This repository has no description
3.3 kB
97 lines
1{
2 config,
3 lib,
4 pkgs,
5 self,
6 ...
7}:
8let
9 vars = config.clan.core.vars.generators;
10 cachePub = self + "/vars/per-machine/neoprism/nix-cache-signing/key.pub/value";
11 credDir = "/run/credentials/nix-grpc-daemon.service";
12in
13{
14 imports = [
15 self.inputs.nix-grpc-store.nixosModules.server
16 ./ca.nix
17 ];
18
19 # Server cert for the daemon, signed by the shared farm CA, plus a copy of
20 # the CA cert to verify clients against. Secret files for the same reason
21 # as in ca.nix. Root-owned: the daemon gets them via LoadCredential below.
22 clan.core.vars.generators.nix-farm-server = {
23 dependencies = [ "nix-farm-ca" ];
24 files."server.key" = { };
25 files."server.crt" = { };
26 files."ca.crt" = { };
27 runtimeInputs = [ pkgs.openssl ];
28 script = ''
29 openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
30 -keyout "$out/server.key" -out server.csr -subj "/CN=neoprism"
31 printf '%s\n' \
32 "basicConstraints=critical,CA:FALSE" \
33 "keyUsage=critical,digitalSignature" \
34 "extendedKeyUsage=serverAuth" \
35 "subjectAltName=DNS:neoprism.r,DNS:neoprism.lassul.us" > server.ext
36 openssl x509 -req -in server.csr \
37 -CA "$in/nix-farm-ca/ca.crt" -CAkey "$in/nix-farm-ca/ca.key" \
38 -CAcreateserial -days 3650 -extfile server.ext -out "$out/server.crt"
39 cp "$in/nix-farm-ca/ca.crt" "$out/ca.crt"
40 '';
41 };
42
43 # Standalone node: schedules onto itself, publishes outputs to niks3.
44 services.nix-grpc-daemon = {
45 enable = true;
46 roles = [
47 "builder"
48 "scheduler"
49 ];
50 listen = "[::]:50051";
51 # gRPC's cert file watcher treats mtime 0 as a stat failure and never
52 # loads the key pair, and clan unpacks /run/secrets with mtime 0. systemd
53 # credentials are fresh copies with a real mtime.
54 tls = {
55 certFile = "${credDir}/server.crt";
56 keyFile = "${credDir}/server.key";
57 clientCaFile = "${credDir}/ca.crt";
58 };
59 # `nix build --store grpc://… --eval-store auto` needs write (README).
60 accessRules = [
61 {
62 cn = "lass";
63 role = "write";
64 }
65 ];
66 niks3 = {
67 package = self.inputs.niks3.packages.${pkgs.stdenv.hostPlatform.system}.niks3;
68 # same box, skip nginx/ACME
69 url = "http://${config.services.niks3.httpAddr}";
70 tokenFile = vars.niks3.files."api-token-grpc".path;
71 cacheUrl = config.services.niks3.cacheUrl;
72 # empty until `clan vars generate neoprism` wrote the key
73 publicKeys = lib.optional (builtins.pathExists cachePub) (
74 lib.removeSuffix "\n" (builtins.readFile cachePub)
75 );
76 # cache.nixos.org keeps serving what it signed; only push our own paths
77 pushFlags = [
78 "--ignore-upstream-key"
79 "cache.nixos.org-1"
80 ];
81 };
82 };
83
84 systemd.services.nix-grpc-daemon.serviceConfig = {
85 LoadCredential = map (f: "${f}:${vars.nix-farm-server.files.${f}.path}") [
86 "server.crt"
87 "server.key"
88 "ca.crt"
89 ];
90 # Upstream's 2G default assumes the unit only proxies, but `niks3 push`
91 # runs in this cgroup too and got OOM-killed on large NARs (kernel
92 # modules), taking the whole daemon down with it.
93 MemoryMax = "8G";
94 };
95
96 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 50051 ];
97}