110 lines
3.0 KiB
Nix
110 lines
3.0 KiB
Nix
{ config, pkgs, inputs, ... }:
|
|
|
|
{
|
|
sops.secrets.cache_priv = {};
|
|
sops.secrets.gitea_token = {
|
|
owner = "hydra";
|
|
group = "hydra";
|
|
mode = "0440";
|
|
};
|
|
|
|
services.postfix = {
|
|
enable = true;
|
|
setSendmail = true;
|
|
};
|
|
|
|
imports =
|
|
[
|
|
inputs.self.nixosModules.malobeo.gitea-translator
|
|
];
|
|
|
|
services.malobeo.gitea-translator = {
|
|
enable = true;
|
|
};
|
|
|
|
services.hydra = {
|
|
enable = true;
|
|
hydraURL = "https://hydra.malobeo.org";
|
|
useSubstitutes = true;
|
|
notificationSender = "hydra@localhost";
|
|
|
|
extraConfig = ''
|
|
store_uri = file:///var/lib/hydra/cache?secret-key=/etc/nix/albert/secret
|
|
binary_cache_secret_key_file = /etc/nix/albert/secret
|
|
binary_cache_dir = /var/lib/hydra/cache
|
|
Include ${config.sops.secrets.gitea_token.path}
|
|
using_frontend_proxy 1
|
|
base_uri hydra.malobeo.org
|
|
<hydra_notify>
|
|
<prometheus>
|
|
listen_address = 0.0.0.0
|
|
port = 9199
|
|
</prometheus>
|
|
</hydra_notify>
|
|
queue_runner_metrics_address = 0.0.0.0:9198
|
|
'';
|
|
};
|
|
networking.firewall.allowedTCPPorts = [ 9199 9198 ];
|
|
|
|
systemd.services.hydra-manual-setup = {
|
|
description = "Create Admin User for Hydra";
|
|
serviceConfig.Type = "oneshot";
|
|
serviceConfig.RemainAfterExit = true;
|
|
wantedBy = [ "multi-user.target" ];
|
|
requires = [ "hydra-init.service" ];
|
|
after = [ "hydra-init.service" ];
|
|
environment = builtins.removeAttrs (config.systemd.services.hydra-init.environment) ["PATH"];
|
|
script = ''
|
|
if [ ! -e ~hydra/.setup-is-complete ]; then
|
|
# create signing keys
|
|
/run/current-system/sw/bin/install -d -m 551 /etc/nix/albert
|
|
/run/current-system/sw/bin/nix-store --generate-binary-cache-key albert /etc/nix/albert/secret /etc/nix/albert/public
|
|
/run/current-system/sw/bin/chown -R hydra:hydra /etc/nix/albert
|
|
/run/current-system/sw/bin/chmod 440 /etc/nix/albert/secret
|
|
/run/current-system/sw/bin/chmod 444 /etc/nix/albert/public
|
|
# create cache
|
|
/run/current-system/sw/bin/install -d -m 755 /var/lib/hydra/cache
|
|
/run/current-system/sw/bin/chown -R hydra-queue-runner:hydra /var/lib/hydra/cache
|
|
# done
|
|
touch ~hydra/.setup-is-complete
|
|
fi
|
|
'';
|
|
};
|
|
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "15 3 * * *"; # [1]
|
|
};
|
|
|
|
|
|
nix.settings.trusted-users = ["hydra" "hydra-evaluator" "hydra-queue-runner"];
|
|
nix.settings.auto-optimise-store = true;
|
|
|
|
services.nix-serve = {
|
|
enable = true;
|
|
secretKeyFile = config.sops.secrets.cache_priv.path;
|
|
};
|
|
|
|
nix.buildMachines = [
|
|
{
|
|
hostName = "localhost";
|
|
systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
|
|
protocol = null;
|
|
maxJobs = 6;
|
|
supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
|
|
}
|
|
];
|
|
|
|
nix.settings.allowed-uris = [
|
|
"github:"
|
|
"git+https://github.com/"
|
|
"git+ssh://github.com/"
|
|
"https://github.com/nixos/nixpkgs"
|
|
|
|
"git+https://git.dynamicdiscord.de/"
|
|
"git+ssh://git.dynamicdiscord.de/"
|
|
"https://git.dynamicdiscord.de"
|
|
];
|
|
}
|
|
|