertEqual(result.returncode, 0, result.stderr)
|
||||
self.assertGreaterEqual(time.monotonic() - started, 6)
|
||||
self.assertIsNone(server.poll())
|
||||
finally:
|
||||
server.terminate()
|
||||
server.wait(timeout=3)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -1,36 +0,0 @@
|
||||
Subject: [PATCH] tests: finish parsing before inspecting editor state
|
||||
|
||||
EditorState creation has a 20 ms parsing budget. A descheduled test can
|
||||
therefore observe an incomplete tree. Finish these small test documents
|
||||
without an interactive deadline and publish the result with a transaction.
|
||||
Keep the original completion and vector-matching assertions enabled.
|
||||
|
||||
--- a/module/codemirror-promql/src/test/utils-test.ts
|
||||
+++ b/module/codemirror-promql/src/test/utils-test.ts
|
||||
@@ -13,7 +13,7 @@
|
||||
|
||||
import { parser } from '@prometheus-io/lezer-promql';
|
||||
import { EditorState } from '@codemirror/state';
|
||||
-import { LRLanguage } from '@codemirror/language';
|
||||
+import { ensureSyntaxTree, LRLanguage } from '@codemirror/language';
|
||||
import nock from 'nock';
|
||||
import path from 'path';
|
||||
import { fileURLToPath } from 'url';
|
||||
@@ -23,10 +23,16 @@
|
||||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||||
|
||||
export function createEditorState(expr: string): EditorState {
|
||||
- return EditorState.create({
|
||||
+ const state = EditorState.create({
|
||||
doc: expr,
|
||||
extensions: lightPromQLSyntax,
|
||||
});
|
||||
+ // These tests need a complete tree, independent of the editor's time budget.
|
||||
+ if (!ensureSyntaxTree(state, state.doc.length, Infinity)) {
|
||||
+ throw new Error('Unable to parse the test expression');
|
||||
+ }
|
||||
+ // Publish the completed parse so syntaxTree(state) sees it too.
|
||||
+ return state.update({}).state;
|
||||
}
|
||||
|
||||
export function mockPrometheusServer(): void {
|
||||
@@ -1,17 +0,0 @@
|
||||
{ prometheus }:
|
||||
prometheus.overrideAttrs (
|
||||
old:
|
||||
let
|
||||
assets = old.passthru.assets.overrideAttrs (assetsOld: {
|
||||
patches = (assetsOld.patches or [ ]) ++ [ ./complete-test-parsing.patch ];
|
||||
});
|
||||
in
|
||||
{
|
||||
postPatch = builtins.replaceStrings [ "${old.passthru.assets}" ] [ "${assets}" ] (
|
||||
builtins.unsafeDiscardStringContext old.postPatch
|
||||
);
|
||||
passthru = old.passthru // {
|
||||
inherit assets;
|
||||
};
|
||||
}
|
||||
)
|
||||
@@ -1,4 +0,0 @@
|
||||
{ psutil }:
|
||||
psutil.overridePythonAttrs (old: {
|
||||
patches = (old.patches or [ ]) ++ [ ./heap-info-zero-mmap.patch ];
|
||||
})
|
||||
@@ -1,17 +0,0 @@
|
||||
Subject: [PATCH] Allow an empty mmap allocation total in heap_info
|
||||
|
||||
The allocator may satisfy all live allocations from the heap. A zero
|
||||
mmap_used value is valid and depends on the worker allocation history.
|
||||
Keep the heap and platform checks without requiring an mmap allocation.
|
||||
|
||||
--- a/tests/test_system.py
|
||||
+++ b/tests/test_system.py
|
||||
@@ -267,6 +267,7 @@
|
||||
if MACOS:
|
||||
assert m.mmap_used == 0 # not supported
|
||||
else:
|
||||
- assert m.mmap_used > 0
|
||||
+ # A process can have no live mmap-backed malloc allocations.
|
||||
+ assert m.mmap_used >= 0
|
||||
if WINDOWS:
|
||||
assert m.heap_count >= 0
|
||||
@@ -1,29 +0,0 @@
|
||||
Subject: [PATCH] tests: count replacements when checking the worker restart limit
|
||||
|
||||
With two workers, another in-flight test may crash after the fourth
|
||||
crash requests shutdown. Either four or five failed tests is valid.
|
||||
Require exactly three replacements and the failed-tests exit status,
|
||||
while preserving the queued-work and no-internal-error assertions.
|
||||
|
||||
--- a/testing/acceptance_test.py
|
||||
+++ b/testing/acceptance_test.py
|
||||
@@ -1011,9 +1011,18 @@
|
||||
"worker*crashed while running*",
|
||||
"worker*crashed while running*",
|
||||
"* xdist: maximum crashed workers reached: 3 *",
|
||||
- "* 4 failed in *",
|
||||
]
|
||||
)
|
||||
+ # A second in-flight test may crash after shutdown is requested.
|
||||
+ # The restart limit constrains replacements, not concurrent failures.
|
||||
+ replacements = sum(
|
||||
+ line.startswith("replacing crashed worker ") for line in res.stdout.lines
|
||||
+ )
|
||||
+ assert replacements == 3
|
||||
+ failed = res.parseoutcomes()["failed"]
|
||||
+ assert failed in (4, 5)
|
||||
+ res.assert_outcomes(failed=failed)
|
||||
+ assert res.ret == pytest.ExitCode.TESTS_FAILED
|
||||
assert "INTERNALERROR" not in res.stdout.str()
|
||||
|
||||
def test_max_worker_restart_die(self, pytester: pytest.Pytester) -> None:
|
||||
@@ -1,12 +0,0 @@
|
||||
{ pytest-xdist }:
|
||||
pytest-xdist.overridePythonAttrs (old: {
|
||||
patches = (old.patches or [ ]) ++ [
|
||||
./concurrent-worker-crashes.patch
|
||||
./worker-startup-timeout.patch
|
||||
];
|
||||
|
||||
# The suite exercises its own worker pools. Limit the outer suite to one worker.
|
||||
preCheck = builtins.replaceStrings [ "--numprocesses=$NIX_BUILD_CORES" ] [ "--numprocesses=1" ] (
|
||||
old.preCheck or ""
|
||||
);
|
||||
})
|
||||
@@ -1,19 +0,0 @@
|
||||
Subject: [PATCH] tests: allow more time for remote worker events
|
||||
|
||||
Worker startup can exceed ten seconds on heavily loaded builders. Allow
|
||||
the remote-test helper to wait up to sixty seconds for worker events.
|
||||
The wait still returns as soon as an event arrives and remains bounded.
|
||||
Production worker timeouts and test assertions are unchanged.
|
||||
|
||||
--- a/testing/test_remote.py
|
||||
+++ b/testing/test_remote.py
|
||||
@@ -17,7 +17,8 @@
|
||||
from xdist.workermanage import WorkerController
|
||||
|
||||
|
||||
-WAIT_TIMEOUT = 10.0
|
||||
+# Allow worker events extra time on heavily loaded builders.
|
||||
+WAIT_TIMEOUT = 60.0
|
||||
|
||||
|
||||
def check_marshallable(d: object) -> None:
|
||||
@@ -1,5 +0,0 @@
|
||||
{ scipy }:
|
||||
scipy.overridePythonAttrs (old: {
|
||||
# Keep the STFT tests enabled with tolerances for x86-64-v3 rounding.
|
||||
patches = (old.patches or [ ]) ++ [ ./stft-test-tolerances.patch ];
|
||||
})
|
||||
@@ -1,51 +0,0 @@
|
||||
Subject: [PATCH] signal: allow floating-point rounding in STFT tests
|
||||
|
||||
Keep the STFT tests enabled for x86-64-v3 builds. Allow two float32
|
||||
epsilons of relative error when comparing inverse-STFT implementations;
|
||||
float64 and the existing i686 override remain unchanged. Allow one
|
||||
float64 epsilon of absolute error in all three scaling round trips,
|
||||
which otherwise require exact zeros (observed residual: 4e-17 for a
|
||||
signal with amplitude 2).
|
||||
|
||||
Upstream issue: https://github.com/scipy/scipy/issues/25488
|
||||
|
||||
--- a/scipy/signal/tests/_scipy_spectral_test_shim.py
|
||||
+++ b/scipy/signal/tests/_scipy_spectral_test_shim.py
|
||||
@@ -294,7 +294,7 @@
|
||||
|
||||
# Adapted tolerances to account for resolution loss:
|
||||
atol = np.finfo(x.dtype).resolution*2 # instead of default atol = 0
|
||||
- rtol = 1e-7 # default for np.allclose()
|
||||
+ rtol = max(1e-7, 2 * np.finfo(x.dtype).eps)
|
||||
|
||||
# Relax atol on 32-Bit platforms a bit to pass CI tests.
|
||||
# - Not clear why there are discrepancies (in the FFT maybe?)
|
||||
--- a/scipy/signal/tests/test_spectral.py
|
||||
+++ b/scipy/signal/tests/test_spectral.py
|
||||
@@ -2044,7 +2044,7 @@
|
||||
|
||||
# Test round trip:
|
||||
x1 = istft(Zs, boundary=True, scaling='spectrum')[1]
|
||||
- assert_allclose(x1, x)
|
||||
+ assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
|
||||
|
||||
# For a Hann-windowed 256 sample length FFT, we expect a peak at
|
||||
# frequency 64 (since it is 1/4 the length of X) with a height of 1
|
||||
@@ -2074,7 +2074,7 @@
|
||||
|
||||
# Test round trip:
|
||||
x1 = istft(Zp, input_onesided=False, boundary=True, scaling='psd')[1]
|
||||
- assert_allclose(x1, x)
|
||||
+ assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
|
||||
|
||||
# The power of the one-sided psd-scaled STFT can be determined
|
||||
# analogously (note that the two sides are not of equal shape):
|
||||
@@ -2094,7 +2094,7 @@
|
||||
|
||||
# Test round trip:
|
||||
x1 = istft(Zp0, input_onesided=True, boundary=True, scaling='psd')[1]
|
||||
- assert_allclose(x1, x)
|
||||
+ assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
|
||||
|
||||
|
||||
class TestSampledSpectralRepresentations:
|
||||
@@ -1,21 +0,0 @@
|
||||
{ trunk, jq }:
|
||||
trunk.overrideAttrs (old: {
|
||||
nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ jq ];
|
||||
|
||||
# Patch the bundled libdeflate before Cargo validates its vendor checksums.
|
||||
postPatch = (old.postPatch or "") + ''
|
||||
libdeflateVendors=( "$cargoDepsCopy"/source-*/libdeflate-sys-1.23.1 )
|
||||
if [ "''${#libdeflateVendors[@]}" -ne 1 ] || [ ! -d "''${libdeflateVendors[0]}" ]; then
|
||||
echo "Expected exactly one vendored libdeflate-sys 1.23.1" >&2
|
||||
exit 1
|
||||
fi
|
||||
libdeflateVendor="''${libdeflateVendors[0]}"
|
||||
patch -d "$libdeflateVendor/libdeflate" -p1 < ${./libdeflate-gcc16.patch}
|
||||
libdeflateHeader=libdeflate/lib/x86/cpu_features.h
|
||||
libdeflateChecksum=$(sha256sum "$libdeflateVendor/$libdeflateHeader" | cut -d ' ' -f 1)
|
||||
jq --arg path "$libdeflateHeader" --arg hash "$libdeflateChecksum" \
|
||||
'.files[$path] = $hash' "$libdeflateVendor/.cargo-checksum.json" \
|
||||
> "$libdeflateVendor/.cargo-checksum.json.new"
|
||||
mv "$libdeflateVendor/.cargo-checksum.json.new" "$libdeflateVendor/.cargo-checksum.json"
|
||||
'';
|
||||
})
|
||||
@@ -1,33 +0,0 @@
|
||||
From 2a3762cf736aff9aa5dda329fdec3c08a816eb9b Mon Sep 17 00:00:00 2001
|
||||
From: Sergei Trofimovich <slyich@gmail.com>
|
||||
Date: Tue, 20 May 2025 21:18:28 +0100
|
||||
Subject: [PATCH] lib/x86/cpu_features.h: drop evex512 on gcc-16
|
||||
|
||||
gcc-16 `master` branch dropped support for `evex512` as:
|
||||
https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=c052a6f4a1c803cb92147ff98fb91cf3511e0856
|
||||
|
||||
As a result libdeflate build started failing as:
|
||||
|
||||
In file included from /build/source/lib/adler32.c:28:
|
||||
/build/source/lib/x86/adler32_template.h:135:12: error: attribute 'target' argument 'no-evex512' is unknown
|
||||
135 | ADD_SUFFIX(reduce_to_32bits)(vec_t v_s1, vec_t v_s2, u32 *s1_p, u32 *s2_p)
|
||||
| ^~~~~~~~~~~~~~~~
|
||||
|
||||
The change adds upper build to `evex512` for `gcc`.
|
||||
---
|
||||
lib/x86/cpu_features.h | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/x86/cpu_features.h b/lib/x86/cpu_features.h
|
||||
index fbfdb0eb..f9d69d72 100644
|
||||
--- a/lib/x86/cpu_features.h
|
||||
+++ b/lib/x86/cpu_features.h
|
||||
@@ -165,7 +165,7 @@ static inline u32 get_x86_cpu_features(void) { return 0; }
|
||||
# define HAVE_AVXVNNI(features) ((features) & X86_CPU_FEATURE_AVXVNNI)
|
||||
#endif
|
||||
|
||||
-#if (GCC_PREREQ(14, 0) || CLANG_PREREQ(18, 0, 18000000)) \
|
||||
+#if ((GCC_PREREQ(14, 0) && !(GCC_PREREQ(16, 0))) || CLANG_PREREQ(18, 0, 18000000)) \
|
||||
&& !defined(__EVEX512__) /* avoid subtracting the evex512 feature */
|
||||
# define EVEX512 ",evex512" /* needed to override potential -mno-evex512 */
|
||||
# define NO_EVEX512 ",no-evex512"
|
||||
@@ -1,4 +0,0 @@
|
||||
{ zopfli }:
|
||||
zopfli.overrideAttrs (old: {
|
||||
patches = (old.patches or [ ]) ++ [ ./unaligned-match-loads.patch ];
|
||||
})
|
||||
@@ -1,32 +0,0 @@
|
||||
Subject: [PATCH] Read unaligned match buffers with memcpy
|
||||
|
||||
Byte buffers need not satisfy integer alignment or aliasing requirements.
|
||||
GCC 16 with x86-64-v3 vectorizes the cast loads using aligned AVX reads,
|
||||
causing a segmentation fault. Copy into local integers instead.
|
||||
|
||||
--- a/src/zopfli/lz77.c
|
||||
+++ b/src/zopfli/lz77.c
|
||||
@@ -302,13 +302,20 @@
|
||||
if (sizeof(size_t) == 8) {
|
||||
/* 8 checks at once per array bounds check (size_t is 64-bit). */
|
||||
- while (scan < safe_end && *((size_t*)scan) == *((size_t*)match)) {
|
||||
+ while (scan < safe_end) {
|
||||
+ size_t scan_word, match_word;
|
||||
+ memcpy(&scan_word, scan, sizeof(scan_word));
|
||||
+ memcpy(&match_word, match, sizeof(match_word));
|
||||
+ if (scan_word != match_word) break;
|
||||
scan += 8;
|
||||
match += 8;
|
||||
}
|
||||
} else if (sizeof(unsigned int) == 4) {
|
||||
/* 4 checks at once per array bounds check (unsigned int is 32-bit). */
|
||||
- while (scan < safe_end
|
||||
- && *((unsigned int*)scan) == *((unsigned int*)match)) {
|
||||
+ while (scan < safe_end) {
|
||||
+ unsigned int scan_word, match_word;
|
||||
+ memcpy(&scan_word, scan, sizeof(scan_word));
|
||||
+ memcpy(&match_word, match, sizeof(match_word));
|
||||
+ if (scan_word != match_word) break;
|
||||
scan += 4;
|
||||
match += 4;
|
||||
}
|
||||
@@ -1,5 +1,4 @@
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
@@ -7,7 +6,6 @@
|
||||
}:
|
||||
let
|
||||
cfg = config.services.snapshot_manager;
|
||||
snapshotManagerPackages = ps: with ps; [ typer ];
|
||||
in
|
||||
{
|
||||
options = {
|
||||
@@ -36,41 +34,6 @@ in
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = [
|
||||
(final: _prev: {
|
||||
snapshot_manager_python = final.python314.withPackages snapshotManagerPackages;
|
||||
snapshot_manager_test_python = final.python314.withPackages (
|
||||
ps:
|
||||
snapshotManagerPackages ps
|
||||
++ (with ps; [
|
||||
pyfakefs
|
||||
pytest
|
||||
pytest-asyncio
|
||||
pytest-mock
|
||||
pytest-xdist
|
||||
])
|
||||
);
|
||||
snapshot_manager_tests =
|
||||
final.runCommand "snapshot-manager-tests"
|
||||
{
|
||||
nativeBuildInputs = [ final.snapshot_manager_test_python ];
|
||||
}
|
||||
''
|
||||
export HOME="$TMPDIR"
|
||||
cd ${inputs.self}
|
||||
pytest \
|
||||
-o cache_dir="$TMPDIR/pytest-cache" \
|
||||
tests/test_common.py \
|
||||
tests/test_signal_alert.py \
|
||||
tests/test_snapshot_manager.py \
|
||||
tests/test_zfs.py
|
||||
touch "$out"
|
||||
'';
|
||||
})
|
||||
];
|
||||
|
||||
system.checks = [ pkgs.snapshot_manager_tests ];
|
||||
|
||||
systemd = {
|
||||
services.snapshot_manager = {
|
||||
description = "ZFS Snapshot Manager";
|
||||
@@ -82,7 +45,7 @@ in
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.snapshot_manager_python}/bin/python -m python.tools.snapshot_manager ${lib.escapeShellArg cfg.path}";
|
||||
ExecStart = "${pkgs.my_python}/bin/python -m python.tools.snapshot_manager ${lib.escapeShellArg cfg.path}";
|
||||
}
|
||||
// lib.optionalAttrs (cfg.EnvironmentFile != null) {
|
||||
EnvironmentFile = cfg.EnvironmentFile;
|
||||
|
||||
@@ -22,12 +22,6 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/var"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
|
||||
Generated
+39
-93
@@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789770686,
|
||||
"narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
|
||||
"lastModified": 1781152676,
|
||||
"narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
|
||||
"rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -20,22 +20,26 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"firefox-addons": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
"dir": "pkgs/firefox-addons",
|
||||
"lastModified": 1787025780,
|
||||
"narHash": "sha256-NhyLP9G4DFOn/7aYr7K/D7hWrzEGr5EgUBV+lpdmJ24=",
|
||||
"owner": "rycee",
|
||||
"repo": "nur-expressions",
|
||||
"rev": "5ad360b6d3cb0aa1b61f9cb27fef113ca9117c37",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
"dir": "pkgs/firefox-addons",
|
||||
"owner": "rycee",
|
||||
"repo": "nur-expressions",
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
@@ -45,11 +49,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790819692,
|
||||
"narHash": "sha256-rvubAPbh3QCliic3sAK+CXTrPCGgJstY52OTs/5H1J4=",
|
||||
"lastModified": 1786999651,
|
||||
"narHash": "sha256-MTGMFlLDTklsXhCp4r5GXB4VAVadPdalXLvUjd/K7h0=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c8ecc29e5175452bee4a2aa1ba2383856d795338",
|
||||
"rev": "353742587cbaf079b3caee743115d037bc51fea6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -58,38 +62,16 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"jellyswarrm": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790427786,
|
||||
"narHash": "sha256-8+Ip0HFW2oZiRr0zCZmPPIHfTdxxHy4CmSF1uOkM3Bw=",
|
||||
"owner": "LLukas22",
|
||||
"repo": "Jellyswarrm",
|
||||
"rev": "9e67c5ad12116add867ba6c1bf69f767879e9147",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "LLukas22",
|
||||
"repo": "Jellyswarrm",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790722812,
|
||||
"narHash": "sha256-XwFt1uLyaBCQU1/nUeGqeBnqNXPVgGRnz20YVYdmF6Y=",
|
||||
"lastModified": 1786867632,
|
||||
"narHash": "sha256-ez+ubZlA1RtdjCB18a6zJ9M4u8qoPDy08EcnsW5M3Xw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "06f9ecaea5f64b6ff61cf42cb32f21621c4fa14a",
|
||||
"rev": "ff17823245ab9ff7bcae6acf950bd89cba82c38c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -101,11 +83,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1789546076,
|
||||
"narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
|
||||
"rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
|
||||
"lastModified": 1767892417,
|
||||
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
|
||||
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -114,11 +96,11 @@
|
||||
},
|
||||
"nixpkgs-master": {
|
||||
"locked": {
|
||||
"lastModified": 1790862528,
|
||||
"narHash": "sha256-00jiK7QCLGuVe4mj3kDa6P/iDFKb87aK9ZtJDZCOvTc=",
|
||||
"lastModified": 1787081018,
|
||||
"narHash": "sha256-K0uwZBtZsbBigHAMQW7YWti3gPe6a5ct5bcOw5F+Q9Y=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "86f3f30260edec38090733d0667e818e6e2ea6f5",
|
||||
"rev": "cacac5ac351a010599d9f9d106acfed25a8e4c77",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -146,11 +128,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1790689126,
|
||||
"narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
|
||||
"lastModified": 1787001381,
|
||||
"narHash": "sha256-Ue1Yo8gfHdD4TMtNewhA4tkSYeFqXThju0nCyJc3ALo=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
|
||||
"rev": "ec2d622de0773551768cf98f3fc50cbcc003b9c5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -163,35 +145,14 @@
|
||||
"root": {
|
||||
"inputs": {
|
||||
"disko": "disko",
|
||||
"firefox-addons": "firefox-addons",
|
||||
"home-manager": "home-manager",
|
||||
"jellyswarrm": "jellyswarrm",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-master": "nixpkgs-master",
|
||||
"nixpkgs-stable": "nixpkgs-stable",
|
||||
"sops-nix": "sops-nix",
|
||||
"systems": "systems_2"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"jellyswarrm",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779419951,
|
||||
"narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
"systems": "systems"
|
||||
}
|
||||
},
|
||||
"sops-nix": {
|
||||
@@ -201,11 +162,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790498116,
|
||||
"narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=",
|
||||
"lastModified": 1786629091,
|
||||
"narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866",
|
||||
"rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -215,21 +176,6 @@
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1689347949,
|
||||
"narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
|
||||
|
||||
@@ -21,13 +21,13 @@
|
||||
|
||||
nixos-hardware.url = "github:nixos/nixos-hardware/master";
|
||||
|
||||
jellyswarrm = {
|
||||
url = "github:LLukas22/Jellyswarrm";
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
firefox-addons = {
|
||||
url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
|
||||
+32
-9
@@ -1,13 +1,13 @@
|
||||
{ inputs, ... }:
|
||||
{
|
||||
# Additional package sets are accessible through `pkgs.<name>`.
|
||||
# When applied, the stable nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.stable'
|
||||
stable = final: _prev: {
|
||||
stable = import inputs.nixpkgs-stable {
|
||||
system = final.stdenv.hostPlatform.system;
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
};
|
||||
|
||||
# When applied, the master nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.master'
|
||||
master = final: _prev: {
|
||||
master = import inputs.nixpkgs-master {
|
||||
system = final.stdenv.hostPlatform.system;
|
||||
@@ -15,12 +15,35 @@
|
||||
};
|
||||
};
|
||||
|
||||
# Baseline x86-64 (v1) packages for prebuilt applications that should not
|
||||
# inherit an x86-64-v3 host platform.
|
||||
x86-v1 = final: _prev: {
|
||||
x86-v1 = import inputs.nixpkgs {
|
||||
system = final.stdenv.hostPlatform.system;
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
python-env = final: _prev: {
|
||||
my_python = final.python314.withPackages (
|
||||
ps: with ps; [
|
||||
alembic
|
||||
apprise
|
||||
apscheduler
|
||||
fastapi
|
||||
fastapi-cli
|
||||
httpx
|
||||
jinja2
|
||||
mypy
|
||||
pgvector
|
||||
psycopg
|
||||
pydantic
|
||||
pyfakefs
|
||||
pytest
|
||||
pytest-cov
|
||||
pytest-mock
|
||||
pytest-xdist
|
||||
python-multipart
|
||||
pydantic-settings
|
||||
ruff
|
||||
sqlalchemy
|
||||
tenacity
|
||||
tinytuya
|
||||
typer
|
||||
uvicorn
|
||||
websockets
|
||||
]
|
||||
);
|
||||
};
|
||||
}
|
||||
@@ -6,6 +6,51 @@ authors = [{ name = "Richie Cahill", email = "richie@tmmworkshop.com" }]
|
||||
requires-python = "~=3.14.0"
|
||||
readme = "README.md"
|
||||
license = "MIT"
|
||||
# these dependencies are a best effort and aren't guaranteed to work
|
||||
# for up-to-date dependencies, see overlays/default.nix
|
||||
dependencies = [
|
||||
"alembic",
|
||||
"apprise",
|
||||
"apscheduler",
|
||||
"beautifulsoup4",
|
||||
"bm25s",
|
||||
"ebooklib",
|
||||
"fastapi",
|
||||
"fastapi-cli",
|
||||
"httpx",
|
||||
"jinja2",
|
||||
"pgvector",
|
||||
"polars",
|
||||
"psycopg[binary]",
|
||||
"pydantic",
|
||||
"pydantic-settings",
|
||||
"python-multipart",
|
||||
"sqlalchemy[asyncio]",
|
||||
"tenacity",
|
||||
"tiktoken",
|
||||
"tinytuya",
|
||||
"typer",
|
||||
"uvicorn",
|
||||
"websockets",
|
||||
"yake",
|
||||
]
|
||||
|
||||
[project.scripts]
|
||||
database = "python.database_cli:app"
|
||||
whisper-transcribe = "python.tools.whisper.transcribe:main"
|
||||
|
||||
[dependency-groups]
|
||||
dev = [
|
||||
"aiosqlite",
|
||||
"mypy",
|
||||
"pyfakefs",
|
||||
"pytest-asyncio",
|
||||
"pytest-cov",
|
||||
"pytest-mock",
|
||||
"pytest-xdist",
|
||||
"pytest",
|
||||
"ruff",
|
||||
]
|
||||
|
||||
[tool.ruff]
|
||||
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
# Ebook Search Docker
|
||||
|
||||
Run the EPUB search app against the existing Postgres database on `jeeves`:
|
||||
|
||||
```sh
|
||||
python -m python.ebook_search.docker.containers start --library-path /path/to/epubs --build
|
||||
```
|
||||
|
||||
All ebook-search Docker files live in this directory:
|
||||
|
||||
- `Dockerfile` — multi-stage: `test` (runs pytest) and `runtime` (default target, the app image)
|
||||
- `docker-compose.yml`
|
||||
- `containers.py` — Typer lifecycle CLI
|
||||
- `pyproject.toml` / `uv.lock` — the container's uv-locked dependencies
|
||||
|
||||
The app listens on `http://localhost:8070`.
|
||||
|
||||
Useful lifecycle commands:
|
||||
|
||||
```sh
|
||||
python -m python.ebook_search.docker.containers build
|
||||
python -m python.ebook_search.docker.containers start --library-path /path/to/epubs
|
||||
python -m python.ebook_search.docker.containers test
|
||||
python -m python.ebook_search.docker.containers logs
|
||||
python -m python.ebook_search.docker.containers ps
|
||||
python -m python.ebook_search.docker.containers stop
|
||||
```
|
||||
|
||||
Direct compose usage from the repo root:
|
||||
|
||||
```sh
|
||||
docker compose -f python/ebook_search/docker/docker-compose.yml ps
|
||||
```
|
||||
|
||||
## Dependencies
|
||||
|
||||
The image builds its environment with uv from `pyproject.toml` + `uv.lock` in this
|
||||
directory — this is the source of truth for the container's dependencies. To add or
|
||||
update a dependency, edit `pyproject.toml` here and regenerate the lock (uv is
|
||||
available in the `ebook-search` dev shell):
|
||||
|
||||
```sh
|
||||
nix develop .#ebook-search -c uv lock --project python/ebook_search/docker
|
||||
```
|
||||
|
||||
## Tests
|
||||
|
||||
The main pytest suite excludes `tests/ebook_search` (its dependencies are no longer
|
||||
in the nix dev shell). The `test ebook search` CI workflow runs them in a uv env
|
||||
built from the lockfile in this directory — same commands work locally from the
|
||||
repo root (the `--override-ini` drops the main suite's ignore):
|
||||
|
||||
```sh
|
||||
uv sync --locked --project python/ebook_search/docker
|
||||
uv run --project python/ebook_search/docker --no-sync pytest tests/ebook_search --override-ini addopts="-n auto -ra"
|
||||
```
|
||||
|
||||
They can also run inside the Docker `test` image, which validates the image itself:
|
||||
|
||||
```sh
|
||||
python -m python.ebook_search.docker.containers test
|
||||
```
|
||||
|
||||
or the raw docker equivalent:
|
||||
|
||||
```sh
|
||||
docker build --file python/ebook_search/docker/Dockerfile --target test --tag ebook-search:test .
|
||||
docker run --rm ebook-search:test
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
The compose service loads the repo root `.env` into the container via `env_file`.
|
||||
|
||||
Mount your EPUB directory by setting `EBOOK_LIBRARY_HOST_PATH` in an env file or on the command line. The container sees it as `/library`, and `EBOOK_SEARCH_LIBRARY_PATHS` is set to `/library` inside the container.
|
||||
|
||||
Database connection settings are controlled by `RICHIE_DB`, `RICHIE_HOST`, `RICHIE_PORT`, `RICHIE_USER`, and `RICHIE_PASSWORD`. The default host is `jeeves`.
|
||||
@@ -0,0 +1,54 @@
|
||||
# Gems
|
||||
|
||||
Gems is a server-rendered, turn-based resource-engine game for one to four human or AI players. It uses FastAPI,
|
||||
Jinja, HTMX, server-sent events, and SQLite.
|
||||
|
||||
The application deliberately contains no playable card deck, patron/governor set, objective set, official artwork,
|
||||
or copied rulebook text. A room host must upload a content pack they are entitled to use before starting a game.
|
||||
|
||||
## Run locally
|
||||
|
||||
```shell
|
||||
uv run gems --host 127.0.0.1 --port 8082
|
||||
```
|
||||
|
||||
The default database and installation key are created under `.gems/`. The following environment variables override
|
||||
runtime behavior:
|
||||
|
||||
- `GEMS_DATABASE_PATH`
|
||||
- `GEMS_KEY_PATH`
|
||||
- `GEMS_PUBLIC_ORIGIN`
|
||||
- `GEMS_SECURE_COOKIES`
|
||||
- `GEMS_HOST`
|
||||
- `GEMS_PORT`
|
||||
|
||||
## Content packs
|
||||
|
||||
The current schema is available from a running server at `/schemas/content-pack-v1.json`. A pack defines exactly
|
||||
five normal resources, one wild resource, cards, and optional patrons, objectives, and outposts. `patrons` is the
|
||||
canonical field name; `governors` is accepted as an input alias.
|
||||
|
||||
Cards may use only the built-in, bounded effect vocabulary:
|
||||
|
||||
- `none`
|
||||
- `virtual_wild`
|
||||
- `copy_bonus`
|
||||
- `copy_and_claim`
|
||||
- `multi_bonus`
|
||||
- `claim_free`
|
||||
- an optional discard-cards alternate cost
|
||||
|
||||
Unknown fields, resource references, executable expressions, HTML, artwork URLs, and files larger than 512 KiB are
|
||||
rejected. The normalized pack is private to its room and becomes immutable when play starts.
|
||||
|
||||
## Neutral module mapping
|
||||
|
||||
Gems calls the four optional mechanics Objectives, Outposts, Eastern Decks, and Fortifications. Lobby presets combine
|
||||
these mechanics into the familiar base, objective-race, objective-plus-outpost, eastern-plus-fortification, and
|
||||
all-module configurations. Component identities and values always come from the uploaded pack.
|
||||
|
||||
## Jeeves
|
||||
|
||||
The NixOS module runs one Uvicorn worker on `127.0.0.1:8002`, stores state in
|
||||
`/zfs/media/services/gems`, and publishes it through HAProxy at `https://gems.tmmworkshop.com`. The DNS record must
|
||||
point to Jeeves before ACME can issue the certificate.
|
||||
@@ -14,7 +14,7 @@ DEFAULT_BASE_BRANCH = "main"
|
||||
DEFAULT_BRANCH = "automation/update-flake-lock"
|
||||
DEFAULT_GITEA_URL = "https://gitea.tmmworkshop.com"
|
||||
PR_LABELS = ["dependencies", "automated", "flake_lock_update"]
|
||||
PR_CHECK_WORKFLOWS = ["build_systems.yml", "treefmt.yml"]
|
||||
PR_CHECK_WORKFLOWS = ["build_systems.yml", "treefmt.yml", "pytest.yml"]
|
||||
PR_TITLE = "Update flake.lock"
|
||||
PR_BODY = "Automated flake.lock update."
|
||||
|
||||
|
||||
@@ -176,21 +176,6 @@ def create_zfs_datasets() -> None:
|
||||
run_output(("zfs", "create", "root_pool/home"))
|
||||
run_output(("zfs", "create", "-o", "reservation=1G", "root_pool/var"))
|
||||
run_output(("zfs", "create", "-o", "compression=zstd-9", "-o", "reservation=10G", "root_pool/nix"))
|
||||
run_output(
|
||||
(
|
||||
"zfs",
|
||||
"create",
|
||||
"-o",
|
||||
"sync=disabled",
|
||||
"-o",
|
||||
"redundant_metadata=some",
|
||||
"-o",
|
||||
"normalization=none",
|
||||
"-o",
|
||||
"utf8only=off",
|
||||
"root_pool/nix_build",
|
||||
)
|
||||
)
|
||||
datasets = run_output(("zfs", "list", "-o", "name"))
|
||||
|
||||
expected_datasets = {
|
||||
@@ -198,7 +183,6 @@ def create_zfs_datasets() -> None:
|
||||
"root_pool/home",
|
||||
"root_pool/var",
|
||||
"root_pool/nix",
|
||||
"root_pool/nix_build",
|
||||
}
|
||||
missing_datasets = expected_datasets.difference(datasets.splitlines())
|
||||
if missing_datasets:
|
||||
@@ -264,7 +248,6 @@ def create_nix_hardware_file(mnt_dir: str, disks: Sequence[str], encrypt: str |
|
||||
' "/home" = {\n device = "root_pool/home";\n fsType = "zfs";\n };\n\n'
|
||||
' "/var" = {\n device = "root_pool/var";\n fsType = "zfs";\n };\n\n'
|
||||
' "/nix" = {\n device = "root_pool/nix";\n fsType = "zfs";\n };\n\n'
|
||||
' "/nix/var/nix/builds" = {\n device = "root_pool/nix_build";\n fsType = "zfs";\n };\n\n'
|
||||
' "/boot" = {\n'
|
||||
f' device = "/dev/disk/by-uuid/{get_boot_drive_id(disks[0])}";\n'
|
||||
' fsType = "vfat";\n options = [\n "fmask=0077"\n'
|
||||
@@ -287,7 +270,6 @@ def install_nixos(mnt_dir: str, disks: Sequence[str], encrypt: str | None) -> No
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/home", f"{mnt_dir}/home"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/var", f"{mnt_dir}/var"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix", f"{mnt_dir}/nix"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix_build", f"{mnt_dir}/nix/var/nix/builds"))
|
||||
|
||||
for disk in disks:
|
||||
run_output(("mkfs.vfat", "-n", "EFI", f"{disk}-part1"))
|
||||
|
||||
+16
-50
@@ -2,63 +2,29 @@
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import logging
|
||||
import socket
|
||||
from os import getenv
|
||||
|
||||
from apprise import Apprise
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class SignalRPCError(RuntimeError):
|
||||
"""signal-cli returned an error or closed without responding."""
|
||||
|
||||
|
||||
def signal_alert(body: str, from_phone: str, to_phone: str, *, timeout: float = 4.0) -> None:
|
||||
"""Send a Signal alert through the local signal-cli daemon.
|
||||
def signal_alert(body: str, title: str = "") -> None:
|
||||
"""Send a signal alert.
|
||||
|
||||
Args:
|
||||
body: The body of the alert.
|
||||
from_phone: The Signal account sending the alert.
|
||||
to_phone: The Signal account receiving the alert.
|
||||
timeout: Seconds to wait on each socket operation.
|
||||
|
||||
Raises:
|
||||
SignalRPCError: If signal-cli returns an error or closes the
|
||||
connection before responding.
|
||||
OSError: If the socket is unreachable or an operation times out.
|
||||
body (str): The body of the alert.
|
||||
title (str, optional): The title of the alert. Defaults to "".
|
||||
"""
|
||||
signal_rpc_id = "signal-alert"
|
||||
request = {
|
||||
"jsonrpc": "2.0",
|
||||
"method": "send",
|
||||
"params": {
|
||||
"account": from_phone,
|
||||
"recipient": [to_phone],
|
||||
"message": body,
|
||||
},
|
||||
"id": signal_rpc_id,
|
||||
}
|
||||
apprise_client = Apprise()
|
||||
|
||||
try:
|
||||
with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
|
||||
client.settimeout(timeout)
|
||||
client.connect("/run/signal-cli/socket")
|
||||
client.sendall(json.dumps(request).encode() + b"\n")
|
||||
from_phone = getenv("SIGNAL_ALERT_FROM_PHONE")
|
||||
to_phone = getenv("SIGNAL_ALERT_TO_PHONE")
|
||||
if not from_phone or not to_phone:
|
||||
logger.info("SIGNAL_ALERT_FROM_PHONE or SIGNAL_ALERT_TO_PHONE not set")
|
||||
return
|
||||
|
||||
buffer = b""
|
||||
while chunk := client.recv(65536):
|
||||
buffer += chunk
|
||||
while b"\n" in buffer:
|
||||
line, buffer = buffer.split(b"\n", maxsplit=1)
|
||||
response = json.loads(line)
|
||||
if response.get("id") != signal_rpc_id:
|
||||
continue
|
||||
if rpc_error := response.get("error"):
|
||||
error = f"Signal RPC returned an error: {rpc_error}"
|
||||
raise SignalRPCError(error)
|
||||
return
|
||||
error = "Signal RPC socket closed before returning a response"
|
||||
raise SignalRPCError(error)
|
||||
except (OSError, json.JSONDecodeError) as exc:
|
||||
error = f"Signal RPC failed: {exc!r}"
|
||||
raise SignalRPCError(error) from exc
|
||||
apprise_client.add(f"signal://localhost:8989/{from_phone}/{to_phone}")
|
||||
|
||||
apprise_client.notify(title=title, body=body)
|
||||
@@ -0,0 +1 @@
|
||||
"""system_tests."""
|
||||
@@ -0,0 +1,99 @@
|
||||
"""Validate Jeeves."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
from copy import copy
|
||||
from re import search
|
||||
from time import sleep
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from python.common import bash_wrapper
|
||||
from python.zfs import Zpool
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from collections.abc import Sequence
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def zpool_tests(pool_names: Sequence[str], zpool_capacity_threshold: int = 90) -> list[str] | None:
|
||||
"""Check the zpool health and capacity.
|
||||
|
||||
Args:
|
||||
pool_names (Sequence[str]): A list of pool names to test.
|
||||
zpool_capacity_threshold (int, optional): The threshold for the zpool capacity. Defaults to 90.
|
||||
|
||||
Returns:
|
||||
list[str] | None: A list of errors if any.
|
||||
"""
|
||||
logger.info("Testing zpool")
|
||||
|
||||
errors: list[str] = []
|
||||
for pool_name in pool_names:
|
||||
pool = Zpool(pool_name)
|
||||
if pool.health != "ONLINE":
|
||||
errors.append(f"{pool.name} is {pool.health}")
|
||||
if pool.capacity >= zpool_capacity_threshold:
|
||||
errors.append(f"{pool.name} is low on space")
|
||||
|
||||
upgrade_status, _ = bash_wrapper("zpool upgrade")
|
||||
if not search(r"Every feature flags pool has all supported and requested features enabled.", upgrade_status):
|
||||
errors.append("ZPool out of date run `sudo zpool upgrade -a`")
|
||||
|
||||
return errors
|
||||
|
||||
|
||||
def systemd_tests(
|
||||
service_names: Sequence[str],
|
||||
max_retries: int = 30,
|
||||
retry_delay_secs: int = 1,
|
||||
retryable_statuses: Sequence[str] | None = None,
|
||||
valid_statuses: Sequence[str] | None = None,
|
||||
) -> list[str] | None:
|
||||
"""Tests a systemd services.
|
||||
|
||||
Args:
|
||||
service_names (Sequence[str]): A list of service names to test.
|
||||
max_retries (int, optional): The maximum number of retries. Defaults to 30.
|
||||
minimum value is 1.
|
||||
retry_delay_secs (int, optional): The delay between retries in seconds. Defaults to 1.
|
||||
minimum value is 1.
|
||||
retryable_statuses (Sequence[str] | None, optional): A list of retryable statuses. Defaults to None.
|
||||
valid_statuses (Sequence[str] | None, optional): A list of valid statuses. Defaults to None.
|
||||
|
||||
Returns:
|
||||
list[str] | None: A list of errors if any.
|
||||
"""
|
||||
logger.info("Testing systemd service")
|
||||
|
||||
max_retries = max(max_retries, 1)
|
||||
retry_delay_secs = max(retry_delay_secs, 1)
|
||||
last_try = max_retries - 1
|
||||
|
||||
if retryable_statuses is None:
|
||||
retryable_statuses = ("inactive\n", "activating\n")
|
||||
|
||||
if valid_statuses is None:
|
||||
valid_statuses = ("active\n",)
|
||||
|
||||
service_names_set = set(service_names)
|
||||
|
||||
errors: set[str] = set()
|
||||
for retry in range(max_retries):
|
||||
if not service_names_set:
|
||||
break
|
||||
logger.info(f"Testing systemd service in {retry + 1} of {max_retries}")
|
||||
service_names_to_test = copy(service_names_set)
|
||||
for service_name in service_names_to_test:
|
||||
service_status, _ = bash_wrapper(f"systemctl is-active {service_name}")
|
||||
if service_status in valid_statuses:
|
||||
service_names_set.remove(service_name)
|
||||
continue
|
||||
if service_status in retryable_statuses and retry < last_try:
|
||||
continue
|
||||
errors.add(f"{service_name} is {service_status.strip()}")
|
||||
|
||||
sleep(retry_delay_secs)
|
||||
|
||||
return list(errors)
|
||||
@@ -0,0 +1,67 @@
|
||||
"""Validate {server_name}."""
|
||||
|
||||
import logging
|
||||
import sys
|
||||
import tomllib
|
||||
from os import environ
|
||||
from pathlib import Path # noqa: TC003 This is required for the typer CLI
|
||||
from socket import gethostname
|
||||
|
||||
import typer
|
||||
|
||||
from python.common import configure_logger
|
||||
from python.signal_alert import signal_alert
|
||||
from python.system_tests.components import systemd_tests, zpool_tests
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def load_config_data(config_file: Path) -> dict[str, list[str]]:
|
||||
"""Load a TOML configuration file.
|
||||
|
||||
Args:
|
||||
config_file (Path): The path to the configuration file.
|
||||
|
||||
Returns:
|
||||
dict: The configuration data.
|
||||
"""
|
||||
return tomllib.loads(config_file.read_text())
|
||||
|
||||
|
||||
def main(config_file: Path) -> None:
|
||||
"""Main."""
|
||||
configure_logger(level=environ.get("LOG_LEVEL", "INFO"))
|
||||
|
||||
server_name = gethostname()
|
||||
logger.info(f"Starting {server_name} validation")
|
||||
|
||||
config_data = load_config_data(config_file)
|
||||
|
||||
errors: list[str] = []
|
||||
try:
|
||||
if config_data.get("zpools") and (zpool_errors := zpool_tests(config_data["zpools"])):
|
||||
errors.extend(zpool_errors)
|
||||
|
||||
if config_data.get("services") and (systemd_errors := systemd_tests(config_data["services"])):
|
||||
errors.extend(systemd_errors)
|
||||
|
||||
except Exception as error:
|
||||
logger.exception(f"{server_name} validation failed")
|
||||
errors.append(f"{server_name} validation failed: {error}")
|
||||
|
||||
if errors:
|
||||
logger.error(f"{server_name} validation failed: \n{'\n'.join(errors)}")
|
||||
signal_alert(f"{server_name} validation failed {errors}")
|
||||
|
||||
sys.exit(1)
|
||||
|
||||
logger.info(f"{server_name} validation passed")
|
||||
|
||||
|
||||
def cli() -> None:
|
||||
"""CLI."""
|
||||
typer.run(main)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
cli()
|
||||
@@ -6,7 +6,6 @@ import logging
|
||||
import sys
|
||||
import tomllib
|
||||
from functools import cache
|
||||
from os import getenv
|
||||
from pathlib import Path # noqa: TC003 This is required for the typer CLI
|
||||
from re import compile as re_compile
|
||||
from re import search
|
||||
@@ -25,15 +24,6 @@ def main(config_file: Path) -> None:
|
||||
configure_logger(level="DEBUG")
|
||||
logger.info("Starting snapshot_manager")
|
||||
|
||||
from_phone = getenv("SIGNAL_ALERT_FROM_PHONE")
|
||||
to_phone = getenv("SIGNAL_ALERT_TO_PHONE")
|
||||
if not from_phone:
|
||||
error = "SIGNAL_ALERT_FROM_PHONE environment variable is not set"
|
||||
raise ValueError(error)
|
||||
if not to_phone:
|
||||
error = "SIGNAL_ALERT_TO_PHONE environment variable is not set"
|
||||
raise ValueError(error)
|
||||
|
||||
try:
|
||||
time_stamp = get_time_stamp()
|
||||
|
||||
@@ -43,14 +33,14 @@ def main(config_file: Path) -> None:
|
||||
if status != "snapshot created":
|
||||
msg = f"{dataset.name} failed to create snapshot {time_stamp}"
|
||||
logger.error(msg)
|
||||
signal_alert(msg, from_phone, to_phone)
|
||||
signal_alert(msg)
|
||||
continue
|
||||
count_lookup = get_count_lookup(config_file, dataset.name)
|
||||
logger.info(f"using {count_lookup} for {dataset.name}")
|
||||
get_snapshots_to_delete(dataset, count_lookup, from_phone, to_phone)
|
||||
get_snapshots_to_delete(dataset, count_lookup)
|
||||
except Exception:
|
||||
logger.exception("snapshot_manager failed")
|
||||
signal_alert("snapshot_manager failed", from_phone, to_phone)
|
||||
signal_alert("snapshot_manager failed")
|
||||
sys.exit(1)
|
||||
else:
|
||||
logger.info("snapshot_manager completed")
|
||||
@@ -102,16 +92,12 @@ def load_config_data(config_file: Path) -> dict[str, dict[str, int]]:
|
||||
def get_snapshots_to_delete(
|
||||
dataset: Dataset,
|
||||
count_lookup: dict[str, int],
|
||||
from_phone: str,
|
||||
to_phone: str,
|
||||
) -> None:
|
||||
"""Get snapshots to delete.
|
||||
|
||||
Args:
|
||||
dataset (Dataset): the dataset
|
||||
count_lookup (dict[str, int]): the count lookup
|
||||
from_phone (str): The Signal account sending alerts.
|
||||
to_phone (str): The Signal account receiving alerts.
|
||||
"""
|
||||
snapshots = dataset.get_snapshots()
|
||||
|
||||
@@ -141,7 +127,7 @@ def get_snapshots_to_delete(
|
||||
for snapshot in snapshots_being_deleted:
|
||||
if error := dataset.delete_snapshot(snapshot):
|
||||
error_message = f"{dataset.name}@{snapshot} failed to delete: {error}"
|
||||
signal_alert(error_message, from_phone, to_phone)
|
||||
signal_alert(error_message)
|
||||
logger.error(error_message)
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
"""Van weather service - fetches weather with masked GPS location."""
|
||||
@@ -0,0 +1,293 @@
|
||||
"""Van weather service - fetches weather with masked GPS for privacy."""
|
||||
|
||||
import logging
|
||||
from datetime import UTC, datetime
|
||||
from typing import Annotated, Any
|
||||
|
||||
import httpx
|
||||
import typer
|
||||
from apscheduler.schedulers.blocking import BlockingScheduler
|
||||
from tenacity import before_sleep_log, retry, stop_after_attempt, wait_fixed
|
||||
|
||||
from python.common import configure_logger
|
||||
from python.van_weather.models import Config, DailyForecast, HourlyForecast, Weather
|
||||
|
||||
# Map Pirate Weather icons to Home Assistant conditions
|
||||
CONDITION_MAP = {
|
||||
"clear-day": "sunny",
|
||||
"clear-night": "clear-night",
|
||||
"rain": "rainy",
|
||||
"snow": "snowy",
|
||||
"sleet": "snowy-rainy",
|
||||
"wind": "windy",
|
||||
"fog": "fog",
|
||||
"cloudy": "cloudy",
|
||||
"partly-cloudy-day": "partlycloudy",
|
||||
"partly-cloudy-night": "partlycloudy",
|
||||
}
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
@retry(
|
||||
stop=stop_after_attempt(3),
|
||||
wait=wait_fixed(5),
|
||||
before_sleep=before_sleep_log(logger, logging.WARNING),
|
||||
reraise=True,
|
||||
)
|
||||
def get_ha_state(url: str, token: str, entity_id: str) -> float:
|
||||
"""Get numeric state from Home Asasistant entity."""
|
||||
response = httpx.get(
|
||||
f"{url}/api/states/{entity_id}",
|
||||
headers={"Authorization": f"Bearer {token}"},
|
||||
timeout=30,
|
||||
)
|
||||
response.raise_for_status()
|
||||
state = response.json()["state"]
|
||||
if state in ("unavailable", "unknown"):
|
||||
error = f"{entity_id} is {state}"
|
||||
raise ValueError(error)
|
||||
return float(state)
|
||||
|
||||
|
||||
def parse_daily_forecast(data: dict[str, dict[str, Any]]) -> list[DailyForecast]:
|
||||
"""Parse daily forecast from Pirate Weather API."""
|
||||
daily = data.get("daily", {}).get("data", [])
|
||||
daily_forecasts = []
|
||||
for day in daily[:8]: # Up to 8 days
|
||||
time_stamp = day.get("time")
|
||||
if time_stamp:
|
||||
date_time = datetime.fromtimestamp(time_stamp, tz=UTC).isoformat()
|
||||
daily_forecasts.append(
|
||||
DailyForecast(
|
||||
date_time=date_time,
|
||||
condition=CONDITION_MAP.get(day.get("icon", ""), "cloudy"),
|
||||
temperature=day.get("temperatureHigh"),
|
||||
templow=day.get("temperatureLow"),
|
||||
precipitation_probability=day.get("precipProbability"),
|
||||
moon_phase=day.get("moonPhase"),
|
||||
wind_gust=day.get("windGust"),
|
||||
cloud_cover=day.get("cloudCover"),
|
||||
)
|
||||
)
|
||||
|
||||
return daily_forecasts
|
||||
|
||||
|
||||
def parse_hourly_forecast(data: dict[str, dict[str, Any]]) -> list[HourlyForecast]:
|
||||
"""Parse hourly forecast from Pirate Weather API."""
|
||||
hourly = data.get("hourly", {}).get("data", [])
|
||||
hourly_forecasts = []
|
||||
for hour in hourly[:48]: # Up to 48 hours
|
||||
time_stamp = hour.get("time")
|
||||
if time_stamp:
|
||||
date_time = datetime.fromtimestamp(time_stamp, tz=UTC).isoformat()
|
||||
hourly_forecasts.append(
|
||||
HourlyForecast(
|
||||
date_time=date_time,
|
||||
condition=CONDITION_MAP.get(hour.get("icon", ""), "cloudy"),
|
||||
temperature=hour.get("temperature"),
|
||||
precipitation_probability=hour.get("precipProbability"),
|
||||
)
|
||||
)
|
||||
return hourly_forecasts
|
||||
|
||||
|
||||
@retry(
|
||||
stop=stop_after_attempt(3),
|
||||
wait=wait_fixed(5),
|
||||
before_sleep=before_sleep_log(logger, logging.WARNING),
|
||||
reraise=True,
|
||||
)
|
||||
def fetch_weather(api_key: str, lat: float, lon: float) -> Weather:
|
||||
"""Fetch weather from Pirate Weather API."""
|
||||
url = f"https://api.pirateweather.net/forecast/{api_key}/{lat},{lon}"
|
||||
response = httpx.get(url, params={"units": "us"}, timeout=30)
|
||||
response.raise_for_status()
|
||||
data = response.json()
|
||||
|
||||
daily_forecasts = parse_daily_forecast(data)
|
||||
hourly_forecasts = parse_hourly_forecast(data)
|
||||
|
||||
current = data.get("currently", {})
|
||||
icon = current.get("icon", "")
|
||||
return Weather(
|
||||
temperature=current.get("temperature"),
|
||||
feels_like=current.get("apparentTemperature"),
|
||||
humidity=current.get("humidity"),
|
||||
wind_speed=current.get("windSpeed"),
|
||||
wind_bearing=current.get("windBearing"),
|
||||
condition=CONDITION_MAP.get(icon, "cloudy"),
|
||||
summary=current.get("summary"),
|
||||
pressure=current.get("pressure"),
|
||||
visibility=current.get("visibility"),
|
||||
uv_index=current.get("uvIndex"),
|
||||
ozone=current.get("ozone"),
|
||||
nearest_storm_distance=current.get("nearestStormDistance"),
|
||||
nearest_storm_bearing=current.get("nearestStormBearing"),
|
||||
precip_probability=current.get("precipProbability"),
|
||||
cloud_cover=current.get("cloudCover"),
|
||||
daily_forecasts=daily_forecasts,
|
||||
hourly_forecasts=hourly_forecasts,
|
||||
)
|
||||
|
||||
|
||||
@retry(
|
||||
stop=stop_after_attempt(3),
|
||||
wait=wait_fixed(5),
|
||||
before_sleep=before_sleep_log(logger, logging.WARNING),
|
||||
reraise=True,
|
||||
)
|
||||
def post_to_ha(url: str, token: str, weather: Weather) -> None:
|
||||
"""Post weather data to Home Assistant as sensor entities."""
|
||||
headers = {"Authorization": f"Bearer {token}"}
|
||||
|
||||
# Post current weather as individual sensors
|
||||
sensors = {
|
||||
"sensor.van_weather_condition": {
|
||||
"state": weather.condition or "unknown",
|
||||
"attributes": {"friendly_name": "Van Weather Condition"},
|
||||
},
|
||||
"sensor.van_weather_temperature": {
|
||||
"state": weather.temperature,
|
||||
"attributes": {"unit_of_measurement": "°F", "device_class": "temperature"},
|
||||
},
|
||||
"sensor.van_weather_apparent_temperature": {
|
||||
"state": weather.feels_like,
|
||||
"attributes": {"unit_of_measurement": "°F", "device_class": "temperature"},
|
||||
},
|
||||
"sensor.van_weather_humidity": {
|
||||
"state": int((weather.humidity or 0) * 100),
|
||||
"attributes": {"unit_of_measurement": "%", "device_class": "humidity"},
|
||||
},
|
||||
"sensor.van_weather_pressure": {
|
||||
"state": weather.pressure,
|
||||
"attributes": {"unit_of_measurement": "mbar", "device_class": "pressure"},
|
||||
},
|
||||
"sensor.van_weather_wind_speed": {
|
||||
"state": weather.wind_speed,
|
||||
"attributes": {"unit_of_measurement": "mph", "device_class": "wind_speed"},
|
||||
},
|
||||
"sensor.van_weather_wind_bearing": {
|
||||
"state": weather.wind_bearing,
|
||||
"attributes": {"unit_of_measurement": "°"},
|
||||
},
|
||||
"sensor.van_weather_visibility": {
|
||||
"state": weather.visibility,
|
||||
"attributes": {"unit_of_measurement": "mi"},
|
||||
},
|
||||
"sensor.van_weather_uv_index": {
|
||||
"state": weather.uv_index,
|
||||
"attributes": {"friendly_name": "Van Weather UV Index", "icon": "mdi:sun-wireless"},
|
||||
},
|
||||
"sensor.van_weather_ozone": {
|
||||
"state": weather.ozone,
|
||||
"attributes": {"unit_of_measurement": "DU", "icon": "mdi:earth"},
|
||||
},
|
||||
"sensor.van_weather_nearest_storm_distance": {
|
||||
"state": weather.nearest_storm_distance,
|
||||
"attributes": {"unit_of_measurement": "mi", "icon": "mdi:weather-lightning"},
|
||||
},
|
||||
"sensor.van_weather_nearest_storm_bearing": {
|
||||
"state": weather.nearest_storm_bearing,
|
||||
"attributes": {"unit_of_measurement": "°", "icon": "mdi:weather-lightning"},
|
||||
},
|
||||
"sensor.van_weather_precip_probability": {
|
||||
"state": int((weather.precip_probability or 0) * 100),
|
||||
"attributes": {"unit_of_measurement": "%", "icon": "mdi:weather-rainy"},
|
||||
},
|
||||
"sensor.van_weather_cloud_cover": {
|
||||
"state": int((weather.cloud_cover or 0) * 100),
|
||||
"attributes": {"unit_of_measurement": "%", "icon": "mdi:weather-cloudy"},
|
||||
},
|
||||
}
|
||||
|
||||
for entity_id, data in sensors.items():
|
||||
if data["state"] is not None:
|
||||
response = httpx.post(f"{url}/api/states/{entity_id}", headers=headers, json=data, timeout=30)
|
||||
response.raise_for_status()
|
||||
|
||||
# Post daily forecast as JSON attribute sensor
|
||||
daily_forecast = [
|
||||
{
|
||||
"datetime": daily_forecast.date_time.isoformat(),
|
||||
"condition": daily_forecast.condition,
|
||||
"temperature": daily_forecast.temperature,
|
||||
"templow": daily_forecast.templow,
|
||||
"precipitation_probability": int((daily_forecast.precipitation_probability or 0) * 100),
|
||||
}
|
||||
for daily_forecast in weather.daily_forecasts
|
||||
]
|
||||
|
||||
response = httpx.post(
|
||||
f"{url}/api/states/sensor.van_weather_forecast_daily",
|
||||
headers=headers,
|
||||
json={"state": len(daily_forecast), "attributes": {"forecast": daily_forecast}},
|
||||
timeout=30,
|
||||
)
|
||||
response.raise_for_status()
|
||||
|
||||
# Post hourly forecast as JSON attribute sensor
|
||||
hourly_forecast = [
|
||||
{
|
||||
"datetime": hourly_forecast.date_time.isoformat(),
|
||||
"condition": hourly_forecast.condition,
|
||||
"temperature": hourly_forecast.temperature,
|
||||
"precipitation_probability": int((hourly_forecast.precipitation_probability or 0) * 100),
|
||||
}
|
||||
for hourly_forecast in weather.hourly_forecasts
|
||||
]
|
||||
|
||||
response = httpx.post(
|
||||
f"{url}/api/states/sensor.van_weather_forecast_hourly",
|
||||
headers=headers,
|
||||
json={"state": len(hourly_forecast), "attributes": {"forecast": hourly_forecast}},
|
||||
timeout=30,
|
||||
)
|
||||
response.raise_for_status()
|
||||
|
||||
|
||||
def update_weather(config: Config) -> None:
|
||||
"""Fetch weather using last-known location, post to HA."""
|
||||
lat = get_ha_state(config.ha_url, config.ha_token, config.lat_entity)
|
||||
lon = get_ha_state(config.ha_url, config.ha_token, config.lon_entity)
|
||||
|
||||
masked_lat = round(lat, config.mask_decimals)
|
||||
masked_lon = round(lon, config.mask_decimals)
|
||||
|
||||
logger.info(f"Masked location: {masked_lat}, {masked_lon}")
|
||||
|
||||
weather = fetch_weather(config.pirate_weather_api_key, masked_lat, masked_lon)
|
||||
logger.info(f"Weather: {weather.temperature}°F, {weather.condition}")
|
||||
|
||||
post_to_ha(config.ha_url, config.ha_token, weather)
|
||||
logger.info("Posted weather to HA")
|
||||
|
||||
|
||||
def main(
|
||||
ha_url: Annotated[str, typer.Option(envvar="HA_URL")],
|
||||
ha_token: Annotated[str, typer.Option(envvar="HA_TOKEN")],
|
||||
api_key: Annotated[str, typer.Option(envvar="PIRATE_WEATHER_API_KEY")],
|
||||
interval: Annotated[int, typer.Option(help="Poll interval in seconds")] = 900,
|
||||
log_level: Annotated[str, typer.Option()] = "INFO",
|
||||
) -> None:
|
||||
"""Fetch weather for van using masked GPS location."""
|
||||
configure_logger(log_level)
|
||||
|
||||
config = Config(ha_url=ha_url, ha_token=ha_token, pirate_weather_api_key=api_key)
|
||||
|
||||
logger.info(f"Starting van weather service, polling every {interval}s")
|
||||
|
||||
scheduler = BlockingScheduler()
|
||||
scheduler.add_job(
|
||||
update_weather,
|
||||
"interval",
|
||||
seconds=interval,
|
||||
args=[config],
|
||||
next_run_time=datetime.now(UTC),
|
||||
)
|
||||
scheduler.start()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
typer.run(main)
|
||||
@@ -0,0 +1,72 @@
|
||||
"""Models for van weather service."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from datetime import datetime # noqa: TC003 This is required for pydantic
|
||||
|
||||
from pydantic import BaseModel, field_serializer
|
||||
|
||||
|
||||
class Config(BaseModel):
|
||||
"""Service configuration."""
|
||||
|
||||
ha_url: str
|
||||
ha_token: str
|
||||
pirate_weather_api_key: str
|
||||
lat_entity: str = "sensor.van_last_known_latitude"
|
||||
lon_entity: str = "sensor.van_last_known_longitude"
|
||||
mask_decimals: int = 1 # ~11km accuracy
|
||||
|
||||
|
||||
class DailyForecast(BaseModel):
|
||||
"""Daily forecast entry."""
|
||||
|
||||
date_time: datetime
|
||||
condition: str | None = None
|
||||
temperature: float | None = None # High
|
||||
templow: float | None = None # Low
|
||||
precipitation_probability: float | None = None
|
||||
moon_phase: float | None = None
|
||||
wind_gust: float | None = None
|
||||
cloud_cover: float | None = None
|
||||
|
||||
@field_serializer("date_time")
|
||||
def serialize_date_time(self, date_time: datetime) -> str:
|
||||
"""Serialize datetime to ISO format."""
|
||||
return date_time.isoformat()
|
||||
|
||||
|
||||
class HourlyForecast(BaseModel):
|
||||
"""Hourly forecast entry."""
|
||||
|
||||
date_time: datetime
|
||||
condition: str | None = None
|
||||
temperature: float | None = None
|
||||
precipitation_probability: float | None = None
|
||||
|
||||
@field_serializer("date_time")
|
||||
def serialize_date_time(self, date_time: datetime) -> str:
|
||||
"""Serialize datetime to ISO format."""
|
||||
return date_time.isoformat()
|
||||
|
||||
|
||||
class Weather(BaseModel):
|
||||
"""Weather data from Pirate Weather."""
|
||||
|
||||
temperature: float | None = None
|
||||
feels_like: float | None = None
|
||||
humidity: float | None = None
|
||||
wind_speed: float | None = None
|
||||
wind_bearing: float | None = None
|
||||
condition: str | None = None
|
||||
summary: str | None = None
|
||||
pressure: float | None = None
|
||||
visibility: float | None = None
|
||||
uv_index: float | None = None
|
||||
ozone: float | None = None
|
||||
nearest_storm_distance: float | None = None
|
||||
nearest_storm_bearing: float | None = None
|
||||
precip_probability: float | None = None
|
||||
cloud_cover: float | None = None
|
||||
daily_forecasts: list[DailyForecast] = []
|
||||
hourly_forecasts: list[HourlyForecast] = []
|
||||
@@ -1,37 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -Eeuo pipefail
|
||||
|
||||
if [[ "$(hostname)" != "jeeves" ]]; then
|
||||
echo "Signal device authorization must run on jeeves." >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$EUID" -ne 0 ]]; then
|
||||
echo "Signal device authorization must run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$#" -ne 1 ]]; then
|
||||
echo "Usage: signal_authorize.sh DEVICE_URI" >&2
|
||||
exit 2
|
||||
fi
|
||||
if [[ "$1" != sgnl://linkdevice\?* ]]; then
|
||||
echo "Invalid Signal device link URI." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
service_name="signal-cli"
|
||||
data_dir="/var/lib/signal-cli"
|
||||
device_uri="$1"
|
||||
restart_service=false
|
||||
|
||||
cleanup() {
|
||||
if [[ "$restart_service" == true ]]; then
|
||||
systemctl start "$service_name"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
restart_service=true
|
||||
systemctl stop "$service_name"
|
||||
runuser -u signal-cli -- \
|
||||
signal-cli --data-dir "$data_dir" -a +12016554378 addDevice --uri "$device_uri"
|
||||
@@ -1,60 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -Eeuo pipefail
|
||||
|
||||
host_name="$(hostname)"
|
||||
if [[ "$#" -ne 0 ]]; then
|
||||
echo "Usage: signal_link.sh" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
service_name="signal-cli"
|
||||
data_dir="/var/lib/signal-cli"
|
||||
link_pid=""
|
||||
temp_dir=""
|
||||
restart_service=false
|
||||
|
||||
cleanup() {
|
||||
if [[ -n "$link_pid" ]] && kill -0 "$link_pid" 2>/dev/null; then
|
||||
kill "$link_pid" 2>/dev/null || true
|
||||
wait "$link_pid" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
if [[ -n "$temp_dir" ]]; then
|
||||
rm -f -- "$temp_dir/link-uri"
|
||||
rmdir -- "$temp_dir"
|
||||
fi
|
||||
|
||||
if [[ "$restart_service" == true ]]; then
|
||||
sudo systemctl start "$service_name"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
restart_service=true
|
||||
sudo systemctl stop "$service_name"
|
||||
|
||||
temp_dir="$(mktemp -d)"
|
||||
link_fifo="$temp_dir/link-uri"
|
||||
mkfifo "$link_fifo"
|
||||
|
||||
sudo -u signal-cli \
|
||||
signal-cli --data-dir "$data_dir" link --name "$host_name" >"$link_fifo" &
|
||||
link_pid="$!"
|
||||
|
||||
if ! IFS= read -r device_uri <"$link_fifo"; then
|
||||
wait "$link_pid"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$device_uri" != sgnl://linkdevice\?* ]]; then
|
||||
echo "signal-cli returned an invalid device link URI." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Run this command manually on jeeves in another dotfiles dir:"
|
||||
printf "sudo ./scripts/signal/authorize.sh %q\n" "$device_uri"
|
||||
echo "Waiting for jeeves to authorize this device..."
|
||||
|
||||
wait "$link_pid"
|
||||
link_pid=""
|
||||
echo "$host_name is now linked to the Signal account on jeeves."
|
||||
@@ -8,7 +8,7 @@
|
||||
# loader path, which NixOS does not provide globally.
|
||||
ebook-search = pkgs.mkShell {
|
||||
nativeBuildInputs = with pkgs; [
|
||||
python314
|
||||
my_python
|
||||
uv
|
||||
];
|
||||
LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
|
||||
@@ -23,6 +23,7 @@
|
||||
nix
|
||||
home-manager
|
||||
git
|
||||
my_python
|
||||
|
||||
ssh-to-age
|
||||
gnupg
|
||||
|
||||
@@ -3,17 +3,18 @@
|
||||
imports = [
|
||||
"${inputs.self}/users/math"
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/users/steve"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/monitoring-agent.nix"
|
||||
"${inputs.self}/common/optional/nvidia.nix"
|
||||
"${inputs.self}/common/optional/scanner.nix"
|
||||
"${inputs.self}/common/optional/signal-cli.nix"
|
||||
"${inputs.self}/common/optional/steam.nix"
|
||||
"${inputs.self}/common/optional/syncthing_base.nix"
|
||||
"${inputs.self}/common/optional/systemd-boot.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/update.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3"
|
||||
"${inputs.self}/common/optional/yubikey.nix"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./hardware.nix
|
||||
./syncthing.nix
|
||||
|
||||
@@ -50,11 +50,6 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
|
||||
@@ -22,12 +22,6 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/models"]
|
||||
15_min = 4
|
||||
hourly = 24
|
||||
|
||||
@@ -4,13 +4,11 @@
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/signal-cli.nix"
|
||||
"${inputs.self}/common/optional/ssh_decrypt.nix"
|
||||
"${inputs.self}/common/optional/syncthing_base.nix"
|
||||
"${inputs.self}/common/optional/systemd-boot.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/update.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./docker
|
||||
./hardware.nix
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# docker_networks
|
||||
|
||||
docker network create -d bridge web
|
||||
@@ -53,11 +53,6 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -4,20 +4,6 @@
|
||||
...
|
||||
}:
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
(final: _prev: {
|
||||
heater_python = final.python314.withPackages (
|
||||
ps: with ps; [
|
||||
fastapi
|
||||
pydantic
|
||||
tinytuya
|
||||
typer
|
||||
uvicorn
|
||||
]
|
||||
);
|
||||
})
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 8124 ];
|
||||
|
||||
systemd.services.heater-api = {
|
||||
@@ -31,7 +17,7 @@
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.heater_python}/bin/python -m python.heater.main --host 0.0.0.0 --port 8124";
|
||||
ExecStart = "${pkgs.my_python}/bin/python -m python.heater.main --host 0.0.0.0 --port 8124";
|
||||
EnvironmentFile = "/etc/heater.env";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
|
||||
@@ -68,6 +68,7 @@
|
||||
paho-mqtt # for mqtt
|
||||
psycopg2 # for postgresql
|
||||
py-improv-ble-client # for esphome
|
||||
pymodbus # for modbus
|
||||
pyopenweathermap # for weather
|
||||
pymetno # for met.no weather
|
||||
uiprotect # for ubiquiti integration
|
||||
@@ -75,12 +76,10 @@
|
||||
jsonpath # for rest sensors
|
||||
monarchmoneycommunity # for monarch
|
||||
];
|
||||
extraComponents = [
|
||||
"isal"
|
||||
"modbus" # for victron modbus integration
|
||||
];
|
||||
extraComponents = [ "isal" ];
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
garmin_connect
|
||||
pirate-weather
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.docker.daemon.settings."data-root" = "${vars.containers}/docker";
|
||||
|
||||
# nixos-container hardcodes its state directory to /var/lib/nixos-containers,
|
||||
# so route it to the shared container dataset with a bind mount.
|
||||
fileSystems."/var/lib/nixos-containers" = {
|
||||
device = "${vars.containers}/nixos-containers";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
prepare-docker-storage = {
|
||||
description = "Create Docker storage directory";
|
||||
requiredBy = [ "docker.service" ];
|
||||
before = [ "docker.service" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
after = [ "zfs-mount.service" ];
|
||||
path = [
|
||||
pkgs.coreutils
|
||||
pkgs.util-linux
|
||||
];
|
||||
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = [ "/nix" ];
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mountpoint -q ${vars.containers}
|
||||
install -d -m 0710 ${vars.containers}/docker
|
||||
'';
|
||||
};
|
||||
|
||||
prepare-nixos-container-storage = {
|
||||
description = "Create NixOS container storage directory";
|
||||
requiredBy = [ "var-lib-nixos\\x2dcontainers.mount" ];
|
||||
before = [ "var-lib-nixos\\x2dcontainers.mount" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
after = [ "zfs-mount.service" ];
|
||||
path = [
|
||||
pkgs.coreutils
|
||||
pkgs.util-linux
|
||||
];
|
||||
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = [ "/nix" ];
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mountpoint -q ${vars.containers}
|
||||
install -d -m 0755 ${vars.containers}/nixos-containers
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,25 +1,24 @@
|
||||
{ inputs, ... }:
|
||||
{ inputs, lib, ... }:
|
||||
let
|
||||
vars = import ./vars.nix;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
"${inputs.self}/users/dov"
|
||||
"${inputs.self}/users/math"
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/users/steve"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/monitoring-agent.nix"
|
||||
"${inputs.self}/common/optional/signal-cli.nix"
|
||||
"${inputs.self}/common/optional/ssh_decrypt.nix"
|
||||
"${inputs.self}/common/optional/syncthing_base.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/update.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./monitoring
|
||||
./docker
|
||||
./services
|
||||
./containers.nix
|
||||
./hardware.nix
|
||||
./networking
|
||||
./programs.nix
|
||||
@@ -27,6 +26,8 @@ in
|
||||
./syncthing.nix
|
||||
];
|
||||
|
||||
nix.settings.system-features = lib.mkAfter [ "gccarch-x86-64-v3" ];
|
||||
|
||||
services = {
|
||||
openssh.ports = [ 629 ];
|
||||
|
||||
@@ -36,6 +37,14 @@ in
|
||||
path = ./snapshot_config.toml;
|
||||
EnvironmentFile = "${vars.secrets}/services/snapshot_manager";
|
||||
};
|
||||
|
||||
zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [
|
||||
"e4da7455b2ae64ca"
|
||||
"a09acf02330d37b9"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = {
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers.signal_cli_rest_api = {
|
||||
image = "bbernhard/signal-cli-rest-api:0.199-dev";
|
||||
ports = [
|
||||
"8989:8080"
|
||||
];
|
||||
volumes = [
|
||||
"${vars.docker_configs}/signal-cli-config:/home/.local/share/signal-cli"
|
||||
];
|
||||
environment = {
|
||||
MODE = "json-rpc";
|
||||
};
|
||||
autoStart = true;
|
||||
};
|
||||
}
|
||||
@@ -96,11 +96,6 @@ in
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
# Monitoring
|
||||
|
||||
## Vultr API metrics
|
||||
|
||||
The `vultr-exporter` service reads its API token from:
|
||||
|
||||
```text
|
||||
/zfs/storage/secrets/services/vultr-exporter
|
||||
```
|
||||
|
||||
Create the file on Jeeves as root with the following contents:
|
||||
|
||||
```text
|
||||
API_KEY=<Vultr API token>
|
||||
```
|
||||
|
||||
The token needs read access to the Vultr Account and Billing APIs. Unrelated
|
||||
resource collectors are disabled in the packaged exporter.
|
||||
|
||||
Restrict the file to root and ensure the public egress IP used by Jeeves is
|
||||
allowed for the token in the Vultr API settings:
|
||||
|
||||
```console
|
||||
sudo chown root:root /zfs/storage/secrets/services/vultr-exporter
|
||||
sudo chmod 600 /zfs/storage/secrets/services/vultr-exporter
|
||||
```
|
||||
|
||||
The exporter listens on `127.0.0.1:9188`; it is scraped by the local
|
||||
`prometheus-main` service every five minutes and is not exposed through the
|
||||
host firewall.
|
||||
|
||||
Portal-1 exposes its node exporter only through `tailscale0` on port `9100`.
|
||||
Jeeves reaches it using the Portal-1 Tailscale hostname.
|
||||
@@ -7,13 +7,13 @@ let
|
||||
gitea_ssh = 2223;
|
||||
grafana = 3000;
|
||||
jellyfin_http = 8096;
|
||||
jellyswarrm = 3100;
|
||||
nix_binary_cache = 5000;
|
||||
nornsight = 8001;
|
||||
ollama = 11434;
|
||||
open_webui = 8080;
|
||||
postgresql = 5432;
|
||||
share = 8091;
|
||||
signal_cli = 8989;
|
||||
syncthing = 8384;
|
||||
};
|
||||
in
|
||||
@@ -28,7 +28,6 @@ in
|
||||
ports.audiobookshelf
|
||||
ports.gems
|
||||
ports.jellyfin_http
|
||||
ports.jellyswarrm
|
||||
ports.nix_binary_cache
|
||||
ports.nornsight
|
||||
ports.share
|
||||
@@ -41,6 +40,7 @@ in
|
||||
ports.ollama
|
||||
ports.open_webui
|
||||
ports.postgresql
|
||||
ports.signal_cli
|
||||
ports.syncthing
|
||||
];
|
||||
};
|
||||
|
||||
@@ -21,16 +21,5 @@
|
||||
nix-builder-12.enable = true;
|
||||
nix-builder-13.enable = true;
|
||||
nix-builder-14.enable = true;
|
||||
|
||||
# Warm the shared x86-64-v3 cache before the smaller per-system runners
|
||||
# start. Eight jobs with eight cores each can use Jeeves' 64 logical CPUs,
|
||||
# while the 6000% quota leaves some capacity for its normal services.
|
||||
nix-cache-builder = {
|
||||
enable = true;
|
||||
labels = [ "nix-cache-builder:host" ];
|
||||
cores = 8;
|
||||
maxJobs = 8;
|
||||
cpuQuota = "6000%";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,7 +1,8 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
outputs,
|
||||
utils,
|
||||
...
|
||||
}:
|
||||
|
||||
@@ -11,130 +12,6 @@ let
|
||||
cfg = config.services.nix_builder;
|
||||
runnerUsername = "gitea-runner";
|
||||
runnerUserid = 601;
|
||||
containerConfig =
|
||||
containerCfg:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
giteaAutomationPython = pkgs.python314.withPackages (
|
||||
ps: with ps; [
|
||||
httpx
|
||||
pydantic
|
||||
typer
|
||||
]
|
||||
);
|
||||
runnerConfigFile = (pkgs.formats.yaml { }).generate "gitea-runner.yaml" { };
|
||||
registerRunner = pkgs.writeShellApplication {
|
||||
name = "register-gitea-runner";
|
||||
runtimeInputs = [
|
||||
pkgs.coreutils
|
||||
pkgs.hostname
|
||||
config.services.gitea-actions-runner.package
|
||||
];
|
||||
text = builtins.readFile ./register_gitea_runner.sh;
|
||||
};
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
hostName = "nix-builder";
|
||||
useDHCP = lib.mkDefault true;
|
||||
interfaces.eth0.useDHCP = true;
|
||||
# Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
|
||||
useHostResolvConf = false;
|
||||
};
|
||||
nix.settings = {
|
||||
inherit (containerCfg) cores;
|
||||
max-jobs = containerCfg.maxJobs;
|
||||
system-features = lib.mkAfter [
|
||||
"gccarch-x86-64-v2"
|
||||
"gccarch-x86-64-v3"
|
||||
];
|
||||
trusted-substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://cache.tmmworkshop.com"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
substituters = [
|
||||
"https://cache.nixos.org/?priority=2&want-mass-query=true"
|
||||
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
|
||||
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
sandbox = true;
|
||||
allowed-users = [ runnerUsername ];
|
||||
trusted-users = [
|
||||
"root"
|
||||
runnerUsername
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users.${runnerUsername} = {
|
||||
isSystemUser = true;
|
||||
group = runnerUsername;
|
||||
uid = runnerUserid;
|
||||
};
|
||||
groups.${runnerUsername}.gid = runnerUserid;
|
||||
};
|
||||
services.gitea-actions-runner.instances.builder = {
|
||||
enable = true;
|
||||
name = "jeeves-nix-builder";
|
||||
url = "http://192.168.99.14:6443/";
|
||||
labels = containerCfg.labels;
|
||||
tokenFile = "/run/secrets/gitea-runners/registration-token";
|
||||
settings.runner.timeout = "12h";
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
giteaAutomationPython
|
||||
gnused
|
||||
nix
|
||||
nixfmt
|
||||
nixos-rebuild
|
||||
nodejs
|
||||
ruff
|
||||
treefmt
|
||||
wget
|
||||
];
|
||||
};
|
||||
systemd.services."gitea-runner-builder" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = mkForce false;
|
||||
User = mkForce runnerUsername;
|
||||
Group = mkForce runnerUsername;
|
||||
ExecStartPre = mkForce [
|
||||
"${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs containerCfg.labels}"
|
||||
];
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
mkContainerPath =
|
||||
containerCfg:
|
||||
(import "${pkgs.path}/nixos/lib/eval-config.nix" {
|
||||
modules = [
|
||||
{
|
||||
boot.isNspawnContainer = true;
|
||||
nixpkgs.pkgs = pkgs;
|
||||
}
|
||||
(containerConfig containerCfg)
|
||||
];
|
||||
system = null;
|
||||
}).config.system.build.toplevel;
|
||||
in
|
||||
{
|
||||
options.services.nix_builder = {
|
||||
@@ -149,36 +26,7 @@ in
|
||||
types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
enable = mkEnableOption "Gitea runner container";
|
||||
|
||||
labels = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [
|
||||
"self-hosted:host"
|
||||
"nixos:host"
|
||||
];
|
||||
description = "Gitea Actions labels advertised by this runner.";
|
||||
};
|
||||
|
||||
cores = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 8;
|
||||
description = "Number of cores made available to each Nix build job.";
|
||||
};
|
||||
|
||||
maxJobs = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 2;
|
||||
description = "Maximum number of Nix build jobs run in parallel.";
|
||||
};
|
||||
|
||||
cpuQuota = mkOption {
|
||||
type = types.str;
|
||||
default = "800%";
|
||||
description = "systemd CPU quota for the runner container.";
|
||||
};
|
||||
};
|
||||
options.enable = mkEnableOption "Gitea runner container";
|
||||
}
|
||||
)
|
||||
);
|
||||
@@ -200,11 +48,9 @@ in
|
||||
containers = mapAttrs (
|
||||
name: containerCfg:
|
||||
mkIf containerCfg.enable {
|
||||
path = mkContainerPath containerCfg;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostBridge = cfg.bridgeName;
|
||||
extraFlags = [ "--hostname=${name}" ];
|
||||
bindMounts = {
|
||||
host-nix = {
|
||||
mountPoint = "/host-nix/var/nix/daemon-socket";
|
||||
@@ -222,18 +68,107 @@ in
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking = {
|
||||
useDHCP = lib.mkDefault true;
|
||||
interfaces.eth0.useDHCP = true;
|
||||
# Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
|
||||
useHostResolvConf = false;
|
||||
};
|
||||
nix.settings = {
|
||||
system-features = lib.mkAfter [ "gccarch-x86-64-v3" ];
|
||||
trusted-substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://cache.tmmworkshop.com"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
substituters = [
|
||||
"https://cache.nixos.org/?priority=2&want-mass-query=true"
|
||||
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
|
||||
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
sandbox = true;
|
||||
allowed-users = [ "gitea-runner" ];
|
||||
trusted-users = [
|
||||
"root"
|
||||
"gitea-runner"
|
||||
];
|
||||
};
|
||||
nixpkgs = {
|
||||
overlays = builtins.attrValues outputs.overlays;
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
users = {
|
||||
users.${runnerUsername} = {
|
||||
isSystemUser = true;
|
||||
group = runnerUsername;
|
||||
uid = runnerUserid;
|
||||
};
|
||||
groups.${runnerUsername}.gid = runnerUserid;
|
||||
};
|
||||
services.gitea-actions-runner.instances.${name} = {
|
||||
enable = true;
|
||||
name = "jeeves-${name}";
|
||||
url = "http://192.168.99.14:6443/";
|
||||
labels = [
|
||||
"self-hosted:host"
|
||||
"nixos:host"
|
||||
];
|
||||
tokenFile = "/run/secrets/gitea-runners/registration-token";
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
my_python
|
||||
nix
|
||||
nixfmt
|
||||
nixos-rebuild
|
||||
nodejs
|
||||
treefmt
|
||||
wget
|
||||
];
|
||||
};
|
||||
systemd.services."gitea-runner-${utils.escapeSystemdPath name}" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = mkForce false;
|
||||
User = mkForce runnerUsername;
|
||||
Group = mkForce runnerUsername;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
}
|
||||
) cfg.containers;
|
||||
|
||||
systemd = {
|
||||
services = mapAttrs' (
|
||||
name: containerCfg:
|
||||
nameValuePair "container@${name}" {
|
||||
requires = [ "gitea.service" ];
|
||||
after = [ "gitea.service" ];
|
||||
serviceConfig.CPUQuota = containerCfg.cpuQuota;
|
||||
}
|
||||
) (filterAttrs (_: c: c.enable) cfg.containers);
|
||||
services = builtins.listToAttrs (
|
||||
map (name: {
|
||||
name = "container@${name}";
|
||||
value = {
|
||||
requires = [ "gitea.service" ];
|
||||
after = [ "gitea.service" ];
|
||||
};
|
||||
}) (builtins.attrNames (filterAttrs (_: c: c.enable) cfg.containers))
|
||||
);
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d ${vars.uv_cache} 0755 ${runnerUsername} ${runnerUsername} - -"
|
||||
|
||||
@@ -1,36 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
legacy_instance_dir="$STATE_DIRECTORY/$(hostname)"
|
||||
instance_dir="$STATE_DIRECTORY/$1"
|
||||
runner_url="$2"
|
||||
runner_config_file="$3"
|
||||
shift 3
|
||||
runner_labels="$(IFS=,; printf '%s' "$*")"
|
||||
|
||||
if [ ! -e "$instance_dir" ] && [ -d "$legacy_instance_dir" ]; then
|
||||
mv "$legacy_instance_dir" "$instance_dir"
|
||||
fi
|
||||
|
||||
mkdir -vp "$instance_dir"
|
||||
cd "$instance_dir" || exit 1
|
||||
|
||||
token_hash_file="$instance_dir/.token-hash"
|
||||
token_hash_current="$(printf '%s' "$TOKEN" | sha256sum | cut -d' ' -f1)"
|
||||
token_hash_stored="$(cat "$token_hash_file" 2>/dev/null || echo "")"
|
||||
labels_file="$instance_dir/.labels"
|
||||
labels_wanted="$(printf '%s\n' "$@" | sort)"
|
||||
labels_current="$(cat "$labels_file" 2>/dev/null || echo 0)"
|
||||
|
||||
if [ ! -e "$instance_dir/.runner" ] || [ "$labels_wanted" != "$labels_current" ] || [ "$token_hash_current" != "$token_hash_stored" ]; then
|
||||
rm -v "$instance_dir/.runner" || true
|
||||
|
||||
gitea-runner register --no-interactive \
|
||||
--instance "$runner_url" \
|
||||
--token "$TOKEN" \
|
||||
--name "jeeves-$(hostname)" \
|
||||
--labels "$runner_labels" \
|
||||
--config "$runner_config_file"
|
||||
|
||||
printf '%s' "$token_hash_current" > "$token_hash_file"
|
||||
printf '%s\n' "$labels_wanted" > "$labels_file"
|
||||
fi
|
||||
@@ -17,7 +17,6 @@ sudo zpool create scratch -o ashift=12 -O acltype=posixacl -O atime=off -O dnode
|
||||
# media datasets
|
||||
sudo zfs create media/temp -o sync=disabled -o redundant_metadata=none
|
||||
sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
|
||||
sudo zfs create media/secure/containers -o mountpoint=/zfs/media/containers -o compression=lz4 -o sync=disabled -o redundant_metadata=some -o normalization=none -o utf8only=off
|
||||
sudo zfs create media/secure/docker -o compression=zstd-9
|
||||
sudo zfs create media/secure/github-runners -o compression=zstd-9 -o sync=disabled
|
||||
sudo zfs create media/secure/notes -o copies=2
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
{
|
||||
...
|
||||
}:
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${vars.docker_configs}/camofox-browser 0750 root root - -"
|
||||
];
|
||||
|
||||
containers.camofox-browser = {
|
||||
autoStart = true;
|
||||
privateNetwork = false;
|
||||
bindMounts = {
|
||||
camofox-browser = {
|
||||
hostPath = "${vars.docker_configs}/camofox-browser";
|
||||
mountPoint = "/var/lib/camofox-browser";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
config =
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking.hostName = "camofox-browser";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
ffmpeg
|
||||
git
|
||||
nodejs
|
||||
python3Packages.yt-dlp
|
||||
];
|
||||
|
||||
systemd.services.camofox-browser = {
|
||||
description = "Camofox browser server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
environment = {
|
||||
CAMOFOX_HOST = "127.0.0.1";
|
||||
CAMOFOX_PORT = "9377";
|
||||
HOME = "/var/lib/camofox-browser";
|
||||
};
|
||||
path = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
nodejs
|
||||
];
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
WorkingDirectory = "/var/lib/camofox-browser";
|
||||
};
|
||||
script = ''
|
||||
set -eu
|
||||
|
||||
app_dir=/var/lib/camofox-browser/app
|
||||
|
||||
if [ ! -d "$app_dir/.git" ]; then
|
||||
git clone --depth 1 https://github.com/jo-inc/camofox-browser "$app_dir"
|
||||
fi
|
||||
|
||||
cd "$app_dir"
|
||||
|
||||
if [ ! -d node_modules ]; then
|
||||
npm install
|
||||
fi
|
||||
|
||||
exec npm start
|
||||
'';
|
||||
};
|
||||
|
||||
system.stateVersion = lib.mkDefault "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -6,47 +6,8 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
stateDir = "${vars.services}/gems";
|
||||
gemsPackages =
|
||||
ps: with ps; [
|
||||
fastapi
|
||||
jinja2
|
||||
pydantic
|
||||
pydantic-settings
|
||||
python-multipart
|
||||
typer
|
||||
uvicorn
|
||||
];
|
||||
in
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
(final: _prev: {
|
||||
gems_python = final.python314.withPackages gemsPackages;
|
||||
gems_test_python = final.python314.withPackages (
|
||||
ps:
|
||||
gemsPackages ps
|
||||
++ (with ps; [
|
||||
httpx
|
||||
pytest
|
||||
pytest-asyncio
|
||||
pytest-xdist
|
||||
])
|
||||
);
|
||||
gems_tests =
|
||||
final.runCommand "gems-tests"
|
||||
{
|
||||
nativeBuildInputs = [ final.gems_test_python ];
|
||||
}
|
||||
''
|
||||
export HOME="$TMPDIR"
|
||||
cd ${inputs.self}
|
||||
pytest -o cache_dir="$TMPDIR/pytest-cache" tests/gems
|
||||
touch "$out"
|
||||
'';
|
||||
})
|
||||
];
|
||||
|
||||
system.checks = [ pkgs.gems_tests ];
|
||||
|
||||
users.groups.gems = { };
|
||||
users.users.gems = {
|
||||
isSystemUser = true;
|
||||
@@ -75,7 +36,7 @@ in
|
||||
Type = "simple";
|
||||
User = "gems";
|
||||
Group = "gems";
|
||||
ExecStart = "${pkgs.gems_python}/bin/python -m python.gems.main --host 0.0.0.0 --port 8002";
|
||||
ExecStart = "${pkgs.my_python}/bin/python -m python.gems.main --host 0.0.0.0 --port 8002";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
StandardOutput = "journal";
|
||||
|
||||
@@ -19,7 +19,6 @@ in
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
ENDLESS_TASK_TIMEOUT = "12h";
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
server = {
|
||||
|
||||
@@ -1,16 +0,0 @@
|
||||
{ inputs, ... }:
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
imports = [ inputs.jellyswarrm.nixosModules.default ];
|
||||
|
||||
services.jellyswarrm = {
|
||||
enable = true;
|
||||
host = "0.0.0.0";
|
||||
port = 3100;
|
||||
dataDir = "${vars.services}/jellyswarrm";
|
||||
username = "admin";
|
||||
passwordFile = "${vars.secrets}/services/jellyswarrm-password";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
services.open-webui = {
|
||||
enable = true;
|
||||
host = "0.0.0.0";
|
||||
environment = {
|
||||
ANONYMIZED_TELEMETRY = "False";
|
||||
DO_NOT_TRACK = "True";
|
||||
SCARF_NO_ANALYTICS = "True";
|
||||
OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,7 +1,11 @@
|
||||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
systemd = {
|
||||
services = {
|
||||
@@ -26,6 +30,21 @@
|
||||
ExecStart = "${pkgs.bash}/bin/bash -c 'echo 1 > /sys/bus/pci/devices/0000:61:00.0/remove'";
|
||||
};
|
||||
};
|
||||
startup_validation = {
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "validates startup";
|
||||
path = [ pkgs.zfs ];
|
||||
environment = {
|
||||
PYTHONPATH = "${inputs.self}/";
|
||||
};
|
||||
serviceConfig = {
|
||||
EnvironmentFile = "${vars.secrets}/services/server-validation";
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.my_python}/bin/python -m python.system_tests.validate_system '${./validate_system.toml}'";
|
||||
};
|
||||
};
|
||||
};
|
||||
timers = {
|
||||
plex_permission = {
|
||||
@@ -36,6 +55,13 @@
|
||||
Unit = "plex_permission.service";
|
||||
};
|
||||
};
|
||||
startup_validation = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "10min";
|
||||
Unit = "startup_validation.service";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
zpool = ["root_pool", "storage", "media"]
|
||||
services = [
|
||||
"audiobookshelf",
|
||||
"docker",
|
||||
"jellyfin",
|
||||
]
|
||||
@@ -23,12 +23,6 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/var"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
@@ -66,12 +60,6 @@ daily = 30
|
||||
monthly = 12
|
||||
|
||||
# media
|
||||
["media/secure/containers"]
|
||||
15_min = 2
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["media/temp"]
|
||||
15_min = 2
|
||||
hourly = 0
|
||||
|
||||
@@ -5,7 +5,6 @@ let
|
||||
in
|
||||
{
|
||||
inherit zfs_media zfs_storage zfs_scratch;
|
||||
containers = "${zfs_media}/containers";
|
||||
database = "${zfs_media}/database";
|
||||
docker = "${zfs_media}/docker";
|
||||
docker_configs = "${zfs_media}/docker/configs";
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
# portal_1
|
||||
|
||||
Minimal NixOS target for a Vultr VM, installed with nixos-anywhere. The Nix
|
||||
flake target is `portal_1`; the machine hostname is `portal-1` because DNS
|
||||
hostnames cannot contain underscores.
|
||||
|
||||
## Before deploying
|
||||
|
||||
1. Confirm the VM's system disk is `/dev/vda`. If it is not, update both
|
||||
references in `disk-config.nix`.
|
||||
2. Confirm the SSH public key in `default.nix` is the key that should have
|
||||
administrator access.
|
||||
3. Boot the VM into a NixOS installer or another nixos-anywhere-compatible
|
||||
Linux rescue environment with root SSH access. Keep this environment
|
||||
running while completing the SOPS bootstrap below.
|
||||
|
||||
## Bootstrap SOPS
|
||||
|
||||
Use the rescue environment's SSH host key as the permanent portal identity.
|
||||
Replace `VM_IP` below:
|
||||
|
||||
```console
|
||||
ssh root@VM_IP 'cat /etc/ssh/ssh_host_ed25519_key.pub' | \
|
||||
nix shell nixpkgs#ssh-to-age --command ssh-to-age
|
||||
```
|
||||
|
||||
This prints an `age1...` recipient; it does not copy the private key. Add the
|
||||
recipient to `.sops.yaml`:
|
||||
|
||||
```yaml
|
||||
- &system_portal_1 age1...
|
||||
```
|
||||
|
||||
Then add `*system_portal_1` to the age recipients for
|
||||
`users/secrets.yaml`. Re-encrypt the existing file for the new recipient and
|
||||
add the Tailscale key:
|
||||
|
||||
```console
|
||||
nix shell nixpkgs#sops --command sops updatekeys users/secrets.yaml
|
||||
nix shell nixpkgs#sops --command sops users/secrets.yaml
|
||||
```
|
||||
|
||||
Add the OAuth client secret from the `Auth Keys: Write` credential in the SOPS
|
||||
editor and save it:
|
||||
|
||||
```yaml
|
||||
tailscale_auth_key: tskey-client-...
|
||||
```
|
||||
|
||||
## Deploy
|
||||
|
||||
From the repository root, replace `VM_IP` with the VM's public IP:
|
||||
|
||||
```console
|
||||
nix run github:nix-community/nixos-anywhere -- \
|
||||
--copy-host-keys --flake .#portal_1 root@VM_IP
|
||||
```
|
||||
|
||||
This repartitions `/dev/vda`, so anything already on that disk is erased. The
|
||||
layout reserves 8 GiB for swap and assigns the remaining space to the root
|
||||
filesystem.
|
||||
|
||||
`--copy-host-keys` preserves the same private SSH host key at
|
||||
`/etc/ssh/ssh_host_ed25519_key` on the installed system. SOPS-Nix converts that
|
||||
key to an age identity during activation. After the reboot, connect as
|
||||
`richie` and verify that automatic Tailscale enrollment succeeded:
|
||||
|
||||
```console
|
||||
ssh -p 278 richie@VM_IP
|
||||
sudo tailscale status
|
||||
```
|
||||
|
||||
The installed OpenSSH service listens on port 278. Port 22 is served by
|
||||
Endlessh and will not provide an SSH login.
|
||||
|
||||
HAProxy uses the same frontend, routing, and rate-limiting configuration as
|
||||
Jeeves. Portal manages the ACME certificates for the existing public domains;
|
||||
their DNS records must resolve to Portal for HTTP-01 issuance and renewal.
|
||||
|
||||
The application backends still use Jeeves' original `127.0.0.1` addresses.
|
||||
Replace them with the corresponding Tailscale addresses before directing
|
||||
application traffic through Portal. Ports 80 and 443 are allowed through the
|
||||
firewall.
|
||||
@@ -9,14 +9,14 @@
|
||||
inputs.disko.nixosModules.disko
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/signal-cli.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3"
|
||||
./disk-config.nix
|
||||
./haproxy
|
||||
./monitoring.nix
|
||||
];
|
||||
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
|
||||
boot = {
|
||||
# Avoid consuming the VM's limited memory for /tmp.
|
||||
tmp.useTmpfs = false;
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
systemd.services.agent-logger = {
|
||||
description = "Unified agent logger";
|
||||
after = [ "local-fs.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
environment = {
|
||||
AGENT_LOG_DB = "/var/lib/agent-logger/agent_log.sqlite";
|
||||
HOME = "/home/richie";
|
||||
PYTHONPATH = "${inputs.self}";
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "richie";
|
||||
WorkingDirectory = "/home/richie";
|
||||
ExecStart = "${pkgs.my_python}/bin/python -m python.agent_logger.main";
|
||||
StateDirectory = "agent-logger";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
StandardOutput = "journal";
|
||||
StandardError = "journal";
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = "read-only";
|
||||
PrivateTmp = true;
|
||||
ReadOnlyPaths = [ "${inputs.self}" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -12,6 +12,7 @@
|
||||
"${inputs.self}/common/optional/yubikey.nix"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./hardware.nix
|
||||
./open_webui.nix
|
||||
./programs.nix
|
||||
./qmk.nix
|
||||
./syncthing.nix
|
||||
|
||||
@@ -34,22 +34,14 @@
|
||||
device = "root_pool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/home" = {
|
||||
device = "root_pool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
{
|
||||
services.open-webui = {
|
||||
enable = true;
|
||||
host = "0.0.0.0";
|
||||
environment = {
|
||||
ANONYMIZED_TELEMETRY = "False";
|
||||
DO_NOT_TRACK = "True";
|
||||
SCARF_NO_ANALYTICS = "True";
|
||||
OLLAMA_API_BASE_URL = "https://ollama.com";
|
||||
WEBUI_AUTH = "False";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,104 @@
|
||||
"""test_components."""
|
||||
|
||||
from pytest_mock import MockerFixture
|
||||
|
||||
from python.system_tests.components import systemd_tests, zpool_tests
|
||||
from python.zfs import Zpool
|
||||
|
||||
temp = "Every feature flags pool has all supported and requested features enabled.\n"
|
||||
|
||||
SYSTEM_TESTS_COMPONENTS = "python.system_tests.components"
|
||||
|
||||
|
||||
def test_zpool_tests(mocker: MockerFixture) -> None:
|
||||
"""test_zpool_tests."""
|
||||
mock_zpool = mocker.MagicMock(spec=Zpool)
|
||||
mock_zpool.health = "ONLINE"
|
||||
mock_zpool.capacity = 70
|
||||
mock_zpool.name = "Main"
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=(temp, ""))
|
||||
errors = zpool_tests(("Main",))
|
||||
assert errors == []
|
||||
|
||||
|
||||
def test_zpool_tests_out_of_date(mocker: MockerFixture) -> None:
|
||||
"""test_zpool_tests_out_of_date."""
|
||||
mock_zpool = mocker.MagicMock(spec=Zpool)
|
||||
mock_zpool.health = "ONLINE"
|
||||
mock_zpool.capacity = 70
|
||||
mock_zpool.name = "Main"
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=("", ""))
|
||||
errors = zpool_tests(("Main",))
|
||||
assert errors == ["ZPool out of date run `sudo zpool upgrade -a`"]
|
||||
|
||||
|
||||
def test_zpool_tests_out_of_space(mocker: MockerFixture) -> None:
|
||||
"""test_zpool_tests_out_of_space."""
|
||||
mock_zpool = mocker.MagicMock(spec=Zpool)
|
||||
mock_zpool.health = "ONLINE"
|
||||
mock_zpool.capacity = 100
|
||||
mock_zpool.name = "Main"
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=(temp, ""))
|
||||
errors = zpool_tests(("Main",))
|
||||
assert errors == ["Main is low on space"]
|
||||
|
||||
|
||||
def test_zpool_tests_offline(mocker: MockerFixture) -> None:
|
||||
"""test_zpool_tests_offline."""
|
||||
mock_zpool = mocker.MagicMock(spec=Zpool)
|
||||
mock_zpool.health = "OFFLINE"
|
||||
mock_zpool.capacity = 70
|
||||
mock_zpool.name = "Main"
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=(temp, ""))
|
||||
errors = zpool_tests(("Main",))
|
||||
assert errors == ["Main is OFFLINE"]
|
||||
|
||||
|
||||
def test_systemd_tests(mocker: MockerFixture) -> None:
|
||||
"""test_systemd_tests."""
|
||||
mocker.patch(
|
||||
f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper",
|
||||
side_effect=[
|
||||
("inactive\n", ""),
|
||||
("active\n", ""),
|
||||
],
|
||||
)
|
||||
errors = systemd_tests(("docker",))
|
||||
assert errors == []
|
||||
"""test_systemd_tests."""
|
||||
|
||||
|
||||
def test_systemd_tests_multiple_negative_retries(mocker: MockerFixture) -> None:
|
||||
"""test_systemd_tests_fail."""
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=("active\n", ""))
|
||||
errors = systemd_tests(("docker",), max_retries=-1, retry_delay_secs=-1)
|
||||
assert errors == []
|
||||
|
||||
|
||||
def test_systemd_tests_multiple_pass(mocker: MockerFixture) -> None:
|
||||
"""test_systemd_tests_fail."""
|
||||
mocker.patch(
|
||||
f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper",
|
||||
side_effect=[
|
||||
("inactive\n", ""),
|
||||
("activating\n", ""),
|
||||
("active\n", ""),
|
||||
],
|
||||
)
|
||||
errors = systemd_tests(
|
||||
("docker",),
|
||||
retryable_statuses=("inactive\n", "activating\n"),
|
||||
valid_statuses=("active\n",),
|
||||
)
|
||||
assert errors == []
|
||||
|
||||
|
||||
def test_systemd_tests_fail(mocker: MockerFixture) -> None:
|
||||
"""test_systemd_tests_fail."""
|
||||
mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=("inactive\n", ""))
|
||||
errors = systemd_tests(("docker",), max_retries=5)
|
||||
assert errors == ["docker is inactive"]
|
||||
@@ -0,0 +1,63 @@
|
||||
"""test_server_validate_scripts."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
import pytest
|
||||
from pytest_mock import MockerFixture
|
||||
|
||||
from python.system_tests.validate_system import main
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from pyfakefs.fake_filesystem import FakeFilesystem
|
||||
from pytest_mock import MockerFixture
|
||||
|
||||
VALIDATE_SYSTEM = "python.system_tests.validate_system"
|
||||
|
||||
|
||||
def test_validate_system(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"""test_validate_system."""
|
||||
fs.create_file(
|
||||
"/mock_snapshot_config.toml",
|
||||
contents='zpools = ["root_pool", "storage", "media"]\nservices = ["docker"]\n',
|
||||
)
|
||||
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.systemd_tests", return_value=None)
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.zpool_tests", return_value=None)
|
||||
main(Path("/mock_snapshot_config.toml"))
|
||||
|
||||
|
||||
def test_validate_system_errors(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"""test_validate_system_errors."""
|
||||
fs.create_file(
|
||||
"/mock_snapshot_config.toml",
|
||||
contents='zpools = ["root_pool", "storage", "media"]\nservices = ["docker"]\n',
|
||||
)
|
||||
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.signal_alert")
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.systemd_tests", return_value=["systemd_tests error"])
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.zpool_tests", return_value=["zpool_tests error"])
|
||||
|
||||
with pytest.raises(SystemExit) as exception_info:
|
||||
main(Path("/mock_snapshot_config.toml"))
|
||||
|
||||
assert exception_info.value.code == 1
|
||||
|
||||
|
||||
def test_validate_system_execution(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"""test_validate_system_execution."""
|
||||
fs.create_file(
|
||||
"/mock_snapshot_config.toml",
|
||||
contents='zpools = ["root_pool", "storage", "media"]\nservices = ["docker"]\n',
|
||||
)
|
||||
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.signal_alert")
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.systemd_tests", return_value=None)
|
||||
mocker.patch(f"{VALIDATE_SYSTEM}.zpool_tests", side_effect=RuntimeError("zpool_tests error"))
|
||||
|
||||
with pytest.raises(SystemExit) as exception_info:
|
||||
main(Path("/mock_snapshot_config.toml"))
|
||||
|
||||
assert exception_info.value.code == 1
|
||||
+22
-50
@@ -2,68 +2,40 @@
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import socket
|
||||
from os import environ
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
import pytest
|
||||
from apprise import Apprise
|
||||
|
||||
from python.signal_alert import SignalRPCError, signal_alert
|
||||
from python.signal_alert import signal_alert
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from pytest_mock import MockerFixture
|
||||
|
||||
|
||||
def test_signal_alert(mocker: MockerFixture) -> None:
|
||||
mock_logger = mocker.patch("python.signal_alert.logger")
|
||||
mock_socket = mocker.patch("python.signal_alert.socket.socket")
|
||||
client = mock_socket.return_value.__enter__.return_value
|
||||
client.recv.side_effect = [b'{"jsonrpc":"2.0","result":{},"id":"signal-alert"}\n']
|
||||
"""test_signal_alert."""
|
||||
environ["SIGNAL_ALERT_FROM_PHONE"] = "1234567890"
|
||||
environ["SIGNAL_ALERT_TO_PHONE"] = "0987654321"
|
||||
|
||||
assert signal_alert("test", "1234567890", "0987654321") is None
|
||||
mock_logger = mocker.patch("python.signal_alert.logger")
|
||||
mock_apprise_client = mocker.MagicMock(spec=Apprise)
|
||||
mocker.patch("python.signal_alert.Apprise", return_value=mock_apprise_client)
|
||||
|
||||
signal_alert("test")
|
||||
|
||||
mock_logger.info.assert_not_called()
|
||||
mock_socket.assert_called_once_with(socket.AF_UNIX, socket.SOCK_STREAM)
|
||||
client.settimeout.assert_called_once_with(4.0)
|
||||
client.connect.assert_called_once_with("/run/signal-cli/socket")
|
||||
request = json.loads(client.sendall.call_args.args[0])
|
||||
assert request == {
|
||||
"jsonrpc": "2.0",
|
||||
"method": "send",
|
||||
"params": {
|
||||
"account": "1234567890",
|
||||
"recipient": ["0987654321"],
|
||||
"message": "test",
|
||||
},
|
||||
"id": "signal-alert",
|
||||
}
|
||||
mock_apprise_client.add.assert_called_once_with("signal://localhost:8989/1234567890/0987654321")
|
||||
mock_apprise_client.notify.assert_called_once_with(title="", body="test")
|
||||
|
||||
|
||||
def test_signal_alert_socket_error(mocker: MockerFixture) -> None:
|
||||
mocker.patch("python.signal_alert.socket.socket", side_effect=ConnectionError("connection failed"))
|
||||
def test_signal_alert_no_phones(mocker: MockerFixture) -> None:
|
||||
"""test_signal_alert_no_phones."""
|
||||
if "SIGNAL_ALERT_FROM_PHONE" in environ:
|
||||
del environ["SIGNAL_ALERT_FROM_PHONE"]
|
||||
if "SIGNAL_ALERT_TO_PHONE" in environ:
|
||||
del environ["SIGNAL_ALERT_TO_PHONE"]
|
||||
mock_logger = mocker.patch("python.signal_alert.logger")
|
||||
signal_alert("test")
|
||||
|
||||
with pytest.raises(SignalRPCError, match="Signal RPC failed") as exc_info:
|
||||
signal_alert("test", "1234567890", "0987654321")
|
||||
|
||||
assert isinstance(exc_info.value.__cause__, ConnectionError)
|
||||
|
||||
|
||||
def test_signal_alert_rpc_error(mocker: MockerFixture) -> None:
|
||||
mock_socket = mocker.patch("python.signal_alert.socket.socket")
|
||||
client = mock_socket.return_value.__enter__.return_value
|
||||
client.recv.side_effect = [b'{"jsonrpc":"2.0","error":{"code":-1,"message":"failed"},"id":"signal-alert"}\n']
|
||||
|
||||
with pytest.raises(SignalRPCError, match=r"Signal RPC returned an error:.*failed"):
|
||||
signal_alert("test", "1234567890", "0987654321")
|
||||
|
||||
|
||||
def test_signal_alert_ignores_notifications(mocker: MockerFixture) -> None:
|
||||
mock_socket = mocker.patch("python.signal_alert.socket.socket")
|
||||
client = mock_socket.return_value.__enter__.return_value
|
||||
client.recv.side_effect = [
|
||||
b'{"jsonrpc":"2.0","method":"receive"}\n{"jsonrpc":"2.0","result":{},"id":"signal-alert"}\n'
|
||||
]
|
||||
|
||||
assert signal_alert("test", "1234567890", "0987654321") is None
|
||||
|
||||
assert client.recv.call_count == 1
|
||||
mock_logger.info.assert_called_once_with("SIGNAL_ALERT_FROM_PHONE or SIGNAL_ALERT_TO_PHONE not set")
|
||||
@@ -16,17 +16,6 @@ if TYPE_CHECKING:
|
||||
from pytest_mock import MockerFixture
|
||||
|
||||
SNAPSHOT_MANAGER = "python.tools.snapshot_manager"
|
||||
FROM_PHONE = "1234567890"
|
||||
TO_PHONE = "0987654321"
|
||||
|
||||
|
||||
def patch_phone_numbers(mocker: MockerFixture) -> None:
|
||||
"""Patch the Signal phone number environment variables."""
|
||||
phone_numbers = {
|
||||
"SIGNAL_ALERT_FROM_PHONE": FROM_PHONE,
|
||||
"SIGNAL_ALERT_TO_PHONE": TO_PHONE,
|
||||
}
|
||||
mocker.patch(f"{SNAPSHOT_MANAGER}.getenv", side_effect=phone_numbers.get)
|
||||
|
||||
|
||||
def patch_utcnow(mocker: MockerFixture, datetime_value: datetime) -> None:
|
||||
@@ -45,7 +34,6 @@ def create_mock_snapshot(mocker: MockerFixture, name: str) -> Snapshot:
|
||||
def test_main(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"""Test main."""
|
||||
load_config_data.cache_clear()
|
||||
patch_phone_numbers(mocker)
|
||||
|
||||
mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")
|
||||
|
||||
@@ -70,15 +58,12 @@ def test_main(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"daily": 0,
|
||||
"monthly": 0,
|
||||
},
|
||||
FROM_PHONE,
|
||||
TO_PHONE,
|
||||
)
|
||||
|
||||
|
||||
def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"""Test main."""
|
||||
load_config_data.cache_clear()
|
||||
patch_phone_numbers(mocker)
|
||||
|
||||
mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")
|
||||
|
||||
@@ -93,11 +78,7 @@ def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem)
|
||||
fs.create_file("/mock_snapshot_config.toml", contents=mock_snapshot_config_toml)
|
||||
main(Path("/mock_snapshot_config.toml"))
|
||||
|
||||
mock_signal_alert.assert_called_once_with(
|
||||
"test_dataset failed to create snapshot 2023-01-01T00:00:00",
|
||||
FROM_PHONE,
|
||||
TO_PHONE,
|
||||
)
|
||||
mock_signal_alert.assert_called_once_with("test_dataset failed to create snapshot 2023-01-01T00:00:00")
|
||||
mock_get_datasets.assert_called_once()
|
||||
mock_get_snapshots_to_delete.assert_not_called()
|
||||
|
||||
@@ -105,7 +86,6 @@ def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem)
|
||||
def test_main_exception(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
"""Test main."""
|
||||
load_config_data.cache_clear()
|
||||
patch_phone_numbers(mocker)
|
||||
|
||||
mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")
|
||||
|
||||
@@ -123,7 +103,7 @@ def test_main_exception(mocker: MockerFixture, fs: FakeFilesystem) -> None:
|
||||
|
||||
assert isinstance(pytest_wrapped_e.value, SystemExit)
|
||||
assert pytest_wrapped_e.value.code == 1
|
||||
mock_signal_alert.assert_called_once_with("snapshot_manager failed", FROM_PHONE, TO_PHONE)
|
||||
mock_signal_alert.assert_called_once_with("snapshot_manager failed")
|
||||
mock_get_datasets.assert_called_once()
|
||||
mock_get_snapshots_to_delete.assert_not_called()
|
||||
|
||||
@@ -140,12 +120,7 @@ def test_get_snapshots_to_delete(mocker: MockerFixture) -> None:
|
||||
|
||||
mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
|
||||
|
||||
get_snapshots_to_delete(
|
||||
mock_dataset,
|
||||
{"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0},
|
||||
FROM_PHONE,
|
||||
TO_PHONE,
|
||||
)
|
||||
get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
|
||||
|
||||
mock_signal_alert.assert_not_called()
|
||||
mock_dataset.delete_snapshot.assert_called_once_with("auto_202509150415")
|
||||
@@ -160,12 +135,7 @@ def test_get_snapshots_to_delete_no_snapshot(mocker: MockerFixture) -> None:
|
||||
|
||||
mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
|
||||
|
||||
get_snapshots_to_delete(
|
||||
mock_dataset,
|
||||
{"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0},
|
||||
FROM_PHONE,
|
||||
TO_PHONE,
|
||||
)
|
||||
get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
|
||||
|
||||
mock_signal_alert.assert_not_called()
|
||||
mock_dataset.delete_snapshot.assert_not_called()
|
||||
@@ -183,17 +153,10 @@ def test_get_snapshots_to_delete_errored(mocker: MockerFixture) -> None:
|
||||
|
||||
mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
|
||||
|
||||
get_snapshots_to_delete(
|
||||
mock_dataset,
|
||||
{"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0},
|
||||
FROM_PHONE,
|
||||
TO_PHONE,
|
||||
)
|
||||
get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
|
||||
|
||||
mock_signal_alert.assert_called_once_with(
|
||||
"test_dataset@auto_202509150415 failed to delete: snapshot has dependent clones",
|
||||
FROM_PHONE,
|
||||
TO_PHONE,
|
||||
"test_dataset@auto_202509150415 failed to delete: snapshot has dependent clones"
|
||||
)
|
||||
mock_dataset.delete_snapshot.assert_called_once_with("auto_202509150415")
|
||||
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
|
||||
users = {
|
||||
users.dov = {
|
||||
isNormalUser = true;
|
||||
|
||||
shell = pkgs.zsh;
|
||||
group = "dov";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoSBmMfvp6aThkrfkLQ4TDwZJD0HCC0lsTIRNREIAWeduNkVFdkO3T1SMLmCKJ+zlL9xziNBEqB8NFl4TabAhptIGlKgTOc8C9eDaPQMQV8PB/4DxZhCt7O2qb4Vfcz82IHPtdwwaIsGpssgh81mQ4tPtP8BI0TluRBy+2v095s20j+PYRGrAXJtOWpVY9zaXxEJ8dXDhHDF2xzxvUcwu9NsoY8t+4/ZJ1mrTTG+eGp5gLAKnSVhAGgsmqCY577Nkso1jSzKer1XcCiaGIedpLuTzmUbOFFEVhhTSy+Ki1NLEcjGW2e6Vyg5Pm8VGN75MqyDZsi5igv9Grxq62EHQ4mFea9rns48B74O/bNQ1OoLVO9u/HwdLCgBTZzptrCmNwML6kBWrmCogoH3ueVbHwDCW5kTTMBCoVV+HaZ+qDWu7xZVx49MuCK29QGZj/IrN0N7h78KL0NYajdei87R0mcmWGP0YaJTdCQ4iKi9c77BUYQp+Qpqt+mnIX0cgjQOU= dkruger@kzin" # cspell:disable-line
|
||||
];
|
||||
extraGroups = [
|
||||
"audio"
|
||||
"video"
|
||||
"users"
|
||||
];
|
||||
uid = 1004;
|
||||
};
|
||||
|
||||
groups.dov.gid = 1004;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
imports = [
|
||||
./direnv.nix
|
||||
./git.nix
|
||||
./zsh.nix
|
||||
];
|
||||
|
||||
programs.starship.enable = true;
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
enableZshIntegration = true;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{
|
||||
programs.git = {
|
||||
enable = true;
|
||||
signing.format = null;
|
||||
settings = {
|
||||
user = {
|
||||
email = "dov.kruger@gmail.com";
|
||||
name = "Dov Kruger";
|
||||
};
|
||||
pull.rebase = true;
|
||||
color.ui = true;
|
||||
};
|
||||
lfs.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
history.size = 10000;
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"docker"
|
||||
"docker-compose"
|
||||
"colored-man-pages"
|
||||
"rust"
|
||||
"systemd"
|
||||
"tmux"
|
||||
"ufw"
|
||||
"z"
|
||||
];
|
||||
};
|
||||
shellAliases = {
|
||||
"lrt" = "eza --icons -lsnew";
|
||||
"ls" = "eza";
|
||||
"ll" = "eza --long --group";
|
||||
"la" = "eza --all";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./cli
|
||||
./programs.nix
|
||||
./ssh_config.nix
|
||||
];
|
||||
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
git.enable = true;
|
||||
};
|
||||
|
||||
home = {
|
||||
username = "dov";
|
||||
homeDirectory = "/home/${config.home.username}";
|
||||
stateVersion = "24.05";
|
||||
sessionVariables = {
|
||||
FLAKE = "$HOME/dotfiles";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
{
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
Loaded 100 of 121 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user