forked from mirrors/nixpkgs
nixos/darwin-builder: add disk space options (#224480)
This commit is contained in:
Geraint Ballinger
GitHub
parent
772d05f31d
commit
8b2521bdae
|
|
@ -61,3 +61,89 @@ builders-use-substitutes = true
|
||||||
```ShellSession
|
```ShellSession
|
||||||
$ sudo launchctl kickstart -k system/org.nixos.nix-daemon
|
$ sudo launchctl kickstart -k system/org.nixos.nix-daemon
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Example flake usage
|
||||||
|
|
||||||
|
```
|
||||||
|
{
|
||||||
|
inputs = {
|
||||||
|
nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
|
||||||
|
darwin.url = "github:lnl7/nix-darwin/master";
|
||||||
|
darwin.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
|
|
||||||
|
outputs = { self, darwin, nixpkgs, ... }@inputs:
|
||||||
|
let
|
||||||
|
|
||||||
|
inherit (darwin.lib) darwinSystem;
|
||||||
|
system = "aarch64-darwin";
|
||||||
|
pkgs = nixpkgs.legacyPackages."${system}";
|
||||||
|
linuxSystem = builtins.replaceStrings [ "darwin" ] [ "linux" ] system;
|
||||||
|
|
||||||
|
darwin-builder = nixpkgs.lib.nixosSystem {
|
||||||
|
system = linuxSystem;
|
||||||
|
modules = [
|
||||||
|
"${nixpkgs}/nixos/modules/profiles/macos-builder.nix"
|
||||||
|
{ virtualisation.host.pkgs = pkgs; }
|
||||||
|
];
|
||||||
|
};
|
||||||
|
in {
|
||||||
|
|
||||||
|
darwinConfigurations = {
|
||||||
|
machine1 = darwinSystem {
|
||||||
|
inherit system;
|
||||||
|
modules = [
|
||||||
|
{
|
||||||
|
nix.distributedBuilds = true;
|
||||||
|
nix.buildMachines = [{
|
||||||
|
hostName = "ssh://builder@localhost";
|
||||||
|
system = linuxSystem;
|
||||||
|
maxJobs = 4;
|
||||||
|
supportedFeatures = [ "kvm" "benchmark" "big-parallel" ];
|
||||||
|
}];
|
||||||
|
|
||||||
|
launchd.daemons.darwin-builder = {
|
||||||
|
command = "${darwin-builder.config.system.build.macos-builder-installer}/bin/create-builder";
|
||||||
|
serviceConfig = {
|
||||||
|
KeepAlive = true;
|
||||||
|
RunAtLoad = true;
|
||||||
|
StandardOutPath = "/var/log/darwin-builder.log";
|
||||||
|
StandardErrorPath = "/var/log/darwin-builder.log";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Reconfiguring the builder
|
||||||
|
|
||||||
|
Initially you should not change the builder configuration else you will not be
|
||||||
|
able to use the binary cache. However, after you have the builder running locally
|
||||||
|
you may use it to build a modified builder with additional storage or memory.
|
||||||
|
|
||||||
|
To do this, you just need to set the `virtualisation.darwin-builder.*` parameters as
|
||||||
|
in the example below and rebuild.
|
||||||
|
|
||||||
|
```
|
||||||
|
darwin-builder = nixpkgs.lib.nixosSystem {
|
||||||
|
system = linuxSystem;
|
||||||
|
modules = [
|
||||||
|
"${nixpkgs}/nixos/modules/profiles/macos-builder.nix"
|
||||||
|
{
|
||||||
|
virtualisation.host.pkgs = pkgs;
|
||||||
|
virtualisation.darwin-builder.diskSize = 5120;
|
||||||
|
virtualisation.darwin-builder.memorySize = 1024;
|
||||||
|
virtualisation.darwin-builder.hostPort = 33022;
|
||||||
|
virtualisation.darwin-builder.workingDirectory = "/var/lib/darwin-builder";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
```
|
||||||
|
|
||||||
|
You may make any other changes to your VM in this attribute set. For example,
|
||||||
|
you could enable Docker or X11 forwarding to your Darwin host.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,6 +7,8 @@ let
|
||||||
|
|
||||||
keyType = "ed25519";
|
keyType = "ed25519";
|
||||||
|
|
||||||
|
cfg = config.virtualisation.darwin-builder;
|
||||||
|
|
||||||
in
|
in
|
||||||
|
|
||||||
{
|
{
|
||||||
|
|
@ -24,156 +26,214 @@ in
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
# The builder is not intended to be used interactively
|
options.virtualisation.darwin-builder = with lib; {
|
||||||
documentation.enable = false;
|
diskSize = mkOption {
|
||||||
|
default = 20 * 1024;
|
||||||
environment.etc = {
|
type = types.int;
|
||||||
"ssh/ssh_host_ed25519_key" = {
|
example = 30720;
|
||||||
mode = "0600";
|
description = "The maximum disk space allocated to the runner in MB";
|
||||||
|
|
||||||
source = ./keys/ssh_host_ed25519_key;
|
|
||||||
};
|
};
|
||||||
|
memorySize = mkOption {
|
||||||
"ssh/ssh_host_ed25519_key.pub" = {
|
default = 3 * 1024;
|
||||||
mode = "0644";
|
type = types.int;
|
||||||
|
example = 8192;
|
||||||
source = ./keys/ssh_host_ed25519_key.pub;
|
description = "The runner's memory in MB";
|
||||||
};
|
};
|
||||||
};
|
min-free = mkOption {
|
||||||
|
default = 1024 * 1024 * 1024;
|
||||||
# DNS fails for QEMU user networking (SLiRP) on macOS. See:
|
type = types.int;
|
||||||
#
|
example = 1073741824;
|
||||||
# https://github.com/utmapp/UTM/issues/2353
|
description = ''
|
||||||
#
|
The threshold (in bytes) of free disk space left at which to
|
||||||
# This works around that by using a public DNS server other than the DNS
|
start garbage collection on the runner
|
||||||
# server that QEMU provides (normally 10.0.2.3)
|
|
||||||
networking.nameservers = [ "8.8.8.8" ];
|
|
||||||
|
|
||||||
nix.settings = {
|
|
||||||
auto-optimise-store = true;
|
|
||||||
|
|
||||||
min-free = 1024 * 1024 * 1024;
|
|
||||||
|
|
||||||
max-free = 3 * 1024 * 1024 * 1024;
|
|
||||||
|
|
||||||
trusted-users = [ "root" user ];
|
|
||||||
};
|
|
||||||
|
|
||||||
services = {
|
|
||||||
getty.autologinUser = user;
|
|
||||||
|
|
||||||
openssh = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
system.build.macos-builder-installer =
|
|
||||||
let
|
|
||||||
privateKey = "/etc/nix/${user}_${keyType}";
|
|
||||||
|
|
||||||
publicKey = "${privateKey}.pub";
|
|
||||||
|
|
||||||
# This installCredentials script is written so that it's as easy as
|
|
||||||
# possible for a user to audit before confirming the `sudo`
|
|
||||||
installCredentials = hostPkgs.writeShellScript "install-credentials" ''
|
|
||||||
KEYS="''${1}"
|
|
||||||
INSTALL=${hostPkgs.coreutils}/bin/install
|
|
||||||
"''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
|
|
||||||
"''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey}
|
|
||||||
'';
|
'';
|
||||||
|
};
|
||||||
hostPkgs = config.virtualisation.host.pkgs;
|
max-free = mkOption {
|
||||||
|
default = 3 * 1024 * 1024 * 1024;
|
||||||
script = hostPkgs.writeShellScriptBin "create-builder" ''
|
type = types.int;
|
||||||
KEYS="''${KEYS:-./keys}"
|
example = 3221225472;
|
||||||
${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
|
description = ''
|
||||||
PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
|
The threshold (in bytes) of free disk space left at which to
|
||||||
PUBLIC_KEY="''${PRIVATE_KEY}.pub"
|
stop garbage collection on the runner
|
||||||
if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then
|
|
||||||
${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}"
|
|
||||||
${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost'
|
|
||||||
fi
|
|
||||||
if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
|
|
||||||
(set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
|
|
||||||
fi
|
|
||||||
KEYS="$(nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm
|
|
||||||
'';
|
'';
|
||||||
|
};
|
||||||
|
workingDirectory = mkOption {
|
||||||
|
default = ".";
|
||||||
|
type = types.str;
|
||||||
|
example = "/var/lib/darwin-builder";
|
||||||
|
description = ''
|
||||||
|
The working directory to use to run the script. When running
|
||||||
|
as part of a flake will need to be set to a non read-only filesystem.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
hostPort = mkOption {
|
||||||
|
default = 22;
|
||||||
|
type = types.int;
|
||||||
|
example = 31022;
|
||||||
|
description = ''
|
||||||
|
The localhost host port to forward TCP to the guest port.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
in
|
config = {
|
||||||
script.overrideAttrs (old: {
|
# The builder is not intended to be used interactively
|
||||||
meta = (old.meta or { }) // {
|
documentation.enable = false;
|
||||||
platforms = lib.platforms.darwin;
|
|
||||||
|
environment.etc = {
|
||||||
|
"ssh/ssh_host_ed25519_key" = {
|
||||||
|
mode = "0600";
|
||||||
|
|
||||||
|
source = ./keys/ssh_host_ed25519_key;
|
||||||
};
|
};
|
||||||
});
|
|
||||||
|
|
||||||
system = {
|
"ssh/ssh_host_ed25519_key.pub" = {
|
||||||
# To prevent gratuitous rebuilds on each change to Nixpkgs
|
mode = "0644";
|
||||||
nixos.revision = null;
|
|
||||||
|
|
||||||
stateVersion = lib.mkDefault (throw ''
|
source = ./keys/ssh_host_ed25519_key.pub;
|
||||||
The macOS linux builder should not need a stateVersion to be set, but a module
|
};
|
||||||
has accessed stateVersion nonetheless.
|
|
||||||
Please inspect the trace of the following command to figure out which module
|
|
||||||
has a dependency on stateVersion.
|
|
||||||
|
|
||||||
nix-instantiate --attr darwin.builder --show-trace
|
|
||||||
'');
|
|
||||||
};
|
|
||||||
|
|
||||||
users.users."${user}" = {
|
|
||||||
isNormalUser = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
security.polkit.enable = true;
|
|
||||||
|
|
||||||
security.polkit.extraConfig = ''
|
|
||||||
polkit.addRule(function(action, subject) {
|
|
||||||
if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
|
|
||||||
return "yes";
|
|
||||||
} else {
|
|
||||||
return "no";
|
|
||||||
}
|
|
||||||
})
|
|
||||||
'';
|
|
||||||
|
|
||||||
virtualisation = {
|
|
||||||
diskSize = 20 * 1024;
|
|
||||||
|
|
||||||
memorySize = 3 * 1024;
|
|
||||||
|
|
||||||
forwardPorts = [
|
|
||||||
{ from = "host"; guest.port = 22; host.port = 22; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Disable graphics for the builder since users will likely want to run it
|
|
||||||
# non-interactively in the background.
|
|
||||||
graphics = false;
|
|
||||||
|
|
||||||
sharedDirectories.keys = {
|
|
||||||
source = "\"$KEYS\"";
|
|
||||||
target = keysDirectory;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
# If we don't enable this option then the host will fail to delegate builds
|
# DNS fails for QEMU user networking (SLiRP) on macOS. See:
|
||||||
# to the guest, because:
|
|
||||||
#
|
#
|
||||||
# - The host will lock the path to build
|
# https://github.com/utmapp/UTM/issues/2353
|
||||||
# - The host will delegate the build to the guest
|
|
||||||
# - The guest will attempt to lock the same path and fail because
|
|
||||||
# the lockfile on the host is visible on the guest
|
|
||||||
#
|
#
|
||||||
# Snapshotting the host's /nix/store as an image isolates the guest VM's
|
# This works around that by using a public DNS server other than the DNS
|
||||||
# /nix/store from the host's /nix/store, preventing this problem.
|
# server that QEMU provides (normally 10.0.2.3)
|
||||||
useNixStoreImage = true;
|
networking.nameservers = [ "8.8.8.8" ];
|
||||||
|
|
||||||
# Obviously the /nix/store needs to be writable on the guest in order for it
|
nix.settings = {
|
||||||
# to perform builds.
|
auto-optimise-store = true;
|
||||||
writableStore = true;
|
|
||||||
|
|
||||||
# This ensures that anything built on the guest isn't lost when the guest is
|
min-free = cfg.min-free;
|
||||||
# restarted.
|
|
||||||
writableStoreUseTmpfs = false;
|
max-free = cfg.max-free;
|
||||||
|
|
||||||
|
trusted-users = [ "root" user ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services = {
|
||||||
|
getty.autologinUser = user;
|
||||||
|
|
||||||
|
openssh = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
system.build.macos-builder-installer =
|
||||||
|
let
|
||||||
|
privateKey = "/etc/nix/${user}_${keyType}";
|
||||||
|
|
||||||
|
publicKey = "${privateKey}.pub";
|
||||||
|
|
||||||
|
# This installCredentials script is written so that it's as easy as
|
||||||
|
# possible for a user to audit before confirming the `sudo`
|
||||||
|
installCredentials = hostPkgs.writeShellScript "install-credentials" ''
|
||||||
|
KEYS="''${1}"
|
||||||
|
INSTALL=${hostPkgs.coreutils}/bin/install
|
||||||
|
"''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
|
||||||
|
"''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey}
|
||||||
|
'';
|
||||||
|
|
||||||
|
hostPkgs = config.virtualisation.host.pkgs;
|
||||||
|
|
||||||
|
script = hostPkgs.writeShellScriptBin "create-builder" (
|
||||||
|
# When running as non-interactively as part of a DarwinConfiguration the working directory
|
||||||
|
# must be set to a writeable directory.
|
||||||
|
(if cfg.workingDirectory != "." then ''
|
||||||
|
${hostPkgs.coreutils}/bin/mkdir --parent "${cfg.workingDirectory}"
|
||||||
|
cd "${cfg.workingDirectory}"
|
||||||
|
'' else "") + ''
|
||||||
|
KEYS="''${KEYS:-./keys}"
|
||||||
|
${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
|
||||||
|
PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
|
||||||
|
PUBLIC_KEY="''${PRIVATE_KEY}.pub"
|
||||||
|
if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then
|
||||||
|
${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}"
|
||||||
|
${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost'
|
||||||
|
fi
|
||||||
|
if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
|
||||||
|
(set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
|
||||||
|
fi
|
||||||
|
KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm
|
||||||
|
'');
|
||||||
|
|
||||||
|
in
|
||||||
|
script.overrideAttrs (old: {
|
||||||
|
meta = (old.meta or { }) // {
|
||||||
|
platforms = lib.platforms.darwin;
|
||||||
|
};
|
||||||
|
});
|
||||||
|
|
||||||
|
system = {
|
||||||
|
# To prevent gratuitous rebuilds on each change to Nixpkgs
|
||||||
|
nixos.revision = null;
|
||||||
|
|
||||||
|
stateVersion = lib.mkDefault (throw ''
|
||||||
|
The macOS linux builder should not need a stateVersion to be set, but a module
|
||||||
|
has accessed stateVersion nonetheless.
|
||||||
|
Please inspect the trace of the following command to figure out which module
|
||||||
|
has a dependency on stateVersion.
|
||||||
|
|
||||||
|
nix-instantiate --attr darwin.builder --show-trace
|
||||||
|
'');
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users."${user}" = {
|
||||||
|
isNormalUser = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
security.polkit.enable = true;
|
||||||
|
|
||||||
|
security.polkit.extraConfig = ''
|
||||||
|
polkit.addRule(function(action, subject) {
|
||||||
|
if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
|
||||||
|
return "yes";
|
||||||
|
} else {
|
||||||
|
return "no";
|
||||||
|
}
|
||||||
|
})
|
||||||
|
'';
|
||||||
|
|
||||||
|
virtualisation = {
|
||||||
|
diskSize = cfg.diskSize;
|
||||||
|
|
||||||
|
memorySize = cfg.memorySize;
|
||||||
|
|
||||||
|
forwardPorts = [
|
||||||
|
{ from = "host"; guest.port = 22; host.port = cfg.hostPort; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# Disable graphics for the builder since users will likely want to run it
|
||||||
|
# non-interactively in the background.
|
||||||
|
graphics = false;
|
||||||
|
|
||||||
|
sharedDirectories.keys = {
|
||||||
|
source = "\"$KEYS\"";
|
||||||
|
target = keysDirectory;
|
||||||
|
};
|
||||||
|
|
||||||
|
# If we don't enable this option then the host will fail to delegate builds
|
||||||
|
# to the guest, because:
|
||||||
|
#
|
||||||
|
# - The host will lock the path to build
|
||||||
|
# - The host will delegate the build to the guest
|
||||||
|
# - The guest will attempt to lock the same path and fail because
|
||||||
|
# the lockfile on the host is visible on the guest
|
||||||
|
#
|
||||||
|
# Snapshotting the host's /nix/store as an image isolates the guest VM's
|
||||||
|
# /nix/store from the host's /nix/store, preventing this problem.
|
||||||
|
useNixStoreImage = true;
|
||||||
|
|
||||||
|
# Obviously the /nix/store needs to be writable on the guest in order for it
|
||||||
|
# to perform builds.
|
||||||
|
writableStore = true;
|
||||||
|
|
||||||
|
# This ensures that anything built on the guest isn't lost when the guest is
|
||||||
|
# restarted.
|
||||||
|
writableStoreUseTmpfs = false;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue