Skip to content

Commit a141d5f

Browse files
btlogybtlogy
authored
Merge pull request #33 from tahoe-lafs/31.initial-webforge-nix-with-ci
Define the initial NixOS configuration of webforge in a flake with CI support
2 parents ebc116c + d3173b8 commit a141d5f

File tree

8 files changed

+280
-0
lines changed

8 files changed

+280
-0
lines changed

‎.github/workflows/nix.yml

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Nix
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- '.github/workflows/nix.yml'
9+
- 'nix/**'
10+
- 'flake.*'
11+
pull_request:
12+
paths:
13+
- '.github/workflows/nix.yml'
14+
- 'nix/**'
15+
- 'flake.*'
16+
17+
jobs:
18+
check:
19+
name: Check
20+
runs-on: ubuntu-24.04
21+
outputs:
22+
matrix: ${{ steps.set-matrix.outputs.matrix }}
23+
steps:
24+
- name: Checkout
25+
id: checkout
26+
uses: actions/checkout@v4
27+
28+
- name: Install Nix
29+
id: install_nix
30+
uses: nixbuild/nix-quick-install-action@v30
31+
32+
- name: Check Nix Flake
33+
id: check
34+
run: |
35+
nix flake show
36+
nix flake check
37+
38+
- name: Set matrix
39+
id: set-matrix
40+
run: |
41+
# Create a "matrix" targeting the systems we want to check (and later deploy).
42+
# It will be consumed by the next job(s) to fire one build per system in parallel.
43+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/running-variations-of-jobs-in-a-workflow
44+
echo "matrix<<end_of_matrix" >> $GITHUB_OUTPUT
45+
cat >> $GITHUB_OUTPUT <<-EOF
46+
{"include":[
47+
{"target":"webforge","hostname":"webforge","domain":"tahoe-lafs.org"}
48+
]}
49+
EOF
50+
echo "end_of_matrix" >> $GITHUB_OUTPUT
51+
# TODO: Find a simpe way to get the target list from the flake
52+
53+
build:
54+
name: Build
55+
runs-on: ubuntu-24.04
56+
if: github.event_name == 'pull_request'
57+
needs: check
58+
strategy:
59+
fail-fast: false
60+
# Consuming the matrix created above
61+
matrix: ${{fromJson(needs.check.outputs.matrix)}}
62+
steps:
63+
- name: Checkout
64+
id: checkout
65+
uses: actions/checkout@v4
66+
67+
- name: Install Nix
68+
id: install_nix
69+
uses: nixbuild/nix-quick-install-action@v30
70+
71+
- name: Restore and cache Nix store ${{ matrix.target }}
72+
uses: nix-community/cache-nix-action@v6
73+
with:
74+
# restore and save a cache using this key
75+
primary-key: ${{ runner.os }}-Nix-${{ matrix.target }}-${{ hashFiles('flake.*', 'nix/common/*.nix', 'nix/modules/**.nix', format('nix/hosts/{0}/*.nix', matrix.target)) }}
76+
# if there's no cache hit, restore a cache by this prefix
77+
restore-prefixes-first-match: ${{ runner.os }}-Nix-${{ matrix.target }}-
78+
# collect garbage until Nix store size (in bytes) is at most this number
79+
# before trying to save a new cache
80+
gc-max-store-size-linux: 1073741824
81+
# do purge caches
82+
purge: true
83+
# purge all versions of the cache
84+
purge-prefixes: ${{ runner.os }}-Nix-${{ matrix.target }}-
85+
# created more than 0 seconds ago relative to the start of the `Post Restore` phase
86+
purge-created: 0
87+
# except the version with the `primary-key`, if it exists
88+
purge-primary-key: never
89+
90+
- name: Build nixosConfiguration for ${{ matrix.target }}
91+
id: check_target
92+
run: |
93+
nix build .#nixosConfigurations.${{ matrix.target }}.config.system.build.toplevel

‎flake.lock

+30
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flake.nix

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
inputs = {
3+
# The nixpkgs channels we want to consume
4+
nixpkgs-24_11.url = "github:NixOS/nixpkgs/nixos-24.11-small";
5+
6+
# Some links to the above channels for consistent naming in outputs
7+
nixpkgs.follows = "nixpkgs-24_11";
8+
};
9+
outputs = { self, nixpkgs, ... }@attrs: {
10+
# Generate an attrset of nixosConfigurations based on their system name
11+
nixosConfigurations = nixpkgs.lib.attrsets.genAttrs [
12+
"webforge"
13+
] (sysname: nixpkgs.lib.nixosSystem {
14+
system = "x86_64-linux";
15+
specialArgs = attrs;
16+
modules = [
17+
{ system.name = sysname; }
18+
./nix/hosts/${sysname}/configuration.nix
19+
];
20+
}
21+
);
22+
};
23+
}

‎nix/hosts/webforge/configuration.nix

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{ ... }: {
2+
imports = [
3+
./hardware-configuration.nix
4+
./networking.nix # generated at runtime by nixos-infect
5+
];
6+
7+
boot.tmp.cleanOnBoot = true;
8+
zramSwap.enable = true;
9+
networking.hostName = "webforge";
10+
networking.domain = "tahoe-lafs.org";
11+
services.openssh.enable = true;
12+
users.users.root.openssh.authorizedKeys.keys = [
13+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJlPneIaRT/mqu13N83ctEftub4O6zAfi6qgzZKerU5o florian@leastauthority.com"
14+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZtWY7t8HVnaz6bluYsrAlzZC3MZtb8g0nO5L5fCQKR benoit@leastauthority.com" ];
15+
system.stateVersion = "23.11";
16+
}

‎nix/hosts/webforge/hardware-configuration.nix

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{ modulesPath, ... }:
2+
{
3+
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
4+
boot.loader.grub.device = "/dev/sda";
5+
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
6+
boot.initrd.kernelModules = [ "nvme" ];
7+
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
8+
}

‎nix/hosts/webforge/networking.nix

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{ lib, ... }: {
2+
# This file was populated at runtime with the networking
3+
# details gathered from the active system.
4+
networking = {
5+
nameservers = [
6+
"2a01:4ff:ff00::add:2"
7+
"2a01:4ff:ff00::add:1"
8+
"185.12.64.1"
9+
"185.12.64.2"
10+
];
11+
defaultGateway = "172.31.1.1";
12+
defaultGateway6 = {
13+
address = "fe80::1";
14+
interface = "eth0";
15+
};
16+
dhcpcd.enable = false;
17+
usePredictableInterfaceNames = lib.mkForce false;
18+
interfaces = {
19+
eth0 = {
20+
ipv4.addresses = [
21+
{ address="135.181.155.146"; prefixLength=32; }
22+
];
23+
ipv6.addresses = [
24+
{ address="2a01:4f9:c011:b882::1"; prefixLength=64; }
25+
{ address="fe80::9400:4ff:fe03:57eb"; prefixLength=64; }
26+
];
27+
ipv4.routes = [ { address = "172.31.1.1"; prefixLength = 32; } ];
28+
ipv6.routes = [ { address = "fe80::1"; prefixLength = 128; } ];
29+
};
30+
};
31+
};
32+
services.udev.extraRules = ''
33+
ATTR{address}=="96:00:04:03:57:eb", NAME="eth0"
34+
'';
35+
}

‎secrets/.public_keys/adm_btlogy.asc

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
Comment: benoit@leastauthority.com
3+
4+
mDMEY7A6HxYJKwYBBAHaRw8BAQdAYzot0Vh4hn7DI79htP+xfeFzm6sQkbVHCM2T
5+
TMWQLoW0JEJlbm9pdCBEb25uZWF1eCA8YmVub2l0QGRvbm5lYXV4LmV1PoiRBBMW
6+
CgA5AhsBBAsJCAcEFQoJCAUWAgMBAAIeAQIXgBYhBEEesW0TtCJJD+uhFVp6CfDC
7+
efzWBQJjsutGAhkBAAoJEFp6CfDCefzWpvsBAPRU1V6VrObBZkKJdzOMGmPL1oNA
8+
Bz7xRJaGknA/9MfiAP9kick2Xe6736AHTGEkBF5QPbu3ZFdiINNY1Pjah/y6DIkB
9+
MwQQAQoAHRYhBISDYWVkaSHK7A3kGI6P8kyyawozBQJjsDviAAoJEI6P8kyyawoz
10+
uPgIAIFYup3yx+1W7DegwdkK3/DW3r8bknx3w27my5CUk/pmKeWhPtKp2R7RptaF
11+
b/9vBCcaSyAvSC+Zqa80YIPjupahtdGaHt1IwpVhGG5+U0gh5pG4Q+/V3tVMPclm
12+
HLSCaCpRK2XaSVWmAmhxn1x4e0i7Np8kbOVU1taNxd/8pImg6+HbO3NSt0LvsxwU
13+
8hGFukYu/LNesa5YzzmdYPKIcx8Vow4PgLOWnXypeF4+HHYIPXzOj7Z42k63QFZc
14+
8QwgftgY8ZNsx/1SwyWh6SNbXydXFgSRDUC/Csv1q04wEz4AM6nQIJpzo1YlNPpV
15+
M9tsZzbTwtGi7lWvbroOvnKYGFm0MEJlbm9pdCBEb25uZWF1eCAoYjNuL2J0bG9n
16+
eSkgPGJlbkB0ZXJnb2xvZ3kuY29tPoiOBBMWCgA2FiEEQR6xbRO0IkkP66EVWnoJ
17+
8MJ5/NYFAmOy6lYCGwEECwkIBwQVCgkIBRYCAwEAAh4BAheAAAoJEFp6CfDCefzW
18+
z5kA/0xexO8In1Mh+jWWT2Ph5hYBkmk8bIlNxNXpO4LQ/tFhAP9G8OIXe3zxtVat
19+
hLY6l0yXRCmANOOzxPRmnqfgH+D2B7Q7QmVub2l0IERvbm5lYXV4IChiRW4vYmRv
20+
bm5lYXV4KSA8YmVub2l0QGxlYXN0YXV0aG9yaXR5LmNvbT6IjgQTFgoANhYhBEEe
21+
sW0TtCJJD+uhFVp6CfDCefzWBQJjsurOAhsBBAsJCAcEFQoJCAUWAgMBAAIeAQIX
22+
gAAKCRBaegnwwnn81s5WAP9/uRO0t/yUMamYw1eu80+WnYuK8JRECkAOFpEmkvZS
23+
uAEAuEjz8Yo0TykIS4J3w4Z3UopF/ZA+NaeohUi9EzNI+gK0M0Jlbm9pdCBEb25u
24+
ZWF1eCAoYjNuL2Jkb25uZWF1eCkgPGJlbm9pdEBkYXBwcmUuY29tPoiOBBMWCgA2
25+
FiEEQR6xbRO0IkkP66EVWnoJ8MJ5/NYFAmOy6vkCGwEECwkIBwQVCgkIBRYCAwEA
26+
Ah4BAheAAAoJEFp6CfDCefzW370BAPpO3aGS0l+vQ03XuTht1eyeQs7SxLBWT+JR
27+
VWkY5yaPAP9CPZrY6V9QB/337Jk2whXmhTyc3cXtnN6ASXV10SpDDbQgQmVub2l0
28+
IERvbm5lYXV4IDxiZW5AdGVybG9nLm5ldD6IjgQTFgoANhYhBEEesW0TtCJJD+uh
29+
FVp6CfDCefzWBQJmgVSBAhsBBAsJCAcEFQoJCAUWAgMBAAIeAQIXgAAKCRBaegnw
30+
wnn81kOtAQCQ3iD0LMEzrLSFRsti34UhKPmfLoT2SdSCWEn2LFwB7AD9En0pdMNO
31+
uSxp879i/Kpi162msYgNot3QopsEH+hCiQu4MwRjstwVFgkrBgEEAdpHDwEBB0CM
32+
ZnyWJJVeD6NF/+pqgj18MbSKY/miwY2T37PMpHFUjoj1BBgWCgAmAhsCFiEEQR6x
33+
bRO0IkkP66EVWnoJ8MJ5/NYFAmfQM/0FCQX+i2gAgXYgBBkWCgAdFiEEmxtQLqkR
34+
A7s7vsJFNpllLMQ0JkYFAmOy3BUACgkQNpllLMQ0JkYNWQD6A7Nmi4aEATFNkD15
35+
8iJ10wyAlB4gHQ1SSo0Es4ui6UwA/iYLUPLTov9QTDCtbaAMo1T58dQYxeVOTGPJ
36+
PSKaO/IECRBaegnwwnn81vJ/AP4hL5pCzsJVeeYC62Gcyu0aRlfDsJT8KpPt3Y4/
37+
Vibg7QEA16TOMncyuvgjGOuIjZeiZENGtHHQsyGh9I3jCd5czAu4OARjstzeEgor
38+
BgEEAZdVAQUBAQdAnOyinFQ5g+2Fh5/nlXQ5RFM1Y38Y7awRikqfFpHDVjQDAQgH
39+
iH4EGBYKACYCGwwWIQRBHrFtE7QiSQ/roRVaegnwwnn81gUCZ9Az/QUJBf6KnwAK
40+
CRBaegnwwnn81hK6AQCvsLYKn/83IqFluqZTdTobKIuR5HkrWHJmHFI4uz52fgEA
41+
9XlX6sv8aRLqRsbZS5TSpebMw7+jFOq7t49sy+RdDAq4MwRjst7sFgkrBgEEAdpH
42+
DwEBB0CGbVmO7fB1Z2s+m5bmLKwJc2QtzGbW/INJzuS+XwkCkYh+BBgWCgAmAhsg
43+
FiEEQR6xbRO0IkkP66EVWnoJ8MJ5/NYFAmfQM/0FCQX+iJEACgkQWnoJ8MJ5/Nbz
44+
MgD9Fn9qeWcR+qv7ICRpGb+fEMl5cmAp45Gpcgpq/CQIMrAA/ReW0qZOmdfWCRKw
45+
8te5p7SeMzBNTRwURckwsxZcLsAI
46+
=GNi/
47+
-----END PGP PUBLIC KEY BLOCK-----

‎secrets/.public_keys/adm_hacklschorsch.asc

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
Comment: florian@leastauthority.com
3+
4+
mDMEZbvonxYJKwYBBAHaRw8BAQdAYq4atW7YnzVqKzml6zH6sejCZFnkRfk6Ggf9
5+
ShG9z7K0K0Zsb3JpYW4gU2Vzc2VyIDxmbG9yaWFuQGxlYXN0YXV0aG9yaXR5LmNv
6+
bT6IkQQTFgoAOQIbAQQLCQgHBBUKCQgFFgIDAQACHgUCF4AWIQRSRJcPvsiqZmWO
7+
xLbX1KRBQxpz8QUCZbvrkAIZAQAKCRDX1KRBQxpz8ctGAP4r+mAERl1G8JuWHJkF
8+
iDyuRO46fY6xinPg9rhtFQZ7XAD8CHLXXW9vVxvjnhwKPTUQqOp8EEUX3cfgxbzP
9+
HPuKswC0KEZsb3JpYW4gU2Vzc2VyIDxmbG9yaWFuQHByaXZhdGUuc3RvcmFnZT6I
10+
jgQTFgoANhYhBFJElw++yKpmZY7EttfUpEFDGnPxBQJlu+sDAhsBBAsJCAcEFQoJ
11+
CAUWAgMBAAIeBQIXgAAKCRDX1KRBQxpz8WfAAQD6xMklFil++JRSk0opypWpa4tK
12+
NUoGm9RojWdLijpc/wEA5DSlP/peWY/xVe5rzLOtCM+tr7ItNFS6b5nEVRKPTAW4
13+
MwRlu+lJFgkrBgEEAdpHDwEBB0CY+PZUMqXN5ryhwPRQxn7cg6cpmjG2G9UtlyBR
14+
eB5iNYj1BBgWCgAmAhsCFiEEUkSXD77IqmZljsS219SkQUMac/EFAme/b5IFCQen
15+
IMkAgXYgBBkWCgAdFiEEQ945aRlVC4PWaiIKesxZRaeTP48FAmW76UkACgkQesxZ
16+
RaeTP48+VQEA51FL/VXAMpuVaq/qnTbKf1QWax27SvBYfySAsNtJfQkBAJ2VStpT
17+
O3qd3jOMoOw9nYBquw6ofJkXZ/b0M6LTu5ADCRDX1KRBQxpz8ejvAP42iJghPR6K
18+
NivoK5gr9bgrf1nbEzpD0EsvrtgV8wvAsgEAvMHUaqLg5LluQVJapc+zuvbfHHLk
19+
Qe8cFpH9dgI5WQW4OARlu+m5EgorBgEEAZdVAQUBAQdAdRuu++bnGOe9AYLt2+dl
20+
3wfdQqVSNZf1NJ2moI5/cnADAQgHiH4EGBYKACYCGwwWIQRSRJcPvsiqZmWOxLbX
21+
1KRBQxpz8QUCZ79vkgUJB6cgWQAKCRDX1KRBQxpz8b+3AQCTBN34TZ3AdnqEtWu8
22+
omL7YOmE8hg1Y9XNgU1CJDsBkgEAywCKENG1rQFbcaz2UDIXPf6nUGgtxmFNddgA
23+
AJoAtQi4MwRlu+pvFgkrBgEEAdpHDwEBB0CZT53iGkU/5qrtdzfN3LRH7bm+Dusw
24+
H4uqoM2Snq1OaIh+BBgWCgAmAhsgFiEEUkSXD77IqmZljsS219SkQUMac/EFAme/
25+
b5IFCQenH6MACgkQ19SkQUMac/HDEQD/cxjwkrMYt3mkBccrBlm3uIShMYd9SLzR
26+
IL5Bv2iBx5sA/0XK+dEn1fRmEdTjXqJQ/b7+nTx0Oik2y81mAm6XRy0G
27+
=O96Q
28+
-----END PGP PUBLIC KEY BLOCK-----

0 commit comments

Comments
 (0)