nixos/icecream: add modules

This adds modules for the icecream scheduler and daemon.
Icecream can be used for distributed compilation, especially in
environments with diverse toolchains, since it sends the complete build
environment to the daemon.
Unfortunatley the daemon can't be run with DynamicUser = true, since the
daemon requires to be started as root in order to accept other build
environments, see [1].

[1]: https://github.com/icecc/icecream#using-icecream-in-heterogeneous-environments
This commit is contained in:
Rouven Czerwinski 2020-04-04 19:15:49 +02:00
parent e50baf22df
commit 733181d766
3 changed files with 258 additions and 0 deletions

View file

@ -649,6 +649,8 @@
./services/networking/hylafax/default.nix
./services/networking/i2pd.nix
./services/networking/i2p.nix
./services/networking/icecream/scheduler.nix
./services/networking/icecream/daemon.nix
./services/networking/iodine.nix
./services/networking/iperf3.nix
./services/networking/ircd-hybrid/default.nix

View file

@ -0,0 +1,155 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.icecream.daemon;
in {
###### interface
options = {
services.icecream.daemon = {
enable = mkEnableOption "Icecream Daemon";
openFirewall = mkOption {
type = types.bool;
description = ''
Whether to automatically open receive port in the firewall.
'';
};
openBroadcast = mkOption {
type = types.bool;
description = ''
Whether to automatically open the firewall for scheduler discovery.
'';
};
cacheLimit = mkOption {
type = types.ints.u16;
default = 256;
description = ''
Maximum size in Megabytes of cache used to store compile environments of compile clients.
'';
};
netName = mkOption {
type = types.str;
default = "ICECREAM";
description = ''
Network name to connect to. A scheduler with the same name needs to be running.
'';
};
noRemote = mkOption {
type = types.bool;
default = false;
description = ''
Prevent jobs from other nodes being scheduled on this daemon.
'';
};
schedulerHost = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Explicit scheduler hostname, useful in firewalled environments.
Uses scheduler autodiscovery via broadcast if set to null.
'';
};
maxProcesses = mkOption {
type = types.nullOr types.ints.u16;
default = null;
description = ''
Maximum number of compile jobs started in parallel for this daemon.
Uses the number of CPUs if set to null.
'';
};
nice = mkOption {
type = types.int;
default = 5;
description = ''
The level of niceness to use.
'';
};
hostname = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Hostname of the daemon in the icecream infrastructure.
Uses the hostname retrieved via uname if set to null.
'';
};
user = mkOption {
type = types.str;
default = "icecc";
description = ''
User to run the icecream daemon as. Set to root to enable receive of
remote compile environments.
'';
};
package = mkOption {
default = pkgs.icecream;
defaultText = "pkgs.icecream";
type = types.package;
description = "Icecream package to use.";
};
extraArgs = mkOption {
type = types.listOf types.str;
default = [];
description = "Additional command line parameters.";
example = [ "-v" ];
};
};
};
###### implementation
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 10245 ];
networking.firewall.allowedUDPPorts = mkIf cfg.openBroadcast [ 8765 ];
systemd.services.icecc-daemon = {
description = "Icecream compile daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = escapeShellArgs ([
"${getBin cfg.package}/bin/iceccd"
"-b" "$STATE_DIRECTORY"
"-u" "icecc"
(toString cfg.nice)
]
++ optionals (cfg.schedulerHost != null) ["-s" cfg.schedulerHost]
++ optionals (cfg.netName != null) [ "-n" cfg.netName ]
++ optionals (cfg.cacheLimit != null) [ "--cache-limit" (toString cfg.cacheLimit) ]
++ optionals (cfg.maxProcesses != null) [ "-m" (toString cfg.maxProcesses) ]
++ optionals (cfg.hostname != null) [ "-N" (cfg.hostname) ]
++ optional cfg.noRemote "--no-remote"
++ cfg.extraArgs);
DynamicUser = true;
User = "icecc";
Group = "icecc";
StateDirectory = "icecc";
RuntimeDirectory = "icecc";
AmbientCapabilities = "CAP_SYS_CHROOT";
CapabilityBoundingSet = "CAP_SYS_CHROOT";
};
};
};
meta.maintainers = with lib.maintainers; [ emantor ];
}

View file

@ -0,0 +1,101 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.icecream.scheduler;
in {
###### interface
options = {
services.icecream.scheduler = {
enable = mkEnableOption "Icecream Scheduler";
netName = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Network name for the icecream scheduler.
Uses the default ICECREAM if null.
'';
};
port = mkOption {
type = types.port;
default = 8765;
description = ''
Server port to listen for icecream daemon requests.
'';
};
openFirewall = mkOption {
type = types.bool;
description = ''
Whether to automatically open the daemon port in the firewall.
'';
};
openTelnet = mkOption {
type = types.bool;
default = false;
description = ''
Whether to open the telnet TCP port on 8766.
'';
};
persistentClientConnection = mkOption {
type = types.bool;
default = false;
description = ''
Whether to prevent clients from connecting to a better scheduler.
'';
};
package = mkOption {
default = pkgs.icecream;
defaultText = "pkgs.icecream";
type = types.package;
description = "Icecream package to use.";
};
extraArgs = mkOption {
type = types.listOf types.str;
default = [];
description = "Additional command line parameters";
example = [ "-v" ];
};
};
};
###### implementation
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = mkMerge [
(mkIf cfg.openFirewall [ cfg.port ])
(mkIf cfg.openTelnet [ 8766 ])
];
systemd.services.icecc-scheduler = {
description = "Icecream scheduling server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = escapeShellArgs ([
"${getBin cfg.package}/bin/icecc-scheduler"
"-p" (toString cfg.port)
]
++ optionals (cfg.netName != null) [ "-n" (toString cfg.netName) ]
++ optional cfg.persistentClientConnection "-r"
++ cfg.extraArgs);
DynamicUser = true;
};
};
};
meta.maintainers = with lib.maintainers; [ emantor ];
}