95 lines
2.4 KiB
Nix
95 lines
2.4 KiB
Nix
{ depot, lib, pkgs, ... }: # readTree options
|
|
{ config, ... }: # passed by module system
|
|
let
|
|
mod = name: depot.path.origSrc + ("/ops/modules/" + name);
|
|
in
|
|
{
|
|
imports = [
|
|
(mod "o11y/agent.nix")
|
|
(mod "snix-buildkite.nix")
|
|
(mod "known-hosts.nix")
|
|
|
|
(depot.third_party.agenix.src + "/modules/age.nix")
|
|
];
|
|
|
|
# Machine model taken from project Floral.
|
|
boot.isContainer = true;
|
|
|
|
# XXX: There's currently no way to remove the "problematic" entries (trying
|
|
# to override the /proc, /sys, /dev, ... mounts from systemd-nspawn) while
|
|
# also keeping the entry for the wrappers dir.
|
|
boot.specialFileSystems = lib.mkForce {
|
|
"/run/wrappers" = {
|
|
fsType = "tmpfs";
|
|
options = [ "nodev" "mode=755" "size=${config.security.wrapperDirSize}" ];
|
|
};
|
|
};
|
|
|
|
services.depot.buildkite = {
|
|
enable = true;
|
|
agentCount = 32;
|
|
largeSlots = 32;
|
|
};
|
|
|
|
boot.loader.initScript.enable = true;
|
|
system.switch.enableNg = false;
|
|
nix.package = pkgs.nix_2_3;
|
|
|
|
networking = {
|
|
useNetworkd = true;
|
|
useHostResolvConf = false;
|
|
|
|
hostName = "build01";
|
|
domain = "infra.snix.dev";
|
|
nameservers = [
|
|
"2001:4860:4860::6464"
|
|
"2001:4860:4860::64"
|
|
];
|
|
|
|
interfaces.host0.ipv6 = {
|
|
addresses = [
|
|
{ address = "2001:bc8:38ee:100:7000::20"; prefixLength = 64; }
|
|
];
|
|
routes = [
|
|
{ address = "64:ff9b::"; via = "2001:bc8:38ee:100::100"; prefixLength = 96; }
|
|
];
|
|
};
|
|
|
|
firewall.allowPing = true;
|
|
};
|
|
|
|
age.secrets =
|
|
let
|
|
secretFile = name: depot.ops.secrets."${name}.age";
|
|
in
|
|
{
|
|
buildkite-agent-token = {
|
|
file = secretFile "buildkite-agent-token";
|
|
mode = "0440";
|
|
group = "buildkite-agents";
|
|
};
|
|
buildkite-private-key = {
|
|
file = secretFile "buildkite-ssh-private-key";
|
|
mode = "0440";
|
|
group = "buildkite-agents";
|
|
};
|
|
buildkite-besadii-config = {
|
|
file = secretFile "buildkite-besadii-config";
|
|
mode = "0440";
|
|
group = "buildkite-agents";
|
|
};
|
|
buildkite-graphql-token = {
|
|
file = secretFile "buildkite-graphql-token";
|
|
mode = "0440";
|
|
group = "buildkite-agents";
|
|
};
|
|
};
|
|
|
|
services.openssh.enable = true;
|
|
time.timeZone = "UTC";
|
|
users.users.root.openssh.authorizedKeys.keys = depot.ops.users.all;
|
|
users.groups.kvm = { };
|
|
users.users.root.extraGroups = [ "kvm" ];
|
|
|
|
system.stateVersion = "25.05";
|
|
}
|