Create directories in /vault for tent users

Add software RAID in tent using 3 disks
Add access to tent to all hut users too
2025-06-03 19:10:34 +02:00 · 2025-06-03 19:00:26 +02:00 · 2025-06-03 18:16:57 +02:00 · 2025-06-03 18:16:52 +02:00 · 2025-06-03 18:05:41 +02:00 · 2025-06-03 18:05:34 +02:00
73 changed files with 1521 additions and 911 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 *.swp
 /result
+/misc
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1720546205,
-        "narHash": "sha256-boCXsjYVxDviyzoEyAk624600f3ZBo/DKtUdvMTpbGY=",
+        "lastModified": 1723293904,
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "de96bd907d5fbc3b14fc33ad37d1b9a3cb15edc6",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
        "type": "github"
      },
      "original": {
@@ -30,11 +30,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1713974364,
-        "narHash": "sha256-ilZTVWSaNP1ibhQIIRXE+q9Lj2XOH+F9W3Co4QyY1eU=",
+        "lastModified": 1732868163,
+        "narHash": "sha256-qck4h298AgcNI6BnGhEwl26MTLXjumuJVr+9kak7uPo=",
        "ref": "refs/heads/master",
-        "rev": "de89197a4a7b162db7df9d41c9d07759d87c5709",
-        "revCount": 937,
+        "rev": "6782fc6c5b5a29e84a7f2c2d1064f4bcb1288c0f",
+        "revCount": 952,
        "type": "git",
        "url": "https://git.sr.ht/~rodarima/bscpkgs"
      },
@@ -88,16 +88,16 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1720957393,
-        "narHash": "sha256-oedh2RwpjEa+TNxhg5Je9Ch6d3W1NKi7DbRO1ziHemA=",
+        "lastModified": 1736867362,
+        "narHash": "sha256-i/UJ5I7HoqmFMwZEH6vAvBxOrjjOJNU739lnZnhUln8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "693bc46d169f5af9c992095736e82c3488bf7dbb",
+        "rev": "9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-24.11",
        "repo": "nixpkgs",
        "type": "github"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 {
  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
    agenix.url = "github:ryantm/agenix";
    agenix.inputs.nixpkgs.follows = "nixpkgs";
    bscpkgs.url = "git+https://git.sr.ht/~rodarima/bscpkgs";
@@ -18,6 +18,7 @@ in
  {
    nixosConfigurations = {
      hut     = mkConf "hut";
+      tent    = mkConf "tent";
      owl1    = mkConf "owl1";
      owl2    = mkConf "owl2";
      eudy    = mkConf "eudy";
@@ -25,6 +26,7 @@ in
      bay     = mkConf "bay";
      lake2   = mkConf "lake2";
      raccoon = mkConf "raccoon";
+      fox     = mkConf "fox";
    };

    packages.x86_64-linux = self.nixosConfigurations.hut.pkgs // {
--- a/keys.nix
+++ b/keys.nix
@@ -9,9 +9,11 @@ rec {
    koro  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIImiTFDbxyUYPumvm8C4mEnHfuvtBY1H8undtd6oDd67 koro";
    bay   = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICvGBzpRQKuQYHdlUQeAk6jmdbkrhmdLwTBqf3el7IgU bay";
    lake2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINo66//S1yatpQHE/BuYD/Gfq64TY7ZN5XOGXmNchiO0 lake2";
+    fox   = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwItIk5uOJcQEVPoy/CVGRzfmE1ojrdDcI06FrU4NFT fox";
  };

  hostGroup = with hosts; rec {
+    untrusted  = [ fox ];
    compute    = [ owl1 owl2 ];
    playground = [ eudy koro ];
    storage    = [ bay lake2 ];
--- a/m/bay/configuration.nix
+++ b/m/bay/configuration.nix
@@ -2,7 +2,7 @@

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix
    ../module/monitoring.nix
  ];

--- a/m/common/base/ssh.nix
+++ b/m/common/base/ssh.nix
@@ -11,5 +11,8 @@ in
  programs.ssh.knownHosts = hostsKeys // {
    "gitlab-internal.bsc.es".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF9arsAOSRB06hdy71oTvJHG2Mg8zfebADxpvc37lZo3";
    "bscpm03.bsc.es".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM2NuSUPsEhqz1j5b4Gqd+MWFnRqyqY57+xMvBUqHYUS";
+    "bscpm04.bsc.es".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPx4mC0etyyjYUT2Ztc/bs4ZXSbVMrogs1ZTP924PDgT";
+    "glogin1.bsc.es".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsHsZGCrzpd4QDVn5xoDOtrNBkb0ylxKGlyBt6l9qCz";
+    "glogin2.bsc.es".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsHsZGCrzpd4QDVn5xoDOtrNBkb0ylxKGlyBt6l9qCz";
  };
 }
--- a/m/common/base/users.nix
+++ b/m/common/base/users.nix
@@ -56,7 +56,7 @@
        home = "/home/Computational/rpenacob";
        description = "Raúl Peñacoba";
        group = "Computational";
-        hosts = [ "owl1" "owl2" "hut" ];
+        hosts = [ "owl1" "owl2" "hut" "tent" ];
        hashedPassword = "$6$TZm3bDIFyPrMhj1E$uEDXoYYd1z2Wd5mMPfh3DZAjP7ztVjJ4ezIcn82C0ImqafPA.AnTmcVftHEzLB3tbe2O4SxDyPSDEQgJ4GOtj/";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYfXg37mauGeurqsLpedgA2XQ9d4Nm0ZGo/hI1f7wwH rpenacob@bsc"
@@ -69,7 +69,7 @@
        home = "/home/Computational/anavarro";
        description = "Antoni Navarro";
        group = "Computational";
-        hosts = [ "hut" "raccoon" ];
+        hosts = [ "hut" "tent" "raccoon" "fox" ];
        hashedPassword = "$6$QdNDsuLehoZTYZlb$CDhCouYDPrhoiB7/seu7RF.Gqg4zMQz0n5sA4U1KDgHaZOxy2as9pbIGeF8tOHJKRoZajk5GiaZv0rZMn7Oq31";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILWjRSlKgzBPZQhIeEtk6Lvws2XNcYwHcwPv4osSgst5 anavarro@ssfhead"
@@ -82,7 +82,7 @@
        home = "/home/Computational/abonerib";
        description = "Aleix Boné";
        group = "Computational";
-        hosts = [ "owl1" "owl2" "hut" "raccoon" ];
+        hosts = [ "owl1" "owl2" "hut" "tent" "raccoon" "fox" ];
        hashedPassword = "$6$V1EQWJr474whv7XJ$OfJ0wueM2l.dgiJiiah0Tip9ITcJ7S7qDvtSycsiQ43QBFyP4lU0e0HaXWps85nqB4TypttYR4hNLoz3bz662/";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIIFiqXqt88VuUfyANkZyLJNiuroIITaGlOOTMhVDKjf abonerib@bsc"
@@ -108,12 +108,38 @@
        home = "/home/Computational/dbautist";
        description = "Dylan Bautista Cases";
        group = "Computational";
-        hosts = [ "hut" "raccoon" ];
+        hosts = [ "hut" "tent" "raccoon" ];
        hashedPassword = "$6$a2lpzMRVkG9nSgIm$12G6.ka0sFX1YimqJkBAjbvhRKZ.Hl090B27pdbnQOW0wzyxVWySWhyDDCILjQELky.HKYl9gqOeVXW49nW7q/";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAb+EQBoS98zrCwnGKkHKwMLdYABMTqv7q9E0+T0QmkS dbautist@bsc-848818791"
        ];
      };
+
+      dalvare1 = {
+        uid = 2758;
+        isNormalUser = true;
+        home = "/home/Computational/dalvare1";
+        description = "David Álvarez";
+        group = "Computational";
+        hosts = [ "hut" "tent" "fox" ];
+        hashedPassword = "$6$mpyIsV3mdq.rK8$FvfZdRH5OcEkUt5PnIUijWyUYZvB1SgeqxpJ2p91TTe.3eQIDTcLEQ5rxeg.e5IEXAZHHQ/aMsR5kPEujEghx0";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGEfy6F4rF80r4Cpo2H5xaWqhuUZzUsVsILSKGJzt5jF dalvare1@ssfhead"
+        ];
+      };
+
+      varcila = {
+        uid = 5650;
+        isNormalUser = true;
+        home = "/home/Computational/varcila";
+        description = "Vincent Arcila";
+        group = "Computational";
+        hosts = [ "hut" "tent" "fox" ];
+        hashedPassword = "$6$oB0Tcn99DcM4Ch$Vn1A0ulLTn/8B2oFPi9wWl/NOsJzaFAWjqekwcuC9sMC7cgxEVb.Nk5XSzQ2xzYcNe5MLtmzkVYnRS1CqP39Y0";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
+        ];
+      };
    };

    groups = {
--- a/m/common/ssf.nix
+++ b/m/common/ssf.nix
@@ -0,0 +1,9 @@
+{
+  # Provides the base system for a xeon node in the SSF rack.
+  imports = [
+    ./xeon.nix
+    ./ssf/fs.nix
+    ./ssf/net.nix
+    ./ssf/ssh.nix
+  ];
+}
--- a/m/common/xeon/fs.nix
+++ b/m/common/xeon/fs.nix
--- a/m/common/xeon/net.nix
+++ b/m/common/xeon/net.nix
@@ -11,7 +11,7 @@

    proxy = {
      default = "http://hut:23080/";
-      noProxy = "127.0.0.1,localhost,internal.domain,10.0.40.40";
+      noProxy = "127.0.0.1,localhost,internal.domain,10.0.40.40,hut";
      # Don't set all_proxy as go complains and breaks the gitlab runner, see:
      # https://github.com/golang/go/issues/16715
      allProxy = null;
@@ -34,37 +34,37 @@
      # Node Entry for node: mds01 (ID=72)
      10.0.40.40              bay mds01 mds01-eth0
      10.0.42.40              bay-ib mds01-ib0
-      10.0.40.141             bay-ipmi mds01-ipmi0
+      10.0.40.141             bay-ipmi mds01-ipmi0 mds01-ipmi
      
      # Node Entry for node: oss01 (ID=73)
      10.0.40.41              oss01 oss01-eth0
      10.0.42.41              oss01-ib0
-      10.0.40.142             oss01-ipmi0
+      10.0.40.142             oss01-ipmi0 oss01-ipmi
      
      # Node Entry for node: oss02 (ID=74)
      10.0.40.42              lake2 oss02 oss02-eth0
      10.0.42.42              lake2-ib oss02-ib0
-      10.0.40.143             lake2-ipmi oss02-ipmi0
+      10.0.40.143             lake2-ipmi oss02-ipmi0 oss02-ipmi
      
      # Node Entry for node: xeon01 (ID=15)
      10.0.40.1               owl1 xeon01 xeon01-eth0
      10.0.42.1               owl1-ib xeon01-ib0
-      10.0.40.101             owl1-ipmi xeon01-ipmi0
+      10.0.40.101             owl1-ipmi xeon01-ipmi0 xeon01-ipmi
      
      # Node Entry for node: xeon02 (ID=16)
      10.0.40.2               owl2 xeon02 xeon02-eth0
      10.0.42.2               owl2-ib xeon02-ib0
-      10.0.40.102             owl2-ipmi xeon02-ipmi0
+      10.0.40.102             owl2-ipmi xeon02-ipmi0 xeon02-ipmi
      
      # Node Entry for node: xeon03 (ID=17)
      10.0.40.3               xeon03 xeon03-eth0
      10.0.42.3               xeon03-ib0
-      10.0.40.103             xeon03-ipmi0
+      10.0.40.103             xeon03-ipmi0 xeon03-ipmi
      
      # Node Entry for node: xeon04 (ID=18)
      10.0.40.4               xeon04 xeon04-eth0
      10.0.42.4               xeon04-ib0
-      10.0.40.104             xeon04-ipmi0
+      10.0.40.104             xeon04-ipmi0 xeon04-ipmi
      
      # Node Entry for node: xeon05 (ID=19)
      10.0.40.5               koro xeon05 xeon05-eth0
@@ -74,17 +74,17 @@
      # Node Entry for node: xeon06 (ID=20)
      10.0.40.6               xeon06 xeon06-eth0
      10.0.42.6               xeon06-ib0
-      10.0.40.106             xeon06-ipmi0
+      10.0.40.106             xeon06-ipmi0 xeon06-ipmi
      
      # Node Entry for node: xeon07 (ID=21)
      10.0.40.7               hut xeon07 xeon07-eth0
      10.0.42.7               hut-ib xeon07-ib0
-      10.0.40.107             hut-ipmi xeon07-ipmi0
+      10.0.40.107             hut-ipmi xeon07-ipmi0 xeon07-ipmi
      
      # Node Entry for node: xeon08 (ID=22)
      10.0.40.8               eudy xeon08 xeon08-eth0
      10.0.42.8               eudy-ib xeon08-ib0
-      10.0.40.108             eudy-ipmi xeon08-ipmi0
+      10.0.40.108             eudy-ipmi xeon08-ipmi0 xeon08-ipmi
    '';
  };
 }
--- a/m/common/ssf/ssh.nix
+++ b/m/common/ssf/ssh.nix
@@ -0,0 +1,8 @@
+{
+  # Connect to intranet git hosts via proxy
+  programs.ssh.extraConfig = ''
+    # Connect to BSC machines via hut proxy too
+    Host amdlogin1.bsc.es armlogin1.bsc.es hualogin1.bsc.es glogin1.bsc.es glogin2.bsc.es fpgalogin1.bsc.es
+      ProxyCommand nc -X connect -x hut:23080 %h %p
+  '';
+}
--- a/m/common/xeon.nix
+++ b/m/common/xeon.nix
@@ -1,10 +1,7 @@
 {
-  # Provides the base system for a xeon node.
+  # Provides the base system for a xeon node, not necessarily in the SSF rack.
  imports = [
    ./base.nix
    ./xeon/console.nix
-    ./xeon/fs.nix
-    ./xeon/net.nix
-    ./xeon/ssh.nix
  ];
 }
--- a/m/common/xeon/ssh.nix
+++ b/m/common/xeon/ssh.nix
@@ -1,8 +0,0 @@
-{
-  # Connect to intranet git hosts via proxy
-  programs.ssh.extraConfig = ''
-    Host bscpm02.bsc.es bscpm03.bsc.es gitlab-internal.bsc.es alya.gitlab.bsc.es
-      User git
-      ProxyCommand nc -X connect -x hut:23080 %h %p
-  '';
-}
--- a/m/eudy/configuration.nix
+++ b/m/eudy/configuration.nix
@@ -2,7 +2,7 @@

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix
    #(modulesPath + "/installer/netboot/netboot-minimal.nix")

    ./kernel/kernel.nix
--- a/m/fox/configuration.nix
+++ b/m/fox/configuration.nix
@@ -0,0 +1,76 @@
+{ lib, config, pkgs, ... }:
+
+{
+  imports = [
+    ../common/base.nix
+    ../common/xeon/console.nix
+    ../module/emulation.nix
+  ];
+
+  # Select the this using the ID to avoid mismatches
+  boot.loader.grub.device = "/dev/disk/by-id/wwn-0x500a07514b0c1103";
+
+  # No swap, there is plenty of RAM
+  swapDevices = lib.mkForce [];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.kernelModules = [ "kvm-amd" ];
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.updateMicrocode = lib.mkForce false;
+
+  networking = {
+    defaultGateway = "147.83.30.130";
+    nameservers = [ "8.8.8.8" ];
+    hostName = "fox";
+    interfaces.enp1s0f0np0.ipv4.addresses = [
+      {
+        # UPC network
+        # Public IP configuration:
+        # - Hostname: fox.ac.upc.edu
+        # - IP: 147.83.30.141
+        # - Gateway: 147.83.30.130
+        # - NetMask: 255.255.255.192
+        # Private IP configuration for BMC:
+        # - Hostname: fox-ipmi.ac.upc.edu
+        # - IP: 147.83.35.27
+        # - Gateway: 147.83.35.2
+        # - NetMask: 255.255.255.0
+        address = "147.83.30.141";
+        prefixLength = 26; # 255.255.255.192
+      }
+    ];
+    extraHosts = ''
+      147.83.30.141   fox.ac.upc.edu
+      147.83.35.27    fox-ipmi.ac.upc.edu
+    '';
+  };
+
+  # Configure Nvidia driver to use with CUDA
+  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.production;
+  hardware.graphics.enable = true;
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.nvidia.acceptLicense = true;
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  # Mount NVME disks
+  fileSystems."/nvme0" = { device = "/dev/disk/by-label/nvme0"; fsType = "ext4"; };
+  fileSystems."/nvme1" = { device = "/dev/disk/by-label/nvme1"; fsType = "ext4"; };
+
+  # Make a /nvme{0,1}/$USER directory for each user.
+  systemd.services.create-nvme-dirs = let
+    # Take only normal users in fox
+    users = lib.filterAttrs (_: v: v.isNormalUser) config.users.users;
+    commands = lib.concatLists (lib.mapAttrsToList
+      (_: user: [
+        "install -d -o ${user.name} -g ${user.group} -m 0755 /nvme{0,1}/${user.name}"
+      ]) users);
+    script = pkgs.writeShellScript "create-nvme-dirs.sh" (lib.concatLines commands);
+  in {
+    enable = true;
+    wants = [ "local-fs.target" ];
+    after = [ "local-fs.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.ExecStart = script;
+  };
+}
--- a/m/hut/configuration.nix
+++ b/m/hut/configuration.nix
@@ -1,8 +1,8 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix

    ../module/ceph.nix
    ../module/debuginfod.nix
@@ -17,11 +17,28 @@
    ./gitea.nix
    ./msmtp.nix
    ./postgresql.nix
+    ./nginx.nix
+    ./p.nix
    #./pxe.nix
  ];

  # Select the this using the ID to avoid mismatches
-  boot.loader.grub.device = "/dev/disk/by-id/ata-INTEL_SSDSC2BB240G7_PHDV6462004Y240AGN";
+  boot.loader.grub.device = "/dev/disk/by-id/wwn-0x55cd2e414d53567f";
+
+  fileSystems = {
+    "/" = lib.mkForce {
+      device = "/dev/disk/by-label/nvme";
+      fsType = "ext4";
+      neededForBoot = true;
+      options = [ "noatime" ];
+    };
+
+    "/boot" = lib.mkForce {
+      device = "/dev/disk/by-label/nixos-boot";
+      fsType = "ext4";
+      neededForBoot = true;
+    };
+  };

  networking = {
    hostName = "hut";
@@ -39,6 +56,11 @@
        iptables -A nixos-fw -p tcp -s 10.0.40.30 --dport 23080 -j nixos-fw-log-refuse
        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 23080 -j nixos-fw-accept
      '';
+      # Flush all rules and chains on stop so it won't break on start
+      extraStopCommands = ''
+        iptables -F
+        iptables -X
+      '';
    };
  };

--- a/m/hut/gitlab-runner.nix
+++ b/m/hut/gitlab-runner.nix
@@ -1,8 +1,9 @@
 { pkgs, lib, config, ... }:

 {
-  age.secrets.gitlabRunnerShellToken.file = ../../secrets/gitlab-runner-shell-token.age;
-  age.secrets.gitlabRunnerDockerToken.file = ../../secrets/gitlab-runner-docker-token.age;
+  age.secrets.gitlab-pm-shell.file = ../../secrets/gitlab-runner-shell-token.age;
+  age.secrets.gitlab-pm-docker.file = ../../secrets/gitlab-runner-docker-token.age;
+  age.secrets.gitlab-bsc-docker.file = ../../secrets/gitlab-bsc-docker-token.age;

  services.gitlab-runner = {
    enable = true;
@@ -21,21 +22,90 @@
          "--docker-network-mode host"
        ];
        environmentVariables = {
-          https_proxy = "http://localhost:23080";
-          http_proxy = "http://localhost:23080";
+          https_proxy = "http://hut:23080";
+          http_proxy = "http://hut:23080";
        };
      };
    in {
      # For pm.bsc.es/gitlab
      gitlab-pm-shell = common-shell // {
-        authenticationTokenConfigFile = config.age.secrets.gitlabRunnerShellToken.path;
+        authenticationTokenConfigFile = config.age.secrets.gitlab-pm-shell.path;
      };
      gitlab-pm-docker = common-docker // {
-        authenticationTokenConfigFile = config.age.secrets.gitlabRunnerDockerToken.path;
+        authenticationTokenConfigFile = config.age.secrets.gitlab-pm-docker.path;
+      };
+
+      gitlab-bsc-docker = {
+        # gitlab.bsc.es still uses the old token mechanism
+        registrationConfigFile = config.age.secrets.gitlab-bsc-docker.path;
+        tagList = [ "docker" "hut" ];
+        environmentVariables = {
+          # We cannot access the hut local interface from docker, so we connect
+          # to hut directly via the ethernet one.
+          https_proxy = "http://hut:23080";
+          http_proxy = "http://hut:23080";
+        };
+        executor = "docker";
+        dockerImage = "alpine";
+        dockerVolumes = [
+          "/nix/store:/nix/store:ro"
+          "/nix/var/nix/db:/nix/var/nix/db:ro"
+          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+        ];
+        dockerExtraHosts = [
+          # Required to pass the proxy via hut
+          "hut:10.0.40.7"
+        ];
+        dockerDisableCache = true;
+        registrationFlags = [
+          # Increase build log length to 64 MiB
+          "--output-limit 65536"
+        ];
+        preBuildScript = pkgs.writeScript "setup-container" ''
+          mkdir -p -m 0755 /nix/var/log/nix/drvs
+          mkdir -p -m 0755 /nix/var/nix/gcroots
+          mkdir -p -m 0755 /nix/var/nix/profiles
+          mkdir -p -m 0755 /nix/var/nix/temproots
+          mkdir -p -m 0755 /nix/var/nix/userpool
+          mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+          mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+          mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+          mkdir -p -m 0700 "$HOME/.nix-defexpr"
+          mkdir -p -m 0700 "$HOME/.ssh"
+          cat > "$HOME/.ssh/config" << EOF
+          Host bscpm04.bsc.es gitlab-internal.bsc.es
+            User git
+            ProxyCommand nc -X connect -x hut:23080 %h %p
+          Host amdlogin1.bsc.es armlogin1.bsc.es hualogin1.bsc.es glogin1.bsc.es glogin2.bsc.es fpgalogin1.bsc.es
+            ProxyCommand nc -X connect -x hut:23080 %h %p
+          EOF
+          cat >> "$HOME/.ssh/known_hosts" << EOF
+          bscpm04.bsc.es ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPx4mC0etyyjYUT2Ztc/bs4ZXSbVMrogs1ZTP924PDgT
+          gitlab-internal.bsc.es ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF9arsAOSRB06hdy71oTvJHG2Mg8zfebADxpvc37lZo3
+          EOF
+          . ${pkgs.nix}/etc/profile.d/nix-daemon.sh
+          # Required to load SSL certificate paths
+          . ${pkgs.cacert}/nix-support/setup-hook
+        '';
+        environmentVariables = {
+          ENV = "/etc/profile";
+          USER = "root";
+          NIX_REMOTE = "daemon";
+          PATH = "${config.system.path}/bin:/bin:/sbin:/usr/bin:/usr/sbin";
+        };
      };
    };
  };

+  # DOCKER* chains are useless, override at FORWARD and nixos-fw
+  networking.firewall.extraCommands = ''
+    # Don't forward any traffic from docker
+    iptables -I FORWARD 1 -p all -i docker0 -j nixos-fw-log-refuse
+
+    # Allow incoming traffic from docker to 23080
+    iptables -A nixos-fw -p tcp -i docker0 -d hut --dport 23080 -j ACCEPT
+  '';
+
  #systemd.services.gitlab-runner.serviceConfig.Shell = "${pkgs.bash}/bin/bash";
  systemd.services.gitlab-runner.serviceConfig.DynamicUser = lib.mkForce false;
  systemd.services.gitlab-runner.serviceConfig.User = "gitlab-runner";
--- a/m/hut/gpfs-probe.nix
+++ b/m/hut/gpfs-probe.nix
@@ -0,0 +1,31 @@
+{ pkgs, config, lib, ... }:
+let
+  gpfs-probe-script = pkgs.runCommand "gpfs-probe.sh" { }
+    ''
+      cp ${./gpfs-probe.sh} $out;
+      chmod +x $out
+    ''
+  ;
+in
+{
+  # Use a new user to handle the SSH keys
+  users.groups.ssh-robot = { };
+  users.users.ssh-robot = {
+    description = "SSH Robot";
+    isNormalUser = true;
+    home = "/var/lib/ssh-robot";
+  };
+
+  systemd.services.gpfs-probe = {
+    description = "Daemon to report GPFS latency via SSH";
+    path = [ pkgs.openssh pkgs.netcat ];
+    after = [ "network.target" ];
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9966,fork EXEC:${gpfs-probe-script}";
+      User = "ssh-robot";
+      Group = "ssh-robot";
+    };
+  };
+}
--- a/m/hut/gpfs-probe.sh
+++ b/m/hut/gpfs-probe.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+N=500
+
+t=$(timeout 5 ssh bsc015557@glogin2.bsc.es "timeout 3 command time -f %e touch /gpfs/projects/bsc15/bsc015557/gpfs.{1..$N} 2>&1; rm -f /gpfs/projects/bsc15/bsc015557/gpfs.{1..$N}")
+
+if [ -z "$t" ]; then
+  t="5.00"
+fi
+
+cat <<EOF
+HTTP/1.1 200 OK
+Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
+
+# HELP gpfs_touch_latency Time to create $N files.
+# TYPE gpfs_touch_latency gauge
+gpfs_touch_latency $t
+EOF
--- a/m/hut/ipmi.yml
+++ b/m/hut/ipmi.yml
@@ -1,13 +0,0 @@
-modules:
-        default:
-                collectors:
-                - bmc
-                - ipmi
-                - chassis
-
-        lan:
-                collectors:
-                - ipmi
-                - chassis
-                user: ""
-                pass: ""
--- a/m/hut/monitoring.nix
+++ b/m/hut/monitoring.nix
@@ -1,7 +1,13 @@
 { config, lib, ... }:

 {
-  imports = [ ../module/slurm-exporter.nix ];
+  imports = [
+    ../module/slurm-exporter.nix
+    ../module/meteocat-exporter.nix
+    ../module/upc-qaire-exporter.nix
+    ./gpfs-probe.nix
+    ./nix-daemon-exporter.nix
+  ];

  age.secrets.grafanaJungleRobotPassword = {
    file = ../../secrets/jungle-robot-password.age;
@@ -9,6 +15,8 @@
    mode = "400";
  };

+  age.secrets.ipmiYml.file = ../../secrets/ipmi.yml.age;
+
  services.grafana = {
    enable = true;
    settings = {
@@ -41,7 +49,7 @@
  services.prometheus = {
    enable = true;
    port = 9001;
-    retentionTime = "1y";
+    retentionTime = "5y";
    listenAddress = "127.0.0.1";
  };

@@ -70,13 +78,13 @@
        enable = true;
        group = "root";
        user = "root";
-        configFile = ./ipmi.yml;
-        #extraFlags = [ "--log.level=debug" ];
+        configFile = config.age.secrets.ipmiYml.path;
+        # extraFlags = [ "--log.level=debug" ];
        listenAddress = "127.0.0.1";
      };
      node = {
        enable = true;
-        enabledCollectors = [ "systemd" ];
+        enabledCollectors = [ "systemd" "logind" ];
        port = 9002;
        listenAddress = "127.0.0.1";
      };
@@ -102,6 +110,10 @@
            "127.0.0.1:9252"
            "127.0.0.1:${toString config.services.prometheus.exporters.smartctl.port}"
            "127.0.0.1:9341" # Slurm exporter
+            "127.0.0.1:9966" # GPFS custom exporter
+            "127.0.0.1:9999" # Nix-daemon custom exporter
+            "127.0.0.1:9929" # Meteocat custom exporter
+            "127.0.0.1:9928" # UPC Qaire custom exporter
            "127.0.0.1:${toString config.services.prometheus.exporters.blackbox.port}"
          ];
        }];
@@ -157,6 +169,9 @@
            "8.8.8.8"
            "ssfhead"
            "anella-bsc.cesca.cat"
+            "upc-anella.cesca.cat"
+            "fox.ac.upc.edu"
+            "arenys5.ac.upc.edu"
          ];
        }];
        relabel_configs = [
@@ -202,7 +217,7 @@
            # Sets the "instance" label with the remote host we are querying
            source_labels = [ "__param_target" ];
            separator = ";";
-            regex = "(.*)";
+            regex = "(.*)-ipmi"; # Remove "-ipm̀i" at the end
            target_label = "instance";
            replacement = "\${1}";
            action = "replace";
@@ -244,6 +259,14 @@
          module = [ "raccoon" ];
        };
      }
+      {
+        job_name = "raccoon";
+        static_configs = [
+          {
+            targets = [ "127.0.0.1:19002" ]; # Node exporter
+          }
+        ];
+      }
    ];
  };
 }
--- a/m/hut/nginx.nix
+++ b/m/hut/nginx.nix
@@ -0,0 +1,73 @@
+{ theFlake, pkgs, ... }:
+let
+  website = pkgs.stdenv.mkDerivation {
+    name = "jungle-web";
+    src = theFlake;
+    buildInputs = [ pkgs.hugo ];
+    buildPhase = ''
+      cd web
+      rm -rf public/
+      hugo
+    '';
+    installPhase = ''
+      cp -r public $out
+    '';
+    # Don't mess doc/
+    dontFixup = true;
+  };
+in
+{
+  networking.firewall.allowedTCPPorts = [ 80 ];
+  services.nginx = {
+    enable = true;
+    virtualHosts."jungle.bsc.es" = {
+      root = "${website}";
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 80;
+        }
+      ];
+      extraConfig = ''
+        set_real_ip_from 127.0.0.1;
+        set_real_ip_from 84.88.52.107;
+        real_ip_recursive on;
+        real_ip_header X-Forwarded-For;
+
+        location /git {
+          rewrite ^/git$ / break;
+          rewrite ^/git/(.*) /$1 break;
+          proxy_pass http://127.0.0.1:3000;
+          proxy_redirect http:// $scheme://;
+        }
+        location /cache {
+          rewrite ^/cache/(.*) /$1 break;
+          proxy_pass http://127.0.0.1:5000;
+          proxy_redirect http:// $scheme://;
+        }
+        location /lists {
+          proxy_pass http://127.0.0.1:8081;
+          proxy_redirect http:// $scheme://;
+        }
+        location /grafana {
+          proxy_pass http://127.0.0.1:2342;
+          proxy_redirect http:// $scheme://;
+          proxy_set_header Host $host;
+          # Websockets
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "upgrade";
+        }
+        location ~ ^/~(.+?)(/.*)?$ {
+          alias /ceph/home/$1/public_html$2;
+          index  index.html index.htm;
+          autoindex on;
+          absolute_redirect off;
+        }
+        location /p/ {
+          alias /ceph/p/;
+        }
+      '';
+    };
+  };
+}
--- a/m/hut/nix-daemon-builds.sh
+++ b/m/hut/nix-daemon-builds.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# Locate nix daemon pid
+nd=$(pgrep -o nix-daemon)
+
+# Locate children of nix-daemon
+pids1=$(tr ' ' '\n' < "/proc/$nd/task/$nd/children")
+
+# For each children, locate 2nd level children
+pids2=$(echo "$pids1" | xargs -I @ /bin/sh -c 'cat /proc/@/task/*/children' | tr ' ' '\n')
+
+cat <<EOF
+HTTP/1.1 200 OK
+Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
+
+# HELP nix_daemon_build Nix daemon derivation build state.
+# TYPE nix_daemon_build gauge
+EOF
+
+for pid in $pids2; do
+  name=$(cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | rg "^name=(.+)" - --replace '$1' | tr -dc ' [:alnum:]_\-\.')
+  user=$(ps -o uname= -p "$pid")
+  if [ -n "$name" -a -n "$user" ]; then
+    printf 'nix_daemon_build{user="%s",name="%s"} 1\n' "$user" "$name"
+  fi
+done
--- a/m/hut/nix-daemon-exporter.nix
+++ b/m/hut/nix-daemon-exporter.nix
@@ -0,0 +1,23 @@
+{ pkgs, config, lib, ... }:
+let
+  script = pkgs.runCommand "nix-daemon-exporter.sh" { }
+    ''
+      cp ${./nix-daemon-builds.sh} $out;
+      chmod +x $out
+    ''
+  ;
+in
+{
+  systemd.services.nix-daemon-exporter = {
+    description = "Daemon to export nix-daemon metrics";
+    path = [ pkgs.procps pkgs.ripgrep ];
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9999,fork EXEC:${script}";
+      # Needed root to read the environment, potentially unsafe
+      User = "root";
+      Group = "root";
+    };
+  };
+}
--- a/m/hut/p.nix
+++ b/m/hut/p.nix
@@ -0,0 +1,43 @@
+{ pkgs, lib, config, ... }:
+let
+  p = pkgs.writeShellScriptBin "p" ''
+    set -e
+    cd /ceph
+    pastedir="p/$USER"
+    mkdir -p "$pastedir"
+
+    ext="txt"
+
+    if [ -n "$1" ]; then
+      ext="$1"
+    fi
+
+    out=$(mktemp "$pastedir/XXXXXXXX.$ext")
+
+    cat > "$out"
+    chmod go+r "$out"
+    echo "https://jungle.bsc.es/$out"
+  '';
+in
+{
+  environment.systemPackages = with pkgs; [ p ];
+
+  # Make sure we have a directory per user. We cannot use the nice
+  # systemd-tmpfiles-setup.service service because this is a remote FS, and it
+  # may not be mounted when it runs.
+  systemd.services.create-paste-dirs = let
+    # Take only normal users in hut
+    users = lib.filterAttrs (_: v: v.isNormalUser) config.users.users;
+    commands = lib.concatLists (lib.mapAttrsToList
+      (_: user: [
+        "install -d -o ${user.name} -g ${user.group} -m 0755 /ceph/p/${user.name}"
+      ]) users);
+    script = pkgs.writeShellScript "create-paste-dirs.sh" (lib.concatLines commands);
+  in {
+    enable = true;
+    wants = [ "remote-fs.target" ];
+    after = [ "remote-fs.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.ExecStart = script;
+  };
+}
--- a/m/hut/targets.yml
+++ b/m/hut/targets.yml
@@ -1,15 +1,15 @@
 - targets:
-  - 10.0.40.101
-  - 10.0.40.102
-  - 10.0.40.103
-  - 10.0.40.104
-  - 10.0.40.105
-  - 10.0.40.106
-  - 10.0.40.107
-  - 10.0.40.108
+  - owl1-ipmi
+  - owl2-ipmi
+  - xeon03-ipmi
+  - xeon04-ipmi
+  - koro-ipmi
+  - xeon06-ipmi
+  - hut-ipmi
+  - eudy-ipmi
  # Storage
-  - 10.0.40.141
-  - 10.0.40.142
-  - 10.0.40.143
+  - bay-ipmi
+  - oss01-ipmi
+  - lake2-ipmi
  labels:
    job: ipmi-lan
--- a/m/koro/configuration.nix
+++ b/m/koro/configuration.nix
@@ -2,7 +2,7 @@

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix
    #(modulesPath + "/installer/netboot/netboot-minimal.nix")

    ../eudy/cpufreq.nix
--- a/m/lake2/configuration.nix
+++ b/m/lake2/configuration.nix
@@ -2,7 +2,7 @@

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix
    ../module/monitoring.nix
  ];

--- a/m/map.nix
+++ b/m/map.nix
@@ -0,0 +1,70 @@
+{
+  # In physical order from top to bottom (see note below)
+  ssf = {
+    # Switches for Ethernet and OmniPath
+    switch-C6-S1A-05 = { pos=42; size=1; model="Dell S3048-ON"; };
+    switch-opa = { pos=41; size=1; };
+
+    # SSF login
+    ssfhead = { pos=39; size=2; label="SSFHEAD"; board="R2208WTTYSR"; contact="operations@bsc.es"; };
+
+    # Storage
+    bay   = { pos=38; size=1; label="MDS01"; board="S2600WT2R"; sn="BQWL64850303"; contact="rodrigo.arias@bsc.es"; };
+    lake1 = { pos=37; size=1; label="OSS01"; board="S2600WT2R"; sn="BQWL64850234"; contact="rodrigo.arias@bsc.es"; };
+    lake2 = { pos=36; size=1; label="OSS02"; board="S2600WT2R"; sn="BQWL64850266"; contact="rodrigo.arias@bsc.es"; };
+
+    # Compute xeon
+    owl1   = { pos=35; size=1; label="SSF-XEON01"; board="S2600WTTR"; sn="BQWL64954172"; contact="rodrigo.arias@bsc.es"; };
+    owl2   = { pos=34; size=1; label="SSF-XEON02"; board="S2600WTTR"; sn="BQWL64756560"; contact="rodrigo.arias@bsc.es"; };
+    xeon03 = { pos=33; size=1; label="SSF-XEON03"; board="S2600WTTR"; sn="BQWL64750826"; contact="rodrigo.arias@bsc.es"; };
+    # Slot 34 empty
+    koro   = { pos=31; size=1; label="SSF-XEON05"; board="S2600WTTR"; sn="BQWL64954293"; contact="rodrigo.arias@bsc.es"; };
+    xeon06 = { pos=30; size=1; label="SSF-XEON06"; board="S2600WTTR"; sn="BQWL64750846"; contact="antoni.navarro@bsc.es"; };
+    hut    = { pos=29; size=1; label="SSF-XEON07"; board="S2600WTTR"; sn="BQWL64751184"; contact="rodrigo.arias@bsc.es"; };
+    eudy   = { pos=28; size=1; label="SSF-XEON08"; board="S2600WTTR"; sn="BQWL64756586"; contact="aleix.rocanonell@bsc.es"; };
+
+    # 16 KNL nodes, 4 per chassis
+    knl01_04 = { pos=26; size=2; label="KNL01..KNL04"; board="HNS7200APX"; };
+    knl05_08 = { pos=24; size=2; label="KNL05..KNL18"; board="HNS7200APX"; };
+    knl09_12 = { pos=22; size=2; label="KNL09..KNL12"; board="HNS7200APX"; };
+    knl13_16 = { pos=20; size=2; label="KNL13..KNL16"; board="HNS7200APX"; };
+
+    # Slot 19 empty
+
+    # EPI (hw team, guessed order)
+    epi01 = { pos=18; size=1; contact="joan.cabre@bsc.es"; };
+    epi02 = { pos=17; size=1; contact="joan.cabre@bsc.es"; };
+    epi03 = { pos=16; size=1; contact="joan.cabre@bsc.es"; };
+    anon  = { pos=14; size=2; }; # Unlabeled machine. Operative
+
+    # These are old and decommissioned (off)
+    power8    = { pos=12; size=2; label="BSCPOWER8N3";   decommissioned=true; };
+    powern1   = { pos=8;  size=4; label="BSCPOWERN1";    decommissioned=true; };
+    gustafson = { pos=7;  size=1; label="gustafson";     decommissioned=true; };
+    odap01    = { pos=3;  size=4; label="ODAP01";        decommissioned=true; };
+    amhdal    = { pos=2;  size=1; label="AMHDAL";        decommissioned=true; }; # sic
+    moore     = { pos=1;  size=1; label="moore (earth)"; decommissioned=true; };
+  };
+
+  bsc2218 = {
+    raccoon = { board="W2600CR"; sn="QSIP22500829"; contact="rodrigo.arias@bsc.es"; };
+    tent    = { label="SSF-XEON04"; board="S2600WTTR"; sn="BQWL64751229"; contact="rodrigo.arias@bsc.es"; };
+  };
+
+  upc = {
+    fox = { board="H13DSG-O-CPU"; sn="UM24CS600392"; prod="AS-4125GS-TNRT"; prod_sn="E508839X5103339"; contact="rodrigo.arias@bsc.es"; };
+  };
+
+  # NOTE: Position is specified in "U" units (44.45 mm) and starts at 1 from the
+  # bottom. Example:
+  #
+  #  |   ...  | - [pos+size] <--- Label in chassis
+  #  +--------+
+  #  |  node  | - [pos+1]
+  #  |   2U   | - [pos]
+  #  +------- +
+  #  |   ...  | - [pos-1]
+  #
+  # NOTE: The board and sn refers to the FRU information (Board Product and
+  # Board Serial) via `ipmitool fru print 0`.
+}
--- a/m/module/hut-substituter.nix
+++ b/m/module/hut-substituter.nix
@@ -0,0 +1,10 @@
+{ config, ... }:
+{
+  nix.settings =
+    # Don't add hut as a cache to itself
+    assert config.networking.hostName != "hut";
+    {
+      substituters = [ "http://hut/cache" ];
+      trusted-public-keys = [ "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" ];
+    };
+}
--- a/m/module/meteocat-exporter.nix
+++ b/m/module/meteocat-exporter.nix
@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  systemd.services."prometheus-meteocat-exporter" = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Restart = mkDefault "always";
+      PrivateTmp = mkDefault true;
+      WorkingDirectory = mkDefault "/tmp";
+      DynamicUser = mkDefault true;
+      ExecStart = "${pkgs.meteocat-exporter}/bin/meteocat-exporter";
+    };
+  };
+}
--- a/m/module/slurm-client.nix
+++ b/m/module/slurm-client.nix
@@ -47,8 +47,7 @@ in {
    ];

    partitionName = [
-      "owl Nodes=owl[1-2] Default=YES DefaultTime=01:00:00 MaxTime=INFINITE State=UP"
-      "all Nodes=owl[1-2],hut Default=NO DefaultTime=01:00:00 MaxTime=INFINITE State=UP"
+      "owl Nodes=owl[1-2]     Default=YES DefaultTime=01:00:00 MaxTime=INFINITE State=UP"
    ];

    # See slurm.conf(5) for more details about these options.
@@ -91,9 +90,29 @@ in {
      # Ignore memory constraints and only use unused cores to share a node with
      # other jobs.
      SelectTypeParameters=CR_Core
+
+      # Required for pam_slurm_adopt, see https://slurm.schedmd.com/pam_slurm_adopt.html
+      # This sets up the "extern" step into which ssh-launched processes will be
+      # adopted. Alloc runs the prolog at job allocation (salloc) rather than
+      # when a task runs (srun) so we can ssh early.
+      PrologFlags=Alloc,Contain,X11
+
+      # LaunchParameters=ulimit_pam_adopt will set RLIMIT_RSS in processes
+      # adopted by the external step, similar to tasks running in regular steps
+      # LaunchParameters=ulimit_pam_adopt
+      SlurmdDebug=debug5
+      #DebugFlags=Protocol,Cgroup
+    '';
+
+    extraCgroupConfig = ''
+      CgroupPlugin=cgroup/v2
+      #ConstrainCores=yes
    '';
  };

+  # Place the slurm config in /etc as this will be required by PAM
+  environment.etc.slurm.source = config.services.slurm.etcSlurm;
+
  age.secrets.mungeKey = {
    file = ../../secrets/munge-key.age;
    owner = "munge";
--- a/m/module/ssh-hut-extern.nix
+++ b/m/module/ssh-hut-extern.nix
@@ -0,0 +1,9 @@
+{
+  programs.ssh.extraConfig = ''
+    Host ssfhead
+      HostName ssflogin.bsc.es
+    Host hut
+      ProxyJump ssfhead
+      HostName xeon07
+  '';
+}
--- a/m/module/upc-qaire-exporter.nix
+++ b/m/module/upc-qaire-exporter.nix
@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  systemd.services."prometheus-upc-qaire-exporter" = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Restart = mkDefault "always";
+      PrivateTmp = mkDefault true;
+      WorkingDirectory = mkDefault "/tmp";
+      DynamicUser = mkDefault true;
+      ExecStart = "${pkgs.upc-qaire-exporter}/bin/upc-qaire-exporter";
+    };
+  };
+}
--- a/m/owl1/configuration.nix
+++ b/m/owl1/configuration.nix
@@ -2,12 +2,13 @@

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix
    ../module/ceph.nix
    ../module/emulation.nix
    ../module/slurm-client.nix
    ../module/slurm-firewall.nix
    ../module/debuginfod.nix
+    ../module/hut-substituter.nix
  ];

  # Select the this using the ID to avoid mismatches
--- a/m/owl2/configuration.nix
+++ b/m/owl2/configuration.nix
@@ -2,12 +2,13 @@

 {
  imports = [
-    ../common/xeon.nix
+    ../common/ssf.nix
    ../module/ceph.nix
    ../module/emulation.nix
    ../module/slurm-client.nix
    ../module/slurm-firewall.nix
    ../module/debuginfod.nix
+    ../module/hut-substituter.nix
  ];

  # Select the this using the ID to avoid mismatches
--- a/m/raccoon/configuration.nix
+++ b/m/raccoon/configuration.nix
@@ -5,7 +5,7 @@
    ../common/base.nix
    ../module/emulation.nix
    ../module/debuginfod.nix
-    ../eudy/kernel/lttng.nix
+    ../module/ssh-hut-extern.nix
    ../eudy/kernel/perf.nix
  ];

@@ -27,6 +27,23 @@
      address = "84.88.51.152";
      prefixLength = 25;
    } ];
+    interfaces.enp5s0f1.ipv4.addresses = [ {
+      address = "10.0.44.1";
+      prefixLength = 24;
+    } ];
+    nat = {
+      enable = true;
+      internalInterfaces = [ "enp5s0f1" ];
+      externalInterface = "eno0";
+    };
+    hosts = {
+      "10.0.44.4" = [ "tent" ];
+    };
+  };
+
+  nix.settings = {
+    substituters = [ "https://jungle.bsc.es/cache" ];
+    trusted-public-keys = [ "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" ];
  };

  # Enable performance governor
@@ -42,28 +59,8 @@
  # Disable garbage collection for now
  nix.gc.automatic = lib.mkForce false;

-  # Use nix cache from hut
-  nix.settings = {
-    substituters = [ "https://jungle.bsc.es/cache" ];
-    trusted-public-keys = [ "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" ];
-  };
-
  services.openssh.settings.X11Forwarding = true;

-  nixpkgs.overlays = [
-    (final: prev: {
-      xilinx-xrt = prev.callPackage ./xilinx-xrt.nix { };
-      xilinx-fw = prev.callPackage ./xilinx-fw.nix { };
-      xilinx-xocl = prev.callPackage ./xilinx-xocl.nix {
-        kernel = config.boot.kernelPackages.kernel;
-      };
-    })
-  ];
-
-  boot.extraModulePackages = [ pkgs.xilinx-xocl ];
-  boot.kernelModules = [ "xclmgmt" "xocl" ];
-  services.udev.packages = [ pkgs.xilinx-xocl ];
-
  services.prometheus.exporters.node = {
    enable = true;
    enabledCollectors = [ "systemd" ];
--- a/m/raccoon/xilinx-create-xsabin.sh
+++ b/m/raccoon/xilinx-create-xsabin.sh
@@ -1,335 +0,0 @@
-#!/bin/bash
-## (c) Copyright 2020 Xilinx, Inc. All rights reserved.
-##
-## This file contains confidential and proprietary information
-## of Xilinx, Inc. and is protected under U.S. and
-## international copyright and other intellectual property
-## laws.
-##
-## DISCLAIMER
-## This disclaimer is not a license and does not grant any
-## rights to the materials distributed herewith. Except as
-## otherwise provided in a valid license issued to you by
-## Xilinx, and to the maximum extent permitted by applicable
-## law: (1) THESE MATERIALS ARE MADE AVAILABLE "AS IS" AND
-## WITH ALL FAULTS, AND XILINX HEREBY DISCLAIMS ALL WARRANTIES
-## AND CONDITIONS, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING
-## BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, NON-
-## INFRINGEMENT, OR FITNESS FOR ANY PARTICULAR PURPOSE; and
-## (2) Xilinx shall not be liable (whether in contract or tort,
-## including negligence, or under any other theory of
-## liability) for any loss or damage of any kind or nature
-## related to, arising under or in connection with these
-## materials, including for any direct, or any indirect,
-## special, incidental, or consequential loss or damage
-## (including loss of data, profits, goodwill, or any type of
-## loss or damage suffered as a result of any action brought
-## by a third party) even if such damage or loss was
-## reasonably foreseeable or Xilinx had been advised of the
-## possibility of the same.
-##
-## CRITICAL APPLICATIONS
-## Xilinx products are not designed or intended to be fail-
-## safe, or for use in any application requiring fail-safe
-## performance, such as life-support or safety devices or
-## systems, Class III medical devices, nuclear facilities,
-## applications related to the deployment of airbags, or any
-## other applications that could lead to death, personal
-## injury, or severe property or environmental damage
-## (individually and collectively, "Critical
-## Applications"). Customer assumes the sole risk and
-## liability of any use of Xilinx products in Critical
-## Applications, subject only to applicable laws and
-## regulations governing limitations on product liability.
-##
-## THIS COPYRIGHT NOTICE AND DISCLAIMER MUST BE RETAINED AS
-## PART OF THIS FILE AT ALL TIMES.
-
-# This script must be run with root permissions
-# if [[ "$EUID" -ne 0 ]]; then
-#   echo "This script must be run as root."
-#   exit
-# fi
-
-# Get absolute path to this script with any symlinks resolved
-realme=$(realpath $0)
-scriptpath="${realme%/*}"
-echo "This is create_xsabin.sh running from $scriptpath on $(date)"
-
-# The directory above that is the human-readable installation path - probably /opt/xilinx/firmware/<card>/<family>/<partition>/
-humanpath=${scriptpath%/*}
-pushd $humanpath > /dev/null
-
-# This script may be called during firmware upgrade, in which case the firmware product, branch, version and release
-# are provided as script arguments, to help this script to select the new firmware file
-if [[ "$#" -ge 4 ]]; then
-  firmware_upgrade_product=$1
-  firmware_upgrade_branch=$2
-  firmware_upgrade_version=$3
-  firmware_upgrade_release=$4
-  echo "Run for install of firmware $firmware_upgrade_product-$firmware_upgrade_branch version $firmware_upgrade_version release $firmware_upgrade_release"
-elif [[ "$#" -eq 3 ]]; then
-  # If 3 script arguments, these are the partition name, version and release, so that this script can report them for debug
-  echo "Run for install of partition $1 version $2 release $3"
-fi
-
-# Find the partition_metadata.json link in the install directory
-jsonlink="partition_metadata.json"
-if [[ ! -e "$jsonlink" ]]; then
-  echo "Cannot find $jsonlink file in $humanpath - install failed"
-  exit 1
-fi
-
-# Find the machine-readable directory for this partition:
-# this is the target of the partition_metadata.json link
-if [[ ! -h "$jsonlink" ]]; then
-  echo "$jsonlink in $humanpath should be a symlink, but it is not - install failed"
-  exit 1
-fi
-jsonpath=$(readlink $jsonlink)
-if [[ $? -ne 0 ]]; then
-  echo "Failed to read target of symlink $jsonlink in $humanpath - install failed"
-  exit 1
-fi
-if [[ ! -e "$jsonpath" ]]; then
-  echo "Target of symlink $jsonlink in $humanpath is $jsonpath, which does not exist - install failed"
-  exit 1
-fi
-echo "Metadata file is $jsonpath"
-machinepath=${jsonpath%/*}
-json=${jsonpath##*/}
-echo "User install path is $humanpath"
-echo "Machine-readable path is $machinepath"
-pushd $machinepath > /dev/null
-
-# Parse the partition_metadata.json file to find the required firmware
-declare -A firmware
-firmware_products=()
-product=""
-branch="mainline"
-major="*"
-minor="*"
-revision="*"
-while IFS= read -r line; do
-  key=${line#*\"}
-  key=${key%%\"*}
-  value=${line%\"*}
-  value=${value##*\"}
-  numvalue=$value
-  if [[ "$numvalue" =~ ^0x ]]; then
-    numvalue=$(($numvalue))
-  fi
-  case "$key" in
-    "firmware")
-      # Starts a new section: record current one (except if before the first section)
-      if [[ -n "$product" ]]; then
-        firmware_products+=($product)
-        firmware["$product.branch"]=$branch
-        firmware["$product.version"]="$major.$minor.$revision"
-        product=""
-        branch="mainline"
-        major="*"
-        minor="*"
-        revision="*"
-      fi
-      ;;
-    "firmware_product_name")
-      product=${value,,}
-      ;;
-    "firmware_branch_name")
-      branch=${value,,}
-      ;;
-    "firmware_version_major")
-      major=$numvalue
-      ;;
-    "firmware_version_minor")
-      minor=$numvalue
-      ;;
-    "firmware_version_revision")
-      revision=$numvalue
-      ;;
-  esac
-done <<< "$(grep '\"firmware' $json)"
-# Record last section
-firmware_products+=($product)
-firmware["$product.branch"]=$branch
-firmware["$product.version"]="$major.$minor.$revision"
-
-# Locate the required firmware in existing installed directories, and build xclbinutil options to add firmware
-# For each firmware, there is already a symlink in the human-readable directory's firmware directory
-# which points to the existing firmware install directory
-firmware_opts=""
-for product in "${firmware_products[@]}"; do
-  uc_product=${product^^}
-  branch=${firmware[$product.branch]}
-  version=${firmware[$product.version]}
-  link="$humanpath/firmware/$product-$branch"
-  if [[ ! -L "$link" ]]; then
-    echo "Expected symlink $link for required $product firmware, but this either does not exist or is not a symlink - install failed"
-    exit 1
-  fi
-  firmware_path=$(readlink -f $humanpath/firmware/$product-$branch)
-  if [[ ! -e "$firmware_path" ]]; then
-    echo "Required $product firmware install directory not found at $firmware_path. Unable to build xsabin files"
-    exit 1
-  fi
-  # Locate the required firmware binary file
-  case "$product" in
-    "ert")
-      # ERT firmware is deployed within XRT and has its own file naming rule
-      if [[ "$branch" == "mainline" ]] || [[ "$branch" == "legacy" ]] || [[ "$branch" == "" ]]; then
-        ert_name="sched.bin"
-      else
-        ert_name="sched_$branch.bin"
-      fi
-      firmware_file="$firmware_path/$ert_name"
-      if [[ ! -e "$firmware_file" ]]; then
-        echo "Cannot locate required $product firmware: not found at $firmware_file. Unable to build xsabin files"
-        exit 1
-      fi
-      firmware_opts+=" --add-section SCHED_FIRMWARE:RAW:${firmware_file}"
-      ;;
-    *)
-      # All other firmware is deployed in its own package
-      # Accommodate possible variations in firmware file name, as long as the file name contains the product name
-      # During firmware upgrade, it is possible that both the old and the new firmware files are both present
-      # (the old one may not be removed until after this script has run).
-      # In this situation, the new firmware product, branch and version are provided as script arguments:
-      # select the appropriate file here (if multiple files are found).
-      firmware_files=()
-      for globfile in $firmware_path/*; do
-        if [[ -e "$globfile" ]] && [[ ! -d "$globfile" ]]; then
-          globfilename=${globfile##*/}
-          if [[ "$globfilename" == *"$product"* ]] || [[ "$globfilename" == *"$uc_product"* ]]; then
-            firmware_files+=($globfile)
-          fi
-        fi
-      done
-      if [[ "${#firmware_files[@]}" -eq 0 ]]; then
-        echo "Cannot locate required $product firmware: not found at $firmware_path. Unable to build xsabin files"
-        exit 1
-      fi
-      firmware_file=""
-      if [[ "${#firmware_files[@]}" -gt 1 ]]; then
-        IFS=$'\n'
-        firmware_files=( $(sort -V <<<"${firmware_files[*]}") )
-        unset IFS
-        if [[ "$firmware_upgrade_product" == "$product" ]]; then
-          firmware_file=""
-          for fw_file in "${firmware_files[@]}"; do
-            fw_filename=${fw_file##*/}
-            if [[ "$fw_filename" == *"$firmware_upgrade_version"* ]]; then
-              firmware_file=$fw_file
-            fi
-          done
-        fi
-      fi
-      if [[ -z "$firmware_file" ]]; then
-        firmware_file="${firmware_files[-1]}"
-      fi
-      # Select the correct xsabin section name, depending on the firmware product
-      section=""
-      case "$product" in
-        "cmc")
-          section="FIRMWARE"
-          ;;
-        "sc-fw" | "sc")
-          section="BMC-FW"
-          ;;
-        *)
-          echo "Unrecognised firmware product name '$product', unable to select the correct xsabin section name"
-          exit 1
-          ;;
-      esac
-      firmware_opts+=" --add-section ${section}:RAW:${firmware_file}"
-      # The SC firmware (BMC-FW section) may have a metadata JSON file also to be added
-      if [[ "$section" == "BMC-FW" && -e "$firmware_path/metadata.json" ]]; then
-        firmware_opts+=" --add-section BMC-METADATA:JSON:${firmware_path}/metadata.json"
-      fi
-      ;;
-  esac
-done
-
-# Extract vendor, board, name and version from partition_metadata.json, to build PlatformVBNV
-declare -A vbnv
-for element in {partition_vendor,partition_card,partition_family,partition_name,installed_package_version}; do
-  line="$(grep $element $json)"
-  if [[ -n "$line" ]]; then
-    value=${line%\"*}
-    value=${value##*\"}
-    if [[ "$element" != "partition_vendor" ]] && [[ "$element" != "partition_card" ]]; then
-      value=${value//-/_}
-    fi
-  else
-    value="UNKNOWN"
-  fi
-  vbnv[$element]=$value
-done
-platform_vbnv="${vbnv[partition_vendor]}:${vbnv[partition_card]}:${vbnv[partition_family]}_${vbnv[partition_name]}:${vbnv[installed_package_version]}"
-
-# Check for VBNV override in partition_metadata.json
-line="$(grep vbnv_override $json)"
-if [[ -n "$line" ]]; then
-  value=${line%\"*}
-  value=${value##*\"}
-  # Check VBNV override value is correctly formatted (4 fields separated by colons)
-  fields="$(echo "$value" | tr ':' ' ' | wc -w)"
-  if [[ "$fields" == "4" ]]; then
-    platform_vbnv=$value
-  fi
-fi
-
-# Use the XRT standard install path to find xclbinutil
-xclbinutil="${xclbinutil:-/opt/xilinx/xrt/bin/xclbinutil}"
-if [[ ! -e "$xclbinutil" ]]; then
-  echo "xclbinutil tool not found at $xclbinutil, unable to build xsabin files"
-  exit 1
-fi
-
-## Must source XRT's setup.sh to set up environment correctly
-#if [[ ! -e /opt/xilinx/xrt/setup.sh ]]; then
-#  echo "XRT setup.sh not found at /opt/xilinx/xrt/setup.sh, XRT installation is bad. Cannot build xsabin files"
-#  exit 1
-#fi
-#source /opt/xilinx/xrt/setup.sh
-
-# Build xclbinutil options for creating xsabin files
-xclbinopts=" --force"
-if [[ -e "partition.mcs" ]]; then
-  xclbinopts+=" --add-section MCS-PRIMARY:RAW:partition.mcs"
-fi
-if [[ -e "partition_secondary.mcs" ]]; then
-  xclbinopts+=" --add-section MCS-SECONDARY:RAW:partition_secondary.mcs"
-fi
-if [[ -e "partition.bin" ]]; then
-  xclbinopts+=" --add-section FLASH[BIN]-DATA:RAW:partition.bin"
-fi
-if [[ -e "bin_metadata.json" ]]; then
-  xclbinopts+=" --add-section FLASH[BIN]-METADATA:JSON:bin_metadata.json"
-fi
-if [[ -e "partition.bit" ]]; then
-  xclbinopts+=" --add-section BITSTREAM:RAW:partition.bit"
-fi
-if [[ -e "partition.pdi" ]]; then
-  xclbinopts+=" --add-section PDI:RAW:partition.pdi"
-fi
-xclbinopts+=" --add-section PARTITION_METADATA:JSON:${json}"
-xclbinopts+=$firmware_opts
-xclbinopts+=" --key-value SYS:PlatformVBNV:${platform_vbnv}"
-
-# Create partition.xsabin
-xsabin="partition.xsabin"
-xclbincmd="${xclbinutil} ${xclbinopts} --output $xsabin"
-echo $xclbincmd
-$xclbincmd
-if [[ $? -ne 0 ]]; then
-  echo "An error occurred while running xclbinutil"
-  exit 1
-fi
-if [[ ! -e "$xsabin" ]]; then
-  echo "xclbinutil did not create output file $xsabin"
-  exit 1
-fi
-
-# And we're done
-echo "create_xsabin.sh completed successfully"
--- a/m/raccoon/xilinx-fw.nix
+++ b/m/raccoon/xilinx-fw.nix
@@ -1,75 +0,0 @@
-{
-  stdenv
-, lib
-, dpkg
-, fetchurl
-, xilinx-xrt
-}:
-
-with lib;
-
-# Must read: https://xilinx.github.io/XRT/master/html/platforms_partitions.html#shell
-# Taken from:
-# - https://aur.archlinux.org/packages/xilinx-sc-fw-u280
-# - https://aur.archlinux.org/packages/xilinx-u280-gen3x16-xdma-base
-
-stdenv.mkDerivation rec {
-  pname = "xilinx-fw";
-  version = "1.3.5-3592445";
-  srcs = [
-    # List packages with: curl https://packages.xilinx.com/artifactory/debian-packages-cache/pool/
-    (fetchurl {
-      url = "https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xilinx-cmc-u280_1.3.5-3592445_all.deb";
-      hash = "sha256-H48bdeuBc9dK6LExMnw1RCfY85PKntBk/X8CMcAI+zI=";
-    })
-    (fetchurl {
-      url = "https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xilinx-sc-fw-u280_4.3.28-1.ea1b92f_all.deb";
-      hash = "sha256-JxQal2IqYAgebAgfjs2noFG5ghxC9sJQFppJFUCx6jA=";
-    })
-    (fetchurl {
-      url = "https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xilinx-u280-gen3x16-xdma-base_1-3585717_all.deb";
-      hash = "sha256-oe84YgmmRFZjNa63j0pIneuFUG0Bb4aA7wulyU4bCrY=";
-    })
-    (fetchurl {
-      url = "https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xilinx-u280-gen3x16-xdma-validate_1-3585755_all.deb";
-      hash = "sha256-F+IAzR8NVc9FDsgQstpBcKeq3ogH1PI8nuq94sEExCg=";
-    })
-    # Needed for the ERT firmware
-    (fetchurl {
-      url = "https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xrt_202320.2.16.204_22.04-amd64-xrt.deb";
-      hash = "sha256-FEhzx2KlIYpunXmTSBjtyAtblbuz5tkvnt2qp21gUho=";
-    })
-  ];
-
-  dontStrip = true;
-  hardeningDisable = [ "all" ];
-  nativeBuildInputs = [ dpkg ];
-  unpackPhase = ''
-    for f in $srcs; do
-      dpkg-deb -x "$f" deb
-    done
-    sourceRoot=deb
-  '';
-  # Generate the xsabin firmware file by fixing the original script
-  buildPhase = ''
-    set -x
-
-    ln -rs lib/firmware/xilinx/283bab8f654d8674968f4da57f7fa5d7 lib/firmware/xilinx/fb2b2c5a19ed63593fea95f51fbc8eb9
-    ln -rs lib/firmware/xilinx/283bab8f654d8674968f4da57f7fa5d7/partition_metadata.json opt/xilinx/firmware/u280/gen3x16-xdma/base/partition_metadata.json
-    ln -rs lib/firmware/xilinx/283bab8f654d8674968f4da57f7fa5d7/partition.xsabin opt/xilinx/firmware/u280/gen3x16-xdma/base/partition.xsabin
-    ln -rs opt/xilinx/xrt/share/fw opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware/ert-v30
-    ln -rs opt/xilinx/firmware/cmc/u280 opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware/cmc-u280
-    ln -rs opt/xilinx/firmware/sc-fw/u280 opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware/sc-fw-u280
-
-    find
-
-    export xclbinutil=${xilinx-xrt}/xrt/bin/xclbinutil
-    cp -a ${./xilinx-create-xsabin.sh} opt/xilinx/firmware/u280/gen3x16-xdma/base/scripts/create_xsabin.sh
-    bash -x opt/xilinx/firmware/u280/gen3x16-xdma/base/scripts/create_xsabin.sh xilinx-u280-gen3x16-xdma-base 1 3585717
-    set +x
-  '';
-  installPhase = ''
-    mkdir -p $out
-    cp -a * $out
-  '';
-}
--- a/m/raccoon/xilinx-xocl-depmod.patch
+++ b/m/raccoon/xilinx-xocl-depmod.patch
@@ -1,27 +0,0 @@
--- a/driver/xocl/mgmtpf/Makefile	2025-02-20 15:59:28.379826176 +0100
-+++ b/driver/xocl/mgmtpf/Makefile	2025-02-20 15:59:42.366892140 +0100
-@@ -119,10 +119,6 @@ all:
- 
- install: all
- 	$(MAKE) -C $(KERNEL_SRC) M=$(PWD) modules_install
-	depmod -a
-	install -m 644 99-xclmgmt.rules /etc/udev/rules.d
-	-rmmod -s xclmgmt || true
-	-modprobe xclmgmt
- 
- clean:
- 	rm -rf *.o *.o.d *.o.cmd *~ core .depend .*.cmd *.ko *.ko.unsigned \
--- a/driver/xocl/userpf/Makefile	2025-02-20 16:03:20.751922522 +0100
-+++ b/driver/xocl/userpf/Makefile	2025-02-20 16:03:35.377991553 +0100
-@@ -138,11 +138,6 @@ all:
- 
- install: all
- 	$(MAKE) -C $(KERNEL_SRC) M=$(PWD) modules_install
-	depmod -a
-	install -m 644 99-xocl.rules /etc/udev/rules.d
-	-rmmod -s xocl || true
-	-rmmod -s xdma || true
-	-modprobe xocl
- 
- clean:
- 	rm -rf *.o *.o.d *~ core .depend .*.cmd *.ko *.ko.unsigned *.mod.c \
--- a/m/raccoon/xilinx-xocl.nix
+++ b/m/raccoon/xilinx-xocl.nix
@@ -1,35 +0,0 @@
-{
-  stdenv
-, lib
-, kernel
-, xilinx-xrt
-}:
-
-with lib;
-
-# See: https://iotlab.sdsu.edu/index.php/flash-base-image-on-xilinx-alveo-u280/
-
-stdenv.mkDerivation rec {
-  pname = "xilinx-xocl";
-  version = "2.19.0";
-  src = "${xilinx-xrt}/src/xrt-${version}";
-  dontStrip = true;
-  preBuild = ''
-    cd driver/xocl
-  '';
-  patches = [
-    ./xilinx-xocl-depmod.patch
-  ];
-  buildFlags = [ "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
-  installFlags = [
-    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    "INSTALL_MOD_PATH=${placeholder "out"}"
-  ];
-  postInstall = ''
-    mkdir -p $out/etc/udev/rules.d
-    install -m 644 userpf/99-xocl.rules $out/etc/udev/rules.d
-    install -m 644 mgmtpf/99-xclmgmt.rules $out/etc/udev/rules.d
-  '';
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-  hardeningDisable = [ "all" ];
-}
--- a/m/raccoon/xilinx-xrt-aiebu.patch
+++ b/m/raccoon/xilinx-xrt-aiebu.patch
@@ -1,25 +0,0 @@
--- a/src/runtime_src/core/common/aiebu/src/cpp/aiebu/utils/asm/CMakeLists.txt
-+++ b/src/runtime_src/core/common/aiebu/src/cpp/aiebu/utils/asm/CMakeLists.txt
-@@ -23,8 +23,6 @@ add_executable(aiebu-asm $<TARGET_OBJECTS:aiebu_asm_objects>)
- target_link_libraries(aiebu-asm PRIVATE aiebu_static)
-
- if (${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
-  target_link_options(aiebu-asm PRIVATE "-static")
-  set_target_properties(aiebu-asm PROPERTIES INSTALL_RPATH "" BUILD_RPATH "")
-
-   # Create a dynamically linked executable. aiebu-asm-dyn, on Linux for running
-   # valgrind, etc. This binary is not released for deployment but only used for
-@@ -35,13 +33,6 @@ if (${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
-   target_link_libraries(aiebu-asm-dyn PRIVATE aiebu_static)
- endif()
-
-# This custom target fails if aiebu-asm has any dynamic dependencies
-add_custom_target(check_dynamic_deps ALL
-  COMMAND ${CMAKE_COMMAND} -E echo "Checking for dynamic dependencies ..."
-  COMMAND ${CMAKE_COMMAND} -P "${AIEBU_SOURCE_DIR}/cmake/depends.cmake" $<TARGET_FILE:aiebu-asm> aiebu-asm_depends.txt
-  DEPENDS aiebu-asm
-  )
-
- install(TARGETS aiebu-asm
-   RUNTIME DESTINATION ${AIEBU_INSTALL_BIN_DIR}
-   CONFIGURATIONS Debug Release COMPONENT Runtime
--- a/m/raccoon/xilinx-xrt-icd.patch
+++ b/m/raccoon/xilinx-xrt-icd.patch
@@ -1,13 +0,0 @@
-diff --git a/src/CMake/icd.cmake b/src/CMake/icd.cmake
-index 255a2e3d8..460a6d4c7 100644
--- a/src/CMake/icd.cmake
-+++ b/src/CMake/icd.cmake
-@@ -10,7 +10,7 @@ configure_file (
-   ${ICD_FILE_NAME}
-   )
- 
-set(OCL_ICD_INSTALL_PREFIX "/etc/OpenCL/vendors")
-+set(OCL_ICD_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/etc/OpenCL/vendors")
- 
- install (FILES ${CMAKE_CURRENT_BINARY_DIR}/${ICD_FILE_NAME}
-   DESTINATION ${OCL_ICD_INSTALL_PREFIX}
--- a/m/raccoon/xilinx-xrt-u280-support.patch
+++ b/m/raccoon/xilinx-xrt-u280-support.patch
@@ -1,204 +0,0 @@
-From 6f64871f2e679ad5d3b140c8a2732edaae2dcf6a Mon Sep 17 00:00:00 2001
-From: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
-Date: Thu, 20 Feb 2025 18:49:54 +0100
-Subject: [PATCH] Revert "Removed support for u50lv, u55n and u280 platforms in
- XRT (#7901)"
-
-This reverts commit 41f4221433c6b173316b61cb2e7e3ee5152d8075.
---
- .../core/pcie/driver/linux/xocl/devices.h     | 103 ++++++++++++++++++
- 1 file changed, 103 insertions(+)
-
-diff --git a/src/runtime_src/core/pcie/driver/linux/xocl/devices.h b/src/runtime_src/core/pcie/driver/linux/xocl/devices.h
-index 971ad73d2..5fe329cfa 100644
--- a/src/runtime_src/core/pcie/driver/linux/xocl/devices.h
-+++ b/src/runtime_src/core/pcie/driver/linux/xocl/devices.h
-@@ -2064,6 +2064,14 @@ struct xocl_subdev_map {
- 		.subdev_num = ARRAY_SIZE(USER_RES_DSA52),		\
- 	}
- 
-+#define	XOCL_BOARD_USER_DSA52_U280					\
-+	(struct xocl_board_private){					\
-+		.flags		= 0,					\
-+		.subdev_info	= USER_RES_DSA52,			\
-+		.subdev_num = ARRAY_SIZE(USER_RES_DSA52),		\
-+		.p2p_bar_sz = 64,					\
-+	}
-+
- #define	XOCL_BOARD_USER_SMARTN						\
- 	(struct xocl_board_private){					\
- 		.flags		= XOCL_DSAFLAG_SMARTN,			\
-@@ -2370,6 +2378,30 @@ struct xocl_subdev_map {
- 		.flash_type = FLASH_TYPE_SPI,				\
- 	}
- 
-+
-+#define	MGMT_RES_XBB_DSA52_U280						\
-+		((struct xocl_subdev_info []) {				\
-+			XOCL_DEVINFO_FEATURE_ROM,			\
-+			XOCL_DEVINFO_PRP_IORES_MGMT,			\
-+			XOCL_DEVINFO_AXIGATE_ULP,			\
-+			XOCL_DEVINFO_CLOCK_HBM,				\
-+			XOCL_DEVINFO_AF_DSA52,				\
-+			XOCL_DEVINFO_XMC,				\
-+			XOCL_DEVINFO_XVC_PRI,				\
-+			XOCL_DEVINFO_MAILBOX_MGMT,			\
-+			XOCL_DEVINFO_ICAP_MGMT,				\
-+			XOCL_DEVINFO_FMGR,				\
-+			XOCL_DEVINFO_FLASH,				\
-+		})
-+
-+#define	XOCL_BOARD_MGMT_XBB_DSA52_U280					\
-+	(struct xocl_board_private){					\
-+		.flags		= 0,					\
-+		.subdev_info	= MGMT_RES_XBB_DSA52_U280,		\
-+		.subdev_num = ARRAY_SIZE(MGMT_RES_XBB_DSA52_U280),	\
-+		.flash_type = FLASH_TYPE_SPI,				\
-+	}
-+
- #define MGMT_RES_XBB_SMARTN						\
- 	((struct xocl_subdev_info []) {					\
- 		XOCL_DEVINFO_FEATURE_ROM_SMARTN,			\
-@@ -2772,6 +2804,24 @@ struct xocl_subdev_map {
- 		.board_name = "u50"					\
- 	}
- 
-+#define	XOCL_BOARD_U55N_USER_RAPTOR2					\
-+	(struct xocl_board_private){					\
-+		.flags = XOCL_DSAFLAG_DYNAMIC_IP,			\
-+		.board_name = "u55n",					\
-+		.subdev_info	= RES_USER_VSEC,			\
-+		.subdev_num = ARRAY_SIZE(RES_USER_VSEC),		\
-+	}
-+
-+#define	XOCL_BOARD_U55N_MGMT_RAPTOR2					\
-+	(struct xocl_board_private){					\
-+		.flags = XOCL_DSAFLAG_DYNAMIC_IP,                       \
-+		.subdev_info	= RES_MGMT_VSEC,			\
-+		.subdev_num = ARRAY_SIZE(RES_MGMT_VSEC),		\
-+		.flash_type = FLASH_TYPE_SPI,				\
-+		.board_name = "u55n",					\
-+		.vbnv = "xilinx_u55n"					\
-+	}
-+
- #define	XOCL_BOARD_U55C_USER_RAPTOR2					\
- 	(struct xocl_board_private){					\
- 		.flags = XOCL_DSAFLAG_DYNAMIC_IP,			\
-@@ -2790,6 +2840,24 @@ struct xocl_subdev_map {
- 		.vbnv = "xilinx_u55c"					\
- 	}
- 
-+#define	XOCL_BOARD_U50LV_USER_RAPTOR2					\
-+	(struct xocl_board_private){					\
-+		.flags = XOCL_DSAFLAG_DYNAMIC_IP,			\
-+		.board_name = "u50lv",					\
-+		.subdev_info	= RES_USER_VSEC,			\
-+		.subdev_num = ARRAY_SIZE(RES_USER_VSEC),		\
-+	}
-+
-+#define	XOCL_BOARD_U50LV_MGMT_RAPTOR2					\
-+	(struct xocl_board_private){					\
-+		.flags = XOCL_DSAFLAG_DYNAMIC_IP,                       \
-+		.subdev_info	= RES_MGMT_VSEC,			\
-+		.subdev_num = ARRAY_SIZE(RES_MGMT_VSEC),		\
-+		.flash_type = FLASH_TYPE_SPI,				\
-+		.board_name = "u50lv",					\
-+		.vbnv = "xilinx_u50lv"					\
-+	}
-+
- #define	XOCL_BOARD_U50C_USER_RAPTOR2					\
- 	(struct xocl_board_private){					\
- 		.flags = XOCL_DSAFLAG_DYNAMIC_IP,			\
-@@ -2834,6 +2902,14 @@ struct xocl_subdev_map {
- 		.p2p_bar_sz = 64,					\
- 	}
- 
-+#define	XOCL_BOARD_U280_USER_RAPTOR2					\
-+	(struct xocl_board_private){					\
-+		.flags = XOCL_DSAFLAG_DYNAMIC_IP, 			\
-+		.subdev_info	= RES_USER_VSEC,			\
-+		.subdev_num = ARRAY_SIZE(RES_USER_VSEC),		\
-+		.board_name = "u280",					\
-+	}
-+
- #define	XOCL_BOARD_U250_MGMT_RAPTOR2					\
- 	(struct xocl_board_private){					\
- 		.flags = XOCL_DSAFLAG_DYNAMIC_IP,			\
-@@ -2843,6 +2919,15 @@ struct xocl_subdev_map {
- 		.board_name = "u250"					\
- 	}
- 
-+#define	XOCL_BOARD_U280_MGMT_RAPTOR2					\
-+	(struct xocl_board_private){					\
-+		.flags = XOCL_DSAFLAG_DYNAMIC_IP,			\
-+		.subdev_info	= RES_MGMT_VSEC,			\
-+		.subdev_num = ARRAY_SIZE(RES_MGMT_VSEC),		\
-+		.flash_type = FLASH_TYPE_SPI,				\
-+		.board_name = "u280"					\
-+	}
-+
- #define	XOCL_BOARD_VERSAL_USER_RAPTOR2					\
- 	(struct xocl_board_private){					\
- 		.flags = XOCL_DSAFLAG_DYNAMIC_IP |			\
-@@ -3435,6 +3520,8 @@ struct xocl_subdev_map {
- 	{ XOCL_PCI_DEVID(0x10EE, 0x6A8F, 0x4353, MGMT_6A8F_DSA52) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5000, PCI_ANY_ID, MGMT_XBB_DSA52_U200) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5004, PCI_ANY_ID, MGMT_XBB_DSA52) },	\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x5008, PCI_ANY_ID, MGMT_XBB_DSA52_U280) },\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x500C, PCI_ANY_ID, MGMT_XBB_DSA52_U280) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5020, PCI_ANY_ID, MGMT_U50) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5028, PCI_ANY_ID, MGMT_VERSAL) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5044, PCI_ANY_ID, MGMT_VERSAL) },	\
-@@ -3448,7 +3535,9 @@ struct xocl_subdev_map {
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5078, PCI_ANY_ID, VERSAL_MGMT_RAPTOR2) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5050, PCI_ANY_ID, MGMT_U25) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x504E, PCI_ANY_ID, U26Z_MGMT_RAPTOR2) },	\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x5058, PCI_ANY_ID, U55N_MGMT_RAPTOR2) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x505C, PCI_ANY_ID, U55C_MGMT_RAPTOR2) },\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x5060, PCI_ANY_ID, U50LV_MGMT_RAPTOR2) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x506C, PCI_ANY_ID, U50C_MGMT_RAPTOR2) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5074, PCI_ANY_ID, X3522PV_MGMT_RAPTOR2) },	\
- 	{ XOCL_PCI_DEVID(0x13FE, 0x006C, PCI_ANY_ID, MGMT_6A8F) },	\
-@@ -3457,6 +3546,8 @@ struct xocl_subdev_map {
- 	{ XOCL_PCI_DEVID(0x10EE, 0xF987, PCI_ANY_ID, XBB_MFG("samsung_efuse")) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0xD000, PCI_ANY_ID, XBB_MFG("u200")) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0xD004, PCI_ANY_ID, XBB_MFG("u250")) },\
-+	{ XOCL_PCI_DEVID(0x10EE, 0xD008, PCI_ANY_ID, XBB_MFG("u280-es1")) }, \
-+	{ XOCL_PCI_DEVID(0x10EE, 0xD00C, PCI_ANY_ID, XBB_MFG("u280")) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0xD030, PCI_ANY_ID, XBB_MFG("poc1465")) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0xD020, PCI_ANY_ID, XBB_MFG_U50) }, \
- 	{ XOCL_PCI_DEVID(0x10EE, 0xD03C, PCI_ANY_ID, XBB_MFG_U30) }, \
-@@ -3495,11 +3586,15 @@ struct xocl_subdev_map {
- 	{ XOCL_PCI_DEVID(0x10EE, 0x7990, 0x4352, USER_DSA52) },		\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5001, PCI_ANY_ID, USER_DSA52) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5005, PCI_ANY_ID, USER_DSA52) },	\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x5009, PCI_ANY_ID, USER_DSA52_U280) },	\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x500D, PCI_ANY_ID, USER_DSA52_U280) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5021, PCI_ANY_ID, USER_U50) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5051, PCI_ANY_ID, USER_U25) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x504F, PCI_ANY_ID, U26Z_USER_RAPTOR2) },	\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x513D, PCI_ANY_ID, U30_USER_RAPTOR2) },       \
-+	{ XOCL_PCI_DEVID(0x10EE, 0x5059, PCI_ANY_ID, U55N_USER_RAPTOR2) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x505D, PCI_ANY_ID, U55C_USER_RAPTOR2) },\
-+	{ XOCL_PCI_DEVID(0x10EE, 0x5061, PCI_ANY_ID, U50LV_USER_RAPTOR2) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x506D, PCI_ANY_ID, U50C_USER_RAPTOR2) },\
- 	{ XOCL_PCI_DEVID(0x10EE, 0x5075, PCI_ANY_ID, X3522PV_USER_RAPTOR2) },	\
- 	{ XOCL_PCI_DEVID(0x13FE, 0x0065, PCI_ANY_ID, USER_XDMA) },	\
-@@ -3561,6 +3656,14 @@ struct xocl_subdev_map {
- 		.vbnv = "xilinx_u250",			\
- 		.priv_data = &XOCL_BOARD_U250_MGMT_RAPTOR2,		\
- 		.type = XOCL_DSAMAP_RAPTOR2 },				\
-+	{ 0x10EE, 0x500D, PCI_ANY_ID,					\
-+		.vbnv = "xilinx_u280",			\
-+		.priv_data = &XOCL_BOARD_U280_USER_RAPTOR2,		\
-+		.type = XOCL_DSAMAP_RAPTOR2 },				\
-+	{ 0x10EE, 0x500C, PCI_ANY_ID,					\
-+		.vbnv = "xilinx_u280",			\
-+		.priv_data = &XOCL_BOARD_U280_MGMT_RAPTOR2,		\
-+		.type = XOCL_DSAMAP_RAPTOR2 },				\
- 	{ 0x10EE, 0x5020, PCI_ANY_ID,					\
- 		.vbnv = "xilinx_u50",		\
- 		.priv_data = &XOCL_BOARD_U50_MGMT_RAPTOR2,		\
-- 
-2.45.2
-
--- a/m/raccoon/xilinx-xrt.nix
+++ b/m/raccoon/xilinx-xrt.nix
@@ -1,74 +0,0 @@
-{
-  stdenv
-, fetchFromGitHub
-, enableDebug ? false
-, lib
-, cmake
-, pkg-config
-, libdrm
-, libelf
-, opencl-headers
-, ocl-icd
-, git
-, boost
-, ncurses
-, openssl
-, rapidjson
-, protobuf
-, python3
-, libuuid
-, curl
-, libsystemtap
-, libxcrypt
-, udev
-}:
-
-with lib;
-
-stdenv.mkDerivation rec {
-  name = "xilinx-xrt";
-  version = "dc81a9cc";
-  src = fetchFromGitHub {
-    owner = "Xilinx";
-    repo = "XRT";
-    rev = "dc81a9cc852bf44e71aa3edde7c8f7d54f355eab";
-    hash = "sha256-SG1gIO8Bvgs5XQ7HswjWNavPH+m8xHXqauztuJa6aEo=";
-    fetchSubmodules = true;
-  };
-  dontStrip = true;
-  patches = [
-    ./xilinx-xrt-aiebu.patch
-    ./xilinx-xrt-icd.patch
-    ./xilinx-xrt-u280-support.patch
-  ];
-  cmakeFlags = [
-    "-DXRT_INSTALL_PREFIX=${placeholder "out"}"
-    "-DXRT_INSTALL_DIR=${placeholder "out"}"
-    "-DXRT_NATIVE_BUILD=yes"
-    "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON"
-    # Enable debug
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
-    #"-DCMAKE_BUILD_TYPE=Debug"
-    #"-DXOCL_VERBOSE=1"
-    #"-DXRT_VERBOSE=1"
-  ];
-  # A directory named "build" already exists
-  cmakeBuildDir = "the-build";
-
-  # Replace all occurences of /usr to $out, although some are not correct. By
-  # default they are replaced by /var/empty
-  dontFixCmake = true;
-  preConfigure = ''
-    find "." -type f \( -name "*.cmake" -o -name "*.cmake.in" -o -name CMakeLists.txt \) -print | 
-        while read fn; do
-            sed -e 's^/usr\([ /]\|$\)^'$out'\1^g' -e 's^/opt\([ /]\|$\)^'$out'\1^g' < "$fn" > "$fn.tmp"
-            mv "$fn.tmp" "$fn"
-        done
-  '';
-  nativeBuildInputs = [ cmake pkg-config git ];
-  buildInputs = [ libdrm.dev opencl-headers ocl-icd boost.dev ncurses
-    openssl.dev rapidjson protobuf python3 libelf libuuid.dev curl.dev
-    libsystemtap libxcrypt udev.out udev.dev
-  ];
-  hardeningDisable = [ "all" ];
-}
--- a/m/tent/configuration.nix
+++ b/m/tent/configuration.nix
@@ -0,0 +1,70 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ../common/xeon.nix
+    ../module/emulation.nix
+    ../module/debuginfod.nix
+    ../module/ssh-hut-extern.nix
+  ];
+
+  # Select the this using the ID to avoid mismatches
+  boot.loader.grub.device = "/dev/disk/by-id/wwn-0x55cd2e414d537675";
+
+  networking = {
+    hostName = "tent";
+    interfaces.eno1.ipv4.addresses = [
+      {
+        address = "10.0.44.4";
+        prefixLength = 24;
+      }
+    ];
+
+    # Only BSC DNSs seem to be reachable from the office VLAN
+    nameservers = [ "84.88.52.35" "84.88.52.36" ];
+    defaultGateway = "10.0.44.1";
+  };
+
+  nix.settings = {
+    substituters = [ "https://jungle.bsc.es/cache" ];
+    trusted-public-keys = [ "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" ];
+  };
+
+  services.prometheus.exporters.node = {
+    enable = true;
+    enabledCollectors = [ "systemd" ];
+    port = 9002;
+    listenAddress = "127.0.0.1";
+  };
+
+  boot.swraid = {
+    enable = true;
+    mdadmConf = ''
+      DEVICE partitions
+      ARRAY /dev/md0 metadata=1.2 UUID=496db1e2:056a92aa:a544543f:40db379d
+      MAILADDR root
+    '';
+  };
+
+  fileSystems."/vault" = {
+    device = "/dev/disk/by-label/vault";
+    fsType = "ext4";
+  };
+
+  # Make a /vault/$USER directory for each user.
+  systemd.services.create-vault-dirs = let
+    # Take only normal users in tent
+    users = lib.filterAttrs (_: v: v.isNormalUser) config.users.users;
+    commands = lib.concatLists (lib.mapAttrsToList
+      (_: user: [
+        "install -d -o ${user.name} -g ${user.group} -m 0711 /vault/${user.name}"
+      ]) users);
+    script = pkgs.writeShellScript "create-vault-dirs.sh" (lib.concatLines commands);
+  in {
+    enable = true;
+    wants = [ "local-fs.target" ];
+    after = [ "local-fs.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.ExecStart = script;
+  };
+}
--- a/pkgs/meteocat-exporter/default.nix
+++ b/pkgs/meteocat-exporter/default.nix
@@ -0,0 +1,25 @@
+{ python3Packages, lib }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "meteocat-exporter";
+  version = "1.0";
+
+  src = ./.;
+
+  doCheck = false;
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    beautifulsoup4
+    lxml
+    prometheus-client
+  ];
+
+  meta = with lib; {
+    description = "MeteoCat Prometheus Exporter";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/meteocat-exporter/meteocat-exporter
+++ b/pkgs/meteocat-exporter/meteocat-exporter
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+
+import time
+from prometheus_client import start_http_server, Gauge
+from bs4 import BeautifulSoup
+from urllib import request
+
+# Configuration -------------------------------------------
+meteo_station = "X8" # Barcelona - Zona Universitària
+listening_port = 9929
+update_period = 60 * 5 # Each 5 min
+# ---------------------------------------------------------
+
+metric_tmin = Gauge('meteocat_temp_min', 'Min temperature')
+metric_tmax = Gauge('meteocat_temp_max', 'Max temperature')
+metric_tavg = Gauge('meteocat_temp_avg', 'Average temperature')
+metric_srad = Gauge('meteocat_solar_radiation', 'Solar radiation')
+
+def update(st):
+    url = 'https://www.meteo.cat/observacions/xema/dades?codi=' + st
+    response = request.urlopen(url)
+    data = response.read()
+    soup = BeautifulSoup(data, 'lxml')
+    table = soup.find("table", {"class" : "tblperiode"})
+    rows = table.find_all('tr')
+    row = rows[-1] # Take the last row
+    row_data = []
+    header = row.find('th')
+    header_text = header.text.strip()
+    row_data.append(header_text)
+    for col in row.find_all('td'):
+        row_data.append(col.text)
+    try:
+        # Sometimes it will return '(s/d)' and fail to parse
+        metric_tavg.set(float(row_data[1]))
+        metric_tmax.set(float(row_data[2]))
+        metric_tmin.set(float(row_data[3]))
+        metric_srad.set(float(row_data[10]))
+        #print("ok: temp_avg={}".format(float(row_data[1])))
+    except:
+        print("cannot parse row: {}".format(row))
+        metric_tavg.set(float("nan"))
+        metric_tmax.set(float("nan"))
+        metric_tmin.set(float("nan"))
+        metric_srad.set(float("nan"))
+
+if __name__ == '__main__':
+    start_http_server(port=listening_port, addr="localhost")
+    while True:
+        try:
+            update(meteo_station)
+        except:
+            print("update failed")
+        time.sleep(update_period)
--- a/pkgs/meteocat-exporter/setup.py
+++ b/pkgs/meteocat-exporter/setup.py
@@ -0,0 +1,11 @@
+#!/usr/bin/env python
+
+from setuptools import setup, find_packages
+
+setup(name='meteocat-exporter',
+      version='1.0',
+      # Modules to import from other scripts:
+      packages=find_packages(),
+      # Executables
+      scripts=["meteocat-exporter"],
+     )
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -11,7 +11,7 @@ final: prev:
      paths = [ pmix.dev pmix.out ];
    };
  in prev.mpich.overrideAttrs (old: {
-    patches = [
+    patches = (old.patches or []) ++ [
      # See https://github.com/pmodels/mpich/issues/6946
      ./mpich-fix-hwtopo.patch
    ];
@@ -39,7 +39,21 @@ final: prev:
      # See https://bugs.schedmd.com/show_bug.cgi?id=19324
      ./slurm-rank-expansion.patch
    ];
+    # Install also the pam_slurm_adopt library to restrict users from accessing
+    # nodes with no job allocated.
+    postBuild = (old.postBuild or "") + ''
+      pushd contribs/pam_slurm_adopt
+        make "PAM_DIR=$out/lib/security"
+      popd
+    '';
+    postInstall = (old.postInstall or "") + ''
+      pushd contribs/pam_slurm_adopt
+        make "PAM_DIR=$out/lib/security" install
+      popd
+    '';
  });

  prometheus-slurm-exporter = prev.callPackage ./slurm-exporter.nix { };
+  meteocat-exporter = prev.callPackage ./meteocat-exporter/default.nix { };
+  upc-qaire-exporter = prev.callPackage ./upc-qaire-exporter/default.nix { };
 }
--- a/pkgs/upc-qaire-exporter/default.nix
+++ b/pkgs/upc-qaire-exporter/default.nix
@@ -0,0 +1,24 @@
+{ python3Packages, lib }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "upc-qaire-exporter";
+  version = "1.0";
+
+  src = ./.;
+
+  doCheck = false;
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    prometheus-client
+    requests
+  ];
+
+  meta = with lib; {
+    description = "UPC Qaire Prometheus Exporter";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/upc-qaire-exporter/setup.py
+++ b/pkgs/upc-qaire-exporter/setup.py
@@ -0,0 +1,11 @@
+#!/usr/bin/env python
+
+from setuptools import setup, find_packages
+
+setup(name='upc-qaire-exporter',
+      version='1.0',
+      # Modules to import from other scripts:
+      packages=find_packages(),
+      # Executables
+      scripts=["upc-qaire-exporter"],
+     )
--- a/pkgs/upc-qaire-exporter/upc-qaire-exporter
+++ b/pkgs/upc-qaire-exporter/upc-qaire-exporter
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+
+import time
+from prometheus_client import start_http_server, Gauge
+import requests, json
+from datetime import datetime, timedelta
+
+# Configuration -------------------------------------------
+listening_port = 9928
+update_period = 60 * 5 # Each 5 min
+# ---------------------------------------------------------
+
+metric_temp = Gauge('upc_c6_s302_temp', 'UPC C6 S302 temperature sensor')
+
+def genparams():
+    d = {}
+    d['topic'] = 'TEMPERATURE'
+    d['shift_dates_to'] = ''
+    d['datapoints'] = 301
+    d['devicesAndColors'] = '1148418@@@#40ACB6'
+
+    now = datetime.now()
+
+    d['fromDate'] = now.strftime('%d/%m/%Y')
+    d['toDate'] = now.strftime('%d/%m/%Y')
+    d['serviceFrequency'] = 'NONE'
+
+    # WTF!
+    for i in range(7):
+        for j in range(48):
+            key = 'week.days[{}].hours[{}].value'.format(i, j)
+            d[key] = 'OPEN'
+
+    return d
+
+def measure():
+    # First we need to load session
+    s = requests.Session()
+    r = s.get("https://upc.edu/sirena")
+    if r.status_code != 200:
+        print("bad HTTP status code on new session: {}".format(r.status_code))
+        return
+
+    if s.cookies.get("JSESSIONID") is None:
+        print("cannot get JSESSIONID")
+        return
+
+    # Now we can pull the data
+    url = "https://upcsirena.app.dexma.com/l_12535/analysis/by_datapoints/data.json"
+    r = s.post(url, data=genparams())
+
+    if r.status_code != 200:
+        print("bad HTTP status code on data: {}".format(r.status_code))
+        return
+
+    #print(r.text)
+    j = json.loads(r.content)
+
+    # Just take the last one
+    last = j['data']['chartElementList'][-1]
+    temp = last['values']['1148418-Temperatura']
+
+    return temp
+
+if __name__ == '__main__':
+    start_http_server(port=listening_port, addr="localhost")
+    while True:
+        try:
+            metric_temp.set(measure())
+        except:
+            print("measure failed")
+            metric_temp.set(float("nan"))
+
+        time.sleep(update_period)
--- a/secrets/ceph-user.age
+++ b/secrets/ceph-user.age
--- a/secrets/gitea-runner-token.age
+++ b/secrets/gitea-runner-token.age
--- a/secrets/gitlab-bsc-docker-token.age
+++ b/secrets/gitlab-bsc-docker-token.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 HY2yRg XPOFoZqY+AnKC77jrgNqAm1ADphurfuhO4NRrfiuUDc
+iCfMMpGHyaYHGy6ci8sqjUtcPeteLlyvLGEF79VPOEc
+-> ssh-ed25519 CAWG4Q 6OsGrnM+/c5lTN81Rvp166K+ygmSIFeSYzXxYg25KGE
+Av1zTw2zK4Gufzti9kQaye7C362GCiDRRHzCqBLR33g
+-> ssh-ed25519 MSF3dg 8CHqJ7mEDvjvqbmF+eE6Em1Wi6eHAzEUpiExC1gm7S0
+bdwzYHw3RAbdHq+RsiFUP++sQ586VUlSnAzAOhiQUjI
+--- gA5XSUfjUBol938sC5DbUf8PvQUIr2pNkS2nL95OF9c
+<EFBFBD><EFBFBD><EFBFBD>Ea1G7<47><37>ݩ[R<><52>\{~$Go<47>cQ<63>wKP&<26><><EFBFBD>w<EFBFBD><77><EFBFBD>6]
+<EFBFBD><EFBFBD>ѣ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>^z<7A>̄ 1k<31><6B><03><><EFBFBD><EFBFBD><EFBFBD>Y<EFBFBD><59>2<15>p<>2<EFBFBD><32>K<EFBFBD><4B><EFBFBD><EFBFBD>nok<>/X<><58>pt''<27><>$0co=<3D><EFBFBD>
--- a/secrets/gitlab-runner-docker-token.age
+++ b/secrets/gitlab-runner-docker-token.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 HY2yRg WvKK6U1wQtx2pbUDfuaUIXTQiCulDkz7hgUCSwMfMzQ
-jLktUMqKuVxukqzz++pHOKvmucUQqeKYy5IwBma7KxY
-> ssh-ed25519 CAWG4Q XKGuNNoYFl9bdZzsqYYTY7GsEt5sypLW4R+1uk78NmU
-8dIA2GzRAwTGM5CDHSM2BUBsbXzEAUssWUz2PY2PaTg
-> ssh-ed25519 MSF3dg T630RsKuZIF/bp+KITnIIWWHsg6M/VQGqbWQZxqT+AA
-SraZcgZJVtmUzHF/XR9J7aK5t5EDNpkC/av/WJUT/G8
--- /12G8pj9sbs591OM/ryhoLnSWWmzYcoqprk9uN/3g18
-<EFBFBD><EFBFBD><EFBFBD><01>%<25>]yi"<22><><EFBFBD>L<EFBFBD><0B><>H`<60>a$<24><>)<29>9ve<76>.0<EFBFBD>m<EFBFBD>K<EFBFBD>v<EFBFBD><EFBFBD><0B>u"|1c<31>-%<25><>"<22>WF<12><><EFBFBD>A<EFBFBD><41>h<EFBFBD>$<05><>j<e<><65>x<EFBFBD>Lx<4C><78>.?<3F><><EFBFBD>:L<><4C><EFBFBD><EFBFBD>,<2C>u<EFBFBD>|<7C><>F|<7C>i<EFBFBD><69><EFBFBD>
+-> ssh-ed25519 HY2yRg pXNTB/ailRwSEJG1pXvrzzpz5HqkDZdWVWnOH7JGeQ4
+NzA+2fxfkNRy/u+Zq96A02K1Vxy0ETYZjMkDVTKyCY8
+-> ssh-ed25519 CAWG4Q 7CLJWn+EAxoWDduXaOSrHaBFHQ4GIpYP/62FFTj3ZTI
+vSYV1pQg2qI2ngCzM0nCZAnqdz1tbT4hM5m+/TyGU2c
+-> ssh-ed25519 MSF3dg Akmp4NcZcDuaYHta/Vej6zulNSrAOCd5lmSV+OiBGC4
+qTxqVzTyywur+GjtUQdbaIUdH1fqCqPe6qPf8iHRa4w
+--- uCKNqD1TmZZThOzlpsecBKx/k+noIWhCVMr/pzNwBr8
+r'<27>Ƌs4<15>˺<EFBFBD>Aĥ<41>P<05>L<EFBFBD><4C>7`	<09><02><>)H<><48>-<2D>0<EFBFBD>AH<41>5<16><><1F><>L<EFBFBD>Qe<51><65>H2b<32><1D>B޲<42>CJG<4A>"-S<><1C>\<5C><><0C>H<n<>V
--- a/secrets/gitlab-runner-shell-token.age
+++ b/secrets/gitlab-runner-shell-token.age
--- a/secrets/ipmi.yml.age
+++ b/secrets/ipmi.yml.age
--- a/secrets/jungle-robot-password.age
+++ b/secrets/jungle-robot-password.age
--- a/secrets/munge-key.age
+++ b/secrets/munge-key.age
--- a/secrets/nix-serve.age
+++ b/secrets/nix-serve.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -9,8 +9,10 @@ in
  "gitea-runner-token.age".publicKeys = hut;
  "gitlab-runner-docker-token.age".publicKeys = hut;
  "gitlab-runner-shell-token.age".publicKeys = hut;
+  "gitlab-bsc-docker-token.age".publicKeys = hut;
  "nix-serve.age".publicKeys = hut;
  "jungle-robot-password.age".publicKeys = hut;
+  "ipmi.yml.age".publicKeys = hut;

  "ceph-user.age".publicKeys = safe;
  "munge-key.age".publicKeys = safe;
--- a/web/content/access/index.md
+++ b/web/content/access/index.md
@@ -11,7 +11,7 @@ access to the login machine using a resource petition in the BSC intranet.

 Then, to request access to the machines we will need some information about you:

-1. Which machines you want access to (hut, owl1, owl2, eudy, koro...)
+1. Which machines you want access to ([hut](/hut), [fox](/fox), owl1, owl2, eudy, koro...)
 1. Your user name and user id (to match the NFS permissions)
 1. Your real name and surname (for identification purposes)
 1. The salted hash of your login password, generated with `mkpasswd -m sha-512`
--- a/web/content/doc/_index.md
+++ b/web/content/doc/_index.md
@@ -0,0 +1,10 @@
+---
+title: "Docs"
+description: "Documentation for users of jungle machines"
+date: 2023-09-15
+---
+
+If this is the first time you use any of the jungle machines with NixOS, follow
+the [quick start guide](quickstart).
+
+
--- a/web/content/doc/quickstart.md
+++ b/web/content/doc/quickstart.md
@@ -0,0 +1,234 @@
+---
+title: "Quick start"
+date: 2023-09-15
+---
+
+This documentation will guide you on how to build custom packages of software
+and use them in the jungle machines. It has been designed to reduce the friction
+from users coming from module systems.
+
+You should be able to access the jungle machines, otherwise [request
+access](/access).
+
+## Changes from other HPC machines
+
+Users of other machines have been using the Lmod tool (module load ...) to add
+or remove programs from their environment, as well as manually building their
+own software for too many years.
+
+While we cannot prevent users from continuing to use this tedious mechanism, we
+have designed the jungle machines to be much easier to operate by using the nix
+package manager.
+
+### Freedom to install packages
+
+When a user wanted to install a package, it was forced to either do it on its
+own directory, or request a system administrator to install it in a shared
+directory, so other users can also use that package.
+
+This situation is gone, each user can install any package of software by
+themselves, without requiring any other authorization. When two users request
+the same package, the same copy will be provided.
+
+A new package will be downloaded if it is available (someone already built it)
+or will be built from source on demand.
+
+### No changes over time
+
+All users retain the same versions of the packages they request until they
+decide to update them.
+
+## Using nix to manage packages
+
+In this chapter we show how to install packages and enter a development shell to
+build new programs from source. The examples are done from the hut machine,
+read [this page](/access) to request access.
+
+### Installing binaries
+
+To temporarily install new packages, use:
+
+```text
+hut% nix shell jungle#gcc jungle#cowsay jungle#ovni
+```
+
+Notice that the packages are described as two parts divided by the `#` symbol.
+The first part defines where to take the package from and the second part is
+the name of the package. For now we will use `jungle#<package>`. You can find
+many more packages here:
+
+<https://search.nixos.org/packages>
+
+You will now enter a new shell, where those requested package **binaries are
+available in $PATH**:
+
+```text
+hut% cowsay hello world
+ _____________
+< hello world >
+ -------------
+        \   ^__^
+         \  (oo)\_______
+            (__)\       )\/\
+                ||----w |
+                ||     ||
+
+hut% ovniver
+LD_LIBRARY_PATH not set
+libovni: build v1.11.0 (a7103f8), dynamic v1.11.0 (a7103f8)
+
+hut% gcc --version
+gcc (GCC) 13.3.0
+Copyright (C) 2023 Free Software Foundation, Inc.
+This is free software; see the source for copying conditions.  There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+```
+
+### Building programs
+
+The above method only loads new binaries in the `$PATH`. If we try to build a
+program that includes headers or links with a library, it will fail to find
+them:
+
+```text
+hut$ cat test.c
+#include <ovni.h>
+
+int main()
+{
+        ovni_version_check();
+        return 0;
+}
+hut% gcc test.c -lovni -o test
+test.c:1:10: fatal error: ovni.h: No such file or directory
+    1 | #include <ovni.h>
+      |          ^~~~~~~~
+compilation terminated.
+```
+
+We could manually add the full path to the ovni include directory with `-I` and
+the libraries with `-L`, but there is a tool that already perform these steps
+automatically for us, `nix develop`.
+
+Let's go back to our original shell first, where those packages are not
+available anymore:
+
+```
+hut% ps
+    PID TTY          TIME CMD
+2356260 pts/1    00:00:01 zsh
+2457268 pts/1    00:00:00 zsh
+2457297 pts/1    00:00:00 ps
+hut% exit
+hut% ovniver
+ovniver: command not found
+```
+
+### Creating a flake.nix
+
+To define which packages we want, we will write a small file that list them, a
+flake.nix file.
+
+First, we will create a new directory where we are going to be working:
+
+```
+hut% mkdir example
+hut% cd exmple
+```
+
+Then place this flake.nix file:
+
+```nix
+{
+  inputs.jungle.url = "jungle";
+  outputs = { self, jungle }:  
+  let
+    pkgs = jungle.outputs.packages.x86_64-linux;
+  in {
+    devShells.x86_64-linux.default = pkgs.mkShell {
+      pname = "devshell";
+      buildInputs = with pkgs; [
+        ovni gcc cowsay # more packages here...
+      ];
+    };
+  };
+}
+```
+
+
+Now enter the shell with:
+
+```
+hut% nix develop
+warning: creating lock file '/home/Computational/rarias/example/flake.lock':
+• Added input 'jungle':
+    'path:/nix/store/27srv8haj6vv4ywrbmw0a8vds561m8rq-source?lastModified=1739479441&narHash=sha256-Kgjs8SO1w9NbPBu8ghwzCxYJ9kvWpoQOT%2BXwPvA9DcU%3D&rev=76396c0d67ef0cf32377d5c1894bb695293bca9d' (2025-02-13)
+• Added input 'jungle/agenix':
+    'github:ryantm/agenix/f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41?narHash=sha256-b%2Buqzj%2BWa6xgMS9aNbX4I%2BsXeb5biPDi39VgvSFqFvU%3D' (2024-08-10)
+• Added input 'jungle/agenix/darwin':
+    'github:lnl7/nix-darwin/4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d?narHash=sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0%3D' (2023-11-24)
+• Added input 'jungle/agenix/darwin/nixpkgs':
+    follows 'jungle/agenix/nixpkgs'
+• Added input 'jungle/agenix/home-manager':
+    'github:nix-community/home-manager/3bfaacf46133c037bb356193bd2f1765d9dc82c1?narHash=sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE%3D' (2023-12-20)
+• Added input 'jungle/agenix/home-manager/nixpkgs':
+    follows 'jungle/agenix/nixpkgs'
+• Added input 'jungle/agenix/nixpkgs':
+    follows 'jungle/nixpkgs'
+• Added input 'jungle/agenix/systems':
+    'github:nix-systems/default/da67096a3b9bf56a91d16901293e51ba5b49a27e?narHash=sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768%3D' (2023-04-09)
+• Added input 'jungle/bscpkgs':
+    'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=6782fc6c5b5a29e84a7f2c2d1064f4bcb1288c0f' (2024-11-29)
+• Added input 'jungle/bscpkgs/nixpkgs':
+    follows 'jungle/nixpkgs'
+• Added input 'jungle/nixpkgs':
+    'github:NixOS/nixpkgs/9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc?narHash=sha256-i/UJ5I7HoqmFMwZEH6vAvBxOrjjOJNU739lnZnhUln8%3D' (2025-01-14)
+
+hut$ 
+```
+
+Notice that long list of messages is Nix creating a new flake.lock file with the
+current state of the packages. Next invocations will use the same packages as
+described by the lock file.
+
+### Building a program from nix develop
+
+Now let's try again building our test program:
+
+```text
+hut$ cat test.c
+#include <ovni.h>
+
+int main()
+{
+        ovni_version_check();
+        return 0;
+}
+hut$ gcc test.c -o test -lovni
+hut$ ldd test
+        linux-vdso.so.1 (0x00007ffff7fc4000)
+        libovni.so.1 => /nix/store/sqk972akjv0q8dchn8ccjln2llzyyfd0-ovni-1.11.0/lib/libovni.so.1 (0x00007ffff7fab000)
+        libc.so.6 => /nix/store/nqb2ns2d1lahnd5ncwmn6k84qfd7vx2k-glibc-2.40-36/lib/libc.so.6 (0x00007ffff7db2000)
+        /nix/store/nqb2ns2d1lahnd5ncwmn6k84qfd7vx2k-glibc-2.40-36/lib/ld-linux-x86-64.so.2 => /nix/store/nqb2ns2d1lahnd5ncwmn6k84qfd7vx2k-glibc-2.40-36/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fc6000)
+hut$ ./test
+```
+
+Now the ovni.h header and the libovni library are found and the program is
+successfully built, linked and executed.
+
+You can add more packages as needed in your flake.nix:
+
+```nix
+  buildInputs = with pkgs; [
+    ovni gcc cowsay # more packages here...
+  ];
+```
+
+Make sure you exit the develop shell first, and then enter again with `nix
+develop`.
+
+## Remember
+
+- `nix shell` places binaries in the `$PATH`.
+- `nix develop` enters a development shell where both binaries and the libraries
+  and includes are available so you can build new programs.
--- a/web/content/fox/_index.md
+++ b/web/content/fox/_index.md
@@ -0,0 +1,97 @@
+---
+title: "Fox"
+description: "AMD Genoa 9684X with 2 NVIDIA RTX4000 GPUs"
+date: 2025-02-12
+---
+
+![Fox](fox.jpg)
+
+Picture by [Joanne Redwood](https://web.archive.org/web/20191109175146/https://www.inaturalist.org/photos/6568074),
+[CC0](http://creativecommons.org/publicdomain/zero/1.0/deed.en).
+
+The *fox* machine is a big GPU server that is configured to run heavy workloads.
+It has two fast AMD CPUs with large cache and 2 reasonable NVIDIA GPUs. Here are
+the detailed specifications:
+
+- 2x AMD GENOA X 9684X DP/UP 96C/192T 2.55G 1,150M 400W SP5 3D V-cach
+- 24x 32GB DDR5-4800 ECC RDIMM (total 768 GiB of RAM)
+- 1x 2.5" SSD SATA3 MICRON 5400 MAX 480GB
+- 2x 2.5" KIOXIA CM7-R 1.92TB NVMe GEN5 PCIe 5x4
+- 2x NVIDIA RTX4000 ADA Gen 20GB GDDR6 PCIe 4.0
+
+## Access
+
+To access the machine, request a SLURM session from [hut](/hut) using the `fox`
+partition:
+
+    hut% salloc -p fox
+
+Then connect via ssh:
+
+    hut% ssh fox
+    fox%
+
+Follow [these steps](/access) if you don't have access to hut or fox.
+
+## CUDA
+
+To use CUDA, you can use the following `flake.nix` placed in a new directory to
+load all the required dependencies:
+
+```nix
+{
+  inputs.jungle.url = "jungle";
+
+  outputs = { jungle, ... }: {
+    devShell.x86_64-linux = let
+      pkgs = jungle.nixosConfigurations.fox.pkgs;
+    in pkgs.mkShell {
+      name = "cuda-env-shell";
+      buildInputs = with pkgs; [
+        git gitRepo gnupg autoconf curl
+        procps gnumake util-linux m4 gperf unzip
+
+        # Cuda packages (more at https://search.nixos.org/packages)
+        cudatoolkit linuxPackages.nvidia_x11
+        cudaPackages.cuda_cudart.static
+        cudaPackages.libcusparse
+
+        libGLU libGL
+        xorg.libXi xorg.libXmu freeglut
+        xorg.libXext xorg.libX11 xorg.libXv xorg.libXrandr zlib
+        ncurses5 stdenv.cc binutils
+      ];
+      shellHook = ''
+        export CUDA_PATH=${pkgs.cudatoolkit}
+        export LD_LIBRARY_PATH=/var/run/opengl-driver/lib
+        export SMS=50
+      '';
+    };
+  };
+}
+```
+
+Then just run `nix develop` from the same directory:
+
+    % mkdir cuda
+    % cd cuda
+    % vim flake.nix
+    [...]
+    % nix develop
+    $ nvcc -V
+    nvcc: NVIDIA (R) Cuda compiler driver
+    Copyright (c) 2005-2024 NVIDIA Corporation
+    Built on Tue_Feb_27_16:19:38_PST_2024
+    Cuda compilation tools, release 12.4, V12.4.99
+    Build cuda_12.4.r12.4/compiler.33961263_0
+
+## Filesystems
+
+The machine has several file systems available.
+
+- `$HOME`: Mounted via NFS across all nodes. It is slow and has low capacity.
+  Don't abuse.
+- `/ceph/home/$USER`: Shared Ceph file system across jungle nodes. Slow but high
+  capacity. Stores three redundant copies of every file.
+- `/nvme{0,1}/$USER`: The two local NVME disks, very fast and large capacity.
+- `/tmp`: tmpfs, fast but not backed by a disk. Will be erased on reboot.
--- a/web/content/fox/fox.jpg
+++ b/web/content/fox/fox.jpg
--- a/web/content/hut/_index.md
+++ b/web/content/hut/_index.md
@@ -13,6 +13,115 @@ which is available at `hut` or `xeon07`. It runs the following services:
 - Grafana: to plot the data in the web browser.
 - Slurmctld: to manage the SLURM nodes.
 - Gitlab runner: to run CI jobs from Gitlab.
+- Nix binary cache: to serve cached nix builds

 This node is prone to interruptions from all the services it runs, so it is not
 a good candidate for low noise executions.
+
+# Binary cache
+
+We provide a binary cache in `hut`, with the aim of avoiding unnecessary
+recompilation of packages.
+
+The cache should contain common packages from bscpkgs, but we don't provide
+any guarantee that of what will be available in the cache, or for how long.
+We recommend following the latest version of the `jungle` flake to avoid cache
+misses.
+
+## Usage
+
+### From NixOS
+
+In NixOS, we can add the cache through the `nix.settings` option, which will
+enable it for all builds in the system.
+
+```nix
+{ ... }: {
+  nix.settings = {
+    substituters = [ "https://jungle.bsc.es/cache" ];
+    trusted-public-keys = [ "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" ];
+  };
+}
+```
+
+### Interactively
+
+The cache can also be specified in a per-command basis through the flags
+`--substituters` and `--trusted-public-keys`:
+
+```sh
+nix build --substituters "https://jungle.bsc.es/cache" --trusted-public-keys "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" <...>
+```
+
+Note: you'll have to be a trusted user.
+
+### Nix configuration file (non-nixos)
+
+If using nix outside of NixOS, you'll have to update `/etc/nix/nix.conf`
+
+```
+# echo "substituters = https://jungle.bsc.es/cache" >> /etc/nix/nix.conf
+# echo "trusted-public-keys = jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" >> /etc/nix/nix.conf
+```
+
+### Hint in flakes
+
+By adding the configuration below to a `flake.nix`, when someone uses the flake,
+`nix` will interactively ask to trust and use the provided binary cache:
+
+```nix
+{
+  nixConfig = {
+    extra-substituters = [
+      "https://jungle.bsc.es/cache"
+    ];
+    extra-trusted-public-keys = [
+      "jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0="
+    ];
+  };
+  outputs = { ... }: {
+    ...
+  };
+}
+```
+
+### Querying the cache
+
+Check if the cache is available:
+```sh
+$ curl https://jungle.bsc.es/cache/nix-cache-info
+StoreDir: /nix/store
+WantMassQuery: 1
+Priority: 30
+```
+
+Prevent nix from building locally:
+```bash
+nix build --max-jobs 0 <...>
+```
+
+Check if a package is in cache:
+```bash
+# Do a raw eval on the <package>.outPath (this should not build the package)
+$ nix eval --raw jungle#openmp.outPath
+/nix/store/dwnn4dgm1m4184l4xbi0qfrprji9wjmi-openmp-2024.11
+# Take the hash (everything from / to - in the basename) and curl <hash>.narinfo
+# if it exists in the cache, it will return HTTP 200 and some information
+# if not, it will return 404
+$ curl https://jungle.bsc.es/cache/dwnn4dgm1m4184l4xbi0qfrprji9wjmi.narinfo
+StorePath: /nix/store/dwnn4dgm1m4184l4xbi0qfrprji9wjmi-openmp-2024.11
+URL: nar/dwnn4dgm1m4184l4xbi0qfrprji9wjmi-17imkdfqzmnb013d14dx234bx17bnvws8baf3ii1xra5qi2y1wiz.nar
+Compression: none
+NarHash: sha256:17imkdfqzmnb013d14dx234bx17bnvws8baf3ii1xra5qi2y1wiz
+NarSize: 1519328
+References: 4gk773fqcsv4fh2rfkhs9bgfih86fdq8-gcc-13.3.0-lib nqb2ns2d1lahnd5ncwmn6k84qfd7vx2k-glibc-2.40-36
+Deriver: vcn0x8hikc4mvxdkvrdxp61bwa5r7lr6-openmp-2024.11.drv
+Sig: jungle.bsc.es:GDTOUEs1jl91wpLbb+gcKsAZjpKdARO9j5IQqb3micBeqzX2M/NDtKvgCS1YyiudOUdcjwa3j+hyzV2njokcCA==
+# In oneline:
+$ curl "https://jungle.bsc.es/cache/$(nix eval --raw jungle#<package>.outPath | cut -d '/' -f4 | cut -d '-' -f1).narinfo"
+```
+
+#### References
+
+- https://nix.dev/guides/recipes/add-binary-cache.html
+- https://nixos.wiki/wiki/Binary_Cache
--- a/web/content/paste/_index.md
+++ b/web/content/paste/_index.md
@@ -0,0 +1,68 @@
+---
+title: "Paste"
+description: "Paste service"
+author: "Rodrigo Arias Mallo"
+date: 2024-09-20
+---
+
+The hut machine provides a paste service using the program `p` (as in paste).
+
+You can use it directly from the hut machine or remotely if you have [SSH
+access](/access) to hut using the following alias:
+
+```
+alias p="ssh hut p"
+```
+
+You can add it to bashrc or zshrc for persistent installation.
+
+## Usage
+
+The `p` command reads from the standard input, uploads the content to a file
+in the ceph filesystem and prints the URL to access it. It only accepts an
+optional argument, which is the extension of the file that will be stored on
+disk (without the dot). By default it uses the `txt` extension, so plain text
+can be read in the browser directly.
+
+```
+p [extension]
+```
+
+To remove files, go to `/ceph/p/$USER` and remove them manually.
+
+## Examples
+
+Share a text file, in this case the source of p itself:
+
+```
+hut% p < m/hut/p.nix
+https://jungle.bsc.es/p/rarias/okbtG130.txt
+```
+
+Paste the last dmesg lines directly from a pipe:
+
+```
+hut% dmesg | tail -5 | p
+https://jungle.bsc.es/p/rarias/luX4STm9.txt
+```
+
+Upload a PNG picture from a file:
+
+```
+hop% p png < mark-api-cpu.png
+https://jungle.bsc.es/p/rarias/oSRAMVsE.png
+```
+
+Take an screenshot and upload it as a PNG file:
+
+```
+hop% scrot -s - | p png
+https://jungle.bsc.es/p/rarias/SOgK5EV0.png
+```
+
+Upload a directory by creating a tar.gz file on the fly:
+
+```
+hop% tar c ovni | gzip | p tar.gz
+https://jungle.bsc.es/p/rarias/tkwROcTR.tar.gz
+```
--- a/web/hugo.toml
+++ b/web/hugo.toml
@@ -3,26 +3,38 @@ languageCode = 'en-us'
 title = 'The jungle'
 theme = 'PaperMod'

+[[menu.main]]
+identifier = "doc"
+name = "Docs"
+url = "/doc/"
+weight = 10
+
 [[menu.main]]
 identifier = "grafana"
 name = "Grafana"
 url = "/grafana/"
-weight = 10
+weight = 20

 [[menu.main]]
 identifier = "Git"
 name = "Git"
 url = "/git/"
-weight = 20
+weight = 30

 [[menu.main]]
 identifier = "Lists"
 name = "Lists"
 url = "/lists/"
-weight = 30
+weight = 40
+
+[[menu.main]]
+identifier = "Paste"
+name = "Paste"
+url = "/paste/"
+weight = 50

 [[menu.main]]
 identifier = "Posts"
 name = "Posts"
 url = "/posts/"
-weight = 40
+weight = 60
--- a/web/themes/PaperMod/layouts/partials/templates/opengraph.html
+++ b/web/themes/PaperMod/layouts/partials/templates/opengraph.html
@@ -49,4 +49,4 @@
 {{ end }}{{ end }}

 {{- /* Facebook Page Admin ID for Domain Insights */}}
-{{- with site.Social.facebook_admin }}<meta property="fb:admins" content="{{ . }}" />{{ end }}
+{{- with site.Params.Social.facebook_admin }}<meta property="fb:admins" content="{{ . }}" />{{ end }}
--- a/web/themes/PaperMod/layouts/partials/templates/twitter_cards.html
+++ b/web/themes/PaperMod/layouts/partials/templates/twitter_cards.html
@@ -28,6 +28,6 @@
 {{- end }}
 <meta name="twitter:title" content="{{ .Title }}"/>
 <meta name="twitter:description" content="{{ with .Description }}{{ . }}{{ else }}{{if .IsPage}}{{ .Summary }}{{ else }}{{ with site.Params.description }}{{ . }}{{ end }}{{ end }}{{ end -}}"/>
-{{ with site.Social.twitter -}}
+{{ with site.Params.Social.twitter -}}
 <meta name="twitter:site" content="@{{ . }}"/>
 {{ end -}}
Author	SHA1	Message	Date
Rodrigo Arias Mallo	4f2422eca2	Create directories in /vault for tent users	2025-06-03 19:10:34 +02:00
Rodrigo Arias Mallo	ec7c883ae4	Add software RAID in tent using 3 disks	2025-06-03 19:00:26 +02:00
Rodrigo Arias Mallo	c2c4fa0226	Add access to tent to all hut users too	2025-06-03 18:16:57 +02:00
Rodrigo Arias Mallo	bcb2bb252d	Add hut SSH configuration from outside SSF LAN	2025-06-03 18:16:52 +02:00
Rodrigo Arias Mallo	e813c811ac	Don't use proxy in base preset	2025-06-03 18:05:41 +02:00
Rodrigo Arias Mallo	da20987f99	Add tent machine from xeon04 We moved the tent machine to the server room in the BSC building and is now directly connected to the raccoon via NAT. Fixes: #106	2025-06-03 18:05:34 +02:00
Rodrigo Arias Mallo	650be88015	Create specific SSF rack configuration Allow xeon machines to optionally inherit SSF configuration such as the NFS mount point and the network configuration.	2025-06-03 12:22:07 +02:00
Aleix Roca Nonell	b802a59868	Create tracing group and add arocanon in raccoon Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 11:09:41 +02:00
Aleix Roca Nonell	7247f7e665	Extend perf support in raccoon Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 11:09:30 +02:00
Aleix Roca Nonell	1d555871a5	Enable nixdebuginfod in raccoon Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:50:01 +02:00
Rodrigo Arias Mallo	a2535c996d	Make raccoon use performance governor Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:35 +02:00
Rodrigo Arias Mallo	37e60afb54	Enable binfmt emulation in raccoon Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:33 +02:00
Rodrigo Arias Mallo	3fe138a418	Disable nix garbage collector in raccoon Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:31 +02:00
Rodrigo Arias Mallo	4e7a9f7ce4	Add dbautist user to raccoon machine Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:28 +02:00
Rodrigo Arias Mallo	a6a1af673a	Add node exporter monitoring in raccoon Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:26 +02:00
Rodrigo Arias Mallo	2a3a7b2fb2	Allow X11 forwarding via SSH Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:23 +02:00
Rodrigo Arias Mallo	b4ab1c836a	Enable linger for user rarias Allows services to run without a login session. Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:45:19 +02:00
Rodrigo Arias Mallo	fb8b4defa7	Only proxy SSH git remotes via hut in xeon Other machines like raccoon have direct access. Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-06-03 10:44:31 +02:00
Rodrigo Arias Mallo	1bcfbf8cd6	Add machine map file Documents the location, board and serial numbers so we can track the machines if they move around. Some information is unkown. Using the Nix language to encode the machines location and properties allows us to later use that information in the configuration of the machines themselves. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 14:55:58 +02:00
Rodrigo Arias Mallo	9f43a0e13b	Remove fox monitoring via IPMI We will need to setup an VPN to be able to access fox in its new location, so for now we simply remove the IPMI monitoring. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:53 +02:00
Rodrigo Arias Mallo	3a3c3050ef	Monitor fox, gateway and UPC anella via ICMP Fox should reply once the machine is connected to the UPC network. Monitoring also the gateway and UPC anella allows us to estimate if the whole network is down or just fox. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:51 +02:00
Rodrigo Arias Mallo	4419f68948	Update configuration for UPC network The fox machine will be placed in the UPC network, so we update the configuration with the new IP and gateway. We won't be able to reach hut directly so we also remove the host entry and proxy. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:48 +02:00
Rodrigo Arias Mallo	e51fc9ffa5	Disable home via NFS in fox It won't be accesible anymore as we won't be in the same LAN. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:46 +02:00
Rodrigo Arias Mallo	2ae9e9b635	Rekey all secrets Fox is no longer able to use munge or ceph, so we remove the key and rekey them. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:44 +02:00
Rodrigo Arias Mallo	be77f6a5f5	Rotate fox SSH host key Prevent decrypting old secrets by reading the git history. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:42 +02:00
Rodrigo Arias Mallo	6316a12a67	Distrust fox SSH key We no longer will share secrets with fox until we can regain our trust. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:38 +02:00
Rodrigo Arias Mallo	db663913d8	Remove Ceph module from fox It will no longer be accesible from the UPC. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:36 +02:00
Rodrigo Arias Mallo	b4846b0f6c	Remove fox from SLURM Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:20 +02:00
Rodrigo Arias Mallo	64a52801ed	Remove pam_slurm_adopt from fox We no longer will be able to use SLURM from jungle. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-06-02 11:26:02 +02:00
Rodrigo Arias Mallo	7a2f37aaa2	Add UPC temperature sensor monitoring These sensors are part of their air quality measurements, which just happen to be very close to our server room. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-05-29 13:01:37 +02:00
Rodrigo Arias Mallo	aae6585f66	Add meteocat exporter Allows us to track ambient temperature changes and estimate the temperature delta between the server room and exterior temperature. We should be able to predict when we would need to stop the machines due to excesive temperature as summer approaches. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-05-29 13:01:29 +02:00
Rodrigo Arias Mallo	1c15e77c83	Add custom nix-daemon exporter Allows us to see which derivations are being built in realtime. It is a bit of a hack, but it seems to work. We simply look at the environment of the child processes of nix-daemon (usually bash) and then look for the $name variable which should hold the current derivation being built. Needs root to be able to read the environ file of the different nix-daemon processes as they are owned by the nixbld* users. See: https://discourse.nixos.org/t/query-ongoing-builds/23486 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-05-29 12:57:07 +02:00
Rodrigo Arias Mallo	82fc3209de	Set keep-outputs to true in all machines From the documentation of keep-outputs, setting it to true would prevent the GC from removing build time dependencies: If true, the garbage collector will keep the outputs of non-garbage derivations. If false (default), outputs will be deleted unless they are GC roots themselves (or reachable from other roots). In general, outputs must be registered as roots separately. However, even if the output of a derivation is registered as a root, the collector will still delete store paths that are used only at build time (e.g., the C compiler, or source tarballs downloaded from the network). To prevent it from doing so, set this option to true. See: https://nix.dev/manual/nix/2.24/command-ref/conf-file.html#conf-keep-outputs Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>	2025-04-22 17:27:37 +02:00
Rodrigo Arias Mallo	abeab18270	Add raccoon node exporter monitoring Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-22 14:50:08 +02:00
Rodrigo Arias Mallo	1985b58619	Increase data retention to 5 years Now that we have more space, we can extend the retention time to 5 years to hold the monitoring metrics. For a year we have: # du -sh /var/lib/prometheus2 13G /var/lib/prometheus2 So we can expect it to increase to about 65 GiB. In the future we may want to reduce some adquisition frequency. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-22 14:50:03 +02:00
Rodrigo Arias Mallo	44bd061823	Don't forward any docker traffic Access to the 23080 local port will be done by applying the INPUT rules, which pass through nixos-fw. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-15 14:16:15 +02:00
Rodrigo Arias Mallo	e8c309f584	Allow traffic from docker to enter port 23080 Before: hut% sudo docker run -it --rm alpine /bin/ash -xc 'true \| nc -w 3 -v 10.0.40.7 23080' + true + nc -w 3 -v 10.0.40.7 23080 nc: 10.0.40.7 (10.0.40.7:23080): Operation timed out After: hut% sudo docker run -it --rm alpine /bin/ash -xc 'true \| nc -w 3 -v 10.0.40.7 23080' + true + nc -w 3 -v 10.0.40.7 23080 10.0.40.7 (10.0.40.7:23080) open Fixes: #94 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-15 14:16:10 +02:00
Rodrigo Arias Mallo	71ae7fb585	Add bscpm04.bsc.es SSH host and public key Allows fetching repositories from hut and other machines in jungle without the need to do any extra configuration. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-15 14:15:45 +02:00
Aleix Boné	8834d561d2	Add nix cache documentation section Include usage from NixOS and non-NixOS hosts and a test with curl to ensure it can be reached. Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-04-15 14:08:22 +02:00
Aleix Boné	29daa3c364	Use hut nix cache in owl1, owl2 and raccoon For owl1 and owl2 directly connect to hut via LAN with HTTP, but for raccoon pass via the proxy using jungle.bsc.es with HTTPS. There is no risk of tampering as packages are signed. Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-04-15 14:08:17 +02:00
Rodrigo Arias Mallo	9c503fbefb	Clean all iptables rules on stop Prevents the "iptables: Chain already exists." error by making sure that we don't leave any chain on start. The ideal solution is to use iptables-restore instead, which will do the right job. But this needs to be changed in NixOS entirely. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-15 14:08:14 +02:00
Rodrigo Arias Mallo	51b6a8b612	Make nginx listen on all interfaces Needed for local hosts to contact the nix cache via HTTP directly. We also allow the incoming traffic on port 80. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-15 14:08:07 +02:00
Aleix Boné	52213d388d	Fix nginx /cache regex `nix-serve` does not handle duplicates in the path: ``` hut$ curl http://127.0.0.1:5000/nix-cache-info StoreDir: /nix/store WantMassQuery: 1 Priority: 30 hut$ curl http://127.0.0.1:5000//nix-cache-info File not found. ``` This meant that the cache was not accessible via: `curl https://jungle.bsc.es/cache/nix-cache-info` but `curl https://jungle.bsc.es/cachenix-cache-info` worked. Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-04-15 14:08:04 +02:00
Rodrigo Arias Mallo	edf744db8d	Add new GitLab runner for gitlab.bsc.es It uses docker based on alpine and the host nix store, so we can perform builds but isolate them from the system. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:41:18 +02:00
Rodrigo Arias Mallo	b82894eaec	Remove SLURM partition all We no longer have homogeneous nodes so it doesn't make much sense to allocate a mix of them. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:27 +02:00
Rodrigo Arias Mallo	1c47199891	Add varcila user to hut and fox Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:25 +02:00
Rodrigo Arias Mallo	8738bd4eeb	Adjust fox slurm config after disabling SMT Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:23 +02:00
Rodrigo Arias Mallo	7699783aac	Add abonerib user to fox Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:21 +02:00
Rodrigo Arias Mallo	fee1d4da7e	Don't move doc in web output Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:19 +02:00
Rodrigo Arias Mallo	b77ce7fb56	Add quickstart guide Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:17 +02:00
Rodrigo Arias Mallo	b4a12625c5	Reject SSH connections without SLURM allocation Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:15 +02:00
Rodrigo Arias Mallo	302106ea9a	Add users to fox Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:13 +02:00
Rodrigo Arias Mallo	96877de8d9	Add dalvare1 user Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:11 +02:00
Rodrigo Arias Mallo	8878985be6	Add fox page in jungle website Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:08 +02:00
Rodrigo Arias Mallo	737578db34	Mount NVME disks in /nvme{0,1} Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:06 +02:00
Rodrigo Arias Mallo	88555e3f8c	Exclude fox from being suspended by slurm Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:04 +02:00
Rodrigo Arias Mallo	feb2060be7	Use IPMI host names instead of IP addresses Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:15:01 +02:00
Rodrigo Arias Mallo	00999434c2	Add fox IPMI monitoring Use agenix to store the credentials safely. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:14:59 +02:00
Rodrigo Arias Mallo	29d58cc62d	Add new fox machine Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-04-08 17:14:42 +02:00
Rodrigo Arias Mallo	587caf262e	Update PM GitLab tokens to new URL Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 15:43:13 +01:00
Rodrigo Arias Mallo	2730404ca5	Fix MPICH build by fetching upstream patches too Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 15:43:13 +01:00
Rodrigo Arias Mallo	84db5e6fd6	Fix papermod theme in website for new hugo Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 15:43:13 +01:00
Rodrigo Arias Mallo	f4f34a3159	flake.lock: Update Flake lock file updates: • Updated input 'agenix': 'github:ryantm/agenix/de96bd907d5fbc3b14fc33ad37d1b9a3cb15edc6' (2024-07-09) → 'github:ryantm/agenix/f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41' (2024-08-10) • Updated input 'bscpkgs': 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=de89197a4a7b162db7df9d41c9d07759d87c5709' (2024-04-24) → 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=6782fc6c5b5a29e84a7f2c2d1064f4bcb1288c0f' (2024-11-29) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/693bc46d169f5af9c992095736e82c3488bf7dbb' (2024-07-14) → 'github:NixOS/nixpkgs/9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc' (2025-01-14) Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 15:43:13 +01:00
Rodrigo Arias Mallo	91b8b4a3c5	Set nixpkgs to track nixos-24.11 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 15:43:13 +01:00
Rodrigo Arias Mallo	6cad205269	Add script to monitor GPFS Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 15:43:07 +01:00
Rodrigo Arias Mallo	c57bf76969	Add BSC machines to ssh config Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:51 +01:00
Rodrigo Arias Mallo	ad4b615211	Collect statistics from logged users Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:48 +01:00
Rodrigo Arias Mallo	b4518b59cf	Add custom GPFS exporter for MN5 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:46 +01:00
Rodrigo Arias Mallo	45dc4124a3	Remove exception to fetch task endpoint It causes the request to go to the website rather than the Gitea service. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:43 +01:00
Rodrigo Arias Mallo	bdfe9a48fd	Use SSD for boot, then switch to NVME Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:40 +01:00
Rodrigo Arias Mallo	1b337d31f8	Use NVME as root Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:37 +01:00
Rodrigo Arias Mallo	717cd5a21e	Keep host header for Grafana requests This was breaking requests due to CSRF check. See: https://github.com/grafana/grafana/issues/45117#issuecomment-1033842787 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:32 +01:00
Rodrigo Arias Mallo	def5955614	Ignore logging requests from the gitea runner Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:28 +01:00
Rodrigo Arias Mallo	0e3c975cb5	Log the client IP not the proxy Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:22 +01:00
Rodrigo Arias Mallo	93189a575e	Ignore misc directory Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:19 +01:00
Rodrigo Arias Mallo	36592c44eb	Create paste directories in /ceph/p Ensure that all hut users have a paste directory in /ceph/p owned by themselves. We need to wait for the ceph mount point to create them, so we use a systemd service that waits for the remote-fs.target. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:16 +01:00
Rodrigo Arias Mallo	a34e3752a2	Add paste documentation in jungle website Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:13 +01:00
Rodrigo Arias Mallo	0d2dea94fb	Add p command to paste files Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:10 +01:00
Rodrigo Arias Mallo	7f539d7e06	Use nginx to serve website and other services Instead of using multiple tunels to forward all our services to the VM that serves jungle.bsc.es, just use nginx to redirect the traffic from hut. This allows adding custom rules for paths that are not posible otherwise. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:23:07 +01:00
Rodrigo Arias Mallo	f8ec090836	Mount the NVME disk in /nvme Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-01-16 14:22:58 +01:00