hosts/p-body/hydra.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

{
  config,
  self,
  ...
}: let
  hydraGroup = config.users.users.hydra.group;
  inherit (config.networking) domain hostName;
in {
  age.secrets = {
    "hydraGH" = {
      file = "${self}/secrets/hosts/${hostName}/hydraGH.age";
      mode = "440";
      owner = config.users.users.hydra.name;
      group = hydraGroup;
    };
  };

  # https://github.com/NixOS/nix/issues/2002#issuecomment-375270656
  nix.extraOptions = ''
    allowed-uris = https:// http://
  '';

  services.hydra = {
    enable = true;
    hydraURL = "https://hydra.${domain}";
    notificationSender = "hydra@${domain}";
    listenHost = "localhost";
    port = 6000;
    useSubstitutes = true;
    extraConfig = ''
      Include ${config.age.secrets.hydraGH.path}

      compress_build_logs = 1
      queue_runner_metrics_address = 127.0.0.1:6002

      <githubstatus>
        jobs = .*
        useShortContext = true
      </githubstatus>

      <hydra_notify>
        <prometheus>
          listen_address = 127.0.0.1
          port = 6001
        </prometheus>
      </hydra_notify>
    '';
    extraEnv = {HYDRA_DISALLOW_UNFREE = "0";};
  };

  nix.settings.trusted-users = ["@${hydraGroup}"];

  users.users = {
    hydra-queue-runner.extraGroups = [hydraGroup];
    hydra-www.extraGroups = [hydraGroup];
  };
}