push sheeet

nixos/modules/services/continuous-integration/hercules-ci-agent/common.nix

@@ -0,0 +1,125 @@
+/*
+  This file is for options that NixOS and nix-darwin have in common.
+
+  Platform-specific code is in the respective default.nix files.
+*/
+
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    filterAttrs
+    literalExpression
+    mkIf
+    mkOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    types
+    mkPackageOption
+    ;
+
+  cfg = config.services.hercules-ci-agent;
+
+  inherit (import ./settings.nix { inherit pkgs lib; }) format settingsModule;
+
+in
+{
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "hercules-ci-agent" "extraOptions" ]
+      [ "services" "hercules-ci-agent" "settings" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "hercules-ci-agent" "baseDirectory" ]
+      [ "services" "hercules-ci-agent" "settings" "baseDirectory" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "hercules-ci-agent" "concurrentTasks" ]
+      [ "services" "hercules-ci-agent" "settings" "concurrentTasks" ]
+    )
+    (mkRemovedOptionModule [ "services" "hercules-ci-agent" "patchNix" ]
+      "Nix versions packaged in this version of Nixpkgs don't need a patched nix-daemon to work correctly in Hercules CI Agent clusters."
+    )
+  ];
+
+  options.services.hercules-ci-agent = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable to run Hercules CI Agent as a system service.
+
+        [Hercules CI](https://hercules-ci.com) is a
+        continuous integation service that is centered around Nix.
+
+        Support is available at [help@hercules-ci.com](mailto:help@hercules-ci.com).
+      '';
+    };
+    package = mkPackageOption pkgs "hercules-ci-agent" { };
+    settings = mkOption {
+      description = ''
+        These settings are written to the `agent.toml` file.
+
+        Not all settings are listed as options, can be set nonetheless.
+
+        For the exhaustive list of settings, see <https://docs.hercules-ci.com/hercules-ci/reference/agent-config/>.
+      '';
+      type = types.submoduleWith { modules = [ settingsModule ]; };
+    };
+
+    /*
+      Internal and/or computed values.
+
+      These are written as options instead of let binding to allow sharing with
+      default.nix on both NixOS and nix-darwin.
+    */
+    tomlFile = mkOption {
+      type = types.path;
+      internal = true;
+      defaultText = lib.literalMD "generated `hercules-ci-agent.toml`";
+      description = ''
+        The fully assembled config file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Make sure that nix.extraOptions does not override trusted-users
+    assertions = [
+      {
+        assertion =
+          (cfg.settings.nixUserIsTrusted or false)
+          -> builtins.match ".*(^|\n)[ \t]*trusted-users[ \t]*=.*" config.nix.extraOptions == null;
+        message = ''
+          hercules-ci-agent: Please do not set `trusted-users` in `nix.extraOptions`.
+
+          The hercules-ci-agent module by default relies on `nix.settings.trusted-users`
+          to be effectful, but a line like `trusted-users = ...` in `nix.extraOptions`
+          will override the value set in `nix.settings.trusted-users`.
+
+          Instead of setting `trusted-users` in the `nix.extraOptions` string, you should
+          set an option with additive semantics, such as
+           - the NixOS option `nix.settings.trusted-users`, or
+           - the Nix option in the `extraOptions` string, `extra-trusted-users`
+        '';
+      }
+    ];
+    nix.extraOptions = ''
+      # A store path that was missing at first may well have finished building,
+      # even shortly after the previous lookup. This *also* applies to the daemon.
+      narinfo-cache-negative-ttl = 0
+    '';
+    services.hercules-ci-agent = {
+      tomlFile = format.generate "hercules-ci-agent.toml" cfg.settings;
+      settings.config._module.args = {
+        packageOption = options.services.hercules-ci-agent.package;
+        inherit pkgs;
+      };
+    };
+  };
+}

nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix

@@ -0,0 +1,119 @@
+/*
+  This file is for NixOS-specific options and configs.
+
+  Code that is shared with nix-darwin goes in common.nix.
+*/
+
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkIf mkDefault;
+
+  cfg = config.services.hercules-ci-agent;
+
+  command = "${cfg.package}/bin/hercules-ci-agent --config ${cfg.tomlFile}";
+  testCommand = "${command} --test-configuration";
+
+in
+{
+  imports = [
+    ./common.nix
+    (lib.mkRenamedOptionModule
+      [ "services" "hercules-ci-agent" "user" ]
+      [ "systemd" "services" "hercules-ci-agent" "serviceConfig" "User" ]
+    )
+  ];
+
+  config = mkIf cfg.enable {
+    systemd.services.hercules-ci-agent = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      path = [ config.nix.package ];
+      startLimitBurst = 30 * 1000000; # practically infinite
+      serviceConfig = {
+        User = "hercules-ci-agent";
+        ExecStart = command;
+        ExecStartPre = testCommand;
+        Restart = "on-failure";
+        RestartSec = 120;
+
+        # If a worker goes OOM, don't kill the main process. It needs to
+        # report the failure and it's unlikely to be part of the problem.
+        OOMPolicy = "continue";
+
+        # Work around excessive stack use by libstdc++ regex
+        # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164
+        # A 256 MiB stack allows between 400 KiB and 1.5 MiB file to be matched by ".*".
+        LimitSTACK = 256 * 1024 * 1024;
+      };
+    };
+
+    # Changes in the secrets do not affect the unit in any way that would cause
+    # a restart, which is currently necessary to reload the secrets.
+    systemd.paths.hercules-ci-agent-restart-files = {
+      wantedBy = [ "hercules-ci-agent.service" ];
+      pathConfig = {
+        Unit = "hercules-ci-agent-restarter.service";
+        PathChanged = [
+          cfg.settings.clusterJoinTokenPath
+          cfg.settings.binaryCachesPath
+        ];
+      };
+    };
+    systemd.services.hercules-ci-agent-restarter = {
+      serviceConfig.Type = "oneshot";
+      script = ''
+        # Wait a bit, with the effect of bundling up file changes into a single
+        # run of this script and hopefully a single restart.
+        sleep 10
+        if systemctl is-active --quiet hercules-ci-agent.service; then
+          if ${testCommand}; then
+            systemctl restart hercules-ci-agent.service
+          else
+            echo 1>&2 "WARNING: Not restarting agent because config is not valid at this time."
+          fi
+        else
+          echo 1>&2 "Not restarting hercules-ci-agent despite config file update, because it is not already active."
+        fi
+      '';
+    };
+
+    # Trusted user allows simplified configuration and better performance
+    # when operating in a cluster.
+    nix.settings.trusted-users = [ config.systemd.services.hercules-ci-agent.serviceConfig.User ];
+    services.hercules-ci-agent = {
+      settings = {
+        nixUserIsTrusted = true;
+        labels =
+          let
+            mkIfNotNull = x: mkIf (x != null) x;
+          in
+          {
+            nixos.configurationRevision = mkIfNotNull config.system.configurationRevision;
+            nixos.release = config.system.nixos.release;
+            nixos.label = mkIfNotNull config.system.nixos.label;
+            nixos.codeName = config.system.nixos.codeName;
+            nixos.tags = config.system.nixos.tags;
+            nixos.systemName = mkIfNotNull config.system.name;
+          };
+      };
+    };
+
+    users.users.hercules-ci-agent = {
+      home = cfg.settings.baseDirectory;
+      createHome = true;
+      group = "hercules-ci-agent";
+      description = "Hercules CI Agent system user";
+      isSystemUser = true;
+    };
+
+    users.groups.hercules-ci-agent = { };
+  };
+
+  meta.maintainers = [ lib.maintainers.roberth ];
+}

nixos/modules/services/continuous-integration/hercules-ci-agent/settings.nix

@@ -0,0 +1,161 @@
+# Not a module
+{ pkgs, lib }:
+let
+  inherit (lib)
+    types
+    literalExpression
+    mkOption
+    ;
+
+  format = pkgs.formats.toml { };
+
+  settingsModule =
+    {
+      config,
+      packageOption,
+      pkgs,
+      ...
+    }:
+    {
+      freeformType = format.type;
+      options = {
+        apiBaseUrl = mkOption {
+          description = ''
+            API base URL that the agent will connect to.
+
+            When using Hercules CI Enterprise, set this to the URL where your
+            Hercules CI server is reachable.
+          '';
+          type = types.str;
+          default = "https://hercules-ci.com";
+        };
+        baseDirectory = mkOption {
+          type = types.path;
+          default = "/var/lib/hercules-ci-agent";
+          description = ''
+            State directory (secrets, work directory, etc) for agent
+          '';
+        };
+        concurrentTasks = mkOption {
+          description = ''
+            Number of tasks to perform simultaneously.
+
+            A task is a single derivation build, an evaluation or an effect run.
+            At minimum, you need 2 concurrent tasks for `x86_64-linux`
+            in your cluster, to allow for import from derivation.
+
+            `concurrentTasks` can be around the CPU core count or lower if memory is
+            the bottleneck.
+
+            The optimal value depends on the resource consumption characteristics of your workload,
+            including memory usage and in-task parallelism. This is typically determined empirically.
+
+            When scaling, it is generally better to have a double-size machine than two machines,
+            because each split of resources causes inefficiencies; particularly with regards
+            to build latency because of extra downloads.
+          '';
+          type = types.either types.ints.positive (types.enum [ "auto" ]);
+          default = "auto";
+          defaultText = lib.literalMD ''
+            `"auto"`, meaning equal to the number of CPU cores.
+          '';
+        };
+        labels = mkOption {
+          description = ''
+            A key-value map of user data.
+
+            This data will be available to organization members in the dashboard and API.
+
+            The values can be of any TOML type that corresponds to a JSON type, but arrays
+            can not contain tables/objects due to limitations of the TOML library. Values
+            involving arrays of non-primitive types may not be representable currently.
+          '';
+          type = format.type;
+          defaultText = literalExpression ''
+            {
+              agent.source = "..."; # One of "nixpkgs", "flake", "override"
+              lib.version = "...";
+              pkgs.version = "...";
+            }
+          '';
+        };
+        workDirectory = mkOption {
+          description = ''
+            The directory in which temporary subdirectories are created for task state. This includes sources for Nix evaluation.
+          '';
+          type = types.path;
+          default = config.baseDirectory + "/work";
+          defaultText = literalExpression ''baseDirectory + "/work"'';
+        };
+        staticSecretsDirectory = mkOption {
+          description = ''
+            This is the default directory to look for statically configured secrets like `cluster-join-token.key`.
+
+            See also `clusterJoinTokenPath` and `binaryCachesPath` for fine-grained configuration.
+          '';
+          type = types.path;
+          default = config.baseDirectory + "/secrets";
+          defaultText = literalExpression ''baseDirectory + "/secrets"'';
+        };
+        clusterJoinTokenPath = mkOption {
+          description = ''
+            Location of the cluster-join-token.key file.
+
+            You can retrieve the contents of the file when creating a new agent via
+            <https://hercules-ci.com/dashboard>.
+
+            As this value is confidential, it should not be in the store, but
+            installed using other means, such as agenix, NixOps
+            `deployment.keys`, or manual installation.
+
+            The contents of the file are used for authentication between the agent and the API.
+          '';
+          type = types.path;
+          default = config.staticSecretsDirectory + "/cluster-join-token.key";
+          defaultText = literalExpression ''staticSecretsDirectory + "/cluster-join-token.key"'';
+        };
+        binaryCachesPath = mkOption {
+          description = ''
+            Path to a JSON file containing binary cache secret keys.
+
+            As these values are confidential, they should not be in the store, but
+            copied over using other means, such as agenix, NixOps
+            `deployment.keys`, or manual installation.
+
+            The format is described on <https://docs.hercules-ci.com/hercules-ci-agent/binary-caches-json/>.
+          '';
+          type = types.path;
+          default = config.staticSecretsDirectory + "/binary-caches.json";
+          defaultText = literalExpression ''staticSecretsDirectory + "/binary-caches.json"'';
+        };
+        secretsJsonPath = mkOption {
+          description = ''
+            Path to a JSON file containing secrets for effects.
+
+            As these values are confidential, they should not be in the store, but
+            copied over using other means, such as agenix, NixOps
+            `deployment.keys`, or manual installation.
+
+            The format is described on <https://docs.hercules-ci.com/hercules-ci-agent/secrets-json/>.
+          '';
+          type = types.path;
+          default = config.staticSecretsDirectory + "/secrets.json";
+          defaultText = literalExpression ''staticSecretsDirectory + "/secrets.json"'';
+        };
+      };
+      config = {
+        labels = {
+          agent.source =
+            if packageOption.highestPrio == (lib.modules.mkOptionDefault { }).priority then
+              "nixpkgs"
+            else
+              lib.mkOptionDefault "override";
+          pkgs.version = pkgs.lib.version;
+          lib.version = lib.version;
+        };
+      };
+    };
+in
+{
+  inherit format settingsModule;
+}