superconfig/tools/ci-farm/ at e07f099d71a01a29ea0ac4f56acf1c93ccaecd35 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / tools / ci-farm

3 files

at e07f099d71a01a29ea0ac4f56acf1c93ccaecd35

Hermes tools.ci-farm: push the ci-farm closure to niks3 8d ago

tools.ci-farm: push the ci-farm closure to niks3

1 week ago

tools.ci-farm: add on-demand nix-grpc-store farm on GitHub Actions A farm job (scheduler, builder, envoy, client) and a pool of worker jobs build the requested machines together, each derivation once, and push the outputs to niks3 with the job's GitHub OIDC token. Runners can't reach each other, so every hop is a dumbpipe (iroh) tunnel ending on 127.0.0.1. All daemons and envoy share one TLS identity (FARM_KEY secret, farm.crt committed, SAN 127.0.0.1) and only trust it. The iroh endpoint keys are derived from FARM_KEY, so it is the only secret. Workers probe the farm with fresh dialers before starting their long-lived one: a dumbpipe dialer started before the farm is discoverable never reaches it. configs.nix-farm: niks3 accepts GitHub OIDC tokens of this repository.

1 week ago

flake-module.nix

tools.ci-farm: push the ci-farm closure to niks3

1 week ago