79 lines
1.9 KiB
Nix
79 lines
1.9 KiB
Nix
|
# SPDX-FileCopyrightText: 2025 Elias Coppens <elias@dgnum.eu>
|
||
|
|
#
|
||
|
|
# SPDX-License-Identifier: EUPL-1.2
|
||
|
|
|
||
|
|
{ pkgs, lib, ... }:
|
||
|
|
let
|
||
|
|
org = import ../../../meta/organization.nix;
|
||
|
|
keys = (import ../../../keys/default.nix)._keys;
|
||
|
|
in
|
||
|
|
{
|
||
|
|
config = {
|
||
|
|
users.users = builtins.listToAttrs (
|
||
|
|
builtins.map (u: {
|
||
|
|
name = u;
|
||
|
|
value = {
|
||
|
|
isNormalUser = true;
|
||
|
|
home = "/home/${u}";
|
||
|
|
openssh.authorizedKeys.keys = keys.${u};
|
||
|
|
};
|
||
|
|
}) org.groups.nix-builder
|
||
|
|
);
|
||
|
|
|
||
|
|
security.pam.loginLimits = [
|
||
|
|
{
|
||
|
|
domain = "*";
|
||
|
|
item = "nofile";
|
||
|
|
type = "-";
|
||
|
|
value = "20480";
|
||
|
|
}
|
||
|
|
];
|
||
|
|
|
||
|
|
systemd.services.nix-daemon.serviceConfig = {
|
||
|
|
MemoryAccounting = true;
|
||
|
|
MemoryMax = "450G";
|
||
|
|
MemoryHigh = "440G";
|
||
|
|
MemorySwapMax = "2G";
|
||
|
|
ManagedOOMSwap = "kill";
|
||
|
|
ManagedOOMMemoryPressure = "kill";
|
||
|
|
MemoryPressureWatch = "on";
|
||
|
|
};
|
||
|
|
|
||
|
|
nix = {
|
||
|
|
gc = {
|
||
|
|
automatic = true;
|
||
|
|
dates = lib.mkForce "*:45";
|
||
|
|
options = lib.mkForce ''--max-freed "$((128 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
|
||
|
|
|
||
|
|
randomizedDelaySec = "1800";
|
||
|
|
};
|
||
|
|
|
||
|
|
nrBuildUsers = 128;
|
||
|
|
|
||
|
|
settings = {
|
||
|
|
keep-outputs = false;
|
||
|
|
keep-derivations = false;
|
||
|
|
use-cgroups = true;
|
||
|
|
http-connections = 0;
|
||
|
|
auto-allocate-uids = true;
|
||
|
|
cores = 0;
|
||
|
|
max-jobs = 8; # Do not build more than 2 derivations at once in the event, both of them are too big, yes this is stupid, fix it in Nix.
|
||
|
|
fsync-metadata = true;
|
||
|
|
system-features = [
|
||
|
|
"benchmark"
|
||
|
|
"big-parallel"
|
||
|
|
"kvm"
|
||
|
|
"nixos-test"
|
||
|
|
];
|
||
|
|
experimental-features = [
|
||
|
|
"auto-allocate-uids"
|
||
|
|
# "ca-derivations" this feature is really extremely broken.
|
||
|
|
"cgroups"
|
||
|
|
"fetch-closure"
|
||
|
|
"impure-derivations"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|