Enable the build VM as a substituter.

This should enable me to have local build jobs without rebuilding stuff that already exists on the build VM server.

nix/configuration/configuration.nix

@@ -246,8 +246,31 @@ in
             glew = (final.glew.override { enableEGL = false; });
           };
         })
+        (final: prev: {
+          fwupd = prev.fwupd.overrideAttrs (
+            finalAttrs: prevAttrs: {
+              version = "2.1.5";
+              src = final.fetchFromGitHub {
+                owner = "fwupd";
+                repo = "fwupd";
+                tag = finalAttrs.version;
+                hash = "sha256-DzQ+N99ZmFRqZc2rN6PSqmoIMXUyrE8Kkn+KnT/AWPc=";
+              };
+            }
+          );
+        })
         (disableTests "onetbb") # oneTBB tests hang forever on machines with a single core (like my build virtual machine) https://github.com/uxlfoundation/oneTBB/issues/1557
         (disableTests "aws-c-common") # aws-c-common tests time out on my build virtual machine but run fine on my laptop.
+
+        # Works but probably sets python2's scipy to be python3:
+        #
+        # (final: prev: {
+        #   pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+        #     (python-final: python-prev: {
+        #       scipy = final.unoptimized.python3Packages.scipy;
+        #     })
+        #   ];
+        # })
       ];
 
     # This option defines the first version of NixOS you have installed on this particular machine,

nix/configuration/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781152676,
+        "lastModified": 1780894562,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "narHash": "sha256-c3430xwxwhHipl3jigUGMMBfpaMylDqytW/kdmB3ZGs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "24fed06cac83bcc44ac8efbb57cab1a82fa0bedc",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1785893730,
+        "lastModified": 1783278211,
-        "narHash": "sha256-K3pjEDafWrpfC1dc14icLxx9tWx4c/dfKTeiDYoZU7Q=",
+        "narHash": "sha256-/1u+MIQIge+cNPukQoK4Jp8nLuFZRbx4U+MyyxG0RpM=",
         "ref": "refs/heads/main",
-        "rev": "83f05b36778dd90d4e15e0d020685d9388cbaea1",
+        "rev": "9281ba7e10d362d4edb489d0df0e78936dfe7b58",
-        "revCount": 39,
+        "revCount": 32,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/nix_builder.git"
       },
@@ -185,11 +185,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785967620,
+        "lastModified": 1780749050,
-        "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {
@@ -199,6 +199,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-google": {
+      "locked": {
+        "lastModified": 1779893571,
+        "narHash": "sha256-wiwMyVCtmjRjlFCe2zaumCE6LRV9GzzN0ZH25NQkbAU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "45f6cfaa4605b706c870e75bd74bdb5e97eee11e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "45f6cfaa4605b706c870e75bd74bdb5e97eee11e",
+        "type": "github"
+      }
+    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1730741070,
@@ -248,7 +264,8 @@
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "nix_builder": "nix_builder",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-google": "nixpkgs-google"
       }
     },
     "rust-overlay": {

nix/configuration/flake.nix

@@ -20,6 +20,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-google.url = "github:NixOS/nixpkgs/45f6cfaa4605b706c870e75bd74bdb5e97eee11e";
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.2";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -38,6 +39,7 @@
     {
       self,
       nixpkgs,
+      nixpkgs-google,
       disko,
       impermanence,
       lanzaboote,
@@ -97,6 +99,9 @@
                       hostPlatform.gcc.arch = "default";
                       hostPlatform.gcc.tune = "default";
                     };
+                    google = import nixpkgs-google {
+                      system = prev.stdenv.hostPlatform.system;
+                    };
                   })
                 ];
               };

nix/configuration/hosts/family_disks/distributed_build.nix

@@ -4,19 +4,17 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
+      enable = false;
-      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
+      enable = true;
-      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/.disk/root";
     };
   };
 }

nix/configuration/hosts/hydra/default.nix

@@ -129,8 +129,6 @@
     # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
     # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";
 
-    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
-
     me.build_in_ram.enable = true;
     me.dont_use_substituters.enable = true;
     me.hydra.enable = true;

nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix

@@ -4,19 +4,10 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
+      enable = true;
-      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
-    me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
-    };
   };
 }

nix/configuration/hosts/odo/distributed_build.nix

@@ -4,19 +4,17 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
+      enable = false;
-      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
+      enable = true;
-      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/.disk/root";
     };
   };
 }

nix/configuration/hosts/odowork/distributed_build.nix

@@ -4,19 +4,17 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
+      enable = false;
-      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
+      enable = true;
-      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/.disk/root";
     };
   };
 }

nix/configuration/hosts/quark/distributed_build.nix

@@ -3,20 +3,12 @@
 
   config = {
     me.distributed_build.enable = true;
-    me.distributed_build.machines.quark = {
-      enable_build = false;
-      enable_substituter = false;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
+      enable = true;
-      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/.disk/root";
     };
   };
 }

nix/configuration/hosts/recovery/distributed_build.nix

@@ -4,19 +4,10 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
+      enable = true;
-      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
-    me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
-    };
   };
 }

nix/configuration/roles/distributed_build/default.nix

@@ -10,14 +10,7 @@
 
 let
   make_machine_config = name: {
-    enable_build = lib.mkOption {
+    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to use the ${name} machine during distributed builds.";
-    };
-
-    enable_substituter = lib.mkOption {
       type = lib.types.bool;
       default = false;
       example = true;
@@ -66,30 +59,11 @@ let
       hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
     };
   };
-  build_machine_list = (
-    map (
-      hostname:
-      (lib.mkIf config.me.distributed_build.machines."${hostname}".enable_build (
-        lib.mkMerge [
-          {
-            hostName = hostname;
-            sshUser = "nixworker";
-            sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
-            maxJobs = 1;
-            supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-            protocol = "ssh-ng";
-          }
-          static_host_configs."${hostname}"
-          config.me.distributed_build.machines."${hostname}".additional_config
-        ]
-      ))
-    ) (builtins.attrNames all_nixos_configs)
-  );
   substituters_list = (
     map (
       hostname:
       (lib.mkIf (
-        config.me.distributed_build.machines."${hostname}".enable_substituter
+        config.me.distributed_build.machines."${hostname}".enable
         && config.me.distributed_build.machines."${hostname}".substituter_url != null
       ) (config.me.distributed_build.machines."${hostname}".substituter_url))
     ) (builtins.attrNames all_nixos_configs)
@@ -134,11 +108,28 @@ in
           "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
           "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
           "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
-          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
         ];
       }
       {
-        nix.buildMachines = build_machine_list;
+        nix.buildMachines = (
+          map (
+            hostname:
+            (lib.mkIf config.me.distributed_build.machines."${hostname}".enable (
+              lib.mkMerge [
+                {
+                  hostName = hostname;
+                  sshUser = "nixworker";
+                  sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
+                  maxJobs = 1;
+                  supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
+                  protocol = "ssh-ng";
+                }
+                static_host_configs."${hostname}"
+                config.me.distributed_build.machines."${hostname}".additional_config
+              ]
+            ))
+          ) (builtins.attrNames all_nixos_configs)
+        );
       }
       (lib.mkIf has_any_substituters {
         nix.settings.substitute = lib.mkForce true;

nix/configuration/roles/gcloud/default.nix

@@ -18,7 +18,7 @@
   };
 
   config = lib.mkIf config.me.gcloud.enable {
-    environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs.google; [
       (google-cloud-sdk.withExtraComponents [ google-cloud-sdk.components.gke-gcloud-auth-plugin ])
     ];
 

nix/configuration/roles/hydra/default.nix

@@ -83,10 +83,7 @@
           "worker2_update"
           "family_disks"
           "family_disks_update"
-          "nixbsd"
+          # "nixbsd" # Disabled due to onetbb tests hanging on one-cpu machines.
-          "nix_builder_develop"
-          "organic_develop"
-          "natter_develop"
         ];
         build_flags = lib.concatMap (target: [
           "--target"

nix/configuration/roles/hydra/files/nix_builder.toml

@@ -178,30 +178,9 @@ output_directory = "/home/nixworker/persist/nix_builder"
   update = true
   update_branch = "nix_update"
 
-[[targets]]
+# [[targets]]
-  name = "nixbsd"
+#   name = "nixbsd"
-  repo = "https://github.com/nixos-bsd/nixbsd.git"
+#   repo = "https://github.com/nixos-bsd/nixbsd.git"
-  revision = "2b512eda58e6d77378bd20d6027802b158942e24"
+#   revision = "828ff7a3c4ee91f548de65a963fca40eaedb171c"
-  path = "."
+#   path = "."
-  attr = "base.vmClosureInfo"
+#   attr = "base.vmClosureInfo"
-
-[[targets]]
-  name = "nix_builder_develop"
-  repo = "https://code.fizz.buzz/talexander/nix_builder.git"
-  branch = "main"
-  path = "."
-  attr = "devShells.x86_64-linux.default"
-
-[[targets]]
-  name = "organic_develop"
-  repo = "https://code.fizz.buzz/talexander/organic.git"
-  branch = "main"
-  path = "."
-  attr = "devShells.x86_64-linux.default"
-
-[[targets]]
-  name = "natter_develop"
-  repo = "https://code.fizz.buzz/talexander/natter.git"
-  branch = "main"
-  path = "."
-  attr = "devShells.x86_64-linux.default"

nix/configuration/roles/latex/default.nix

@@ -25,8 +25,8 @@
     nixpkgs.overlays = [
       (final: prev: {
         tex = (
-          pkgs.texliveSmall.withPackages (
+          pkgs.texlive.combine {
-            ps: with ps; [
+            inherit (pkgs.texlive)
               scheme-basic
               dvisvgm
               dvipng # for preview and export as html in org-mode
@@ -44,8 +44,8 @@
               upquote # emacs org-mode pdf export
               lineno # emacs org-mode pdf export
               beamer # emacs org-mode presentation pdf export
-            ]
+              ;
-          )
+          }
         );
       })
     ];

nix/configuration/roles/network/default.nix

@@ -68,15 +68,7 @@ in
       10.217.1.1		drmario
       10.217.2.1		mrmanager
       fdfd:5e8a:ee2d::2:2 mrmanager
-      172.16.16.1		unifi
-      172.16.16.231		plug1
-      172.16.16.232		plug2
-      172.16.16.233		plug3
-      172.16.16.234		plug4
-      172.16.16.235		temperature1
-      172.16.16.236		temperature2
       172.16.16.245		turtle
-      172.16.16.250		sauna
       172.16.16.251		stream
     '';
 

nix/configuration/roles/podman/default.nix

@@ -50,23 +50,6 @@
       DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
     };
 
-    # Increase subuid / subgid to support running buildkit-rootless
-    # ref: https://github.com/moby/buildkit/issues/3297
-    users.users.talexander = {
-      subUidRanges = [
-        {
-          startUid = 100000;
-          count = 262144; # default = 65536
-        }
-      ];
-      subGidRanges = [
-        {
-          startGid = 100000;
-          count = 262144; # default = 65536
-        }
-      ];
-    };
-
     environment.persistence."/state" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [

nix/configuration/roles/wine/default.nix

@@ -20,9 +20,8 @@
   config = lib.mkIf (config.me.wine.enable && config.me.graphical) {
     environment.systemPackages = with pkgs; [
       # wineWowPackages.stable # supports 32 + 64 bit
-      wineWow64Packages.waylandFull # Supports 32 + 64 bit with native wayland support.
+      wineWowPackages.waylandFull # Supports 32 + 64 bit with native wayland support.
       # winetricks
-      # lutris
     ];
   };
 }

nix/kubernetes/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781152676,
+        "lastModified": 1780290312,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
         "type": "github"
       },
       "original": {
@@ -164,11 +164,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1784120854,
+        "lastModified": 1780749050,
-        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {

nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix

@@ -63,7 +63,6 @@ let
               username = builtins.readFile "${./secrets/flux-system/registry-credentials/username}";
               password = builtins.readFile "${./secrets/flux-system/registry-credentials/password}";
               email = builtins.readFile "${./secrets/flux-system/registry-credentials/email}";
-              address = builtins.readFile "${./secrets/flux-system/registry-credentials/address}";
             })
             // {
               # "__annotations" = {
@@ -208,19 +207,14 @@ let
       username,
       password,
       email,
-      address,
     }:
     let
     in
     {
       "__type" = "kubernetes.io/dockerconfigjson";
       ".dockerconfigjson" = builtins.toJSON {
-        auths = {
+        inherit username password email;
-          "${address}" = {
+        "auth" = toBase64 "${username}:${password}";
-            inherit username password email;
-            "auth" = toBase64 "${username}:${password}";
-          };
-        };
       };
     };
   ## dex

nix/kubernetes/roles/kubelet/default.nix

@@ -48,12 +48,6 @@ let
       "fd00:3e42:e349::10"
     ];
     imageMaximumGCAge = "24h"; # Delete unused images after 1 day.
-    imageGCHighThresholdPercent = 80;
-    imageGCLowThresholdPercent = 70;
-    evictionHard = {
-      "nodefs.available" = "5%";
-      "imagefs.available" = "10%";
-    };
   };
   kubelet_config_file = (to_yaml_file "kubelet-config.yaml" kubelet_config);
 in