Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Richie
|
df168661f4 |
Vendored
+2
@@ -336,6 +336,8 @@
|
||||
"yubioath",
|
||||
"yzhang",
|
||||
"zeroconf",
|
||||
"zerotier",
|
||||
"zerotierone",
|
||||
"zoxide",
|
||||
"zram",
|
||||
"zstd"
|
||||
|
||||
@@ -31,10 +31,6 @@ in
|
||||
"flakes"
|
||||
"ca-derivations"
|
||||
];
|
||||
system-features = lib.mkAfter [
|
||||
"gccarch-x86-64-v2"
|
||||
"gccarch-x86-64-v3"
|
||||
];
|
||||
warn-dirty = false;
|
||||
flake-registry = ""; # disable global flake registries
|
||||
connect-timeout = 10;
|
||||
|
||||
@@ -17,7 +17,6 @@
|
||||
logDriver = "local";
|
||||
storageDriver = "overlay2";
|
||||
daemon.settings = {
|
||||
live-restore = false;
|
||||
experimental = true;
|
||||
exec-opts = [ "native.cgroupdriver=systemd" ];
|
||||
log-opts = {
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
nixpkgs.hostPlatform = {
|
||||
system = "x86_64-linux";
|
||||
gcc = {
|
||||
arch = "x86-64-v3";
|
||||
tune = "generic";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -22,12 +22,6 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/var"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
|
||||
@@ -15,8 +15,6 @@
|
||||
};
|
||||
};
|
||||
|
||||
test-exclusions = import ./test-exclusions.nix;
|
||||
|
||||
python-env = final: _prev: {
|
||||
my_python = final.python314.withPackages (
|
||||
ps: with ps; [
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
# Test exclusions for the locally rebuilt x86-64-v3 package set.
|
||||
#
|
||||
# Selecting x86-64-v3 changes every affected derivation, so the normal
|
||||
# nixpkgs binary cache cannot be used and upstream test suites run locally.
|
||||
# The jeeves builder uses /tmp/nix-builds so filesystem tests run on tmpfs
|
||||
# instead of ZFS with normalization=formD and utf8only=on; those tests remain
|
||||
# enabled. The remaining workarounds cover UDP readiness, resource-sensitive
|
||||
# parser and nested-worker races, and mismatched timeout clocks, plus
|
||||
# architecture-dependent floating-point differences whose risk we accept for
|
||||
# our workloads. Keep these exceptions visible until their causes are fixed.
|
||||
_final: prev: {
|
||||
gnutls = prev.gnutls.overrideAttrs (old: {
|
||||
# This test uses a fixed four-second sleep instead of checking UDP
|
||||
# readiness; the client saw no listener in the x86-64-v3 build.
|
||||
postPatch = (old.postPatch or "") + ''
|
||||
sed '2iexit 77' -i tests/serv-udp.sh
|
||||
'';
|
||||
});
|
||||
|
||||
prometheus = prev.prometheus.overrideAttrs (
|
||||
old:
|
||||
let
|
||||
assets = old.passthru.assets.overrideAttrs (assetsOld: {
|
||||
# CodeMirror's bounded synchronous parser can return an incomplete tree
|
||||
# when these cases run on a heavily loaded builder.
|
||||
postPatch = (assetsOld.postPatch or "") + ''
|
||||
substituteInPlace module/codemirror-promql/src/complete/hybrid.test.ts \
|
||||
--replace-fail "it(value.title, () => {" \
|
||||
"(value.title === 'autocomplete topk params 2' ? it.skip : it)(value.title, () => {"
|
||||
substituteInPlace module/codemirror-promql/src/parser/vector.test.ts \
|
||||
--replace-fail "it(value.binaryExpr, () => {" \
|
||||
"(value.binaryExpr === 'foo * on(test,blub) bar' ? it.skip : it)(value.binaryExpr, () => {"
|
||||
'';
|
||||
});
|
||||
in
|
||||
{
|
||||
postPatch = builtins.replaceStrings [ "${old.passthru.assets}" ] [ "${assets}" ] (
|
||||
builtins.unsafeDiscardStringContext old.postPatch
|
||||
);
|
||||
passthru = old.passthru // {
|
||||
inherit assets;
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
|
||||
(_pythonFinal: pythonPrev: {
|
||||
backrefs = pythonPrev.backrefs.overridePythonAttrs (old: {
|
||||
# regex measures its timeout in process CPU time, while this test used
|
||||
# wall time and could miss the timeout when a busy builder descheduled it.
|
||||
postPatch = (old.postPatch or "") + ''
|
||||
substituteInPlace tests/test_bregex.py \
|
||||
--replace-fail "time.time()" "time.process_time()"
|
||||
'';
|
||||
});
|
||||
|
||||
pytest-xdist = pythonPrev.pytest-xdist.overridePythonAttrs (old: {
|
||||
# The suite exercises its own worker pools. Run the outer suite with one
|
||||
# worker and allow inner workers more time on heavily loaded builders.
|
||||
postPatch = (old.postPatch or "") + ''
|
||||
substituteInPlace testing/test_remote.py \
|
||||
--replace-fail "WAIT_TIMEOUT = 10.0" "WAIT_TIMEOUT = 60.0"
|
||||
'';
|
||||
preCheck = builtins.replaceStrings [ "--numprocesses=$NIX_BUILD_CORES" ] [ "--numprocesses=1" ] (
|
||||
old.preCheck or ""
|
||||
);
|
||||
# This test deliberately crashes workers past the restart limit and
|
||||
# races while checking which replacement message was emitted.
|
||||
disabledTests = (old.disabledTests or [ ]) ++ [
|
||||
"test_max_worker_restart_tests_queued"
|
||||
];
|
||||
});
|
||||
|
||||
scipy = pythonPrev.scipy.overridePythonAttrs (old: {
|
||||
# x86-64-v3 FFT implementations produce rounding differences outside
|
||||
# these tests' strict tolerances. We accept the numerical-precision
|
||||
# risk for our workloads.
|
||||
disabledTests = (old.disabledTests or [ ]) ++ [
|
||||
"test_roundtrip_float32"
|
||||
"test_roundtrip_scaling"
|
||||
];
|
||||
});
|
||||
})
|
||||
];
|
||||
}
|
||||
@@ -176,21 +176,6 @@ def create_zfs_datasets() -> None:
|
||||
run_output(("zfs", "create", "root_pool/home"))
|
||||
run_output(("zfs", "create", "-o", "reservation=1G", "root_pool/var"))
|
||||
run_output(("zfs", "create", "-o", "compression=zstd-9", "-o", "reservation=10G", "root_pool/nix"))
|
||||
run_output(
|
||||
(
|
||||
"zfs",
|
||||
"create",
|
||||
"-o",
|
||||
"sync=disabled",
|
||||
"-o",
|
||||
"redundant_metadata=some",
|
||||
"-o",
|
||||
"normalization=none",
|
||||
"-o",
|
||||
"utf8only=off",
|
||||
"root_pool/nix_build",
|
||||
)
|
||||
)
|
||||
datasets = run_output(("zfs", "list", "-o", "name"))
|
||||
|
||||
expected_datasets = {
|
||||
@@ -198,7 +183,6 @@ def create_zfs_datasets() -> None:
|
||||
"root_pool/home",
|
||||
"root_pool/var",
|
||||
"root_pool/nix",
|
||||
"root_pool/nix_build",
|
||||
}
|
||||
missing_datasets = expected_datasets.difference(datasets.splitlines())
|
||||
if missing_datasets:
|
||||
@@ -264,7 +248,6 @@ def create_nix_hardware_file(mnt_dir: str, disks: Sequence[str], encrypt: str |
|
||||
' "/home" = {\n device = "root_pool/home";\n fsType = "zfs";\n };\n\n'
|
||||
' "/var" = {\n device = "root_pool/var";\n fsType = "zfs";\n };\n\n'
|
||||
' "/nix" = {\n device = "root_pool/nix";\n fsType = "zfs";\n };\n\n'
|
||||
' "/nix/var/nix/builds" = {\n device = "root_pool/nix_build";\n fsType = "zfs";\n };\n\n'
|
||||
' "/boot" = {\n'
|
||||
f' device = "/dev/disk/by-uuid/{get_boot_drive_id(disks[0])}";\n'
|
||||
' fsType = "vfat";\n options = [\n "fmask=0077"\n'
|
||||
@@ -287,7 +270,6 @@ def install_nixos(mnt_dir: str, disks: Sequence[str], encrypt: str | None) -> No
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/home", f"{mnt_dir}/home"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/var", f"{mnt_dir}/var"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix", f"{mnt_dir}/nix"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix_build", f"{mnt_dir}/nix/var/nix/builds"))
|
||||
|
||||
for disk in disks:
|
||||
run_output(("mkfs.vfat", "-n", "EFI", f"{disk}-part1"))
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
imports = [
|
||||
"${inputs.self}/users/math"
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/users/steve"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/monitoring-agent.nix"
|
||||
@@ -13,7 +14,7 @@
|
||||
"${inputs.self}/common/optional/systemd-boot.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/update.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3.nix"
|
||||
"${inputs.self}/common/optional/yubikey.nix"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./hardware.nix
|
||||
./syncthing.nix
|
||||
|
||||
@@ -50,11 +50,6 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
|
||||
@@ -22,12 +22,6 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/models"]
|
||||
15_min = 4
|
||||
hourly = 24
|
||||
|
||||
@@ -9,7 +9,6 @@
|
||||
"${inputs.self}/common/optional/systemd-boot.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/update.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3.nix"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./docker
|
||||
./hardware.nix
|
||||
|
||||
@@ -53,11 +53,6 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.docker.daemon.settings."data-root" = "${vars.containers}/docker";
|
||||
|
||||
# nixos-container hardcodes its state directory to /var/lib/nixos-containers,
|
||||
# so route it to the shared container dataset with a bind mount.
|
||||
fileSystems."/var/lib/nixos-containers" = {
|
||||
device = "${vars.containers}/nixos-containers";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
prepare-docker-storage = {
|
||||
description = "Create Docker storage directory";
|
||||
requiredBy = [ "docker.service" ];
|
||||
before = [ "docker.service" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
after = [ "zfs-mount.service" ];
|
||||
path = [
|
||||
pkgs.coreutils
|
||||
pkgs.util-linux
|
||||
];
|
||||
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = [ "/nix" ];
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mountpoint -q ${vars.containers}
|
||||
install -d -m 0710 ${vars.containers}/docker
|
||||
'';
|
||||
};
|
||||
|
||||
prepare-nixos-container-storage = {
|
||||
description = "Create NixOS container storage directory";
|
||||
requiredBy = [ "var-lib-nixos\\x2dcontainers.mount" ];
|
||||
before = [ "var-lib-nixos\\x2dcontainers.mount" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
after = [ "zfs-mount.service" ];
|
||||
path = [
|
||||
pkgs.coreutils
|
||||
pkgs.util-linux
|
||||
];
|
||||
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = [ "/nix" ];
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mountpoint -q ${vars.containers}
|
||||
install -d -m 0755 ${vars.containers}/nixos-containers
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,8 +4,10 @@ let
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
"${inputs.self}/users/dov"
|
||||
"${inputs.self}/users/math"
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/users/steve"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/monitoring-agent.nix"
|
||||
@@ -13,12 +15,10 @@ in
|
||||
"${inputs.self}/common/optional/syncthing_base.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/update.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3.nix"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./monitoring
|
||||
./docker
|
||||
./services
|
||||
./containers.nix
|
||||
./hardware.nix
|
||||
./networking
|
||||
./programs.nix
|
||||
@@ -35,6 +35,14 @@ in
|
||||
path = ./snapshot_config.toml;
|
||||
EnvironmentFile = "${vars.secrets}/services/snapshot_manager";
|
||||
};
|
||||
|
||||
zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [
|
||||
"e4da7455b2ae64ca"
|
||||
"a09acf02330d37b9"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = {
|
||||
|
||||
@@ -96,11 +96,6 @@ in
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
outputs,
|
||||
utils,
|
||||
...
|
||||
}:
|
||||
|
||||
@@ -11,122 +12,6 @@ let
|
||||
cfg = config.services.nix_builder;
|
||||
runnerUsername = "gitea-runner";
|
||||
runnerUserid = 601;
|
||||
runnerLabels = [
|
||||
"self-hosted:host"
|
||||
"nixos:host"
|
||||
];
|
||||
containerConfig =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
runnerConfigFile = (pkgs.formats.yaml { }).generate "gitea-runner.yaml" { };
|
||||
registerRunner = pkgs.writeShellApplication {
|
||||
name = "register-gitea-runner";
|
||||
runtimeInputs = [
|
||||
pkgs.coreutils
|
||||
pkgs.hostname
|
||||
config.services.gitea-actions-runner.package
|
||||
];
|
||||
text = builtins.readFile ./register_gitea_runner.sh;
|
||||
};
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
hostName = "nix-builder";
|
||||
useDHCP = lib.mkDefault true;
|
||||
interfaces.eth0.useDHCP = true;
|
||||
# Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
|
||||
useHostResolvConf = false;
|
||||
};
|
||||
nix.settings = {
|
||||
system-features = lib.mkAfter [
|
||||
"gccarch-x86-64-v2"
|
||||
"gccarch-x86-64-v3"
|
||||
];
|
||||
trusted-substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://cache.tmmworkshop.com"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
substituters = [
|
||||
"https://cache.nixos.org/?priority=2&want-mass-query=true"
|
||||
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
|
||||
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
sandbox = true;
|
||||
allowed-users = [ runnerUsername ];
|
||||
trusted-users = [
|
||||
"root"
|
||||
runnerUsername
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users.${runnerUsername} = {
|
||||
isSystemUser = true;
|
||||
group = runnerUsername;
|
||||
uid = runnerUserid;
|
||||
};
|
||||
groups.${runnerUsername}.gid = runnerUserid;
|
||||
};
|
||||
services.gitea-actions-runner.instances.builder = {
|
||||
enable = true;
|
||||
name = "jeeves-nix-builder";
|
||||
url = "http://192.168.99.14:6443/";
|
||||
labels = runnerLabels;
|
||||
tokenFile = "/run/secrets/gitea-runners/registration-token";
|
||||
settings.runner.timeout = "12h";
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
my_python
|
||||
nix
|
||||
nixfmt
|
||||
nixos-rebuild
|
||||
nodejs
|
||||
treefmt
|
||||
wget
|
||||
];
|
||||
};
|
||||
systemd.services."gitea-runner-builder" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = mkForce false;
|
||||
User = mkForce runnerUsername;
|
||||
Group = mkForce runnerUsername;
|
||||
ExecStartPre = mkForce [
|
||||
"${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs runnerLabels}"
|
||||
];
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
sharedContainerPath =
|
||||
(import "${pkgs.path}/nixos/lib/eval-config.nix" {
|
||||
modules = [
|
||||
{
|
||||
boot.isNspawnContainer = true;
|
||||
nixpkgs.pkgs = pkgs;
|
||||
}
|
||||
containerConfig
|
||||
];
|
||||
system = null;
|
||||
}).config.system.build.toplevel;
|
||||
in
|
||||
{
|
||||
options.services.nix_builder = {
|
||||
@@ -163,11 +48,9 @@ in
|
||||
containers = mapAttrs (
|
||||
name: containerCfg:
|
||||
mkIf containerCfg.enable {
|
||||
path = sharedContainerPath;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostBridge = cfg.bridgeName;
|
||||
extraFlags = [ "--hostname=${name}" ];
|
||||
bindMounts = {
|
||||
host-nix = {
|
||||
mountPoint = "/host-nix/var/nix/daemon-socket";
|
||||
@@ -185,6 +68,93 @@ in
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking = {
|
||||
useDHCP = lib.mkDefault true;
|
||||
interfaces.eth0.useDHCP = true;
|
||||
# Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
|
||||
useHostResolvConf = false;
|
||||
};
|
||||
nix.settings = {
|
||||
trusted-substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://cache.tmmworkshop.com"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
substituters = [
|
||||
"https://cache.nixos.org/?priority=2&want-mass-query=true"
|
||||
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
|
||||
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
sandbox = true;
|
||||
allowed-users = [ "gitea-runner" ];
|
||||
trusted-users = [
|
||||
"root"
|
||||
"gitea-runner"
|
||||
];
|
||||
};
|
||||
nixpkgs = {
|
||||
overlays = builtins.attrValues outputs.overlays;
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
users = {
|
||||
users.${runnerUsername} = {
|
||||
isSystemUser = true;
|
||||
group = runnerUsername;
|
||||
uid = runnerUserid;
|
||||
};
|
||||
groups.${runnerUsername}.gid = runnerUserid;
|
||||
};
|
||||
services.gitea-actions-runner.instances.${name} = {
|
||||
enable = true;
|
||||
name = "jeeves-${name}";
|
||||
url = "http://192.168.99.14:6443/";
|
||||
labels = [
|
||||
"self-hosted:host"
|
||||
"nixos:host"
|
||||
];
|
||||
tokenFile = "/run/secrets/gitea-runners/registration-token";
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
my_python
|
||||
nix
|
||||
nixfmt
|
||||
nixos-rebuild
|
||||
nodejs
|
||||
treefmt
|
||||
wget
|
||||
];
|
||||
};
|
||||
systemd.services."gitea-runner-${utils.escapeSystemdPath name}" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = mkForce false;
|
||||
User = mkForce runnerUsername;
|
||||
Group = mkForce runnerUsername;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
}
|
||||
) cfg.containers;
|
||||
|
||||
|
||||
@@ -1,36 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
legacy_instance_dir="$STATE_DIRECTORY/$(hostname)"
|
||||
instance_dir="$STATE_DIRECTORY/$1"
|
||||
runner_url="$2"
|
||||
runner_config_file="$3"
|
||||
shift 3
|
||||
runner_labels="$(IFS=,; printf '%s' "$*")"
|
||||
|
||||
if [ ! -e "$instance_dir" ] && [ -d "$legacy_instance_dir" ]; then
|
||||
mv "$legacy_instance_dir" "$instance_dir"
|
||||
fi
|
||||
|
||||
mkdir -vp "$instance_dir"
|
||||
cd "$instance_dir" || exit 1
|
||||
|
||||
token_hash_file="$instance_dir/.token-hash"
|
||||
token_hash_current="$(printf '%s' "$TOKEN" | sha256sum | cut -d' ' -f1)"
|
||||
token_hash_stored="$(cat "$token_hash_file" 2>/dev/null || echo "")"
|
||||
labels_file="$instance_dir/.labels"
|
||||
labels_wanted="$(printf '%s\n' "$@" | sort)"
|
||||
labels_current="$(cat "$labels_file" 2>/dev/null || echo 0)"
|
||||
|
||||
if [ ! -e "$instance_dir/.runner" ] || [ "$labels_wanted" != "$labels_current" ] || [ "$token_hash_current" != "$token_hash_stored" ]; then
|
||||
rm -v "$instance_dir/.runner" || true
|
||||
|
||||
gitea-runner register --no-interactive \
|
||||
--instance "$runner_url" \
|
||||
--token "$TOKEN" \
|
||||
--name "jeeves-$(hostname)" \
|
||||
--labels "$runner_labels" \
|
||||
--config "$runner_config_file"
|
||||
|
||||
printf '%s' "$token_hash_current" > "$token_hash_file"
|
||||
printf '%s\n' "$labels_wanted" > "$labels_file"
|
||||
fi
|
||||
@@ -17,7 +17,6 @@ sudo zpool create scratch -o ashift=12 -O acltype=posixacl -O atime=off -O dnode
|
||||
# media datasets
|
||||
sudo zfs create media/temp -o sync=disabled -o redundant_metadata=none
|
||||
sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
|
||||
sudo zfs create media/secure/containers -o mountpoint=/zfs/media/containers -o compression=lz4 -o sync=disabled -o redundant_metadata=some -o normalization=none -o utf8only=off
|
||||
sudo zfs create media/secure/docker -o compression=zstd-9
|
||||
sudo zfs create media/secure/github-runners -o compression=zstd-9 -o sync=disabled
|
||||
sudo zfs create media/secure/notes -o copies=2
|
||||
|
||||
@@ -19,7 +19,6 @@ in
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
ENDLESS_TASK_TIMEOUT = "12h";
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
server = {
|
||||
|
||||
@@ -23,12 +23,6 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/var"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
@@ -66,12 +60,6 @@ daily = 30
|
||||
monthly = 12
|
||||
|
||||
# media
|
||||
["media/secure/containers"]
|
||||
15_min = 2
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["media/temp"]
|
||||
15_min = 2
|
||||
hourly = 0
|
||||
|
||||
@@ -5,7 +5,6 @@ let
|
||||
in
|
||||
{
|
||||
inherit zfs_media zfs_storage zfs_scratch;
|
||||
containers = "${zfs_media}/containers";
|
||||
database = "${zfs_media}/database";
|
||||
docker = "${zfs_media}/docker";
|
||||
docker_configs = "${zfs_media}/docker/configs";
|
||||
|
||||
@@ -10,12 +10,13 @@
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3.nix"
|
||||
./disk-config.nix
|
||||
./haproxy
|
||||
./monitoring.nix
|
||||
];
|
||||
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
|
||||
boot = {
|
||||
# Avoid consuming the VM's limited memory for /tmp.
|
||||
tmp.useTmpfs = false;
|
||||
|
||||
@@ -9,7 +9,6 @@
|
||||
"${inputs.self}/common/optional/syncthing_base.nix"
|
||||
"${inputs.self}/common/optional/systemd-boot.nix"
|
||||
"${inputs.self}/common/optional/tailscale.nix"
|
||||
"${inputs.self}/common/optional/x86-64-v3.nix"
|
||||
"${inputs.self}/common/optional/yubikey.nix"
|
||||
"${inputs.self}/common/optional/zfs"
|
||||
./hardware.nix
|
||||
|
||||
@@ -34,22 +34,14 @@
|
||||
device = "root_pool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/home" = {
|
||||
device = "root_pool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
|
||||
users = {
|
||||
users.dov = {
|
||||
isNormalUser = true;
|
||||
|
||||
shell = pkgs.zsh;
|
||||
group = "dov";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoSBmMfvp6aThkrfkLQ4TDwZJD0HCC0lsTIRNREIAWeduNkVFdkO3T1SMLmCKJ+zlL9xziNBEqB8NFl4TabAhptIGlKgTOc8C9eDaPQMQV8PB/4DxZhCt7O2qb4Vfcz82IHPtdwwaIsGpssgh81mQ4tPtP8BI0TluRBy+2v095s20j+PYRGrAXJtOWpVY9zaXxEJ8dXDhHDF2xzxvUcwu9NsoY8t+4/ZJ1mrTTG+eGp5gLAKnSVhAGgsmqCY577Nkso1jSzKer1XcCiaGIedpLuTzmUbOFFEVhhTSy+Ki1NLEcjGW2e6Vyg5Pm8VGN75MqyDZsi5igv9Grxq62EHQ4mFea9rns48B74O/bNQ1OoLVO9u/HwdLCgBTZzptrCmNwML6kBWrmCogoH3ueVbHwDCW5kTTMBCoVV+HaZ+qDWu7xZVx49MuCK29QGZj/IrN0N7h78KL0NYajdei87R0mcmWGP0YaJTdCQ4iKi9c77BUYQp+Qpqt+mnIX0cgjQOU= dkruger@kzin" # cspell:disable-line
|
||||
];
|
||||
extraGroups = [
|
||||
"audio"
|
||||
"video"
|
||||
"users"
|
||||
];
|
||||
uid = 1004;
|
||||
};
|
||||
|
||||
groups.dov.gid = 1004;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
imports = [
|
||||
./direnv.nix
|
||||
./git.nix
|
||||
./zsh.nix
|
||||
];
|
||||
|
||||
programs.starship.enable = true;
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
enableZshIntegration = true;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{
|
||||
programs.git = {
|
||||
enable = true;
|
||||
signing.format = null;
|
||||
settings = {
|
||||
user = {
|
||||
email = "dov.kruger@gmail.com";
|
||||
name = "Dov Kruger";
|
||||
};
|
||||
pull.rebase = true;
|
||||
color.ui = true;
|
||||
};
|
||||
lfs.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
history.size = 10000;
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"docker"
|
||||
"docker-compose"
|
||||
"colored-man-pages"
|
||||
"rust"
|
||||
"systemd"
|
||||
"tmux"
|
||||
"ufw"
|
||||
"z"
|
||||
];
|
||||
};
|
||||
shellAliases = {
|
||||
"lrt" = "eza --icons -lsnew";
|
||||
"ls" = "eza";
|
||||
"ll" = "eza --long --group";
|
||||
"la" = "eza --all";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./cli
|
||||
./programs.nix
|
||||
./ssh_config.nix
|
||||
];
|
||||
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
git.enable = true;
|
||||
};
|
||||
|
||||
home = {
|
||||
username = "dov";
|
||||
homeDirectory = "/home/${config.home.username}";
|
||||
stateVersion = "24.05";
|
||||
sessionVariables = {
|
||||
FLAKE = "$HOME/dotfiles";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
{
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
@@ -3,17 +3,54 @@
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
fastfetch
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
{ pkgs, ... }:
|
||||
{ inputs, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./comms.nix
|
||||
"${inputs.self}/users/shared/comms.nix"
|
||||
"${inputs.self}/users/shared/games.nix"
|
||||
"${inputs.self}/users/shared/sweet.nix"
|
||||
./firefox
|
||||
./games.nix
|
||||
./kitty.nix
|
||||
./llm_tools.nix
|
||||
./sweet.nix
|
||||
./t3_code
|
||||
./vscode
|
||||
];
|
||||
|
||||
@@ -3,14 +3,21 @@
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
fastfetch
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# Home Assistant
|
||||
esphome
|
||||
@@ -28,6 +35,8 @@
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
bacon
|
||||
cargo
|
||||
@@ -42,6 +51,9 @@
|
||||
rustfmt
|
||||
trunk
|
||||
wasm-pack
|
||||
# cpp
|
||||
clang-tools
|
||||
clang_20
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
@@ -49,5 +61,6 @@
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
codebase-memory-mcp
|
||||
];
|
||||
}
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
|
||||
in
|
||||
{
|
||||
|
||||
users = {
|
||||
users.steve = {
|
||||
isNormalUser = true;
|
||||
|
||||
shell = pkgs.zsh;
|
||||
group = "steve";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJH03VzDbUhzfhvwD+OsYh6GobODYaI9jdNdzWQoqFsp matth@Jove" # cspell:disable-line
|
||||
];
|
||||
extraGroups = [
|
||||
"audio"
|
||||
"video"
|
||||
"wheel"
|
||||
"users"
|
||||
]
|
||||
++ ifTheyExist [
|
||||
"dialout"
|
||||
"docker"
|
||||
"hass"
|
||||
"libvirtd"
|
||||
"networkmanager"
|
||||
"plugdev"
|
||||
"scanner"
|
||||
"transmission"
|
||||
"uaccess"
|
||||
"wireshark"
|
||||
];
|
||||
uid = 1005;
|
||||
};
|
||||
|
||||
groups.steve.gid = 1005;
|
||||
};
|
||||
home-manager.users.steve = import ./systems/${config.networking.hostName}.nix;
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
imports = [
|
||||
./direnv.nix
|
||||
./git.nix
|
||||
./zsh.nix
|
||||
];
|
||||
|
||||
programs.starship.enable = true;
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
enableZshIntegration = true;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{
|
||||
programs.git = {
|
||||
enable = true;
|
||||
signing.format = null;
|
||||
settings = {
|
||||
user = {
|
||||
email = "matthew.michal11@gmail.com";
|
||||
name = "Matthew Michal";
|
||||
};
|
||||
pull.rebase = true;
|
||||
color.ui = true;
|
||||
};
|
||||
lfs.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
history.size = 10000;
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"docker"
|
||||
"docker-compose"
|
||||
"colored-man-pages"
|
||||
"rust"
|
||||
"systemd"
|
||||
"tmux"
|
||||
"ufw"
|
||||
"z"
|
||||
];
|
||||
};
|
||||
shellAliases = {
|
||||
"lrt" = "eza --icons -lsnew";
|
||||
"ls" = "eza";
|
||||
"ll" = "eza --long --group";
|
||||
"la" = "eza --all";
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./cli
|
||||
./programs.nix
|
||||
./ssh_config.nix
|
||||
];
|
||||
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
git.enable = true;
|
||||
};
|
||||
|
||||
home = {
|
||||
username = "steve";
|
||||
homeDirectory = "/home/${config.home.username}";
|
||||
stateVersion = "24.05";
|
||||
sessionVariables = {
|
||||
FLAKE = "$HOME/dotfiles";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
{
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
Reference in New Issue
Block a user