pyrox.dev
1/*
2
3 This file is for NixOS-specific options and configs.
4
5 Code that is shared with nix-darwin goes in common.nix.
6
7*/
8
9{ pkgs, config, lib, ... }:
10let
11 inherit (lib) mkIf mkDefault;
12
13 cfg = config.services.hercules-ci-agent;
14
15 command = "${cfg.package}/bin/hercules-ci-agent --config ${cfg.tomlFile}";
16 testCommand = "${command} --test-configuration";
17
18in
19{
20 imports = [
21 ./common.nix
22 (lib.mkRenamedOptionModule [ "services" "hercules-ci-agent" "user" ] [ "systemd" "services" "hercules-ci-agent" "serviceConfig" "User" ])
23 ];
24
25 config = mkIf cfg.enable {
26 systemd.services.hercules-ci-agent = {
27 wantedBy = [ "multi-user.target" ];
28 after = [ "network-online.target" ];
29 wants = [ "network-online.target" ];
30 path = [ config.nix.package ];
31 startLimitBurst = 30 * 1000000; # practically infinite
32 serviceConfig = {
33 User = "hercules-ci-agent";
34 ExecStart = command;
35 ExecStartPre = testCommand;
36 Restart = "on-failure";
37 RestartSec = 120;
38
39 LimitSTACK = 256 * 1024 * 1024;
40 OOMPolicy = "continue";
41 };
42 };
43
44 # Changes in the secrets do not affect the unit in any way that would cause
45 # a restart, which is currently necessary to reload the secrets.
46 systemd.paths.hercules-ci-agent-restart-files = {
47 wantedBy = [ "hercules-ci-agent.service" ];
48 pathConfig = {
49 Unit = "hercules-ci-agent-restarter.service";
50 PathChanged = [ cfg.settings.clusterJoinTokenPath cfg.settings.binaryCachesPath ];
51 };
52 };
53 systemd.services.hercules-ci-agent-restarter = {
54 serviceConfig.Type = "oneshot";
55 script = ''
56 # Wait a bit, with the effect of bundling up file changes into a single
57 # run of this script and hopefully a single restart.
58 sleep 10
59 if systemctl is-active --quiet hercules-ci-agent.service; then
60 if ${testCommand}; then
61 systemctl restart hercules-ci-agent.service
62 else
63 echo 1>&2 "WARNING: Not restarting agent because config is not valid at this time."
64 fi
65 else
66 echo 1>&2 "Not restarting hercules-ci-agent despite config file update, because it is not already active."
67 fi
68 '';
69 };
70
71 # Trusted user allows simplified configuration and better performance
72 # when operating in a cluster.
73 nix.settings.trusted-users = [ config.systemd.services.hercules-ci-agent.serviceConfig.User ];
74 services.hercules-ci-agent = {
75 settings = {
76 nixUserIsTrusted = true;
77 labels =
78 let
79 mkIfNotNull = x: mkIf (x != null) x;
80 in
81 {
82 nixos.configurationRevision = mkIfNotNull config.system.configurationRevision;
83 nixos.release = config.system.nixos.release;
84 nixos.label = mkIfNotNull config.system.nixos.label;
85 nixos.codeName = config.system.nixos.codeName;
86 nixos.tags = config.system.nixos.tags;
87 nixos.systemName = mkIfNotNull config.system.name;
88 };
89 };
90 };
91
92 users.users.hercules-ci-agent = {
93 home = cfg.settings.baseDirectory;
94 createHome = true;
95 group = "hercules-ci-agent";
96 description = "Hercules CI Agent system user";
97 isSystemUser = true;
98 };
99
100 users.groups.hercules-ci-agent = { };
101 };
102
103 meta.maintainers = [ lib.maintainers.roberth ];
104}