superconfig/tools/ci-farm/ at 447b6da3fd77f00a2e4ee7de023accdac0eacaa3 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / tools / ci-farm

3 files

at 447b6da3fd77f00a2e4ee7de023accdac0eacaa3

Hermes tools.ci-farm: keep the niks3 token when a refresh fails, drain the builder without one 6d ago

tools.ci-farm: keep the niks3 token when a refresh fails, drain the builder without one

6 days ago

tools.ci-farm: add on-demand nix-grpc-store farm on GitHub Actions A farm job (scheduler, builder, envoy, client) and a pool of worker jobs build the requested machines together, each derivation once, and push the outputs to niks3 with the job's GitHub OIDC token. Runners can't reach each other, so every hop is a dumbpipe (iroh) tunnel ending on 127.0.0.1. All daemons and envoy share one TLS identity (FARM_KEY secret, farm.crt committed, SAN 127.0.0.1) and only trust it. The iroh endpoint keys are derived from FARM_KEY, so it is the only secret. Workers probe the farm with fresh dialers before starting their long-lived one: a dumbpipe dialer started before the farm is discoverable never reaches it. configs.nix-farm: niks3 accepts GitHub OIDC tokens of this repository.

1 week ago

flake-module.nix

.github: build all machines with the farm in the ci check, one job per machine ci.yml calls farm.yml (now reusable) instead of the eval-only nixos-* checks, which are gone from flake.nix. The farm job is only the coordinator (scheduler + envoy, which now requires the farm client cert, reachable over iroh). Each machine job joins as a builder, evaluates its machine, builds the toplevel through the farm and leaves when done; its outputs are in niks3 by then. ci runs for master pushes, PRs and dispatches; a newer run for the same ref cancels the older one, farms of different refs queue FIFO (queue: max). update-pkgs verifies PRs with ci.yml alone.

1 week ago