Limit slurm partition users with AllowGroups

Fixes: rarias/jungle#245

flake.nix

@@ -5,14 +5,19 @@
 
   outputs = { self, nixpkgs, ... }:
 let
-  forAllSystems = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "armv6l-linux" "armv7l-linux" "i686-linux" "riscv64-linux" ];
-
   mkConf = name: nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
     specialArgs = { inherit nixpkgs; theFlake = self; };
     modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
   };
-  in
+  # For now we only support x86
+  system = "x86_64-linux";
+  pkgs = import nixpkgs {
+    inherit system;
+    overlays = [ self.overlays.default ];
+    config.allowUnfree = true;
+  };
+in
   {
     nixosConfigurations = {
       hut     = mkConf "hut";
@@ -33,15 +38,9 @@ let
     overlays.default = self.bscOverlay;
 
     # full nixpkgs with our overlay applied
-    legacyPackages = forAllSystems (system:
-      import nixpkgs {
-        inherit system;
-        overlays = [ self.overlays.default ];
-        config.allowUnfree = true;
-      }
-    );
+    legacyPackages.${system} = pkgs;
 
-    hydraJobs = self.legacyPackages.x86_64-linux.bsc.hydraJobs;
+    hydraJobs = self.legacyPackages.${system}.bsc.hydraJobs;
 
     # propagate nixpkgs lib, so we can do bscpkgs.lib
     lib = nixpkgs.lib // {

m/common/base/users.nix

@@ -134,7 +134,7 @@
         home = "/home/Computational/varcila";
         description = "Vincent Arcila";
         group = "Computational";
-        hosts = [ "apex" "hut" "tent" "fox" "owl1" "owl2" ];
+        hosts = [ "apex" "hut" "tent" "fox" ];
         hashedPassword = "$6$oB0Tcn99DcM4Ch$Vn1A0ulLTn/8B2oFPi9wWl/NOsJzaFAWjqekwcuC9sMC7cgxEVb.Nk5XSzQ2xzYcNe5MLtmzkVYnRS1CqP39Y0";
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
@@ -224,6 +224,8 @@
 
     groups = {
       Computational = { gid = 564; };
+      fox = { gid = 565; };
+      owl = { gid = 566; };
       tracing = { };
     };
   };

m/hut/gitlab-runner.nix

@@ -61,8 +61,6 @@
         registrationFlags = [
           # Increase build log length to 64 MiB
           "--output-limit 65536"
-          # Allow the runner to be used in multiple projects
-          "--locked=false"
         ];
         preBuildScript = pkgs.writeScript "setup-container" ''
           mkdir -p -m 0755 /nix/var/log/nix/drvs

m/hut/ompss2-timer.nix

@@ -29,7 +29,6 @@
     closing = pkgs.writeText "closing.txt"
     ''
       Subject: OmpSs-2 release enters closing period
-      To: star@bsc.es
 
       Hi,
 
@@ -43,7 +42,6 @@
     freeze = pkgs.writeText "freeze.txt"
     ''
       Subject: OmpSs-2 release enters freeze period
-      To: star@bsc.es
 
       Hi,
 
@@ -57,7 +55,6 @@
     release = pkgs.writeText "release.txt"
     ''
       Subject: OmpSs-2 release now
-      To: star@bsc.es
 
       Hi,
 
@@ -72,7 +69,7 @@
         script = ''
           set -eu
           set -o pipefail
-          cat ${mail} | ${config.security.wrapperDir}/sendmail -t star@bsc.es
+          cat ${mail} | ${config.security.wrapperDir}/sendmail star@bsc.es
         '';
         serviceConfig = {
           Type = "oneshot";

m/module/jungle-users.nix

@@ -17,8 +17,13 @@ with lib;
     allowedUser = host: userConf: builtins.elem host userConf.hosts;
     filterUsers = host: users: filterAttrs (n: v: allowedUser host v) users;
     removeHosts = users: mapAttrs (n: v: builtins.removeAttrs v [ "hosts" ]) users;
+    addExtraGroups = mapAttrs (_: user: user // {
+        extraGroups = (user.extraGroups or [ ])
+          ++ (lib.optionals (allowedUser "fox" user) [ "fox" ])
+          ++ (lib.optionals (allowedUser "owl1" user || allowedUser "owl2" user) [ "owl" ]);
+      });
     currentHost = config.networking.hostName;
   in {
-    users.users = removeHosts (filterUsers currentHost config.users.jungleUsers);
+    users.users = removeHosts (addExtraGroups (filterUsers currentHost config.users.jungleUsers));
   };
 }

m/module/slurm-common.nix

@@ -10,8 +10,8 @@
     ];
 
     partitionName = [
-      "owl Nodes=owl[1-2]     Default=YES DefaultTime=01:00:00 MaxTime=INFINITE State=UP"
-      "fox Nodes=fox          Default=NO  DefaultTime=01:00:00 MaxTime=INFINITE State=UP"
+      "owl Nodes=owl[1-2]     Default=YES DefaultTime=01:00:00 MaxTime=INFINITE State=UP AllowGroups=wheel,owl"
+      "fox Nodes=fox          Default=NO  DefaultTime=01:00:00 MaxTime=INFINITE State=UP AllowGroups=wheel,fox"
     ];
 
     # See slurm.conf(5) for more details about these options.

overlay.nix

@@ -61,16 +61,6 @@ let
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
-    upx = prev.upx.overrideAttrs {
-      version = "5.1.0";
-      src = final.fetchFromGitHub {
-        owner = "upx";
-        repo = "upx";
-        tag = "v5.1.0";
-        fetchSubmodules = true;
-        hash = "sha256-FQtDHsbZ/JrgRLwc2Wd2F5ZcBdqrU0YIT9hGQ0k0D+w=";
-      };
-    };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
   };
 

pkgs/llvm-ompss2/clang.nix

@@ -3,7 +3,6 @@
 , lib
 , fetchFromGitHub
 , cmake
-, ninja
 , bash
 , python3
 , perl
@@ -63,7 +62,6 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [
     bash
     cmake
-    ninja
     elfutils
     llvmPackages_latest.lld
     pkg-config

pkgs/nix-portable/default.nix

@@ -19,16 +19,6 @@ with builtins;
   compression ? "zstd -19 -T0",
   lib ? pkgs.lib,
   pkgs ? import <nixpkgs> {},
-
-  # pkgs set from the host system (just for eval in installDynamic)
-  pkgsHost ?
-    if stdenv.hostPlatform == stdenv.buildPlatform then
-      pkgs
-    else
-      import pkgs.path {
-        system = pkgs.stdenv.hostPlatform.system;
-      },
-
   # hardcode executable to run. Useful when creating a bundle.
   bundledPackage ? null,
 
@@ -59,7 +49,7 @@ let
     in
     stdenv.mkDerivation {
       name = "nix-portable-store-tarball";
-      nativeBuildInputs = [ perl pkgs.zstd ];
+      nativeBuildInputs = [ perl zstd ];
       exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
       buildCommand = ''
         storePaths=$(cat ${closureInfo}/store-paths)
@@ -96,9 +86,9 @@ let
   '';
 
   installDynamic = pkgname: let
-    out = builtins.unsafeDiscardStringContext pkgsHost.${pkgname}.out.outPath;
+    out = pkgs.${pkgname}.out;
   in ''
-    if [ ! -e \$store${lib.removePrefix "/nix/store" out} ] ; then
+    if [ ! -e \$store${lib.removePrefix "/nix/store" pkgs.${pkgname}.out} ] ; then
       debug "Installing ${pkgname}"
       \$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix build --impure --no-link --expr "
         (import ${nixpkgsSrc} {}).${pkgname}.out
@@ -110,9 +100,7 @@ let
     export PATH="${out}/bin:\$PATH"
   '';
 
-  caBundleZstd = pkgs.runCommand "cacerts" {
-    nativeBuildInputs = [ pkgs.zstd ];
-  } "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | zstd -19 > $out";
+  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
 
   bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
   nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
@@ -264,7 +252,7 @@ let
     fi
 
     # Override $SHELL with nix bashInteractive
-    export SHELL="${builtins.unsafeDiscardStringContext pkgsHost.bashInteractive.out.outPath}/bin/bash"
+    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
     export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "
 
     # unset bash function aliases
@@ -309,7 +297,7 @@ let
 
 
     collectBinds(){
-      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch /home"
+      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch"
 
       toBind=""
       for p in \$pathsTopLevel; do
@@ -603,7 +591,7 @@ let
   runtimeScriptEscaped = replaceStrings ["\""] ["\\\""] runtimeScript;
 
   nixPortable = pkgs.runCommand pname {
-    nativeBuildInputs = [unixtools.xxd unzip pkgs.zip];
+    nativeBuildInputs = [unixtools.xxd unzip];
 
     meta = {
       homepage = "https://github.com/DavHau/nix-portable";
@@ -631,7 +619,7 @@ let
 
     unzip -vl $out/bin/nix-portable.zip
 
-    zip="zip -0"
+    zip="${zip}/bin/zip -0"
     $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
     $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
     $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
@@ -642,7 +630,7 @@ let
     fp=$(sha256sum $out/bin/nix-portable.zip | cut -d " "  -f 1)
     sed -i "s/_FINGERPRINT_PLACEHOLDER_/$fp/g" $out/bin/nix-portable.zip
     # fix broken zip header due to manual modification
-    zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
+    ${zip}/bin/zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
 
     rm $out/bin/nix-portable.zip
     executable=${if bundledPackage == null then "" else bundledExe}