Enable wine on odo and update nix_builder.

Pods were getting evicted due to disk pressure, so this causes garbage collection to trigger sooner.

nix/configuration/flake.lock

@@ -170,11 +170,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1783278211,
-        "narHash": "sha256-/1u+MIQIge+cNPukQoK4Jp8nLuFZRbx4U+MyyxG0RpM=",
+        "lastModified": 1784398011,
+        "narHash": "sha256-RMBrYkNpcOlPvX3LaI3qdZfqgX+R3/D3tsJhxLJJiak=",
         "ref": "refs/heads/main",
-        "rev": "9281ba7e10d362d4edb489d0df0e78936dfe7b58",
-        "revCount": 32,
+        "rev": "59fdbf41efdd0bbd0341a7534738149b33bd557f",
+        "revCount": 37,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/nix_builder.git"
       },

nix/configuration/hosts/family_disks/distributed_build.nix

@@ -14,6 +14,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/hydra/default.nix

@@ -129,6 +129,8 @@
     # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
     # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";
 
+    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
+
     me.build_in_ram.enable = true;
     me.dont_use_substituters.enable = true;
     me.hydra.enable = true;

nix/configuration/hosts/odo/default.nix

@@ -152,7 +152,7 @@
     me.wasm.enable = true;
     me.waybar.enable = true;
     me.webcam.enable = true;
-    me.wine.enable = false;
+    me.wine.enable = true;
     me.wireguard.activated = [
       "drmario"
       "wgh"

nix/configuration/hosts/odo/distributed_build.nix

@@ -14,6 +14,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/odowork/distributed_build.nix

@@ -14,6 +14,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/quark/distributed_build.nix

@@ -8,6 +8,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/roles/distributed_build/default.nix

@@ -59,25 +59,16 @@ let
       hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
     };
   };
-  joined_configs =
-    lib.genAttrs
-      (builtins.filter (hostname: config.me.distributed_build.machines."${hostname}".enable) (
-        builtins.attrNames all_nixos_configs
-      ))
-      (
+  substituters_list = (
+    map (
       hostname:
-        (lib.mkMerge [
-          {
-            hostName = hostname;
-            sshUser = "nixworker";
-            sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
-            maxJobs = 1;
-            supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-          }
-          static_host_configs."${hostname}"
-          config.me.distributed_build.machines."${hostname}".additional_config
-        ])
+      (lib.mkIf (
+        config.me.distributed_build.machines."${hostname}".enable
+        && config.me.distributed_build.machines."${hostname}".substituter_url != null
+      ) (config.me.distributed_build.machines."${hostname}".substituter_url))
+    ) (builtins.attrNames all_nixos_configs)
   );
+  has_any_substituters = substituters_list != [ ];
 in
 {
   imports = [ ];
@@ -117,6 +108,7 @@ in
           "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
           "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
           "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
+          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
         ];
       }
       {
@@ -140,12 +132,10 @@ in
           ) (builtins.attrNames all_nixos_configs)
         );
       }
-      # {
-      #   nix.settings.substitute = lib.mkForce true;
-      #   nix.settings.substituters = lib.mkForce (
-      #     lib.mapAttrsToList (hostname: joined_config: "ssh-ng://${joined_config.hostName}") joined_configs
-      #   );
-      # }
+      (lib.mkIf has_any_substituters {
+        nix.settings.substitute = lib.mkForce true;
+        nix.settings.substituters = lib.mkForce substituters_list;
+      })
     ]
   );
 }

nix/configuration/roles/podman/default.nix

@@ -50,6 +50,23 @@
       DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
     };
 
+    # Increase subuid / subgid to support running buildkit-rootless
+    # ref: https://github.com/moby/buildkit/issues/3297
+    users.users.talexander = {
+      subUidRanges = [
+        {
+          startUid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+      subGidRanges = [
+        {
+          startGid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+    };
+
     environment.persistence."/state" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [

nix/configuration/roles/wine/default.nix

@@ -20,7 +20,7 @@
   config = lib.mkIf (config.me.wine.enable && config.me.graphical) {
     environment.systemPackages = with pkgs; [
       # wineWowPackages.stable # supports 32 + 64 bit
-      wineWowPackages.waylandFull # Supports 32 + 64 bit with native wayland support.
+      wineWow64Packages.waylandFull # Supports 32 + 64 bit with native wayland support.
       # winetricks
     ];
   };

nix/kubernetes/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
         "type": "github"
       },
       "original": {
@@ -164,11 +164,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
         "type": "github"
       },
       "original": {

nix/kubernetes/roles/kubelet/default.nix

@@ -48,6 +48,12 @@ let
       "fd00:3e42:e349::10"
     ];
     imageMaximumGCAge = "24h"; # Delete unused images after 1 day.
+    imageGCHighThresholdPercent = 80;
+    imageGCLowThresholdPercent = 70;
+    evictionHard = {
+      "nodefs.available" = "5%";
+      "imagefs.available" = "10%";
+    };
   };
   kubelet_config_file = (to_yaml_file "kubelet-config.yaml" kubelet_config);
 in