diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e1d50f3dc..8d9d5a4b7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached nixos-x86_64: runs-on: ubuntu-latest strategy: @@ -55,7 +55,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel' nixos-aarch64: runs-on: ubuntu-24.04-arm strategy: @@ -74,7 +74,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel' # ofborg machines share most of their closure, so build all of one arch in a # single job to reuse the store between them. nixos-ofborg-x86_64: @@ -89,7 +89,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-x86_64-linux' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#ciSystems.ofborg-x86_64-linux' nixos-ofborg-aarch64: name: NixOS ofborg (aarch64) runs-on: ubuntu-24.04-arm @@ -102,7 +102,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-aarch64-linux' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#ciSystems.ofborg-aarch64-linux' nix-darwin-ofborg: name: nix-darwin ofborg (aarch64) runs-on: macos-latest @@ -115,7 +115,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-aarch64-darwin' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#ciSystems.ofborg-aarch64-darwin' nix-darwin-ofborg-x86_64: name: nix-darwin ofborg (x86_64) runs-on: macos-26-intel @@ -128,7 +128,7 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-x86_64-darwin' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#ciSystems.ofborg-x86_64-darwin' nix-darwin: runs-on: macos-latest strategy: @@ -146,4 +146,4 @@ jobs: with: name: nixos-infra-dev authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#darwinConfigurations."${{ matrix.machine }}".config.system.build.toplevel' + - run: nix run --inputs-from . nix-fast-build#nix-fast-build -- --skip-cached --flake '.#darwinConfigurations."${{ matrix.machine }}".config.system.build.toplevel' diff --git a/builders/common/hydra-queue-builder.nix b/builders/common/hydra-queue-builder.nix index 49b8feba0..3caa219da 100644 --- a/builders/common/hydra-queue-builder.nix +++ b/builders/common/hydra-queue-builder.nix @@ -18,13 +18,15 @@ enable = true; queueRunnerAddr = "https://queue-runner.hydra.nixos.org"; authorizationFile = config.age.secrets."queue-runner-token".path; - maxJobs = config.nix.settings.max-jobs; - # Required for presigned uploads: builders fetch dependencies via - # substitution and upload results to s3 directly. - useSubstitutes = true; - # Align this with what our GC settings - storeAvailThreshold = 5.0; - # Tolerate only minimal contention before we stop scheduling new jobs - cpuPsiThreshold = 15.0; + settings = { + maxJobs = config.nix.settings.max-jobs; + # Required for presigned uploads: builders fetch dependencies via + # substitution and upload results to s3 directly. + useSubstitutes = true; + # Align this with what our GC settings + storeAvailThreshold = 5.0; + # Tolerate only minimal contention before we stop scheduling new jobs + cpuPsiThreshold = 15.0; + }; }; } diff --git a/builders/instances/elated-minsky.nix b/builders/instances/elated-minsky.nix index dec601940..4e43daf68 100644 --- a/builders/instances/elated-minsky.nix +++ b/builders/instances/elated-minsky.nix @@ -14,9 +14,9 @@ max-jobs = 48; }; - services.hydra-queue-builder-dev.supportedFeatures = lib.filter (feat: feat != "big-parallel") ( - with config.nix.settings; system-features ++ extra-system-features - ); + services.hydra-queue-builder-dev.settings.supportedFeatures = lib.filter ( + feat: feat != "big-parallel" + ) (with config.nix.settings; system-features ++ extra-system-features); networking = { hostName = "elated-minsky"; diff --git a/builders/instances/goofy-hopcroft.nix b/builders/instances/goofy-hopcroft.nix index a0d4c742d..2e48acac8 100644 --- a/builders/instances/goofy-hopcroft.nix +++ b/builders/instances/goofy-hopcroft.nix @@ -14,9 +14,9 @@ max-jobs = 40; }; - services.hydra-queue-builder-dev.supportedFeatures = lib.filter (feat: feat != "big-parallel") ( - with config.nix.settings; system-features ++ extra-system-features - ); + services.hydra-queue-builder-dev.settings.supportedFeatures = lib.filter ( + feat: feat != "big-parallel" + ) (with config.nix.settings; system-features ++ extra-system-features); networking = { hostName = "goofy-hopcroft"; diff --git a/builders/instances/hopeful-rivest.nix b/builders/instances/hopeful-rivest.nix index b11e7675d..ecc92bbec 100644 --- a/builders/instances/hopeful-rivest.nix +++ b/builders/instances/hopeful-rivest.nix @@ -9,7 +9,7 @@ max-jobs = 3; }; - services.hydra-queue-builder-dev.mandatoryFeatures = [ "big-parallel" ]; + services.hydra-queue-builder-dev.settings.mandatoryFeatures = [ "big-parallel" ]; networking = { hostName = "hopeful-rivest"; diff --git a/builders/instances/sleepy-brown.nix b/builders/instances/sleepy-brown.nix index d229f39c5..dfb3c30f0 100644 --- a/builders/instances/sleepy-brown.nix +++ b/builders/instances/sleepy-brown.nix @@ -8,7 +8,7 @@ max-jobs = 4; }; - services.hydra-queue-builder-dev.supportedFeatures = [ "big-parallel" ]; + services.hydra-queue-builder-dev.settings.supportedFeatures = [ "big-parallel" ]; networking = { hostName = "sleepy-brown"; diff --git a/flake.lock b/flake.lock index bde29fbec..70fe2fe6d 100644 --- a/flake.lock +++ b/flake.lock @@ -26,7 +26,7 @@ "ai-robots-txt": { "flake": false, "locked": { - "narHash": "sha256-PS0oFF+uHTKuRIKJTk4+u0BfgZJSag2BbRpjv8fxRFE=", + "narHash": "sha256-6DufkhGhd0OeJ/8q/b2LZ+KvMuGXq8x75zXmc2p0eMw=", "type": "file", "url": "https://github.com/ai-robots-txt/ai.robots.txt/raw/refs/heads/main/robots.json" }, @@ -100,11 +100,11 @@ ] }, "locked": { - "lastModified": 1784448989, - "narHash": "sha256-XC0OkWCiTM91msCp0o7zfM+iBv06mLlCzFxkP8vf+ac=", + "lastModified": 1785582945, + "narHash": "sha256-PI+qji1xkJm3PV7l7/PKJDumFz0fbA4etXE614jRnls=", "owner": "zhaofengli", "repo": "colmena", - "rev": "e5eda626e459f7043868fd2e3b3bf8ce0d1992e6", + "rev": "84d419ad080477ed2f31fbf3866551393df647a7", "type": "github" }, "original": { @@ -138,7 +138,7 @@ "darwin_2": { "inputs": { "nixpkgs": [ - "nixpkgs" + "nixpkgs-darwin" ] }, "locked": { @@ -189,11 +189,11 @@ ] }, "locked": { - "lastModified": 1785045660, - "narHash": "sha256-InCL0/sHlhtAn8dNarNPMJQjDe5LNdsDzrLblEC413c=", + "lastModified": 1785415743, + "narHash": "sha256-gRV5McxnehAfu64D2qQ5iMoM39JkjDRlhMB+2xjTZjs=", "owner": "Mic92", "repo": "fast-nix-gc", - "rev": "7d0e25f017f47708eaa4efc5d0898915485d4467", + "rev": "aac5e3118db566939338569d3e13c75a9fd5eb84", "type": "github" }, "original": { @@ -269,15 +269,15 @@ "flake-parts": { "inputs": { "nixpkgs-lib": [ - "nixpkgs" + "nixpkgs-darwin" ] }, "locked": { - "lastModified": 1782949081, - "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", + "lastModified": 1785627969, + "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", + "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a", "type": "github" }, "original": { @@ -321,33 +321,10 @@ "type": "github" } }, - "freescout": { - "inputs": { - "flake-utils": [ - "flake-utils" - ], - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1761846753, - "narHash": "sha256-ijmJj6bplEz27JSt5eV842QBwNhRzQT8pTKNDz4lR2Y=", - "ref": "refs/heads/main", - "rev": "1b9ac64565b6dd65aa677a004abb8fabd68981e2", - "revCount": 52, - "type": "git", - "url": "https://cyberchaos.dev/e1mo/freescout-nix-flake.git" - }, - "original": { - "type": "git", - "url": "https://cyberchaos.dev/e1mo/freescout-nix-flake.git" - } - }, "geolite2-asn-mmdb": { "flake": false, "locked": { - "narHash": "sha256-u0uqrnOTEh0kzydB9mEweX9+Rn5ejXkwad18tLuXDSc=", + "narHash": "sha256-rvz743lYlBmfOl4HhaagcQClBuKQpwdvuO8iN5Af4gY=", "type": "file", "url": "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb" }, @@ -460,11 +437,11 @@ ] }, "locked": { - "lastModified": 1784311474, - "narHash": "sha256-c+n6e+j2leZmsfIF+Te717KCnZf4Cl3egnYAHI9hw+s=", + "lastModified": 1785347265, + "narHash": "sha256-oZNsf7bzVUQSm5o9Py5GS3/vLtDnPBjx1Gpj2BLt0CU=", "owner": "NixOS", "repo": "hydra", - "rev": "14a2128fb44c2920e317ec0a228e55f0ce4d973a", + "rev": "bb95f71b9a73eff25de8f9b294a47d751972afd0", "type": "github" }, "original": { @@ -574,6 +551,32 @@ "type": "github" } }, + "nix-fast-build": { + "inputs": { + "flake-parts": [ + "flake-parts" + ], + "nixpkgs": [ + "nixpkgs" + ], + "treefmt-nix": [ + "treefmt-nix" + ] + }, + "locked": { + "lastModified": 1785674245, + "narHash": "sha256-GgrP1+KBWztL04EaXVBYW5Ar1FsN0Qpnd5Rp0rjJn+E=", + "owner": "Mic92", + "repo": "nix-fast-build", + "rev": "813ce1a65e0375a337337c97eecd55c7f792e2a5", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "nix-fast-build", + "type": "github" + } + }, "nix-github-actions": { "inputs": { "nixpkgs": [ @@ -643,11 +646,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1785104993, - "narHash": "sha256-eKbrvPoAOFutbYMdbB3r5EQVmFxKv24iKqHPPUXA0gM=", + "lastModified": 1785707870, + "narHash": "sha256-6lxLyxzyk97I1NQ1l3duGL6BH4pUt2kCYJJ3UXezKl4=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "8623c4c20aa4ca2f5fb81510d2944066c3fb0d96", + "rev": "c9822b4fe2001d855d95813e5a69a08dc20291cb", "type": "github" }, "original": { @@ -673,6 +676,22 @@ "type": "github" } }, + "nixpkgs-darwin": { + "locked": { + "lastModified": 1785067121, + "narHash": "sha256-rdJdWxAcg5fnntU4DjPivPdVEN4F+VJavw+UWpEMeUI=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "329c3d2af6d1b618705150ea39f72c15eb4e613e", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-26.05-darwin", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs-swh": { "inputs": { "nixpkgs": [ @@ -695,11 +714,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1785110946, - "narHash": "sha256-WWuWxmXKzGZWryswWlijP3Mjp6aGy4Ngmeil5nGMMjk=", + "lastModified": 1785602060, + "narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d3498f786f97ac0bded21b34bae0bf3809b45aa3", + "rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e", "type": "github" }, "original": { @@ -716,11 +735,11 @@ ] }, "locked": { - "lastModified": 1780036770, - "narHash": "sha256-5ozCWlik03HQaLmCpkFKMaEJRWVyYh+wpn1n+QCwCXQ=", + "lastModified": 1785330598, + "narHash": "sha256-PtvvYklVoXkiFRKpCbcfoC+MduRhffkFqxZ3DXFhXwc=", "owner": "NixOS", "repo": "ofborg", - "rev": "76dd2e363527f124de98307eb36e53945dccd32e", + "rev": "80074b9649c2249c116a88650620f27a7f4030d7", "type": "github" }, "original": { @@ -798,12 +817,13 @@ "fast-nix-gc": "fast-nix-gc", "flake-parts": "flake-parts", "flake-utils": "flake-utils", - "freescout": "freescout", "geolite2-asn-mmdb": "geolite2-asn-mmdb", "hydra": "hydra", + "nix-fast-build": "nix-fast-build", "nix-index": "nix-index", "nixocaine": "nixocaine", "nixpkgs": "nixpkgs", + "nixpkgs-darwin": "nixpkgs-darwin", "nixpkgs-swh": "nixpkgs-swh", "nixpkgs-unstable": "nixpkgs-unstable", "ofborg": "ofborg", @@ -825,11 +845,11 @@ ] }, "locked": { - "lastModified": 1784546415, - "narHash": "sha256-uGguGzFhFbzdC46Uwiu+8V7a/VPMdt8VU04HHcVOTcQ=", + "lastModified": 1785198005, + "narHash": "sha256-falBPi+PJtMx0vwII8L24wjDGXNZMwRiVXsw8WTXLEo=", "owner": "simple-nixos-mailserver", "repo": "nixos-mailserver", - "rev": "9e3c3510ced1cb278e3522a6a0f6fe302cc805eb", + "rev": "d357b9f048c5532ec81b0e0034c0b8463d5ddd46", "type": "gitlab" }, "original": { @@ -866,11 +886,11 @@ ] }, "locked": { - "lastModified": 1785115751, - "narHash": "sha256-wy/oBThUnKzKY4RGsjGXQDBnqP1Qlb8QpRksbpPA110=", + "lastModified": 1785724110, + "narHash": "sha256-wVE1lrrGlpHpgtiIa4zYBObVgPBOx5wMnD5QYMzoYE8=", "owner": "numtide", "repo": "srvos", - "rev": "1ae1c0c562ef21aabdc88624bafb387fb4da7847", + "rev": "f8a1f138ff7ccdb736f56272093953e12bb87ad5", "type": "github" }, "original": { @@ -979,11 +999,11 @@ ] }, "locked": { - "lastModified": 1784369104, - "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=", + "lastModified": 1785360170, + "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "df3c0640565d04a0261253cdd89fce78ec50168a", + "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 9bc83704b..a44e79649 100644 --- a/flake.nix +++ b/flake.nix @@ -31,6 +31,11 @@ inputs.treefmt-nix.follows = "treefmt-nix"; }; + nix-fast-build.url = "github:Mic92/nix-fast-build"; + nix-fast-build.inputs.nixpkgs.follows = "nixpkgs"; + nix-fast-build.inputs.flake-parts.follows = "flake-parts"; + nix-fast-build.inputs.treefmt-nix.follows = "treefmt-nix"; + nix-index = { url = "github:nix-community/nix-index"; inputs.nixpkgs.follows = "nixpkgs"; @@ -45,28 +50,21 @@ }; nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small"; + nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin"; nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; flake-parts = { url = "github:hercules-ci/flake-parts"; - inputs.nixpkgs-lib.follows = "nixpkgs"; + inputs.nixpkgs-lib.follows = "nixpkgs-darwin"; }; darwin = { url = "github:nix-darwin/nix-darwin/nix-darwin-26.05"; - inputs.nixpkgs.follows = "nixpkgs"; + inputs.nixpkgs.follows = "nixpkgs-darwin"; }; flake-utils.url = "github:numtide/flake-utils"; - freescout = { - url = "git+https://cyberchaos.dev/e1mo/freescout-nix-flake.git"; - inputs = { - flake-utils.follows = "flake-utils"; - nixpkgs.follows = "nixpkgs"; - }; - }; - treefmt-nix = { url = "github:numtide/treefmt-nix"; inputs.nixpkgs.follows = "nixpkgs-unstable"; diff --git a/macs/common/hydra-queue-builder.nix b/macs/common/hydra-queue-builder.nix index 57ad4c29e..29f7d4215 100644 --- a/macs/common/hydra-queue-builder.nix +++ b/macs/common/hydra-queue-builder.nix @@ -22,12 +22,14 @@ enable = true; queueRunnerAddr = "https://queue-runner.hydra.nixos.org"; authorizationFile = config.age.secrets."queue-runner-token".path; - maxJobs = if lib.elem "big-parallel" (config.nix.settings.system-features or [ ]) then 2 else 4; - # Required for presigned uploads: builders fetch dependencies via - # substitution and upload results to s3 directly. - useSubstitutes = true; - # Align this with what our GC settings - storeAvailThreshold = 5.0; + settings = { + maxJobs = if lib.elem "big-parallel" (config.nix.settings.system-features or [ ]) then 2 else 4; + # Required for presigned uploads: builders fetch dependencies via + # substitution and upload results to s3 directly. + useSubstitutes = true; + # Align this with what our GC settings + storeAvailThreshold = 5.0; + }; }; nix.settings.trusted-users = [ "hydra-queue-builder" ]; diff --git a/macs/common/ofborg-queue-builder.nix b/macs/common/ofborg-queue-builder.nix index 71f742365..44e26fbc6 100644 --- a/macs/common/ofborg-queue-builder.nix +++ b/macs/common/ofborg-queue-builder.nix @@ -14,7 +14,7 @@ services.hydra-queue-builder-dev = { enable = true; queueRunnerAddr = "https://queue-runner.staging-hydra.nixos.org"; - maxJobs = 2; + settings.maxJobs = 2; mtls = { serverRootCaCertPath = builtins.path { path = ../../non-critical-infra/hosts/staging-hydra/ca.crt; diff --git a/non-critical-infra/modules/hydra/builder.nix b/non-critical-infra/modules/hydra/builder.nix index b8bd5e6bf..4aeaf85ca 100644 --- a/non-critical-infra/modules/hydra/builder.nix +++ b/non-critical-infra/modules/hydra/builder.nix @@ -21,7 +21,7 @@ in services.hydra-queue-builder-dev = { enable = true; queueRunnerAddr = "https://queue-runner.staging-hydra.nixos.org"; - maxJobs = 2; + settings.maxJobs = 2; mtls = { serverRootCaCertPath = "${../../hosts/staging-hydra/ca.crt}"; clientCertPath = "${../../hosts/${nodePath}/client.crt}"; diff --git a/non-critical-infra/modules/mailserver/freescout.nix b/non-critical-infra/modules/mailserver/freescout.nix index d47f98a30..1b3eda986 100644 --- a/non-critical-infra/modules/mailserver/freescout.nix +++ b/non-critical-infra/modules/mailserver/freescout.nix @@ -1,13 +1,13 @@ { - inputs, config, + inputs, pkgs, ... }: { imports = [ - inputs.freescout.nixosModules.freescout + "${inputs.nixpkgs-unstable}/nixos/modules/services/web-apps/freescout.nix" ../nginx.nix ]; @@ -22,11 +22,11 @@ enable = true; kind = "pgsql"; }; + }; - nginx = { - forceSSL = true; - enableACME = true; - }; + services.nginx.virtualHosts.${config.services.freescout.domain} = { + forceSSL = true; + enableACME = true; }; services.postgresqlBackup = {