sercanto/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
nix-community infrastructure [maintainer=@zowoq]
990 commits 1 branch 0 tags 3.4 MiB
Nix 58.3%
Python 29.1%
HCL 9.2%
Shell 2.9%
sed 0.5%
Find a file
Jörg Thalheim cbbb8d5af3 encrypt all yaml files with sops
2022-10-25 09:55:28 +02:00
.github build(deps): bump cachix/install-nix-action from 17 to 18 2022-10-18 07:33:29 +10:00
build01 encrypt all yaml files with sops 2022-10-25 09:55:28 +02:00
build02 encrypt all yaml files with sops 2022-10-25 09:55:28 +02:00
build03 encrypt all yaml files with sops 2022-10-25 09:55:28 +02:00
build04 run nixpkgs-fmt 2022-08-14 16:49:30 +02:00
keys import gpg keys with import-keys-hook 2021-09-29 19:09:35 +02:00
roles encrypt all yaml files with sops 2022-10-25 09:55:28 +02:00
services hound: exclude nixops-dashboard 2022-10-13 07:03:39 +10:00
terraform encrypt all yaml files with sops 2022-10-25 09:55:28 +02:00
users make zowoq an admin 2022-10-22 09:53:37 +02:00
.envrc switch to flake 2022-04-10 21:58:25 +02:00
.gitignore update to Terraform 1.0 2021-08-18 13:05:59 +02:00
.mergify.yml fix mergify condition 2022-04-10 23:35:53 +02:00
.sops.yaml add zowoq's key to sops policies 2022-10-25 09:55:28 +02:00
_config.yml configure GitHub pages 2020-05-03 15:11:06 +02:00
bors.toml bors: fix merge commit message 2022-09-28 14:58:20 +10:00
ci.nix ci: remove effects deployment 2022-10-04 10:01:17 +10:00
ci.sh switch to hercules-ci 2021-11-12 10:08:20 +01:00
deploy ./deploy: also accept parameters 2022-04-11 16:19:27 +02:00
flake.lock flake.lock: Update 2022-10-24 23:52:23 +00:00
flake.nix flake: update flake-parts follows 2022-10-13 07:52:32 +10:00
README.md make zowoq an admin 2022-10-22 09:53:37 +02:00
secrets.yaml encrypt all yaml files with sops 2022-10-25 09:55:28 +02:00
shell.nix switch to deploykit from deploy_nixos 2022-08-29 14:11:38 +02:00
tasks.py tasks: reformat 2022-09-28 10:20:56 +02:00

README.md

nix-community infrastructure

Welcome to the Nix Community infrastructure project. This project holds all the NixOS and Terraform configuration for this organization.

Community builder

We also provide one x86 hetzner build machine as a public remote builder for the nix community. If you want access read the security guide lines on aarch64-build-box. Than add your username to roles/builder/users.nix. Don't keep any important data in your home! We will regularly delete /home without further notice.

Using your NixOS home-manager configuration on the hosts

If you happen to have your NixOS & home-manager configurations intertwined but you'd like your familiar environment on our infrastructure you can evaluate pkgs.writeShellScript "hm-activate" config.systemd.services.home-manager-<yourusername>.serviceConfig.ExecStart from your NixOS configuration, and send this derivation to be realized remotely: (in case you aren't a Nix trusted user)

# somehow get the .drv of the above expression into $path
$ nix copy --to ssh://build01.nix-community.org --derivation $path
$ ssh build01.nix-community.org
$ nix-store -r $path
$ $path

(My implementation of this ~ckie)

Hydra

If you want to build your project in our hydra, add a new project in this file.

Support

If you hit any issues, ping us on Matrix in the nix-community room (see the admin list below) or create an issue here: New Issue.

Pull requests from forks

As PRs from forks don't have automatic CI checks, admins can test PRs by posting a comment on the PR instead.

Administrators

  • @adisbladis
  • @flokli
  • @grahamc
  • @Mic92
  • @nlewo
  • @ryantm
  • @zimbatm
  • @zowoq

Services

Hosts

build01

This machine is perfect for running heavy builds.

  • Provider: Hetzner
  • CPU: AMD Ryzen 7 1700X Eight-Core Processor
  • RAM: 64GB
  • Drives: 2 x 512 GB SATA SSD

build02

This machine currently just runs r-ryantm/nixpkgs-update.

  • Provider: Hetzner
  • CPU: AMD Ryzen 7 3700X Eight-Core Processor
  • RAM: 64GB DDR4 ECC
  • Drives: 2 x 1 TB NVME in RAID 1

build03

This machine is a replacement for build01.

  • Provider: Hetzner
  • CPU: AMD Ryzen 5 3600 6-Core Processor
  • RAM: 64GB DDR4 ECC
  • Drives: 2 x 512 GB NVME in RAID 1

build04

This machine is meant as an aarch64 builder for our hydra instance running on build03.

  • Provider: Oracle cloud
  • Instance type: Ampere A1 Compute
  • CPU: 4 VCPUs on an Ampere Altra (arm64)
  • RAM: 24GB
  • Drives: 200 GB Block

Cache

All the builds on these machines are pushed to https://nix-community.cachix.org/

Thanks to Cachix for sponsoring our binary cache!

File hierarchy

  • ./build\d+ - build machines
  • ./ci.sh - What is executed by CI
  • ./deploy - Deploy script
  • ./roles - shared NixOS configuration modules
  • ./services - single instances of NixOS services
  • ./terraform - Setup DNS
  • ./users - NixOS configuration of our admins

Deployment commands:

$ ./deploy

If you want to reboot a machine, use the following command to also deploy secrets afterwards:

$ inv deploy --hosts build02 reboot --hosts build02

Install/Fix system from Hetzner recovery mode

  1. Install kexec image from Hetzner recovery system as described in kexec.nix and boot into it

  2. Format and/or mount all filesystems to /mnt:

$ inv format-disks --hosts buildXX --disks /dev/nvme0n1,/dev/nvme1n1
  1. Setup secrets
$ inv setup-secret --hosts buildXX
  1. Generate configuration and download to the repo
$ nixos-generate-config  --root /tmp
# optional, in most cases one can import roles/hardware/hetzner-amd.nix
$ scp buildXX.nix-community.org:/tmp/etc/nixos/hardware-configuration.nix buildXX/hardware-configuration.nix
  1. Build and install
$ inv install-nixos --hosts buildXX

Debug VM

You can start a vm from the rescue system in order to debug the boot:

$ nix-shell -p qemu_kvm --run 'qemu-kvm -m 10G -hda /dev/sda -hdb /dev/sdb -curses -cpu host -enable-kvm'