49 lines
1.6 KiB
Nix
49 lines
1.6 KiB
Nix
# swarm-heavyduty: the builder, the forge's CI runner and the binary cache.
|
|
{ config, lib, ... }:
|
|
let
|
|
hyperhive = config.services.hyperhive;
|
|
|
|
# The store's CA and the leaves, copied from swarm-central, where the secret
|
|
# store runs. See swarm-services.nix for the helper's naming.
|
|
pki = "/var/lib/swarm-pki";
|
|
pair = option: stem: {
|
|
"${option}ClientCertFile" = "${pki}/${stem}.pem";
|
|
"${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
|
|
};
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
deploy.builder.enable = true;
|
|
deploy.ci-runner.enable = true;
|
|
deploy.attic.enable = true;
|
|
|
|
# The cache answers on the private addresses only.
|
|
gateway.vhosts = lib.genAttrs [ hyperhive.swarm.attic.ownDomain ] (_: {
|
|
public = false;
|
|
});
|
|
|
|
deploy.bao = lib.mergeAttrsList [
|
|
{ serverCaFile = "${pki}/ca.pem"; }
|
|
(pair "builder" "builder")
|
|
(pair "ciRunner" "ci-runner")
|
|
(pair "attic" "attic")
|
|
(pair "forwarderOidc" "forwarder-oidc")
|
|
(pair "servicesIssuer" "services-issuer")
|
|
];
|
|
};
|
|
|
|
# CI builds land in this host's store; the runner module warns without a
|
|
# collector. See docs/4-implementation/scheduler/ci.md, "Host store
|
|
# maintenance", for the daily timer and the disk-pressure settings.
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "daily";
|
|
randomizedDelaySec = "45min";
|
|
options = "--delete-older-than 1d";
|
|
};
|
|
nix.settings.min-free = 20 * 1024 * 1024 * 1024;
|
|
nix.settings.max-free = 50 * 1024 * 1024 * 1024;
|
|
|
|
# The cache is served through the gateway, over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.gateway.httpsPort ];
|
|
}
|