Garuda's infra documentation

garuda-build (Legacy Fosshost VPS)

General

This server is a legacy, still up Fosshost VPS. Fosshost itself ceased to be quite a while ago, but this server is still up for some reason. Since we can't be sure how long it will stay up, we don't want to put anything important on it. Therefore, its sole purpose is running a disposable build environment for the Chaotic-AUR infra 4.0.

Host-specific tasks

• Restarting the Docker stack:
  • sudo systemctl restart docker-compose-chaotic-v4-builder-root
  • alternatively: sudo chaotic-restart

Nix expression

{ pkgs
, sources
, ...
}:
let
  wrapperScript = pkgs.writeScriptBin "chaotic-restart" ''
    systemctl restart docker-compose-chaotic-v4-builder-root.target 
  '';
in
{
  imports = [
    "${sources.chaotic-portable-builder}/nix/nixos.nix"
    ../modules
    ./garuda-build/docker-compose.nix
    ./garuda-build/hardware-configuration.nix
  ];

  # Base configuration
  networking.interfaces.ens18.ipv4.addresses = [{
    address = "216.158.66.108";
    prefixLength = 24;
  }];
  networking.hostName = "garuda-build";
  networking.defaultGateway = "216.158.66.97";

  # At least try to prevent the insane spam of login attempts
  services.openssh.ports = [ 1022 ];

  # Lock down chaotic-op group to SCP in landing zone
  services.openssh.extraConfig = ''
    Match Group chaotic-op
      AllowAgentForwarding no
      AllowTCPForwarding yes
      ForceCommand internal-sftp
      PermitOpen 127.0.0.1:6379
      PermitTunnel no
      X11Forwarding no
  '';

  # Enable the user accounts of chaotic maintainers
  garuda-lib.chaoticUsers = true;

  # Allow controlling infra 4.0's containers without root
  environment.systemPackages = [ wrapperScript ];
  security.sudo.extraRules = [
    { users = [ "xiota" ]; commands = [{ command = "${wrapperScript}/bin/chaotic-restart"; options = [ "NOPASSWD" ]; }]; }
  ];

  system.stateVersion = "22.05";
}

Docker containers

# Auto-generated using compose2nix v0.2.2-pre.
{ pkgs, lib, ... }:

{
  # Runtime
  virtualisation.docker = {
    enable = true;
    autoPrune.enable = true;
  };
  virtualisation.oci-containers.backend = "docker";

  # Containers
  virtualisation.oci-containers.containers."chaotic-builder" = {
    image = "registry.gitlab.com/garuda-linux/tools/chaotic-manager/manager:latest";
    environment = {
      "BUILDER_HOSTNAME" = "garuda-build";
      "BUILDER_TIMEOUT" = "8600";
      "CI_CODE_SKIP" = "123";
      "DATABASE_HOST" = "builds.garudalinux.org";
      "DATABASE_PORT" = "400";
      "REDIS_SSH_HOST" = "builds.garudalinux.org";
      "REDIS_SSH_PORT" = "400";
      "REDIS_SSH_USER" = "package-deployer";
      "SHARED_PATH" = "/var/garuda/docker-compose-runner/chaotic-v4/shared";
    };
    volumes = [
      "/var/garuda/docker-compose-runner/chaotic-v4/shared:/shared:rw"
      "/var/garuda/docker-compose-runner/chaotic-v4/sshkey:/app/sshkey:rw"
      "/var/run/docker.sock:/var/run/docker.sock:rw"
    ];
    cmd = [ "builder" ];
    log-driver = "journald";
    extraOptions = [
      "--network-alias=chaotic-builder"
      "--network=chaotic-v4-builder_default"
    ];
    environmentFiles = [
      "/var/garuda/secrets/docker-compose/chaotic-v4-builder.env"
    ];
  };
  systemd.services."docker-chaotic-builder" = {
    serviceConfig = {
      Restart = lib.mkOverride 500 "no";
    };
    after = [
      "docker-network-chaotic-v4-builder_default.service"
    ];
    requires = [
      "docker-network-chaotic-v4-builder_default.service"
    ];
    partOf = [
      "docker-compose-chaotic-v4-builder-root.target"
    ];
    wantedBy = [
      "docker-compose-chaotic-v4-builder-root.target"
    ];
    unitConfig.RequiresMountsFor = [
      "/var/garuda/docker-compose-runner/chaotic-v4/shared"
      "/var/garuda/docker-compose-runner/chaotic-v4/sshkey"
      "/var/run/docker.sock"
    ];
  };
  virtualisation.oci-containers.containers."watchtower" = {
    image = "containrrr/watchtower:latest";
    volumes = [
      "/var/run/docker.sock:/var/run/docker.sock:rw"
    ];
    cmd = [ "--cleanup" "chaotic-builder" "watchtower" "--interval" "3600" ];
    log-driver = "journald";
    extraOptions = [
      "--network-alias=watchtower"
      "--network=chaotic-v4-builder_default"
    ];
  };
  systemd.services."docker-watchtower" = {
    serviceConfig = {
      Restart = lib.mkOverride 500 "always";
      RestartMaxDelaySec = lib.mkOverride 500 "1m";
      RestartSec = lib.mkOverride 500 "100ms";
      RestartSteps = lib.mkOverride 500 9;
    };
    after = [
      "docker-network-chaotic-v4-builder_default.service"
    ];
    requires = [
      "docker-network-chaotic-v4-builder_default.service"
    ];
    partOf = [
      "docker-compose-chaotic-v4-builder-root.target"
    ];
    wantedBy = [
      "docker-compose-chaotic-v4-builder-root.target"
    ];
    unitConfig.RequiresMountsFor = [
      "/var/run/docker.sock"
    ];
  };

  # Networks
  systemd.services."docker-network-chaotic-v4-builder_default" = {
    path = [ pkgs.docker ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStop = "docker network rm -f chaotic-v4-builder_default";
    };
    script = ''
      docker network inspect chaotic-v4-builder_default || docker network create chaotic-v4-builder_default
    '';
    partOf = [ "docker-compose-chaotic-v4-builder-root.target" ];
    wantedBy = [ "docker-compose-chaotic-v4-builder-root.target" ];
  };

  # Root service
  # When started, this will automatically create all resources and start
  # the containers. When stopped, this will teardown all resources.
  systemd.targets."docker-compose-chaotic-v4-builder-root" = {
    unitConfig = {
      Description = "Root target generated by compose2nix.";
    };
    wantedBy = [ "multi-user.target" ];
  };
}