superconfig/configs/nix-farm/ at ef0c4e5a0d4f91a74d213dbea4864b8f7fd3052e · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / configs / nix-farm

4 files

at ef0c4e5a0d4f91a74d213dbea4864b8f7fd3052e

lassulus configs.nix-farm: keep connections to B2 alive 7d ago

configs.nix-farm: don't push paths cache.nixos.org serves Builders pushed every path of a closure, including everything they had substituted from cache.nixos.org: 9.9 of 10.3 GiB for ignavia. niks3 now comes from a fork (lassulus/niks3) with `push --ignore-upstream-key`, and neoprism's daemon and the CI farm pass cache.nixos.org-1 to it. cache.lassul.us no longer holds complete closures on its own: clients need cache.nixos.org next to it, which every machine has.

1 week ago

configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.

1 week ago

configs.nix-farm: keep connections to B2 alive

1 week ago

configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.

1 week ago