cluster/simulacrum: only run checks on x86_64-linux

`flake.lock`: Update

cluster/services/c-f32aebf5/default.nix

@@ -1,6 +0,0 @@
-{
-  services.c-f32aebf5 = {
-    nodes.host = [ "VEGAS" ];
-    nixos.host = [ ./host.nix ];
-  };
-}

cluster/services/c-f32aebf5/host.nix

@@ -1,203 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cid = "c-f32aebf5";
-  link = config.links.${cid};
-  root = "/var/lib/${cid}";
-  home = "${root}/pfx";
-
-  sptAki =  {
-    release-3_8_0 = pkgs.fetchurl {
-      url = "https://dev.sp-tarkov.com/SPT/Stable-releases/releases/download/3.8.0/RELEASE-SPT-3.8.0-29197-2dd4d91.7z";
-      hash = "sha256-IRMzI+hQkoCmVJXkAV4c/b2l/MtLb98IwDftMbFTlxA=";
-    };
-    update-3_8_1 = pkgs.fetchurl {
-      url = "https://spt-releases.modd.in/SPT-3.8.1-29197-d3ac83e.7z";
-      hash = "sha256-3roQlHgi8CUtLKji2YZLNgo8s92eUv3a+AbKo7VFB2U=";
-    };
-  };
-
-  installSpt = pkgs.writeShellScript "install-spt" ''
-    mkdir spt
-    cd spt
-    ${pkgs.p7zip}/bin/7z x -y ${sptAki.release-3_8_0}
-    ${pkgs.p7zip}/bin/7z x -y ${sptAki.update-3_8_1}
-  '';
-in
-
-{
-  links.${cid} = {
-    protocol = "http";
-    ipv4 = config.reflection.interfaces.primary.addrPublic;
-  };
-
-  users.users.${cid} = {
-    isNormalUser = true;
-    group = cid;
-    inherit home;
-    openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvaZG+5642/jjqVaFGsS3DK0Jtg1wfMY4Yh20tFKtdcZEsLRy16KSJkPH447vP91pGkx8T+GJ1kXEw4dMR9dOKDwS2qCgHwAQbZ2V+/NNJ56bCzTo+geSc/imrWjiHQUhzPRcTyI6pVi3rVAhzEnAVjcC7a4LnLsIFW8Ill0kF8OR4tHoeDNCNN/0XOgZH4dIT9eQCyw4u5zOaw9W81eTL7K1PLmbAWW1+qd//C6CrpxpxNO/kAnOavkscK1uJSfGRcs7Vb5mKKV2J7Be0vxCVY8C8h1qcYcrzudTs9MbQAgFP00bVcvl/byd5CAccQ2wBfuwUdJBC4MV8HZ152biGds8sdCBDoxyvSqScaBFza0iHAXPEygvfx+gEW9KNssfBoiU50SJgWbQUp9gQoppATg8XHqUI03xUeVBRbTyf7UMd2Qk3slWPEnEXlzvjwKGxyLsI0WKdWtqALgKe7mDn+wDAG15CayACi4kgKkZh3VariRC5Ks17LJdLH67vBvs="
-    ];
-  };
-  users.groups.${cid} = {};
-
-  systemd.services.${cid} = {
-    wantedBy = [ "multi-user.target" ];
-
-    path = [
-      pkgs.jq
-      pkgs.wine64Packages.staging
-      pkgs.tmux
-    ];
-
-    preStart = ''
-      cd ${home}
-      test -e drive_c || wine64 wineboot
-
-      cd drive_c
-      test -e spt || ${installSpt}
-
-      cd spt
-      jq < Aki_Data/Server/configs/http.json > .http-new.json \
-        '.ip = "${link.ipv4}" | .port = ${link.portStr} | .backendIp = "${link.ipv4}" | .backendPort = ${link.portStr}'
-      mv .http-new.json Aki_Data/Server/configs/http.json
-    '';
-
-    script = ''
-      cd ${home}/drive_c/spt
-      tmux new -s 0 -d wine64 Aki.Server.exe
-      exec tmux wait-for stop
-    '';
-
-    environment = {
-      WINEPREFIX = "${home}";
-    };
-
-    restartIfChanged = false;
-
-    serviceConfig = {
-      DynamicUser = true;
-      User = cid;
-      Group = cid;
-      ReadWritePaths = [ home ];
-
-      ExecStop = "${pkgs.wine64Packages.staging}/bin/wineserver --kill";
-      Restart = "on-failure";
-
-      CPUQuota = "75%";
-      MemoryMax = "2G";
-      MemorySwapMax = "2G";
-
-      IPAddressDeny = [
-        "10.0.0.0/8"
-        "100.64.0.0/10"
-        "169.254.0.0/16"
-        "172.16.0.0/12"
-        "192.0.0.0/24"
-        "192.0.2.0/24"
-        "192.168.0.0/16"
-        "198.18.0.0/15"
-        "198.51.100.0/24"
-        "203.0.113.0/24"
-        "240.0.0.0/4"
-        "100::/64"
-        "2001:2::/48"
-        "2001:db8::/32"
-        "fc00::/7"
-        "fe80::/10"
-      ];
-      IPAddressAllow = lib.unique config.networking.nameservers;
-    };
-  };
-
-  systemd.services."${cid}-backup" = {
-    startAt = "04:00";
-
-    script = ''
-      cd ${home}/drive_c/spt/user
-      tarball=".profiles-backup-$(date +%s).tar"
-      final="profiles-backup-$(date +%Y-%m-%d-%H:%M:%S).tar.xz"
-      ${pkgs.gnutar}/bin/tar cvf "$tarball" profiles/
-      ${pkgs.xz}/bin/xz -9 "$tarball"
-      mv "''${tarball}.xz" "$final"
-      ${pkgs.rotate-backups}/bin/rotate-backups -S yes -q --daily 30 --weekly 12 -I 'profiles-backup-*.tar.xz' .
-    '';
-
-    unitConfig.ConditionPathExists = "${home}/drive_c/spt/user";
-
-    serviceConfig = {
-      Type = "oneshot";
-      DynamicUser = true;
-      User = cid;
-      Group = cid;
-      ReadWritePaths = [ home ];
-      PrivateNetwork = true;
-    };
-  };
-
-  systemd.services."${cid}-auto-restart" = {
-    startAt = "05:00";
-
-    script = ''
-      echo -n "Service status: "
-      if ! systemctl is-active '${cid}.service'; then
-        echo Service not active.
-        exit
-      fi
-
-      for i in {1..120}; do
-        if test "$(${pkgs.iproute2}/bin/ss -H -tn 'cgroup = /sys/fs/cgroup/system.slice/${cid}.service' | wc -l)" != 0; then
-          echo Service in use.
-          exit
-        fi
-        sleep 1
-      done
-
-      echo Restarting service...
-      systemctl restart --no-block '${cid}.service'
-    '';
-
-    unitConfig.ConditionPathExists = "${home}/drive_c/spt";
-
-    serviceConfig = {
-      Type = "oneshot";
-    };
-  };
-  systemd.services."${cid}-control" = {
-    script = ''
-      if test -e ${home}/drive_c/spt/control/restart; then
-        echo Action: restart
-        trap 'rm -f ${home}/drive_c/spt/control/restart' EXIT
-        systemctl restart ${cid}.service
-      elif test -e ${home}/drive_c/spt/control/shutdown; then
-        echo Action: stop
-        systemctl stop ${cid}.service
-      else
-        echo Action: start
-        systemctl start ${cid}.service
-      fi
-    '';
-
-    unitConfig.ConditionPathExists = "${home}/drive_c/spt/control";
-
-    serviceConfig = {
-      Type = "oneshot";
-    };
-  };
-
-  systemd.paths."${cid}-control" = {
-    wantedBy = [ "paths.target" ];
-    pathConfig.PathChanged = "${home}/drive_c/spt/control";
-  };
-
-  services.openssh.extraConfig = ''
-    Match User ${cid}
-      ChrootDirectory ${root}
-      ForceCommand internal-sftp -d /pfx/drive_c
-      AllowTcpForwarding no
-      X11Forwarding no
-      PasswordAuthentication no
-  '';
-
-  networking.firewall.allowedTCPPorts = [ link.port ];
-}

cluster/services/hercules-ci-multi-agent/common.nix

@@ -1,4 +1,4 @@
-{ cluster, depot, lib, ... }:
+{ cluster, config, depot, lib, ... }:
 
 let
   inherit (cluster.config.services.hercules-ci-multi-agent) nodes secrets;
@@ -40,8 +40,19 @@ in
     settings = {
       clusterJoinTokenPath = secrets."clusterJoinToken-${org}".path;
       binaryCachesPath = secrets.cacheConfig.path;
+      concurrentTasks = lib.pipe config.reflection.hardware.cpu.cores [
+        (lib.flip builtins.div 2)
+        builtins.floor
+        (lib.max 2)
+      ];
     };
   });
 
+  nix.settings.cores = lib.pipe config.reflection.hardware.cpu.cores [
+    (builtins.mul 0.75)
+    builtins.floor
+    (lib.max 1)
+  ];
+
   users.groups.hercules-ci-agent.members = map (org: "hci-${org}") (lib.attrNames nodes);
 }

cluster/services/idm/client.nix

@@ -27,7 +27,7 @@ in
     mode = "0755";
     text = ''
       #!/bin/sh
-      exec ${pkgs.kanidm}/bin/kanidm_ssh_authorizedkeys "$@"
+      exec ${config.services.kanidm.package}/bin/kanidm_ssh_authorizedkeys "$@"
     '';
   };
 
@@ -57,10 +57,10 @@ in
   environment.systemPackages = let
     idmAlias = pkgs.runCommand "kanidm-idm-alias" {} ''
       mkdir -p $out/bin
-      ln -s ${pkgs.kanidm}/bin/kanidm $out/bin/idm
+      ln -s ${config.services.kanidm.package}/bin/kanidm $out/bin/idm
       mkdir -p $out/share/bash-completion/completions
       cat >$out/share/bash-completion/completions/idm.bash <<EOF
-      source ${pkgs.kanidm}/share/bash-completion/completions/kanidm.bash
+      source ${config.services.kanidm.package}/share/bash-completion/completions/kanidm.bash
       complete -F _kanidm -o bashdefault -o default idm
       EOF
     '';

cluster/services/irc/irc-host.nix

@@ -90,7 +90,7 @@ in {
   security.pam.services.ngircd = {
     text = ''
       # verify IRC users via IDM
-      auth required ${pkgs.kanidm}/lib/pam_kanidm.so 
+      auth required ${config.services.kanidm.package}/lib/pam_kanidm.so 
     '';
   };
   systemd.services.ngircd = {

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1718371084,
+        "lastModified": 1722339003,
-        "narHash": "sha256-abpBi61mg0g+lFFU0zY4C6oP6fBwPzbHPKBGw676xsA=",
+        "narHash": "sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "3a56735779db467538fb2e577eda28a9daacaca6",
+        "rev": "3f1dae074a12feb7327b4bf43cbac0d124488bb7",
         "type": "github"
       },
       "original": {
@@ -40,11 +40,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717279440,
+        "lastModified": 1722472866,
-        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
+        "narHash": "sha256-GJIz4M5HDB948Ex/8cPvbkrNzl/eKUE7/c21JBu4lb8=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
+        "rev": "e127acbf9a71ebc0c26bc8e28346822e0a6e16ba",
         "type": "github"
       },
       "original": {
@@ -113,19 +113,16 @@
     },
     "devshell": {
       "inputs": {
-        "flake-utils": [
-          "repin-flake-utils"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1717408969,
+        "lastModified": 1722113426,
-        "narHash": "sha256-Q0OEFqe35fZbbRPPRdrjTUUChKVhhWXz3T9ZSKmaoVY=",
+        "narHash": "sha256-Yo/3loq572A8Su6aY5GP56knpuKYRvM2a1meP9oJZCw=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "1ebbe68d57457c8cae98145410b164b5477761f4",
+        "rev": "67cce7359e4cd3c45296fb4aaf6a19e2a9c757ae",
         "type": "github"
       },
       "original": {
@@ -197,11 +194,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1719994518,
+        "lastModified": 1722555600,
-        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
         "type": "github"
       },
       "original": {
@@ -271,11 +268,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1719398431,
+        "lastModified": 1720223941,
-        "narHash": "sha256-p6cC+0/c6GCBPtBkSnaOrhwLWl+uyoWYl/dReg+jcsk=",
+        "narHash": "sha256-QDbU8LZzcUSqBp1CBqDj/f5Wd/sdgQ8pZwRWueoMUL4=",
         "owner": "hercules-ci",
         "repo": "hercules-ci-agent",
-        "rev": "c37b2ada2dd001bc4be6771bcdea680b0b93fb94",
+        "rev": "2e10fb21fc2e07edf40763b73443e5934bd40947",
         "type": "github"
       },
       "original": {
@@ -336,11 +333,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1721065874,
+        "lastModified": 1721084841,
-        "narHash": "sha256-WqIRfqqQwcSrJNPVRxbvCG6uZvKNuPruBL85VcnESRA=",
+        "narHash": "sha256-zWajCfHFqPa3Z72DHcxBUq4bmcCu1lpEKUbZZewpYOE=",
         "owner": "hyprspace",
         "repo": "hyprspace",
-        "rev": "76a3f73a42c2f9bbeb4c56afa4b30a98a283b79f",
+        "rev": "b54fd70812b98994630cfa6aac17ad7c2be9b468",
         "type": "github"
       },
       "original": {
@@ -396,19 +393,17 @@
     },
     "nar-serve": {
       "inputs": {
-        "flake-utils": [
-          "repin-flake-utils"
-        ],
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1716758395,
+        "lastModified": 1722409392,
-        "narHash": "sha256-yM/ICgmMxUAk/feKojy/Jul8jh4OaVBhQoIChA6Vvq8=",
+        "narHash": "sha256-8QuMS00EutmqzAIPxyJEPxM8EHiWlSKs6E2Htoh3Kes=",
         "owner": "numtide",
         "repo": "nar-serve",
-        "rev": "a1458804bb1ab9f1a44101e56a010ca95b8e8309",
+        "rev": "9d0eff868d328fe67c60c26c8ba50e0b9d8de867",
         "type": "github"
       },
       "original": {
@@ -461,11 +456,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719254875,
+        "lastModified": 1719848872,
-        "narHash": "sha256-ECni+IkwXjusHsm9Sexdtq8weAq/yUyt1TWIemXt3Ko=",
+        "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2893f56de08021cffd9b6b6dfc70fd9ccd51eb60",
+        "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
         "type": "github"
       },
       "original": {
@@ -509,11 +504,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1720107418,
+        "lastModified": 1722539632,
-        "narHash": "sha256-KPxjth7cCwNeTV9jJ90lPu8b/wMi3hcAnUbZ5NzogjA=",
+        "narHash": "sha256-g4L+I8rDl7RQy5x8XcEMqNO49LFhrHTzVBqXtG2+FGo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d586b644539e41fafcee09f9b40a6552252dbdb4",
+        "rev": "f2d6c7123138044e0c68902268bd8f37dd7e2fa7",
         "type": "github"
       },
       "original": {
@@ -592,7 +587,7 @@
         "nix-super": "nix-super",
         "nixpkgs": "nixpkgs_4",
         "repin-flake-utils": "repin-flake-utils",
-        "systems": "systems_2"
+        "systems": "systems_3"
       }
     },
     "systems": {
@@ -611,6 +606,21 @@
       }
     },
     "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
       "locked": {
         "lastModified": 1683988522,
         "narHash": "sha256-cAVqq+Mjx4EiWovT7rwbwncX5QBnhNsqwsgyg+eeYrg=",

flake.nix

@@ -62,7 +62,6 @@
       url = "github:numtide/nar-serve";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "repin-flake-utils";
       };
     };
 
@@ -70,7 +69,6 @@
       url = "github:numtide/devshell";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "repin-flake-utils";
       };
     };
     

hosts/VEGAS/default.nix

@@ -16,6 +16,11 @@ tools: rec {
     };
   };
 
+  hardware = {
+    cpu.cores = 8;
+    memory.gb = 64;
+  };
+
   hyprspace = {
     enable = true;
     id = "QmYs4xNBby2fTs8RnzfXEk161KD4mftBfCiR8yXtgGPj4J";

hosts/checkmate/default.nix

@@ -17,6 +17,11 @@ tools: rec {
     };
   };
 
+  hardware = {
+    cpu.cores = 1;
+    memory.gb = 1;
+  };
+
   hyprspace = {
     enable = true;
     id = "12D3KooWL84sAtq1QTYwb7gVbhSNX5ZUfVt4kgYKz8pdif1zpGUh";

hosts/grail/default.nix

@@ -16,6 +16,11 @@ tools: rec {
     };
   };
 
+  hardware = {
+    cpu.cores = 4;
+    memory.gb = 8;
+  };
+
   hyprspace = {
     enable = true;
     id = "12D3KooWN31twBvdEcxz2jTv4tBfPe3mkNueBwDJFCN4xn7ZwFbi";

hosts/options/default.nix

@@ -9,6 +9,7 @@ let
       ./hour/interfaces.nix
       ./hour/nixos.nix
       ./hour/ssh.nix
+      ./hour/hardware.nix
     ];
   };
 

hosts/options/hour/hardware.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+with lib;
+
+{
+  options.hardware = {
+    cpu = {
+      cores = mkOption {
+        type = types.ints.unsigned;
+      };
+    };
+    memory = {
+      gb = mkOption {
+        type = types.ints.unsigned;
+      };
+    };
+  };
+}
+

hosts/prophet/default.nix

@@ -17,6 +17,11 @@ tools: rec {
     };
   };
 
+  hardware = {
+    cpu.cores = 4;
+    memory.gb = 24;
+  };
+
   hyprspace = {
     enable = true;
     id = "QmbrAHuh4RYcyN9fWePCZMVmQjbaNXtyvrDCWz4VrchbXh";

hosts/thunderskin/default.nix

@@ -17,6 +17,11 @@ tools: rec {
     };
   };
 
+  hardware = {
+    cpu.cores = 1;
+    memory.gb = 1;
+  };
+
   hyprspace = {
     enable = true;
     id = "12D3KooWB9AUPorFoACkWbphyargRBV9osJsYuQDumtQ85j7Aqmg";

packages/shadows.nix

@@ -9,11 +9,7 @@
 
     options.shadows = lib.mkOption {
       type = with lib.types; lazyAttrsOf package;
-      default = {
+      default = { };
-        inherit (self'.packages)
-          kanidm
-        ;
-      };
     };
   };
 }

packages/tools/npins/default.nix

@@ -21,7 +21,7 @@ in rustPlatform.buildRustPackage rec {
   inherit (src) version;
   src = passthru.mkSource sources.npins;
 
-  cargoSha256 = "0rwnzkmx91cwcz9yw0rbbqv73ba6ggim9f4qgz5pgy6h696ld2k8";
+  cargoHash = "sha256-aIpGTTLQ+HfLf5i4VON7Rq1xNl4rA+7TZ5yF1Ov8lmc=";
 
   buildInputs = lib.optional stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security ]);
   nativeBuildInputs = [ makeWrapper ];

patches/base/s3ql/remove-ssl-monkeypatch.patch

@@ -0,0 +1,12 @@
+diff --git a/tests/t0_http.py b/tests/t0_http.py
+index 66ed564f..36bebab1 100755
+--- a/tests/t0_http.py
++++ b/tests/t0_http.py
+@@ -289,7 +289,6 @@ def do_GET(self):
+ 
+     # We don't *actually* want to establish SSL, that'd be
+     # to complex for our mock server
+-    monkeypatch.setattr('ssl.match_hostname', lambda x, y: True)
+     conn = HTTPConnection(
+         test_host,
+         test_port,