vanadium/sane-nix: init

Setup memory && storage protection mechanisms

nix/configurations/hetzner_benchmark.nix

@@ -44,8 +44,6 @@ in
         ];
       };
 
-      nix.package = pkgs.nix-monitored;
-
       system.nixos =
         let
           rev = lib.substring 0 8 sources.nixpkgs.revision;
@@ -59,6 +57,7 @@ in
     ./hetzner_benchmark/nixos/hardware-configuration.nix
     ./hetzner_benchmark/nixos/misc.nix
     ./hetzner_benchmark/nixos/programs.nix
+    ./hetzner_benchmark/nixos/builder.nix
 
     ../nixosModules/common/fish.nix
     ../nixosModules/common/disable-command-not-found.nix

nix/configurations/hetzner_benchmark/nixos/builder.nix

@@ -0,0 +1,31 @@
+# https://nix.dev/tutorials/nixos/distributed-builds-setup.html
+{ config, ... }:
+{
+  users.users.remotebuild = {
+    isSystemUser = true;
+    group = "remotebuild";
+    useDefaultShell = true;
+
+    openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
+  };
+
+  users.groups.remotebuild = { };
+  nix = {
+    nrBuildUsers = 64; # defaults to 32
+    settings = {
+      trusted-users = [ "remotebuild" ];
+
+      min-free = 50 * 1024 * 1024 * 1024; # start gc when < 10 GB is available
+      max-free = 100 * 1024 * 1024 * 1024; # stop gc when 20 GB is available
+
+      max-jobs = "auto";
+      cores = 0;
+    };
+  };
+
+  systemd.services.nix-daemon.serviceConfig = {
+    MemoryAccounting = true;
+    MemoryMax = "90%";
+    OOMScoreAdjust = 500;
+  };
+}

nix/configurations/hydrogen.nix

@@ -41,7 +41,6 @@ in
         overlays = map import [
           ../overlays/agenix.nix
           ../overlays/nur.nix
-          ../overlays/nix-tree.nix
           ../packages/overlay.nix
 
           # use lix everywhere and wrap it with nom
@@ -50,8 +49,6 @@ in
         ];
       };
 
-      nix.package = pkgs.nix-monitored;
-
       system.nixos =
         let
           rev = lib.substring 0 8 sources.nixpkgs.revision;

nix/configurations/installer.nix

@@ -38,7 +38,6 @@ in
       ../overlays/agenix.nix
       ../overlays/disko.nix
       ../overlays/nur.nix
-      ../overlays/nix-tree.nix
 
       ../packages/overlay.nix
     ];

nix/configurations/vanadium.nix

@@ -52,7 +52,6 @@ in
           ../overlays/disko.nix
           ../overlays/nur.nix
           ../overlays/wired-notify.nix
-          ../overlays/nix-tree.nix
           ../overlays/wallpapers.nix
           ../overlays/nil.nix
           ../overlays/dix.nix
@@ -71,6 +70,7 @@ in
 
           # use lix everywhere and wrap it with nom
           ../overlays/lix.nix
+          ../overlays/nix-monitored.nix
         ];
       };
 
@@ -88,6 +88,7 @@ in
     # NixOS modules
     #
     ./vanadium/nixos/hardware-configuration.nix # generated
+    ./vanadium/nixos/sane-nix.nix
     ./vanadium/nixos/fs.nix
     ./vanadium/nixos/restic.nix
 

nix/configurations/vanadium/home/programs.nix

@@ -79,6 +79,7 @@
     pkgs.niv
     pkgs.npins
     pkgs.nix-tree
+    pkgs.nix-output-monitor
     pkgs.nh
 
     # productivity / media

nix/configurations/vanadium/nixos/sane-nix.nix

@@ -0,0 +1,13 @@
+# Protect my system from running out of storage or memory
+{
+  nix.settings = {
+    min-free = 50 * 1024 * 1024 * 1024;
+    max-free = 100 * 1024 * 1024 * 1024;
+  };
+
+  systemd.services.nix-daemon.serviceConfig = {
+    MemoryAccounting = true;
+    MemoryMax = "90%";
+    OOMScoreAdjust = 500;
+  };
+}

nix/identities.nix

@@ -1,6 +1,7 @@
 [
   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPq2o9pbmLRGrOpAP76eYCAscmfakDC7wPm9fmsCCQM leana@vanadium"
-  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5OgvihLpGaenFmZpbflF+UFsyYTZDwBZqTmSYdquC3 root@vanadium"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOcIprcqvTCicHdtn9GFM77n7fTzhG0/nAEqMp5n6W+m root@vanadium"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5OgvihLpGaenFmZpbflF+UFsyYTZDwBZqTmSYdquC3 root@vanadium" # host
 
   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXzNdCA0zZ+WmeKZnhQSQtUcxnQhhDl59E3BPQfLj7Q leana@hydrogen"
   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMVDmEt/12u9U4QGDZBx/Sx8itzqfQ4zWJvcC3pRZqP root@hydrogen"

nix/overlays/nix-monitored.nix

@@ -1,10 +1,32 @@
 let
   sources = import ../../npins;
 in
-# The final nix is lix in this case
+final: prev:
-final: prev: {
+let
-  nix-monitored = sources.nix-monitored.asFlake.packages.${final.stdenv.hostPlatform.system}.default.override {
+  nix-monitored =
-    inherit (final) nix;
+    sources.nix-monitored.asFlake.packages.${final.stdenv.hostPlatform.system}.default.override
-    withNotify = false; # noisy, spams "command completed" even for nix shells
+      {
+        inherit (final)
+          nix # Use the nix the user wants, whether it's lix or nix
+          nix-output-monitor # don't use the nom pinned by nix-monitored
+          ;
+        withNotify = false;
+      };
+
+  keepNixOverride =
+    drv:
+    drv
+    // {
+      override = args: drv.override (builtins.removeAttrs args [ "nix" ]);
+    };
+in
+{
+  nixos-rebuild-ng = keepNixOverride (
+    prev.nixos-rebuild-ng.override {
+      nix = nix-monitored;
+    }
+  );
+  nix-direnv = prev.nix-direnv.override {
+    nix = nix-monitored;
   };
 }

nix/overlays/nix-tree.nix

@@ -1,8 +0,0 @@
-# The one in nixpkgs doesn't work
-# Getting nix-tree: user error (Failed parsing nix path-info output.)
-let
-  sources = import ../../npins;
-in
-final: _: {
-  nix-tree = (import sources.nix-tree).packages.${final.stdenv.hostPlatform.system}.default;
-}

npins/sources.json

@@ -162,22 +162,6 @@
       "hash": "1rdyjmxkvyqd5blbzbwfv2b99krx6rkpdzi1ckyby8i676gf9hv7",
       "frozen": true
     },
-    "nix-tree": {
-      "type": "GitRelease",
-      "repository": {
-        "type": "GitHub",
-        "owner": "utdemir",
-        "repo": "nix-tree"
-      },
-      "pre_releases": false,
-      "version_upper_bound": null,
-      "release_prefix": null,
-      "submodules": false,
-      "version": "v0.8.0",
-      "revision": "e7ef6623cf944b80e48196d74c6531dd79943652",
-      "url": "https://api.github.com/repos/utdemir/nix-tree/tarball/v0.8.0",
-      "hash": "1ag68xnszianrfinm56mf9bhvm0pglvnmlyffjr1pxrkji8d52nc"
-    },
     "nixos-hardware": {
       "type": "Git",
       "repository": {