greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Enable pushing builds to S3

Browse Source
This commit is contained in:
Greg Hellings
2025-01-21 16:51:04 -06:00
parent faeeb8df9e
commit 0607fc4f14
7 changed files with 76 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/modules/baseline/xonsh.nix
+4 -1
View File
@@ -15,6 +15,8 @@
enable = true;
sessionVariables = {
# This is for pushing builds to my local S3 cache
AWS_SHARED_CREDENTIALS_FILE = "/run/agenix/cache-credentials";
CLICOLOR = 1;
EDITOR = "nvim";
# vte_new_tab_cwd causes new Terminal tabs to open in the
@@ -48,15 +50,16 @@
s = "nix run \".#runserver\"";
# Nix related ones
deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host";
gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
nb = "nix build -L";
nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
nixtest = "nixpkgs-review rev HEAD";
nixup = "nix flake lock --update-input";
nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
stable = "nix flake lock --update-input nixstable --update-input hm --update-input nixvimstable";
unstable = "nix flake lock --update-input nixunstable --update-input hmunstable --update-input nixvimunstable --update-input nurpkgs --update-input vsext --update-input wsl";
updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host";
# General
gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
modules/baseline.nix
+2
View File
@@ -35,6 +35,7 @@ in
"gregory.hellings"
]; # For home and for work machines
substituters = [
"http://nas.home:9000/binary-cache/"
"https://cache.garnix.io"
"https://ai.cachix.org"
"https://nixpkgs-python.cachix.org"
@@ -42,6 +43,7 @@ in
"https://nix-community.cachix.org"
];
trusted-public-keys = [
"nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
"nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="
modules/cache-public-key.pem
+1
View File
@@ -0,0 +1 @@
nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=
modules/nixos/remote-builder.nix
+45 -9
View File
@@ -1,4 +1,9 @@
{ lib, config, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.greg.remote-builder;
@@ -10,7 +15,46 @@ with lib;
};
config = mkIf cfg.enable {
age.secrets = {
# Don't forget to also update home/modules/baseline/xonsh.nix if this changes
cache-credentials = {
file = ../../secrets/cache-credentials.age;
owner = "greg";
group = "nixbld";
mode = "660";
};
private-cache = {
file = ../../secrets/cache-private-key.age;
group = "nixbld";
mode = "660";
};
};
# If the system is powerful enough to be a remote builder, it should
# be powerful enough to do some basic qemu stuff
boot.binfmt.emulatedSystems = [
"i686-linux"
"aarch64-linux"
];
greg.tailscale.enable = true;
# The builder user needs to be trusted to submit builds
nix.settings = {
post-build-hook = getExe (
pkgs.writeShellScriptBin "upload-to-cache.sh" ''
set -eu
set -f
export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path}
export IFS=' '
echo "Uploading paths " $OUT_PATHS
nix copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" $OUT_PATHS
''
);
secret-key-files = config.age.secrets.private-cache.path;
trusted-users = [ config.users.users.remote-builder-user.name ];
};
users.users.remote-builder-user = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus"
@@ -26,13 +70,5 @@ with lib;
isNormalUser = true;
useDefaultShell = true;
};
# The builder user needs to be trusted to submit builds
nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ];
# If the system is powerful enough to be a remote builder, it should
# be powerful enough to do some basic qemu stuff
boot.binfmt.emulatedSystems = [
"i686-linux"
"aarch64-linux"
];
};
}
secrets/cache-credentials.age
BIN
View File
Binary file not shown.
secrets/cache-private-key.age
BIN
View File
Binary file not shown.
secrets/secrets.nix
+24
View File
@@ -6,6 +6,8 @@ let
hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz";
jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIbvNNYrsT9sSBSwIL9c0LiHDaOiztlTJZAGgTDGUHq root@vm-matrix";
exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3";
systems = [
genesis
linode
@@ -14,6 +16,7 @@ let
hosea
jeremiah
matrix
exodus
];
user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
@@ -23,6 +26,7 @@ let
user_isaiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@isaiah";
user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea";
user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah";
user_exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC189EnvWjNUp3xSzPMAtw85oQEsvP1tQR1TK640nLx6 greg@exodus";
users = [
user_genesis_virt
@@ -32,6 +36,7 @@ let
user_isaiah
user_hosea
user_jeremiah
user_exodus
];
everyone = systems ++ users;
@@ -50,6 +55,25 @@ in
"jude-forgejo-runner.age".publicKeys = everyone;
"minio.age".publicKeys = everyone;
"cache-private-key.age".publicKeys = [
jeremiah
isaiah
jude
user_jeremiah
user_isaiah
user_jude
user_exodus
];
"cache-credentials.age".publicKeys = [
jeremiah
isaiah
jude
user_jeremiah
user_isaiah
user_jude
user_exodus
];
"restic-env.age".publicKeys = everyone;
"restic-pw.age".publicKeys = everyone;