This repository has no description
3.4 kB
96 lines
1{ inputs, ... }:
2{
3 perSystem =
4 {
5 lib,
6 pkgs,
7 system,
8 ...
9 }:
10 let
11 grpc = inputs.nix-grpc-store.packages.${system};
12
13 # Envoy as configured by nix-grpc-store's NixOS module, rendered for a
14 # plain Linux runner. The farm identity on both sides: the clients in
15 # the machine jobs reach it over iroh, the nodes verify it and grant it
16 # `trusted` (so it can read the builder list from the scheduler).
17 envoySettings =
18 (inputs.nixpkgs.lib.nixosSystem {
19 modules = [
20 inputs.nix-grpc-store.nixosModules.lb
21 {
22 nixpkgs.pkgs = pkgs;
23 services.nix-grpc-farm-lb = {
24 enable = true;
25 listen = "127.0.0.1:50051";
26 scheduler = "127.0.0.1:50052";
27 systems = [ system ];
28 # Written by ci-farm.sh. Envoy watches the directories of
29 # these files, so they must exist on the runner.
30 tls = {
31 certFile = "/tmp/ci-farm/farm.crt";
32 keyFile = "/tmp/ci-farm/farm.key";
33 clientCaFile = "/tmp/ci-farm/farm.crt";
34 upstream = {
35 certFile = "/tmp/ci-farm/farm.crt";
36 keyFile = "/tmp/ci-farm/farm.key";
37 caFile = "/tmp/ci-farm/farm.crt";
38 };
39 };
40 };
41 }
42 ];
43 }).config.services.envoy.settings;
44
45 # The module verifies a client certificate but doesn't require one, and
46 # passes requests on with the farm identity. Require it: the listener
47 # is reachable over iroh.
48 envoyConfig = (pkgs.formats.json { }).generate "ci-farm-envoy.json" (
49 envoySettings
50 // {
51 static_resources = envoySettings.static_resources // {
52 listeners = map (
53 listener:
54 listener
55 // {
56 filter_chains = map (
57 chain:
58 lib.recursiveUpdate chain { transport_socket.typed_config.require_client_certificate = true; }
59 ) listener.filter_chains;
60 }
61 ) envoySettings.static_resources.listeners;
62 };
63 }
64 );
65 in
66 {
67 # ci-farm farm MACHINE... scheduler + balancer until the machine
68 # jobs of MACHINE... have finished
69 # ci-farm machine INDEX NAME builder, builds the toplevel of NAME
70 # through the farm
71 # ci-farm push PATH... pushes the closures of PATH... to niks3
72 #
73 # Runs in .github/workflows/farm.yml. See ci-farm.sh for the layout.
74 packages = lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
75 ci-farm = pkgs.writeShellApplication {
76 name = "ci-farm";
77 runtimeInputs = [
78 grpc.default
79 inputs.niks3.packages.${system}.niks3
80 pkgs.coreutils
81 pkgs.curl
82 pkgs.dumbpipe
83 pkgs.envoy-bin
84 pkgs.gh
85 pkgs.jq
86 ];
87 runtimeEnv = {
88 FARM_CRT = ./farm.crt;
89 ENVOY_CONFIG = envoyConfig;
90 NIX_WITH_PLUGIN = lib.getExe grpc.nix-with-plugin;
91 };
92 text = builtins.readFile ./ci-farm.sh;
93 };
94 };
95 };
96}