nix-dotfiles/hosts/tsuki/services/hydra.nix

79 lines
2.3 KiB
Nix
Raw Normal View History

2022-09-22 00:51:00 +02:00
{ pkgs, unstable-pkgs, secrets, ... }:
2022-03-07 16:01:52 +01:00
{
2022-06-22 20:16:57 +02:00
# Follow instructions for setup:
# https://gist.github.com/joepie91/c26f01a787af87a96f967219234a8723
2022-03-07 16:01:52 +01:00
services.hydra = {
enable = true;
hydraURL = "https://hydra.nani.wtf";
listenHost = "localhost";
2022-03-07 16:01:52 +01:00
notificationSender = "hydra@nani.wtf";
2022-06-22 20:16:57 +02:00
useSubstitutes = true;
2022-09-22 00:51:00 +02:00
package = unstable-pkgs.hydra_unstable;
buildMachinesFiles = [];
dbi = "dbi:Pg:dbname=hydra;host=/var/run/postgresql;user=hydra;";
};
systemd.slices.system-hydra = {
description = "Nix Hydra slice";
requires = [
"system.slice"
"postgresql.service"
];
after = [ "system.slice" ];
};
systemd.services = {
hydra-evaluator.serviceConfig.Slice = "system-hydra.slice";
hydra-init.serviceConfig.Slice = "system-hydra.slice";
hydra-notify.serviceConfig.Slice = "system-hydra.slice";
hydra-queue-runner.serviceConfig.Slice = "system-hydra.slice";
hydra-send-stats.serviceConfig.Slice = "system-hydra.slice";
hydra-server.serviceConfig.Slice = "system-hydra.slice";
};
systemd.timers = {
hydra-check-space.timerConfig.Slice = "system-hydra.slice";
hydra-compress-logs.timerConfig.Slice = "system-hydra.slice";
hydra-update-gc-roots.timerConfig.Slice = "system-hydra.slice";
2022-03-07 16:01:52 +01:00
};
2024-01-23 05:36:39 +01:00
systemd.services.hydra-server.serviceConfig = {
Slice = "system-hydra.slice";
ReadOnlyPaths = [
"/nix/"
"/var/lib/hydra/scm/"
];
ReadWritePaths = [
"/nix/var/nix/gcroots/hydra/"
"/nix/var/nix/daemon-socket/socket"
];
LockPersonality = true;
# MemoryDenyWriteExecute = false;
NoNewPrivileges = true;
PermissionsStartOnly = true;
PrivateDevices = true;
PrivateMounts = true;
# PrivateNetwork=false
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RemoveIPC = true;
Restart = "always";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
# StateDirectory=hydra/www
# StateDirectoryMode=700
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
};
2022-03-07 16:01:52 +01:00
}