diff --git a/flake.nix b/flake.nix index 42bcade7..e5e3125c 100644 --- a/flake.nix +++ b/flake.nix @@ -75,6 +75,8 @@ dn42-nixos-rebuild = mkDeploy "dn42" hostRegistry.hosts.dn42.ip4; grafana-nixos-rebuild = mkDeploy "grafana" "grafana.hq.c3d2.de"; + + hydra-nixos-rebuild = mkDeploy "hydra" hostRegistry.hosts.hydra.ip4; }); nixosConfigurations = let @@ -190,6 +192,14 @@ system = "x86_64-linux"; }; + hydra = nixosSystem' { + modules = [ + ./lib/lxc-container.nix + ./hosts/containers/hydra + ]; + system = "x86_64-linux"; + }; + }; nixosModules.c3d2 = import ./lib; diff --git a/host-registry.nix b/host-registry.nix index 852c3586..f39116a8 100644 --- a/host-registry.nix +++ b/host-registry.nix @@ -100,6 +100,11 @@ rec { grafana = { ip6 = "2a02:8106:208:5282:4042:fbff:fe4b:2de8"; }; + + hydra = { + ip4 = "172.20.73.49"; + ip6 = "2a02:8106:208:5282:e03c:d7ff:fe8e:fe16"; + }; }; hqGlobal = builtins.attrNames hosts; diff --git a/hosts/containers/hydra/c3d2.svg b/hosts/containers/hydra/c3d2.svg new file mode 100644 index 00000000..9d201eb6 --- /dev/null +++ b/hosts/containers/hydra/c3d2.svg @@ -0,0 +1,140 @@ + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + diff --git a/hosts/containers/hydra/cache.nix b/hosts/containers/hydra/cache.nix new file mode 100644 index 00000000..20ecfa84 --- /dev/null +++ b/hosts/containers/hydra/cache.nix @@ -0,0 +1,26 @@ +{ config, pkgs, ... }: + +{ + services.nix-serve = { + enable = true; + secretKeyFile = "/var/cache-priv-key.pem"; + }; + + services.nginx.virtualHosts."nix-serve.hq.c3d2.de" = { + forceSSL = true; + enableACME = true; + locations."/".extraConfig = '' + proxy_pass http://127.0.0.1:${toString config.services.nix-serve.port}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; + }; + + services.nginx.virtualHosts."depot.hq.c3d2.de" = { + forceSSL = true; + enableACME = true; + locations."/".root = "/srv/www/depot"; + }; + +} diff --git a/hosts/containers/hydra/default.nix b/hosts/containers/hydra/default.nix new file mode 100644 index 00000000..53cd8a55 --- /dev/null +++ b/hosts/containers/hydra/default.nix @@ -0,0 +1,74 @@ +{ config, pkgs, lib, ... }: + +{ + imports = [ ./hydra.nix ./cache.nix ]; + + c3d2 = { + users = { + emery = true; + windsleep = true; + }; + # hq.statistics.enable = true; + }; + + nixpkgs.config.allowUnfree = true; + + security.acme = { + email = "mail@c3d2.de"; + acceptTerms = true; + }; + security.pam.enableSSHAgentAuth = true; + + services.openssh = { + enable = true; + passwordAuthentication = false; + }; + + programs.mosh.enable = true; + + nix = { + useSandbox = false; + maxJobs = 4; + buildCores = 20; + autoOptimiseStore = true; + gc = { + automatic = true; + dates = "06:00"; + options = "--delete-older-than 14d"; + }; + sshServe.enable = true; + trustedUsers = [ "@wheel" ]; + }; + + boot = { + tmpOnTmpfs = true; + # For cross-building + binfmt.emulatedSystems = [ "aarch64-linux" ]; + }; + + fileSystems."/" = { + fsType = "rootfs"; + device = "rootfs"; + }; + + networking = { + hostName = "hydra"; + firewall.enable = false; + defaultGateway = "172.20.73.1"; + interfaces.eth0.ipv4.addresses = [{ + address = "172.20.73.49"; + prefixLength = 26; + }]; + }; + + environment.systemPackages = with pkgs; [ tmux htop vim gitMinimal nixFlakes ]; + nix.extraOptions = '' + experimental-features = nix-command flakes + ''; + + # This value determines the NixOS release with which your system is to be + # compatible, in order to avoid breaking some software such as database + # servers. You should change this only after NixOS release notes say you + # should. + system.stateVersion = "20.09"; # Did you read the comment? +} diff --git a/hosts/containers/hydra/hydra.nix b/hosts/containers/hydra/hydra.nix new file mode 100644 index 00000000..ea75c1eb --- /dev/null +++ b/hosts/containers/hydra/hydra.nix @@ -0,0 +1,43 @@ +{ config, pkgs, ... }: + +{ + nix = { + binaryCaches = + [ "https://cache.nixos.org" "https://genodepkgs.cachix.org" ]; + binaryCachePublicKeys = [ + "genodepkgs.cachix.org-1:j6xcYrUP9Q9c+WbS+MbkJR26cqeytOVdC4SmhOYj2Sw=" + ]; + extraOptions = '' + allowed-uris = http:// https:// + ''; + }; + + services.hydra = { + enable = true; + hydraURL = "https://hydra.hq.c3d2.de"; + logo = ./c3d2.svg; + notificationSender = "hydra@spam.works"; + package = pkgs.hydra-unstable; + useSubstitutes = false; + }; + + services.nginx = + let + hydraVhost = { + forceSSL = true; + enableACME = true; + locations."/".proxyPass = + "http://localhost:${toString config.services.hydra.port}"; + }; + in { + enable = true; + recommendedProxySettings = true; + recommendedGzipSettings = true; + virtualHosts = { + "hydra.hq.c3d2.de" = hydraVhost // { + default = true; + }; + "hydra.serv.zentralwerk.org" = hydraVhost; + }; + }; +}