Skip to content

Commit ca95c2f

Browse files
zowoqzowoq
committed
switch to new queue runner
1 parent 8bfc353 commit ca95c2f

File tree

14 files changed

+268
-3
lines changed

14 files changed

+268
-3
lines changed

‎dev/genca.sh

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/usr/bin/env bash
2+
# https://github.com/NixOS/infra/blob/5d020952f5b870ff323904035347cd768530617d/non-critical-infra/hosts/staging-hydra/genca.sh
3+
set -x
4+
5+
hosts="build03 build04"
6+
7+
O="Nix Community Infra"
8+
9+
newDir="$(date '+%Y-%m-%dT%H:%M')"
10+
mkdir "${newDir}"
11+
cd "${newDir}" || exit
12+
13+
openssl genpkey -algorithm Ed25519 -out ca.key
14+
openssl req -x509 -new -nodes -key ca.key -sha256 -days 18250 -out ca.crt \
15+
-subj "/O=${O}/CN=hydra-queue-runner-ca"
16+
17+
cat <<EOF >server.cnf
18+
[req]
19+
prompt = no
20+
x509_extensions = v3_req
21+
req_extensions = v3_req
22+
default_md = sha256
23+
distinguished_name = req_distinguished_name
24+
25+
[req_distinguished_name]
26+
O = ${O}
27+
CN = queue-runner.hydra.nix-community.org
28+
29+
[v3_req]
30+
basicConstraints = CA:FALSE
31+
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
32+
extendedKeyUsage = critical, serverAuth
33+
subjectAltName = @alt_names
34+
35+
[alt_names]
36+
DNS.1 = queue-runner.hydra.nix-community.org
37+
EOF
38+
39+
openssl genpkey -algorithm Ed25519 -out server.key
40+
openssl req -new -key server.key -out server.csr -config server.cnf
41+
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 18250 -sha256 -extfile server.cnf -extensions v3_req
42+
43+
for host in ${hosts}; do
44+
openssl genpkey -algorithm Ed25519 -out "client-${host}.key"
45+
openssl req -new -key "client-${host}.key" -out "client-${host}.csr" \
46+
-subj "/O=${O}/CN=hydra-queue-builder-${host}"
47+
openssl x509 -req -in "client-${host}.csr" -CA ca.crt -CAkey ca.key -CAcreateserial -out "client-${host}.crt" -days 18250 -sha256
48+
done
49+
50+
rm -rf -- *.csr *.srl
51+
rm server.cnf
52+
53+
cd - || exit

‎dnscontrol/dnsconfig.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ var cnames = {
6565
"nl.meet": "nixnl.codeberg.page.",
6666
"nur-update": "build03",
6767
"prometheus": "web02",
68+
"queue-runner.hydra": "build03",
6869
"temp-cache": "build03",
6970
// keep-sorted end
7071
};

‎flake.lock

Lines changed: 17 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flake.nix

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@
3838
nixbsd.inputs.nixpkgs.follows = "nixbsd-nixpkgs";
3939
nixbsd.url = "github:qowoz/nixbsd/tmp3-community";
4040
nixos-facter-modules.url = "github:nix-community/nixos-facter-modules";
41+
nixos-infra.flake = false;
42+
nixos-infra.url = "github:NixOS/infra";
4143
nixpkgs-update-github-releases.flake = false;
4244
nixpkgs-update-github-releases.url = "github:nix-community/nixpkgs-update-github-releases";
4345
nixpkgs-update.inputs.mmdoc.follows = "empty";

‎hosts/build03/ca.crt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBkzCCAUWgAwIBAgIUM3IOGPv05wdHhykHyC7J0eYl4qYwBQYDK2VwMD4xHDAa
3+
BgNVBAoME05peCBDb21tdW5pdHkgSW5mcmExHjAcBgNVBAMMFWh5ZHJhLXF1ZXVl
4+
LXJ1bm5lci1jYTAgFw0yNTA4MDQwNDMxMTFaGA8yMDc1MDcyMzA0MzExMVowPjEc
5+
MBoGA1UECgwTTml4IENvbW11bml0eSBJbmZyYTEeMBwGA1UEAwwVaHlkcmEtcXVl
6+
dWUtcnVubmVyLWNhMCowBQYDK2VwAyEApTUfa9PNgjIqQIU8ur4gJ/EAClvVX+oJ
7+
hduaCt0iQ+WjUzBRMB0GA1UdDgQWBBSs13lAhWgE2ji+4Yvm6b5bCI9pYjAfBgNV
8+
HSMEGDAWgBSs13lAhWgE2ji+4Yvm6b5bCI9pYjAPBgNVHRMBAf8EBTADAQH/MAUG
9+
AytlcANBAIsqwp4tW+P5yAdhZy8rWGeKhwVyKmtkf2EjCeWbxDAVqeQvEXWcP1o0
10+
SFwPhoW5BaccYOgsrSDq3hY7xs2BUgQ=
11+
-----END CERTIFICATE-----

‎hosts/build03/client.crt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBiDCCATqgAwIBAgIULzcgJlY8HPEN7WebeYdUwmvL0dQwBQYDK2VwMD4xHDAa
3+
BgNVBAoME05peCBDb21tdW5pdHkgSW5mcmExHjAcBgNVBAMMFWh5ZHJhLXF1ZXVl
4+
LXJ1bm5lci1jYTAgFw0yNTA4MDQwNDMxMTFaGA8yMDc1MDcyMzA0MzExMVowRDEc
5+
MBoGA1UECgwTTml4IENvbW11bml0eSBJbmZyYTEkMCIGA1UEAwwbaHlkcmEtcXVl
6+
dWUtYnVpbGRlci1idWlsZDAzMCowBQYDK2VwAyEAgT2MFRB7qdN1Hx+ipgFOgYVc
7+
zdDmZtm/jrPS/BOerrCjQjBAMB0GA1UdDgQWBBTR0QWcQtL2JbUeFmoHOO7y8wj7
8+
5zAfBgNVHSMEGDAWgBSs13lAhWgE2ji+4Yvm6b5bCI9pYjAFBgMrZXADQQCZtrwk
9+
DknHpZPuceVHJPYYv9mYJvXfbHy5XAUkkS8lMWvH78dIQA+tK0atIvt364HkRBN1
10+
8pQWdhCU+bkKDDcC
11+
-----END CERTIFICATE-----

‎hosts/build03/default.nix

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
./builders.nix
55
./cache.nix
66
./postgresql.nix
7+
./queue-runner.nix
78
inputs.self.nixosModules.buildbot
89
inputs.self.nixosModules.cgroups
910
inputs.self.nixosModules.ci-builder

‎hosts/build03/queue-runner.nix

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
config,
3+
inputs,
4+
lib,
5+
...
6+
}:
7+
{
8+
imports = [ "${inputs.nixos-infra}/non-critical-infra/modules/hydra-queue-runner-v2.nix" ];
9+
10+
sops.secrets.queue-runner-server-key.owner = "nginx";
11+
12+
services.hydra-queue-runner-v2 = {
13+
enable = true;
14+
settings = {
15+
useSubstitutes = true;
16+
};
17+
rest.port = 9090;
18+
};
19+
20+
services.hydra = {
21+
extraConfig = lib.mkAfter ''
22+
queue_runner_endpoint = http://localhost:9090
23+
'';
24+
};
25+
26+
systemd.services.hydra-queue-runner.enable = false;
27+
28+
services.nginx.virtualHosts."queue-runner.hydra.nix-community.org" = {
29+
# disable defaults
30+
enableACME = false;
31+
forceSSL = false;
32+
33+
extraConfig = ''
34+
client_max_body_size 5120M;
35+
ssl_client_certificate ${./ca.crt};
36+
ssl_verify_depth 2;
37+
ssl_verify_client on;
38+
'';
39+
40+
sslCertificate = ./server.crt;
41+
sslCertificateKey = config.sops.secrets.queue-runner-server-key.path;
42+
onlySSL = true;
43+
44+
locations."/".extraConfig = ''
45+
# This is necessary so that grpc connections do not get closed early
46+
# see https://stackoverflow.com/a/67805465
47+
client_body_timeout 31536000s;
48+
grpc_pass grpc://[::1]:50051;
49+
grpc_read_timeout 31536000s; # 1 year in seconds
50+
grpc_send_timeout 31536000s; # 1 year in seconds
51+
grpc_socket_keepalive on;
52+
grpc_set_header Host $host;
53+
grpc_set_header X-Real-IP $remote_addr;
54+
grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
55+
grpc_set_header X-Forwarded-Proto $scheme;
56+
grpc_set_header X-Client-DN $ssl_client_s_dn;
57+
grpc_set_header X-Client-Cert $ssl_client_escaped_cert;
58+
'';
59+
};
60+
}

‎hosts/build03/secrets.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ buildbot-nix-worker-password: ENC[AES256_GCM,data:TaMHVzlzuAHfTBAyqG5JJFwpG2We+w
1111
buildbot-effects-nix-community-infra: ENC[AES256_GCM,data:wAYSvEza+1xjT/rIp5MtR3HEQe3OscRBtrWF/f6G/z+ftaiWXMfWhW9X8z53I20lzx9a6BqmO4jcWAGmXRSV4TX6wxKsUP9BnzxTImDS41zWfOtHV9sDifk6jmVJyAAsrY8CrebGTmPvWUXEUMmAZkUorQkv8gfxoL66GCtPfqa7d1OSKX8rAXd1YAJL58aXFeD6X6iZqo2tVd1OhlmUuFj5oum+9uLPjCY54IfilLlERw5DdTPDhMBdKt5owR0dpJDmp9t8i0AV2j4Hm36ZsY8L9ket1iB04MlapsUI24RiXHk+aFJqSy+0onvmqeniiBeaa106YomSQAS1cyOp0U+Rcqwhtnh9MNUZzciVXi2F5nkPzA3OcbQh8MDcJ/66z/VUkSac0iMXvr/47d5V0XCm9JSKXuijOUGTu9LRbdEAAQ+gsZ/Z8i6+9d75CeSoVH5Mtm7eU4CbhloNmpAcz5qyFf+sRgWz5qK8z1MwT795P/P/Oi2YQswtwnyLO7UkQ5tCrE+qcFxM9cAAcJzkzGctB5QdHDaPkkpMGic8vpAoYgx3t7Qmasuef96Fhhj4lk10sTTUrWZlnFbmduO/fDOULvisnW/BTpYsnsIPSKREg8wQAu7Fiu9EO0TZOagAQf03EiFDcxosetxPJIXoNWsZK/1LsX+7SnBBklVDtwxu6urOUCW8vYXD4aGZvkTGc6O6vwiOs+oEHd6J7Mes/+23hTzldnFobodwnzbRNVt/WT2FQjX5qFehyxbARL+EtT4MQC4sWGpXSybUs10=,iv:rdLHfK4NbCaMIIhhQd2MfVf1DdKKF9Sqe4Kxuy57yok=,tag:DPxsDTLIhA0d4KPXwseL9g==,type:str]
1212
temp-cache-key: ENC[AES256_GCM,data:weL92egwmo4z32jXmWjgbfHo6h61+mWwHrHVAg0N8cHzBOjgsAL3NTRgpiiaePw/FcZa1rJ/ygBGyUYJbIq036fxhd1I/Vu+dPFXz7PPIphRj/q8wru21qfLXep39rk+bIqsJJB2++070SCKwgRLb4re9cM05ah3,iv:sX78dExpTL+UFkHWfQmYN8nsZcMCFhrgXwvtzvoWdJA=,tag:j3MNmXSdQEuh9oYP00yJAw==,type:str]
1313
rfc39-record-ssh-key: ENC[AES256_GCM,data:2jmn3F+y1xFACYfUoxJqp7EAEZVVuDYUGISk7/d8xAfjfpnekAO8OHRVT+RSgLQuVXsV7ffocb3M319+Kgdp5/hRUr7zNlCkBTMdXz9XBHDUmeEjhjtjQCmH0WYRjLgpyDrUY4gk1+EuAIKY0J9MktKJ4JKIxSm0Keei2iByoXxIjQhHDNg48UXQBW0A8ZPqWPmJsHCFtGcQXSVG/rehGqYh2cDC5Q4XpU4Rw1j+ZyE81RakbNxWx/uIVvbQxGuYI3qXyOunllokj5jh8VBQUpz3QdCkIR7dFTuoBy7N79sdZntAqHhNdeZPLpxIVTNwGBzgTvdcA9PCQSIs7TYg7X7l98Z9QQUnSXpg3APz+jlsoOF/icXrcOxJBAPAhBqH/2mBUEjbNiWQR44cZi4Bt6n1LZCA0IniZsBwUFDE9o8a4z70Nc2QGcLLixbWc+g8GtrH1qxtXe2mZ13uWFL1THuIypJzrbGKAPV+NAao9Q60znzWgQiuSkN2eXaGZQLadEXi,iv:wbhy54VM7WqRSgjoyjYKenliXgxjd41lFJdTr+1UH84=,tag:DB7VXqK2RHdadeEHabTwRw==,type:str]
14+
queue-runner-ca-key: ENC[AES256_GCM,data:aNs2Xk3n6vAJIyFeYEj28Lm89gCAMN8op90Yo5U4HrnoxR+aJnwnF5sbwT989iNAjGpKdgu9KH47lo4maDJRSTLprEKb8ytEpUWTKgq6VTujPhlxDtdqlj2QtTeSJxlrXZwxLs/miH4a/qFUNcbmLJJmPLe+e7w=,iv:iEVZqsJjkXAJ7Dqadf9dyDTtTMLq6DX1gjE3GU11SUY=,tag:hFz/4Syc8vDtrPdKeiBe9w==,type:str]
15+
queue-runner-server-key: ENC[AES256_GCM,data:cxTbXFV2ckIk468TbrdHrqxZDvGJ7cCaI+/hbfzRtnYmT2W26f3SzjM4EDg9ZCQcXIcdb6Ii/bfCwJj/Yhp60t/o5QuBvYHoNgyrM9v7bRZeNwY3JE5EM64UEIIgSzT/WlOwvf7c+mSS+4n1MfeMoRPZQM5mbOg=,iv:VoL4YPCusW0/XNEBPAyC1SuHRCfvipmHamLxcPlN+ZM=,tag:Lrov4NonT6CRLWs2P9OKig==,type:str]
16+
queue-runner-client-key: ENC[AES256_GCM,data:CP16NvBDGOC0rOOxZO7EoIzWjdxEhpaPUM35RkkWoSgIlGYoXhT/1k/jaRAnyhfyj7h8rMBQMbgFeXqYAW6B7dTgxtB/HqDL7dZNk1HILhzYyMJlZ5+Px9S+qDutqJjwDhLSh7lyLOWBABjYYWAJEpNQ50Eakmc=,iv:K/FeMftONTpMMVcyfpCJFWhcoULdzwebl/k+aKM9NPw=,tag:VJU1QFjy3HAQQit8AtKPFA==,type:str]
1417
sops:
1518
age:
1619
- recipient: age1qg7tfjwzp6dxwkw9vej6knkhdvqre3fu7ryzsdk5ggvtdx854ycqevlwnq
@@ -67,7 +70,7 @@ sops:
6770
WUZQSGQyQy9halJsRTIvb1FGV08zZEEKmjlYY6epTuZKRBcVyjPvJI5XKQtP5Yag
6871
FMrI+M6hUeyBeCade5C+Y4eGQbt57BWLmsX7u0J1WTlkUSS5j7+wPg==
6972
-----END AGE ENCRYPTED FILE-----
70-
lastmodified: "2025-07-01T23:53:43Z"
71-
mac: ENC[AES256_GCM,data:McXvWpN6kIprv2BOTCAqtDHiZv4xF3kmaltSJqGzfV3midOC8eeJVBwRhCU53h1TTJXoZU8Ar0cloNkiT1sqFFy8WUcdFC0NHHRnLAGX4ihSuSh5RA2odWUhua9QY73xfBwSGy876bVKtMzDVNMeecjRjBpZFJ3O/8FpKrMig/g=,iv:8iQPZv+jKJqI694cyJ5r0Je4jmvnmIj7QL06kq1ttwc=,tag:xP82ALLVO/Qq50TKx/1pWw==,type:str]
73+
lastmodified: "2025-08-04T04:34:06Z"
74+
mac: ENC[AES256_GCM,data:qpy+3Ifv9ydOKA51E/EoJjLZVhkEl/CwcqLu+rDCfTw920agoHXUMBeXCsiE3U3WoNPMJQUcQOXUr4MVZ/wtYHnGGqYHDlx3Ap0b1+Kjl0SJxlhpvib3mKpQEXTqh1bB5ylujydaDZasknjncWl96nKJG6KhF6xJE5zDqCaHWrU=,iv:kiLGLOnxIqpu+UpiBqx1pwkBqvncks8DBDqURp1BdGE=,tag:oJp0P+xeBinYhihUsqBWSg==,type:str]
7275
unencrypted_suffix: _unencrypted
7376
version: 3.10.2

‎hosts/build03/server.crt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB9DCCAaagAwIBAgIULzcgJlY8HPEN7WebeYdUwmvL0dMwBQYDK2VwMD4xHDAa
3+
BgNVBAoME05peCBDb21tdW5pdHkgSW5mcmExHjAcBgNVBAMMFWh5ZHJhLXF1ZXVl
4+
LXJ1bm5lci1jYTAgFw0yNTA4MDQwNDMxMTFaGA8yMDc1MDcyMzA0MzExMVowTTEc
5+
MBoGA1UECgwTTml4IENvbW11bml0eSBJbmZyYTEtMCsGA1UEAwwkcXVldWUtcnVu
6+
bmVyLmh5ZHJhLm5peC1jb21tdW5pdHkub3JnMCowBQYDK2VwAyEAZVsAufKBynGu
7+
MGDtn7Mryt5zkoxJ+Q3D/camesUKjFKjgaQwgaEwCQYDVR0TBAIwADALBgNVHQ8E
8+
BAMCA+gwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwLwYDVR0RBCgwJoIkcXVldWUt
9+
cnVubmVyLmh5ZHJhLm5peC1jb21tdW5pdHkub3JnMB0GA1UdDgQWBBQNqGtr7msZ
10+
+1Ljn5sXVmxftth3KzAfBgNVHSMEGDAWgBSs13lAhWgE2ji+4Yvm6b5bCI9pYjAF
11+
BgMrZXADQQCYRvZxS6cFMXTWr0Gy8svwctT6VL2Lfsrvg64SkmBFfFQdmlJpCSI1
12+
LCPSU5Q3NUMj6ILhZXN7J1cclj54iusD
13+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)