afnix/infra
2
1
Fork 8
Code Issues 54 Code Review (Gerrit) Projects 2 Releases Packages Wiki Activity
Repository for AFNix-managed infrastructure https://hydra.afnix.fr/project/infra
1,447 commits 4 branches 0 tags 7.3 MiB
  • Nix 82.5%
  • Python 6%
  • Rust 4.8%
  • Go 2.4%
  • JavaScript 2.4%
  • Other 1.9%
Find a file
Exact
Yureka 73d6694e5a cache01-ams01: postgres for attic 
Attic seems to be running consistently into cache lock contention issues. We are moving it to PostgreSQL to avoid SQLite scalability limits.

@Raito made a data migration in advance.

Change-Id: Ic9e3cbd1d00a0ec5ab06a44535f332fa848323a6
2026-07-07 15:40:24 +00:00
arcana arcana-microvm-server: add a GC root for declared runners 2026-02-10 14:44:05 +00:00
common sni-proxy-aware-nginx: do not redirect to :444 port 2026-06-27 12:27:34 +00:00
dashboards feat(grafana): plug jsonnet-based dashboards in provisioning 2024-08-24 16:32:21 +02:00
dnscontrol afnix/par01/yuki: decommission id.afnix.fr 2026-05-19 21:52:00 +02:00
hosts/afnix cache01-ams01: postgres for attic 2026-07-07 15:40:24 +00:00
lib lib/microvms: improve URI construction logic 2026-02-08 18:51:08 +01:00
macos/mdm-scripts macos/infect-with-nix: avoid keeping the bootstrap Lix around in $PATH 2026-01-20 07:52:21 +01:00
netboot/arm64 feat: introduce ARM64 baremetal nodes 2025-02-12 22:30:45 +01:00
overlays lix-hydra-releng: switch to using rclone sync for manual & apidoc 2026-06-28 11:32:33 +00:00
pki feat(systems): trust our infra chain on all systems 2025-01-01 03:43:13 +01:00
secrets services/mimir: add alert route to ma27's ntfy 2026-05-26 13:24:21 +02:00
services lix-hydra-releng: switch to using rclone sync for manual & apidoc 2026-06-28 11:32:33 +00:00
terraform terraform/afnix_hydra: use newly introduced release.nix for Lix 2026-06-06 13:15:13 +02:00
vm afnix-zulip01: 4GB -> 6GB mem 2026-07-07 15:40:24 +00:00
.editorconfig editorconfig: .rs files are indented with 4 spaces 2026-03-22 18:17:59 +01:00
.envrc chore: add lorri to prevent direnv from blocking, closes #147 2024-10-27 09:42:11 +00:00
.gitattributes feat(secrets): flag .age secret blobs as binary 2025-02-25 17:30:56 +01:00
.gitignore terraform/afnix_hydra: activate jobsets, fix flake_uri 2026-01-25 21:23:08 +01:00
baremetal-nodes.nix hosts/floral: wob01 → ams01 2025-11-01 20:01:30 +01:00
default.nix feat: sign the ICA1 CSR 2024-12-31 17:50:23 +01:00
flake.lock update microvm.nix 2026-06-27 14:07:44 +02:00
flake.nix update Lix & Hydra 2026-06-27 09:16:35 +02:00
LICENSE Initial commit 2024-06-23 06:41:53 +02:00
README.md deployment: move to Arcana 2025-11-10 02:49:57 +01:00
renovate.json renovate: enable lock file maintenance settings 2025-09-08 08:22:16 +02:00
secrets.nix services/mimir: add alert route to ma27's ntfy 2026-05-26 13:24:21 +02:00
tasks.py wob01 -> ams01 in more places 2026-01-30 15:48:20 +01:00

README.md

Infrastructure for the donut shaped thing that is absolutely not a donut.

Quick start

Enter our dev-shell for things like our arcana wrapper, secrets helper and required binaries:

$ nix develop

Build the infrastructure

$ arcana build --on @localboot

Notice that @localboot is load-bearing as we have some machines that cannot be deployed with vanilla arcana. Fixing this is welcome.

Recommended deploy process

$ arcana apply dry-activate $machine # Verify that the nvd log is reasonable.
$ arcana apply $machine

Recommended upgrade process

$ nix flake update
$ arcana apply dry-activate --on @localboot # Verify that the nvd log is reasonable. Run it twice to get only NVD logs shown.
$ arcana apply --on @localboot

Deploy the Terraform infrastructure

$ vault-login
$ eval "$(get-secrets)"
$ nix run .#tf -- plan # Vanilla Terraform from there.
$ nix run .#tf -- apply

Make changes to DNS via dnscontrol

$ vault-login
$ eval "$(get-secrets)"
$ cd dnscontrol
$ dnscontrol preview # preview the changes without applying them
$ dnscontrol push # apply changes

Troubleshooting

I failed to deploy gerrit01

Our Gerrit source build is known to have some hiccups sometimes, we are always interested in build logs, feel free to attach information in a new issue so we can make it more reliable.

get-secrets fails

Are you a floral-admin ? If not, please get in touch with one of the superadmins.