superconfig/configs/nix-farm/ at be6c7d60ae70680d7b6cc10ed5b9bfd5bef98cdc · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / configs / nix-farm

4 files

at be6c7d60ae70680d7b6cc10ed5b9bfd5bef98cdc

lassulus configs.nix-farm: don't push paths cache.nixos.org serves 8d ago

configs.nix-farm: don't push paths cache.nixos.org serves Builders pushed every path of a closure, including everything they had substituted from cache.nixos.org: 9.9 of 10.3 GiB for ignavia. niks3 now comes from a fork (lassulus/niks3) with `push --ignore-upstream-key`, and neoprism's daemon and the CI farm pass cache.nixos.org-1 to it. cache.lassul.us no longer holds complete closures on its own: clients need cache.nixos.org next to it, which every machine has.

1 week ago

configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.

1 week ago

tools.ci-farm: add on-demand nix-grpc-store farm on GitHub Actions A farm job (scheduler, builder, envoy, client) and a pool of worker jobs build the requested machines together, each derivation once, and push the outputs to niks3 with the job's GitHub OIDC token. Runners can't reach each other, so every hop is a dumbpipe (iroh) tunnel ending on 127.0.0.1. All daemons and envoy share one TLS identity (FARM_KEY secret, farm.crt committed, SAN 127.0.0.1) and only trust it. The iroh endpoint keys are derived from FARM_KEY, so it is the only secret. Workers probe the farm with fresh dialers before starting their long-lived one: a dumbpipe dialer started before the farm is discoverable never reaches it. configs.nix-farm: niks3 accepts GitHub OIDC tokens of this repository.

1 week ago

configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.

1 week ago