36 lines
1.1 KiB
Nix
36 lines
1.1 KiB
Nix
# swarm-heavyduty: the builder, the forge's CI runner and the binary cache.
|
|
{ config, lib, ... }:
|
|
let
|
|
hyperhive = config.services.hyperhive;
|
|
|
|
# Leaves copied from swarm-central, where the secret store runs. See
|
|
# swarm-services.nix for the helper's naming.
|
|
pki = "/var/lib/swarm-pki";
|
|
pair = option: stem: {
|
|
"${option}ClientCertFile" = "${pki}/${stem}.pem";
|
|
"${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
|
|
};
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
deploy.builder.enable = true;
|
|
deploy.ci-runner.enable = true;
|
|
deploy.attic.enable = true;
|
|
|
|
# The cache answers on the private addresses only.
|
|
gateway.vhosts = lib.genAttrs [ hyperhive.swarm.attic.ownDomain ] (_: {
|
|
public = false;
|
|
});
|
|
|
|
deploy.bao = lib.mergeAttrsList [
|
|
(pair "builder" "builder")
|
|
(pair "ciRunner" "ci-runner")
|
|
(pair "attic" "attic")
|
|
(pair "forwarderOidc" "forwarder-oidc")
|
|
(pair "servicesIssuer" "services-issuer")
|
|
];
|
|
};
|
|
|
|
# The cache is served through the gateway, over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.gateway.httpsPort ];
|
|
}
|