monolith: enable nix cache over ssh
This commit is contained in:
parent
3156f59c26
commit
2b6edc0d73
5 changed files with 139 additions and 53 deletions
|
|
@ -1,56 +1,96 @@
|
|||
{ pkgs, lib, ... }:
|
||||
let
|
||||
installNixScript = pkgs.writeScriptBin "install-nix" ''
|
||||
mkdir -p -m 0755 /nix/var/log/nix/drvs
|
||||
mkdir -p -m 0755 /nix/var/nix/gcroots
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles
|
||||
mkdir -p -m 0755 /nix/var/nix/temproots
|
||||
mkdir -p -m 0755 /nix/var/nix/userpool
|
||||
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
|
||||
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
|
||||
mkdir -p -m 0700 "$HOME/.nix-defexpr"
|
||||
installNixScript =
|
||||
{
|
||||
authenticationTokenConfigFile,
|
||||
nixCacheSshPrivateKeyPath ? null,
|
||||
...
|
||||
}:
|
||||
pkgs.writeScriptBin "install-nix" ''
|
||||
mkdir -p -m 0755 /nix/var/log/nix/drvs
|
||||
mkdir -p -m 0755 /nix/var/nix/gcroots
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles
|
||||
mkdir -p -m 0755 /nix/var/nix/temproots
|
||||
mkdir -p -m 0755 /nix/var/nix/userpool
|
||||
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
|
||||
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
|
||||
mkdir -p -m 0700 "$HOME/.nix-defexpr"
|
||||
|
||||
. ${pkgs.nix}/etc/profile.d/nix.sh
|
||||
. ${pkgs.nix}/etc/profile.d/nix.sh
|
||||
|
||||
${pkgs.nix}/bin/nix-env -i ${
|
||||
lib.concatStringsSep " " (
|
||||
with pkgs;
|
||||
[
|
||||
nix
|
||||
cacert
|
||||
git
|
||||
openssh
|
||||
docker
|
||||
]
|
||||
)
|
||||
}
|
||||
'';
|
||||
${pkgs.nix}/bin/nix-env -i ${
|
||||
lib.concatStringsSep " " (
|
||||
with pkgs;
|
||||
[
|
||||
nix
|
||||
cacert
|
||||
git
|
||||
openssh
|
||||
docker
|
||||
]
|
||||
)
|
||||
}
|
||||
|
||||
${lib.optionalString (nixCacheSshPrivateKeyPath != null) ''
|
||||
NIX_CACHE_SSH_PRIVATE_KEY_PATH="${nixCacheSshPrivateKeyPath}"
|
||||
. ${./gitlab-runner/nix-cache-start}
|
||||
''}
|
||||
'';
|
||||
|
||||
pushStoreContents =
|
||||
{
|
||||
authenticationTokenConfigFile,
|
||||
nixCacheSshPrivateKeyPath ? null,
|
||||
...
|
||||
}:
|
||||
pkgs.writeScriptBin "push-to-cache" ''
|
||||
${lib.optionalString (nixCacheSshPrivateKeyPath != null) ''
|
||||
. ${./gitlab-runner/nix-cache-end}
|
||||
''}
|
||||
'';
|
||||
in
|
||||
{
|
||||
mkNixRunner = authenticationTokenConfigFile: {
|
||||
# File should contain at least these two variables:
|
||||
# `CI_SERVER_URL`
|
||||
# `REGISTRATION_TOKEN`
|
||||
inherit authenticationTokenConfigFile; # 2
|
||||
dockerImage = "alpine:3.18.2";
|
||||
dockerPullPolicy = "if-not-present";
|
||||
dockerVolumes = [
|
||||
"/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
|
||||
"/nix/store:/nix/store:ro"
|
||||
"/nix/var/nix/db:/nix/var/nix/db:ro"
|
||||
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
|
||||
"/tmp:/tmp"
|
||||
"/var/run/docker.sock:/var/run/docker.sock"
|
||||
"/var/lib/docker/containers:/var/lib/docker/containers"
|
||||
];
|
||||
dockerDisableCache = true;
|
||||
preBuildScript = "\". ${lib.getExe installNixScript}\"";
|
||||
environmentVariables = {
|
||||
ENV = "/etc/profile";
|
||||
USER = "root";
|
||||
NIX_REMOTE = "daemon";
|
||||
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
|
||||
rec {
|
||||
mkNixRunnerFull =
|
||||
{
|
||||
authenticationTokenConfigFile,
|
||||
nixCacheSshPrivateKeyPath ? null,
|
||||
...
|
||||
}@args:
|
||||
{
|
||||
# File should contain at least these two variables:
|
||||
# `CI_SERVER_URL`
|
||||
# `REGISTRATION_TOKEN`
|
||||
inherit authenticationTokenConfigFile; # 2
|
||||
dockerImage = "alpine:3.18.2";
|
||||
dockerPullPolicy = "if-not-present";
|
||||
dockerVolumes =
|
||||
[
|
||||
"/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
|
||||
"/nix/store:/nix/store:ro"
|
||||
"/nix/var/nix/db:/nix/var/nix/db:ro"
|
||||
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
|
||||
"/tmp:/tmp"
|
||||
"/var/run/docker.sock:/var/run/docker.sock"
|
||||
"/var/lib/docker/containers:/var/lib/docker/containers"
|
||||
]
|
||||
++ lib.optionals (nixCacheSshPrivateKeyPath != null) [
|
||||
"${nixCacheSshPrivateKeyPath}:${nixCacheSshPrivateKeyPath}"
|
||||
];
|
||||
dockerDisableCache = true;
|
||||
preBuildScript = "\". ${lib.getExe (installNixScript args)}\"";
|
||||
postBuildScript = "\". ${lib.getExe (pushStoreContents args)}\"";
|
||||
environmentVariables = {
|
||||
ENV = "/etc/profile";
|
||||
USER = "root";
|
||||
NIX_REMOTE = "daemon";
|
||||
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
|
||||
};
|
||||
};
|
||||
|
||||
mkNixRunner =
|
||||
authenticationTokenConfigFile:
|
||||
mkNixRunnerFull {
|
||||
inherit authenticationTokenConfigFile;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
21
system/gitlab-runner/nix-cache-end
Executable file
21
system/gitlab-runner/nix-cache-end
Executable file
|
|
@ -0,0 +1,21 @@
|
|||
#!/bin/sh
|
||||
|
||||
echo "nix-cache: Storing new store items"
|
||||
NEW_NIX_STORE_CONTENTS_FILE=$(mktemp)
|
||||
find /nix/store/ -maxdepth 1 > $NEW_NIX_STORE_CONTENTS_FILE
|
||||
|
||||
sort $OLD_NIX_STORE_CONTENTS_FILE -o $OLD_NIX_STORE_CONTENTS_FILE
|
||||
sort $NEW_NIX_STORE_CONTENTS_FILE -o $NEW_NIX_STORE_CONTENTS_FILE
|
||||
|
||||
echo "nix-cache: Comparing store paths"
|
||||
FILTERED_NIX_STORE_CONTENTS_FILE=$(mktemp)
|
||||
comm -13 $OLD_NIX_STORE_CONTENTS_FILE $NEW_NIX_STORE_CONTENTS_FILE > $FILTERED_NIX_STORE_CONTENTS_FILE
|
||||
echo "nix-cache: New store paths:"
|
||||
cat $FILTERED_NIX_STORE_CONTENTS_FILE | sed 's/^/ /g'
|
||||
|
||||
if test -n "$(head -n1 $FILTERED_NIX_STORE_CONTENTS_FILE)"; then
|
||||
echo "nix-cache: Sending new paths to cache"
|
||||
nix copy --to "$STORE_URL" $(cat $FILTERED_NIX_STORE_CONTENTS_FILE) || true
|
||||
else
|
||||
echo "nix-cache: Nothing to send"
|
||||
fi
|
||||
18
system/gitlab-runner/nix-cache-start
Executable file
18
system/gitlab-runner/nix-cache-start
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
#!/bin/sh
|
||||
|
||||
echo "nix-cache: Setting up ssh key and host"
|
||||
STORE_HOST_PUB_KEY="IyBuaXgtY2FjaGUud29wdXMuZGV2OjIyIFNTSC0yLjAtT3BlblNTSF8xMC4wCm5peC1jYWNoZS53b3B1cy5kZXYgc3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU5VNzFONVF4ZENtTTdOMjVTbk9nNnUrWUxtdjkyem5wZURjeUlEYW1sZEkK"
|
||||
STORE_URL="ssh://nix-ssh@nix-cache.wopus.dev?trusted=true&compress=true&ssh-key=$NIX_CACHE_SSH_PRIVATE_KEY_PATH&base64-ssh-public-host-key=$STORE_HOST_PUB_KEY"
|
||||
echo STORE_URL="$STORE_URL"
|
||||
|
||||
NIX_EXTRA_CONFIG_FILE=$(mktemp)
|
||||
cat > "$NIX_EXTRA_CONFIG_FILE" <<EOF
|
||||
extra-substituters = $STORE_URL
|
||||
EOF
|
||||
|
||||
echo "nix-cache: Adding remote cache as substituter"
|
||||
export NIX_USER_CONF_FILES="$NIX_EXTRA_CONFIG_FILE:$NIX_USER_CONF_FILES"
|
||||
|
||||
echo "nix-cache: Storing existing store items"
|
||||
OLD_NIX_STORE_CONTENTS_FILE=$(mktemp)
|
||||
find /nix/store/ -maxdepth 1 > $OLD_NIX_STORE_CONTENTS_FILE
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
...
|
||||
}:
|
||||
let
|
||||
inherit (pkgs.callPackage ./gitlab-runner.nix { }) mkNixRunner;
|
||||
inherit (pkgs.callPackage ./gitlab-runner.nix { }) mkNixRunner mkNixRunnerFull;
|
||||
in
|
||||
{
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
||||
|
|
@ -18,7 +18,10 @@ in
|
|||
thoreb-telemetria-nix = mkNixRunner config.sops.secrets."gitlab-runners/thoreb-telemetria-nix".path;
|
||||
thoreb-itinerario-nix = mkNixRunner config.sops.secrets."gitlab-runners/thoreb-itinerario-nix".path;
|
||||
|
||||
wopus-gitlab-nix = mkNixRunner config.sops.secrets."gitlab-runners/wopus-gitlab-nix".path;
|
||||
wopus-gitlab-nix = mkNixRunnerFull {
|
||||
authenticationTokenConfigFile = config.sops.secrets."gitlab-runners/wopus-gitlab-nix".path;
|
||||
nixCacheSshPrivateKeyPath = config.sops.secrets."gitlab-runners/wopus-ssh-nix-cache-pk".path;
|
||||
};
|
||||
|
||||
default = {
|
||||
# File should contain at least these two variables:
|
||||
|
|
@ -45,5 +48,8 @@ in
|
|||
"gitlab-runners/wopus-gitlab-nix" = {
|
||||
sopsFile = ../secrets/monolith/default.yaml;
|
||||
};
|
||||
"gitlab-runners/wopus-ssh-nix-cache-pk" = {
|
||||
sopsFile = ../secrets/monolith/default.yaml;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue