superconfig/tools/ci-farm/ at 97a2c0a59db6b377e967cbe2b868b80f6882eda0 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / tools / ci-farm

3 files

at 97a2c0a59db6b377e967cbe2b868b80f6882eda0

Hermes tools.ci-farm: wait for a healthy builder behind the balancer before building 7d ago

tools.ci-farm: wait for a healthy builder behind the balancer before building The client gives up after connect-timeout on a store it has never reached. At farm start envoy has no builder yet (none joined, or not yet dialed and health checked through its tunnel), answers with grpc-status 14, and a few machine jobs failed on their first QueryMissing. Probe a health check through the balancer until a builder answers it.

1 week ago

tools.ci-farm: add on-demand nix-grpc-store farm on GitHub Actions A farm job (scheduler, builder, envoy, client) and a pool of worker jobs build the requested machines together, each derivation once, and push the outputs to niks3 with the job's GitHub OIDC token. Runners can't reach each other, so every hop is a dumbpipe (iroh) tunnel ending on 127.0.0.1. All daemons and envoy share one TLS identity (FARM_KEY secret, farm.crt committed, SAN 127.0.0.1) and only trust it. The iroh endpoint keys are derived from FARM_KEY, so it is the only secret. Workers probe the farm with fresh dialers before starting their long-lived one: a dumbpipe dialer started before the farm is discoverable never reaches it. configs.nix-farm: niks3 accepts GitHub OIDC tokens of this repository.

1 week ago

flake-module.nix

.github: build all machines with the farm in the ci check, one job per machine ci.yml calls farm.yml (now reusable) instead of the eval-only nixos-* checks, which are gone from flake.nix. The farm job is only the coordinator (scheduler + envoy, which now requires the farm client cert, reachable over iroh). Each machine job joins as a builder, evaluates its machine, builds the toplevel through the farm and leaves when done; its outputs are in niks3 by then. ci runs for master pushes, PRs and dispatches; a newer run for the same ref cancels the older one, farms of different refs queue FIFO (queue: max). update-pkgs verifies PRs with ci.yml alone.

1 week ago