maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

style: Switch to nixfmt from nixpkgs-fmt

Browse source 
Most of the ecosystem has moved to this formatter,
and many people configured their editors to autoformat it with this formatter.

Closes: https://git.snix.dev/snix/snix/issues/62
Change-Id: Icf39e7836c91fc2ae49fbe22a40a639105bfb0bd
Reviewed-on: https://cl.snix.dev/c/snix/+/30671
Reviewed-by: Florian Klink <flokli@flokli.de>
Tested-by: besadii
Autosubmit: Ilan Joselevich <personal@ilanjoselevich.com>
This commit is contained in:
Ilan Joselevich 2025-08-09 21:08:41 +02:00
parent 3443e6bd08
commit 91d02d8c84
136 changed files with 39952 additions and 11007 deletions
Download patch file Download diff file Expand all files Collapse all files

7
ops/buildkite/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }:
{
depot,
lib,
pkgs,
...
}:
depot.nix.readTree.drvTargets rec {
terraform = pkgs.terraform.withPlugins (p: [

3
ops/dashboards/default.nix
View file

@ -1,4 +1,5 @@
{ ... }: {
{ ... }:
{
node_exporter = ./json/node_exporter.json;
all = ./json;
}

7
ops/dns/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }:
{
depot,
lib,
pkgs,
...
}:
depot.nix.readTree.drvTargets rec {
# Provide a Terraform wrapper with the right provider installed.

7
ops/gerrit-tvl/default.nix
View file

@ -1,4 +1,9 @@
{ depot, pkgs, lib, ... }:
{
depot,
pkgs,
lib,
...
}:
{ gerrit }:
let

7
ops/hcloud/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }:
{
depot,
lib,
pkgs,
...
}:
depot.nix.readTree.drvTargets rec {
terraform = pkgs.terraform.withPlugins (p: [

7
ops/hetzner-s3/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }:
{
depot,
lib,
pkgs,
...
}:
depot.nix.readTree.drvTargets rec {
terraform = pkgs.terraform.withPlugins (p: [

7
ops/keycloak/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }:
{
depot,
lib,
pkgs,
...
}:
depot.nix.readTree.drvTargets rec {
# Provide a Terraform wrapper with the right provider installed.

8
ops/machines/archivist-ec2/default.nix
View file

@ -21,10 +21,11 @@ in
path = [ depot.contrib.archivist.parse-bucket-logs ];
serviceConfig = {
Type = "oneshot";
ExecStart = (pkgs.writers.writePython3 "parse-bucket-logs-continuously"
{
ExecStart = (
pkgs.writers.writePython3 "parse-bucket-logs-continuously" {
libraries = [ pkgs.python3Packages.boto3 ];
} ./parse-bucket-logs-continuously.py);
} ./parse-bucket-logs-continuously.py
);
DynamicUser = "yes";
StateDirectory = "parse-bucket-logs";
};
@ -38,4 +39,3 @@ in
system.stateVersion = "23.05"; # Did you read the comment?
}

33
ops/machines/archivist-ec2/hardware-configuration.nix
View file

@ -1,27 +1,30 @@
{ lib, modulesPath, ... }:
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
];
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [
"ahci"
"xhci_pci"
"virtio_pci"
"sr_mod"
"virtio_blk"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-partlabel/root";
fsType = "xfs";
};
fileSystems."/" = {
device = "/dev/disk/by-partlabel/root";
fsType = "xfs";
};
fileSystems."/boot" =
{
device = "/dev/disk/by-partlabel/boot";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-partlabel/boot";
fsType = "vfat";
};
swapDevices = [ ];

27
ops/machines/build01/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }: # readTree options
{
depot,
lib,
pkgs,
...
}: # readTree options
{ config, ... }: # passed by module system
let
mod = name: depot.path.origSrc + ("/ops/modules/" + name);
@ -24,7 +29,11 @@ in
boot.specialFileSystems = lib.mkForce {
"/run/wrappers" = {
fsType = "tmpfs";
options = [ "nodev" "mode=755" "size=${config.security.wrapperDirSize}" ];
options = [
"nodev"
"mode=755"
"size=${config.security.wrapperDirSize}"
];
};
};
@ -56,10 +65,17 @@ in
interfaces.host0.ipv6 = {
addresses = [
{ address = "2001:bc8:38ee:100:7000::20"; prefixLength = 64; }
{
address = "2001:bc8:38ee:100:7000::20";
prefixLength = 64;
}
];
routes = [
{ address = "64:ff9b::"; via = "2001:bc8:38ee:100::100"; prefixLength = 96; }
{
address = "64:ff9b::";
via = "2001:bc8:38ee:100::100";
prefixLength = 96;
}
];
};
@ -112,7 +128,8 @@ in
];
time.timeZone = "UTC";
users.users.root.openssh.authorizedKeys.keys = depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
users.users.root.openssh.authorizedKeys.keys =
depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
users.groups.kvm = { };
users.users.root.extraGroups = [ "kvm" ];

10
ops/machines/gerrit01/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }: # readTree options
{
depot,
lib,
pkgs,
...
}: # readTree options
{ config, ... }: # passed by module system
let
@ -111,7 +116,8 @@ in
createHome = true;
home = "/var/lib/git";
};
users.root.openssh.authorizedKeys.keys = depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
users.root.openssh.authorizedKeys.keys =
depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
};
boot.initrd.systemd.enable = true;

10
ops/machines/meta01/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }: # readTree options
{
depot,
lib,
pkgs,
...
}: # readTree options
{ config, ... }: # passed by module system
let
@ -130,7 +135,8 @@ in
# Required for prometheus to be able to scrape stats
services.nginx.statusPage = true;
users.users.root.openssh.authorizedKeys.keys = depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
users.users.root.openssh.authorizedKeys.keys =
depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
boot.initrd.systemd.enable = true;
zramSwap.enable = true;

10
ops/machines/public01/default.nix
View file

@ -1,4 +1,9 @@
{ depot, lib, pkgs, ... }: # readTree options
{
depot,
lib,
pkgs,
...
}: # readTree options
{ config, ... }: # passed by module system
let
@ -158,7 +163,8 @@ in
# Required for prometheus to be able to scrape stats
services.nginx.statusPage = true;
users.users.root.openssh.authorizedKeys.keys = depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
users.users.root.openssh.authorizedKeys.keys =
depot.ops.users.edef ++ depot.ops.users.flokli ++ depot.ops.users.raito;
boot.initrd.systemd.enable = true;
zramSwap.enable = true;

25
ops/machines/snix-cache/default.nix
View file

@ -1,18 +1,24 @@
{ depot, pkgs, lib, ... }: # readTree options
{
depot,
pkgs,
lib,
...
}: # readTree options
{ config, ... }: # passed by module system
let
srvos =
import (builtins.fetchTarball {
srvos = import (
builtins.fetchTarball {
url = "https://github.com/nix-community/srvos/archive/8e7d3c690975ee6790926bdfd1258016c967d163.tar.gz";
sha256 = "sha256-l7epHqAcg8Qktu8vO2ZfjSH1wcai01XQOKQA9ADHIk4=";
});
disko =
(builtins.fetchTarball {
}
);
disko = (
builtins.fetchTarball {
url = "https://github.com/nix-community/disko/archive/84dd8eea9a06006d42b8af7cfd4fda4cf334db81.tar.gz";
sha256 = "13mfnjnjp21wms4mw35ar019775qgy3fnjc59zrpnqbkfmzyvv02";
});
}
);
in
{
@ -38,7 +44,6 @@ in
forceSSL = true;
};
security.acme.acceptTerms = true;
security.acme.defaults.email = "admin+acme@numtide.com";
@ -48,11 +53,9 @@ in
systemd.network.networks."10-uplink".networkConfig.Address = "2a01:4f9:3071:1091::2/64";
# Enable SSH and add some keys
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys =
depot.ops.users.edef
++ depot.ops.users.flokli

3
ops/machines/snix-cache/monitoring.nix
View file

@ -174,7 +174,8 @@ in
};
};
systemd.services.grafana.serviceConfig.LoadCredential = "github_auth_client_secret:/etc/secrets/grafana_github_auth_client_secret";
systemd.services.grafana.serviceConfig.LoadCredential =
"github_auth_client_secret:/etc/secrets/grafana_github_auth_client_secret";
systemd.services.grafana.serviceConfig.RuntimeDirectory = "grafana";
systemd.services.grafana.serviceConfig.SupplementaryGroups = "nginx";

13
ops/machines/snix-cache/nar-bridge-module.nix
View file

@ -1,9 +1,10 @@
{ config
, lib
, utils
, pkgs
, depot
, ...
{
config,
lib,
utils,
pkgs,
depot,
...
}:
let
cfg = config.services.nar-bridge;

16
ops/machines/snix-cache/nar-bridge.nix
View file

@ -9,13 +9,15 @@
virtualHosts.${config.machine.domain} = {
locations."=/" = {
tryFiles = "$uri $uri/index.html =404";
root = pkgs.runCommand "index"
{
nativeBuildInputs = [ pkgs.markdown2html-converter ];
} ''
mkdir -p $out
markdown2html-converter ${./README.md} -o $out/index.html
'';
root =
pkgs.runCommand "index"
{
nativeBuildInputs = [ pkgs.markdown2html-converter ];
}
''
mkdir -p $out
markdown2html-converter ${./README.md} -o $out/index.html
'';
};
locations."/" = {
proxyPass = "http://unix:/run/nar-bridge.sock:/";

55
ops/modules/forgejo.nix
View file

@ -3,10 +3,21 @@
# Thanks to all the Lix core developers for this!
# vim: et:ts=2:sw=2:
#
{ depot, pkgs, lib, config, ... }:
{
depot,
pkgs,
lib,
config,
...
}:
let
cfg = config.services.depot.forgejo;
inherit (lib) types mkEnableOption mkOption mkIf;
inherit (lib)
types
mkEnableOption
mkOption
mkIf
;
emojo =
let
drgn = pkgs.fetchzip {
@ -39,7 +50,15 @@ let
'';
};
in
pkgs.symlinkJoin { name = "emojo"; paths = [ drgn neocat neofox dragn ]; };
pkgs.symlinkJoin {
name = "emojo";
paths = [
drgn
neocat
neofox
dragn
];
};
in
{
options.services.depot.forgejo = {
@ -77,13 +96,15 @@ in
enable = true;
package = pkgs.forgejo.overrideAttrs (old: {
patches = old.patches ++ (with depot.third_party.lix_forgejo.patches; [
upstream_link
signin_redirect
api_dont_notify
forgejo_is_now_gerrit_native
forgejo_knows_about_gerrit
]);
patches =
old.patches
++ (with depot.third_party.lix_forgejo.patches; [
upstream_link
signin_redirect
api_dont_notify
forgejo_is_now_gerrit_native
forgejo_knows_about_gerrit
]);
});
# General settings.
@ -294,10 +315,14 @@ in
services.mysql.enable = lib.mkForce true;
services.mysql.package = lib.mkForce pkgs.mariadb;
systemd.tmpfiles.rules = let cfg = config.services.forgejo; in [
"d '${cfg.customDir}/public/assets' 0750 ${cfg.user} ${cfg.group} - -"
"d '${cfg.customDir}/public/assets/img' 0750 ${cfg.user} ${cfg.group} - -"
"L+ '${cfg.customDir}/public/assets/img/emoji' - - - - ${emojo}"
];
systemd.tmpfiles.rules =
let
cfg = config.services.forgejo;
in
[
"d '${cfg.customDir}/public/assets' 0750 ${cfg.user} ${cfg.group} - -"
"d '${cfg.customDir}/public/assets/img' 0750 ${cfg.user} ${cfg.group} - -"
"L+ '${cfg.customDir}/public/assets/img/emoji' - - - - ${emojo}"
];
};
}

30
ops/modules/gerrit-autosubmit.nix
View file

@ -1,24 +1,34 @@
# Configuration for the Gerrit autosubmit bot (//ops/gerrit-autosubmit)
{ depot, pkgs, config, lib, ... }:
{
depot,
pkgs,
config,
lib,
...
}:
let
cfg = config.services.depot.gerrit-autosubmit;
description = "gerrit-autosubmit - autosubmit bot for Gerrit";
mkStringOption = default: lib.mkOption {
inherit default;
type = lib.types.str;
};
mkStringOption =
default:
lib.mkOption {
inherit default;
type = lib.types.str;
};
in
{
options.services.depot.gerrit-autosubmit = {
enable = lib.mkEnableOption description;
gerritUrl = mkStringOption "https://cl.snix.dev";
secretsFile = with lib; mkOption {
description = "Path to a systemd EnvironmentFile containing secrets";
default = config.age.secretsDir + "/gerrit-autosubmit";
type = types.str;
};
secretsFile =
with lib;
mkOption {
description = "Path to a systemd EnvironmentFile containing secrets";
default = config.age.secretsDir + "/gerrit-autosubmit";
type = types.str;
};
};
config = lib.mkIf cfg.enable {

12
ops/modules/gerrit-webhook-to-irccat.nix
View file

@ -1,4 +1,9 @@
{ config, depot, lib, ... }:
{
config,
depot,
lib,
...
}:
let
cfg = config.services.depot.gerrit-webhook-to-irccat;
@ -21,8 +26,9 @@ in
config = lib.mkIf cfg.enable {
systemd.services.gerrit-webhook-to-irccat = {
serviceConfig = {
ExecStart = "${depot.ops.gerrit-webhook-to-irccat}/bin/gerrit-webhook-to-irccat" +
" -irccat-url ${cfg.irccatUrl}";
ExecStart =
"${depot.ops.gerrit-webhook-to-irccat}/bin/gerrit-webhook-to-irccat"
+ " -irccat-url ${cfg.irccatUrl}";
Restart = "always";
RestartSec = 5;
User = "gerrit-webhook-to-irccat";

23
ops/modules/hetzner-cloud.nix
View file

@ -1,11 +1,21 @@
{ config, lib, pkgs, modulesPath, ... }:
{
config,
lib,
pkgs,
modulesPath,
...
}:
let
cfg = config.infra.hardware.hetzner-cloud;
inherit (lib) types mkOption mkEnableOption mkIf;
inherit (lib)
types
mkOption
mkEnableOption
mkIf
;
in
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix") ];
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
options.infra.hardware.hetzner-cloud = {
enable = mkEnableOption "the Hetzner Cloud hardware profile";
@ -40,7 +50,10 @@ in
}
];
dns = [ "2a01:4ff:ff00::add:1" "2a01:4ff:ff00::add:2" ];
dns = [
"2a01:4ff:ff00::add:1"
"2a01:4ff:ff00::add:2"
];
};
boot.loader.systemd-boot.enable = true;

28
ops/modules/irccat.nix
View file

@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.irccat;
@ -35,16 +40,18 @@ in
wants = [ "network.target" ];
serviceConfig = {
ExecStartPre = (pkgs.writeShellScript "merge-irccat-config" ''
if [ ! -f "$CREDENTIALS_DIRECTORY/secrets" ]; then
echo "irccat secrets file is missing"
exit 1
fi
ExecStartPre = (
pkgs.writeShellScript "merge-irccat-config" ''
if [ ! -f "$CREDENTIALS_DIRECTORY/secrets" ]; then
echo "irccat secrets file is missing"
exit 1
fi
# jq's * is the recursive merge operator
${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configJson} "$CREDENTIALS_DIRECTORY/secrets" \
> /var/lib/irccat/irccat.json
'');
# jq's * is the recursive merge operator
${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configJson} "$CREDENTIALS_DIRECTORY/secrets" \
> /var/lib/irccat/irccat.json
''
);
ExecStart = "${pkgs.irccat}/bin/irccat";
DynamicUser = true;
@ -57,4 +64,3 @@ in
};
};
}

10
ops/modules/known-hosts.nix
View file

@ -4,12 +4,18 @@
{
programs.ssh.knownHosts = {
public01 = {
hostNames = [ "public01.infra.snix.dev" "git.snix.dev" ];
hostNames = [
"public01.infra.snix.dev"
"git.snix.dev"
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICzB7bqXWcv+sVokySvj1d74zRlVLSNqBw7/OY3c7QYd";
};
gerrit01 = {
hostNames = [ "gerrit01.infra.snix.dev" "cl.snix.dev" ];
hostNames = [
"gerrit01.infra.snix.dev"
"cl.snix.dev"
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+RCLAExaM5EC70UsCPMtDT1Cfa80Ux/vex95fLk9S4";
};

18
ops/modules/monorepo-gerrit.nix
View file

@ -1,5 +1,11 @@
# Gerrit configuration for the snix monorepo
{ depot, pkgs, config, lib, ... }:
{
depot,
pkgs,
config,
lib,
...
}:
let
cfg = config.services.gerrit;
@ -7,10 +13,12 @@ let
gerritPackage = depot.third_party.nix-gerrit.gerrit_3_12;
gerritPlugins = depot.third_party.nix-gerrit.plugins_3_12;
besadiiWithConfig = name: pkgs.writeShellScript "besadii-gerrit01" ''
export BESADII_CONFIG=/run/agenix/gerrit-besadii-config
exec -a ${name} ${depot.ops.besadii}/bin/besadii "$@"
'';
besadiiWithConfig =
name:
pkgs.writeShellScript "besadii-gerrit01" ''
export BESADII_CONFIG=/run/agenix/gerrit-besadii-config
exec -a ${name} ${depot.ops.besadii}/bin/besadii "$@"
'';
gerritHooks = pkgs.runCommand "gerrit-hooks" { } ''
mkdir -p $out

8
ops/modules/o11y/alertmanager-irc-relay.nix
View file

@ -1,4 +1,5 @@
{ config, depot, ... }: {
{ config, depot, ... }:
{
imports = [
depot.third_party.alertmanager-irc-relay.module
];
@ -10,7 +11,10 @@
irc_port = 6697;
irc_nickname = "silentfox";
irc_channels = [
{ name = "#snix"; password = "$CHANNEL_PASSWORD"; }
{
name = "#snix";
password = "$CHANNEL_PASSWORD";
}
];
};
environmentFiles = [

49
ops/modules/o11y/alloy.nix
View file

@ -1,15 +1,25 @@
{ depot
, config
, lib
, ...
{
depot,
config,
lib,
...
}:
let
cfg = config.infra.monitoring.alloy;
inherit (lib) mkEnableOption mkOption mkIf types mapAttrs' nameValuePair;
inherit (lib)
mkEnableOption
mkOption
mkIf
types
mapAttrs'
nameValuePair
;
in
{
options.infra.monitoring.alloy = {
enable = (mkEnableOption "Grafana Alloy") // { default = true; };
enable = (mkEnableOption "Grafana Alloy") // {
default = true;
};
exporters = mkOption {
description = ''
@ -19,12 +29,17 @@ in
internally, which ends up exported as `job` label
on all metrics of that exporter.
'';
type = types.attrsOf (types.submodule ({ config, name, ... }: {
options.port = mkOption {
description = "Exporter port";
type = types.int;
};
}));
type = types.attrsOf (
types.submodule (
{ config, name, ... }:
{
options.port = mkOption {
description = "Exporter port";
type = types.int;
};
}
)
);
default = { };
};
};
@ -70,8 +85,10 @@ in
}
}
'';
} // (mapAttrs'
(name: v: nameValuePair "alloy/scrape_${name}.alloy" {
}
// (mapAttrs' (
name: v:
nameValuePair "alloy/scrape_${name}.alloy" {
text = ''
prometheus.scrape "${name}" {
targets = [
@ -80,8 +97,8 @@ in
forward_to = [prometheus.remote_write.mimir.receiver]
}
'';
})
cfg.exporters);
}
) cfg.exporters);
systemd.services.alloy.serviceConfig = {
LoadCredential = [

9
ops/modules/o11y/grafana.nix
View file

@ -1,7 +1,8 @@
{ depot
, config
, lib
, ...
{
depot,
config,
lib,
...
}:
let
cfg = config.services.depot.grafana;

12
ops/modules/o11y/loki.nix
View file

@ -1,6 +1,7 @@
{ config
, lib
, ...
{
config,
lib,
...
}:
let
cfg = config.services.depot.loki;
@ -38,7 +39,10 @@ in
ring = {
kvstore.store = "memberlist";
# TODO: Such a ugly hack.
instance_interface_names = [ "enp1s0" "lo" ];
instance_interface_names = [
"enp1s0"
"lo"
];
};
replication_factor = 1;
};

76
ops/modules/o11y/mimir.nix
View file

@ -1,7 +1,8 @@
{ config
, lib
, pkgs
, ...
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.depot.prometheus;
@ -9,15 +10,17 @@ let
mimirPort = config.services.mimir.configuration.server.http_listen_port;
alerts = pkgs.runCommand "mimir-alerts-checked"
{
src = ./alerts;
nativeBuildInputs = with pkgs; [ prometheus.cli ];
} ''
promtool check rules $src/*
mkdir $out
cp -R $src $out/anonymous/
'';
alerts =
pkgs.runCommand "mimir-alerts-checked"
{
src = ./alerts;
nativeBuildInputs = with pkgs; [ prometheus.cli ];
}
''
promtool check rules $src/*
mkdir $out
cp -R $src $out/anonymous/
'';
in
{
options.services.depot.prometheus.enable = mkEnableOption "Prometheus scraper";
@ -42,13 +45,34 @@ in
};
# TODO: Such a ugly hack.
distributor.ring.instance_interface_names = [ "enp1s0" "lo" ];
ingester.ring.instance_interface_names = [ "enp1s0" "lo" ];
frontend.instance_interface_names = [ "enp1s0" "lo" ];
query_scheduler.ring.instance_interface_names = [ "enp1s0" "lo" ];
ruler.ring.instance_interface_names = [ "enp1s0" "lo" ];
compactor.sharding_ring.instance_interface_names = [ "enp1s0" "lo" ];
store_gateway.sharding_ring.instance_interface_names = [ "enp1s0" "lo" ];
distributor.ring.instance_interface_names = [
"enp1s0"
"lo"
];
ingester.ring.instance_interface_names = [
"enp1s0"
"lo"
];
frontend.instance_interface_names = [
"enp1s0"
"lo"
];
query_scheduler.ring.instance_interface_names = [
"enp1s0"
"lo"
];
ruler.ring.instance_interface_names = [
"enp1s0"
"lo"
];
compactor.sharding_ring.instance_interface_names = [
"enp1s0"
"lo"
];
store_gateway.sharding_ring.instance_interface_names = [
"enp1s0"
"lo"
];
memberlist = {
advertise_addr = "127.0.0.1";
@ -91,11 +115,13 @@ in
receivers = [
{
name = "irc";
webhook_configs = [{
# Mimir can't expand environment variables in external config files,
# so work around it.
url_file = "/run/credentials/mimir.service/webhook-url";
}];
webhook_configs = [
{
# Mimir can't expand environment variables in external config files,
# so work around it.
url_file = "/run/credentials/mimir.service/webhook-url";
}
];
}
];
};

14
ops/modules/o11y/tempo.nix
View file

@ -1,6 +1,7 @@
{ config
, lib
, ...
{
config,
lib,
...
}:
let
cfg = config.services.depot.tempo;
@ -48,11 +49,14 @@ in
};
};
systemd.services.tempo.serviceConfig.EnvironmentFile = [ config.age.secrets.tempo-environment.path ];
systemd.services.tempo.serviceConfig.EnvironmentFile = [
config.age.secrets.tempo-environment.path
];
services.nginx = {
upstreams.tempo = {
servers."${config.services.tempo.settings.distributor.receivers.otlp.protocols.http.endpoint}" = { };
servers."${config.services.tempo.settings.distributor.receivers.otlp.protocols.http.endpoint}" =
{ };
extraConfig = "keepalive 16;";
};

42
ops/modules/restic.nix
View file

@ -5,14 +5,21 @@
# - restic's cache lives in /var/backup/restic/cache
# - repository password lives in `config.age.secrets.restic-repository-password.path`
# - object storage credentials in `config.age.secrets.restic-bucket-credentials.path`
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.depot.restic;
mkStringOption = default: lib.mkOption {
inherit default;
type = lib.types.str;
};
mkStringOption =
default:
lib.mkOption {
inherit default;
type = lib.types.str;
};
in
{
options.services.depot.restic = {
@ -23,16 +30,20 @@ in
repository = mkStringOption config.networking.hostName;
interval = mkStringOption "hourly";
paths = with lib; mkOption {
description = "Directories that should be backed up";
type = types.listOf types.str;
};
paths =
with lib;
mkOption {
description = "Directories that should be backed up";
type = types.listOf types.str;
};
exclude = with lib; mkOption {
description = "Files that should be excluded from backups";
type = types.listOf types.str;
default = [ ];
};
exclude =
with lib;
mkOption {
description = "Files that should be excluded from backups";
type = types.listOf types.str;
default = [ ];
};
};
config = lib.mkIf cfg.enable {
@ -51,8 +62,7 @@ in
RESTIC_PASSWORD_FILE = config.age.secrets.restic-repository-password.path;
RESTIC_CACHE_DIR = "/var/backup/restic/cache";
RESTIC_EXCLUDE_FILE =
builtins.toFile "exclude-files" (lib.concatStringsSep "\n" cfg.exclude);
RESTIC_EXCLUDE_FILE = builtins.toFile "exclude-files" (lib.concatStringsSep "\n" cfg.exclude);
};
};

100
ops/modules/snix-buildkite.nix
View file

@ -1,9 +1,10 @@
# Configuration for the snix buildkite agents.
{ config
, depot
, pkgs
, lib
, ...
{
config,
depot,
pkgs,
lib,
...
}:
let
@ -50,61 +51,56 @@ in
config = lib.mkIf cfg.enable {
# Run the Buildkite agents using the default upstream module.
services.buildkite-agents = builtins.listToAttrs (
map
(n: rec {
name = "${hostname}-${toString n}";
value =
{
inherit name;
enable = true;
tokenPath = config.age.secretsDir + "/buildkite-agent-token";
privateSshKeyPath = config.age.secretsDir + "/buildkite-private-key";
hooks.post-command = "${buildkiteHooks}/bin/post-command";
tags.queue = "default";
hooks.environment = ''
export PATH=$PATH:/run/wrappers/bin
'';
map (n: rec {
name = "${hostname}-${toString n}";
value = {
inherit name;
enable = true;
tokenPath = config.age.secretsDir + "/buildkite-agent-token";
privateSshKeyPath = config.age.secretsDir + "/buildkite-private-key";
hooks.post-command = "${buildkiteHooks}/bin/post-command";
tags.queue = "default";
hooks.environment = ''
export PATH=$PATH:/run/wrappers/bin
'';
tags = {
# all agents support small jobs
small = "true";
inherit hostname;
large = if n <= cfg.largeSlots then "true" else "false";
};
tags = {
# all agents support small jobs
small = "true";
inherit hostname;
large = if n <= cfg.largeSlots then "true" else "false";
};
runtimePackages = with pkgs; [
bash
coreutils
credentialHelper
curl
git
gnutar
gzip
jq
nix
];
};
})
agents
runtimePackages = with pkgs; [
bash
coreutils
credentialHelper
curl
git
gnutar
gzip
jq
nix
];
};
}) agents
);
# Set up a group for all Buildkite agent users
users = {
groups.buildkite-agents = { };
users = builtins.listToAttrs (
map
(n: rec {
name = "buildkite-agent-${hostname}-${toString n}";
value = {
isSystemUser = true;
group = lib.mkForce "buildkite-agents";
extraGroups = [
name
"docker"
];
};
})
agents
map (n: rec {
name = "buildkite-agent-${hostname}-${toString n}";
value = {
isSystemUser = true;
group = lib.mkForce "buildkite-agents";
extraGroups = [
name
"docker"
];
};
}) agents
);
};
};

5
ops/modules/www/base.nix
View file

@ -2,7 +2,10 @@
{
config = {
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [
80
443
];
security.acme = {
acceptTerms = true;

3
ops/modules/www/tempo.snix.dev.nix
View file

@ -6,7 +6,8 @@
services.nginx = {
upstreams.tempo = {
servers."${config.services.tempo.settings.distributor.receivers.otlp.protocols.http.endpoint}" = { };
servers."${config.services.tempo.settings.distributor.receivers.otlp.protocols.http.endpoint}" =
{ };
};
virtualHosts."tempo.snix.dev" = {

80
ops/nixos.nix
View file

@ -1,42 +1,56 @@
# Helper functions for instantiating depot-compatible NixOS machines.
{ depot, lib, pkgs, ... }@args:
{
depot,
lib,
pkgs,
...
}@args:
let inherit (lib) findFirst;
in rec {
let
inherit (lib) findFirst;
in
rec {
# This provides our standard set of arguments to all NixOS modules.
baseModule = { ... }: {
nix.nixPath =
let
# Due to nixpkgsBisectPath, pkgs.path is not always in the nix store
nixpkgsStorePath =
if lib.hasPrefix builtins.storeDir (toString pkgs.path)
then builtins.storePath pkgs.path # nixpkgs is already in the store
else pkgs.path; # we need to dump nixpkgs to the store either way
in
[
("nixos=" + nixpkgsStorePath)
("nixpkgs=" + nixpkgsStorePath)
];
};
nixosFor = configuration: (depot.third_party.nixos {
configuration = { ... }: {
imports = [
baseModule
configuration
];
baseModule =
{ ... }:
{
nix.nixPath =
let
# Due to nixpkgsBisectPath, pkgs.path is not always in the nix store
nixpkgsStorePath =
if lib.hasPrefix builtins.storeDir (toString pkgs.path) then
builtins.storePath pkgs.path # nixpkgs is already in the store
else
pkgs.path; # we need to dump nixpkgs to the store either way
in
[
("nixos=" + nixpkgsStorePath)
("nixpkgs=" + nixpkgsStorePath)
];
};
specialArgs = {
inherit (args) depot;
};
});
nixosFor =
configuration:
(depot.third_party.nixos {
configuration =
{ ... }:
{
imports = [
baseModule
configuration
];
};
findSystem = hostname:
(findFirst
(system: system.config.networking.hostName == hostname)
(throw "${hostname} is not a known NixOS host")
(map nixosFor depot.ops.machines.all-systems));
specialArgs = {
inherit (args) depot;
};
});
findSystem =
hostname:
(findFirst (
system: system.config.networking.hostName == hostname
) (throw "${hostname} is not a known NixOS host") (map nixosFor depot.ops.machines.all-systems));
# Systems that should be built in CI
archivistEC2System = nixosFor depot.ops.machines.archivist-ec2;

14
ops/pipelines/depot.nix
View file

@ -1,6 +1,11 @@
# This file configures the primary build pipeline used for the
# top-level list of depot targets.
{ depot, pkgs, externalArgs, ... }:
{
depot,
pkgs,
externalArgs,
...
}:
let
pipeline = depot.nix.buildkite.mkPipeline {
@ -8,9 +13,10 @@ let
drvTargets = depot.ci.targets;
parentTargetMap =
if (externalArgs ? parentTargetMap)
then builtins.fromJSON (builtins.readFile externalArgs.parentTargetMap)
else { };
if (externalArgs ? parentTargetMap) then
builtins.fromJSON (builtins.readFile externalArgs.parentTargetMap)
else
{ };
postBuildSteps = [
# After successful builds, create a gcroot for builds on canon.

4
ops/secrets/default.nix
View file

@ -1,3 +1,5 @@
args:
let mkSecrets = import ./mkSecrets.nix args; in
let
mkSecrets = import ./mkSecrets.nix args;
in
mkSecrets ./. (import ./secrets.nix) // { inherit mkSecrets; }

10
ops/secrets/mkSecrets.nix
View file

@ -12,10 +12,12 @@ let
agePubkey = types.typedef "age pubkey" (s: isString s && hasPrefix "age" s);
agenixSecret = types.struct "agenixSecret" {
publicKeys = types.listOf (types.union [
sshPubkey
agePubkey
]);
publicKeys = types.listOf (
types.union [
sshPubkey
agePubkey
]
);
};
in

12
ops/secrets/secrets.nix
View file

@ -20,13 +20,21 @@ let
superadmins = raito ++ edef ++ flokli;
allDefault.publicKeys = superadmins ++ [ gerrit01 public01 build01 meta01 ];
allDefault.publicKeys = superadmins ++ [
gerrit01
public01
build01
meta01
];
terraform.publicKeys = superadmins;
gerrit01Default.publicKeys = superadmins ++ [ gerrit01 ];
public01Default.publicKeys = superadmins ++ [ public01 ];
build01Default.publicKeys = superadmins ++ [ build01 ];
meta01Default.publicKeys = superadmins ++ [ meta01 ];
ciDefault.publicKeys = superadmins ++ [ gerrit01 build01 ];
ciDefault.publicKeys = superadmins ++ [
gerrit01
build01
];
in
{
"grafana-agent-password.age" = allDefault;

3
ops/users/default.nix
View file

@ -1,4 +1,5 @@
{ ... }: {
{ ... }:
{
flokli = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTVTXOutUZZjXLB0lUSgeKcSY/8mxKkC0ingGK1whD2 flokli"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE6a15p9HLSrawsMTd2UQGAiM7r7VdyrfSRyzwRYTgWT flokli@m2air"