Merge master into staging-next
This commit is contained in:
github-actions[bot]
@@ -37,15 +37,22 @@ let
|
||||
description = ''
|
||||
Number of tasks to perform simultaneously.
|
||||
|
||||
A task is a single derivation build or an evaluation.
|
||||
A task is a single derivation build, an evaluation or an effect run.
|
||||
At minimum, you need 2 concurrent tasks for <literal>x86_64-linux</literal>
|
||||
in your cluster, to allow for import from derivation.
|
||||
|
||||
<literal>concurrentTasks</literal> can be around the CPU core count or lower if memory is
|
||||
the bottleneck.
|
||||
|
||||
The optimal value depends on the resource consumption characteristics of your workload,
|
||||
including memory usage and in-task parallelism. This is typically determined empirically.
|
||||
|
||||
When scaling, it is generally better to have a double-size machine than two machines,
|
||||
because each split of resources causes inefficiencies; particularly with regards
|
||||
to build latency because of extra downloads.
|
||||
'';
|
||||
type = types.int;
|
||||
default = 4;
|
||||
type = types.either types.ints.positive (types.enum [ "auto" ]);
|
||||
default = "auto";
|
||||
};
|
||||
workDirectory = mkOption {
|
||||
description = ''
|
||||
@@ -186,7 +193,18 @@ in
|
||||
# even shortly after the previous lookup. This *also* applies to the daemon.
|
||||
narinfo-cache-negative-ttl = 0
|
||||
'';
|
||||
services.hercules-ci-agent.tomlFile =
|
||||
format.generate "hercules-ci-agent.toml" cfg.settings;
|
||||
services.hercules-ci-agent = {
|
||||
tomlFile =
|
||||
format.generate "hercules-ci-agent.toml" cfg.settings;
|
||||
|
||||
settings.labels = {
|
||||
agent.source =
|
||||
if options.services.hercules-ci-agent.package.highestPrio == (lib.modules.mkOptionDefault { }).priority
|
||||
then "nixpkgs"
|
||||
else lib.mkOptionDefault "override";
|
||||
pkgs.version = pkgs.lib.version;
|
||||
lib.version = lib.version;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -68,7 +68,23 @@ in
|
||||
# Trusted user allows simplified configuration and better performance
|
||||
# when operating in a cluster.
|
||||
nix.trustedUsers = [ config.systemd.services.hercules-ci-agent.serviceConfig.User ];
|
||||
services.hercules-ci-agent.settings.nixUserIsTrusted = true;
|
||||
services.hercules-ci-agent = {
|
||||
settings = {
|
||||
nixUserIsTrusted = true;
|
||||
labels =
|
||||
let
|
||||
mkIfNotNull = x: mkIf (x != null) x;
|
||||
in
|
||||
{
|
||||
nixos.configurationRevision = mkIfNotNull config.system.configurationRevision;
|
||||
nixos.release = config.system.nixos.release;
|
||||
nixos.label = mkIfNotNull config.system.nixos.label;
|
||||
nixos.codeName = config.system.nixos.codeName;
|
||||
nixos.tags = config.system.nixos.tags;
|
||||
nixos.systemName = mkIfNotNull config.system.name;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.hercules-ci-agent = {
|
||||
home = cfg.settings.baseDirectory;
|
||||
|
||||
@@ -4,24 +4,17 @@ with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.couchdb;
|
||||
useVersion2 = strings.versionAtLeast (strings.getVersion cfg.package) "2.0";
|
||||
configFile = pkgs.writeText "couchdb.ini" (
|
||||
''
|
||||
[couchdb]
|
||||
database_dir = ${cfg.databaseDir}
|
||||
uri_file = ${cfg.uriFile}
|
||||
view_index_dir = ${cfg.viewIndexDir}
|
||||
'' + (if cfg.adminPass != null then
|
||||
''
|
||||
'' + (optionalString (cfg.adminPass != null) ''
|
||||
[admins]
|
||||
${cfg.adminUser} = ${cfg.adminPass}
|
||||
'' else
|
||||
"") + (if useVersion2 then
|
||||
''
|
||||
'' + ''
|
||||
[chttpd]
|
||||
'' else
|
||||
''
|
||||
[httpd]
|
||||
'') +
|
||||
''
|
||||
port = ${toString cfg.port}
|
||||
@@ -30,8 +23,7 @@ let
|
||||
[log]
|
||||
file = ${cfg.logFile}
|
||||
'');
|
||||
executable = if useVersion2 then "${cfg.package}/bin/couchdb"
|
||||
else ''${cfg.package}/bin/couchdb -a ${configFile} -a ${pkgs.writeText "couchdb-extra.ini" cfg.extraConfig} -a ${cfg.configFile}'';
|
||||
executable = "${cfg.package}/bin/couchdb";
|
||||
|
||||
in {
|
||||
|
||||
@@ -177,8 +169,7 @@ in {
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
services.couchdb.configFile = mkDefault
|
||||
(if useVersion2 then "/var/lib/couchdb/local.ini" else "/var/lib/couchdb/couchdb.ini");
|
||||
services.couchdb.configFile = mkDefault "/var/lib/couchdb/local.ini";
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${dirOf cfg.uriFile}' - ${cfg.user} ${cfg.group} - -"
|
||||
@@ -195,7 +186,7 @@ in {
|
||||
touch ${cfg.configFile}
|
||||
'';
|
||||
|
||||
environment = mkIf useVersion2 {
|
||||
environment = {
|
||||
# we are actually specifying 4 configuration files:
|
||||
# 1. the preinstalled default.ini
|
||||
# 2. the module configuration
|
||||
|
||||
@@ -144,33 +144,20 @@ let
|
||||
};
|
||||
|
||||
tempAddress = mkOption {
|
||||
type = types.enum [ "default" "enabled" "disabled" ];
|
||||
default = if cfg.enableIPv6 then "default" else "disabled";
|
||||
defaultText = literalExample ''if cfg.enableIPv6 then "default" else "disabled"'';
|
||||
type = types.enum (lib.attrNames tempaddrValues);
|
||||
default = cfg.tempAddresses;
|
||||
defaultText = literalExample ''config.networking.tempAddresses'';
|
||||
description = ''
|
||||
When IPv6 is enabled with SLAAC, this option controls the use of
|
||||
temporary address (aka privacy extensions). This is used to reduce tracking.
|
||||
The three possible values are:
|
||||
temporary address (aka privacy extensions) on this
|
||||
interface. This is used to reduce tracking.
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>"default"</literal> to generate temporary addresses and use
|
||||
them by default;
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>"enabled"</literal> to generate temporary addresses but keep
|
||||
using the standard EUI-64 ones by default;
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>"disabled"</literal> to completely disable temporary addresses.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
See also the global option
|
||||
<xref linkend="opt-networking.tempAddresses"/>, which
|
||||
applies to all interfaces where this is not set.
|
||||
|
||||
Possible values are:
|
||||
${tempaddrDoc}
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -366,6 +353,32 @@ let
|
||||
|
||||
isHexString = s: all (c: elem c hexChars) (stringToCharacters (toLower s));
|
||||
|
||||
tempaddrValues = {
|
||||
disabled = {
|
||||
sysctl = "0";
|
||||
description = "completely disable IPv6 temporary addresses";
|
||||
};
|
||||
enabled = {
|
||||
sysctl = "1";
|
||||
description = "generate IPv6 temporary addresses but still use EUI-64 addresses as source addresses";
|
||||
};
|
||||
default = {
|
||||
sysctl = "2";
|
||||
description = "generate IPv6 temporary addresses and use these as source addresses in routing";
|
||||
};
|
||||
};
|
||||
tempaddrDoc = ''
|
||||
<itemizedlist>
|
||||
${concatStringsSep "\n" (mapAttrsToList (name: { description, ... }: ''
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>"${name}"</literal> to ${description};
|
||||
</para>
|
||||
</listitem>
|
||||
'') tempaddrValues)}
|
||||
</itemizedlist>
|
||||
'';
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
@@ -1039,6 +1052,21 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
networking.tempAddresses = mkOption {
|
||||
default = if cfg.enableIPv6 then "default" else "disabled";
|
||||
type = types.enum (lib.attrNames tempaddrValues);
|
||||
description = ''
|
||||
Whether to enable IPv6 Privacy Extensions for interfaces not
|
||||
configured explicitly in
|
||||
<xref linkend="opt-networking.interfaces._name_.tempAddress" />.
|
||||
|
||||
This sets the ipv6.conf.*.use_tempaddr sysctl for all
|
||||
interfaces. Possible values are:
|
||||
|
||||
${tempaddrDoc}
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
@@ -1098,7 +1126,7 @@ in
|
||||
// listToAttrs (forEach interfaces
|
||||
(i: let
|
||||
opt = i.tempAddress;
|
||||
val = { disabled = 0; enabled = 1; default = 2; }.${opt};
|
||||
val = tempaddrValues.${opt}.sysctl;
|
||||
in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val));
|
||||
|
||||
# Capabilities won't work unless we have at-least a 4.3 Linux
|
||||
@@ -1203,9 +1231,11 @@ in
|
||||
(pkgs.writeTextFile rec {
|
||||
name = "ipv6-privacy-extensions.rules";
|
||||
destination = "/etc/udev/rules.d/98-${name}";
|
||||
text = ''
|
||||
text = let
|
||||
sysctl-value = tempaddrValues.${cfg.tempAddresses}.sysctl;
|
||||
in ''
|
||||
# enable and prefer IPv6 privacy addresses by default
|
||||
ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.bash}/bin/sh -c 'echo 2 > /proc/sys/net/ipv6/conf/%k/use_tempaddr'"
|
||||
ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.bash}/bin/sh -c 'echo ${sysctl-value} > /proc/sys/net/ipv6/conf/%k/use_tempaddr'"
|
||||
'';
|
||||
})
|
||||
(pkgs.writeTextFile rec {
|
||||
@@ -1214,15 +1244,13 @@ in
|
||||
text = concatMapStrings (i:
|
||||
let
|
||||
opt = i.tempAddress;
|
||||
val = if opt == "disabled" then 0 else 1;
|
||||
msg = if opt == "disabled"
|
||||
then "completely disable IPv6 privacy addresses"
|
||||
else "enable IPv6 privacy addresses but prefer EUI-64 addresses";
|
||||
val = tempaddrValues.${opt}.sysctl;
|
||||
msg = tempaddrValues.${opt}.description;
|
||||
in
|
||||
''
|
||||
# override to ${msg} for ${i.name}
|
||||
ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${toString val}"
|
||||
'') (filter (i: i.tempAddress != "default") interfaces);
|
||||
ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${val}"
|
||||
'') (filter (i: i.tempAddress != cfg.tempAddresses) interfaces);
|
||||
})
|
||||
] ++ lib.optional (cfg.wlanInterfaces != {})
|
||||
(pkgs.writeTextFile {
|
||||
|
||||
Reference in New Issue
Block a user