Enable pam_slurm_adopt in all compute nodes

Prevents access to owl1 and owl2 too if the user doesn't have any jobs running there.
Don't suspend owl compute nodes
2025-10-31 11:27:44 +01:00 · 2025-10-31 11:27:44 +01:00
36 changed files with 60 additions and 174 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -2,16 +2,16 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1767634882,
-        "narHash": "sha256-2GffSfQxe3sedHzK+sTKlYo/NTIAGzbFCIsNMUPAAnk=",
+        "lastModified": 1752436162,
+        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "3c9db02515ef1d9b6b709fc60ba9a540957f661c",
+        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 {
  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
  };

  outputs = { self, nixpkgs, ... }:
--- a/m/apex/configuration.nix
+++ b/m/apex/configuration.nix
@@ -57,18 +57,6 @@
    };
  };

-  services.fail2ban = {
-    enable = true;
-    maxretry = 5;
-    bantime-increment = {
-      enable = true; # Double ban time on each attack
-      maxtime = "7d"; # Ban up to a week
-    };
-  };
-
-  # Disable SSH login with password, allow only keypair
-  services.openssh.settings.PasswordAuthentication = false;
-
  networking.firewall = {
    extraCommands = ''
      # Blackhole BSC vulnerability scanner (OpenVAS) as it is spamming our
--- a/m/bay/configuration.nix
+++ b/m/bay/configuration.nix
@@ -24,7 +24,7 @@
      address = "10.0.40.40";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.40";
      prefixLength = 24;
    } ];
--- a/m/common/base/boot.nix
+++ b/m/common/base/boot.nix
@@ -4,6 +4,13 @@
  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;

+  # Enable GRUB2 serial console
+  boot.loader.grub.extraConfig = ''
+    serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
+    terminal_input --append serial
+    terminal_output --append serial
+  '';
+
  boot.kernel.sysctl = {
    "kernel.perf_event_paranoid" = lib.mkDefault "-1";

--- a/m/common/base/env.nix
+++ b/m/common/base/env.nix
@@ -1,10 +1,10 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:

 {
  environment.systemPackages = with pkgs; [
    vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
    nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
-    ncdu perf ldns pv
+    ncdu config.boot.kernelPackages.perf ldns pv
    # From jungle overlay
    osumb nixgen
  ];
--- a/m/common/base/users.nix
+++ b/m/common/base/users.nix
@@ -139,7 +139,6 @@
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
        ];
-        shell = pkgs.zsh;
      };

      pmartin1 = {
--- a/m/common/base/watchdog.nix
+++ b/m/common/base/watchdog.nix
@@ -5,5 +5,5 @@
  boot.kernelModules = [ "ipmi_watchdog" ];

  # Enable systemd watchdog with 30 s interval
-  systemd.settings.Manager.RuntimeWatchdogSec = 30;
+  systemd.watchdog.runtimeTime = "30s";
 }
--- a/m/common/xeon/console.nix
+++ b/m/common/xeon/console.nix
@@ -11,11 +11,4 @@
    "console=tty1"
    "console=ttyS0,115200"
  ];
-
-  # Enable GRUB2 serial console
-  boot.loader.grub.extraConfig = ''
-    serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
-    terminal_input --append serial
-    terminal_output --append serial
-  '';
 }
--- a/m/eudy/kernel/perf.nix
+++ b/m/eudy/kernel/perf.nix
@@ -1,6 +1,11 @@
-{ pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:

 {
+  # add the perf tool
+  environment.systemPackages = with pkgs; [
+    config.boot.kernelPackages.perf
+  ];
+
  # allow non-root users to read tracing data from the kernel
  boot.kernel.sysctl."kernel.perf_event_paranoid" = -2;
  boot.kernel.sysctl."kernel.kptr_restrict" = 0;
--- a/m/fox/configuration.nix
+++ b/m/fox/configuration.nix
@@ -3,13 +3,13 @@
 {
  imports = [
    ../common/base.nix
+    ../common/xeon/console.nix
    ../module/amd-uprof.nix
    ../module/emulation.nix
    ../module/nvidia.nix
    ../module/slurm-client.nix
    ../module/hut-substituter.nix
    ./wireguard.nix
-    ./serial-console.nix
  ];

  # Don't turn off on August as UPC has different dates.
@@ -19,9 +19,6 @@
  # Select the this using the ID to avoid mismatches
  boot.loader.grub.device = "/dev/disk/by-id/wwn-0x500a07514b0c1103";

-  # Increase time so we can boot other entries
-  boot.loader.timeout = 60;
-
  # No swap, there is plenty of RAM
  swapDevices = lib.mkForce [];

@@ -34,10 +31,7 @@
  # Use performance for benchmarks
  powerManagement.cpuFreqGovernor = "performance";

-  # Enable amd-uprof in >= 6.15 kernels only
-  services.amd-uprof.enable =
-    let ver = config.boot.kernelPackages.kernel.version;
-    in (lib.strings.compareVersions ver "6.15") >= 0;
+  services.amd-uprof.enable = true;

  # Disable NUMA balancing
  boot.kernel.sysctl."kernel.numa_balancing" = 0;
@@ -48,11 +42,6 @@
  # Disable NMI watchdog to save one hw counter (for AMD uProf)
  boot.kernel.sysctl."kernel.nmi_watchdog" = 0;

-  specialisation.oldKernel.configuration = {
-    system.nixos.tags = [ "old-kernel" ];
-    boot.kernelPackages = lib.mkForce pkgs.linuxPackages_6_12;
-  };
-
  services.openssh.settings.X11Forwarding = true;

  services.fail2ban.enable = true;
--- a/m/fox/serial-console.nix
+++ b/m/fox/serial-console.nix
@@ -1,21 +0,0 @@
-{
-  # Restart the serial console
-  systemd.services."serial-getty@ttyS1" = {
-    enable = true;
-    wantedBy = [ "getty.target" ];
-    serviceConfig.Restart = "always";
-  };
-
-  # Enable serial console
-  boot.kernelParams = [
-    "console=tty1"
-    "console=ttyS1,115200"
-  ];
-
-  # Enable GRUB2 serial console
-  boot.loader.grub.extraConfig = ''
-    serial --unit=1 --speed=115200 --word=8 --parity=no --stop=1
-    terminal_input --append serial
-    terminal_output --append serial
-  '';
-}
--- a/m/hut/configuration.nix
+++ b/m/hut/configuration.nix
@@ -45,7 +45,7 @@
      address = "10.0.40.7";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.7";
      prefixLength = 24;
    } ];
--- a/m/lake2/configuration.nix
+++ b/m/lake2/configuration.nix
@@ -46,7 +46,7 @@
      address = "10.0.40.42";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.42";
      prefixLength = 24;
    } ];
--- a/m/module/debuginfod.nix
+++ b/m/module/debuginfod.nix
@@ -1,10 +1,3 @@
 {
-  services.nixseparatedebuginfod2 = {
-    enable = true;
-    substituters = [
-      "local:"
-      "https://cache.nixos.org"
-      "http://hut/cache"
-    ];
-  };
+  services.nixseparatedebuginfod.enable = true;
 }
--- a/m/owl1/configuration.nix
+++ b/m/owl1/configuration.nix
@@ -20,7 +20,7 @@
      address = "10.0.40.1";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.1";
      prefixLength = 24;
    } ];
--- a/m/owl2/configuration.nix
+++ b/m/owl2/configuration.nix
@@ -21,7 +21,7 @@
      prefixLength = 24;
    } ];
    # Watch out! The OmniPath device is not in the same place here:
-    interfaces.ibs801.ipv4.addresses = [ {
+    interfaces.ibp129s0.ipv4.addresses = [ {
      address = "10.0.42.2";
      prefixLength = 24;
    } ];
--- a/m/raccoon/configuration.nix
+++ b/m/raccoon/configuration.nix
@@ -4,7 +4,6 @@
  imports = [
    ../common/base.nix
    ../common/ssf/hosts.nix
-    ../common/xeon/console.nix
    ../module/emulation.nix
    ../module/debuginfod.nix
    ../module/nvidia.nix
--- a/m/tent/gitea.nix
+++ b/m/tent/gitea.nix
@@ -27,7 +27,4 @@
      };
    };
  };
-
-  # Allow gitea user to send mail
-  users.users.gitea.extraGroups = [ "mail-robot" ];
 }
--- a/overlay.nix
+++ b/overlay.nix
@@ -30,8 +30,7 @@ let
      amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
    });
    lmbench = callPackage ./pkgs/lmbench/default.nix { };
-    # Broken and unmantained
-    # mcxx = callPackage ./pkgs/mcxx/default.nix { };
+    mcxx = callPackage ./pkgs/mcxx/default.nix { };
    meteocat-exporter = prev.callPackage ./pkgs/meteocat-exporter/default.nix { };
    mpi = final.mpich; # Set MPICH as default
    mpich = callPackage ./pkgs/mpich/default.nix { mpich = prev.mpich; };
--- a/pkgs/amd-uprof/driver.nix
+++ b/pkgs/amd-uprof/driver.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
  '';
  hardeningDisable = [ "pic" "format" ];
  nativeBuildInputs = kernel.moduleBuildDependencies;
-  patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
+  patches = [ ./makefile.patch ./hrtimer.patch ];
  makeFlags = [
    "KERNEL_VERSION=${kernel.modDirVersion}"
    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
--- a/pkgs/amd-uprof/remove-wr-rdmsrq.patch
+++ b/pkgs/amd-uprof/remove-wr-rdmsrq.patch
@@ -1,20 +0,0 @@
-diff --git a/inc/PwrProfAsm.h b/inc/PwrProfAsm.h
-index d77770a..c93a0e9 100644
--- a/inc/PwrProfAsm.h
-+++ b/inc/PwrProfAsm.h
-@@ -347,6 +347,7 @@
- 
- #endif
- 
-+/*
- #define rdmsrq(msr,val1,val2,val3,val4) ({ \
-         __asm__ __volatile__( \
-                               "rdmsr\n" \
-@@ -362,6 +363,7 @@
-                               :"c"(msr), "a"(val1), "d"(val2), "S"(val3), "D"(val4) \
-                             ); \
-     })
-+*/
- 
- #define rdmsrpw(msr,val1,val2,val3,val4) ({ \
-         __asm__ __volatile__( \
--- a/pkgs/bench6/default.nix
+++ b/pkgs/bench6/default.nix
@@ -9,15 +9,13 @@
 , nanos6
 , nodes
 , nosv
-, mkl
 , mpi
 , tampi
 , openblas
 , ovni
 , gitBranch ? "master"
 , gitURL ? "ssh://git@bscpm04.bsc.es/rarias/bench6.git"
-, gitCommit ? "fe30c2cfe36b535ef26a0054e010bc005e88ba04"
-, useMkl ? true
+, gitCommit ? "bf29a53113737c3aa74d2fe3d55f59868faea7b4"
 }:

 stdenv.mkDerivation rec {
@@ -44,13 +42,10 @@ stdenv.mkDerivation rec {
    nosv
    mpi
    tampi
-    ovni
-  ] ++ (if (useMkl) then [
-    mkl
-  ] else [
    openblas
    openblas.dev
-  ]);
+    ovni
+  ];

  env = {
    NANOS6_HOME = nanos6;
--- a/pkgs/cudainfo/default.nix
+++ b/pkgs/cudainfo/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
  src = ./.;
  buildInputs = [
    cudatoolkit # Required for nvcc
-    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
+    cudaPackages.cuda_cudart.static # Required for -lcudart_static
    autoAddDriverRunpath
  ];
  installPhase = ''
--- a/pkgs/gpi-2/default.nix
+++ b/pkgs/gpi-2/default.nix
@@ -9,6 +9,7 @@
 , automake
 , libtool
 , mpi
+, rsync
 , gfortran
 }:

@@ -43,24 +44,13 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--with-infiniband=${rdma-core-all}"
-    "--with-mpi=yes" # fixes mpi detection when cross-compiling
+    "--with-mpi=${mpiAll}"
    "--with-slurm"
    "CFLAGS=-fPIC"
    "CXXFLAGS=-fPIC"
  ];

-  nativeBuildInputs = [
-    autoconf
-    automake
-    gfortran
-    libtool
-  ];
-
-  buildInputs = [
-    slurm
-    mpiAll
-    rdma-core-all
-  ];
+  buildInputs = [ slurm mpiAll rdma-core-all autoconf automake libtool rsync gfortran ];

  hardeningDisable = [ "all" ];

@@ -70,6 +60,5 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl3Plus;
-    cross = false; # infiniband detection does not work
  };
 }
--- a/pkgs/intel-oneapi/2023.nix
+++ b/pkgs/intel-oneapi/2023.nix
@@ -10,7 +10,7 @@
 , zlib
 , autoPatchelfHook
 , libfabric
-, gcc
+, gcc13
 , wrapCCWith
 }:

@@ -33,6 +33,8 @@ let
    maintainers = with lib.maintainers.bsc; [ abonerib ];
  };

+  gcc = gcc13;
+
  v = {
    hpckit   = "2023.1.0";
    compiler = "2023.1.0";
--- a/pkgs/llvm-ompss2/default.nix
+++ b/pkgs/llvm-ompss2/default.nix
@@ -27,10 +27,10 @@ let
  # We need to replace the lld linker from bintools with our linker just built,
  # otherwise we run into incompatibility issues when mixing compiler and linker
  # versions.
-  bintools-unwrapped = llvmPackages_latest.bintools-unwrapped.override {
+  bintools-unwrapped = llvmPackages_latest.tools.bintools-unwrapped.override {
    lld = clangOmpss2Unwrapped;
  };
-  bintools = llvmPackages_latest.bintools.override {
+  bintools = llvmPackages_latest.tools.bintools.override {
    bintools = bintools-unwrapped;
  };
  targetConfig = stdenv.targetPlatform.config;
--- a/pkgs/mcxx/default.nix
+++ b/pkgs/mcxx/default.nix
@@ -65,7 +65,6 @@ stdenv.mkDerivation rec {
  ];

  meta = {
-    broken = true;
    homepage = "https://github.com/bsc-pm/mcxx";
    description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
    maintainers = with lib.maintainers.bsc; [ rpenacob ];
--- a/pkgs/meteocat-exporter/default.nix
+++ b/pkgs/meteocat-exporter/default.nix
@@ -1,11 +1,9 @@
 { python3Packages, lib }:

-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication rec {
  pname = "meteocat-exporter";
  version = "1.0";

-  pyproject = true;
-
  src = ./.;

  doCheck = false;
--- a/pkgs/mpich/default.nix
+++ b/pkgs/mpich/default.nix
@@ -6,13 +6,6 @@
 , pmix
 , gfortran
 , symlinkJoin
-# Disabled when cross-compiling
-# To fix cross compilation, we should fill the values in:
-# https://github.com/pmodels/mpich/blob/main/maint/fcrosscompile/cross_values.txt.in
-# For each arch
-, enableFortran ? stdenv.hostPlatform == stdenv.buildPlatform
-, perl
-, targetPackages
 }:

 let
@@ -22,13 +15,10 @@ let
    paths = [ pmix.dev pmix.out ];
  };
 in mpich.overrideAttrs (old: {
-  buildInputs = old.buildInputs ++ [
+  buildInput = old.buildInputs ++ [
    libfabric
    pmixAll
  ];
-  nativeBuildInputs = old.nativeBuildInputs ++ [
-    perl
-  ];
  configureFlags = [
    "--enable-shared"
    "--enable-sharedlib"
@@ -41,21 +31,10 @@ in mpich.overrideAttrs (old: {
  ] ++ lib.optionals (lib.versionAtLeast gfortran.version "10") [
    "FFLAGS=-fallow-argument-mismatch" # https://github.com/pmodels/mpich/issues/4300
    "FCFLAGS=-fallow-argument-mismatch"
-  ] ++ lib.optionals (!enableFortran) [
-    "--disable-fortran"
  ];
-
-  preFixup = ''
-    sed -i 's:^CC=.*:CC=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc:' $out/bin/mpicc
-    sed -i 's:^CXX=.*:CXX=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++:' $out/bin/mpicxx
-  '' + lib.optionalString enableFortran ''
-    sed -i 's:^FC=.*:FC=${targetPackages.gfortran or gfortran}/bin/${targetPackages.gfortran.targetPrefix or gfortran.targetPrefix}gfortran:' $out/bin/mpifort
-  '';
-
  hardeningDisable = [ "all" ];

  meta = old.meta // {
    maintainers = old.meta.maintainers ++ (with lib.maintainers.bsc; [ rarias ]);
-    cross = true;
  };
 })
--- a/pkgs/osu/default.nix
+++ b/pkgs/osu/default.nix
@@ -32,11 +32,6 @@ stdenv.mkDerivation rec {
      "CXX=mpicxx"
  ];

-  env = {
-    MPICH_CC="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
-    MPICH_CXX="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
-  };
-
  postInstall = ''
    mkdir -p $out/bin
    for f in $(find $out -executable -type f); do
@@ -49,6 +44,5 @@ stdenv.mkDerivation rec {
    homepage = "http://mvapich.cse.ohio-state.edu/benchmarks/";
    maintainers = [ ];
    platforms = lib.platforms.all;
-    cross = true;
  };
 }
--- a/pkgs/paraver/default.nix
+++ b/pkgs/paraver/default.nix
@@ -12,7 +12,7 @@
 , paraverKernel
 , openssl
 , glibcLocales
-, wrapGAppsHook3
+, wrapGAppsHook
 }:

 let
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
    autoconf
    automake
    autoreconfHook
-    wrapGAppsHook3
+    wrapGAppsHook
  ];

  buildInputs = [
--- a/pkgs/sonar/default.nix
+++ b/pkgs/sonar/default.nix
@@ -35,6 +35,5 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.mit;
-    cross = true;
  };
 }
--- a/pkgs/tagaspi/default.nix
+++ b/pkgs/tagaspi/default.nix
@@ -5,14 +5,23 @@
 , automake
 , autoconf
 , libtool
+, mpi
 , autoreconfHook
 , gpi-2
 , boost
 , numactl
 , rdma-core
 , gfortran
+, symlinkJoin
 }:

+let
+  mpiAll = symlinkJoin {
+    name = "mpi-all";
+    paths = [ mpi.all ];
+  };
+in
+
 stdenv.mkDerivation rec {
  pname = "tagaspi";
  enableParallelBuilding = true;
@@ -26,18 +35,16 @@ stdenv.mkDerivation rec {
    hash = "sha256-RGG/Re2uM293HduZfGzKUWioDtwnSYYdfeG9pVrX9EM=";
  };

-  nativeBuildInputs = [
+  buildInputs = [
    autoreconfHook
    automake
    autoconf
    libtool
-    gfortran
-  ];
-
-  buildInputs = [
    boost
    numactl
    rdma-core
+    gfortran
+    mpiAll
  ];

  dontDisableStatic = true;
@@ -56,6 +63,5 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl3Plus;
-    cross = false; # gpi-2 cannot cross
  };
 }
--- a/pkgs/tampi/default.nix
+++ b/pkgs/tampi/default.nix
@@ -68,6 +68,5 @@ in stdenv.mkDerivation {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl3Plus;
-    cross = true;
  };
 }
--- a/pkgs/upc-qaire-exporter/default.nix
+++ b/pkgs/upc-qaire-exporter/default.nix
@@ -1,11 +1,9 @@
 { python3Packages, lib }:

-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication rec {
  pname = "upc-qaire-exporter";
  version = "1.0";

-  pyproject = true;
-
  src = ./.;

  doCheck = false;