about summary refs log tree commit diff
path: root/ops
AgeCommit message (Collapse)AuthorFilesLines
2021-08-24 r/2751 feat(ops): Serve nixery.dev from whitbyVincent Ambo2-0/+22
Adds a new module for the nixery.dev domain and serves it from whitby. Note that the DNS records do *not* point to whitby yet, so deploying this will lead to a failed TLS provisioning unit - but this is intentional. Change-Id: I911f67a0aa24f8df3cb52d2cfc49a8b6132cf718 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3383 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-08-24 r/2750 chore(ops/dns): Reduce Nixery TTLs to 1 minute temporarilyVincent Ambo1-10/+10
We'll need to do a DNS switchover, likely with a short amount of downtime due to TLS provisioning. It would be possible to avoid this by provisioning a cert manually pre-hoc through the DNS challenge and then configuring whitby to use that, however I simply don't have time for that right now and the Google Cloud Project for Nixery is going away in O(days) for $reasons. Change-Id: I88dface5aaacec5acfa525ae117462f8ad296d92 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3382 Tested-by: BuildkiteCI Reviewed-by: kn <klemens@posteo.de>
2021-08-15 r/2735 fix(monorepo-gerrit): Enable adding new email addresses to accountsVincent Ambo1-0/+3
This is required when people change their email addresses (e.g. cl/3349) as nothing in Gerrit will update that information from the OAuth provider. Change-Id: I1eafdf22efd37898dcd0d06bb9a5d1471ffb5e31 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3356 Tested-by: BuildkiteCI Reviewed-by: eta <eta@theta.eu.org> Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: lukegb <lukegb@tvl.fyi>
2021-08-13 r/2729 chore(ops/users): change my email address to tvl@eta.steta1-1/+1
I got a new domain, etc. Change-Id: Ic8ffc01f4e5e89dc2458d80a9c38757438cfa764 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3349 Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: tazjin <mail@tazj.in> Tested-by: BuildkiteCI
2021-08-13 r/2726 feat(ops/www): Point images.tvl.* at NixeryVincent Ambo2-0/+23
Change-Id: I39f979c68e7b74f6da6a7da0f07aaa470886d451 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3346 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de> Reviewed-by: sterni <sternenseemann@systemli.org>
2021-08-12 r/2724 chore(ops/dns): Move nixery.dev to tvl-fyi GCP projectVincent Ambo1-6/+6
Change-Id: Ifbe7939a98a12d52ffbed3fb198558e6a7743e93 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3344 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-08-12 r/2723 feat(ops/dns): Add images.tvl.* recordVincent Ambo2-2/+4
This record is intended to serve Nixery. Change-Id: I575dedac18c98f9f4bd5e459babe79e850361651 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3343 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-08-12 r/2721 feat(ops/modules): Add module for running NixeryVincent Ambo2-0/+46
This sets up a very simple Nixery instance with some things lacking: * no support for garbage-collecting image fragments (yet) * no popularity setup The plan is to use this to get the ball rolling on a separate domain (e.g. images.tvl.fyi), iron things out and then look into flipping over nixery.dev Change-Id: Ic594809f9d487fec7a0f632d608752a3f9c61315 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3280 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de> Reviewed-by: sterni <sternenseemann@systemli.org>
2021-08-12 r/2719 fix(monorepo-gerrit): Pin JVM version used for GerritVincent Ambo1-0/+7
Change-Id: Ib22cdc415cbd5a8345b9589b2c34b3908996dd57 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3322 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-08-06 r/2708 feat(ops/dns): Import current nixery.dev zoneVincent Ambo2-0/+22
Change-Id: I3c5684fedb516740c7048c117cdfda01a2a23260 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3278 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-06-12 r/2651 refactor(ops): Break out prometheus-fail2ban-exporter moduleGriffin Smith1-0/+52
Break out the configuration for the prometheus fail2ban exporter, which is a simple python script that exports stats from fail2ban as a prometheus-scrapable textfile, from Mugwump into a reusable nixos module in //ops/nixos/modules. Change-Id: I5451c9c5de6c7bc4431150ae596a9c758bf1b693 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3136 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
2021-05-25 r/2631 fix(wigglydonke.rs): Don't rebuild nginx config unnecessarilyVincent Ambo1-1/+1
This fix is essentially the same as the one in cl/1263. Change-Id: I27be280a610914fcfbb6d7fee7aebaa56b993812 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3158 Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi> Tested-by: BuildkiteCI
2021-05-25 r/2630 chore(nixpkgs): Bump channels to 2021-05-25Vincent Ambo6-16/+9
* users/grfn/system/home/yeren: remove obsolete awscli2 overrides * ops: make new isSystemUser || isNormalUser assertion happy * users/grfn/system/system/mugwump: make buildkite agents system users * users/tazjin/nixos/camden: set isSystemUser = true for git * users/tazjin/emacs: Remove missing & broken packages * third_party/openldap: remove, as the argon2 module is now enabled upstream * third_party/gerrit_plugins: Pinned new unstable hashes * third_party/nix, third_party/grpc: Disabled CI as these are broken * third_party/overlays/emacs: Bumped version to stay in sync with channel * third_party/buzz: Update LIBCLANG_PATH to reference libclang.lib, since libclang's default output no longer contains libclang.so * users/grfn/system/home: Install julia-stable instead of julia (which aliases to julia-lts), as the latter depends on an insecure version of libgit Change-Id: Iff33b0ecb0ef07a82d1de35e23c40d2f4bf0f8ed Reviewed-on: https://cl.tvl.fyi/c/depot/+/3001 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi>
2021-05-25 r/2628 chore(whitby): Add ZNC state to Restic backupsVincent Ambo1-1/+1
Until we have declarative ZNC config (which requires a solution for secrets handling in it), make sure we back this up as well. Change-Id: Idb186327da171eb6d3dbbd83801639f1f9321a40 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3159 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-05-24 r/2627 fix(tvl-slapd): Replace deprecated OpenLDAP module optionsVincent Ambo1-5/+7
Use the new module settings which apply configuration in cn=config instead of slapd.conf. The module performed this update via lib.mkChangedModuleOption, I've applied the transformations contained therein manually. Note that some of the settings were already in place, which means that the `suffix` and `database` options seemingly disappear into the void. Fixes b/105. Change-Id: I8a968c1eb8cb7827618cb732cdb46006a5d011f9 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3157 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-05-24 r/2626 refactor(ops/nixos): Pass `depot` as a special argumentVincent Ambo1-4/+4
This changes the evaluation order for the `depot` argument and ensures it is partially evaluated before the module system starts resolving imports. This way we can import modules from `depot.path` without `depot` having to come from readTree. Fixes b/129. Change-Id: Icf4dd2be15011055dac8b27e991a4ff6a12bf827 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3156 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-05-24 r/2624 chore(ops/users): Update email address for cynthiaCynthia Revström1-1/+1
Change-Id: Ieb59d9215c5c1159113375dea0dd96d3d29e1303 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3154 Reviewed-by: tazjin <mail@tazj.in> Tested-by: BuildkiteCI
2021-05-24 r/2623 fix(ops/users): Rehash password for knKlemens Nanni1-1/+1
This time using `tools.hash-password` because login did not work with the initially created hash. Change-Id: I1eb62a496d2d8497d27573af47bf8bf70dac9bbb Reviewed-on: https://cl.tvl.fyi/c/depot/+/3153 Reviewed-by: tazjin <mail@tazj.in> Tested-by: BuildkiteCI
2021-05-24 r/2621 feat(ops/users): Add knKlemens Nanni1-0/+5
Change-Id: Ib615743fc57357b0de17600c9a3f400c48fd0f70 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3151 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi>
2021-05-23 r/2620 feat(dns): Add record for deploys.tvl.fyiGriffin Smith1-10/+11
This will be used to serve (nix-) diffs for pending deploys of whitby Change-Id: Ia864993b1fcb3b7ce5fcc21f32a27528a4c31f08 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3149 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
2021-05-23 r/2619 fix(whitby): Fix irccat configuration for incorrectly named optionVincent Ambo1-1/+3
irccat is passing the realname option as the ident of the user, which doesn't match what is in ZNC. It hasn't seen any upstream commits in a long time, so I'm just leaving this as is and fixing it locally in our config. Change-Id: I3bf865f37b8df9c1cd891a94245ca3fad376bbe1 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3150 Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi> Tested-by: BuildkiteCI
2021-05-23 r/2617 feat(whitby): Let sterni bear the wheelVincent Ambo1-1/+1
Change-Id: Ib4f7dcbdc754d2fc271f501a9ea270e983a3645f Reviewed-on: https://cl.tvl.fyi/c/depot/+/3147 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-05-23 r/2616 fix(ops/users): Fix hash format for cschillingVincent Ambo1-1/+1
Change-Id: Ib0c53e8f6bc030cbdfe31020ed9d6764bd732a62 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3146 Reviewed-by: tazjin <mail@tazj.in> Tested-by: BuildkiteCI
2021-05-23 r/2611 feat(ops/users): Add cschilling to userssterni1-0/+5
Change-Id: I8afc23c749a5318d7c2ce893903980112ff13c12 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3137 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: tazjin <mail@tazj.in>
2021-05-23 r/2610 feat(whitby): Enable fail2banGriffin Smith1-0/+2
I like running fail2ban on any machine that has stuff like ssh world-open, to limit the potential for password brute-force attacks etc. Change-Id: I0c60811ae5a2fddb44f04679fb455e646b8e39c5 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3138 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
2021-05-22 r/2609 chore: Replace Freenode mentions with HackIntVincent Ambo1-1/+2
This doesn't replace all of them in the repo, but at least the ones that are relevant to our move. Change-Id: I842e7594b4c16af30d880272417874f6b29afd22 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3134 Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi> Reviewed-by: grfn <grfn@gws.fyi>
2021-05-22 r/2606 feat(ops/owothia): Add owothia module and deploy on whitbyVincent Ambo2-0/+75
This configures owothia to use her new bouncer to HackInt. Change-Id: I80eb8191c2b0f2a6f8a31d19b60250ade27c1913 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3129 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-05-22 r/2604 chore(whitby): Move clbot to HackIntVincent Ambo1-9/+7
Points clbot at the new local ZNC instead. This will make it part of the things happening through the `tvlbot` account. Relates to b/101 Change-Id: I1c15ffa5720d3af34475c15bee3fdaa537ac659b Reviewed-on: https://cl.tvl.fyi/c/depot/+/3127 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi>
2021-05-22 r/2602 chore(whitby): Move irccat & panettone notifications to HackIntVincent Ambo1-5/+4
Change-Id: I6bd5c183d2c1c28b8c6b0201bdf22a66333d4aea Reviewed-on: https://cl.tvl.fyi/c/depot/+/3131 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-05-22 r/2600 feat(whitby): Add shadowsocks serverFlorian Klink1-1/+8
This adds a shadowsocks service, running on port 8443, tcp and udp. The password is read from /etc/secrets/shadowsocks-secret.sec, and needs to be populated externally. Change-Id: I6797150db108ba14459502dee43d8e4ed6cfa910 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3125 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
2021-05-21 r/2599 feat(apereo-cas): move away from 127.0.0.1:8443Florian Klink1-1/+1
The following commit itends to bind on port 8443 on all interfaces, so let's move this to something else. Change-Id: Ibb94a0f4e6892b6e543b542b89bcdaaefb617f23 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3126 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
2021-05-21 r/2598 feat(whitby): Initial ZNC configurationVincent Ambo1-0/+27
Bouncer to be used for TVL's IRC bots, see b/101 Change-Id: Ic9f71ecd94365d3baa31e0552b1ce16362f94557 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3124 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de>
2021-05-20 r/2597 fix(ops/nixos): Fix typo in NIX_PATH nameVincent Ambo1-1/+1
Change-Id: Ic29b219ca1c536f8a99860ecdf2957a62ba95889 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3123 Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
2021-05-06 r/2571 chore(sourcegraph): Increase nofile ulimit for SourcegraphVincent Ambo1-0/+6
Sourcegraph logs warnings about this on startup otherwise. Unclear to what degree it really affects operation though. Change-Id: I6ee7c5358631aafd9a7f8155150361bf7499314d Reviewed-on: https://cl.tvl.fyi/c/depot/+/3098 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
2021-05-05 r/2568 fix(ops/www): Fix typo in nginx configurationVincent Ambo1-1/+1
Change-Id: I5ee7307acae548cc7779fe715ea4aad620fe8f5c Reviewed-on: https://cl.tvl.fyi/c/depot/+/3096 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-05-05 r/2567 feat(ops/www): Configure atward.tvl.fyi and its aliasesVincent Ambo2-0/+34
Change-Id: I20dfb057f8184899226bcb4527010a6982d426f0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3094 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-05-05 r/2566 refactor(atward): Configure listen addressVincent Ambo1-1/+7
This appeases the flokli. Change-Id: Ib6a6c1a2cc8780e7944913d9204b42505b29fdc0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3093 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-05-03 r/2562 feat(ops): Add NixOS module for atwardVincent Ambo2-0/+35
Very standard, nothing fancy. Change-Id: Ibb286f221a4752abfb62e971b98e9496357040f5 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3090 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de>
2021-05-03 r/2561 feat(ops/dns): Add hostnames for atward (at.*, atward.*)Vincent Ambo2-2/+6
The shorter one is going to be more convenient when we get go-link (or, well, at-link) support. Change-Id: Ic24adcdad679b893c40c87731add818660259dac Reviewed-on: https://cl.tvl.fyi/c/depot/+/3091 Tested-by: BuildkiteCI Reviewed-by: isomer <isomer@tvl.fyi>
2021-04-28 r/2550 feat(ops/users): Add ezemtsov to usersEvgeny Zemtsov1-0/+5
Change-Id: I78a06540e97c0f294d81abe65c15122ed422dd8a Reviewed-on: https://cl.tvl.fyi/c/depot/+/3059 Reviewed-by: tazjin <mail@tazj.in> Tested-by: BuildkiteCI
2021-04-20 r/2529 feat(ops/modules/www): Disable FLoC tracking for all TVL pagesVincent Ambo1-0/+4
.. this is actually likely not disabling it for some pages, that will need this to be copy & pasted, but it's hard to tell just from the nginx docs. We'll make sure after deploying. Change-Id: I2fa6e31ca10835a206673b858594fa071e729d82 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3020 Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2021-04-20 r/2527 refactor(ops/nixos): Ensure that pkgs == depot.third_party.nixpkgsVincent Ambo1-0/+7
This is currently done ad-hoc in a bunch of our systems, but we should just do it centrally. The commit message is a bit of a lie, as this doesn't yet update grfn's systems. Change-Id: Ic771c1a1da78ec5de9cffbf94c296dce5e11fd84 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3047 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-04-18 r/2524 fix(automatic-gc): Fix garbage collection scriptVincent Ambo1-1/+1
It needs to refer to this by full path of course. Change-Id: I911c876ba18877681accb722426314d92b9f2318 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3042 Reviewed-by: lukegb <lukegb@tvl.fyi> Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
2021-04-14 r/2512 fix(modules/automatic-gc): Add nix-daemon to requisitesVincent Ambo1-0/+1
This will require the daemon to be running when launching GC, but won't start it if it happens to not be running for some reason. Change-Id: If48fe336030173f028428fc00a81d339ef4b8bce Reviewed-on: https://cl.tvl.fyi/c/depot/+/3015 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-04-14 r/2511 feat(ops/modules): Add module for automatically collecting garbageVincent Ambo2-0/+100
Adds a module that automatically collects garbage based on disk space thresholds, and configures it to run hourly on whitby. This is implemented as an alternative to cl/2937, which I've been told uses a Nix feature that doesn't actually work. Under-the-hood this is simply a systemd timer running a shell script which checks available disk space and runs GC when necessary. Change-Id: I3c6b5de85b74ea52e7e16c53f2f900e0911c9805 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3014 Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2021-04-13 r/2500 feat(whitby/grafana): use CAS SSOLuke Granger-Brown1-0/+52
There's a hard-coded list of Admin usernames for the moment. We should revisit this and get an actual groups setup in LDAP that's propagated through... Change-Id: Ic3601f1a9753573076769f4912038e9f1b60e139 Reviewed-on: https://cl.tvl.fyi/c/depot/+/2982 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in> Reviewed-by: grfn <grfn@gws.fyi>
2021-04-12 r/2498 feat(whitby): Enable Grafana at status.tvl.suVincent Ambo2-4/+47
Enables a Grafana service pointing to whitby's local Prometheus instance, accessible at status.tvl.su. I've no idea how to configure Grafana and if it's possible to link it to CAS, but we'll see about that later. Notes: * the explicit fixpoint for whitby config has been removed as we have the `config` parameter available now * backups are enabled for the Grafana storage location Change-Id: If5ffe0c1a3378d1c88529129487c643642705fd2 Reviewed-on: https://cl.tvl.fyi/c/depot/+/2948 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-04-12 r/2497 refactor: Replace 'depotPath' with 'depot.path'Vincent Ambo3-22/+22
Instead of having two ways of accessing the path to the depot (one of which was stuttering, depot.depotPath) we settle on only one: depot.path. This was mostly used for NixOS module imports. Co-Authored-By: Florian Klink <flokli@flokli.de> Change-Id: I2c0db23383fc34f6ca76baaad4cc4af2d9dfae15 Reviewed-on: https://cl.tvl.fyi/c/depot/+/2962 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: sterni <sternenseemann@systemli.org>
2021-04-12 r/2494 chore(besadii): Stop passing explicit messages to BuildkiteVincent Ambo1-6/+0
Dropping the message field will make Buildkite use the commit messages instead, which makes for much more readable build logs. Change-Id: I1849f811632526893b700f117c9f6cf64888c329 Reviewed-on: https://cl.tvl.fyi/c/depot/+/2949 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2021-04-12 r/2493 feat(whitby): Enable Prometheus instance on whitbyVincent Ambo1-1/+24
Enables Prometheus with a local node exporter, and nothing else for now. Some additional collectors have been enabled for things that might be relevant on whitby: * systemd: all our services run in systemd * processes: might be interesting for build-related stats * logind: might be interesting for interactive usage stats Change-Id: I48dacdd9c68b4be9edff7b3cb6256dad562498c4 Reviewed-on: https://cl.tvl.fyi/c/depot/+/2930 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: lukegb <lukegb@tvl.fyi>
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-11-21T09·50+0000