459 Commits

Author SHA1 Message Date
8e0345b866 Add acinca user
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
7350983bb3 Restart slurmd on failure
A failure to reach the control node can cause slurmd to fail and the
unit remains in the failed state until is manually restarted. Instead,
try to restart the service every 30 seconds, forever:

    owl1% systemctl show slurmd | grep -E 'Restart=|RestartUSec='
    Restart=on-failure
    RestartUSec=30s
    owl1% pgrep slurmd
    5903
    owl1% sudo kill -SEGV 5903
    owl1% pgrep slurmd
    6137

Fixes: #177
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
7c34907f52 Lower connect timeout when using hut substituter
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:18 +02:00
15098cb89f Use hut substituter in all nodes
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:18 +02:00
31a3ac4a4d Remove machine access for user csiringo
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:18 +02:00
8cbb9dd58a Add web post update for 2025
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
dbeb973863 Mount apex /home via NFS in raccoon
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
cb8f27071d Remove extra SSH jump configuration
We now have direct visibility among nodes so we don't need any extra
SSH configuration to reach them.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
4021e98def Add raccoon peer to wireguard
It routes traffic from fox, apex and the compute nodes so that we can
reach the git servers and tent.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
5afcdbba5e Add raccoon host key
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
71b24e1b28 Restrict fox peer to a single IP
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
407e93eff3 Use lowercase peer hostnames
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
36c5befc5b Share a public folder for documents
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
59fd50fbee Fix AMDuProfPcm so it finds libnuma.so
We change the search procedure so it detects NixOS from /etc/os-release
and uses "libnuma.so" when calling dlopen, instead of harcoding a full
path to /usr. The full patch of libnuma is stored in the runpath, so
dlopen can find it.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
Tested-by: Vincent Arcila <vincent.arcila@bsc.es>
2025-10-01 16:40:18 +02:00
113097f2fd Add amd_hsmp module in fox for AMD uProf
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
6d4ec8dedc Add AMD uProf section to fox documentation
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
9fcb7c4caa Fix hidden dependencies for AMDuProfSys
It tries to dlopen libcrypt.so.1 and libstdc++.so.6, so we make sure
they are available by adding them to the runpath.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
723860aea0 Disable NMI watchdog in fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
9ea0d5f7ac Fix amd-uprof dependencies with patchelf
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
ceb93bdd6b Fix hrtimer new interface
The hrtimer_init() is now done via hrtimer_setup() with the callback
function as argument.

See: https://lwn.net/Articles/996598/
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
7f8a8c8ea3 Use CFLAGS_MODULE instead of EXTRA_CFLAGS
Fixes the build in Linux 6.15.6, as it was not able to find the include
files.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
814e3b4f0b Add AMD uProf module and enable it in fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
db57b52db4 Add AMD uProf package and driver
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
d43d432a98 Add /nfs/home to fox documentation
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
f793d3efdc Mount home via NFS from apex in fox
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
76c36b1c41 Allow access to NFS via wireguard subnet
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
0de9a4c9c4 Use 10.106.0.0/24 subnet to avoid collisions
The 106 byte is the code for 'j' (jungle) in ASCII:

	% printf j | od -t d
	0000000         106
	0000001

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
c1dea8fdf0 Update fox documentation for SLURM and FS
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
85996dd334 Revert "Remove pam_slurm_adopt from fox"
This reverts commit 64a52801ed.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
35cac2964c Enable fail2ban in fox
Protect fox against ssh bruteforce attacks:

fox% sudo lastb | head
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:25 - 11:25  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:24 - 11:24  (00:00)
root     ssh:notty    200.124.28.102   Mon Sep  1 11:24 - 11:24  (00:00)

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
2a1782c8ad Accept connections from apex to fox slurmd
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
6bde1db500 Accept fox connection to slurm controller
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
cf0692795c Add fox machine to SLURM
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
cbfaa4cb6f Rekey secrets with trusted fox key
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
7e60c2c0dd Trust fox for compute node secrets
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
d41aeba923 Make apex host specific to each machine
Allows direct contact via the VPN when accessing from fox, but use
Internet when using the rest of the machines.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
8de6b0c1c3 Add local host fox in apex
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
710982378b Enable wireguard in apex
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
725a826ea4 Add wireguard server in fox
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
c8444b696a Use writeShellScript for suspend.sh and resume.sh
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
b5d22b2d27 Add firewall rules to slurm server
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
8d0b759524 Remove hut from slurm
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
6a99b096e8 Only configure apex as slurm server
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
9daa2a2649 Split slurm configuration for client and server
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
86ec606121 Move slurm control server to apex
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
b1a2effdd6 Fix typo in csiringo ssh key
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:18 +02:00
96a85c107b Enable nix-ld in weasel
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:18 +02:00
f19f343330 Add csiringo user with access to apex and weasel
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:18 +02:00
3e378ae523 Access gitlab via raccoon in fox
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:18 +02:00
5eb2e2516a Move StartLimit* options to unit section
The StartLimitBurst and StartLimitIntervalSec options belong to the
[Unit] section, otherwise they are ignored in [Service]:

> Unknown key 'StartLimitIntervalSec' in section [Service], ignoring.

When using [Unit], the limits are properly set:

  apex% systemctl show power-policy.service | grep StartLimit
  StartLimitIntervalUSec=10min
  StartLimitBurst=10
  StartLimitAction=none

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
0805684887 Set power policy to always turn on
In all machines, as soon as we recover the power, turn the machine back
on. We cannot rely on the previous state as we will shut them down
before the power is cut to prevent damage on the power supply
monitoring circuit.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
a433a1686b Add NixOS module to control power policy
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
9fa66aaa41 Move August shutdown to 3rd at 22h
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:18 +02:00
49ffca7492 Disable automatic August shutdown for Fox
The UPC has different dates for the yearly power cut, and Fox can
recover properly from a power loss, so we don't need to have it turned
off before the power cut. Simply disabling the timer is enough.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
eaeff6a564 Add cudainfo program to test CUDA
The cudainfo program checks that we can initialize the CUDA RT library
and communicate with the driver. It can be used as standalone program or
built with cudainfo.gpuCheck so it is executed inside the build sandbox
to see if it also works fine. It uses the autoAddDriverRunpath hook to
inject in the runpath the location of the library directory for CUDA
libraries.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
4db07cb9c3 Add missing symlink in cuda sandbox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
e2d8a17fad Enable cuda systemFeature in raccoon and fox
This allows running derivations which depend on cuda runtime without
breaking the sandbox. We only need to add `requiredSystemFeatures = [ "cuda" ];`
to the derivation.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
a05ef0c3eb Move shared nvidia settings to a separate module
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
ef2f2115de Replace xeon07 by hut in ssh config
The xeon07 machine has been renamed to hut.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
deb3370cdc Enable automatic Nix GC in raccoon
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
1d2dca5869 Select proprietary NVIDIA driver in raccoon
The NVIDIA GTX 960 from 2016 has the Maxwell architecture, and NixOS
suggests using the proprietary driver for older than Turing:

> It is suggested to use the open source kernel modules on Turing or
> later GPUs (RTX series, GTX 16xx), and the closed source modules
> otherwise.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
111c13d200 Enable open source NVidia driver in fox
It is recommended for newer versions.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
ef166563d8 Remove option allowUnfree from fox and raccoon
It is already set to true for all machines.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
9e5ce89600 Ban another scanner trying to connect via SSH
It is constantly spamming out logs:

apex# journalctl | grep 'Connection closed by 84.88.52.176' | wc -l
2255

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
9c11076a43 Update weasel IPMI hostname for monitoring
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
a81aebc788 Remove merged MPICH patch
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
0a39169d17 Remove package ix as it is gone
Fails with: "error: ix has been removed from Nixpkgs, as the ix.io
pastebin has been offline since Dec. 2023".

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
957da4b1fd flake.lock: Update
Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41?narHash=sha256-b%2Buqzj%2BWa6xgMS9aNbX4I%2BsXeb5biPDi39VgvSFqFvU%3D' (2024-08-10)
  → 'github:ryantm/agenix/531beac616433bac6f9e2a19feb8e99a22a66baf?narHash=sha256-9P1FziAwl5%2B3edkfFcr5HeGtQUtrSdk/MksX39GieoA%3D' (2025-06-17)
• Updated input 'agenix/darwin':
    'github:lnl7/nix-darwin/4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d?narHash=sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0%3D' (2023-11-24)
  → 'github:lnl7/nix-darwin/43975d782b418ebf4969e9ccba82466728c2851b?narHash=sha256-dyN%2BteG9G82G%2Bm%2BPX/aSAagkC%2BvUv0SgUw3XkPhQodQ%3D' (2025-04-12)
• Updated input 'agenix/home-manager':
    'github:nix-community/home-manager/3bfaacf46133c037bb356193bd2f1765d9dc82c1?narHash=sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE%3D' (2023-12-20)
  → 'github:nix-community/home-manager/abfad3d2958c9e6300a883bd443512c55dfeb1be?narHash=sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs%3D' (2025-04-24)
• Updated input 'bscpkgs':
    'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=6782fc6c5b5a29e84a7f2c2d1064f4bcb1288c0f' (2024-11-29)
  → 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=9d1944c658929b6f98b3f3803fead4d1b91c4405' (2025-06-11)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc?narHash=sha256-i/UJ5I7HoqmFMwZEH6vAvBxOrjjOJNU739lnZnhUln8%3D' (2025-01-14)
  → 'github:NixOS/nixpkgs/dfcd5b901dbab46c9c6e80b265648481aafb01f8?narHash=sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw%3D' (2025-07-13)

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
acd8fd6c51 Upgrade nixpkgs to nixos 25.05
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
99741382ab Silently ban OpenVAS BSC scanner from apex
It is spamming our logs with refused connection lines:

apex% sudo journalctl -b0 | grep 'refused connection.*SRC=192.168.8.16' | wc -l
13945

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
d487241db2 Rotate anavarro password and SSH key
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
24128e22f4 Add weasel machine configuration
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
a36b403bd4 Remove extra flush commands on firewall stop
They are not needed as they are already flushed when the firewall
starts or stops.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
c7a52e2999 Prevent accidental use of nftables
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
88d2de454b Add proxy configuration for internal hosts
Access internal hosts via apex proxy. From the compute nodes we first
open an SSH connection to apex, and then tunnel it through the HTTP
proxy with netcat.

This way we allow reaching internal GitLab repositories without
requiring the user to have credentials in the remote host, while we can
use multiple remotes to provide redundancy.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
1899ad89db Remove unused blackbox configuration modules
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
cd37f86b09 Use IPv4 in blackbox probes
Otherwise they simply fail as IPv6 doesn't work.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
d5a9086afa Make NFS mount async to improve latency
Don't wait to flush writes, as we don't care about consistency on a
crash:

> This option allows the NFS server to violate the NFS protocol and
> reply to requests before any changes made by that request have been
> committed to stable storage (e.g. disc drive).
>
> Using this option usually improves performance, but at the cost that
> an unclean server restart (i.e. a crash) can cause data to be lost or
> corrupted.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
7be793da3d Disable root_squash from NFS
Allows root to read files in the NFS export, so we can directly run
`nixos-rebuild switch` from /home.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
327c0d61a2 Remove SSH proxy to access BSC clusters
We now have direct connection to them.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
f70074b216 Add users to apex machine
They need to be able to login to apex to access any other machine from
the SSF rack.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
fd99204913 Remove proxy from hut HTTP probes
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
6826a372d5 Remove proxy configuration from environment
All machines have now direct connection with the outside world.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
3d02a231a5 Add storcli utility to apex
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
52bd019cdd Add new configuration for apex
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
57b9450a59 Add pmartin1 user with access to fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
daba3eca18 Add access to fox for rpenacob user
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
c47c880ff2 Revert "Only allow Vincent to access fox for now"
This reverts commit efac36b186.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
5318fb1a0d Add all terminfo files in environment
Fixes problems with the kitty terminal when opening vim or kakoune.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
ad834cebd6 Monitor Fox BMC with ICMP probes too
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
43c20c544d Restrict DAC VPN to fox-ipmi machine only
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
5928c68720 Monitor fox via VPN
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
8eb14acdf9 Add OpenVPN service to connect to fox BMC
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
d83ad5decb Add ac.upc.edu as name search server
Allows referring to fox.ac.upc.edu directly as fox.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
bc64d62a7f Update access instructions
We no longer need to request a petition through BSC, as we will be in
charge of the login. Remove link to the old repository as well and
prefer only email.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
d07855e5c5 Disable kptr_restrict in fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
98b882507b Disable NUMA balancing in fox
See: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html#numa-balancing

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
e6f526bbc6 Load amd_uncore module in fox
Needed for L3 events in perf.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
df70515bc8 Enable SSH X11 forwarding
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
dfee33038b Disable registration in Gitea
Get rid of all the spam accounts they are trying to register.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
6e316e57be Enable msmtp configuration in tent
Allows gitea to send notifications via email.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
28e094d4c1 Add GitLab runner with debian docker for PM
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
1210d96ae9 Monitor nix-daemon in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
d5227db996 Move nix-daemon exporter to modules
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
eeb8557b96 Add p service for pastes
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
e94ef5a08d Enable public-inbox service in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
e1359d134e Enable gitea in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
2e94b6795b Add bsc.es to resolve domain names
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
965dca422a Monitor AXLE machine too
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
03209b6bfc Use IPv4 for blackbox exporter
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
a4328fe380 Add public html files to tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
085b92ce0f Add docker GitLab runner for BSC GitLab
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
96d7f186d2 Add GitLab shell runner in tent for PM
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
01891b9bef Enable jungle robot emails for Grafana in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
71bbdd5922 Add tent key for nix-serve
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
c51ca035b7 Remove jungle nix cache from tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
8b2c9dcacd Enable nix cache
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
017b57670b Serve Grafana from subpath
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
de99ff3414 Add nginx server in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
5d25805c6a Add monitoring in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
ef2f31510c Disable nix garbage collector in tent
Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
59961d1351 Rekey secrets with tent keys
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
3cb9563738 Add tent host key and admin keys
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
2006a5fb05 Create directories in /vault/home for tent users
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
ddcf158758 Add software RAID in tent using 3 disks
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
df0ce98526 Add access to tent to all hut users too
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
0022dfab63 Add hut SSH configuration from outside SSF LAN
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
5dce13c512 Don't use proxy in base preset
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
144d87008d Add tent machine from xeon04
We moved the tent machine to the server room in the BSC building and is
now directly connected to the raccoon via NAT.

Fixes: #106
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
7a312bd01c Create specific SSF rack configuration
Allow xeon machines to optionally inherit SSF configuration such as the
NFS mount point and the network configuration.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
7905969874 Only allow Vincent to access fox for now
Needed to run benchmarks without interference.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
3797a8ecaf Use performance governor in fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
9c3274d068 Add hut as nix cache in fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
ce4c653eb2 Use extra- for substituters and trusted-public-keys
From the nix manual:

> A configuration setting usually overrides any previous value. However,
> for settings that take a list of items, you can prefix the name of the
> setting by extra- to append to the previous value.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
d76f38b502 Use DHCP for Ethernet in fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
d6b7421f3f Use UPC time servers as others are blocked
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
2760355358 Create tracing group and add arocanon in raccoon
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
a8c68a630f Extend perf support in raccoon
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
0b330e5274 Enable nixdebuginfod in raccoon
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
3e080465a4 Make raccoon use performance governor
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
ac46401243 Enable binfmt emulation in raccoon
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
54a30e063c Disable nix garbage collector in raccoon
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
384ef9e9df Add dbautist user to raccoon machine
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
fe344ea31a Add node exporter monitoring in raccoon
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
0271ba399f Allow X11 forwarding via SSH
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
d53c7a3acb Enable linger for user rarias
Allows services to run without a login session.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
a3e48bc83c Only proxy SSH git remotes via hut in xeon
Other machines like raccoon have direct access.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
c2bfe806fe Add machine map file
Documents the location, board and serial numbers so we can track the
machines if they move around. Some information is unkown.

Using the Nix language to encode the machines location and properties
allows us to later use that information in the configuration of the
machines themselves.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
6f4fe9bb22 Remove fox monitoring via IPMI
We will need to setup an VPN to be able to access fox in its new
location, so for now we simply remove the IPMI monitoring.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
dad5225486 Monitor fox, gateway and UPC anella via ICMP
Fox should reply once the machine is connected to the UPC network.
Monitoring also the gateway and UPC anella allows us to estimate if the
whole network is down or just fox.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
1b090785a0 Update configuration for UPC network
The fox machine will be placed in the UPC network, so we update the
configuration with the new IP and gateway. We won't be able to reach hut
directly so we also remove the host entry and proxy.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
dbedeb3613 Disable home via NFS in fox
It won't be accesible anymore as we won't be in the same LAN.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
8887b9e1f8 Rekey all secrets
Fox is no longer able to use munge or ceph, so we remove the key and
rekey them.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
2af538e99b Rotate fox SSH host key
Prevent decrypting old secrets by reading the git history.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
7f16280fd5 Distrust fox SSH key
We no longer will share secrets with fox until we can regain our trust.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
f7cad2381c Remove Ceph module from fox
It will no longer be accesible from the UPC.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
40ef1d4886 Remove fox from SLURM
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
3e0674f872 Remove pam_slurm_adopt from fox
We no longer will be able to use SLURM from jungle.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
5dbc100738 Add UPC temperature sensor monitoring
These sensors are part of their air quality measurements, which just
happen to be very close to our server room.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
371b8b6a23 Add meteocat exporter
Allows us to track ambient temperature changes and estimate the
temperature delta between the server room and exterior temperature.
We should be able to predict when we would need to stop the machines due
to excesive temperature as summer approaches.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
102d8706dd Add custom nix-daemon exporter
Allows us to see which derivations are being built in realtime. It is a
bit of a hack, but it seems to work. We simply look at the environment
of the child processes of nix-daemon (usually bash) and then look for
the $name variable which should hold the current derivation being
built. Needs root to be able to read the environ file of the different
nix-daemon processes as they are owned by the nixbld* users.

See: https://discourse.nixos.org/t/query-ongoing-builds/23486
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
edca5972ee Set keep-outputs to true in all machines
From the documentation of keep-outputs, setting it to true would prevent
the GC from removing build time dependencies:

If true, the garbage collector will keep the outputs of non-garbage
derivations. If false (default), outputs will be deleted unless they are
GC roots themselves (or reachable from other roots).

In general, outputs must be registered as roots separately. However,
even if the output of a derivation is registered as a root, the
collector will still delete store paths that are used only at build time
(e.g., the C compiler, or source tarballs downloaded from the network).
To prevent it from doing so, set this option to true.

See: https://nix.dev/manual/nix/2.24/command-ref/conf-file.html#conf-keep-outputs
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:17 +02:00
b7e1e4faa8 Add raccoon node exporter monitoring
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
f2cfc4a415 Increase data retention to 5 years
Now that we have more space, we can extend the retention time to 5 years
to hold the monitoring metrics. For a year we have:

	# du -sh /var/lib/prometheus2
	13G     /var/lib/prometheus2

So we can expect it to increase to about 65 GiB. In the future we may
want to reduce some adquisition frequency.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
41e83fc5ee Don't forward any docker traffic
Access to the 23080 local port will be done by applying the INPUT rules,
which pass through nixos-fw.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
166508fc4f Allow traffic from docker to enter port 23080
Before:

  hut% sudo docker run -it --rm alpine /bin/ash -xc 'true | nc -w 3 -v 10.0.40.7 23080'
  + true
  + nc -w 3 -v 10.0.40.7 23080
  nc: 10.0.40.7 (10.0.40.7:23080): Operation timed out

After:

  hut% sudo docker run -it --rm alpine /bin/ash -xc 'true | nc -w 3 -v 10.0.40.7 23080'
  + true
  + nc -w 3 -v 10.0.40.7 23080
  10.0.40.7 (10.0.40.7:23080) open

Fixes: #94
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
b1795ba5be Add bscpm04.bsc.es SSH host and public key
Allows fetching repositories from hut and other machines in jungle
without the need to do any extra configuration.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
dcfd74f387 Add nix cache documentation section
Include usage from NixOS and non-NixOS hosts and a test with curl to
ensure it can be reached.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
03cdf10cbc Use hut nix cache in owl1, owl2 and raccoon
For owl1 and owl2 directly connect to hut via LAN with HTTP, but for
raccoon pass via the proxy using jungle.bsc.es with HTTPS. There is no
risk of tampering as packages are signed.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
5b14172646 Clean all iptables rules on stop
Prevents the "iptables: Chain already exists." error by making sure that
we don't leave any chain on start. The ideal solution is to use
iptables-restore instead, which will do the right job. But this needs to
be changed in NixOS entirely.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
85d4e8ad5c Make nginx listen on all interfaces
Needed for local hosts to contact the nix cache via HTTP directly.
We also allow the incoming traffic on port 80.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
0ecf221730 Fix nginx /cache regex
`nix-serve` does not handle duplicates in the path:
```
hut$ curl http://127.0.0.1:5000/nix-cache-info
StoreDir: /nix/store
WantMassQuery: 1
Priority: 30
hut$ curl http://127.0.0.1:5000//nix-cache-info
File not found.
```

This meant that the cache was not accessible via:
`curl https://jungle.bsc.es/cache/nix-cache-info` but
`curl https://jungle.bsc.es/cachenix-cache-info` worked.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:17 +02:00
61df5d4ddb Add new GitLab runner for gitlab.bsc.es
It uses docker based on alpine and the host nix store, so we can perform
builds but isolate them from the system.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
fc75b32c5f Remove SLURM partition all
We no longer have homogeneous nodes so it doesn't make much sense to
allocate a mix of them.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
97c1fb240d Add varcila user to hut and fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
2938acc3e4 Adjust fox slurm config after disabling SMT
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
a886d6c943 Add abonerib user to fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
5abdc0da89 Don't move doc in web output
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
9839206f4e Add quickstart guide
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
a7aa3b79a1 Reject SSH connections without SLURM allocation
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
094801a362 Add users to fox
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
e8d65e70e9 Add dalvare1 user
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
4adfc0297f Add fox page in jungle website
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
8b64f53dac Mount NVME disks in /nvme{0,1}
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
6af214dfa3 Exclude fox from being suspended by slurm
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
226dba428e Use IPMI host names instead of IP addresses
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
b18a9f99ef Add fox IPMI monitoring
Use agenix to store the credentials safely.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:17 +02:00
c0f5db745b Add new fox machine
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
7d84c9e088 Update PM GitLab tokens to new URL
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
7e5211d049 Fix MPICH build by fetching upstream patches too
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
c0531bbe8a Fix papermod theme in website for new hugo
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
32367fbc07 flake.lock: Update
Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/de96bd907d5fbc3b14fc33ad37d1b9a3cb15edc6' (2024-07-09)
  → 'github:ryantm/agenix/f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41' (2024-08-10)
• Updated input 'bscpkgs':
    'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=de89197a4a7b162db7df9d41c9d07759d87c5709' (2024-04-24)
  → 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=6782fc6c5b5a29e84a7f2c2d1064f4bcb1288c0f' (2024-11-29)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/693bc46d169f5af9c992095736e82c3488bf7dbb' (2024-07-14)
  → 'github:NixOS/nixpkgs/9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc' (2025-01-14)

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
ae2194debe Set nixpkgs to track nixos-24.11
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
693a96878a Add script to monitor GPFS
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
37ed60eb09 Add BSC machines to ssh config
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
23b58839de Collect statistics from logged users
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
93546953aa Add custom GPFS exporter for MN5
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
3ce5dd7c68 Remove exception to fetch task endpoint
It causes the request to go to the website rather than the Gitea
service.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
74c0ad07ad Use SSD for boot, then switch to NVME
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
4d7c8378bf Use NVME as root
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
2d487e9722 Keep host header for Grafana requests
This was breaking requests due to CSRF check.

See: https://github.com/grafana/grafana/issues/45117#issuecomment-1033842787
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
53e7ce6b64 Ignore logging requests from the gitea runner
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
0a3429ed8f Log the client IP not the proxy
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
3ebd3852f6 Ignore misc directory
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
8789f6d1fe Create paste directories in /ceph/p
Ensure that all hut users have a paste directory in /ceph/p owned by
themselves. We need to wait for the ceph mount point to create them, so
we use a systemd service that waits for the remote-fs.target.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
a5b512dd67 Add paste documentation in jungle website
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
b8db4ad3cd Add p command to paste files
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
8a150555a6 Use nginx to serve website and other services
Instead of using multiple tunels to forward all our services to the VM
that serves jungle.bsc.es, just use nginx to redirect the traffic from
hut. This allows adding custom rules for paths that are not posible
otherwise.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
e76e10ec19 Mount the NVME disk in /nvme
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
c4e12872d9 Delay nix-gc until /home is mounted
Prevents starting the garbage collector before the remote FS are
mounted, in particular /home. Otherwise, all the gcroots which have
symlinks in /home will be considered stale and they will be removed.

See: #79
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
7c381b2b65 Add dbautist user with access to hut
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
92482721b4 Set the serial console to ttyS1 in raccoon
Apparently the ttyS0 console doesn't exist but ttyS1 does:

  raccoon% sudo stty -F /dev/ttyS0
  stty: /dev/ttyS0: Input/output error
  raccoon% sudo stty -F /dev/ttyS1
  speed 9600 baud; line = 0;
  -brkint -imaxbel

The dmesg line agrees:

  00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A

The console configuration is then moved from base to xeon to allow
changing it for the raccoon machine.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
fd23d84da8 Remove setLdLibraryPath and driSupport options
They have been removed from NixOS. The "hardware.opengl" group is now
renamed to "hardware.graphics".

See: 98cef4c273
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
291feda7ff Add documentation section about GRUB chain loading
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
6f22f683a9 Add 10 min shutdown jitter to avoid spikes
The shutdown timer will fire at slightly different times for the
different nodes, so we slowly decrease the power consumption.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
240b26d82e Don't mount the nix store in owl nodes
Initially we planned to run jobs in those nodes by sharing the same nix
store from hut. However, these nodes are now used to build packages
which are not available in hut. Users also ssh to the nodes, which
doesn't mount the hut store, so it doesn't make much sense to keep
mounting it.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
fd76a36c36 Emulate other architectures in owl nodes too
Allows cross-compilation of packages for RISC-V that are known to try to
run RISC-V programs in the host.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
f1373e5227 Program shutdown for August 2nd for all machines
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
d8ca283b80 Enable debuginfod daemon in owl nodes
WARNING: This will introduce noise, as the daemon wakes up from time to
time to check for new packages.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
cdabc58c09 Set gitea and grafana log level to warn
Prevents filling the journal logs with information messages.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
c737993c9c Set default SLURM job time limit to one hour
Prevents enless jobs from being left forever, while allow users to
request a larger time limit.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
60c094030b Allow other jobs to run in unused cores
The current select mechanism was using the memory too as a consumable
resource, which by default only sets 1 MiB per node. As each job already
requests 1 MiB, it prevents other jobs from running.

As we are not really concerned with memory usage, we only use the unused
cores in the select criteria.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
8b8fc73225 Use authentication tokens for PM GitLab runner
Starting with GitLab 16, there is a new mechanism to authenticate the
runners via authentication tokens, so use it instead.  Older tokens and
runners are also removed, as they are no longer used.

With the new way of managing tokens, both the tags and the locked state
are managed from the GitLab web page.

See: https://docs.gitlab.com/ee/ci/runners/new_creation_workflow.html
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
f095067deb flake.lock: Update
Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/1381a759b205dff7a6818733118d02253340fd5e' (2024-04-02)
  → 'github:ryantm/agenix/de96bd907d5fbc3b14fc33ad37d1b9a3cb15edc6' (2024-07-09)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/6143fc5eeb9c4f00163267708e26191d1e918932' (2024-04-21)
  → 'github:NixOS/nixpkgs/693bc46d169f5af9c992095736e82c3488bf7dbb' (2024-07-14)

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
90d44a95eb Allow ptrace to any process of the same user
Allows users to attach GDB to their own processes, without requiring
running the program with GDB from the start. It is only available in
compute nodes, the storage nodes continue with the restricted settings.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
4873c881a9 Add abonerib user to hut, raccon, owl1 and owl2
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
d6d7516e12 Grant rpenacob access to owl1 and owl2 nodes
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
ae96be6915 Access private repositories via hut SSH proxy
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
bb10c47c2e Set the default proxy to point to hut
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
87598e74ae Allow incoming traffic to hut proxy
Reviewed-by: Aleix Boné <abonerib@bsc.es>
2025-10-01 16:40:16 +02:00
6a3728e6c6 eudy: koro: fcs: Fix fcs unprotected cpuid all
smp_processor_id() was called in a preepmtible context, which could
invalidate the returned value. However, this was not harmful, because
fcs threads in nosv are pinned.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:16 +02:00
7b4cbc57e4 Add support for armv7 emulation in hut
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
80eb17c065 Monitor raccoon machine via IPMI
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
338551ec0a Move vlopez user to jungleUsers for koro host
Access to other machines can be easily added into the "hosts" attribute
without the need to replicate the configuration.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
efea776c91 Add raccoon motd file
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
c8604bf3e0 Split xeon specific configuration from base
To accomodate the raccoon knights workstation, some of the configuration
pulled by m/common/main.nix has to be removed. To solve it, the xeon
specific parts are placed into m/common/xeon.nix and only the common
configuration is at m/common/base.nix.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
970cdf8dbd Control user access to each machine
The users.jungleUsers configuration option behaves like the users.users
option, but defines the list attribute `hosts` for each user, which
filters users so that only the user can only access those hosts.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
7312a91271 Add PostgreSQL DB for performance test results
The database will hold the performance results of the execution of the
benchmarks. We follow the same setup on knights3 for now.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
b89c656ff7 Enable Grafana email alerts
Allows sending Grafana alerts via email too, so we have a reduntant
mechanism in case Slack fails to deliver them.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
27bb7cd69e Enable mail notification in Gitea
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
e0e9dc62d5 Add msmtp to send notifications via email
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
bb86b04fce Allow Ceph traffic to lake2 2025-10-01 16:40:16 +02:00
93ad04299d Fix meta in posts entries
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
24056305c7 Fix bogus separator
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
b43aca80ca Manually add links to the menu
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
39378d9544 Add link to Gitea in the website
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
0dec0ee519 Collect Gitea metrics in Prometheus
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
b15130744a Add Gitea service
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
c4f539caf6 Add firewall rules for Ceph and monitoring
The firewall was blocking the monitoring traffic from hut and the Ceph
traffic among OSDs. The rules only allow connecting from the specific
host that they are supposed to be coming from.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
cafd7ea682 Add workaround for MPICH 4.2.0
See: https://github.com/pmodels/mpich/issues/6946

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
08e9db0c3e Fix SLURM bug in rank integer sign expansion
See: https://bugs.schedmd.com/show_bug.cgi?id=19324

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
ab4cab97ba Merge pmix outputs for MPICH
MPICH expects headers and libraries to be present in the same directory.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
a4bf90ddfc Remove nixseparatedebuginfod input
It has been integrated in nixpkgs, so is no longer required.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
ebfbca4b48 flake.lock: Update
Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/daf42cb35b2dc614d1551e37f96406e4c4a2d3e4' (2023-10-08)
  → 'github:ryantm/agenix/1381a759b205dff7a6818733118d02253340fd5e' (2024-04-02)
• Updated input 'agenix/darwin':
    'github:lnl7/nix-darwin/87b9d090ad39b25b2400029c64825fc2a8868943' (2023-01-09)
  → 'github:lnl7/nix-darwin/4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d' (2023-11-24)
• Updated input 'agenix/home-manager':
    'github:nix-community/home-manager/32d3e39c491e2f91152c84f8ad8b003420eab0a1' (2023-04-22)
  → 'github:nix-community/home-manager/3bfaacf46133c037bb356193bd2f1765d9dc82c1' (2023-12-20)
• Added input 'agenix/systems':
    'github:nix-systems/default/da67096a3b9bf56a91d16901293e51ba5b49a27e' (2023-04-09)
• Updated input 'bscpkgs':
    'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=e148de50d68b3eeafc3389b331cf042075971c4b' (2023-11-22)
  → 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=de89197a4a7b162db7df9d41c9d07759d87c5709' (2024-04-24)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/e4ad989506ec7d71f7302cc3067abd82730a4beb' (2023-11-19)
  → 'github:NixOS/nixpkgs/6143fc5eeb9c4f00163267708e26191d1e918932' (2024-04-21)
• Updated input 'nixseparatedebuginfod':
    'github:symphorien/nixseparatedebuginfod/232591f5274501b76dbcd83076a57760237fcd64' (2023-11-05)
  → 'github:symphorien/nixseparatedebuginfod/98d79461660f595637fa710d59a654f242b4c3f7' (2024-03-07)
• Removed input 'nixseparatedebuginfod'
• Removed input 'nixseparatedebuginfod/flake-utils'
• Removed input 'nixseparatedebuginfod/flake-utils/systems'
• Removed input 'nixseparatedebuginfod/nixpkgs'

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
6be7365916 Use google.com probe instead of bsc.es
The main website of the BSC is failing every day around 3:00 AM for
almost one hour, so it is not a very good target. Instead, google.com is
used which should be more reliable. The same robots.txt path is fetched,
as it is smaller than the main page.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
8ae2870fb3 Add another HTTPS probe for bsc.es
As all other HTTPS probes pass through the opsproxy01.bsc.es proxy, we
cannot detect a problem in our proxy or in the BSC one. Adding another
target like bsc.es that doesn't use the ops proxy allows us to discern
where the problem lies.

Instead of monitoring https://www.bsc.es/ directly, which will trigger
the whole Drupal server and take a whole second, we just fetch robots.txt
so the overhead on the server is minimal (and returns in less than 10 ms).

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
0899424de9 Move slurm client in a separate module
Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:16 +02:00
baa8347753 Enable public-inbox at jungle.bsc.es/lists
The public-inbox service fetches emails from the sourcehut mailing lists
and displays them on the web. The idea is to reduce the dependency on
external services and add a secondary storage for the mailing lists in
case sourcehut goes down or changes the current free plans.

The service is available in https://jungle.bsc.es/lists/ and is open to
the public. It currently mirrors the bscpkgs and jungle mailing list.

We also edited the CSS to improve the readability and have larger fonts
by default.

The service for public-inbox produced by NixOS is not well configured to
fetch emails from an IMAP mail server, so we also manually edit the
service file to enable the network.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
777704a9ce Monitor https://pm.bsc.es/gitlab/ too
The GitLab instance is in the /gitlab endpoint and may fail
independently of https://pm.bsc.es/.

Cc: Víctor López <victor.lopez@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
024a31dd1b Enable nixseparatedebuginfod module
The module is only enabled on Hut and Eudy because we noticed activity
on the debuginfod service even if no debug session was active.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
2025-10-01 16:40:16 +02:00
b8fbb6380e Use tmpfs in /tmp
The /tmp directory was using the SSD disk which is not erased across
boots. Nix will use /tmp to perform the builds, so we want it to be as
fast as possible. In general, all the machines have enough space to
handle large builds like LLVM.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
afae708a48 Enable runners for pm.bsc.es/gitlab too
The old runners for the PM gitlab were disabled in configuration in the
last outage, but they remained working until we reboot the node. With
this change we enable the runners for both PM and gitlab.bsc.es.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
4efd74aad6 Remove complete ceph package from hut
Only the ceph-client is needed.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
29cdfba328 Fix warning in slurm exporter using vendorHash
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
59d9d19891 Remove old Ceph package overlay
The Ceph package is now integrated in upstream nixpkgs.

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
50cf081345 flake.lock: Update
Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/d8c973fd228949736dedf61b7f8cc1ece3236792' (2023-07-24)
  → 'github:ryantm/agenix/daf42cb35b2dc614d1551e37f96406e4c4a2d3e4' (2023-10-08)
• Updated input 'bscpkgs':
    'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=f605f8e5e4a1f392589f1ea2b9ffe2074f72a538' (2023-10-31)
  → 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=e148de50d68b3eeafc3389b331cf042075971c4b' (2023-11-22)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/e56990880811a451abd32515698c712788be5720' (2023-09-02)
  → 'github:NixOS/nixpkgs/e4ad989506ec7d71f7302cc3067abd82730a4beb' (2023-11-19)

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
388a10b666 BSC packages are no longer in bsc attribute
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
e7555bb1cf flake.lock: Update
Flake lock file updates:

• Updated input 'bscpkgs':
    'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=3a4062ac04be6263c64a481420d8e768c2521b80' (2023-09-14)
  → 'git+https://git.sr.ht/~rodarima/bscpkgs?ref=refs/heads/master&rev=f605f8e5e4a1f392589f1ea2b9ffe2074f72a538' (2023-10-31)

Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
0882ad7ecc Switch bscpkgs URL to sourcehut
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
6ac5225ddb Monitor anella instead of gw.bsc.es
The target gw.bsc.es doesn't reply to our ICMP probes from hut. However,
the anella hop in the tracepath is a good candidate to identify cuts
between the login and the provider and between the provider and external
hosts like Google or Cloudflare DNS.

Reviewed-By: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
cd6983223e Add ICMP probes
These probes check if we can reach several targets via ICMP, which is
not proxied, so they can be used to see if ICMP forwarding is working in
the login node.

In particular, we test if we can reach the Google (8.8.8.8) and
Cloudflare (1.1.1.1) DNS servers, the BSC gateway which responds to ping
only from the intranet and the login node (ssfhead).

Reviewed-By: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
fb8a0cb0a3 Enable proxy for Grafana too
The alerts need to contact the slack endpoint, so we add the proxy
environment variables to the grafana systemd service.

Reviewed-By: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
a8c0ce5d06 Make blackbox exporter use the proxy
By default it was trying to reach the targets using the default gateway,
but since the electrical cut of 2023-10-20, the login node has not
enabled forwarding again. So better if we don't rely on it.

Reviewed-By: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
2025-10-01 16:40:16 +02:00
9957a0269d Don't log SLURM connection attempts from ssfhead 2025-10-01 16:40:16 +02:00
ca0937859d Add docker runner too 2025-10-01 16:40:16 +02:00
4d362351cb Monitor gitlab.bsc.es too 2025-10-01 16:40:16 +02:00
e9b4d87d9f Monitor PM webpage via blackbox 2025-10-01 16:40:16 +02:00
457e403258 Temporarily disable pm runners 2025-10-01 16:40:16 +02:00
32b9cc17a9 Add runner for gitlab.bsc.es 2025-10-01 16:40:16 +02:00
fbabc06641 Allow anonymous access to grafana 2025-10-01 16:40:16 +02:00
7b67b2b703 Remove user/group when using DynamicUsers 2025-10-01 16:40:16 +02:00
ce964b9b65 Set the SLURM_CONF variable 2025-10-01 16:40:16 +02:00
b84066fde5 Enable slurm-exporter service 2025-10-01 16:40:16 +02:00
38e23068f2 Add prometheus-slurm-exporter package 2025-10-01 16:40:16 +02:00
6b2351bfe7 Document the hut shared nix store for SLURM 2025-10-01 16:40:16 +02:00
b84d1d5e26 Mount the hut nix store for SLURM jobs 2025-10-01 16:40:16 +02:00
6d8fd353d0 Enable direnv integration 2025-10-01 16:40:16 +02:00
642507b255 Remove bscpkgs from the registry and nixPath
This is done to prevent accidental evaluations where the nixpkgs input
of bscpkgs is still pointing to a different version that the one
specified in the jungle flake. Instead use jungle#bscpkgs.X to get a
package from bscpkgs.
2025-10-01 16:40:16 +02:00
128136c137 Add bscpkgs and nixpkgs top level attributes
Allows the evaluation of packages of the intermediate overlays.
2025-10-01 16:40:16 +02:00
1242aad9a3 Use hut packages as the default package set
Allows the user to directly access nixpkgs and bscpkgs from the top
level as `nix build jungle#htop` and `nix build jungle#bsc.ovni`.
2025-10-01 16:40:16 +02:00
0ca0da9ffe Don't fetch registry flakes from the net 2025-10-01 16:40:16 +02:00
03822c8b26 flake.lock: Update
Flake lock file updates:

• Updated input 'bscpkgs':
    'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=6122fef92701701e1a0622550ac0fc5c2beb5906' (2023-09-07)
  → 'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=3a4062ac04be6263c64a481420d8e768c2521b80' (2023-09-14)
2025-10-01 16:40:16 +02:00
77276fb6c1 Revert "Update slurm to 23.02.05.1"
This reverts commit aaefddc44a.
2025-10-01 16:40:16 +02:00
1b296f2ce7 Open ports in firewall of compute nodes 2025-10-01 16:40:16 +02:00
798fa002cc Update slurm to 23.02.05.1 2025-10-01 16:40:16 +02:00
44667e8e40 Monitor storage nodes via IPMI too 2025-10-01 16:40:16 +02:00
668a65b9c6 Specify the space available in /ceph 2025-10-01 16:40:16 +02:00
73f18d5801 Add update post to website 2025-10-01 16:40:16 +02:00
627c912b87 Enable fstrim service 2025-10-01 16:40:16 +02:00
66b5074ff1 Serve the nix store from hut 2025-10-01 16:40:16 +02:00
79446cebcb Add encrypted munge key with agenix 2025-10-01 16:40:16 +02:00
061fc60939 Remove unused large port hole in firewall 2025-10-01 16:40:16 +02:00
09ac1d6c13 Make exporters listen in localhost only 2025-10-01 16:40:16 +02:00
a6324e47e8 Allow only some ports for srun 2025-10-01 16:40:16 +02:00
2f258e1cdd Block ssfhead from reaching our slurm daemon 2025-10-01 16:40:16 +02:00
4c88f9a783 Poweroff idle slurm nodes after 1 hour 2025-10-01 16:40:16 +02:00
01140353c6 Add IB and IPMI node host names 2025-10-01 16:40:16 +02:00
c38a01c8dc flake.lock: Update
Flake lock file updates:

• Updated input 'bscpkgs':
    'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=ee24b910a1cb95bd222e253da43238e843816f2f' (2023-09-01)
  → 'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=6122fef92701701e1a0622550ac0fc5c2beb5906' (2023-09-07)
2025-10-01 16:40:16 +02:00
aa52236a80 Unlock ovni gitlab runners 2025-10-01 16:40:16 +02:00
3a31dcd58b Update email contact to jungle mail list 2025-10-01 16:40:16 +02:00
d57849a954 flake.lock: Update
Flake lock file updates:

• Updated input 'bscpkgs':
    'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=18d64c352c10f9ce74aabddeba5a5db02b74ec27' (2023-08-31)
  → 'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs/heads/master&rev=ee24b910a1cb95bd222e253da43238e843816f2f' (2023-09-01)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/d680ded26da5cf104dd2735a51e88d2d8f487b4d' (2023-08-19)
  → 'github:NixOS/nixpkgs/e56990880811a451abd32515698c712788be5720' (2023-09-02)
2025-10-01 16:40:16 +02:00
6850bf3a71 Add agenix to all nodes 2025-10-01 16:40:16 +02:00
aa92294907 Add agenix module to ceph 2025-10-01 16:40:16 +02:00
da92154d33 Remove old secrets 2025-10-01 16:40:16 +02:00
adec7f80fd Mount /ceph in owl1 and owl2 2025-10-01 16:40:16 +02:00
8a0034a867 Warn about the owl2 omnipath device 2025-10-01 16:40:16 +02:00
6828273c05 Clean owl2 configuration 2025-10-01 16:40:16 +02:00
8cedffe040 Move the ceph client config to an external module 2025-10-01 16:40:16 +02:00
8a027d8b09 Reorganize secrets and ssh keys
The agenix tools needs to read the secrets from a standalone file, but
we also need the same information for the SSH keys.
2025-10-01 16:40:16 +02:00
1f32b8409a Add anavarro user 2025-10-01 16:40:16 +02:00
bc51564a88 Set zsh inc_append_history option 2025-10-01 16:40:16 +02:00
8ba4f910c3 Set zsh shell for rarias 2025-10-01 16:40:16 +02:00
515fa49ed0 Enable zsh and fix key bindings 2025-10-01 16:40:16 +02:00
c63fa494d5 Keep a log over time with the config commits 2025-10-01 16:40:16 +02:00
bf53f01f0a Configure bscpkgs.nixpkgs to follow nixpkgs 2025-10-01 16:40:16 +02:00
a6d3f43b98 Store nixos config in /etc/nixos/config.rev 2025-10-01 16:40:16 +02:00
76e6ae2f00 Enable binary emulation for other architectures 2025-10-01 16:40:16 +02:00
409efacf5b Enable watchdog 2025-10-01 16:40:16 +02:00
e1e879178d Enable all osd on boot in lake2 2025-10-01 16:40:16 +02:00
042ca9e882 Scrape lake2 too 2025-10-01 16:40:16 +02:00
9241bda0ac Also enable monitoring in lake2 2025-10-01 16:40:16 +02:00
005a1be48a Scrape metrics from bay 2025-10-01 16:40:16 +02:00
f86114f33e Add monitoring in the bay node 2025-10-01 16:40:16 +02:00
af29f639e2 Add fio tool 2025-10-01 16:40:16 +02:00
0fe025e8be Add ceph tools in hut too 2025-10-01 16:40:16 +02:00
6a429fda1b Switch ceph logs to journal 2025-10-01 16:40:16 +02:00
4cea250cf4 Update ceph to 18.2.0 in overlay 2025-10-01 16:40:16 +02:00
3b823ee478 Move pkgs overlay to overlay.nix 2025-10-01 16:40:16 +02:00
d9dea762de Enable ceph osd daemons in lake2 2025-10-01 16:40:16 +02:00
80efd57a11 Add the lake2 hostname to the hosts 2025-10-01 16:40:16 +02:00
cced6b0dc0 Use the sda for lake2 2025-10-01 16:40:16 +02:00
b63b450111 Remove netboot module 2025-10-01 16:40:16 +02:00
81baeee5b1 Disable pixiecore in hut for now 2025-10-01 16:40:16 +02:00
686f750c06 Add PXE helper 2025-10-01 16:40:16 +02:00
33155fcb62 Enable netboot again for PXE 2025-10-01 16:40:16 +02:00
6e89b3f936 Specify the disk by path 2025-10-01 16:40:16 +02:00
f0f67f374e Prepare lake2 config after bootstrap
The disk ID is different under NixOS.
2025-10-01 16:40:16 +02:00
7443a192c6 Add lake2 bootstrap config 2025-10-01 16:40:16 +02:00
25f06db5f1 Add section to enable serial console 2025-10-01 16:40:16 +02:00
3c83996e26 Add agenix to PATH in hut 2025-10-01 16:40:16 +02:00
a4fc3d131a Store ceph secret key in age
This allows a node to mount the ceph FS without any extra ceph
configuration in /etc/ceph.
2025-10-01 16:40:16 +02:00
660a8ae163 Add rarias key for secrets 2025-10-01 16:40:16 +02:00
91270b26bb Add ceph metrics to prometheus 2025-10-01 16:40:16 +02:00
94ce6fedf9 Mount the ceph filesystem in hut 2025-10-01 16:40:16 +02:00
817c98d37b Add ceph config in bay 2025-10-01 16:40:16 +02:00
9cd013c4ed Add the bay host name 2025-10-01 16:40:16 +02:00
f707650724 Remove netboot and fixes 2025-10-01 16:40:15 +02:00
9c152ec9cc Add bay node 2025-10-01 16:40:15 +02:00
7e789cd062 Update flake 2025-10-01 16:40:15 +02:00
8fcb5a1079 Monitor power from other nodes via LAN 2025-10-01 16:40:15 +02:00
b80656228d Increase prometheus retention time to one year 2025-10-01 16:40:15 +02:00
cd6e6de2ad Don't set all_proxy 2025-10-01 16:40:15 +02:00
ca78313752 Update nixpkgs to fix docker problem 2025-10-01 16:40:15 +02:00
ae2007e2fe Allow access to devices for node_exporter 2025-10-01 16:40:15 +02:00
d8e366b444 GRUB version no longer needed 2025-10-01 16:40:15 +02:00
a18d56b3ae Upgrade flake: nixpkgs, bscpkgs and agenix 2025-10-01 16:40:15 +02:00
8c1bf6db42 Kill slurmd remaining processes on upgrade 2025-10-01 16:40:15 +02:00
17f9a957eb Add details to request access in the web 2025-10-01 16:40:15 +02:00
a094093d95 koro: Add vlopez user 2025-10-01 16:40:15 +02:00
cbe53a6f0a Add koro node 2025-10-01 16:40:15 +02:00
1b8c3eb554 eudy: Add fcsv3 and intermediate versions for testing 2025-10-01 16:40:15 +02:00
c0335c1f95 eudy: Enable memory overcommit 2025-10-01 16:40:15 +02:00
d5857c0f7d eudy: disable all cpu mitigations 2025-10-01 16:40:15 +02:00
d88caa8610 Add jungle.bsc.es hugo website 2025-10-01 16:40:15 +02:00
9097811cc0 Enable NTP using the BSC time server 2025-10-01 16:40:15 +02:00
83acd40880 Add the ssfhead node as gateway 2025-10-01 16:40:15 +02:00
ba75bf8249 Use our host names first by default 2025-10-01 16:40:15 +02:00
e9845cc76a Add DNS tools to resolve hosts 2025-10-01 16:40:15 +02:00
d5951483ee Lower perf_event_paranoid to -1 2025-10-01 16:40:15 +02:00
937d8a7637 Set perf paranoid to 0 by default 2025-10-01 16:40:15 +02:00
798e01f9e6 Add perf to packages 2025-10-01 16:40:15 +02:00
2ca7e7383e Allow srun to specify the cpu binding
The task/affinity plugin needs to be selected.
2025-10-01 16:40:15 +02:00
b610f12133 Move authorized keys to users.nix 2025-10-01 16:40:15 +02:00
b6aaeb8158 Add rpenacob user 2025-10-01 16:40:15 +02:00
3d0f86ac07 Add osumb to the system packages 2025-10-01 16:40:15 +02:00
221ccef956 flake.lock: Update
Flake lock file updates:

• Updated input 'bscpkgs':
    'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs%2fheads%2fmaster&rev=c775ee4d6f76aded05b08ae13924c302f18f9b2c' (2023-04-26)
  → 'git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git?ref=refs%2fheads%2fmaster&rev=cbe9af5d042e9d5585fe2acef65a1347c68b2fbd' (2023-06-16)
2025-10-01 16:40:15 +02:00
9f03799d34 Set mpi to mpich by default in bscpkgs 2025-10-01 16:40:15 +02:00
3a9615fce4 Add missing parameter to extend 2025-10-01 16:40:15 +02:00
45d7b31c0a Use explicit order in overlays 2025-10-01 16:40:15 +02:00
73b33c4d6c Replace mpi inside bsc attribute 2025-10-01 16:40:15 +02:00
bae3c75222 Add mpich overlay 2025-10-01 16:40:15 +02:00
f51e910aff Add coments in slurm config 2025-10-01 16:40:15 +02:00
8b7ffc914a Add eudy host key to known hosts 2025-10-01 16:40:15 +02:00
afb2bea1c9 Rename xeon08 to eudy
From Eudyptula, a little penguin.
2025-10-01 16:40:15 +02:00
7bbc526671 Update rebuild script for all nodes 2025-10-01 16:40:15 +02:00
4afe3121e6 Add ssh host keys 2025-10-01 16:40:15 +02:00
39f15a1b4f Set the name of the slurm cluster to jungle 2025-10-01 16:40:15 +02:00
3fab341dc8 Change owl hostnames 2025-10-01 16:40:15 +02:00
6ec7353a27 Add owl and all partition 2025-10-01 16:40:15 +02:00
d679fd6314 Simplify flake and expose host pkgs
The configuration of the machines is now moved to m/
2025-10-01 16:40:15 +02:00
218acd6848 Rename xeon07 to hut 2025-10-01 16:40:15 +02:00
68805b337d Remove profiles older than 30 days with gc 2025-10-01 16:40:15 +02:00
eae7ed4e10 Add ncdu to system packages 2025-10-01 16:40:15 +02:00
eb9b5e570f Move arocanon user from xeon08 to common 2025-10-01 16:40:15 +02:00
0c4b85be3b xeon08: Add config for kernel non-voluntary preemption 2025-10-01 16:40:15 +02:00
49ccf0a3f3 xeon08: Add perf 2025-10-01 16:40:15 +02:00
459b29924c xeon08: Enable lttng lockdep tracepoints 2025-10-01 16:40:15 +02:00
0d1a7e59ee xeon08: Add lttng module and tools 2025-10-01 16:40:15 +02:00
b959c72979 Serve grafana in https://jungle.bsc.es/grafana 2025-10-01 16:40:15 +02:00
68f7c02555 Add tree command 2025-10-01 16:40:15 +02:00
26caa390cb Add file to system packages 2025-10-01 16:40:15 +02:00
f0af9d87a0 Add gnumake to system packages 2025-10-01 16:40:15 +02:00
038340c5d2 Add cmake to system packages 2025-10-01 16:40:15 +02:00
471d44f013 Add ix to common packages 2025-10-01 16:40:15 +02:00
af03554610 Improve documentation 2025-10-01 16:40:15 +02:00
35898c68e7 Add gitignore 2025-10-01 16:40:15 +02:00
769317c5a7 Set intel_pstate=passive and disable frequency boost 2025-10-01 16:40:14 +02:00
a9f9a1e8e5 Add xeon08 basic config 2025-10-01 16:40:14 +02:00
0a8097231d Add nixos-config.nix to easily enable nix repl 2025-10-01 16:40:14 +02:00
be90239bbc Automatically resume restarted nodes in SLURM 2025-10-01 16:40:14 +02:00
f2fc2af77a Allow public dashboards in grafana 2025-10-01 16:40:14 +02:00
7828d616fc Add hal ssh key 2025-10-01 16:40:14 +02:00
61ea1af68b Increase the number of CPUs to 56 for nOS-V docker 2025-10-01 16:40:14 +02:00
81243cbc95 Allow 5 concurrent buils in the gitlab-runner 2025-10-01 16:40:14 +02:00
847d516d6d Simplify bash prompt 2025-10-01 16:40:14 +02:00
a6c060a25b Roolback to bash as default shell
Zsh doesn't behave properly, it needs further configuration.
2025-10-01 16:40:14 +02:00
70d2255634 Use pmix by default in slurm 2025-10-01 16:40:14 +02:00
7b176a3780 Increase locked memory to 1 GiB 2025-10-01 16:40:14 +02:00
e7bfba54bc Use the latest kernel 2025-10-01 16:40:14 +02:00
30a12729f1 Disable osnoise and hwlat tracer for now
Reuse nix cache to avoid rebuilding the kernel.
2025-10-01 16:40:14 +02:00
8851dbe212 Update nixpkgs to nixos-unstable 2025-10-01 16:40:14 +02:00
b7d52423c9 Update nixpkgs 2025-10-01 16:40:14 +02:00
32b84a5add Update ib interface name in xeon02
It seems to be plugged in another PCI port
2025-10-01 16:40:14 +02:00
9267ca51fa Add steps in install documentation 2025-10-01 16:40:14 +02:00
5c9f5e845f Add minimal netboot module to build kexec image 2025-10-01 16:40:14 +02:00
2d204c5cc0 Add xeon02 configuration 2025-10-01 16:40:14 +02:00
99481e6203 Refacto slurm configuration into compute/control 2025-10-01 16:40:14 +02:00
8b4dda98af Lock flakes and add inputs 2025-10-01 16:40:14 +02:00
0c296c1825 Test flakes 2025-10-01 16:40:14 +02:00
513c182d24 Enable slurm in xeon01 2025-10-01 16:40:14 +02:00
a2fe4b552a Use xeon07 as control machine 2025-10-01 16:40:14 +02:00
1b030ab76d Remove xeon07 overlay to load upstream slurm 2025-10-01 16:40:14 +02:00
f0abbac1c7 Add script to rebuild configuration 2025-10-01 16:40:14 +02:00
6f80ebb483 Add configuration for xeon01 2025-10-01 16:40:14 +02:00
ce00282704 Load overlays from /config 2025-10-01 16:40:14 +02:00
7829ba7509 Move net.nix to common 2025-10-01 16:40:14 +02:00
a476b1758b Remove host specific network options from net.nix 2025-10-01 16:40:14 +02:00
51a77b5213 Move ssh.nix to common 2025-10-01 16:40:14 +02:00
020ce58efd Move overlays.nix to common 2025-10-01 16:40:14 +02:00
ab978758ba Move users.nix to common 2025-10-01 16:40:14 +02:00
774350f288 Move common options from configuration.nix 2025-10-01 16:40:14 +02:00
b739c96882 Move the remaining hw config to common 2025-10-01 16:40:14 +02:00
32d782be96 Move boot config to common/boot.nix 2025-10-01 16:40:14 +02:00
1432a26fba Move filesystems config to common/fs.nix 2025-10-01 16:40:14 +02:00
f5fa915e09 Use partition labels for / and swap 2025-10-01 16:40:14 +02:00
d6a7a87207 Move fs.nix to common 2025-10-01 16:40:14 +02:00
13f72753a5 Move boot.nix to common 2025-10-01 16:40:14 +02:00
fa757aaaab Move disk selection to configuration.nix 2025-10-01 16:40:14 +02:00
15906e5818 Add common directory 2025-10-01 16:40:14 +02:00
318 changed files with 26836 additions and 8890 deletions

View File

@@ -1,20 +0,0 @@
name: CI
on:
push:
branches:
- master
pull_request:
branches:
- master
jobs:
build:all:
runs-on: native
steps:
- uses: https://gitea.com/ScMi1/checkout@v1.4
- run: nix build -L --no-link --print-out-paths .#bsc.ci.all
build:cross:
runs-on: native
steps:
- uses: https://gitea.com/ScMi1/checkout@v1.4
- run: nix build -L --no-link --print-out-paths .#bsc.ci.cross

2
.gitignore vendored
View File

@@ -1,3 +1,3 @@
**.swp
*.swp
/result
/misc

View File

@@ -1,6 +0,0 @@
build:bsc-ci.all:
stage: build
tags:
- nix
script:
- nix build -L --no-link --print-out-paths .#bsc-ci.all

21
COPYING
View File

@@ -1,21 +0,0 @@
Copyright (c) 2020-2025 Barcelona Supercomputing Center
Copyright (c) 2003-2020 Eelco Dolstra and the Nixpkgs/NixOS contributors
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

View File

@@ -1,9 +0,0 @@
# Jungle
This repository provides two components that can be used independently:
- A Nix overlay with packages used at BSC (formerly known as bscpkgs). Access
them directly with `nix shell .#<pkgname>`.
- NixOS configurations for jungle machines. Use `nixos-rebuild switch --flake .`
to upgrade the current machine.

View File

@@ -1,19 +0,0 @@
let
bscOverlay = import ./overlay.nix;
# read flake.lock and determine revision from there
lock = builtins.fromJSON (builtins.readFile ./flake.lock);
inherit (lock.nodes.nixpkgs.locked) rev narHash;
fetchedNixpkgs = builtins.fetchTarball {
url = "https://github.com/NixOS/nixpkgs/archive/${rev}.tar.gz";
sha256 = narHash;
};
in
{ overlays ? [ ]
, nixpkgs ? fetchedNixpkgs
, ...
}@attrs:
import nixpkgs (
(builtins.removeAttrs attrs [ "overlays" "nixpkgs" ]) //
{ overlays = [ bscOverlay ] ++ overlays; }
)

View File

@@ -1,30 +0,0 @@
# Maintainers
## Role of a maintainer
The responsibilities of maintainers are quite lax, and similar in spirit to
[nixpkgs' maintainers][1]:
The main responsibility of a maintainer is to keep the packages they
maintain in a functioning state, and keep up with updates. In order to do
that, they are empowered to make decisions over the packages they maintain.
That being said, the maintainer is not alone in proposing changes to the
packages. Anybody (both bots and humans) can send PRs to bump or tweak the
package.
In practice, this means that when updating or proposing changes to a package,
we will notify maintainers by mentioning them in Gitea so they can test changes
and give feedback.
Since we do bi-yearly release cycles, there is no expectation from maintainers
to update packages at each upstream release. Nevertheless, on each release cycle
we may request help from maintainers when updating or testing their packages.
## Becoming a maintainer
You'll have to add yourself in the `maintainers.nix` list; your username should
match your `bsc.es` email. Then you can add yourself to the `meta.maintainers`
of any package you are interested in maintaining.
[1]: [https://github.com/NixOS/nixpkgs/tree/nixos-25.05/maintainers]

View File

@@ -1,46 +0,0 @@
#!/bin/sh
# Trims the jungle repository by moving the website to its own repository and
# removing it from jungle. It also removes big pdf files and kernel
# configurations so the jungle repository is small.
set -e
if [ -e oldjungle -o -e newjungle -o -e website ]; then
echo "remove oldjungle/, newjungle/ and website/ first"
exit 1
fi
# Clone the old jungle repo
git clone gitea@tent:rarias/jungle.git oldjungle
# First split the website into a new repository
mkdir website && git -C website init -b master
git-filter-repo \
--path web \
--subdirectory-filter web \
--source oldjungle \
--target website
# Then remove the website, pdf files and big kernel configs
mkdir newjungle && git -C newjungle init -b master
git-filter-repo \
--invert-paths \
--path web \
--path-glob 'doc*.pdf' \
--path-glob '**/kernel/configs/lockdep' \
--path-glob '**/kernel/configs/defconfig' \
--source oldjungle \
--target newjungle
set -x
du -sh oldjungle newjungle website
# 57M oldjungle
# 2,3M newjungle
# 6,4M website
du -sh --exclude=.git oldjungle newjungle website
# 30M oldjungle
# 700K newjungle
# 3,5M website

111
flake.lock generated
View File

@@ -1,25 +1,128 @@
{
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": [
"nixpkgs"
],
"systems": "systems"
},
"locked": {
"lastModified": 1750173260,
"narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
"owner": "ryantm",
"repo": "agenix",
"rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"bscpkgs": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1749650500,
"narHash": "sha256-2MHfVPV6RA7qPSCtXh4+KK0F0UjN+J4z8//+n6NK7Xs=",
"ref": "refs/heads/master",
"rev": "9d1944c658929b6f98b3f3803fead4d1b91c4405",
"revCount": 961,
"type": "git",
"url": "https://git.sr.ht/~rodarima/bscpkgs"
},
"original": {
"type": "git",
"url": "https://git.sr.ht/~rodarima/bscpkgs"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1744478979,
"narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "43975d782b418ebf4969e9ccba82466728c2851b",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1745494811,
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1767634882,
"narHash": "sha256-2GffSfQxe3sedHzK+sTKlYo/NTIAGzbFCIsNMUPAAnk=",
"lastModified": 1752436162,
"narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "3c9db02515ef1d9b6b709fc60ba9a540957f661c",
"rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.11",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"bscpkgs": "bscpkgs",
"nixpkgs": "nixpkgs"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",

View File

@@ -1,22 +1,19 @@
{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
agenix.url = "github:ryantm/agenix";
agenix.inputs.nixpkgs.follows = "nixpkgs";
bscpkgs.url = "git+https://git.sr.ht/~rodarima/bscpkgs";
bscpkgs.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = { self, nixpkgs, ... }:
outputs = { self, nixpkgs, agenix, bscpkgs, ... }:
let
mkConf = name: nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit nixpkgs; theFlake = self; };
specialArgs = { inherit nixpkgs bscpkgs agenix; theFlake = self; };
modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
};
# For now we only support x86
system = "x86_64-linux";
pkgs = import nixpkgs {
inherit system;
overlays = [ self.overlays.default ];
config.allowUnfree = true;
};
in
{
nixosConfigurations = {
@@ -34,19 +31,9 @@ in
weasel = mkConf "weasel";
};
bscOverlay = import ./overlay.nix;
overlays.default = self.bscOverlay;
# full nixpkgs with our overlay applied
legacyPackages.${system} = pkgs;
hydraJobs = self.legacyPackages.${system}.bsc.hydraJobs;
# propagate nixpkgs lib, so we can do bscpkgs.lib
lib = nixpkgs.lib // {
maintainers = nixpkgs.lib.maintainers // {
bsc = import ./pkgs/maintainers.nix;
};
packages.x86_64-linux = self.nixosConfigurations.hut.pkgs // {
bscpkgs = bscpkgs.packages.x86_64-linux;
nixpkgs = nixpkgs.legacyPackages.x86_64-linux;
};
};
}

View File

@@ -57,18 +57,6 @@
};
};
services.fail2ban = {
enable = true;
maxretry = 5;
bantime-increment = {
enable = true; # Double ban time on each attack
maxtime = "7d"; # Ban up to a week
};
};
# Disable SSH login with password, allow only keypair
services.openssh.settings.PasswordAuthentication = false;
networking.firewall = {
extraCommands = ''
# Blackhole BSC vulnerability scanner (OpenVAS) as it is spamming our

View File

@@ -24,7 +24,7 @@
address = "10.0.40.40";
prefixLength = 24;
} ];
interfaces.ibs785.ipv4.addresses = [ {
interfaces.ibp5s0.ipv4.addresses = [ {
address = "10.0.42.40";
prefixLength = 24;
} ];

View File

@@ -11,7 +11,6 @@
./base/hw.nix
./base/net.nix
./base/nix.nix
./base/sys-devices.nix
./base/ntp.nix
./base/rev.nix
./base/ssh.nix

View File

@@ -1,8 +1,9 @@
{ pkgs, ... }:
{ agenix, ... }:
{
imports = [ ../../module/agenix.nix ];
imports = [ agenix.nixosModules.default ];
# Add agenix to system packages
environment.systemPackages = [ pkgs.agenix ];
environment.systemPackages = [
agenix.packages.x86_64-linux.default
];
}

View File

@@ -1,12 +1,12 @@
{ pkgs, ... }:
{ pkgs, config, ... }:
{
environment.systemPackages = with pkgs; [
vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
ncdu perf ldns pv
# From jungle overlay
osumb nixgen
ncdu config.boot.kernelPackages.perf ldns pv
# From bsckgs overlay
osumb
];
programs.direnv.enable = true;

View File

@@ -1,8 +1,9 @@
{ pkgs, nixpkgs, theFlake, ... }:
{ pkgs, nixpkgs, bscpkgs, theFlake, ... }:
{
nixpkgs.overlays = [
(import ../../../overlay.nix)
bscpkgs.bscOverlay
(import ../../../pkgs/overlay.nix)
];
nixpkgs.config.allowUnfree = true;

View File

@@ -1,9 +0,0 @@
{
nix.settings.system-features = [ "sys-devices" ];
programs.nix-required-mounts.enable = true;
programs.nix-required-mounts.allowedPatterns.sys-devices.paths = [
"/sys/devices/system/cpu"
"/sys/devices/system/node"
];
}

View File

@@ -139,7 +139,6 @@
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
];
shell = pkgs.zsh;
};
pmartin1 = {
@@ -181,19 +180,6 @@
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmMqKqPg4uocNOr3O41kLbZMOMJn3m2ZdN1JvTR96z3 bsccns@arnau-bsc"
];
};
aaguirre = {
uid = 9655;
isNormalUser = true;
home = "/home/Computational/aaguirre";
description = "Alejandro Aguirre";
group = "Computational";
hosts = [ "apex" "hut" ];
hashedPassword = "$6$TXRXQT6jjBvxkxU6$E.sh5KspAm1qeG5Ct7OPHpo8REmbGDwjFGvqeGgTVz3GASGOAnPL7UMZsMAsAKBoahOw.v8LNno6XGrTEPzZH1";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOlRX7ZCnqtUJYCxKgWmgSrFCYuA2LHY96rVwqxXPl86 aaguirre@BSC-8488184117"
];
};
};
groups = {

View File

@@ -5,5 +5,5 @@
boot.kernelModules = [ "ipmi_watchdog" ];
# Enable systemd watchdog with 30 s interval
systemd.settings.Manager.RuntimeWatchdogSec = 30;
systemd.watchdog.runtimeTime = "30s";
}

File diff suppressed because it is too large Load Diff

10333
m/eudy/kernel/configs/lockdep Normal file

File diff suppressed because it is too large Load Diff

View File

@@ -1,6 +1,11 @@
{ pkgs, lib, ... }:
{ config, pkgs, lib, ... }:
{
# add the perf tool
environment.systemPackages = with pkgs; [
config.boot.kernelPackages.perf
];
# allow non-root users to read tracing data from the kernel
boot.kernel.sysctl."kernel.perf_event_paranoid" = -2;
boot.kernel.sysctl."kernel.kptr_restrict" = 0;

View File

@@ -93,4 +93,20 @@
wantedBy = [ "multi-user.target" ];
serviceConfig.ExecStart = script;
};
# Only allow SSH connections from users who have a SLURM allocation
# See: https://slurm.schedmd.com/pam_slurm_adopt.html
security.pam.services.sshd.rules.account.slurm = {
control = "required";
enable = true;
modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
args = [ "log_level=debug5" ];
order = 999999; # Make it last one
};
# Disable systemd session (pam_systemd.so) as it will conflict with the
# pam_slurm_adopt.so module. What happens is that the shell is first adopted
# into the slurmstepd task and then into the systemd session, which is not
# what we want, otherwise it will linger even if all jobs are gone.
security.pam.services.sshd.startSession = lib.mkForce false;
}

View File

@@ -23,11 +23,11 @@
peers = [
# List of allowed peers.
{
{
name = "apex";
publicKey = "VwhcN8vSOzdJEotQTpmPHBC52x3Hbv1lkFIyKubrnUA=";
# List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
allowedIPs = [ "10.106.0.30/32" "10.0.40.7/32" ];
allowedIPs = [ "10.106.0.30/32" ];
}
{
name = "raccoon";
@@ -40,7 +40,6 @@
networking.hosts = {
"10.106.0.30" = [ "apex" ];
"10.0.40.7" = [ "hut" ];
"10.106.0.236" = [ "raccoon" ];
"10.0.44.4" = [ "tent" ];
};

View File

@@ -17,7 +17,6 @@
./postgresql.nix
./nginx.nix
./p.nix
./ompss2-timer.nix
#./pxe.nix
];
@@ -45,7 +44,7 @@
address = "10.0.40.7";
prefixLength = 24;
} ];
interfaces.ibs785.ipv4.addresses = [ {
interfaces.ibp5s0.ipv4.addresses = [ {
address = "10.0.42.7";
prefixLength = 24;
} ];

View File

@@ -29,9 +29,6 @@
};
};
# Allow gitea user to send mail
users.users.gitea.extraGroups = [ "mail-robot" ];
services.gitea-actions-runner.instances = {
runrun = {
enable = true;

View File

@@ -1,11 +1,8 @@
{ config, lib, ... }:
{
# Robot user that can see the password to send mail from jungle-robot
users.groups.mail-robot = {};
age.secrets.jungleRobotPassword = {
file = ../../secrets/jungle-robot-password.age;
group = "mail-robot";
group = "gitea";
mode = "440";
};

View File

@@ -2,13 +2,10 @@
let
website = pkgs.stdenv.mkDerivation {
name = "jungle-web";
src = pkgs.fetchgit {
url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
};
src = theFlake;
buildInputs = [ pkgs.hugo ];
buildPhase = ''
cd web
rm -rf public/
hugo
'';

View File

@@ -1,85 +0,0 @@
{ config, pkgs, ... }:
{
systemd.timers = {
"ompss2-closing" = {
wantedBy = [ "timers.target" ];
timerConfig = {
Unit = "ompss2-closing.service";
OnCalendar = [ "*-03-15 07:00:00" "*-09-15 07:00:00"];
};
};
"ompss2-freeze" = {
wantedBy = [ "timers.target" ];
timerConfig = {
Unit = "ompss2-freeze.service";
OnCalendar = [ "*-04-15 07:00:00" "*-10-15 07:00:00" ];
};
};
"ompss2-release" = {
wantedBy = [ "timers.target" ];
timerConfig = {
Unit = "ompss2-release.service";
OnCalendar = [ "*-05-15 07:00:00" "*-11-15 07:00:00" ];
};
};
};
systemd.services =
let
closing = pkgs.writeText "closing.txt"
''
Subject: OmpSs-2 release enters closing period
Hi,
You have one month to merge the remaining features for the next OmpSs-2
release. Please, identify what needs to be merged and discuss it in the next
OmpSs-2 meeting.
Thanks!,
Jungle robot
'';
freeze = pkgs.writeText "freeze.txt"
''
Subject: OmpSs-2 release enters freeze period
Hi,
The period to introduce new features or breaking changes is over, only bug
fixes are allowed now. During this time, please prepare the release notes
to be included in the next OmpSs-2 release.
Thanks!,
Jungle robot
'';
release = pkgs.writeText "release.txt"
''
Subject: OmpSs-2 release now
Hi,
The period to introduce bug fixes is now over. Please, proceed to do the
OmpSs-2 release.
Thanks!,
Jungle robot
'';
mkServ = name: mail: {
"ompss2-${name}" = {
script = ''
set -eu
set -o pipefail
cat ${mail} | ${config.security.wrapperDir}/sendmail star@bsc.es
'';
serviceConfig = {
Type = "oneshot";
DynamicUser = true;
Group = "mail-robot";
};
};
};
in
(mkServ "closing" closing) //
(mkServ "freeze" freeze) //
(mkServ "release" release);
}

View File

@@ -46,7 +46,7 @@
address = "10.0.40.42";
prefixLength = 24;
} ];
interfaces.ibs785.ipv4.addresses = [ {
interfaces.ibp5s0.ipv4.addresses = [ {
address = "10.0.42.42";
prefixLength = 24;
} ];

View File

@@ -1,357 +0,0 @@
{
config,
options,
lib,
pkgs,
...
}:
with lib;
let
cfg = config.age;
isDarwin = lib.attrsets.hasAttrByPath [ "environment" "darwinConfig" ] options;
ageBin = config.age.ageBin;
users = config.users.users;
sysusersEnabled =
if isDarwin then
false
else
options.systemd ? sysusers && (config.systemd.sysusers.enable || config.services.userborn.enable);
mountCommand =
if isDarwin then
''
if ! diskutil info "${cfg.secretsMountPoint}" &> /dev/null; then
num_sectors=1048576
dev=$(hdiutil attach -nomount ram://"$num_sectors" | sed 's/[[:space:]]*$//')
newfs_hfs -v agenix "$dev"
mount -t hfs -o nobrowse,nodev,nosuid,-m=0751 "$dev" "${cfg.secretsMountPoint}"
fi
''
else
''
grep -q "${cfg.secretsMountPoint} ramfs" /proc/mounts ||
mount -t ramfs none "${cfg.secretsMountPoint}" -o nodev,nosuid,mode=0751
'';
newGeneration = ''
_agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
(( ++_agenix_generation ))
echo "[agenix] creating new generation in ${cfg.secretsMountPoint}/$_agenix_generation"
mkdir -p "${cfg.secretsMountPoint}"
chmod 0751 "${cfg.secretsMountPoint}"
${mountCommand}
mkdir -p "${cfg.secretsMountPoint}/$_agenix_generation"
chmod 0751 "${cfg.secretsMountPoint}/$_agenix_generation"
'';
chownGroup = if isDarwin then "admin" else "keys";
# chown the secrets mountpoint and the current generation to the keys group
# instead of leaving it root:root.
chownMountPoint = ''
chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
'';
setTruePath = secretType: ''
${
if secretType.symlink then
''
_truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
''
else
''
_truePath="${secretType.path}"
''
}
'';
installSecret = secretType: ''
${setTruePath secretType}
echo "decrypting '${secretType.file}' to '$_truePath'..."
TMP_FILE="$_truePath.tmp"
IDENTITIES=()
for identity in ${toString cfg.identityPaths}; do
test -r "$identity" || continue
test -s "$identity" || continue
IDENTITIES+=(-i)
IDENTITIES+=("$identity")
done
test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
mkdir -p "$(dirname "$_truePath")"
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
(
umask u=r,g=,o=
test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
LANG=${
config.i18n.defaultLocale or "C"
} ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
)
chmod ${secretType.mode} "$TMP_FILE"
mv -f "$TMP_FILE" "$_truePath"
${optionalString secretType.symlink ''
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
''}
'';
testIdentities = map (path: ''
test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!'
'') cfg.identityPaths;
cleanupAndLink = ''
_agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
(( ++_agenix_generation ))
echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
(( _agenix_generation > 1 )) && {
echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
}
'';
installSecrets = builtins.concatStringsSep "\n" (
[ "echo '[agenix] decrypting secrets...'" ]
++ testIdentities
++ (map installSecret (builtins.attrValues cfg.secrets))
++ [ cleanupAndLink ]
);
chownSecret = secretType: ''
${setTruePath secretType}
chown ${secretType.owner}:${secretType.group} "$_truePath"
'';
chownSecrets = builtins.concatStringsSep "\n" (
[ "echo '[agenix] chowning...'" ]
++ [ chownMountPoint ]
++ (map chownSecret (builtins.attrValues cfg.secrets))
);
secretType = types.submodule (
{ config, ... }:
{
options = {
name = mkOption {
type = types.str;
default = config._module.args.name;
defaultText = literalExpression "config._module.args.name";
description = ''
Name of the file used in {option}`age.secretsDir`
'';
};
file = mkOption {
type = types.path;
description = ''
Age file the secret is loaded from.
'';
};
path = mkOption {
type = types.str;
default = "${cfg.secretsDir}/${config.name}";
defaultText = literalExpression ''
"''${cfg.secretsDir}/''${config.name}"
'';
description = ''
Path where the decrypted secret is installed.
'';
};
mode = mkOption {
type = types.str;
default = "0400";
description = ''
Permissions mode of the decrypted secret in a format understood by chmod.
'';
};
owner = mkOption {
type = types.str;
default = "0";
description = ''
User of the decrypted secret.
'';
};
group = mkOption {
type = types.str;
default = users.${config.owner}.group or "0";
defaultText = literalExpression ''
users.''${config.owner}.group or "0"
'';
description = ''
Group of the decrypted secret.
'';
};
symlink = mkEnableOption "symlinking secrets to their destination" // {
default = true;
};
};
}
);
in
{
imports = [
(mkRenamedOptionModule [ "age" "sshKeyPaths" ] [ "age" "identityPaths" ])
];
options.age = {
ageBin = mkOption {
type = types.str;
default = "${pkgs.age}/bin/age";
defaultText = literalExpression ''
"''${pkgs.age}/bin/age"
'';
description = ''
The age executable to use.
'';
};
secrets = mkOption {
type = types.attrsOf secretType;
default = { };
description = ''
Attrset of secrets.
'';
};
secretsDir = mkOption {
type = types.path;
default = "/run/agenix";
description = ''
Folder where secrets are symlinked to
'';
};
secretsMountPoint = mkOption {
type =
types.addCheck types.str (
s:
(builtins.match "[ \t\n]*" s) == null # non-empty
&& (builtins.match ".+/" s) == null
) # without trailing slash
// {
description = "${types.str.description} (with check: non-empty without trailing slash)";
};
default = "/run/agenix.d";
description = ''
Where secrets are created before they are symlinked to {option}`age.secretsDir`
'';
};
identityPaths = mkOption {
type = types.listOf types.path;
default =
if isDarwin then
[
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_rsa_key"
]
else if (config.services.openssh.enable or false) then
map (e: e.path) (
lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys
)
else
[ ];
defaultText = literalExpression ''
if isDarwin
then [
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_rsa_key"
]
else if (config.services.openssh.enable or false)
then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
else [];
'';
description = ''
Path to SSH keys to be used as identities in age decryption.
'';
};
};
config = mkIf (cfg.secrets != { }) (mkMerge [
{
assertions = [
{
assertion = cfg.identityPaths != [ ];
message = "age.identityPaths must be set, for example by enabling openssh.";
}
];
}
(optionalAttrs (!isDarwin) {
# When using sysusers we no longer be started as an activation script
# because those are started in initrd while sysusers is started later.
systemd.services.agenix-install-secrets = mkIf sysusersEnabled {
wantedBy = [ "sysinit.target" ];
after = [ "systemd-sysusers.service" ];
unitConfig.DefaultDependencies = "no";
path = [ pkgs.mount ];
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "agenix-install" (concatLines [
newGeneration
installSecrets
chownSecrets
]);
RemainAfterExit = true;
};
};
# Create a new directory full of secrets for symlinking (this helps
# ensure removed secrets are actually removed, or at least become
# invalid symlinks).
system.activationScripts = mkIf (!sysusersEnabled) {
agenixNewGeneration = {
text = newGeneration;
deps = [
"specialfs"
];
};
agenixInstall = {
text = installSecrets;
deps = [
"agenixNewGeneration"
"specialfs"
];
};
# So user passwords can be encrypted.
users.deps = [ "agenixInstall" ];
# Change ownership and group after users and groups are made.
agenixChown = {
text = chownSecrets;
deps = [
"users"
"groups"
];
};
# So other activation scripts can depend on agenix being done.
agenix = {
text = "";
deps = [ "agenixChown" ];
};
};
})
(optionalAttrs isDarwin {
launchd.daemons.activate-agenix = {
script = ''
set -e
set -o pipefail
export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
${newGeneration}
${installSecrets}
${chownSecrets}
exit 0
'';
serviceConfig = {
RunAtLoad = true;
KeepAlive.SuccessfulExit = false;
};
};
})
]);
}

View File

@@ -1,10 +1,3 @@
{
services.nixseparatedebuginfod2 = {
enable = true;
substituters = [
"local:"
"https://cache.nixos.org"
"http://hut/cache"
];
};
services.nixseparatedebuginfod.enable = true;
}

View File

@@ -1,4 +1,4 @@
{ lib, pkgs, ... }:
{ lib, ... }:
{
imports = [
@@ -21,20 +21,4 @@
};
services.slurm.client.enable = true;
# Only allow SSH connections from users who have a SLURM allocation
# See: https://slurm.schedmd.com/pam_slurm_adopt.html
security.pam.services.sshd.rules.account.slurm = {
control = "required";
enable = true;
modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
args = [ "log_level=debug5" ];
order = 999999; # Make it last one
};
# Disable systemd session (pam_systemd.so) as it will conflict with the
# pam_slurm_adopt.so module. What happens is that the shell is first adopted
# into the slurmstepd task and then into the systemd session, which is not
# what we want, otherwise it will linger even if all jobs are gone.
security.pam.services.sshd.startSession = lib.mkForce false;
}

View File

@@ -1,6 +1,31 @@
{ config, pkgs, ... }:
{
let
suspendProgram = pkgs.writeShellScript "suspend.sh" ''
exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
set -x
export "PATH=/run/current-system/sw/bin:$PATH"
echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
hosts=$(scontrol show hostnames $1)
for host in $hosts; do
echo Shutting down host: $host
ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power off
done
'';
resumeProgram = pkgs.writeShellScript "resume.sh" ''
exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
set -x
export "PATH=/run/current-system/sw/bin:$PATH"
echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
hosts=$(scontrol show hostnames $1)
for host in $hosts; do
echo Starting host: $host
ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power on
done
'';
in {
services.slurm = {
controlMachine = "apex";
clusterName = "jungle";
@@ -34,6 +59,16 @@
# the resources. Use the task/cgroup plugin to enable process containment.
TaskPlugin=task/affinity,task/cgroup
# Power off unused nodes until they are requested
SuspendProgram=${suspendProgram}
SuspendTimeout=60
ResumeProgram=${resumeProgram}
ResumeTimeout=300
SuspendExcNodes=fox
# Turn the nodes off after 1 hour of inactivity
SuspendTime=3600
# Reduce port range so we can allow only this range in the firewall
SrunPortRange=60000-61000
@@ -51,7 +86,9 @@
# when a task runs (srun) so we can ssh early.
PrologFlags=Alloc,Contain,X11
LaunchParameters=use_interactive_step
# LaunchParameters=ulimit_pam_adopt will set RLIMIT_RSS in processes
# adopted by the external step, similar to tasks running in regular steps
# LaunchParameters=ulimit_pam_adopt
SlurmdDebug=debug5
#DebugFlags=Protocol,Cgroup
'';

View File

@@ -20,7 +20,7 @@
address = "10.0.40.1";
prefixLength = 24;
} ];
interfaces.ibs785.ipv4.addresses = [ {
interfaces.ibp5s0.ipv4.addresses = [ {
address = "10.0.42.1";
prefixLength = 24;
} ];

View File

@@ -21,7 +21,7 @@
prefixLength = 24;
} ];
# Watch out! The OmniPath device is not in the same place here:
interfaces.ibs801.ipv4.addresses = [ {
interfaces.ibp129s0.ipv4.addresses = [ {
address = "10.0.42.2";
prefixLength = 24;
} ];

View File

@@ -27,7 +27,4 @@
};
};
};
# Allow gitea user to send mail
users.users.gitea.extraGroups = [ "mail-robot" ];
}

View File

@@ -2,13 +2,10 @@
let
website = pkgs.stdenv.mkDerivation {
name = "jungle-web";
src = pkgs.fetchgit {
url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
};
src = theFlake;
buildInputs = [ pkgs.hugo ];
buildPhase = ''
cd web
rm -rf public/
hugo
'';

View File

@@ -1,178 +0,0 @@
final: /* Future last stage */
prev: /* Previous stage */
with final.lib;
let
callPackage = final.callPackage;
bscPkgs = {
agenix = prev.callPackage ./pkgs/agenix/default.nix { };
amd-uprof = prev.callPackage ./pkgs/amd-uprof/default.nix { };
bench6 = callPackage ./pkgs/bench6/default.nix { };
bigotes = callPackage ./pkgs/bigotes/default.nix { };
clangOmpss2 = callPackage ./pkgs/llvm-ompss2/default.nix { };
clangOmpss2Nanos6 = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nanos6; };
clangOmpss2Nodes = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmp; };
clangOmpss2NodesOmpv = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmpv; };
clangOmpss2Unwrapped = callPackage ./pkgs/llvm-ompss2/clang.nix { };
cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
#extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
intel-apt = callPackage ./pkgs/intel-oneapi/packages.nix { };
intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
intelPackages_2024 = final.intel-apt.hpckit_2024;
intelPackages_2025 = final.intel-apt.hpckit_2025;
intelPackages = final.intelPackages_2025;
jemallocNanos6 = callPackage ./pkgs/nanos6/jemalloc.nix { };
# FIXME: Extend this to all linuxPackages variants. Open problem, see:
# https://discourse.nixos.org/t/whats-the-right-way-to-make-a-custom-kernel-module-available/4636
linuxPackages = prev.linuxPackages.extend (_final: _prev: {
amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
});
linuxPackages_latest = prev.linuxPackages_latest.extend(_final: _prev: {
amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
});
lmbench = callPackage ./pkgs/lmbench/default.nix { };
# Broken and unmantained
# mcxx = callPackage ./pkgs/mcxx/default.nix { };
meteocat-exporter = prev.callPackage ./pkgs/meteocat-exporter/default.nix { };
mpi = final.mpich; # Set MPICH as default
mpich = callPackage ./pkgs/mpich/default.nix { mpich = prev.mpich; };
nanos6 = callPackage ./pkgs/nanos6/default.nix { };
nanos6Debug = final.nanos6.override { enableDebug = true; };
nixtools = callPackage ./pkgs/nixtools/default.nix { };
nixgen = callPackage ./pkgs/nixgen/default.nix { };
# Broken because of pkgsStatic.libcap
# See: https://github.com/NixOS/nixpkgs/pull/268791
#nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
nodes = callPackage ./pkgs/nodes/default.nix { };
nosv = callPackage ./pkgs/nosv/default.nix { };
oneMath = callPackage ./pkgs/onemath/default.nix { };
openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
openmpv = final.openmp.override { enableNosv = true; enableOvni = true; };
osumb = callPackage ./pkgs/osu/default.nix { };
ovni = callPackage ./pkgs/ovni/default.nix { };
ovniGit = final.ovni.override { useGit = true; };
paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
#pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
#psmpi = callPackage ./pkgs/parastation/psmpi.nix { }; # Unmaintaned
slurm = import ./pkgs/slurm/default.nix { slurm = prev.slurm; };
sonar = callPackage ./pkgs/sonar/default.nix { };
stdenvClangOmpss2 = final.stdenv.override { cc = final.clangOmpss2; allowedRequisites = null; };
stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.clangOmpss2Nanos6; allowedRequisites = null; };
stdenvClangOmpss2Nodes = final.stdenv.override { cc = final.clangOmpss2Nodes; allowedRequisites = null; };
stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
tampi = callPackage ./pkgs/tampi/default.nix { };
tasycl = callPackage ./pkgs/tasycl/default.nix { };
tasycl-acpp = callPackage ./pkgs/tasycl/default.nix { useIntel = false; };
upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
wxparaver = callPackage ./pkgs/paraver/default.nix { };
};
tests = rec {
hwloc = callPackage ./test/bugs/hwloc.nix { };
#sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
hello-c = callPackage ./test/compilers/hello-c.nix { };
hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };
hello-sycl = callPackage ./test/compilers/hello-sycl.nix { };
hello-syclompss = callPackage ./test/compilers/icpx-ompss2.nix { };
lto = callPackage ./test/compilers/lto.nix { };
asan = callPackage ./test/compilers/asan.nix { };
intel2023-icx-c = hello-c.override { stdenv = final.intelPackages_2023.stdenv; };
intel2023-icc-c = hello-c.override { stdenv = final.intelPackages_2023.stdenv-icc; };
intel2023-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2023.stdenv; };
intel2023-icc-cpp = hello-cpp.override { stdenv = final.intelPackages_2023.stdenv-icc; };
intel2023-ifort = callPackage ./test/compilers/hello-f.nix {
stdenv = final.intelPackages_2023.stdenv-ifort;
};
intel2024-icx-c = hello-c.override { stdenv = final.intelPackages_2024.stdenv; };
intel2025-icx-c = hello-c.override { stdenv = final.intelPackages_2025.stdenv; };
intel2024-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2024.stdenv; };
intel2025-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2025.stdenv; };
# intel2023-sycl = hello-sycl.override { intelPackages = final.intelPackages_2023; }; # broken
intel2024-sycl = hello-sycl.override { intelPackages = final.intelPackages_2024; };
intel2025-sycl = hello-sycl.override { intelPackages = final.intelPackages_2025; };
clangOmpss2-lto = lto.override { stdenv = final.stdenvClangOmpss2Nanos6; };
clangOmpss2-asan = asan.override { stdenv = final.stdenvClangOmpss2Nanos6; };
clangOmpss2-task = callPackage ./test/compilers/ompss2.nix {
stdenv = final.stdenvClangOmpss2Nanos6;
};
clangNodes-task = callPackage ./test/compilers/ompss2.nix {
stdenv = final.stdenvClangOmpss2Nodes;
};
clangNosvOpenmp-task = callPackage ./test/compilers/clang-openmp.nix {
stdenv = final.stdenvClangOmpss2Nodes;
};
clangNosvOmpv-nosv = callPackage ./test/compilers/clang-openmp-nosv.nix {
stdenv = final.stdenvClangOmpss2NodesOmpv;
};
clangNosvOmpv-ld = callPackage ./test/compilers/clang-openmp-ld.nix {
stdenv = final.stdenvClangOmpss2NodesOmpv;
};
};
# For now, only build toplevel packages in CI/Hydra
pkgsTopLevel = filterAttrs (_: isDerivation) bscPkgs;
# Native build in that platform doesn't imply cross build works
canCrossCompile = platform: default: pkg:
(isDerivation pkg) &&
# If meta.cross is undefined, use default
(pkg.meta.cross or default) &&
(meta.availableOn final.pkgsCross.${platform}.stdenv.hostPlatform pkg);
# For now only RISC-V
crossSet = genAttrs [ "riscv64" ] (platform:
filterAttrs (_: canCrossCompile platform true)
final.pkgsCross.${platform}.bsc.pkgsTopLevel);
buildList = name: paths:
final.runCommandLocal name { } ''
printf '%s\n' ${toString paths} | tee $out
'';
buildList' = name: paths:
final.runCommandLocal name { } ''
deps="${toString paths}"
cat $deps
printf '%s\n' $deps >$out
'';
pkgsList = buildList "ci-pkgs" (builtins.attrValues pkgsTopLevel);
testsList = buildList "ci-tests" (collect isDerivation tests);
allList = buildList' "ci-all" [ pkgsList testsList ];
# For now only RISC-V
crossList = buildList "ci-cross"
(filter
(canCrossCompile "riscv64" false) # opt-in (pkgs with: meta.cross = true)
(builtins.attrValues crossSet.riscv64));
in bscPkgs // {
lib = prev.lib // {
maintainers = prev.lib.maintainers // {
bsc = import ./pkgs/maintainers.nix;
};
};
# Prevent accidental usage of bsc-ci attribute
bsc-ci = throw "the bsc-ci attribute is deprecated, use bsc.ci";
# Internal for our CI tests
bsc = {
# CI targets for nix build
ci = { pkgs = pkgsList; tests = testsList; all = allList; cross = crossList; };
# Direct access to package sets
tests = tests;
pkgs = bscPkgs;
pkgsTopLevel = pkgsTopLevel;
cross = crossSet;
# Hydra uses attribute sets of pkgs
hydraJobs = { tests = tests; pkgs = pkgsTopLevel; cross = crossSet; };
};
}

View File

@@ -1,212 +0,0 @@
#!/usr/bin/env bash
set -Eeuo pipefail
PACKAGE="agenix"
function show_help () {
echo "$PACKAGE - edit and rekey age secret files"
echo " "
echo "$PACKAGE -e FILE [-i PRIVATE_KEY]"
echo "$PACKAGE -r [-i PRIVATE_KEY]"
echo ' '
echo 'options:'
echo '-h, --help show help'
# shellcheck disable=SC2016
echo '-e, --edit FILE edits FILE using $EDITOR'
echo '-r, --rekey re-encrypts all secrets with specified recipients'
echo '-d, --decrypt FILE decrypts FILE to STDOUT'
echo '-i, --identity identity to use when decrypting'
echo '-v, --verbose verbose output'
echo ' '
echo 'FILE an age-encrypted file'
echo ' '
echo 'PRIVATE_KEY a path to a private SSH key used to decrypt file'
echo ' '
echo 'EDITOR environment variable of editor to use when editing FILE'
echo ' '
echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"'
echo ' '
echo 'RULES environment variable with path to Nix file specifying recipient public keys.'
echo "Defaults to './secrets.nix'"
echo ' '
echo "agenix version: @version@"
echo "age binary path: @ageBin@"
echo "age version: $(@ageBin@ --version)"
}
function warn() {
printf '%s\n' "$*" >&2
}
function err() {
warn "$*"
exit 1
}
test $# -eq 0 && (show_help && exit 1)
REKEY=0
DECRYPT_ONLY=0
DEFAULT_DECRYPT=(--decrypt)
while test $# -gt 0; do
case "$1" in
-h|--help)
show_help
exit 0
;;
-e|--edit)
shift
if test $# -gt 0; then
export FILE=$1
else
echo "no FILE specified"
exit 1
fi
shift
;;
-i|--identity)
shift
if test $# -gt 0; then
DEFAULT_DECRYPT+=(--identity "$1")
else
echo "no PRIVATE_KEY specified"
exit 1
fi
shift
;;
-r|--rekey)
shift
REKEY=1
;;
-d|--decrypt)
shift
DECRYPT_ONLY=1
if test $# -gt 0; then
export FILE=$1
else
echo "no FILE specified"
exit 1
fi
shift
;;
-v|--verbose)
shift
set -x
;;
*)
show_help
exit 1
;;
esac
done
RULES=${RULES:-./secrets.nix}
function cleanup {
if [ -n "${CLEARTEXT_DIR+x}" ]
then
rm -rf -- "$CLEARTEXT_DIR"
fi
if [ -n "${REENCRYPTED_DIR+x}" ]
then
rm -rf -- "$REENCRYPTED_DIR"
fi
}
trap "cleanup" 0 2 3 15
function keys {
(@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in rules.\"$1\".publicKeys)" | @jqBin@ -r .[]) || exit 1
}
function armor {
(@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in (builtins.hasAttr \"armor\" rules.\"$1\" && rules.\"$1\".armor))") || exit 1
}
function decrypt {
FILE=$1
KEYS=$2
if [ -z "$KEYS" ]
then
err "There is no rule for $FILE in $RULES."
fi
if [ -f "$FILE" ]
then
DECRYPT=("${DEFAULT_DECRYPT[@]}")
if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
if [ -f "$HOME/.ssh/id_rsa" ]; then
DECRYPT+=(--identity "$HOME/.ssh/id_rsa")
fi
if [ -f "$HOME/.ssh/id_ed25519" ]; then
DECRYPT+=(--identity "$HOME/.ssh/id_ed25519")
fi
fi
if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
err "No identity found to decrypt $FILE. Try adding an SSH key at $HOME/.ssh/id_rsa or $HOME/.ssh/id_ed25519 or using the --identity flag to specify a file."
fi
@ageBin@ "${DECRYPT[@]}" -- "$FILE" || exit 1
fi
}
function edit {
FILE=$1
KEYS=$(keys "$FILE") || exit 1
ARMOR=$(armor "$FILE") || exit 1
CLEARTEXT_DIR=$(@mktempBin@ -d)
CLEARTEXT_FILE="$CLEARTEXT_DIR/$(basename -- "$FILE")"
DEFAULT_DECRYPT+=(-o "$CLEARTEXT_FILE")
decrypt "$FILE" "$KEYS" || exit 1
[ ! -f "$CLEARTEXT_FILE" ] || cp -- "$CLEARTEXT_FILE" "$CLEARTEXT_FILE.before"
[ -t 0 ] || EDITOR='cp -- /dev/stdin'
$EDITOR "$CLEARTEXT_FILE"
if [ ! -f "$CLEARTEXT_FILE" ]
then
warn "$FILE wasn't created."
return
fi
[ -f "$FILE" ] && [ "$EDITOR" != ":" ] && @diffBin@ -q -- "$CLEARTEXT_FILE.before" "$CLEARTEXT_FILE" && warn "$FILE wasn't changed, skipping re-encryption." && return
ENCRYPT=()
if [[ "$ARMOR" == "true" ]]; then
ENCRYPT+=(--armor)
fi
while IFS= read -r key
do
if [ -n "$key" ]; then
ENCRYPT+=(--recipient "$key")
fi
done <<< "$KEYS"
REENCRYPTED_DIR=$(@mktempBin@ -d)
REENCRYPTED_FILE="$REENCRYPTED_DIR/$(basename -- "$FILE")"
ENCRYPT+=(-o "$REENCRYPTED_FILE")
@ageBin@ "${ENCRYPT[@]}" <"$CLEARTEXT_FILE" || exit 1
mkdir -p -- "$(dirname -- "$FILE")"
mv -f -- "$REENCRYPTED_FILE" "$FILE"
}
function rekey {
FILES=$( (@nixInstantiate@ --json --eval -E "(let rules = import $RULES; in builtins.attrNames rules)" | @jqBin@ -r .[]) || exit 1)
for FILE in $FILES
do
warn "rekeying $FILE..."
EDITOR=: edit "$FILE"
cleanup
done
}
[ $REKEY -eq 1 ] && rekey && exit 0
[ $DECRYPT_ONLY -eq 1 ] && DEFAULT_DECRYPT+=("-o" "-") && decrypt "${FILE}" "$(keys "$FILE")" && exit 0
edit "$FILE" && cleanup && exit 0

View File

@@ -1,66 +0,0 @@
{
lib,
stdenv,
age,
jq,
nix,
mktemp,
diffutils,
replaceVars,
ageBin ? "${age}/bin/age",
shellcheck,
}:
let
bin = "${placeholder "out"}/bin/agenix";
in
stdenv.mkDerivation rec {
pname = "agenix";
version = "0.15.0";
src = replaceVars ./agenix.sh {
inherit ageBin version;
jqBin = "${jq}/bin/jq";
nixInstantiate = "${nix}/bin/nix-instantiate";
mktempBin = "${mktemp}/bin/mktemp";
diffBin = "${diffutils}/bin/diff";
};
dontUnpack = true;
doInstallCheck = true;
installCheckInputs = [ shellcheck ];
postInstallCheck = ''
shellcheck ${bin}
${bin} -h | grep ${version}
test_tmp=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
export HOME="$test_tmp/home"
export NIX_STORE_DIR="$test_tmp/nix/store"
export NIX_STATE_DIR="$test_tmp/nix/var"
mkdir -p "$HOME" "$NIX_STORE_DIR" "$NIX_STATE_DIR"
function cleanup {
rm -rf "$test_tmp"
}
trap "cleanup" 0 2 3 15
mkdir -p $HOME/.ssh
cp -r "${./example}" $HOME/secrets
chmod -R u+rw $HOME/secrets
(
umask u=rw,g=r,o=r
cp ${./example_keys/user1.pub} $HOME/.ssh/id_ed25519.pub
chown $UID $HOME/.ssh/id_ed25519.pub
)
(
umask u=rw,g=,o=
cp ${./example_keys/user1} $HOME/.ssh/id_ed25519
chown $UID $HOME/.ssh/id_ed25519
)
cd $HOME/secrets
test $(${bin} -d secret1.age) = "hello"
'';
installPhase = ''
install -D $src ${bin}
'';
meta.description = "age-encrypted secrets for NixOS";
}

View File

@@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 V3XmEA zirqdzZZ1E+sedBn7fbEHq4ntLEkokZ4GctarBBOHXY
Rvs5YHaAUeCZyNwPedubPcHClWYIuXXWA5zadXPWY6w
-> ssh-ed25519 KLPP8w BVp4rDkOYSQyn8oVeHFeinSqW+pdVtxBF9+5VM1yORY
bMwppAi8Nhz0328taU4AzUkTVyWtSLvFZG6c5W/Fs78
--- xCbqLhXAcOziO2wmbjTiSQfZvt5Rlsc4SCvF+iEzpQA
<EFBFBD>KB<EFBFBD><EFBFBD>/<2F>Z<><5A>r<EFBFBD>%<01><>4<EFBFBD><34><EFBFBD>Mq5<71><35>_<EFBFBD><5F>ݒ<><DD92><EFBFBD><EFBFBD><EFBFBD>11 ܨqM;& <20><>Lr<4C><72><EFBFBD>f<EFBFBD><66><EFBFBD>]>N

View File

@@ -1,7 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFYzWG1FQSBpZkZW
aFpLNnJxc0VUMHRmZ2dZS0pjMGVENnR3OHd5K0RiT1RjRUhibFZBCnN5UG5vUjA3
SXpsNGtiVUw4T0tIVFo5Wkk5QS9NQlBndzVvektiQ0ozc0kKLS0tIGxyY1Q4dEZ1
VGZEanJyTFNta2JNRmpZb2FnK2JyS1hSVml1UGdMNWZKQXMKYla+wTXcRedyZoEb
LVWaSx49WoUTU0KBPJg9RArxaeC23GoCDzR/aM/1DvYU
-----END AGE ENCRYPTED FILE-----

View File

@@ -1,9 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 KLPP8w s1DYZRlZuSsyhmZCF1lFB+E9vB8bZ/+ZhBRlx8nprwE
nmYVCsVBrX2CFXXPU+D+bbkkIe/foofp+xoUrg9DHZw
-> ssh-ed25519 V3XmEA Pwv3oCwcY0DX8rY48UNfsj9RumWsn4dbgorYHCwObgI
FKxRYkL3JHtJxUwymWDF0rAtJ33BivDI6IfPsfumM90
-> V'v(/u$-grease em/Vgf 2qDuk
7I3iiQLPGi1COML9u/JeYkr7EqbSLoU
--- 57WJRigUGtmcObrssS3s4PvmR8wgh1AOC/ijJn1s3xI
<EFBFBD>'K<>ƷY&<26>7G<37>O<EFBFBD><4F>Fj<13>k<EFBFBD>X<EFBFBD><58>BnuJ<75><4A>:9<>(<><7F><EFBFBD>X<EFBFBD>#<23>A<EFBFBD><41><EFBFBD><EFBFBD>ڧj<DAA7>,<02>_<17><><EFBFBD>?<3F>Z<EFBFBD><17>v<EFBFBD><76>V<EFBFBD>96]oks~%<25>c <04>e^C<>%JQ5<51><H<>z}<7D>C<EFBFBD>,<2C>p<EFBFBD><70>*!W<><57><EFBFBD>A<EFBFBD><41><EFBFBD>҅dC<15>K)<10><>-<2D>y

Binary file not shown.

View File

@@ -1,5 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 V3XmEA OB4+1FbPhQ3r6iGksM7peWX5it8NClpXIq/o5nnP7GA
FmHVUj+A5i5+bDFgySQskmlvynnosJiWUTJmBRiNA9I
--- tP+3mFVtd7ogVu1Lkboh55zoi5a77Ht08Uc/QuIviv4
<EFBFBD><EFBFBD>X<EFBFBD>{<7B><>O<EFBFBD><4F><1F><04>tMXx<58>vӪ(<28>I<EFBFBD>myP<79><50><EFBFBD><EFBFBD>+3<>S3i

View File

@@ -1,23 +0,0 @@
let
user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
in
{
"secret1.age".publicKeys = [
user1
system1
];
"secret2.age".publicKeys = [ user1 ];
"passwordfile-user1.age".publicKeys = [
user1
system1
];
"-leading-hyphen-filename.age".publicKeys = [
user1
system1
];
"armored-secret.age" = {
publicKeys = [ user1 ];
armor = true;
};
}

View File

@@ -1,7 +0,0 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxAAAAJA3yvCWN8rw
lgAAAAtzc2gtZWQyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxA
AAAEA+J2V6AG1NriAIvnNKRauIEh1JE9HSdhvKJ68a5Fm0w/JDyIr/FSz1cJdcoW69R+Nr
WzwGK/+3gJpqD1t8L2zEAAAADHJ5YW50bUBob21lMQE=
-----END OPENSSH PRIVATE KEY-----

View File

@@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE

View File

@@ -1,7 +0,0 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRwAAAJC2JJ8htiSf
IQAAAAtzc2gtZWQyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRw
AAAEDxt5gC/s53IxiKAjfZJVCCcFIsdeERdIgbYhLO719+Kb0idNvgGiucWgup/mP78zyC
23uFjYq0evcWdjGQUaBHAAAADHJ5YW50bUBob21lMQE=
-----END OPENSSH PRIVATE KEY-----

View File

@@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH

View File

@@ -1,23 +0,0 @@
#!/bin/sh
set -e
# All operations are done relative to root
GITROOT=$(git rev-parse --show-toplevel)
cd "$GITROOT"
REVISION=${1:-main}
TMPCLONE=$(mktemp -d)
trap "rm -rf ${TMPCLONE}" EXIT
git clone https://github.com/ryantm/agenix.git --revision="$REVISION" "$TMPCLONE" --depth=1
cp "${TMPCLONE}/pkgs/agenix.sh" pkgs/agenix/agenix.sh
cp "${TMPCLONE}/pkgs/agenix.nix" pkgs/agenix/default.nix
sed -i 's#../example#./example#' pkgs/agenix/default.nix
cp "${TMPCLONE}/example/"* pkgs/agenix/example/
cp "${TMPCLONE}/example_keys/"* pkgs/agenix/example_keys/
cp "${TMPCLONE}/modules/age.nix" m/module/agenix.nix

View File

@@ -86,13 +86,4 @@ in
patchelf --add-needed libnuma.so $out/bin/AMDuProfPcm
set +x
'';
meta = {
description = "Performance analysis tool-suite for x86 based applications";
homepage = "https://www.amd.com/es/developer/uprof.html";
platforms = [ "x86_64-linux" ];
license = lib.licenses.unfree;
maintainers = with lib.maintainers.bsc; [ rarias varcila ];
};
}

View File

@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
'';
hardeningDisable = [ "pic" "format" ];
nativeBuildInputs = kernel.moduleBuildDependencies;
patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
patches = [ ./makefile.patch ./hrtimer.patch ];
makeFlags = [
"KERNEL_VERSION=${kernel.modDirVersion}"
"KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -29,7 +29,5 @@ in stdenv.mkDerivation {
description = "AMD Power Profiler Driver";
homepage = "https://www.amd.com/es/developer/uprof.html";
platforms = lib.platforms.linux;
license = lib.licenses.unfree;
maintainers = with lib.maintainers.bsc; [ rarias varcila ];
};
}

View File

@@ -1,20 +0,0 @@
diff --git a/inc/PwrProfAsm.h b/inc/PwrProfAsm.h
index d77770a..c93a0e9 100644
--- a/inc/PwrProfAsm.h
+++ b/inc/PwrProfAsm.h
@@ -347,6 +347,7 @@
#endif
+/*
#define rdmsrq(msr,val1,val2,val3,val4) ({ \
__asm__ __volatile__( \
"rdmsr\n" \
@@ -362,6 +363,7 @@
:"c"(msr), "a"(val1), "d"(val2), "S"(val3), "D"(val4) \
); \
})
+*/
#define rdmsrpw(msr,val1,val2,val3,val4) ({ \
__asm__ __volatile__( \

View File

@@ -1,25 +0,0 @@
{ stdenv, lib, fetchurl, pkg-config, glib, libuuid, popt, elfutils, swig4, python3 }:
stdenv.mkDerivation rec {
name = "babeltrace-1.5.8";
src = fetchurl {
url = "https://www.efficios.com/files/babeltrace/${name}.tar.bz2";
sha256 = "1hkg3phnamxfrhwzmiiirbhdgckzfkqwhajl0lmr1wfps7j47wcz";
};
nativeBuildInputs = [ pkg-config ];
buildInputs = [ glib libuuid popt elfutils swig4 python3 ];
meta = with lib; {
description = "Command-line tool and library to read and convert LTTng tracefiles";
homepage = "https://www.efficios.com/babeltrace";
license = licenses.mit;
platforms = platforms.linux;
maintainers = [ maintainers.bjornfor ];
};
configureFlags = [
"--enable-python-bindings"
];
}

View File

@@ -1,34 +0,0 @@
{
stdenv
, fetchurl
, pkg-config
, glib
, libuuid
, popt
, elfutils
, python3
, swig4
, ncurses
, breakpointHook
}:
stdenv.mkDerivation rec {
pname = "babeltrace2";
version = "2.0.3";
src = fetchurl {
url = "https://www.efficios.com/files/babeltrace/${pname}-${version}.tar.bz2";
sha256 = "1804pyq7fz6rkcz4r1abkkn0pfnss13m6fd8if32s42l4lajadm5";
};
enableParallelBuilding = true;
nativeBuildInputs = [ pkg-config ];
buildInputs = [ glib libuuid popt elfutils python3 swig4 ncurses breakpointHook ];
hardeningDisable = [ "all" ];
configureFlags = [
"--enable-python-plugins"
"--enable-python-bindings"
];
}

View File

@@ -1,70 +0,0 @@
{
stdenv
, lib
, bigotes
, cmake
, clangOmpss2
, openmp
, openmpv
, nanos6
, nodes
, nosv
, mpi
, tampi
, openblas
, ovni
, gitBranch ? "master"
, gitURL ? "ssh://git@bscpm04.bsc.es/rarias/bench6.git"
, gitCommit ? "bf29a53113737c3aa74d2fe3d55f59868faea7b4"
}:
stdenv.mkDerivation rec {
pname = "bench6";
version = "${src.shortRev}";
src = builtins.fetchGit {
url = gitURL;
ref = gitBranch;
rev = gitCommit;
};
nativeBuildInputs = [
cmake
clangOmpss2
];
buildInputs = [
bigotes
openmp
openmpv
nanos6
nodes
nosv
mpi
tampi
openblas
openblas.dev
ovni
];
env = {
NANOS6_HOME = nanos6;
NODES_HOME = nodes;
NOSV_HOME = nosv;
};
cmakeFlags = [
"-DCMAKE_C_COMPILER=clang"
"-DCMAKE_CXX_COMPILER=clang++"
];
hardeningDisable = [ "all" ];
dontStrip = true;
meta = {
homepage = "https://gitlab.pm.bsc.es/rarias/bench6";
description = "Set of micro-benchmarks for OmpSs-2 and several mini-apps";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.linux;
license = lib.licenses.gpl3Plus;
};
}

View File

@@ -1,26 +0,0 @@
{
stdenv
, lib
, fetchFromGitHub
, cmake
}:
stdenv.mkDerivation {
pname = "bigotes";
version = "9dce13";
src = fetchFromGitHub {
owner = "rodarima";
repo = "bigotes";
rev = "9dce13446a8da30bea552d569d260d54e0188518";
sha256 = "sha256-ktxM3pXiL8YXSK+/IKWYadijhYXqGoLY6adLk36iigE=";
};
nativeBuildInputs = [ cmake ];
meta = {
homepage = "https://github.com/rodarima/bigotes";
description = "Versatile benchmark tool";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.linux;
license = lib.licenses.gpl3Plus;
};
}

View File

@@ -1,54 +0,0 @@
{ stdenv
, fetchFromGitHub
, libcap
, libcgroup
, libmhash
, doxygen
, graphviz
, autoreconfHook
, pkg-config
, glib
}:
let
version = "0.4.4";
in stdenv.mkDerivation {
pname = "clsync";
inherit version;
src = fetchFromGitHub {
repo = "clsync";
owner = "clsync";
rev = "v${version}";
sha256 = "0sdiyfwp0iqr6l1sirm51pirzmhi4jzgky5pzfj24nn71q3fwqgz";
};
outputs = [ "out" "dev" ];
buildInputs = [
autoreconfHook
libcap
libcgroup
libmhash
doxygen
graphviz
pkg-config
glib
];
preConfigure = ''
./configure --help
'';
enableParallelBuilding = true;
meta = with lib; {
description = "File live sync daemon based on inotify/kqueue/bsm (Linux, FreeBSD), written in GNU C";
homepage = "https://github.com/clsync/clsync";
license = licenses.gpl3Plus;
maintainers = [ ];
platforms = platforms.linux;
};
}

View File

@@ -1,51 +0,0 @@
{
stdenv
, lib
, babeltrace2
, pkg-config
, uthash
, enableTest ? false
, mpi ? null
, clangOmpss2 ? null
, tampi ? null
}:
with lib;
assert (enableTest -> (mpi != null));
assert (enableTest -> (clangOmpss2 != null));
assert (enableTest -> (tampi != null));
stdenv.mkDerivation rec {
pname = "cn6";
version = "${src.shortRev}";
buildInputs = [
babeltrace2
pkg-config
uthash
mpi
] ++ optionals (enableTest) [ mpi clangOmpss2 tampi ];
src = builtins.fetchGit {
url = "ssh://git@bscpm04.bsc.es/rarias/cn6.git";
ref = "master";
rev = "c72c3b66b720c2a33950f536fc819051c8f20a69";
};
makeFlags = [ "PREFIX=$(out)" ];
postBuild = optionalString (enableTest) ''
(
cd test
make timediff timediff_mpi
)
'';
postInstall = optionalString (enableTest) ''
(
cd test
cp timediff timediff_mpi sync-err.sh $out/bin/
)
'';
}

View File

@@ -1,21 +0,0 @@
{
stdenv
, perl # For the pod2man command
}:
stdenv.mkDerivation rec {
version = "20201006";
pname = "cpuid";
buildInputs = [ perl ];
# Replace /usr install directory for $out
postPatch = ''
sed -i "s@/usr@$out@g" Makefile
'';
src = builtins.fetchTarball {
url = "http://www.etallen.com/cpuid/${pname}-${version}.src.tar.gz";
sha256 = "04qhs938gs1kjxpsrnfy6lbsircsprfyh4db62s5cf83a1nrwn9w";
};
}

View File

@@ -1,6 +1,5 @@
{
stdenv
, lib
, cudatoolkit
, cudaPackages
, autoAddDriverRunpath
@@ -12,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
src = ./.;
buildInputs = [
cudatoolkit # Required for nvcc
(lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
cudaPackages.cuda_cudart.static # Required for -lcudart_static
autoAddDriverRunpath
];
installPhase = ''
@@ -41,9 +40,4 @@ stdenv.mkDerivation (finalAttrs: {
'';
installPhase = "touch $out";
};
meta = {
platforms = [ "x86_64-linux" ];
maintainers = with lib.maintainers.bsc; [ rarias ];
};
})

View File

@@ -1,25 +0,0 @@
{
stdenv
}:
stdenv.mkDerivation rec {
name = "dummy";
src = null;
dontUnpack = true;
dontBuild = true;
programPath = "/bin/dummy";
installPhase = ''
mkdir -p $out/bin
cat > $out/bin/dummy <<EOF
#!/bin/sh
echo Hello worlda!
EOF
chmod +x $out/bin/dummy
'';
}

View File

@@ -1,13 +0,0 @@
diff --git a/src/merger/common/bfd_manager.c b/src/merger/common/bfd_manager.c
index 5f9dacf9..5231e3eb 100644
--- a/src/merger/common/bfd_manager.c
+++ b/src/merger/common/bfd_manager.c
@@ -225,7 +225,7 @@ asymbol **BFDmanager_getDefaultSymbols (void)
*
* @return No return value.
*/
-static void BFDmanager_findAddressInSection (bfd * abfd, asection * section, PTR data)
+static void BFDmanager_findAddressInSection (bfd * abfd, asection * section, void * data)
{
#if HAVE_BFD_GET_SECTION_SIZE || HAVE_BFD_SECTION_SIZE || HAVE_BFD_GET_SECTION_SIZE_BEFORE_RELOC
bfd_size_type size;

View File

@@ -1,123 +0,0 @@
{ stdenv
, lib
, fetchFromGitHub
, boost
, libdwarf
, libelf
, libxml2
, libunwind
, papi
, binutils-unwrapped
, libiberty
, gfortran
, xml2
, which
, libbfd
, mpi ? null
, cuda ? null
, llvmPackages
, autoreconfHook
#, python3Packages
, installShellFiles
, symlinkJoin
, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
}:
let
libdwarfBundle = symlinkJoin {
name = "libdwarfBundle";
paths = [ libdwarf.dev libdwarf.lib libdwarf.out ];
};
in
stdenv.mkDerivation rec {
pname = "extrae";
version = "4.0.1";
src = fetchFromGitHub {
owner = "bsc-performance-tools";
repo = "extrae";
rev = "${version}";
sha256 = "SlMYxNQXJ0Xg90HmpnotUR3tEPVVBXhk1NtEBJwGBR4=";
};
patches = [
# FIXME: Waiting for German to merge this patch. Still not in master, merged
# on 2023-03-01 in devel branch (after 3 years), see:
# https://github.com/bsc-performance-tools/extrae/pull/45
./use-command.patch
# https://github.com/bsc-performance-tools/extrae/issues/71
./PTR.patch
];
enableParallelBuilding = true;
hardeningDisable = [ "all" ];
nativeBuildInputs = [ installShellFiles ];
buildInputs = [
autoreconfHook
gfortran
libunwind
binutils-unwrapped
boost
boost.dev
libiberty
mpi
xml2
which
libxml2.dev
libbfd
#python3Packages.sphinx
]
++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
preConfigure = ''
configureFlagsArray=(
--enable-posix-clock
--with-binutils="${binutils-unwrapped} ${libiberty}"
--with-dwarf=${libdwarfBundle}
--with-elf=${libelf}
--with-boost=${boost.dev}
--enable-instrument-io
--enable-instrument-dynamic-memory
--without-memkind
--enable-merge-in-trace
--disable-online
--without-opencl
--enable-pebs-sampling
--enable-sampling
--with-unwind=${libunwind.dev}
--with-xml-prefix=${libxml2.dev}
${lib.optionalString enablePapi "--with-papi=${papi}"}
${if (mpi != null) then ''--with-mpi=${mpi}''
else ''--without-mpi''}
--without-dyninst)
'';
# Install the manuals only by hand, as we don't want to pull the complete
# LaTeX world
# FIXME: sphinx is broken
#postBuild = ''
# make -C docs man
#'';
#
#postInstall = ''
# installManPage docs/builds/man/*/*
#'';
# ++ (
# if (openmp)
# then [ "--enable-openmp" ]
# else []
# );
meta = {
homepage = "https://github.com/bsc-performance-tools/extrae";
description = "Instrumentation framework to generate execution traces of the most used parallel runtimes";
maintainers = [ ];
broken = true;
platforms = lib.platforms.linux;
license = lib.licenses.lgpl21Plus;
};
}

View File

@@ -1,24 +0,0 @@
diff --git a/substitute b/substitute
index d5615606..82ca91a5 100755
--- a/substitute
+++ b/substitute
@@ -16,7 +16,7 @@ UNAME=`uname`
if [ "${UNAME}" = "Darwin" -o "${UNAME}" = "AIX" ] ; then
TMPFILE=substitute-$$
${SED} "s|${KEY}|${VALUE}|g" < ${FILE} >${TMPFILE}
- /bin/mv -f ${TMPFILE} ${FILE}
+ command mv -f ${TMPFILE} ${FILE}
else
${SED} "s|${KEY}|${VALUE}|g" -i ${FILE}
fi
diff --git a/substitute-all b/substitute-all
index 48c6b76a..eda7a0f2 100755
--- a/substitute-all
+++ b/substitute-all
@@ -23,5 +23,5 @@ fi
echo "Applying modification in ${PATHTOCHANGE} - Key = ${KEY} for value = ${VALUE}"
-/usr/bin/find ${PATHTOCHANGE} -type f -exec ${SCRIPT_LOCATION} "${SED}" "${KEY}" "${VALUE}" {} \;
+command find ${PATHTOCHANGE} -type f -exec ${SCRIPT_LOCATION} "${SED}" "${KEY}" "${VALUE}" {} \;

View File

@@ -1,58 +0,0 @@
{ fetchurl, stdenv, lib, llvmPackages ? null, precision ? "double", perl, mpi }:
with lib;
assert stdenv.cc.isClang -> llvmPackages != null;
assert elem precision [ "single" "double" "long-double" "quad-precision" ];
let
version = "3.3.8";
withDoc = stdenv.cc.isGNU;
in
stdenv.mkDerivation {
name = "fftw-${precision}-${version}";
src = fetchurl {
urls = [
"http://fftw.org/fftw-${version}.tar.gz"
"ftp://ftp.fftw.org/pub/fftw/fftw-${version}.tar.gz"
];
sha256 = "00z3k8fq561wq2khssqg0kallk0504dzlx989x3vvicjdqpjc4v1";
};
outputs = [ "out" "dev" "man" ]
++ optional withDoc "info"; # it's dev-doc only
outputBin = "dev"; # fftw-wisdom
buildInputs = [ mpi ]
++ lib.optionals stdenv.cc.isClang [
# TODO: This may mismatch the LLVM version sin the stdenv, see #79818.
llvmPackages.openmp
];
configureFlags =
[ "--enable-shared"
"--enable-threads"
"--enable-mpi"
"--disable-openmp"
]
++ optional (precision != "double") "--enable-${precision}"
# all x86_64 have sse2
# however, not all float sizes fit
++ optional (stdenv.isx86_64 && (precision == "single" || precision == "double") ) "--enable-sse2"
# doc generation causes Fortran wrapper generation which hard-codes gcc
++ optional (!withDoc) "--disable-doc";
enableParallelBuilding = true;
checkInputs = [ perl ];
meta = with lib; {
description = "Fastest Fourier Transform in the West library";
homepage = "http://www.fftw.org/";
license = licenses.gpl2Plus;
maintainers = [ maintainers.spwhitt ];
platforms = platforms.unix;
};
}

View File

@@ -1,75 +0,0 @@
{
stdenv
, lib
, fetchurl
, symlinkJoin
, slurm
, rdma-core
, autoconf
, automake
, libtool
, mpi
, gfortran
}:
let
rdma-core-all = symlinkJoin {
name ="rdma-core-all";
paths = [ rdma-core.dev rdma-core.out ];
};
mpiAll = symlinkJoin {
name = "mpi-all";
paths = [ mpi.all ];
};
in
stdenv.mkDerivation rec {
pname = "GPI-2";
version = "tagaspi-2021.11";
src = fetchurl {
url = "https://pm.bsc.es/gitlab/interoperability/extern/GPI-2/-/archive/${version}/GPI-2-${version}.tar.gz";
hash = "sha256-eY2wpyTpnOXRoAcYoAP82Jq9Q7p5WwDpMj+f1vEX5zw=";
};
enableParallelBuilding = true;
patches = [ ./rdma-core.patch ./max-mem.patch ];
preConfigure = ''
patchShebangs autogen.sh
./autogen.sh
'';
configureFlags = [
"--with-infiniband=${rdma-core-all}"
"--with-mpi=yes" # fixes mpi detection when cross-compiling
"--with-slurm"
"CFLAGS=-fPIC"
"CXXFLAGS=-fPIC"
];
nativeBuildInputs = [
autoconf
automake
gfortran
libtool
];
buildInputs = [
slurm
mpiAll
rdma-core-all
];
hardeningDisable = [ "all" ];
meta = {
homepage = "https://pm.bsc.es/gitlab/interoperability/extern/GPI-2";
description = "GPI-2 extended for supporting Task-Aware GASPI (TAGASPI) library";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.linux;
license = lib.licenses.gpl3Plus;
cross = false; # infiniband detection does not work
};
}

View File

@@ -1,10 +0,0 @@
--- a/tests/tests/segments/max_mem.c 2025-09-12 13:30:53.449353591 +0200
+++ b/tests/tests/segments/max_mem.c 2025-09-12 13:33:49.750352401 +0200
@@ -1,5 +1,7 @@
#include <test_utils.h>
+gaspi_size_t gaspi_get_system_mem (void);
+
/* Test allocates 45% of system memory and creates a segment that
large or if several ranks per node exist, divided among that
number */

View File

@@ -1,12 +0,0 @@
--- a/src/devices/ib/GPI2_IB.h 2025-09-12 13:25:31.564181121 +0200
+++ b/src/devices/ib/GPI2_IB.h 2025-09-12 13:24:49.105422150 +0200
@@ -26,6 +26,9 @@ along with GPI-2. If not, see <http://ww
#include "GPI2_Dev.h"
+/* Missing prototype as driver.h is now private */
+int ibv_read_sysfs_file(const char *dir, const char *file, char *buf, size_t size);
+
#define GASPI_GID_INDEX (0)
#define PORT_LINK_UP (5)
#define MAX_INLINE_BYTES (128)

View File

@@ -1,46 +0,0 @@
From 1454525f70b43a6957b7c9e1870e997368787da3 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Fri, 8 Nov 2019 21:59:21 -0500
Subject: [PATCH] Fix cross-compilation by looking for `ar`.
---
Makefile.am | 2 +-
configure.ac | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/Makefile.am b/Makefile.am
index d18c49b8..b1b53338 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -494,7 +494,7 @@ CCC=@CXX@
# INSTALL_INFO
# LN_S
-AR=ar
+AR=@AR@
ETAGS=etags
ETAGSFLAGS=
# Flag that tells etags to assume C++.
diff --git a/configure.ac b/configure.ac
index 28e75f17..2449b9f5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -37,6 +37,7 @@ AC_CONFIG_AUX_DIR([build-aux])
AC_CONFIG_HEADERS([src/include/config.h:src/include/config.hin])
AC_CONFIG_SRCDIR([src/roff/groff/groff.cpp])
+AC_CONFIG_MACRO_DIR([m4])
AC_USE_SYSTEM_EXTENSIONS
@@ -72,6 +73,7 @@ GROFF_DOC_CHECK
GROFF_MAKEINFO
GROFF_TEXI2DVI
AC_PROG_RANLIB
+AC_CHECK_TOOL([AR], [ar], [ar])
GROFF_INSTALL_SH
GROFF_INSTALL_INFO
AC_PROG_INSTALL
--
2.23.0

View File

@@ -1,127 +0,0 @@
{ stdenv, lib, fetchurl, perl
, ghostscript #for postscript and html output
, psutils, netpbm #for html output
, buildPackages
, autoreconfHook
, pkg-config
, texinfo
}:
stdenv.mkDerivation rec {
pname = "groff";
version = "1.22.4";
src = fetchurl {
url = "mirror://gnu/groff/${pname}-${version}.tar.gz";
sha256 = "14q2mldnr1vx0l9lqp9v2f6iww24gj28iyh4j2211hyynx67p3p7";
};
enableParallelBuilding = false;
patches = [
./0001-Fix-cross-compilation-by-looking-for-ar.patch
];
postPatch = lib.optionalString (psutils != null) ''
substituteInPlace src/preproc/html/pre-html.cpp \
--replace "psselect" "${psutils}/bin/psselect"
'' + lib.optionalString (netpbm != null) ''
substituteInPlace src/preproc/html/pre-html.cpp \
--replace "pnmcut" "${lib.getBin netpbm}/bin/pnmcut" \
--replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
--replace "pnmtopng" "${lib.getBin netpbm}/bin/pnmtopng"
substituteInPlace tmac/www.tmac.in \
--replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
--replace "pngtopnm" "${lib.getBin netpbm}/bin/pngtopnm" \
--replace "@PNMTOPS_NOSETPAGE@" "${lib.getBin netpbm}/bin/pnmtops -nosetpage"
'';
buildInputs = [ ghostscript psutils netpbm perl ];
nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
# Builds running without a chroot environment may detect the presence
# of /usr/X11 in the host system, leading to an impure build of the
# package. To avoid this issue, X11 support is explicitly disabled.
# Note: If we ever want to *enable* X11 support, then we'll probably
# have to pass "--with-appresdir", too.
configureFlags = [
"--without-x"
] ++ lib.optionals (ghostscript != null) [
"--with-gs=${ghostscript}/bin/gs"
] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
"ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
];
makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
# Trick to get the build system find the proper 'native' groff
# http://www.mail-archive.com/bug-groff@gnu.org/msg01335.html
"GROFF_BIN_PATH=${buildPackages.groff}/bin"
"GROFFBIN=${buildPackages.groff}/bin/groff"
];
doCheck = true;
postInstall = ''
for f in 'man.local' 'mdoc.local'; do
cat '${./site.tmac}' >>"$out/share/groff/site-tmac/$f"
done
moveToOutput bin/gropdf $out
moveToOutput bin/pdfmom $out
moveToOutput bin/roff2text $out
moveToOutput bin/roff2pdf $out
moveToOutput bin/roff2ps $out
moveToOutput bin/roff2dvi $out
moveToOutput bin/roff2ps $out
moveToOutput bin/roff2html $out
moveToOutput bin/glilypond $out
moveToOutput bin/mmroff $out
moveToOutput bin/roff2x $out
moveToOutput bin/afmtodit $out
moveToOutput bin/gperl $out
moveToOutput bin/chem $out
moveToOutput share/groff/${version}/font/devpdf $out
# idk if this is needed, but Fedora does it
moveToOutput share/groff/${version}/tmac/pdf.tmac $out
moveToOutput bin/gpinyin $out
moveToOutput lib/groff/gpinyin $out
substituteInPlace $out/bin/gpinyin \
--replace $out/lib/groff/gpinyin $out/lib/groff/gpinyin
moveToOutput bin/groffer $out
moveToOutput lib/groff/groffer $out
substituteInPlace $out/bin/groffer \
--replace $out/lib/groff/groffer $out/lib/groff/groffer
moveToOutput bin/grog $out
moveToOutput lib/groff/grog $out
substituteInPlace $out/bin/grog \
--replace $out/lib/groff/grog $out/lib/groff/grog
'' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
find $out/ -type f -print0 | xargs --null sed -i 's|${buildPackages.perl}|${perl}|'
'';
meta = with lib; {
homepage = "https://www.gnu.org/software/groff/";
description = "GNU Troff, a typesetting package that reads plain text and produces formatted output";
license = licenses.gpl3Plus;
platforms = platforms.all;
maintainers = with maintainers; [ pSub ];
longDescription = ''
groff is the GNU implementation of troff, a document formatting
system. Included in this release are implementations of troff,
pic, eqn, tbl, grn, refer, -man, -mdoc, -mom, and -ms macros,
and drivers for PostScript, TeX dvi format, HP LaserJet 4
printers, Canon CAPSL printers, HTML and XHTML format (beta
status), and typewriter-like devices. Also included is a
modified version of the Berkeley -me macros, the enhanced
version gxditview of the X11 xditview previewer, and an
implementation of the -mm macros.
'';
};
}

View File

@@ -1,16 +0,0 @@
.
.if n \{\
. \" Character translations for non-keyboard
. \" characters - to make them searchable
. if '\*[.T]'utf8' \{\
. char \- \N'45'
. char - \N'45'
. char ' \N'39'
. char \' \N'39'
. \}
.
. \" Shut off SGR by default (groff colors)
. \" Require GROFF_SGR envvar defined to turn it on
. if '\V[GROFF_SGR]'' \
. output x X tty: sgr 0
.\}

View File

@@ -1,70 +0,0 @@
{ stdenv, lib, fetchurl, pkg-config, expat, ncurses
, pciutils, numactl }:
with lib;
stdenv.mkDerivation rec {
name = "hwloc-1.11.6";
src = fetchurl {
url = "http://www.open-mpi.org/software/hwloc/v1.11/downloads/${name}.tar.bz2";
sha256 = "1yl7dm2qplwmnidd712zy12qfvxk28k8ccs694n42ybwdjwzg1bn";
};
nativeBuildInputs = [ pkg-config ];
# Filter out `null' inputs. This allows users to `.override' the
# derivation and set optional dependencies to `null'.
buildInputs = filter (x: x != null)
([ expat ncurses ]
++ (optionals stdenv.isLinux [ numactl ]));
propagatedBuildInputs =
# Since `libpci' appears in `hwloc.pc', it must be propagated.
optional stdenv.isLinux pciutils;
enableParallelBuilding = true;
postInstall =
optionalString (stdenv.isLinux && numactl != null)
'' if [ -d "${numactl}/lib64" ]
then
numalibdir="${numactl}/lib64"
else
numalibdir="${numactl}/lib"
test -d "$numalibdir"
fi
sed -i "$out/lib/libhwloc.la" \
-e "s|-lnuma|-L$numalibdir -lnuma|g"
'';
# Checks disabled because they're impure (hardware dependent) and
# fail on some build machines.
doCheck = false;
meta = {
description = "Portable abstraction of hierarchical architectures for high-performance computing";
longDescription = ''
hwloc provides a portable abstraction (across OS,
versions, architectures, ...) of the hierarchical topology of
modern architectures, including NUMA memory nodes, sockets,
shared caches, cores and simultaneous multithreading. It also
gathers various attributes such as cache and memory
information. It primarily aims at helping high-performance
computing applications with gathering information about the
hardware so as to exploit it accordingly and efficiently.
hwloc may display the topology in multiple convenient
formats. It also offers a powerful programming interface to
gather information about the hardware, bind processes, and much
more.
'';
# http://www.open-mpi.org/projects/hwloc/license.php
license = licenses.bsd3;
homepage = http://www.open-mpi.org/projects/hwloc/;
maintainers = [ ];
platforms = platforms.all;
};
}

View File

@@ -1,40 +0,0 @@
{
stdenv
, gcc
, iccUnwrapped
, wrapCCWith
, intelLicense
}:
let
targetConfig = stdenv.targetPlatform.config;
inherit gcc;
in wrapCCWith rec {
cc = iccUnwrapped;
extraBuildCommands = ''
echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-cflags
echo "-isystem ${iccUnwrapped}/include" >> $out/nix-support/cc-cflags
echo "-isystem ${iccUnwrapped}/include/intel64" >> $out/nix-support/cc-cflags
echo "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-ldflags
echo "-L${gcc.cc.lib}/lib" >> $out/nix-support/cc-ldflags
cat "${iccUnwrapped}/nix-support/propagated-build-inputs" >> \
$out/nix-support/propagated-build-inputs
echo "export INTEL_LICENSE_FILE=${intelLicense}" \
>> $out/nix-support/setup-hook
# Create the wrappers for icc and icpc
if [ -e $ccPath/icc ]; then
wrap icc $wrapper $ccPath/icc
fi
if [ -e $ccPath/icpc ]; then
wrap icpc $wrapper $ccPath/icpc
fi
if [ -e $ccPath/ifort ]; then
wrap ifort $wrapper $ccPath/ifort
fi
'';
}

View File

@@ -1,71 +0,0 @@
{ stdenv
, lib
, fetchurl
, rpmextract
, autoPatchelfHook
, gcc
, intel-mpi
}:
stdenv.mkDerivation rec {
version = "${year}.${v_a}.${v_b}";
name = "intel-compiler-${version}";
passthru = {
CC = "icc";
CXX = "icpc";
};
# From Arch Linux PKGBUILD
dir_nr="17114";
year="2020";
v_a="4";
v_b="304";
update="4";
composer_xe_dir="compilers_and_libraries_${year}.${v_a}.${v_b}";
tgz="parallel_studio_xe_2020_update${update}_professional_edition.tgz";
src = fetchurl {
url = "https://registrationcenter-download.intel.com/akdlm/irc_nas/tec/${dir_nr}/${tgz}";
sha256 = "1rn9kk5bjj0jfv853b09dxrx7kzvv8dlyzw3hl9ijx9mqr09lrzr";
};
buildInputs = [
rpmextract
autoPatchelfHook
gcc.cc.lib
gcc
intel-mpi
];
# The gcc package is required for building other programs
propagatedBuildInputs = [ gcc ];
installPhase = ''
pwd
ls -l rpm
rpmextract rpm/intel-icc-*.rpm
rpmextract rpm/intel-comp-*.rpm
rpmextract rpm/intel-c-comp-*.rpm
rpmextract rpm/intel-openmp*.rpm
rpmextract rpm/intel-ifort*.rpm
mkdir -p $out/{bin,lib,include}
pushd ./opt/intel/${composer_xe_dir}/linux/
cp -a bin/intel64/* $out/bin/
cp -a compiler/include/* $out/include/
cp -a compiler/lib/intel64_lin/* $out/lib/
ln -s lib $out/lib_lin
rm $out/lib/*.dbg
popd
'';
meta = {
homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
description = "Intel compiler";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.linux;
license = lib.licenses.unfree;
};
}

View File

@@ -1,156 +0,0 @@
{ stdenv
, lib
, fetchurl
, dpkg
, rsync
, libffi
, libelf
, libxml2
, hwloc
, autoPatchelfHook
}:
with lib;
let
getsrc = url: sha256: fetchurl { inherit url sha256; };
version = "2021.2.0";
_debpkgrel = "610";
tbbrel = "357";
# Shorhands
main = "intel-oneapi-dpcpp-cpp";
compiler = "intel-oneapi-compiler-dpcpp-cpp";
shared = "intel-oneapi-compiler-shared";
openmp = "intel-oneapi-openmp";
tbb = "intel-oneapi-tbb";
# From Arch Linux PKGBUILD:
# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=intel-oneapi-compiler-dpcpp-cpp
debs = [
# From intel-oneapi-compiler-dpcpp-cpp
"${main}-${version}-${version}-${_debpkgrel}_amd64.deb"
"${compiler}-common-${version}-${version}-${_debpkgrel}_all.deb"
"${compiler}-runtime-${version}-${version}-${_debpkgrel}_amd64.deb"
# From intel-oneapi-compiler-shared
"${shared}-${version}-${version}-${_debpkgrel}_amd64.deb"
"${shared}-runtime-${version}-${version}-${_debpkgrel}_amd64.deb"
"${shared}-common-${version}-${version}-${_debpkgrel}_all.deb"
"${shared}-common-runtime-${version}-${version}-${_debpkgrel}_all.deb"
"${compiler}-classic-fortran-shared-runtime-${version}-${version}-${_debpkgrel}_amd64.deb"
# From intel-oneapi-openmp
"${openmp}-${version}-${version}-${_debpkgrel}_amd64.deb"
"${openmp}-common-${version}-${version}-${_debpkgrel}_all.deb"
# From intel-oneapi-tbb
"${tbb}-${version}-${version}-${tbbrel}_amd64.deb"
"${tbb}-devel-${version}-${version}-${tbbrel}_amd64.deb"
"${tbb}-common-${version}-${version}-${tbbrel}_all.deb"
"${tbb}-common-devel-${version}-${version}-${tbbrel}_all.deb"
];
apthost = "https://apt.repos.intel.com/oneapi/pool/main/";
urls = map (x: apthost + x) debs;
sums = [
# From intel-oneapi-compiler-dpcpp-cpp
"0pwsfzkazr9yf6v6lgwb3p2in6ch3rlcc9qcfarkyqn052p760kk"
"0vzsanldhs4ym4gsfn0zjqm03x53ma1zjkj24hpkhpsvlr2r069w"
"0nx62v6g0wl70lqdh7sh7gfgxbynhrrips9gpj9if60ngz6fm21m"
# From intel-oneapi-compiler-shared
"1al80pcy2r3q2r2pm04sva7rd3z6y287mkdv5jq4p5bfd8yi14d4"
"07rp0cjmbgj48wly9dm6ibxzbsanmgrsjjqr7mx688ms6qbhv314"
"1pf4xckyyhssjknhs6hwampjsz2qjlg81jw2fc441zaccwf25yf3"
"0hk0x4wq60g9wnn9j051v25zcmbasjdzp34xfvrihmcvyws0s69g"
"0dhbw8kshw4abqc9zf891z5ic0x13x3kvhk56nrqkqgcfwps9w8a"
# From intel-oneapi-openmp
"1wqy2sjwlqdh72zhfrxl9pm106hjzfdbbm98cxigbg20fb5lbv5a"
"19nbqypvqcf8c3mwriaqrmp5igjpwvwrb9mq2fxa5i40w7bhlxjl"
# From intel-oneapi-tbb
"1dpii3g861kimky0x7dqcj6hg7zb6i5kw1wgwrxdc5yxhi5slbm9"
"0bl1flm6w0w9nzrh34ig4p9qz2gbdgw9q14as2pwp8flicd8p899"
"0w3kip6q713v1xlfc10ai4v15cbwmbqrv8r1f5x6pfqdbb0bpmbv"
"0v95nmddyi0mjjdvm07w9fm3vq4a0wkx7zxlyzn2f4xg38qc5j73"
];
in
stdenv.mkDerivation {
inherit version;
name = "intel-compiler-${version}";
passthru = {
CC = "icc";
CXX = "icpc";
};
srcs = zipListsWith getsrc urls sums;
buildInputs = [
dpkg
rsync
libffi
libelf
libxml2
hwloc
autoPatchelfHook
stdenv.cc.cc.lib
];
dontBuild = true;
dontStrip = true;
# The gcc package is required for building other programs
#propagatedBuildInputs = [ gcc ];
unpackCmd = ''
dpkg -x $curSrc .
'';
# FIXME: Some dependencies are missing
autoPatchelfIgnoreMissingDeps = true;
#autoPatchelfIgnoreMissingDeps = [ "*" ];
# Compiler
installPhase = ''
mkdir -p $out/{bin,lib,include}
pushd intel/oneapi/compiler/${version}/linux
# Binaries
rsync -a bin/ $out/bin/
rsync -a bin/intel64/ $out/bin/
# Libraries
rsync -a --exclude=oclfpga lib/ $out/lib/
rsync -a compiler/lib/intel64_lin/ $out/lib/
# Headers
rsync -a include/ $out/include/
rsync -a compiler/include/ $out/include/
popd
# TBB
pushd intel/oneapi/tbb/${version}
# Libraries
rsync -a lib/intel64/gcc4.8/ $out/lib/
# Headers
rsync -a include/ $out/include/
popd
'';
meta = {
homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
description = "Intel compiler";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.linux;
license = lib.licenses.unfree;
};
}

View File

@@ -1,39 +0,0 @@
{ stdenv
, requireFile
}:
stdenv.mkDerivation rec {
name = "intel-compiler-license";
version = "2019.7.217";
src = requireFile {
name = "license.lic";
sha256 = "0rgmsqkhpqcfny8j7msa4sgz3prhh248ylh69gjh12dkra77prsj";
message = ''
The Intel Compiler requires a license. You can get one (free of charge) if
you meet the requeriments at the website:
https://software.intel.com/content/www/us/en/develop/articles/qualify-for-free-software.html#opensourcecontributor
Or you can use your own license. Add it to the store with:
$ nix-store --add-fixed sha256 license.lic
/nix/store/2p9v0nvsl3scshjx348z6j32rh7ac0db-license.lic
Notice that the name must match exactly "license.lic".
Then update the hash in the bsc/intel-compiler/license.nix file using the
nix-hash command with:
$ nix-hash --type sha256 --base32 --flat /nix/store/2p9v0nvsl3scshjx348z6j32rh7ac0db-license.lic
06g2xgm1lch6zqfkhb768wacdx46kf61mfvj5wfpyssw0anr0x9q
'';
};
dontUnpack = true;
installPhase = ''
mkdir -p $out
cp $src $out/
'';
}

View File

@@ -1,29 +0,0 @@
{
stdenv
, gcc
, iccUnwrapped
, wrapCCWith
}:
let
targetConfig = stdenv.targetPlatform.config;
inherit gcc;
in wrapCCWith rec {
cc = iccUnwrapped;
extraBuildCommands = ''
echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-cflags
echo "-isystem ${iccUnwrapped}/include" >> $out/nix-support/cc-cflags
echo "-isystem ${iccUnwrapped}/include/icc" >> $out/nix-support/cc-cflags
echo "-isystem ${gcc.cc}/include/c++/${gcc.version}" >> $out/nix-support/cc-cflags
echo "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}" >> $out/nix-support/cc-cflags
echo "-L${iccUnwrapped}/lib" >> $out/nix-support/cc-ldflags
echo "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}" >> $out/nix-support/cc-ldflags
echo "-L${gcc.cc.lib}/lib" >> $out/nix-support/cc-ldflags
# Create the wrappers for icx*
wrap lld $wrapper $ccPath/lld
wrap icx $wrapper $ccPath/icx
wrap icpx $wrapper $ccPath/icpx
'';
}

View File

@@ -1,113 +0,0 @@
{ stdenv
, lib
, rpmextract
, gcc
, zlib
, ucx
, numactl
, rdma-core
, libpsm2
, patchelf
, autoPatchelfHook
, enableDebug ? false
# The _mt version seems to cause seg-faults and deadlocks with the libpsm2
# provider library with programs that call the MPI library without any locking
# mechanism. See https://pm.bsc.es/gitlab/rarias/bscpkgs/-/issues/28. By
# default, we use the non-mt variant, which provides a big lock. If you want to
# use it, take a look at the I_MPI_THREAD_SPLIT env-var as well.
, enableMt ? false
}:
let
lib_variant = (if enableDebug then "debug" else "release");
# See https://software.intel.com/content/www/us/en/develop/documentation/mpi-developer-reference-linux/top/environment-variable-reference/other-environment-variables.html
lib_mt = (if enableMt then "_mt" else "");
lib_name = "${lib_variant}${lib_mt}";
in
stdenv.mkDerivation rec {
name = "intel-mpi-${version}";
version = "2019.10.317";
dir_nr = "17534";
src = builtins.fetchTarball {
url = "http://registrationcenter-download.intel.com/akdlm/irc_nas/tec/${dir_nr}/l_mpi_${version}.tgz";
sha256 = "00nimgqywr20dv1ns5kg4r8539gvharn0xfj48i7mhbg8kwf8s08";
};
buildInputs = [
rpmextract
autoPatchelfHook
gcc.cc.lib
zlib
ucx
numactl
rdma-core
libpsm2
patchelf
];
postUnpack = ''
pushd $sourceRoot
rpmextract rpm/intel-mpi-*.rpm
# Predictable name
mv opt/intel/compilers_and_libraries_* opt/intel/compilers_and_libraries
popd
sourceRoot="$sourceRoot/opt/intel/compilers_and_libraries/linux/mpi/intel64"
'';
patches = [
./mpicc.patch
./mpicxx.patch
];
postPatch = ''
for i in bin/mpi* ; do
echo "Fixing paths in $i"
sed -i "s:I_MPI_SUBSTITUTE_INSTALLDIR:$out:g" "$i"
done
'';
dontBuild = true;
installPhase = ''
mkdir -p $out
mv etc $out
mv bin $out
mv include $out
mkdir $out/lib
cp -a lib/lib* $out/lib
cp -a lib/${lib_name}/lib* $out/lib
cp -a libfabric/lib/* $out/lib
cp -a libfabric/lib/prov/* $out/lib
cp -a libfabric/bin/* $out/bin
ln -s . $out/intel64
rm $out/lib/libmpi.dbg
# Fixup Intel PSM2 library missing (now located at PSMX2)
ln -s $out/lib/libpsmx2-fi.so $out/lib/libpsm2-fi.so
'';
dontAutoPatchelf = true;
# The rpath of libfabric.so bundled with Intel MPI is patched to include the
# rdma-core lib path, as is required for dlopen to find the rdma components.
# TODO: Try the upstream libfabric library with rdma support, so we can avoid
# this hack.
postFixup = ''
autoPatchelf -- $out
patchelf --set-rpath "$out/lib:${rdma-core}/lib:${libpsm2}/lib" $out/lib/libfabric.so
echo "Patched RPATH in libfabric.so to: $(patchelf --print-rpath $out/lib/libfabric.so)"
'';
meta = {
homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
description = "Intel MPI";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.linux;
license = lib.licenses.unfree;
};
}

View File

@@ -1,20 +0,0 @@
--- a/bin/mpicc 2021-02-04 18:15:11.233632360 +0100
+++ b/bin/mpicc 2021-02-05 09:33:49.493598479 +0100
@@ -50,7 +50,7 @@
if [ x"$opt_args" == x"" ]; then
case "${compiler_short_name}" in
icc|icx) "$dir"/mpiicc -cc=$compiler_name "$@" ;;
- cc|*gcc*|clang*) "$dir"/mpigcc -cc=$compiler_name "$@" ;;
+ cc|*gcc*|clang*|mcc|echo) "$dir"/mpigcc -cc=$compiler_name "$@" ;;
mpicc) "$dir"/mpigcc "$@" ;;
*)
echo "Error: unsupported compiler name '$compiler_name'."
@@ -60,7 +60,7 @@
else
case "${compiler_short_name}" in
icc|icx) "$dir"/mpiicc -cc=$compiler_name "$@" $opt_args ;;
- cc|*gcc*|clang*) "$dir"/mpigcc -cc=$compiler_name "$@" $opt_args ;;
+ cc|*gcc*|clang*|mcc|echo) "$dir"/mpigcc -cc=$compiler_name "$@" $opt_args ;;
mpicc) "$dir"/mpigcc "$@" $opt_args ;;
*)
echo "Error: unsupported compiler name '$compiler_name'."

View File

@@ -1,20 +0,0 @@
--- a/bin/mpicxx 2021-02-04 18:15:11.233632360 +0100
+++ b/bin/mpicxx 2021-02-05 09:36:21.396922569 +0100
@@ -50,7 +50,7 @@
if [ x"$opt_args" == x"" ]; then
case "${compiler_short_name}" in
icc|icpc|dpcpp) "$dir"/mpiicpc -cxx=$compiler_name "$@" ;;
- *g++*) "$dir"/mpigxx -cxx=$compiler_name "$@" ;;
+ *g++*|clang*++|mcxx|echo) "$dir"/mpigxx -cxx=$compiler_name "$@" ;;
mpicxx) "$dir"/mpigxx "$@" ;;
*)
echo "Error: unsupported compiler name '$compiler_name'."
@@ -60,7 +60,7 @@
else
case "${compiler_short_name}" in
icc|icpc|dpcpp) "$dir"/mpiicpc -cxx=$compiler_name "$@" $opt_args ;;
- *g++*) "$dir"/mpigxx -cxx=$compiler_name "$@" $opt_args ;;
+ *g++*|clang*++|mcxx|echo) "$dir"/mpigxx -cxx=$compiler_name "$@" $opt_args ;;
mpicxx) "$dir"/mpigxx "$@" $opt_args ;;
*)
echo "Error: unsupported compiler name '$compiler_name'."

View File

@@ -1,480 +0,0 @@
{ stdenv
, fetchurl
, lib
, dpkg
, rsync
, libffi_3_3
, libelf
, libxml2
, hwloc
, zlib
, autoPatchelfHook
, libfabric
, gcc
, wrapCCWith
}:
# The distribution of intel packages is a mess. We are doing the installation
# based on the .deb metapackage "intel-hpckit", and follow de dependencies,
# which have mismatching versions.
# Bruno Bzeznik (bzizou) went through the madness of using their .sh installer,
# pulling all the X dependencies here:
# https://github.com/Gricad/nur-packages/blob/4b67c8ad0ce1baa1d2f53ba41ae5bca8e00a9a63/pkgs/intel/oneapi.nix
# But this is an attempt to install the packages from the APT repo
let
meta = {
description = "Intel oneapi hpckit package component";
homepage = "https://www.intel.com/content/www/us/en/developer/tools/oneapi/hpc-toolkit-download.html";
license = lib.licenses.unfree;
maintainers = with lib.maintainers.bsc; [ abonerib ];
};
v = {
hpckit = "2023.1.0";
compiler = "2023.1.0";
tbb = "2021.9.0";
mpi = "2021.9.0";
};
findMatch = name:
let
aptPackages = builtins.fromJSON (builtins.readFile ./packages.json);
matches = lib.filter (x: name == x.pname) aptPackages;
n = lib.length matches;
match = builtins.traceVerbose (name + " -- ${builtins.toString n}") (builtins.head matches);
apthost = "https://apt.repos.intel.com/oneapi/";
in
{
url = apthost + match.filename;
sha256 = match.sha256;
};
uncompressDebs = debs: name: stdenv.mkDerivation {
name = name;
srcs = debs;
nativeBuildInputs = [ dpkg ];
phases = [ "installPhase" ];
installPhase = ''
mkdir -p $out
for src in $srcs; do
echo "unpacking $src"
dpkg -x $src $out
done
'';
inherit meta;
};
joinDebs = name: names:
let
debs = builtins.map (x: builtins.fetchurl (findMatch x)) names;
in
uncompressDebs debs "${name}-source";
intel-mpi = stdenv.mkDerivation rec {
version = v.mpi;
pname = "intel-mpi";
src = joinDebs pname [
"intel-oneapi-mpi-devel-${version}"
"intel-oneapi-mpi-${version}"
];
nativeBuildInputs = [
autoPatchelfHook
rsync
];
buildInputs = [
libfabric
zlib
stdenv.cc.cc.lib
];
phases = [ "installPhase" "fixupPhase" ];
dontStrip = true;
installPhase = ''
mkdir -p $out/{bin,etc,lib,include}
mkdir -p $out/share/man
cd $src
# MPI
pushd opt/intel/oneapi/mpi/${version}
rsync -a man/ $out/share/man/
rsync -a etc/ $out/etc/
rsync -a include/ $out/include/
cp -a lib/lib* $out/lib/
# Copy the actual libmpi.so from release
cp -a lib/release/lib* $out/lib
# Broken due missing libze_loader.so.1
rsync -a --exclude IMB-MPI1-GPU bin/ $out/bin/
popd
'';
preFixup = ''
for i in $out/bin/mpi* ; do
echo "Fixing paths in $i"
sed -i "s:I_MPI_SUBSTITUTE_INSTALLDIR:$out:g" "$i"
done
'';
inherit meta;
};
intel-tbb = stdenv.mkDerivation rec {
version = v.tbb;
pname = "intel-tbb";
src = joinDebs pname [
"intel-oneapi-tbb-${version}"
"intel-oneapi-tbb-common-${version}"
];
buildInputs = [
intel-mpi
libffi_3_3
libelf
libxml2
hwloc
stdenv.cc.cc.lib
];
nativeBuildInputs = [
autoPatchelfHook
rsync
];
phases = [ "installPhase" "fixupPhase" ];
dontStrip = true;
autoPatchelfIgnoreMissingDeps = [ "libhwloc.so.5" ];
installPhase = ''
mkdir -p $out/lib
cd $src
pushd opt/intel/oneapi/tbb/${version}
# Libraries
rsync -a lib/intel64/gcc4.8/ $out/lib/
popd
'';
inherit meta;
};
intel-compiler-shared = stdenv.mkDerivation rec {
version = v.compiler;
pname = "intel-compiler-shared";
src = joinDebs pname [
"intel-oneapi-compiler-shared-${version}"
"intel-oneapi-compiler-shared-common-${version}"
"intel-oneapi-compiler-shared-runtime-${version}"
];
buildInputs = [
intel-mpi
intel-tbb
libffi_3_3
libelf
libxml2
zlib
hwloc
stdenv.cc.cc.lib
];
nativeBuildInputs = [
autoPatchelfHook
rsync
];
phases = [ "installPhase" "fixupPhase" ];
dontStrip = true;
autoPatchelfIgnoreMissingDeps = [ "libsycl.so.6" ];
installPhase = ''
mkdir -p $out/{bin,lib,include}
mkdir -p $out/share/man
cd $src
# Compiler
pushd opt/intel/oneapi/compiler/${version}
pushd linux
# Binaries
rsync -a bin/ $out/bin/
rsync -a --exclude libcilkrts.so.5 bin/intel64/ $out/bin/
# Libraries
rsync -a lib/ $out/lib/
rsync -a lib/x64/ $out/lib/
rsync -a compiler/lib/intel64_lin/ $out/lib/
chmod +w $out/lib
cp bin/intel64/libcilkrts.so.5 $out/lib/
ln -s $out/lib/libcilkrts.so.5 $out/lib/libcilkrts.so
# Headers
rsync -a compiler/include/ $out/include/
popd
popd
'';
inherit meta;
};
intel-compiler-fortran = stdenv.mkDerivation rec {
version = v.compiler;
pname = "intel-fortran";
src = joinDebs pname [
"intel-oneapi-compiler-fortran-${version}"
"intel-oneapi-compiler-fortran-common-${version}"
"intel-oneapi-compiler-fortran-runtime-${version}"
"intel-oneapi-compiler-dpcpp-cpp-classic-fortran-shared-runtime-${version}"
#"intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-${version}"
#"intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-runtime-${version}"
];
langFortran = true;
buildInputs = [
intel-mpi
intel-compiler-shared
libffi_3_3
libelf
libxml2
hwloc
stdenv.cc.cc.lib
];
nativeBuildInputs = [
autoPatchelfHook
rsync
];
phases = [ "installPhase" "fixupPhase" ];
dontStrip = true;
installPhase = ''
mkdir -p $out/{bin,lib,include}
mkdir -p $out/share/man
cd $src
# Compiler
pushd opt/intel/oneapi/compiler/${version}
pushd linux
# Binaries
rsync -a bin/ $out/bin/
rsync -a bin/intel64/ $out/bin/
# Libraries
rsync -a lib/ $out/lib/
rsync -a compiler/lib/intel64_lin/ $out/lib/
# Headers
rsync -a compiler/include/ $out/include/
popd
# Manuals
rsync -a documentation/en/man/common/ $out/share/man/
# Fix lib_lin
ln -s $out/lib $out/lib_lin
popd
'';
inherit meta;
};
intel-compiler = stdenv.mkDerivation rec {
version = v.compiler;
pname = "intel-compiler";
src = joinDebs pname [
# C/C++
"intel-oneapi-dpcpp-cpp-${version}"
"intel-oneapi-compiler-dpcpp-cpp-${version}"
"intel-oneapi-compiler-dpcpp-cpp-common-${version}"
"intel-oneapi-compiler-dpcpp-cpp-runtime-${version}"
"intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-${version}"
"intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-common-${version}"
"intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-runtime-${version}"
"intel-oneapi-compiler-dpcpp-cpp-classic-fortran-shared-runtime-${version}"
];
dontCheckForBrokenSymlinks = true;
# From https://aur.archlinux.org/packages/intel-oneapi-compiler:
# - intel-oneapi-compiler-cpp-eclipse-cfg-2023.0.0-25370_all.deb
# + intel-oneapi-compiler-dpcpp-cpp-2023.0.0-2023.0.0-25370_amd64.deb
# x intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-2023.0.0-2023.0.0-25370_amd64.deb (empty)
# + intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-2023.0.0-25370_amd64.deb
# + intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-common-2023.0.0-2023.0.0-25370_all.deb
# + intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic-runtime-2023.0.0-2023.0.0-25370_amd64.deb
# + intel-oneapi-compiler-dpcpp-cpp-classic-fortran-shared-runtime-2023.0.0-2023.0.0-25370_amd64.deb
# + intel-oneapi-compiler-dpcpp-cpp-common-2023.0.0-2023.0.0-25370_all.deb
# + intel-oneapi-compiler-dpcpp-cpp-runtime-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-compiler-dpcpp-eclipse-cfg-2023.0.0-25370_all.deb
# - intel-oneapi-compiler-fortran-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-compiler-fortran-common-2023.0.0-2023.0.0-25370_all.deb
# - intel-oneapi-compiler-fortran-runtime-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-compiler-fortran-runtime-2023.0.0-25370_amd64.deb
# - intel-oneapi-compiler-shared-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-compiler-shared-common-2023.0.0-2023.0.0-25370_all.deb
# - intel-oneapi-compiler-shared-runtime-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-dpcpp-cpp-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-openmp-2023.0.0-2023.0.0-25370_amd64.deb
# - intel-oneapi-openmp-common-2023.0.0-2023.0.0-25370_all.deb
buildInputs = [
intel-compiler-shared
libffi_3_3
libelf
libxml2
hwloc
stdenv.cc.cc.lib
];
nativeBuildInputs = [
autoPatchelfHook
rsync
];
autoPatchelfIgnoreMissingDeps = [ "libtbb.so.12" "libtbbmalloc.so.2" "libze_loader.so.1" ];
phases = [ "installPhase" "fixupPhase" ];
dontStrip = true;
installPhase = ''
mkdir -p $out/{bin,lib}
mkdir -p $out/share/man
cd $src
# Compiler
pushd opt/intel/oneapi/compiler/${version}
pushd linux
# Binaries
rsync -a bin/ $out/bin/
rsync -a bin-llvm/ $out/bin/
rsync -a bin/intel64/ $out/bin/
# Libraries
rsync -a --exclude oclfpga lib/ $out/lib/
rsync -a compiler/lib/intel64_lin/ $out/lib/
# Headers
rsync -a compiler/include/ $out/include/ # Intrinsics for icc
rsync -a include/ $out/include/
chmod +w $out/include
ln -s $out/lib/clang/16.0.0/include/ $out/include/icx # For icx
popd
# Manuals
rsync -a documentation/en/man/common/ $out/share/man/
popd
'';
inherit meta;
};
wrapIntel = { cc, mygcc, extraBuild ? "", extraInstall ? "" }:
let
targetConfig = stdenv.targetPlatform.config;
in (wrapCCWith {
cc = cc;
extraBuildCommands = ''
echo "-isystem ${cc}/include" >> $out/nix-support/cc-cflags
echo "-isystem ${cc}/include/intel64" >> $out/nix-support/cc-cflags
echo "-L${mygcc.cc}/lib/gcc/${targetConfig}/${mygcc.version}" >> $out/nix-support/cc-ldflags
echo "-L${mygcc.cc.lib}/lib" >> $out/nix-support/cc-ldflags
echo "-L${intel-compiler-shared}/lib" >> $out/nix-support/cc-ldflags
echo "-L${cc}/lib" >> $out/nix-support/cc-ldflags
# Need the gcc in the path
# FIXME: We should find a better way to modify the PATH instead of using
# this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
echo 'path_backup="${mygcc}/bin:$path_backup"' >> $out/nix-support/cc-wrapper-hook
# Disable hardening by default
echo "" > $out/nix-support/add-hardening.sh
'' + extraBuild;
}).overrideAttrs (old: {
installPhase = old.installPhase + extraInstall;
});
icx-wrapper = wrapIntel rec {
cc = intel-compiler;
mygcc = gcc;
extraBuild = ''
wrap icx $wrapper $ccPath/icx
wrap icpx $wrapper $ccPath/icpx
echo "-isystem ${cc}/include/icx" >> $out/nix-support/cc-cflags
echo "--gcc-toolchain=${mygcc.cc}" >> $out/nix-support/cc-cflags
'';
extraInstall = ''
export named_cc="icx"
export named_cxx="icpx"
'';
};
# Legacy
icc-wrapper = wrapIntel rec {
cc = intel-compiler;
# Intel icc classic compiler tries to behave like the gcc found in $PATH.
# EVEN if it doesn't support some of the features. See:
# https://community.intel.com/t5/Intel-C-Compiler/builtin-shuffle-GCC-compatibility-and-has-builtin/td-p/1143619
mygcc = gcc;
extraBuild = ''
wrap icc $wrapper $ccPath/icc
wrap icpc $wrapper $ccPath/icpc
echo "-isystem ${cc}/include/icc" >> $out/nix-support/cc-cflags
'';
extraInstall = ''
export named_cc="icc"
export named_cxx="icpc"
'';
};
ifort-wrapper = wrapIntel {
cc = intel-compiler-fortran;
mygcc = gcc;
extraBuild = ''
wrap ifort $wrapper $ccPath/ifort
'';
extraInstall = ''
export named_fc="ifort"
'';
};
stdenv-icc = stdenv.override {
cc = icc-wrapper;
allowedRequisites = null;
};
stdenv-icx = stdenv.override {
cc = icx-wrapper;
allowedRequisites = null;
};
stdenv-ifort = stdenv.override {
cc = ifort-wrapper;
allowedRequisites = null;
};
in
{
inherit intel-mpi;
icx = icx-wrapper;
icc = icc-wrapper;
ifort = ifort-wrapper;
stdenv = stdenv-icx;
stdenv-icc = stdenv-icc;
stdenv-ifort = stdenv-ifort;
}

File diff suppressed because one or more lines are too long

View File

@@ -1,297 +0,0 @@
{
lib,
stdenv,
callPackage,
dpkg,
fetchurl,
sqlite,
elfutils,
}:
let
inherit (builtins)
attrNames
attrValues
concatMap
elem
filter
fromJSON
getAttr
groupBy
head
isNull
listToAttrs
map
mapAttrs
readFile
replaceStrings
splitVersion
;
inherit (lib)
converge
findFirst
groupBy'
hasPrefix
optional
pipe
take
toInt
toList
versionAtLeast
versionOlder
;
aptData = fromJSON (readFile ./packages.json);
# Compare versions in debian control file syntax
# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#syntax-of-relationship-fields
#
# NOTE: this is not a proper version comparison
#
# A proper version solver, should aggregate dependencies with the same name
# and compute the constraint (e.g. a (>= 2) a (<< 5) -> 2 <= a << 5)
#
# But in the intel repo, there are no such "duplicated" dependencies to specify
# upper limits, which leads to issues when intel-hpckit-2021 depends on things
# like intel-basekit >= 2021.1.0-2403 and we end up installing the newest
# basekit instead of the one from 2021.
#
# To mitigate this, >= is set to take the latest version with matching major
# and minor (only revision and patch are allowed to change)
compareVersions =
got: kind: want:
let
g0 = take 2 (splitVersion got);
w0 = take 2 (splitVersion want);
in
if isNull want then
true
else if kind == "=" then
got == want
else if kind == "<<" then
versionOlder got want
else if kind == "<=" then
versionAtLeast want got
else if kind == ">>" then
versionOlder want got
else if kind == ">=" then
(g0 == w0) && versionAtLeast got want # always match major version
else
throw "unknown operation: ${kind}";
findMatching =
{
pname,
kind,
version,
}:
findFirst (x: pname == x.pname && compareVersions x.version kind version) null aptData;
isIntel = pkg: (hasPrefix "intel-" pkg.pname);
expandDeps =
pkg: (map findMatching (filter isIntel pkg.dependencies)) ++ (optional (pkg.size != 0) pkg);
# get the oldest by major version. If they have the same major version, take
# the newest. This prevents most issues with resolutions
# versionOlder b a -> true if b is older than a (b `older` a)
getNewerInMajor =
a: b:
let
va = a.version;
vb = b.version;
va0 = head (splitVersion va);
vb0 = head (splitVersion vb);
in
if isNull a then
b
else if va0 != vb0 then
if va0 > vb0 then b else a
else if versionOlder vb va then
a
else
b;
removeDups = l: attrValues (groupBy' getNewerInMajor null (getAttr "provides") l);
_resolveDeps = converge (l: removeDups (concatMap expandDeps l));
resolveDeps =
pkg:
let
deps = _resolveDeps (toList pkg);
namedDeps = (map (x: "${x.pname}-${x.version}") deps);
in
builtins.traceVerbose (builtins.deepSeq namedDeps namedDeps) deps;
blacklist = [
"intel-basekit-env"
"intel-basekit-getting-started"
"intel-hpckit-env"
"intel-hpckit-getting-started"
"intel-oneapi-advisor"
"intel-oneapi-common-licensing"
"intel-oneapi-common-oneapi-vars"
"intel-oneapi-common-vars"
"intel-oneapi-compiler-cpp-eclipse-cfg"
"intel-oneapi-compiler-dpcpp-eclipse-cfg"
"intel-oneapi-condaindex"
"intel-oneapi-dev-utilities-eclipse-cfg"
"intel-oneapi-dpcpp-ct-eclipse-cfg"
"intel-oneapi-eclipse-ide"
"intel-oneapi-hpc-toolkit-getting-started"
"intel-oneapi-icc-eclipse-plugin-cpp"
"intel-oneapi-vtune"
"intel-oneapi-vtune-eclipse-plugin-vtune"
];
isInBlacklist = pkg: elem pkg.provides blacklist;
removeBlacklist = filter (e: !(isInBlacklist e));
dpkgExtractAll =
pname: version:
{ srcs, deps }:
stdenv.mkDerivation {
inherit pname version srcs;
nativeBuildInputs = [ dpkg ];
phases = [ "installPhase" ];
passthru = { inherit deps; };
installPhase = ''
mkdir -p $out
for src in $srcs; do
echo "Unpacking $src"
dpkg -x $src $out
done
'';
};
apthost = "https://apt.repos.intel.com/oneapi/";
fetchDeb =
p:
fetchurl {
url = apthost + p.filename;
inherit (p) sha256;
};
buildIntel =
pkg:
pipe pkg [
resolveDeps
removeBlacklist
(l: {
srcs = map fetchDeb l;
deps = l;
})
(dpkgExtractAll "${pkg.provides}-extracted" pkg.version)
];
findHpcKit =
year:
findMatching {
pname = "intel-hpckit";
kind = "<<";
version = toString (year + 1);
};
years = map toInt (attrNames components);
patchIntel = callPackage ./patch_intel.nix { };
# Version information for each hpckit. This is used to normalize the paths
# so that files are in $out/{bin,lib,include...} instead of all over the place
# in $out/opt/intel/oneapi/*/*/{...}.
#
# The most important is the compiler component, which is used to build the
# stdenv for the hpckit.
#
# NOTE: this have to be manually specified, so we can avoid IFD. To add a
# new version, add a new field with an empty attrset, (e.g. "2026" = {}; ),
# build hpckit_2026.unpatched and use the values from
# result/opt/intel/oneapi/* to populate the attrset.
#
# WARN: if there are more than one version in the folders of the unpatched
# components, our dependency resolution hacks have probably failed and the
# package set may be broken.
components = {
"2025" = {
ishmem = "1.4";
pti = "0.13";
tcm = "1.4";
umf = "0.11";
ccl = "2021.16";
compiler = "2025.2";
dal = "2025.8";
debugger = "2025.2";
dev-utilities = "2025.2";
dnnl = "2025.2";
dpcpp-ct = "2025.2";
dpl = "2022.9";
ipp = "2022.2";
ippcp = "2025.2";
mkl = "2025.2";
mpi = "2021.16";
tbb = "2022.2";
};
"2024" = {
tcm = "1.1";
ccl = "2021.13";
compiler = "2024.2";
dal = "2024.6";
debugger = "2024.2";
dev-utilities = "2024.2";
diagnostics = "2024.2";
dnnl = "2024.2";
dpcpp-ct = "2024.2";
dpl = "2022.6";
ipp = "2021.12";
ippcp = "2021.12";
mkl = "2024.2";
mpi = "2021.13";
tbb = "2021.13";
extraPackages = [
sqlite
elfutils
];
};
};
replaceDots = replaceStrings [ "." ] [ "_" ];
in
lib.recurseIntoAttrs (
listToAttrs (
map (
year:
let
year_str = toString year;
in
{
name = "hpckit_${year_str}";
value = patchIntel {
unpatched = buildIntel (findHpcKit year);
components = components.${year_str};
};
}
) years
)
)
// {
apt = pipe aptData [
(groupBy (p: replaceDots p.provides))
(mapAttrs (
_: l:
listToAttrs (
map (pkg: {
name = replaceDots ("v" + pkg.version);
value = pkg;
}) l
)
))
];
inherit resolveDeps patchIntel buildIntel;
}

View File

@@ -1,189 +0,0 @@
{
stdenv,
stdenvNoCC,
lib,
symlinkJoin,
autoPatchelfHook,
wrapCCWith,
overrideCC,
gcc,
hwloc,
libelf,
libffi_3_3,
libpsm2,
libuuid,
libxml2,
numactl,
ocl-icd,
openssl,
python3,
rdma-core,
ucx,
zlib,
}:
lib.makeOverridable (
{
unpatched,
components ? { },
extraPackages ? components.extraPackages or [ ],
}:
let
inherit (builtins)
attrValues
filter
mapAttrs
removeAttrs
;
__components = removeAttrs components [ "extraPackages" ];
_components = __components;
# _components = lib.traceSeqN 2 {
# inherit unpatched __components;
# deps = builtins.map (x: "${x.pname}-${x.version}") unpatched.deps;
# } __components;
wrapIntel =
cc:
let
targetConfig = stdenv.targetPlatform.config;
in
(wrapCCWith {
inherit cc;
nixSupport = {
cc-ldflags = [
"-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
"-L${gcc.cc.lib}/lib"
"-L${cc}/lib"
];
cc-cflags = [
"--gcc-toolchain=${gcc.cc}"
"-isystem \"${cc.original}/lib/clang/*/include\""
"-isystem ${cc}/include"
"-isystem ${cc}/include/intel64"
"-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
];
libcxx-cxxflags = [
# "--gcc-toolchain=${gcc.cc}"
"-isystem ${gcc.cc}/include/c++/${gcc.version}"
"-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
];
};
extraBuildCommands = ''
# FIXME: We should find a better way to modify the PATH instead of using
# this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
echo 'path_backup="${gcc.cc}/bin:$path_backup"' >>$out/nix-support/cc-wrapper-hook
# Disable hardening by default
echo "" > $out/nix-support/add-hardening.sh
wrap icx $wrapper $ccPath/icx
wrap icpx $wrapper $ccPath/icpx
wrap ifx $wrapper $ccPath/ifx
ln -s $out/bin/icpx $out/bin/c++
ln -s $out/bin/icx $out/bin/cc
sed -i 's/.*isCxx=0/isCxx=1/' $out/bin/icpx
# Use this to detect when a compiler subprocess is called
# from icpx (--fsycl-host-compiler)
echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
# oneMath looks for sycl libraries in bin/../lib
ln -s ${cc}/lib $out/lib
ln -s ${cc}/include $out/include
'';
}).overrideAttrs
(old: {
installPhase = old.installPhase + ''
export named_cc="icx"
export named_cxx="icpx"
export named_fc="ifx"
'';
});
in
stdenvNoCC.mkDerivation (finalAttrs: {
pname = lib.removeSuffix "-extracted" unpatched.pname;
inherit (unpatched) version;
src = unpatched;
phases = [
"installPhase"
"fixupPhase"
];
buildInputs = [
libffi_3_3
libelf
libxml2
hwloc
numactl
libuuid
libpsm2
zlib
ocl-icd
rdma-core
ucx
openssl
python3
stdenv.cc.cc.lib
]
++ extraPackages;
autoPatchelfIgnoreMissingDeps = [
"libhwloc.so.5"
"libcuda.so.1"
"libze_loader.so.1"
];
# There are broken symlinks that go outside packages, ignore them
dontCheckForBrokenSymlinks = true;
nativeBuildInputs = [ autoPatchelfHook ];
installPhase = ''
cp -r $src/opt/intel/oneapi/ $out
'';
passthru =
let
pkgs = mapAttrs (
folder: version:
let
original = "${finalAttrs.finalPackage}/${folder}/${version}";
in
symlinkJoin {
pname = "intel-${folder}";
inherit version;
paths = [ original ];
passthru = { inherit original; };
}
) _components;
in
pkgs
// {
inherit unpatched;
pkgs = lib.recurseIntoAttrs pkgs;
components = _components;
# This contains all packages properly symlinked into toplevel directories
# in $out.
#
# NOTE: there are clashes with packages that have symlinks outside their
# scope (libtcm and env/vars.sh)
all = symlinkJoin {
pname = finalAttrs.finalPackage.pname + "-symlinked";
inherit (finalAttrs.finalPackage) version;
paths = filter lib.isDerivation (attrValues finalAttrs.finalPackage.pkgs);
};
stdenv = overrideCC stdenv finalAttrs.finalPackage.cc;
cc = wrapIntel finalAttrs.finalPackage.pkgs.compiler;
};
})
)

View File

@@ -1,29 +0,0 @@
#!/usr/bin/env -S jq -f
def extract_fields: {
pname : .Package,
version : .Version,
provides : .Package | sub("[0-9.-]*$"; ""),
filename : .Filename,
size : ."Installed-Size" | tonumber,
sha256 : .SHA256,
dependencies : .Depends,
} ;
# parses dependencies into a list of [{.pname, .kind, .version}]
# some dependencies do not have a version specified, in which case, kind = version = null
#
# example dependencies:
# intel-oneapi-common-vars (>= 2023.0.0-25325), intel-oneapi-common-licensing-2023.0.0
def split_dependencies : map(try(.dependencies |= split(",\\s?"; "")) // .dependencies |= []) ;
def match_version : capture("(?<pname>[a-zA-Z0-9_\\-.]*) *(\\((?<kind>[<>=]*) *(?<version>.*)\\))?"; "") ;
def parse_dependencies : map_values(.dependencies.[] |= match_version) ;
def sort_version_decreasing : sort_by(.version | split("[-.]"; "") | map(tonumber)) | reverse ;
map(extract_fields) | split_dependencies | parse_dependencies | sort_version_decreasing
# [.[] | select(.pname == "intel-hpckit") | .version]

View File

@@ -1,29 +0,0 @@
#!/usr/bin/env -S awk -f
BEGIN {
FS=": "
prev_empty=1
t=" "
print "[ {"
}
!NF { # empty line, update separator so next non empty line closes the dict
prev_empty=1
t="},\n{ "
next # skip line (we won't match anything else)
}
{
printf t "\"%s\" : \"%s\"\n", $1, $2
if (prev_empty) {
# we were the first after a group of empty lines, following ones have to
# have a comma
prev_empty=0
t=", "
}
}
END { print "} ]" }

View File

@@ -1,11 +0,0 @@
#!/bin/sh
out_64=$(mktemp intel-api.64.XXXXXX)
out_all=$(mktemp intel-api.all.XXXXXX)
trap 'rm -f "$out_64" "$out_all"' EXIT INT HUP
curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o "$out_64"
curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o "$out_all"
# NOTE: we use `jq -r tostring` to minify the json (3.2Mb -> 2.3Mb)
cat "$out_64" "$out_all" | ./toJson.awk | ./process.jq | jq -r tostring >packages.json

View File

@@ -1,44 +0,0 @@
{ stdenv, lib, fetchFromGitHub, numactl, pkg-config }:
let
version = "11.2.185";
in
stdenv.mkDerivation {
pname = "libpsm2";
inherit version;
preConfigure= ''
export UDEVDIR=$out/etc/udev
substituteInPlace ./Makefile --replace "udevrulesdir}" "prefix}/etc/udev";
'';
enableParallelBuilding = true;
buildInputs = [ numactl pkg-config ];
installFlags = [
"DESTDIR=$(out)"
"UDEVDIR=/etc/udev"
"LIBPSM2_COMPAT_CONF_DIR=/etc"
];
src = fetchFromGitHub {
owner = "intel";
repo = "opa-psm2";
rev = "PSM2_${version}";
sha256 = "062hg4r6gz7pla9df70nqs5i2a3mp1wszmp4l0g771fykhhrxsjg";
};
postInstall = ''
mv $out/usr/* $out
rmdir $out/usr
'';
meta = with lib; {
homepage = "https://github.com/intel/opa-psm2";
description = "The PSM2 library supports a number of fabric media and stacks";
license = with licenses; [ gpl2 bsd3 ];
platforms = [ "x86_64-linux" ];
maintainers = [ maintainers.bzizou ];
};
}

View File

@@ -1,137 +0,0 @@
{
llvmPackages_latest
, lib
, fetchFromGitHub
, cmake
, bash
, python3
, perl
, which
, elfutils
, libffi
, zlib
, pkg-config
, gcc # needed to set the rpath of libstdc++ for clang-tblgen
, enableDebug ? false
, useGit ? false
, gitUrl ? "ssh://git@bscpm04.bsc.es/llvm-ompss/llvm-mono.git"
, gitBranch ? "master"
, gitCommit ? "872ba63f86edaefc9787984ef3fae9f2f94e0124" # github-release-2025.11
}:
let
stdenv = llvmPackages_latest.stdenv;
release = rec {
version = "2025.11";
src = fetchFromGitHub {
owner = "bsc-pm";
repo = "llvm";
rev = "refs/tags/github-release-${version}";
hash = "sha256-UgwMTUkM9Z87dDH205swZFBeFhrcbLAxginViG40pBM=";
};
};
git = rec {
version = src.shortRev;
src = builtins.fetchGit {
url = gitUrl;
ref = gitBranch;
rev = gitCommit;
};
};
source = if (useGit) then git else release;
in stdenv.mkDerivation {
pname = "clang-ompss2";
inherit (source) src version;
enableParallelBuilding = true;
passthru = {
CC = "clang";
CXX = "clang++";
isClang = true;
isClangWithOmpss = true;
inherit gcc zlib;
};
nativeBuildInputs = [
bash
cmake
elfutils
llvmPackages_latest.lld
pkg-config
python3
perl
which
zlib
];
buildInputs = [
libffi
zlib
gcc.cc.lib # Required for libstdc++.so.6
];
# Error with -D_FORTIFY_SOURCE=2, see https://bugs.gentoo.org/636604:
# /build/source/compiler-rt/lib/tsan/dd/dd_interceptors.cpp:225:20:
# error: redefinition of 'realpath'
# Requires disabling the "fortify" set of flags, however, for performance we
# disable all:
hardeningDisable = [ "all" ];
cmakeBuildType = if enableDebug then "Debug" else "Release";
dontStrip = enableDebug;
dontUseCmakeBuildDir = true;
# Fix the host triple, as it has changed in a newer config.guess:
# https://git.savannah.gnu.org/gitweb/?p=config.git;a=commitdiff;h=ca9bfb8cc75a2be1819d89c664a867785c96c9ba
preConfigure = ''
mkdir -p build
cd build
cmakeDir="../llvm"
cmakeFlagsArray=(
"-DLLVM_HOST_TRIPLE=${stdenv.targetPlatform.config}"
"-DLLVM_TARGETS_TO_BUILD=host"
"-DLLVM_BUILD_LLVM_DYLIB=ON"
"-DLLVM_LINK_LLVM_DYLIB=ON"
# Required to run clang-ast-dump and clang-tblgen during build
"-DCMAKE_BUILD_RPATH=$PWD/lib:${zlib}/lib:${gcc.cc.lib}/lib"
"-DLLVM_ENABLE_LLD=ON"
"-DCMAKE_CXX_FLAGS_DEBUG=-g -ggnu-pubnames"
"-DCMAKE_EXE_LINKER_FLAGS_DEBUG=-Wl,--gdb-index"
"-DLLVM_LIT_ARGS=-sv --xunit-xml-output=xunit.xml"
"-DLLVM_ENABLE_PROJECTS=clang;compiler-rt;lld"
"-DLLVM_ENABLE_ASSERTIONS=ON"
"-DLLVM_INSTALL_TOOLCHAIN_ONLY=ON"
"-DCMAKE_INSTALL_BINDIR=bin"
"-DLLVM_ENABLE_ZLIB=FORCE_ON"
"-DLLVM_ENABLE_LIBXML2=OFF"
# Set the rpath to include external libraries (zlib) both on build and
# install
"-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=ON"
"-DCMAKE_INSTALL_RPATH=${zlib}/lib:${gcc.cc.lib}/lib"
"-DLLVM_APPEND_VC_REV=ON"
"-DLLVM_FORCE_VC_REVISION=${source.version}"
)
'';
# About "-DCLANG_DEFAULT_NANOS6_HOME=${nanos6}", we could specify a default
# nanos6 installation, but this is would require a recompilation of clang each
# time nanos6 is changed. Better to use the environment variable NANOS6_HOME,
# and specify nanos6 at run time.
meta = {
homepage = "https://gitlab.pm.bsc.es/llvm-ompss/llvm-mono";
description = "C language family frontend for LLVM (for OmpSs-2)";
maintainers = with lib.maintainers.bsc; [ rpenacob ];
platforms = lib.platforms.linux;
license = [ lib.licenses.asl20 lib.licenses.llvm-exception ];
};
}

View File

@@ -1,104 +0,0 @@
{
stdenv
, lib
, gcc
, clangOmpss2Unwrapped
, writeShellScript
, openmp ? null
, wrapCCWith
, llvmPackages_latest
, ompss2rt ? null
}:
with lib;
let
usingNodesAndOmpv = (openmp.pname == "openmp-v" && ompss2rt.pname == "nodes");
sameNosv = openmp.nosv == ompss2rt.nosv;
in
assert assertMsg (usingNodesAndOmpv -> sameNosv) "OpenMP-V and NODES must share the same nOS-V";
let
homevar = if ompss2rt.pname == "nanos6" then "NANOS6_HOME" else "NODES_HOME";
rtname = if ompss2rt.pname == "nanos6" then "libnanos6" else "libnodes";
ompname = if openmp.pname == "openmp-v" then "libompv" else "libomp";
# We need to replace the lld linker from bintools with our linker just built,
# otherwise we run into incompatibility issues when mixing compiler and linker
# versions.
bintools-unwrapped = llvmPackages_latest.bintools-unwrapped.override {
lld = clangOmpss2Unwrapped;
};
bintools = llvmPackages_latest.bintools.override {
bintools = bintools-unwrapped;
};
targetConfig = stdenv.targetPlatform.config;
inherit gcc;
cc = clangOmpss2Unwrapped;
gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
extraBuildCommands = ''
echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
echo "-L${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-ldflags
echo "-L${gcc.cc.lib}/lib" >> $out/nix-support/cc-ldflags
for dir in ${gcc.cc}/include/c++/*; do
echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
done
for dir in ${gcc.cc}/include/c++/*/${targetConfig}; do
echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
done
echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags
wrap clang++ $wrapper $ccPath/clang++
'';
envExports = lib.optionalString (openmp != null) ''
echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
'' + optionalString (ompss2rt != null) ''
echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
echo "export ${homevar}=${ompss2rt}" >> $out/nix-support/cc-wrapper-hook
'' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
'';
extraPackages = optional (openmp != null) openmp;
wrappedCC = wrapCCWith {
# extraPackages adds packages to depsTargetTargetPropagated
inherit cc bintools extraPackages;
extraBuildCommands = extraBuildCommands + envExports;
};
resetIntelCCFlags = let tconf = builtins.replaceStrings ["-"] ["_"] targetConfig;
in writeShellScript "remove-intel.sh" ''
if [ "''${NIX_CC_WRAPPER_INTEL:-0}" = 1 ]; then
unset NIX_CFLAGS_COMPILE_${tconf}
unset NIX_CC_WRAPPER_FLAGS_SET_${tconf}
if (( "''${NIX_DEBUG:-0}" >= 1 )); then
echo "ompss2: cleaned NIX_CFLAGS_COMPILE_${tconf} (invokation from intel compiler detected)"
fi
fi
'';
intelExtraBuildCommands = ''
sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang
sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang++
'';
wrappedCCIntel = wrapCCWith {
inherit cc bintools extraPackages;
# extraPackages adds packages to depsTargetTargetPropagated
extraBuildCommands = intelExtraBuildCommands + envExports;
};
in wrappedCC.overrideAttrs (oldAttrs: {
passthru = oldAttrs.passthru // {
forIcpx = wrappedCCIntel;
};
})

View File

@@ -1,86 +0,0 @@
{ lib
, llvmPackages_latest
, monorepoSrc
, runCommand
, cmake
, ninja
, llvm
, perl
, pkg-config
, version
, nosv
, ovni
, python3
, enableNosv ? false
, enableDebug ? false
, enableOvni ? false
}:
assert enableOvni -> enableNosv;
let
stdenv = llvmPackages_latest.stdenv;
in
stdenv.mkDerivation rec {
pname = "openmp" + (lib.optionalString enableNosv "-v");
inherit version;
src = runCommand "${pname}-src" {} ''
mkdir -p "$out"
cp -r ${monorepoSrc}/cmake "$out"
cp -r ${monorepoSrc}/openmp "$out"
'';
sourceRoot = "${src.name}/openmp";
nativeBuildInputs = [
cmake
ninja
perl
pkg-config
python3
] ++ lib.optionals enableNosv [
nosv
] ++ lib.optionals enableOvni [
ovni
];
doCheck = false;
hardeningDisable = [ "all" ];
cmakeBuildType = if enableDebug then "Debug" else "Release";
dontStrip = enableDebug;
separateDebugInfo = true;
cmakeFlags = [
"-DLIBOMP_OMPD_SUPPORT=OFF"
"-DOPENMP_ENABLE_LIBOMPTARGET=OFF"
];
# Remove support for GNU and Intel Openmp.
# Also, remove libomp if building with nosv, as there is no support to build
# only one runtime at a time.
postInstall = ''
rm -f $out/lib/libgomp*
rm -f $out/lib/libiomp*
'' + lib.optionalString enableNosv ''
rm -f $out/lib/libomp.*
rm -f $out/libllvmrt/libomp.*
'';
passthru = {
inherit nosv;
};
meta = {
homepage = "https://gitlab.pm.bsc.es/llvm-ompss/llvm-mono";
description = "Support for the OpenMP language (with nOS-V)";
maintainers = with lib.maintainers.bsc; [ rpenacob ];
platforms = lib.platforms.linux;
license = [ lib.licenses.asl20 lib.licenses.llvm-exception ];
};
}

View File

@@ -1,50 +0,0 @@
{
lib,
stdenv,
libtirpc,
fetchFromGitHub
}:
stdenv.mkDerivation rec {
pname = "lmbench";
version = "941a0dcc";
# We use the intel repo as they have fixed some problems
src = fetchFromGitHub {
owner = "intel";
repo = pname;
rev = "941a0dcc0e7bdd9bb0dee05d7f620e77da8c43af";
sha256 = "sha256-SzwplRBO3V0R3m3p15n71ivYBMGoLsajFK2TapYxdqk=";
};
postPatch = ''
sed -i "s@/bin/rm@rm@g" $(find . -name Makefile)
'';
buildInputs = [ libtirpc ];
patches = [ ./fix-install.patch ./gcc-14.patch ];
hardeningDisable = [ "all" ];
enableParallelBuilding = false;
preBuild = ''
makeFlagsArray+=(
-C src
BASE=$out
CFLAGS=-Wno-implicit-int
CPPFLAGS=-I${libtirpc.dev}/include/tirpc
LDFLAGS=-ltirpc
CC=$CC
AR=$AR
)
'';
meta = {
description = "lmbench";
homepage = "https://github.com/intel/lmbench";
maintainers = with lib.maintainers.bsc; [ rarias ];
platforms = lib.platforms.all;
license = lib.licenses.gpl2Plus;
};
}

View File

@@ -1,10 +0,0 @@
--- a/src/Makefile
+++ b/src/Makefile
@@ -144,6 +144,7 @@ install-target:
if [ ! -d $(BASE)/include ]; then mkdir $(BASE)/include; fi
if [ ! -d $(BASE)/lib ]; then mkdir $(BASE)/lib; fi
cp $(EXES) $(BASE)/bin
+ cp $(OPT_EXES) $(BASE)/bin
cp $(INCS) $(BASE)/include
cp $O/lmbench.a $(BASE)/lib/libmbench.a
cd ../doc; env MAKEFLAGS="$(MAKEFLAGS)" make CC="${CC}" OS="${OS}" BASE="$(BASE)" install

View File

@@ -1,77 +0,0 @@
From a3c6e7d303cd8368e8d4e35be7cbc1997e801257 Mon Sep 17 00:00:00 2001
From: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
Date: Mon, 21 Jul 2025 17:38:58 +0200
Subject: [PATCH] Misc fixes to build with gcc 14
---
src/bench.h | 2 ++
src/lat_select.c | 2 +-
src/lib_debug.c | 1 +
src/lib_sched.c | 2 +-
src/lib_timing.c | 2 +-
5 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/src/bench.h b/src/bench.h
index 8166408..4da9079 100644
--- a/src/bench.h
+++ b/src/bench.h
@@ -320,4 +320,6 @@ extern int handle_scheduler(int childno, int benchproc, int nbenchprocs);
extern char *rpc_xact_1();
extern char *client_rpc_xact_1();
+void lmbench_usage(int argc, char *argv[], char* usage);
+
#endif /* _BENCH_H */
diff --git a/src/lat_select.c b/src/lat_select.c
index 583b505..39df369 100644
--- a/src/lat_select.c
+++ b/src/lat_select.c
@@ -164,7 +164,7 @@ doit(iter_t iterations, void * cookie)
state_t * state = (state_t *)cookie;
fd_set nosave;
static struct timeval tv;
- static count = 0;
+ static int count = 0;
tv.tv_sec = 0;
tv.tv_usec = 0;
diff --git a/src/lib_debug.c b/src/lib_debug.c
index e8347dd..cf65312 100644
--- a/src/lib_debug.c
+++ b/src/lib_debug.c
@@ -1,5 +1,6 @@
#include "bench.h"
#include "lib_debug.h"
+#include <math.h>
/*
* return micro-seconds / iteration at the the fraction point.
diff --git a/src/lib_sched.c b/src/lib_sched.c
index aa83ae0..4f16bbf 100644
--- a/src/lib_sched.c
+++ b/src/lib_sched.c
@@ -91,7 +91,7 @@ handle_scheduler(int childno, int benchproc, int nbenchprocs)
childno * (nbenchprocs + 1) + benchproc);
} else {
/* default action: do nothing */
- return;
+ return 0;
}
return sched_pin(cpu % sched_ncpus());
diff --git a/src/lib_timing.c b/src/lib_timing.c
index af8cf68..7ec9652 100644
--- a/src/lib_timing.c
+++ b/src/lib_timing.c
@@ -1623,7 +1623,7 @@ bread(void* buf, long nbytes)
void
touch(char *buf, int nbytes)
{
- static psize;
+ static int psize;
if (!psize) {
psize = getpagesize();
--
2.49.0

View File

@@ -1,7 +0,0 @@
builtins.mapAttrs (name: value: { email = name + "@bsc.es"; } // value) {
abonerib.name = "Aleix Boné";
arocanon.name = "Aleix Roca";
rarias.name = "Rodrigo Arias";
rpenacob.name = "Raúl Peñacoba";
varcila.name = "Vincent Arcila";
}

View File

@@ -1,75 +0,0 @@
{
stdenv
, lib
, fetchFromGitHub
, autoreconfHook
, nanos6
, gperf
, python3
, gfortran
, pkg-config
, sqlite
, flex
, bison
, gcc
}:
stdenv.mkDerivation rec {
pname = "mcxx";
version = "2023.11";
passthru = {
CC = "mcc";
CXX = "mcxx";
};
# mcxx doesn't use tags, so we pick the same version of the ompss2 release
src = fetchFromGitHub {
owner = "bsc-pm";
repo = pname;
rev = "github-release-${version}";
hash = "sha256-GyBvyy/HD3t9rHSXAYZRMhn4o4Nm/HFfjuOS8J0LPu8=";
};
enableParallelBuilding = true;
nativeBuildInputs = [
autoreconfHook
bison
flex
python3
gfortran
pkg-config
gperf
gcc
];
buildInputs = [
nanos6
sqlite.dev
];
patches = [ ./intel.patch ];
preConfigure = ''
export ICC=icc
export ICPC=icpc
export IFORT=ifort
'';
configureFlags = [
"--enable-ompss-2"
"--with-nanos6=${nanos6}"
# Fails with "memory exhausted" with bison 3.7.1
# "--enable-bison-regeneration"
];
meta = {
broken = true;
homepage = "https://github.com/bsc-pm/mcxx";
description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
maintainers = with lib.maintainers.bsc; [ rpenacob ];
platforms = lib.platforms.linux;
license = lib.licenses.gpl3Plus;
};
}

View File

@@ -1,69 +0,0 @@
{
stdenv
, lib
, fetchFromGitHub
, autoreconfHook
, nanos6
, gperf
, python
, gfortran
, pkg-config
, sqlite
, flex
, bison
, gcc
}:
stdenv.mkDerivation rec {
pname = "mcxx";
version = src.shortRev;
passthru = {
CC = "mcc";
CXX = "mcxx";
};
src = builtins.fetchGit {
url = "ssh://git@bscpm04.bsc.es/mercurium/mcxx";
ref = "master";
};
enableParallelBuilding = true;
buildInputs = [
autoreconfHook
nanos6
gperf
python
gfortran
pkg-config
sqlite.dev
bison
flex
gcc
];
# TODO: Not sure if we need this patch anymore (?)
#patches = [ ./intel.patch ];
preConfigure = ''
export ICC=icc
export ICPC=icpc
export IFORT=ifort
'';
configureFlags = [
"--enable-ompss-2"
"--with-nanos6=${nanos6}"
# Fails with "memory exhausted" with bison 3.7.1
# "--enable-bison-regeneration"
];
meta = {
homepage = "https://github.com/bsc-pm/mcxx";
description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
maintainers = with lib.maintainers.bsc; [ rpenacob ];
platforms = lib.platforms.linux;
license = lib.licenses.gpl3Plus;
};
}

Some files were not shown because too many files have changed in this diff Show More