From 462b85aae832dc135e76cfa81492f64134177a8a Mon Sep 17 00:00:00 2001 From: Rutherther Date: Sat, 12 Sep 2026 18:57:00 +0200 Subject: [PATCH] feat: use edge-ruther as remote nix builder with raised nofile limit --- config.scm | 37 ++++++++++++++++++--- modules/ruther/services/nix.scm | 58 +++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+), 4 deletions(-) create mode 100644 modules/ruther/services/nix.scm diff --git a/config.scm b/config.scm index 13fe92c27e0bcc633dcd4541aa8985a0b16a1e8b..9c23e73a726c7620c365595f103a71a2c1f3be8f 100644 --- a/config.scm +++ b/config.scm @@ -5,6 +5,7 @@ (define-module (config)) (use-modules + (guix gexp) (nongnu packages linux) (nongnu system linux-initrd) (nongnu packages firmware) @@ -23,6 +24,7 @@ (ruther services system) (ruther services bind) (ruther services nix-gl) + (ruther services nix) (ruther services netbird) (ruther packages netbird) (ruther bootloader grub) @@ -260,7 +262,6 @@ zip unzip wget curl vim - nix polkit ;; get pktty fwupd-nonfree netbird @@ -304,20 +305,48 @@ ;; Let's use GUI apps from Nixpkgs, because, why not? nixos-opengl-driver-service - (service nix-service-type + ;; Prefer the builder's LAN address, then fall back to WireGuard. + (extra-special-file + "/root/.ssh/config" + (mixed-text-file + "root-ssh-config" + "Host edge-ruther-builder\n" + " HostName edge-ruther.local\n" + " HostKeyAlias edge-ruther.local\n" + " BatchMode yes\n" + " ConnectTimeout 5\n" + " ProxyUseFdpass yes\n" + " ProxyCommand " + (file-append bash "/bin/sh") + " -c '" + (file-append netcat-openbsd "/bin/nc") + " -F -w 2 edge-ruther.local %p || exec " + (file-append netcat-openbsd "/bin/nc") + " -F -w 10 192.168.32.12 %p'\n")) + + (service nix-service-type/raised-nofile (nix-configuration (extra-config '("experimental-features = nix-command flakes\n" "extra-platforms = i686-linux aarch64-linux\n" "keep-outputs = true\n" - "keep-derivations = true\n")))) + "keep-derivations = true\n" + + "extra-trusted-public-keys = edge-1:sGPnKl9kRZ1Tv8xqC8qdMfdpPpeZ0HDE38/eEmGOCGk=\n" + "fallback = true\n" + + "builders = ssh-ng://nixremote@edge-ruther-builder x86_64-linux /root/.ssh/id_ed25519 8 2 big-parallel,kvm\n" + "builders-use-substitutes = true\n")))) ;; TODO: contribute this to the nix service (simple-service 'nix-etc-d etc-profile-d-service-type (list (file-append nix "/etc/profile.d/nix-daemon.sh") (file-append nix "/etc/profile.d/nix.sh"))) - ;; Vivado or Matlab can crash because they open too many files + ;; Vivado or Matlab can crash because they open too many files. + ;; Note: @nixbld limits are set on the nix-daemon shepherd + ;; service itself (see (ruther services nix)); PAM limits don't + ;; apply because nixbld users never log in. (service pam-limits-service-type (list (pam-limits-entry "@wheel" 'hard 'nofile '50000) diff --git a/modules/ruther/services/nix.scm b/modules/ruther/services/nix.scm new file mode 100644 index 0000000000000000000000000000000000000000..909d1bcd1b249675a2537aafc7f2b7e00b2e0cbc --- /dev/null +++ b/modules/ruther/services/nix.scm @@ -0,0 +1,58 @@ +;; Custom nix-daemon service that raises its NOFILE rlimit. +;; +;; The stock (gnu services nix) nix-daemon is started by shepherd with the +;; default 1024/4096 open-files rlimit. Build processes run as @nixbld are +;; spawned as children of the daemon, so they inherit that limit — PAM limits +;; for @nixbld are ineffective because nixbld users never log in. +;; +;; This module re-exports a service type that inherits from nix-service-type +;; but replaces its shepherd-root-service-type extension with one that passes +;; #:resource-limits to make-forkexec-constructor. + +(define-module (ruther services nix) + #:use-module (srfi srfi-1) + #:use-module (guix gexp) + #:use-module (gnu services) + #:use-module (gnu services nix) + #:use-module (gnu services shepherd) + #:export (nix-service-type/raised-nofile)) + +;; The nix-configuration-* accessors are not exported from (gnu services nix), +;; so reach in with @@. +(define nix-configuration-package + (@@ (gnu services nix) nix-configuration-package)) +(define nix-configuration-build-directory + (@@ (gnu services nix) nix-configuration-build-directory)) +(define nix-configuration-extra-options + (@@ (gnu services nix) nix-configuration-extra-options)) + +(define (nix-shepherd-service/raised-nofile config) + (let ((package (nix-configuration-package config)) + (build-directory (nix-configuration-build-directory config)) + (extra-options (nix-configuration-extra-options config))) + (list + (shepherd-service + (provision '(nix-daemon)) + (documentation "Run nix-daemon with a raised NOFILE rlimit.") + (requirement '(user-processes file-system-/nix/store)) + (start #~(make-forkexec-constructor + (list (string-append #$package "/bin/nix-daemon") + #$@extra-options) + #:environment-variables + (list (string-append "TMPDIR=" #$build-directory) + "PATH=/run/current-system/profile/bin") + #:resource-limits + '((nofile 1048576 1048576)))) + (respawn? #f) + (stop #~(make-kill-destructor)))))) + +(define nix-service-type/raised-nofile + (service-type + (inherit nix-service-type) + (extensions + (cons (service-extension shepherd-root-service-type + nix-shepherd-service/raised-nofile) + (filter (lambda (ext) + (not (eq? (service-extension-target ext) + shepherd-root-service-type))) + (service-type-extensions nix-service-type))))))