hades: CI build machine

{
  networking.hostName = "hades";
  networking.hostId = "8519e7ed";
  nixpkgs.hostPlatform = "x86_64-linux";
  system.stateVersion = "25.05";

  <<config>>

  _class = "nixos";
}

boot.initrd.availableKernelModules = [
  "xhci_pci"
  "ahci"
  "nvme"
  "sd_mod"
];
boot.kernelModules = [ "kvm-intel" ];

This comes from nixos-generate-config based on detected hardware in the machine.

fileSystems."/" = {
  device = "rpool/crypt/root";
  fsType = "zfs";
};

fileSystems."/nix" = {
  device = "rpool/crypt/nix";
  fsType = "zfs";
};

mjm.zfs.enable = true;
mjm.zfs.encryption.rootPool = "rpool";

hades uses ZFS. For the most part, I let ZFS handle mounting datasets to the right place, but / and /nix need to be handled special, so they are set to mountpoint=legacy and mounted manually. hades is using ZFS encryption with support from my ZFS module.

boot.zfs.extraPools = [ "slow" ];

hades also has a spinning disk in it, which is leftover from when it used to run VMs and needed to do replication for backups. Right now, it's not really being used, so maybe it should be repurposed.

fileSystems."/boot" = {
  device = "/dev/disk/by-partlabel/boot";
  fsType = "vfat";
  options = [
    "fmask=0077"
    "dmask=0077"
  ];
};

mjm.secureboot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.lanzaboote.measuredBoot.enable = false;

hades uses my secureboot module to set up Lanzaboote for SecureBoot. It can't use measured boot, because the TPM in this machine doesn't support the necessary operation.

Lanzaboote is built on systemd-boot, so it needs the EFI system partition mounted at /boot.

mjm.server.enable = true;

This machine is running as a server, so it needs the common server infrastructure for my lab.

mjm.spire.agent.tpm.publicKeyHash =
  "766a33e8e31ec28cf179647cc70a5d6464b055f9c39e2fea897d0fa195dc4f0a";

Any of my machines that has a TPM uses it to attest to the SPIRE server and get its node identity. The public key hash here is specified only to create a registration entry that aliases this public key identity to the hostname of the machine.

mjm.forgejo.runner.enable = true;
nix.settings.max-jobs = 6;

hades is the fastest of my Dell OptiPlex servers, sporting an 8th-gen Intel i7 and 48GiB of RAM. And ironically for that it ends up sitting idle most of time, because its purpose is to run CI builds via forgejo-runner. Most of these builds are for when my Nix configurations change.

Due to my use of microVMs to isolate the different services I run, evaluating the Nix code for my machines (particularly apollo) needs a lot of free memory, since it consists of 40ish full NixOS configurations. So this machine is provisioned to support that and hopefully evaluate them as quickly as possible.

mjm.radicle.enable = true;
mjm.radicle.ci.enable = true;

While I primarily use Forgejo to host my Git repositories, I'm also interested in Radicle's distributed approach. I don't think it's ready for primetime yet, but I did try to experiment with whether it could handle what I do with my Nix configs. So I setup a CI node on hades to try it out.

mjm.nut = {
  enable = true;
  connectedUPSName = "smart500";
};

All physical hosts in my homelab run NUT to be able to be shutdown properly in the case of power loss. Since I have two UPSes in the rack, each machine is configured with the one it is connected to, so that will be the one that it monitors.