weasel: nix-serve bind to 0.0.0.0

Proper override for haskell package

madness

Fix nix-serve-ng override

m/common/base.nix

@@ -11,11 +11,13 @@
     ./base/hw.nix
     ./base/net.nix
     ./base/nix.nix
+    ./base/sys-devices.nix
     ./base/ntp.nix
     ./base/rev.nix
     ./base/ssh.nix
     ./base/users.nix
     ./base/watchdog.nix
     ./base/zsh.nix
+    ./base/fish.nix
   ];
 }

m/common/base/env.nix

@@ -5,6 +5,8 @@
     vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
     nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
     ncdu config.boot.kernelPackages.perf ldns pv
+    nix-output-monitor
+    nixfmt-rfc-style
     # From bsckgs overlay
     osumb
   ];

m/common/base/fish.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.fish.enable = true;
+}

m/common/base/sys-devices.nix

@@ -0,0 +1,9 @@
+{
+  nix.settings.system-features = [ "sys-devices" ];
+
+  programs.nix-required-mounts.enable = true;
+  programs.nix-required-mounts.allowedPatterns.sys-devices.paths = [
+    "/sys/devices/system/cpu"
+    "/sys/devices/system/node"
+  ];
+}

m/common/base/users.nix

@@ -87,6 +87,12 @@
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIIFiqXqt88VuUfyANkZyLJNiuroIITaGlOOTMhVDKjf abonerib@bsc"
         ];
+        shell = pkgs.fish;
+        packages = with pkgs; [
+          starship
+          jujutsu
+          neovim
+        ];
       };
 
       vlopez = {

m/weasel/configuration.nix

@@ -1,9 +1,11 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [
     ../common/ssf.nix
     ../module/hut-substituter.nix
+    ./virtualization.nix
+    ./hydra.nix
   ];
 
   # Select this using the ID to avoid mismatches
@@ -30,4 +32,23 @@
       prefixLength = 24;
     } ];
   };
+
+  services.nix-serve = {
+    enable = true;
+    bindAddress = "0.0.0.0";
+    port = 5000;
+    package = pkgs.haskell.lib.overrideSrc (pkgs.haskell.packages.ghc96.nix-serve-ng.override { nix = pkgs.nixVersions.nix_2_28; }) {
+      src = pkgs.fetchgit {
+        url = "https://jungle.bsc.es/git/abonerib/nix-serve-ng.git";
+        rev = "9c056641300a826db66b66d7e584b2541d38927a";
+        hash = "sha256-y69ZchFiZOU71eyeljcQgLxkLk5JUzZfanq8Yzw4MkI=";
+      };
+      version = "unstable";
+    };
+
+    secretKeyFile = "/var/cache-priv-key.pem";
+    # Public key:
+    # 10.0.40.6:8jBhIdXEBap+Qo+vc1/fnV9vj43A2oDk839EEheRr/U=
+  };
+
 }

m/weasel/hydra.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, lib, ... }:
+{
+  services.hydra = {
+    enable = true;
+
+    # Wrap hydra so it puts quiet flag every time... This is dumb and annoying,
+    # but i can't override the systemd ExecStart without running into infinite
+    # recursion.
+    package = pkgs.symlinkJoin {
+      name = "hydra-quiet";
+      paths = [ pkgs.hydra ];
+      postBuild = ''
+        for prog in hydra-queue-runner hydra-evaluator ; do
+          prev=$(realpath $out/bin/$prog)
+          rm $out/bin/$prog
+          cat >$out/bin/$prog <<EOF
+        #!/bin/sh
+        args=()
+        for arg in "\$@"; do
+          if [ "\$arg" != "-v" ]; then
+            args+=("\$arg")
+          fi
+        done
+        exec $prev --quiet "\''${args[@]}"
+        EOF
+
+          chmod +x $out/bin/$prog
+        done
+      '';
+    };
+
+    hydraURL = "http://localhost:3001"; # externally visible URL
+    notificationSender = "hydra@jungle.bsc.es"; # e-mail of Hydra service
+    port = 3001;
+    # a standalone Hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+    buildMachinesFiles = [ ];
+    # you will probably also want, otherwise *everything* will be built from scratch
+    useSubstitutes = true;
+    listenHost = "0.0.0.0"; # Force IPv4
+  };
+
+  systemd.services.hydra-send-stats.enable = lib.mkForce false;
+
+  networking.firewall.allowedTCPPorts = [ config.services.hydra.port ];
+
+  nix.settings.extra-allowed-uris = [
+    "git+ssh://git@bscpm04.bsc.es"
+    "git+ssh://git@gitlab-internal.bsc.es"
+    "https://github.com"
+    "git+ssh://github.com"
+  ];
+}

m/weasel/virtualization.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # Enable common container config files in /etc/containers
+  virtualisation.containers.enable = true;
+  virtualisation = {
+    podman = {
+      enable = true;
+
+      # Required for containers under podman-compose to be able to talk to each other.
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  # We cannot use /home since nfs does not support fileattrs needed by podman
+  systemd.tmpfiles.settings = {
+    "podman-users" = lib.mapAttrs' (
+      name: value:
+      lib.nameValuePair ("/var/lib/podman-users/" + name) {
+        d = {
+          group = value.group;
+          mode = value.homeMode;
+          user = name;
+        };
+      }
+    ) (lib.filterAttrs (_: x: x.isNormalUser) config.users.users);
+  };
+
+  # Useful other development tools
+  environment.systemPackages = with pkgs; [
+    dive # look into docker image layers
+    podman-tui # status of containers in the terminal
+    podman-compose # start group of containers for dev
+  ];
+}

overlay.nix

@@ -16,7 +16,6 @@ let
     clangOmpss2NodesOmpv = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmpv; };
     clangOmpss2Unwrapped = callPackage ./pkgs/llvm-ompss2/clang.nix { };
     cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
-    clsparse = callPackage ./pkgs/clsparse/package.nix { };
     #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
     gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
     intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
@@ -63,7 +62,7 @@ let
   };
 
   tests = rec {
-    #hwloc = callPackage ./test/bugs/hwloc.nix { }; # Broken, no /sys
+    hwloc = callPackage ./test/bugs/hwloc.nix { };
     #sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
     hello-c = callPackage ./test/compilers/hello-c.nix { };
     hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };

pkgs/clsparse/install_target.patch

@@ -1,53 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 3d139ed..15ffc14 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -176,32 +179,22 @@ if( BUILD_clSPARSE OR BUILD_SAMPLES )
-   if( BUILD_clSPARSE )
-     message( STATUS "Setting up clSPARSE external..." )
- 
--    if ( BUILD_SAMPLES )
--      # If the user elects to build samples, then we must build and install clSPARSE
--      # The install location is set as a subdirectory of the SuperBuild
--      ExternalProject_Add(
--        clSPARSE
--        DEPENDS ${clSPARSE.Dependencies}
--        SOURCE_DIR ${PROJECT_SOURCE_DIR}/src
--        BINARY_DIR clSPARSE-build
--        INSTALL_DIR clSPARSE-package
--        CMAKE_ARGS ${clSPARSE.Cmake.Args} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
--        -DBUILD_CLVERSION=${BUILD_CLVERSION} -DCMAKE_INSTALL_PREFIX=<INSTALL_DIR>
--        -DUSE_SYSTEM_CL2HPP:BOOL=${USE_SYSTEM_CL2HPP}
--      )
--    else( )
--      # If the user does not want to build samples, then build clSPARSE but don't automatically
--      # install it
--      ExternalProject_Add(
--        clSPARSE
--        DEPENDS ${clSPARSE.Dependencies}
--        SOURCE_DIR ${PROJECT_SOURCE_DIR}/src
--        BINARY_DIR clSPARSE-build
--        CMAKE_ARGS ${clSPARSE.Cmake.Args} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
--        -DBUILD_CLVERSION=${BUILD_CLVERSION} -DUSE_SYSTEM_CL2HPP:BOOL=${USE_SYSTEM_CL2HPP}
--        INSTALL_COMMAND ""
--      )
--    endif( )
-+    ExternalProject_Add(
-+      clSPARSE
-+      DEPENDS ${clSPARSE.Dependencies}
-+      SOURCE_DIR ${PROJECT_SOURCE_DIR}/src
-+      BINARY_DIR clSPARSE-build
-+      INSTALL_DIR clSPARSE-package
-+      CMAKE_ARGS ${clSPARSE.Cmake.Args} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-+      -DBUILD_CLVERSION=${BUILD_CLVERSION} -DCMAKE_INSTALL_PREFIX=<INSTALL_DIR>
-+      -DUSE_SYSTEM_CL2HPP:BOOL=${USE_SYSTEM_CL2HPP}
-+    )
-+
-+    install(
-+      DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/clSPARSE-package/
-+      DESTINATION ${CMAKE_INSTALL_PREFIX}
-+      USE_SOURCE_PERMISSIONS
-+    )
- 
-   endif( )
- 

pkgs/clsparse/package.nix

@@ -1,70 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  boost,
-  gtest,
-  ocl-icd,
-  opencl-headers,
-  opencl-clhpp,
-  cmake,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "clsparse";
-  version = "0.10.2.0";
-
-  src = fetchFromGitHub {
-    owner = "clMathLibraries";
-    repo = "clSPARSE";
-    rev = "v${version}";
-    hash = "sha256-jIauCtUyPEIx7pFI3qH0WagV+t/fvro0OsGgONBJm0s=";
-  };
-
-  patches = [
-    ./pass_include_dir.patch
-    ./install_target.patch
-    (fetchpatch {
-      name = "remove-gettypecode.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/clMathLibraries/clSPARSE/pull/210.patch";
-      hash = "sha256-9Q+tk7RMdWE4MCnbvWlsI0MIgBYKIWR2jIC1bICtIjU=";
-    })
-  ];
-
-  postInstallPhase = ''
-    mv $installDir/lib64 lib
-    ln -s lib/ lib64
-  '';
-
-  env.NIX_CFLAGS_COMPILE = "-std=c++17";
-
-  nativeBuildInputs = [
-    cmake
-  ];
-
-  buildInputs = [
-    boost
-    ocl-icd
-    opencl-headers
-    opencl-clhpp
-  ];
-
-  cmakeFlags = [
-    "-DBUILD_Boost=OFF"
-    "-DBUILD_gMock=OFF"
-    "-DBUILD_MTX=OFF"
-    "-DBUILD_SAMPLES=OFF"
-    "-DUSE_SYSTEM_CL2HPP=ON"
-    "-DGMOCK_ROOT=${gtest}"
-    "-DGTEST_INCLUDE_DIR=${gtest.src}/googletest/include"
-  ];
-
-  meta = {
-    description = "A software library containing Sparse functions written in OpenCL";
-    homepage = "https://github.com/clMathLibraries/clSPARSE";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ leixb ];
-    platforms = lib.platforms.all;
-  };
-}

pkgs/clsparse/pass_include_dir.patch

@@ -1,14 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 3d139ed..b7ea2d3 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -132,6 +132,9 @@ else( )
-       set( GMOCK_ROOT "$ENV{GMOCK_ROOT}" )
-     endif( )
-     list( APPEND clSPARSE.Cmake.Args -DGTEST_ROOT=${GMOCK_ROOT} )
-+    if( DEFINED GTEST_INCLUDE_DIR )
-+      list( APPEND clSPARSE.Cmake.Args -DGTEST_INCLUDE_DIR=${GTEST_INCLUDE_DIR} )
-+    endif( )
-   endif( )
- endif( )
- 

test/bugs/hwloc.nix

@@ -6,6 +6,7 @@
 
 stdenv.mkDerivation {
   name = "hwloc-test";
+  requiredSystemFeatures = [ "sys-devices" ];
 
   src = ./.;
 
@@ -14,7 +15,7 @@ stdenv.mkDerivation {
   buildPhase = ''
     ls -l /sys
     gcc -lhwloc hwloc.c -o hwloc
-    strace ./hwloc
+    strace ./hwloc > $out
   '';
 
 }

test/compilers/clang-openmp-ld.nix

@@ -23,9 +23,8 @@ in stdenv.mkDerivation {
   dontUnpack = true;
   dontConfigure = true;
 
-  # nOS-V requires access to /sys/devices to request NUMA information. It will
-  # fail to run otherwise, so we disable the sandbox for this test.
-  __noChroot = true;
+  # nOS-V requires access to /sys/devices to request NUMA information
+  requiredSystemFeatures = [ "sys-devices" ];
 
   buildInputs = [ openmp ];
 

test/compilers/clang-openmp-nosv.nix

@@ -36,9 +36,8 @@ in stdenv.mkDerivation {
   dontUnpack = true;
   dontConfigure = true;
 
-  # nOS-V requires access to /sys/devices to request NUMA information. It will
-  # fail to run otherwise, so we disable the sandbox for this test.
-  __noChroot = true;
+  # nOS-V requires access to /sys/devices to request NUMA information
+  requiredSystemFeatures = [ "sys-devices" ];
 
   buildInputs = [ nosv ];
 

test/compilers/clang-openmp.nix

@@ -24,9 +24,8 @@ in stdenv.mkDerivation {
   dontUnpack = true;
   dontConfigure = true;
 
-  # nOS-V requires access to /sys/devices to request NUMA information. It will
-  # fail to run otherwise, so we disable the sandbox for this test.
-  __noChroot = true;
+  # nOS-V requires access to /sys/devices to request NUMA information
+  requiredSystemFeatures = [ "sys-devices" ];
 
   buildPhase = ''
     set -x

test/compilers/ompss2.nix

@@ -25,9 +25,10 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
   #NIX_DEBUG = 1;
   buildInputs = [ ]; #strace gdb;
-  # NODES requires access to /sys/devices to request NUMA information. It will
-  # fail to run otherwise, so we disable the sandbox for this test.
-  __noChroot = true;
+
+  # NODES requires access to /sys/devices to request NUMA information
+  requiredSystemFeatures = [ "sys-devices" ];
+
   buildPhase = ''
     set -x
     #$CC -v