c88fae5277
Removes whitby DNS records and other related configuration that is no longer required now that whitby is gone. whitby served us well. RIP. This resolves b/433. Change-Id: I56fe6f88cde9112fc3bfc79758ac33e88a743422 Reviewed-on: https://cl.tvl.fyi/c/depot/+/13117 Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su>
55 lines
1.8 KiB
Nix
55 lines
1.8 KiB
Nix
# Publicly serve builderball cache. This is an experimental setup, and separate
|
|
# from the "normal" harmonia cache on cache.tvl.su.
|
|
{ config, ... }:
|
|
|
|
let
|
|
# This attrset forms a linked list of hosts, which delegate ACME fallbacks to
|
|
# each other. These *must* form a circle, otherwise we may end up walking only
|
|
# part of the ring.
|
|
#
|
|
# TODO: remove whitby from here, it is gone; leaving this code for now for
|
|
# easier discovery when reconfiguring this.
|
|
acmeFallback = host: ({
|
|
whitby = "nevsky.cache.tvl.fyi";
|
|
nevsky = "whitby.cache.tvl.fyi"; # GOTO 1
|
|
})."${host}";
|
|
in
|
|
{
|
|
imports = [
|
|
./base.nix
|
|
];
|
|
|
|
config = {
|
|
services.nginx.virtualHosts."cache.tvl.fyi" = {
|
|
serverName = "cache.tvl.fyi";
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
# This enables fetching TLS certificates for the same domain on different
|
|
# hosts. This config is kind of messy; it would be nice to generate a
|
|
# correct ring from the depot fixpoint, but this may be impossible due to
|
|
# infinite recursion. Please read the comment on `acmeFallback` above.
|
|
#
|
|
# TODO: whitby is gone, this is not needed at the moment
|
|
# acmeFallbackHost = acmeFallback config.networking.hostName;
|
|
|
|
extraConfig = ''
|
|
location = /cache-key.pub {
|
|
alias /run/agenix/nix-cache-pub;
|
|
}
|
|
|
|
location = / {
|
|
proxy_pass http://${config.services.depot.harmonia.settings.bind};
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://localhost:${toString config.services.depot.builderball.port};
|
|
}
|
|
'';
|
|
};
|
|
|
|
# participating hosts should use their local cache, otherwise they might end
|
|
# up querying themselves from afar for data they don't have.
|
|
networking.extraHosts = "127.0.0.1 cache.tvl.fyi";
|
|
};
|
|
}
|