[albert] init hydra

2026-08-21 14:02:10 +02:00
parent fccdb74671
commit 486ea86797
1 changed files with 105 additions and 0 deletions
@@ -0,0 +1,105 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  sops.secrets.cache_priv = {};
+  sops.secrets.gitea_token = {
+    owner = "hydra";
+    group = "hydra";
+    mode = "0440";
+  };
+
+  services.postfix = {
+    enable = true;
+    setSendmail = true;
+  };
+
+  imports =
+    [
+      inputs.self.nixosModules.malobeo.gitea-translator
+    ];
+
+  services.malobeo.gitea-translator = {
+    enable = true;
+  };
+
+  services.hydra = {
+    enable = true;
+    hydraURL = "localhost:3000";
+    useSubstitutes = true;
+    notificationSender = "hydra@localhost";
+
+    extraConfig = ''
+      store_uri = file:///var/lib/hydra/cache?secret-key=/etc/nix/albert/secret
+      binary_cache_secret_key_file = /etc/nix/albert/secret
+      binary_cache_dir = /var/lib/hydra/cache
+      Include ${config.sops.secrets.gitea_token.path}
+    '';
+  };
+
+  systemd.services.hydra-manual-setup = {
+    description = "Create Admin User for Hydra";
+    serviceConfig.Type = "oneshot";
+    serviceConfig.RemainAfterExit = true;
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "hydra-init.service" ];
+    after = [ "hydra-init.service" ];
+    environment = builtins.removeAttrs (config.systemd.services.hydra-init.environment) ["PATH"];
+    script = ''
+      if [ ! -e ~hydra/.setup-is-complete ]; then
+        # create signing keys
+        /run/current-system/sw/bin/install -d -m 551 /etc/nix/albert
+        /run/current-system/sw/bin/nix-store --generate-binary-cache-key albert /etc/nix/albert/secret /etc/nix/albert/public
+        /run/current-system/sw/bin/chown -R hydra:hydra /etc/nix/albert
+        /run/current-system/sw/bin/chmod 440 /etc/nix/albert/secret
+        /run/current-system/sw/bin/chmod 444 /etc/nix/albert/public
+        # create cache
+        /run/current-system/sw/bin/install -d -m 755 /var/lib/hydra/cache
+        /run/current-system/sw/bin/chown -R hydra-queue-runner:hydra /var/lib/hydra/cache
+        # done
+        touch ~hydra/.setup-is-complete
+      fi
+    '';
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "15 3 * * *"; # [1]
+  };
+
+
+  nix.settings.trusted-users = ["hydra" "hydra-evaluator" "hydra-queue-runner"];
+  nix.settings.auto-optimise-store = true;
+
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = config.sops.secrets.cache_priv.path;
+  };
+
+  nix.buildMachines = [
+    {
+      hostName = "localhost";
+      systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+      protocol = null;
+      maxJobs = 2;
+      supportedFeatures = [ ];
+    }
+  ];
+
+  nix.settings.allowed-uris = [
+    "github:"
+    "git+https://github.com/"
+    "git+ssh://github.com/"
+    "https://github.com/nixos/nixpkgs"
+
+    "git+https://git.dynamicdiscord.de/"
+    "git+ssh://git.dynamicdiscord.de/"
+    "https://git.dynamicdiscord.de"
+  ];
+
+  services.nginx.virtualHosts."hydra.malobeo.org" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".proxyPass = "http://localhost:3000";
+  };
+}
+