Add option to disable local auth

Use project name in sysbuild query

flake.lock

@@ -3,11 +3,11 @@
     "nix": {
       "flake": false,
       "locked": {
-        "lastModified": 1760573252,
-        "narHash": "sha256-mcvNeNdJP5R7huOc8Neg0qZESx/0DMg8Fq6lsdx0x8U=",
+        "lastModified": 1767367029,
+        "narHash": "sha256-RsVlkBkxvPPePEo59AVolBFdayxny9FFv8X4aNq9qFc=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "3c39583e5512729f9c5a44c3b03b6467a2acd963",
+        "rev": "394a8da9dd9c046de715e451a96b70e64ce4aa7a",
         "type": "github"
       },
       "original": {
@@ -36,16 +36,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759652726,
-        "narHash": "sha256-2VjnimOYDRb3DZHyQ2WH2KCouFqYm9h0Rr007Al/WSA=",
+        "lastModified": 1767475907,
+        "narHash": "sha256-w10AFfl20h5MSBCsCegD4xtmcgDlQQeoFsOaIFwHOrE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "06b2985f0cc9eb4318bf607168f4b15af1e5e81d",
+        "rev": "7a0d60a03534a2d14b0805616aa1fd403fccfa55",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05-small",
+        "ref": "nixos-25.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "A Nix-based continuous build system";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11-small";
 
   inputs.nix = {
     url = "github:NixOS/nix/2.32-maintenance";
@@ -59,7 +59,7 @@
 
         manual = forEachSystem (system: let
           pkgs = nixpkgs.legacyPackages.${system};
-          hydra = self.packages.${pkgs.hostPlatform.system}.hydra;
+          hydra = self.packages.${pkgs.stdenv.hostPlatform.system}.hydra;
         in
           pkgs.runCommand "hydra-manual-${hydra.version}" { }
             ''

nixos-modules/default.nix

@@ -4,7 +4,7 @@
   hydra = { pkgs, lib,... }: {
     _file = ./default.nix;
     imports = [ ./hydra.nix ];
-    services.hydra-dev.package = lib.mkDefault self.packages.${pkgs.hostPlatform.system}.hydra;
+    services.hydra-dev.package = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.hydra;
   };
 
   hydraTest = { pkgs, ... }: {

package.nix

@@ -31,7 +31,7 @@
 , perl
 , pixz
 , boost
-, postgresql_13
+, postgresql_17
 , nlohmann_json
 , prometheus-cpp
 
@@ -192,7 +192,7 @@ stdenv.mkDerivation (finalAttrs: {
     subversion
     breezy
     openldap
-    postgresql_13
+    postgresql_17
     pixz
     nix-eval-jobs
   ];

src/lib/Hydra/Controller/User.pm

@@ -25,6 +25,8 @@ sub login :Local :Args(0) :ActionClass('REST') { }
 sub login_POST {
     my ($self, $c) = @_;
 
+    badRequest($c, "Local authentication is disabled.") if $c->config->{disable_local_auth};
+
     my $username = $c->stash->{params}->{username} // "";
     my $password = $c->stash->{params}->{password} // "";
 

src/lib/Hydra/Plugin/GiteaStatus.pm

@@ -63,9 +63,9 @@ sub common {
             my $accessToken = $self->{config}->{gitea_authorization}->{$repoOwner};
 
             my $rev = $i->revision;
-            my $domain = URI->new($i->uri)->host;
             my $host;
             unless (defined $gitea_url) {
+                my $domain = URI->new($i->uri)->host;
                 $host = "https://$domain";
             } else {
                 $host = $gitea_url->value;

src/lib/Hydra/Plugin/GitlabPulls.pm

@@ -84,7 +84,7 @@ sub fetchInput {
     my $tempdir = File::Temp->newdir("gitlab-pulls" . "XXXXX", TMPDIR => 1);
     my $filename = "$tempdir/gitlab-pulls-sorted.json";
     open(my $fh, ">", $filename) or die "Cannot open $filename for writing: $!";
-    print $fh JSON::MaybeXS->new(canonical => 1, pretty => 1)->encode(\%pulls);
+    print $fh JSON::MaybeXS->new(canonical => 1, pretty => 1, utf8 => 1)->encode(\%pulls);
     close $fh;
     my $storePath = addToStore($filename);
     my $timestamp = time;

src/lib/Hydra/Schema/Result/Builds.pm

@@ -563,7 +563,7 @@ makeQueries('', "");
 makeQueries('ForProject', "and jobset_id in (select id from jobsets j where j.project = ?)");
 makeQueries('ForJobset', "and jobset_id = ?");
 makeQueries('ForJob', "and jobset_id = ? and job = ?");
-makeQueries('ForJobName', "and jobset_id = (select id from jobsets j where j.name = ?) and job = ?");
+makeQueries('ForJobName', "and jobset_id = (select id from jobsets j where j.project = ? and j.name = ?) and job = ?");
 
 sub as_json {
   my ($self) = @_;

src/root/build.tt

@@ -568,7 +568,7 @@ END;
           running the following command:</p>
 
 <div class="card bg-light"><div class="card-body p-2"><code>
-<span class="shell-prompt"># </span>nix build [% HTML.escape(eval.flake) %]#hydraJobs.[% HTML.escape(job) %]
+<span class="shell-prompt"># </span>nix build '[% HTML.escape(eval.flake) %]#hydraJobs.[% HTML.escape(job) %]'
 </code></div></div>
 
         [% ELSE %]

src/root/job.tt

@@ -9,8 +9,8 @@
 [% INCLUDE includeFlot %]
 
 [% IF !jobExists(jobset, job) %]
-<div class="alert alert-warning">This job is not a member of the <a
-[% HTML.attributes(href => c.uri_for('/jobset' project.name jobset.name
+<div class="alert alert-warning">This job is not a member of the
+<a [% HTML.attributes(href => c.uri_for('/jobset' project.name jobset.name
 'evals')) %]>latest evaluation</a> of its jobset. This means it was
 removed or had an evaluation error.</div>
 [% END %]

src/root/topbar.tt

@@ -146,7 +146,9 @@
         <a class="dropdown-item" href="/github-redirect?after=[% c.req.path | uri %]">Sign in with GitHub</a>
         <div class="dropdown-divider"></div>
       [% END %]
-      <a class="dropdown-item" href="#hydra-signin" data-toggle="modal">Sign in with a Hydra account</a>
+      [% UNLESS c.config.disable_local_auth %]
+        <a class="dropdown-item" href="#hydra-signin" data-toggle="modal">Sign in with a Hydra account</a>
+      [% END %]
     [% END %]
   [% END %]
 

src/script/hydra-eval-jobset

@@ -160,7 +160,7 @@ sub fetchInputSystemBuild {
     $jobsetName ||= $jobset->name;
 
     my @latestBuilds = $db->resultset('LatestSucceededForJobName')
-        ->search({}, {bind => [$jobsetName, $jobName]});
+        ->search({}, {bind => [$projectName, $jobsetName, $jobName]});
 
     my @validBuilds = ();
     foreach my $build (@latestBuilds) {
@@ -358,14 +358,21 @@ sub evalJobs {
     my @cmd;
 
     if (defined $flakeRef) {
+        my $nix_expr =
+            "let " .
+            "flake = builtins.getFlake (toString \"$flakeRef\"); " .
+            "in " .
+            "flake.hydraJobs " .
+            "or flake.checks " .
+            "or (throw \"flake '$flakeRef' does not provide any Hydra jobs or checks\")";
+
         @cmd = ("nix-eval-jobs",
                 # Disable the eval cache to prevent SQLite database contention.
                 # Since Hydra typically evaluates each revision only once,
                 # parallel workers would compete for database locks without
                 # providing any benefit from caching.
                 "--option", "eval-cache", "false",
-                "--flake", $flakeRef,
-                "--select", "flake: flake.outputs.hydraJobs or flake.outputs.checks or (throw \"flake '$flakeRef' does not provide any Hydra jobs or checks\")");
+                "--expr", $nix_expr);
     } else {
         my $nixExprInput = $inputInfo->{$nixExprInputName}->[0]
             or die "cannot find the input containing the job expression\n";

t/jobs/basic.nix

@@ -1,6 +1,4 @@
-{ system ? builtins.currentSystem }:
-
-with import ./config.nix { inherit system; };
+with import ./config.nix;
 {
   empty_dir =
     mkDerivation {

t/jobs/config.nix.in

@@ -1,11 +1,9 @@
-{ system ? builtins.currentSystem }:
-
 rec {
   path = "@testPath@";
 
   mkDerivation = args:
     derivation ({
-      inherit system;
+      system = builtins.currentSystem;
       PATH = path;
     } // args);
   mkContentAddressedDerivation = args: mkDerivation ({

t/jobs/flake-checks/flake.nix

@@ -1,11 +1,6 @@
 {
-  outputs = { self, ... }:
-    let
-      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
-      forAllSystems = f: builtins.listToAttrs (map (system: { name = system; value = f system; }) systems);
-    in {
-      checks = forAllSystems (system:
-        import ./basic.nix { inherit system; }
-      );
-    };
+  outputs = { ... }: {
+    checks =
+      import ./basic.nix;
+  };
 }

t/jobs/flake-hydraJobs/flake.nix

@@ -1,11 +1,6 @@
 {
-  outputs = { self, ... }:
-    let
-      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
-      forAllSystems = f: builtins.listToAttrs (map (system: { name = system; value = f system; }) systems);
-    in {
-      hydraJobs = forAllSystems (system:
-        import ./basic.nix { inherit system; }
-      );
-    };
+  outputs = { ... }: {
+    hydraJobs =
+      import ./basic.nix;
+  };
 }