ci.nix

{
  pkgs ? import ../pin.nix {jsonpath=../nixpkgs-18.03.json;}
}:
let
  keys = [ (pkgs.lib.readFile keys/id_rsa_vrg.pub) ];
  argopkgs = import ../pkgs {};
  hydraSrc = builtins.fetchTarball https://github.com/nixos/hydra/archive/master.tar.gz;
  argomodules = import ../modules/module-list.nix;
in
  {
    network.description = "argo-ci";
    network.enableRollback = false;

    main =
    { config, ... }:
    {
      require=argomodules;
      environment.argo.known-hosts.enable=true;
      environment.argo.provider-tacc.enable=true;
      environment.argo.root-access.enable=true;

      imports = [ "${hydraSrc}/hydra-module.nix" ];
      networking = {
        firewall = {
          allowedTCPPorts=[ config.services.hydra.port ];
        };
      };

      deployment.targetEnv = "none";
      deployment.targetHost = "129.114.111.116";

      i18n.defaultLocale = "en_US.UTF-8";
      services.ntp.enable = false;
      services.openssh.allowSFTP = false;

      assertions = pkgs.lib.singleton {
        assertion = pkgs.system == "x86_64-linux";
        message = "unsupported system ${pkgs.system}";
      };

      environment.etc = pkgs.lib.singleton {
        target = "nix/id_buildfarm";
        source = keys/id_buildfarm;
        uid = config.users.users.hydra-queue-runner.uid;
        gid = config.users.groups.hydra.gid;
        mode = "0600";
      };

      nix = {
        useChroot = true;
        nrBuildUsers = 30;
        distributedBuilds = true;
        buildMachines = [
          { hostName = "129.114.111.114";
            maxJobs = 10;
            speedFactor = 1;
            sshKey = "/etc/nix/id_buildfarm";
            sshUser = "root";
            systems = ["builtin" "x86_64-linux" "i686-linux"];
            supportedFeatures = [ "nixos-test" "benchmark" ];
          }
        ];
        extraOptions = "auto-optimise-store = true";
      };

      services.hydra = {
        enable = true;
        hydraURL = "http://129.114.111.116";
        notificationSender = "hydra@example.org";
        port = 8080;
        extraConfig = "binary_cache_secret_key_file = /etc/nix/hydra.example.org-1/secret";
        buildMachinesFiles = [ "/etc/nix/machines" ];
      };

      services.postgresql = {
        package = pkgs.postgresql94;
        dataDir = "/var/db/postgresql-${config.services.postgresql.package.psqlSchema}";
      };

      systemd.services.hydra-manual-setup = {
        description = "Create Admin User for Hydra";
        serviceConfig.Type = "oneshot";
        serviceConfig.RemainAfterExit = true;
        wantedBy = [ "multi-user.target" ];
        requires = [ "hydra-init.service" ];
        after = [ "hydra-init.service" ];
        environment = config.systemd.services.hydra-init.environment;
        script = ''
          if [ ! -e ~hydra/.setup-is-complete ]; then
            # create admin user
            /run/current-system/sw/bin/hydra-create-user alice --full-name 'Alice Q. User' --email-address 'alice@example.org' --password foobar --role admin
            # create signing keys
            /run/current-system/sw/bin/install -d -m 551 /etc/nix/hydra.example.org-1
            /run/current-system/sw/bin/nix-store --generate-binary-cache-key hydra.example.org-1 /etc/nix/hydra.example.org-1/secret /etc/nix/hydra.example.org-1/public
            /run/current-system/sw/bin/chown -R hydra:hydra /etc/nix/hydra.example.org-1
            /run/current-system/sw/bin/chmod 440 /etc/nix/hydra.example.org-1/secret
            /run/current-system/sw/bin/chmod 444 /etc/nix/hydra.example.org-1/public
            # done
            touch ~hydra/.setup-is-complete
          fi
        '';
      };
     };

    slave1 =
    { ... }:
    {
      deployment.targetEnv = "none";
      deployment.targetHost = "129.114.111.114";

      require=argomodules;
      environment.argo.known-hosts.enable=true;
      environment.argo.provider-tacc.enable=true;
      environment.argo.root-access.enable=true;

      i18n.defaultLocale = "en_US.UTF-8";
      nix.useChroot = true;
      nix.nrBuildUsers = 30;
      services.ntp.enable = false;
      services.openssh.allowSFTP = false;

      nix.gc = {
        automatic = true;
        dates = "05:15";
        options = ''--max-freed "$((32 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
      };

      services.openssh.enable = true;
      users.extraUsers.root.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)];
     };
   }