depot/hosts/VEGAS/services/hydra/default.nix

100 lines
3 KiB
Nix
Raw Normal View History

{ cluster, config, inputs, lib, pkgs, tools, ... }:
2021-12-01 23:27:26 +02:00
let
inherit (tools.meta) domain;
patroni = cluster.config.links.patroni-pg-access;
2021-12-01 23:27:26 +02:00
in
{
age.secrets = {
hydraS3 = {
file = ../../../../secrets/hydra-s3.age;
group = "hydra";
mode = "0440";
};
hydra-bincache-key = {
file = ../../../../secrets/hydra-bincache.age;
group = "hydra";
mode = "0440";
};
hydra-builder-key = {
file = ../../../../secrets/hydra-builder-key.age;
group = "hydra";
mode = "0440";
};
2022-03-13 00:16:38 +02:00
} // lib.mapAttrs' (k: lib.nameValuePair "hydra-database-credentials-for-${k}")
2021-12-01 23:27:26 +02:00
(lib.genAttrs [ "hydra-queue-runner" "hydra-www" "hydra" ]
(x:
{
file = ../../../../secrets/hydra-db-credentials.age;
group = "hydra";
owner = x;
mode = "0400";
}
)
);
2022-06-18 03:44:51 +03:00
links.hydra.protocol = "http";
2021-12-01 23:27:26 +02:00
services.nginx.appendHttpConfig = ''
limit_req_zone $binary_remote_addr zone=hydra_api_push_limiter:10m rate=1r/m;
'';
2022-06-18 03:44:51 +03:00
services.nginx.virtualHosts."hydra.${domain}" = lib.recursiveUpdate (tools.nginx.vhosts.proxy config.links.hydra.url) {
locations."/api/push" = {
2022-06-18 03:44:51 +03:00
proxyPass = config.links.hydra.url;
extraConfig = ''
auth_request off;
proxy_method PUT;
limit_req zone=hydra_api_push_limiter burst=3 nodelay;
limit_req_status 429;
'';
};
};
2021-12-01 23:27:26 +02:00
services.oauth2_proxy.nginx.virtualHosts = [ "hydra.${domain}" ];
services.hydra = {
enable = true;
2022-07-31 23:36:07 +03:00
package = inputs.self.packages.${pkgs.system}.hydra;
2021-12-01 23:27:26 +02:00
hydraURL = "https://hydra.${domain}";
dbi = "dbi:Pg:dbname=hydra;host=${patroni.ipv4};port=${patroni.portStr};user=hydra;";
2022-06-18 03:44:51 +03:00
inherit (config.links.hydra) port;
2021-12-01 23:27:26 +02:00
notificationSender = "hydra@${domain}";
buildMachinesFiles = [ "/etc/nix/hydra-machines" ];
useSubstitutes = true;
extraConfig = ''
store_uri = s3://nix-store?scheme=https&endpoint=object-storage.${domain}&secret-key=${config.age.secrets.hydra-bincache-key.path}
server_store_uri = https://cache.${domain}
'';
extraEnv = {
AWS_SHARED_CREDENTIALS_FILE = config.age.secrets.hydraS3.path;
PGPASSFILE = config.age.secrets."hydra-database-credentials-for-hydra".path;
};
};
# override weird hydra module stuff
systemd.services = {
hydra-send-stats = lib.mkForce {};
} // lib.genAttrs [ "hydra-notify" "hydra-queue-runner" "hydra-server" ]
(x: let
name = if x == "hydra-server" then "hydra-www" else
if x == "hydra-notify" then "hydra-queue-runner" else x;
in {
environment = {
PGPASSFILE = lib.mkForce config.age.secrets."hydra-database-credentials-for-${name}".path;
};
}
);
nix.extraOptions = lib.mkForce ''
2022-07-01 17:41:05 +03:00
allowed-uris = https://git.${domain} https://github.com https://git.sr.ht
2021-12-01 23:27:26 +02:00
keep-outputs = true
keep-derivations = true
'';
programs.ssh.knownHosts.git = {
hostNames = [ "git.${domain}" ];
2022-02-01 22:18:08 +02:00
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICz2nGA+Y4OxhMKsV6vKIns3hOoBkK557712h7FfWXcE";
2021-12-01 23:27:26 +02:00
};
}