├── .buildkite
    └── pipeline.yml
├── .gac.defaults
├── .gitattributes
├── .gitignore
├── README.md
├── benchmarks
    ├── Benchmarks.md
    ├── bm-ci.sh
    ├── bm-staging.sh
    ├── bm-stress.sh
    ├── default.nix
    ├── globals.nix
    ├── policy_core.yaml
    ├── policy_relay.yaml
    ├── policy_relay_relaxed.yaml
    ├── scripts
    │   ├── check_fork.sh
    │   ├── collect-data.nix
    │   ├── create-plots.nix
    │   ├── destroy-cluster.nix
    │   ├── parse.hs
    │   ├── plots.r
    │   ├── record-stats.sh
    │   ├── run-bench.nix
    │   ├── set-cluster.nix
    │   ├── set-rev.nix
    │   ├── set-wallets-cluster.nix
    │   └── xblocks.sh
    └── shell.nix
├── bors.toml
├── cardano-node-src.json
├── cardano-sl-src.json
├── clusters
    ├── goguen-ala-cardano
    │   ├── defaults-shared-resources.nix
    │   ├── goguen-ala-cardano-target-aws.nix
    │   └── goguen-ala-cardano.nix
    └── mempty
    │   └── default.nix
├── config.nix
├── configs
    ├── default.nix
    └── goguen-ala-cardano.nix
├── default.nix
├── deployments
    ├── bors-ng.nix
    ├── cardano-explorer-env-development.nix
    ├── cardano-explorer-env-devops.nix
    ├── cardano-explorer-env-production.nix
    ├── cardano-explorer-env-staging.nix
    ├── cardano-explorer-env-testnet.nix
    ├── cardano-explorer.nix
    ├── cardano-faucet-env-development.nix
    ├── cardano-faucet-env-devops.nix
    ├── cardano-faucet-env-testnet.nix
    ├── cardano-faucet.nix
    ├── cardano-nodes-env-development.nix
    ├── cardano-nodes-env-devops.nix
    ├── cardano-nodes-env-production.nix
    ├── cardano-nodes-env-staging.nix
    ├── cardano-nodes-env-testnet.nix
    ├── cardano-nodes.nix
    ├── configurator.nix
    ├── deployer.nix
    ├── deployer
    │   ├── deployer-dev-access.nix
    │   └── deployer.nix
    ├── edgenodesv2.nix
    ├── env-development.nix
    ├── global.nix
    ├── hydra-master-wireguard.nix
    ├── hydra
    │   ├── hydra-aws.nix
    │   └── hydra.nix
    ├── infrastructure-env-production.nix
    ├── infrastructure-env-staging.nix
    ├── infrastructure-target-aws.nix
    ├── infrastructure.nix
    ├── keypairs.nix
    ├── mac-base.nix
    ├── mac-metadata.nix
    ├── mainnet-noauto-restart.nix
    ├── mantis-deployer.nix
    ├── mantis-slave-packet-1
    │   ├── ah1jc8c0jlrirwxhs82rmvylj8m914xi-hardware.nix
    │   ├── host-id.nix
    │   ├── l73iy1yk17sgw2dsibmxjwxnr049xjmy-installed.nix
    │   ├── metadata.nix
    │   └── nwfi2d1385xfg5f5x4csvr3rndf6060l-standard.nix
    ├── mantis-slave-packet-2
    │   ├── ah1jc8c0jlrirwxhs82rmvylj8m914xi-hardware.nix
    │   ├── host-id.nix
    │   ├── l73iy1yk17sgw2dsibmxjwxnr049xjmy-installed.nix
    │   ├── metadata.nix
    │   └── nwfi2d1385xfg5f5x4csvr3rndf6060l-standard.nix
    ├── mantis
    │   ├── goguen-ala-cardano-target-aws.nix
    │   └── goguen-ala-cardano.nix
    ├── monitoring-aws.nix
    ├── monitoring-env-development.nix
    ├── monitoring-env-devops.nix
    ├── monitoring-env-production.nix
    ├── monitoring-env-staging.nix
    ├── monitoring-env-testnet.nix
    ├── monitoring.nix
    ├── packet-net.nix
    ├── security-groups.nix
    ├── security-groups
    │   ├── allow-all.nix
    │   ├── allow-deployer-ssh.nix
    │   ├── allow-explorer-python-monitoring.nix
    │   ├── allow-monitoring-collection.nix
    │   └── allow-public-www-https.nix
    ├── testnet-deployer-aws.nix
    ├── testnet-deployer.nix
    └── ugly-fix.nix
├── docs
    ├── Daedalus-Installer-Update-Procedure.md
    ├── Developer-clusters-HOWTO.md
    ├── Goguen-clusters-HOWTO.org
    ├── bors.md
    ├── deployments.graphml
    ├── deployments.pdf
    ├── github-webhook-util.md
    └── iohk-ops-reference.md
├── fetch-nixpkgs.nix
├── gac-mkdeployer.sh
├── gac-new.sh
├── gac.sh
├── globals.nix
├── goguen
    ├── build-sbt-lib.nix
    ├── default.nix
    ├── docker-image.nix
    ├── explorer.nix
    ├── explorer
    │   └── yarn.nix
    ├── iele-deps.patch
    ├── iele-semantics.nix
    ├── iele-tests.patch
    ├── jdk-override
    │   ├── jdk-linux-base.nix
    │   ├── jdk8cpu-linux.nix
    │   └── readme.md
    ├── jobsets
    │   ├── default.nix
    │   ├── pr-excluded-labels.nix
    │   ├── simple-pr-dummy.json
    │   └── spec.json
    ├── kevm.nix
    ├── kevm.patch
    ├── mantis.nix
    ├── pins
    │   ├── blockchain-k-plugin-src.json
    │   ├── ethereum-explorer-src.json
    │   ├── evm-semantics-src.json
    │   ├── fetch-nixpkgs.nix
    │   ├── iele-semantics-src.json
    │   ├── iohk-nix-src.json
    │   ├── k-src.json
    │   ├── mantis-cardano-src.json
    │   ├── mantis-extvm-pb-src.json
    │   ├── nixpkgs-src.json
    │   ├── pandoc-tangle-src.json
    │   ├── remix-ide-src.json
    │   ├── sbt-verify-src.json
    │   ├── secp256k1-src.json
    │   ├── solc-bin-src.json
    │   ├── solidity-service-src.json
    │   ├── solidity-src.json
    │   └── tests-src.json
    ├── release.nix
    ├── remix-ide.nix
    ├── remix-ide.patch
    ├── sbt-verify.nix
    ├── secp256k1.nix
    ├── solidity-service.nix
    ├── solidity.nix
    ├── solidity.patch
    ├── stack.patch
    ├── trimmed-solc-bin.nix
    ├── update-nixpkgs-pin.sh
    └── update-pin.sh
├── iohk-nix.json
├── iohk
    ├── Setup.hs
    ├── amazonka-content-length.patch
    ├── common
    │   ├── Appveyor.hs
    │   ├── Arch.hs
    │   ├── Buildkite
    │   │   ├── API.hs
    │   │   └── Pipeline.hs
    │   ├── Cardano.hs
    │   ├── CommandLineUtils.hs
    │   ├── Constants.hs
    │   ├── Github.hs
    │   ├── InstallerVersions.hs
    │   ├── Nix.hs
    │   ├── NixOps.hs
    │   ├── RunCardano.hs
    │   ├── Topology.hs
    │   ├── Types.hs
    │   ├── UpdateLogic.hs
    │   ├── UpdateProposal.hs
    │   └── Utils.hs
    ├── default.nix
    ├── iohk-ops.cabal
    ├── iohk-ops.hs
    ├── shell.nix
    ├── test
    │   ├── AppveyorSpec.hs
    │   ├── BuildkiteSpec.hs
    │   ├── IntegrationTest.hs
    │   ├── Spec.hs
    │   ├── UpdateLogicSpec.hs
    │   └── UpdateProposalSpec.hs
    └── update.sh
├── jobsets
    ├── cardano.nix
    ├── default.nix
    ├── pr-excluded-labels.nix
    ├── simple-pr-dummy.json
    └── spec.json
├── lib.nix
├── lib
    ├── gpg-keys
    │   ├── alan.mcnicholas.base64
    │   ├── ben.ford.base64
    │   ├── deployer.base64
    │   └── rodney.lorrimar.base64
    ├── ssh-keys.nix
    └── users
    │   └── deployer-users.nix
├── mainnet-infra.yaml
├── mainnet.yaml
├── modules
    ├── amazon-base.nix
    ├── amazon-image.nix
    ├── amis.nix
    ├── auto-gc.nix
    ├── bors-ng-service.nix
    ├── buildkite-agent-container.nix
    ├── buildkite-agent.nix
    ├── cachecache.nix
    ├── cardano-base.nix
    ├── cardano-benchmark.nix
    ├── cardano-development.nix
    ├── cardano-devops.nix
    ├── cardano-explorer-python.nix
    ├── cardano-explorer.nix
    ├── cardano-faucet-module.nix
    ├── cardano-faucet.nix
    ├── cardano-production.nix
    ├── cardano-service.nix
    ├── cardano-staging.nix
    ├── cardano-testnet.nix
    ├── cardano.nix
    ├── common.nix
    ├── configurator.nix
    ├── dd-process-monitor.nix
    ├── deployer-aws.nix
    ├── deployer-base.nix
    ├── deployer-bootstrap.nix
    ├── deployer.nix
    ├── development.nix
    ├── devops.nix
    ├── docker-builder.nix
    ├── exchange-monitor.nix
    ├── exchange-monitor
    │   ├── default.nix
    │   ├── exchange-monitor.py
    │   └── shell.nix
    ├── explorer-remix-solidity-services.nix
    ├── extra-statsd.nix
    ├── gen-grafana-creds.nix
    ├── gen-graylog-creds.nix
    ├── gen-wireguard-keys.nix
    ├── globals.nix
    ├── grafana
    │   ├── cardano
    │   │   ├── cardano-application-dashboard.json
    │   │   └── cardano-failures.dashboard.json
    │   └── generic
    │   │   └── node-system-dashboard.json
    ├── graylog
    │   ├── graylogConfig.json
    │   └── graylogPreload.sh
    ├── hydra-aws.nix
    ├── hydra-base.nix
    ├── hydra-master-common.nix
    ├── hydra-master-main.nix
    ├── hydra-master-mantis.nix
    ├── hydra-push-docker.nix
    ├── hydra-slave.nix
    ├── iohk-logo.png
    ├── log-classifier-service.nix
    ├── log-classifier.nix
    ├── mac-host-common.nix
    ├── macs
    │   ├── clover-image.nix
    │   ├── config.plist.template
    │   ├── dist
    │   │   ├── OVMF_CODE.fd
    │   │   └── OVMF_VARS-1024x768.fd
    │   ├── guest
    │   │   ├── apply.sh
    │   │   └── darwin-configuration.nix
    │   └── host
    │   │   ├── default.nix
    │   │   ├── installer-image
    │   │       ├── justdoit.nix
    │   │       ├── mac-mini-nixos-installer.nix
    │   │       └── target-config.nix
    │   │   ├── macmini-boot-fixes.nix
    │   │   ├── monitorama.nix
    │   │   ├── networking.nix
    │   │   └── qemu.nix
    ├── mantis-faucet-service.nix
    ├── mantis-service.nix
    ├── mantis-service.pseudo.nix
    ├── monitoring-exporters.nix
    ├── monitoring-rules-cardano.nix
    ├── monitoring-services.nix
    ├── network-wide.nix
    ├── nginx
    │   ├── cardano-large.svg
    │   ├── cardano-small.svg
    │   └── monitoring-index-template.html
    ├── nix_nsswitch.nix
    ├── parameters-ops.nix
    ├── parameters.nix
    ├── production.nix
    ├── staging.nix
    ├── test-hydra-locally.nix
    ├── test-monitoring-locally.nix
    └── testnet.nix
├── network.nix
├── nix-darwin
    ├── NukeNix.hs
    ├── PrepareDarwin.hs
    ├── README.md
    ├── RewriteLibs.hs
    ├── default.nix
    ├── deploy-darwin.hs
    ├── everything.hs
    ├── lib
    │   ├── build.nix
    │   ├── nix-darwin.json
    │   └── nixpkgs.json
    ├── modules
    │   ├── basics.nix
    │   ├── buildkite-agent.nix
    │   ├── caffeinate.nix
    │   ├── double-builder-gc.nix
    │   └── hydra-slave.nix
    ├── patch-prepare.hs
    ├── roles
    │   ├── buildkite-agent.nix
    │   ├── ci.nix
    │   ├── hydra-slave.nix
    │   └── signing.nix
    ├── services
    │   ├── builder-gc.nix
    │   └── caffeinate.nix
    └── test.nix
├── nix
    ├── sources.json
    └── sources.nix
├── nixpkgs-src.json
├── overlays
    └── monitoring-exporters.nix
├── pkgs
    ├── hydra-fork.nix
    └── hydra.nix
├── production-infra.yaml
├── relay-batch-3.yaml
├── relay-batch-4.yaml
├── relay-batch-5.yaml
├── relay-batch-6.yaml
├── scripts
    ├── blocks.sh
    ├── check-hydra.sh
    ├── ci.sh
    ├── collect_csv.py
    ├── create-amis.sh
    ├── enroll-packetnet-machine.sh
    ├── enumerate-nixops-instances.sh
    ├── find-all-revisions.sh
    ├── rotate-keys.sh
    ├── shellcheck.nix
    ├── stack.yaml
    └── test-builder-performance.sh
├── shell.nix
├── staging-infra.yaml
├── staging-testnet.yaml
├── static
    ├── id_buildfarm.pub
    ├── txgen-logging-warnonly.yaml
    └── txgen-logging.yaml
├── terraform
    ├── README.md
    ├── appveyor-deploy-s3
    │   ├── README.md
    │   ├── bucket-index.html
    │   └── main.tf
    ├── appveyor-s3-cache
    │   ├── README.md
    │   └── main.tf
    ├── cardano-deployer
    │   ├── README.md
    │   ├── aws.tf
    │   ├── configuration.nix
    │   ├── main.tf
    │   ├── outputs.tf
    │   └── variables.tf
    ├── cardano-public-testnet
    │   ├── README.md
    │   ├── global
    │   │   ├── aws.tf
    │   │   ├── groups.tf
    │   │   ├── main.tf
    │   │   ├── modules
    │   │   │   ├── installer_bucket
    │   │   │   │   ├── bucket-index.html
    │   │   │   │   ├── main.tf
    │   │   │   │   ├── output.tf
    │   │   │   │   └── variables.tf
    │   │   │   └── user
    │   │   │   │   ├── main.tf
    │   │   │   │   ├── outputs.tf
    │   │   │   │   └── variables.tf
    │   │   ├── policies.tf
    │   │   ├── roles.tf
    │   │   ├── s3.tf
    │   │   ├── templates
    │   │   │   ├── assume_role_policy.json
    │   │   │   └── s3_bucket_policy.json
    │   │   ├── users.tf
    │   │   └── variables.tf
    │   ├── install_aws_credentials.sh
    │   ├── main.tf
    │   ├── regional
    │   │   └── main.tf
    │   └── variables.tf
    ├── devops-839-hermes
    │   ├── README.md
    │   ├── aws.tf
    │   ├── configuration.nix
    │   ├── main.tf
    │   ├── outside.tf
    │   └── variables.tf
    ├── mfa.nix
    ├── modules
    │   ├── ci-cache-s3
    │   │   ├── main.tf
    │   │   ├── output.tf
    │   │   └── variables.tf
    │   ├── ci-deploy-s3
    │   │   ├── main.tf
    │   │   ├── output.tf
    │   │   └── variables.tf
    │   └── s3-full-access-policy
    │   │   └── main.tf
    ├── shell.nix
    └── terraform.nix
├── testnet.yaml
├── tests
    ├── cardano-node-simple-config.nix
    ├── default.nix
    ├── simple-node-nixops.nix
    └── simple-node.nix
├── topology-benchmark.yaml
├── topology-bulk3.yaml
├── topology-bulk4.yaml
├── topology-bulk5.yaml
├── topology-bulk6.yaml
├── topology-development.yaml
├── topology-devops.yaml
├── topology-edgenode.yaml
├── topology-min.yaml
├── topology-production.yaml
├── topology-staging.yaml
├── topology-testnet.yaml
└── windows
    └── iohk-setup.ps1


/.buildkite/pipeline.yml:
--------------------------------------------------------------------------------
 1 | steps:
 2 |   - label: 'iohk-ops'
 3 |     command: 'scripts/ci.sh -b false'
 4 |     agents:
 5 |       - "system=x86_64-linux"
 6 |     agents:
 7 |       system: x86_64-linux
 8 | 
 9 |   - label: 'jobsets'
10 |     command: 'nix-build jobsets'
11 |     agents:
12 |       - "system=x86_64-linux"
13 |     agents:
14 |       system: x86_64-linux
15 | 


--------------------------------------------------------------------------------
/.gac.defaults:
--------------------------------------------------------------------------------
1 | CLUSTER_KIND=mantis
2 | CLUSTER_TYPE=mantis
3 | OPS_REPO='git@github.com:input-output-hk/iohk-ops'
4 | DEFAULT_OPS_BRANCH='master'


--------------------------------------------------------------------------------
/.gitattributes:
--------------------------------------------------------------------------------
1 | # since this file is autogenerated, lets ignore diffs
2 | pkgs/default.nix -diff
3 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | *~
 2 | *#
 3 | .#*
 4 | *.swp
 5 | *prof
 6 | keys/*.key
 7 | /test-*.yaml
 8 | config.yaml
 9 | .config.sh
10 | 
11 | .stack-work
12 | /cardano-sl/
13 | /cardano-sl-tools/
14 | ec2-image/
15 | experiments/
16 | image/
17 | /iohk/dist
18 | /keys
19 | logs/
20 | logs-analyze/
21 | /nixops
22 | /update-proposals/
23 | 
24 | /static
25 | github_token
26 | 
27 | image
28 | result*
29 | scripts/iohk-nixpkgs
30 | smart-gen.log
31 | smart-gen-*
32 | pkgs/stack2nix
33 | /topology.nix
34 | txgen.log
35 | txgen.json
36 | 
37 | .terraform
38 | **/terraform.tfvars
39 | nixpkgs
40 | genesis-keys
41 | 


--------------------------------------------------------------------------------
/benchmarks/bm-ci.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -e        # exit on error
 4 | set -o xtrace # print commands
 5 | 
 6 | export TZ=UTC
 7 | export TEMPDIR=/tmp/
 8 | export TMPDIR=/tmp/
 9 | export TEMP=/tmp/
10 | export TMP=/tmp/
11 | 
12 | "$(nix-build ./scripts/run-bench.nix\
13 |     --argstr coreNodes     7       \
14 |     --argstr startWaitTime 10      \
15 |     --argstr txsPerThread  4000    \
16 |     --argstr conc          1       \
17 |     --argstr delay         500     \
18 |     --argstr cooldown      10      \
19 |     --argstr addGenerators 1       \
20 |     --argstr edgeNodes     0       \
21 |     --arg walletsDeployment \"\"   \
22 |     )"/bin/run-bench.sh
23 | 
24 | #    --arg    walletsDeployment \"edgenodes-cluster\" \
25 | 


--------------------------------------------------------------------------------
/benchmarks/bm-staging.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -e        # exit on error
 4 | set -o xtrace # print commands
 5 | 
 6 | export TZ=UTC
 7 | export TEMPDIR=/tmp/
 8 | export TMPDIR=/tmp/
 9 | export TEMP=/tmp/
10 | export TMP=/tmp/
11 | 
12 | "$(nix-build ./scripts/run-bench.nix \
13 |     --argstr coreNodes     7        \
14 |     --argstr startWaitTime 10       \
15 |     --argstr txsPerThread  25000    \
16 |     --argstr conc          1        \
17 |     --argstr delay         500      \
18 |     --argstr cooldown      10       \
19 |     --argstr addGenerators 1        \
20 |     --argstr edgeNodes     0        \
21 |     --arg walletsDeployment  \"\"   \
22 |     )"/bin/run-bench.sh
23 | 
24 | 


--------------------------------------------------------------------------------
/benchmarks/bm-stress.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -e        # exit on error
 4 | set -o xtrace # print commands
 5 | 
 6 | export TZ=UTC
 7 | export TEMPDIR=/tmp/
 8 | export TMPDIR=/tmp/
 9 | export TEMP=/tmp/
10 | export TMP=/tmp/
11 | 
12 | "$(nix-build ./scripts/run-bench.nix \
13 |     --argstr coreNodes     7        \
14 |     --argstr startWaitTime 10       \
15 |     --argstr txsPerThread  6000     \
16 |     --argstr conc          2        \
17 |     --argstr delay         250      \
18 |     --argstr cooldown      10       \
19 |     --argstr addGenerators 6        \
20 |     --argstr edgeNodes     10       \
21 |     --argstr walletsDeployment edgenodes-cluster \
22 |     )"/bin/run-bench.sh
23 | 


--------------------------------------------------------------------------------
/benchmarks/default.nix:
--------------------------------------------------------------------------------
1 | import (../default.nix)
2 | 


--------------------------------------------------------------------------------
/benchmarks/globals.nix:
--------------------------------------------------------------------------------
1 | import (../globals.nix)
2 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/check_fork.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | ## needs 'gnused' from Nix on MacOSX
 4 | 
 5 | if [ $# -lt 1 ]; then
 6 |   echo "$0 <report-???.txt>"
 7 |   exit 1
 8 | fi
 9 | 
10 | BASEDIR="$(dirname "$0")"
11 | REPFILE=$1
12 | BLIDs=
13 | NODES="c-a-1 c-a-2 c-a-3 c-b-1 c-b-2 c-c-1 c-c-2"
14 | 
15 | BLIDs=$(awk '/transactions in fork:/{start=1;next} start; !NF && start{start=0}' "$REPFILE"  \
16 |    | cut -d " " -f 2 | sort | uniq | sed -ne '2,$p' | paste -s -d " " -)
17 | 
18 | 
19 | echo -n "        "
20 | for BLID in ${BLIDs}; do
21 |   echo -n "   ${BLID}  "
22 | done
23 | echo
24 | for NODE in ${NODES}; do
25 |   echo -n "$NODE"
26 |   FN="${NODE}.log"
27 |   "${BASEDIR}"/xblocks.sh "$FN" > "${FN}".blocks
28 |   for BLID in ${BLIDs}; do
29 |     #CNT=`fgrep "previous block: ${BLID}" $FN | wc -l`
30 |     CNT=$("${BASEDIR}"/parse.hs "${BLID}" < "${FN}".blocks | tail -1 | cut -d " " -f 1)
31 |     echo -n  "          ${CNT}"
32 |   done
33 |   echo
34 | done
35 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/create-plots.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   last # run for which plots will be created
 3 | }:
 4 | 
 5 | with import <nixpkgs> {};
 6 | writeScriptBin "create-plots.sh" ''
 7 |   #! /usr/bin/env nix-shell
 8 |   #! nix-shell -i bash -p rWrapper R rPackages.dplyr rPackages.ggplot2 rPackages.gplots rPackages.anytime rPackages.gridExtra
 9 | 
10 |   set -e        # exit on error
11 |   set -o xtrace # print commands
12 | 
13 |   src=../../scripts/plots.r
14 | 
15 |   cd ./experiments/${last}
16 |   mkdir -p plots
17 | 
18 |   Rscript $src ${last}
19 | 
20 |   mv *.png ./plots/
21 |   mv *.pdf ./plots/
22 |   rm bench-settings2
23 | ''
24 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/destroy-cluster.nix:
--------------------------------------------------------------------------------
 1 | with import <nixpkgs> {};
 2 | writeScriptBin "destroy-cluster.sh" ''
 3 |   #!/usr/bin/env bash
 4 | 
 5 |   set -e        # exit on error
 6 |   set -o xtrace # print commands
 7 | 
 8 |   IO=$(nix-build -A iohk-ops)/bin/iohk-ops
 9 | 
10 |   $IO destroy --confirm delete
11 | ''
12 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/record-stats.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | if [ $# -ne 2 ]; then
 4 |         echo " $0  arguments: -exec <executable> | -pid <pid>"
 5 |         exit 1
 6 | fi
 7 | 
 8 | export TZ=UTC
 9 | 
10 | echo " starting: "
11 | echo " $0 $1 $2 ($#)"
12 | date
13 | uname -a
14 | 
15 | WATCHPID=
16 | if [ "$1" = "-exec" ]; then
17 |   # overwrite: it is the service that we are searching
18 |   WATCHPROC=cardano-node
19 |   WATCHPID=$(systemctl show ${WATCHPROC} -p MainPID --value)
20 | fi
21 | 
22 | if [ "$1" = "-pid" ]; then
23 |   WATCHPID=$2
24 |   WATCHPROC=cardano-node
25 | fi
26 | 
27 | if [ -z "${WATCHPID}" ]; then
28 |         echo " No service ${WATCHPROC} found."
29 |         exit 1
30 | fi
31 | 
32 | echo "  watching service ${WATCHPROC} with PID ${WATCHPID}"
33 | echo
34 | 
35 | PAGESIZE=$(getconf PAGESIZE)
36 | CLKTCK=$(getconf CLK_TCK)
37 | echo "PAGESIZE=${PAGESIZE} CLKTCK=${CLKTCK}"
38 | echo
39 | 
40 | SLEEPTIME=5
41 | RECNAME1=statm
42 | RECNAME2=stat
43 | RECNAME3=io
44 | PROC=/proc/$WATCHPID
45 | 
46 | while [ -e "${PROC}/${RECNAME1}" ]; do
47 |         NOW=$(date +%s)
48 |         { printf "%s %s " "${NOW}" "${RECNAME1}" && cat "${PROC}/${RECNAME1}"; }
49 |         { printf "%s %s " "${NOW}" "${RECNAME2}" && cat "${PROC}/${RECNAME2}"; }
50 |         { printf "%s %s " "${NOW}" "${RECNAME3}" && < "${PROC}/${RECNAME3}" cut -d " " -f 2 | tr '\n' ' ' && echo; }
51 |         sleep $SLEEPTIME
52 | done
53 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/set-cluster.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   clusterName ? "benchmarksCluster" # commit of cardano-sl
 3 | }:
 4 | 
 5 | with import <nixpkgs> {};
 6 | writeScriptBin "set-cluster.sh" ''
 7 |   #!/usr/bin/env bash
 8 | 
 9 |   set -e        # exit on error
10 |   set -o xtrace # print commands
11 | 
12 |   CLUSTERNAME=${clusterName}
13 | 
14 |   IO=$(nix-build -A iohk-ops)/bin/iohk-ops
15 | 
16 |   $IO -C .. -v new -e benchmark $CLUSTERNAME nodes
17 | 
18 |   $IO -C .. deploy -t 10
19 | ''
20 | 
21 | #$IO -C .. -v new -t topology-staging.yaml -k bench $CLUSTERNAME nodes
22 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/set-rev.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   commit  # commit of cardano-sl
 3 | }:
 4 | 
 5 | with import <nixpkgs> {};
 6 | writeScriptBin "set-rev.sh" ''
 7 |   #!/usr/bin/env bash
 8 | 
 9 |   set -e        # exit on error
10 |   set -o xtrace # print commands
11 | 
12 |   IO=$(nix-build -A iohk-ops)/bin/iohk-ops
13 | 
14 |   $IO -C .. set-rev cardanosl ${commit}
15 | ''
16 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/set-wallets-cluster.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   clusterName ? "edgenodes-cluster"
 3 | }:
 4 | 
 5 | with import <nixpkgs> {};
 6 | writeScriptBin "set-wallets-cluster.sh" ''
 7 |   #!/usr/bin/env bash
 8 | 
 9 |   set -e        # exit on error
10 |   set -o xtrace # print commands
11 | 
12 |   CLUSTERNAME=${clusterName}
13 | 
14 |   nixops create -d $CLUSTERNAME ../deployments/edgenodesv2.nix
15 |   nixops set-args -d $CLUSTERNAME --argstr accessKeyId cardano-deployer --arg topologyFile ../topology-edgenode.yaml --arg nodes 10
16 | 
17 |   nixops deploy -d $CLUSTERNAME
18 | 
19 | ''
20 | 


--------------------------------------------------------------------------------
/benchmarks/scripts/xblocks.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | ## needs 'gnused' from Nix on MacOSX
 4 | 
 5 | if [ $# -ne 1 ]; then
 6 |   echo "$0 <log file>"
 7 |   exit 1
 8 | fi
 9 | 
10 | # BASE BLOCK -> NEW BLOCK
11 | sed -ne '/^MainBlockHeader:/{
12 |           n
13 |           N
14 |           s/hash: \([0-9a-f]\+\).*previous block: \([0-9a-f]\+\)/("\2", "\1")/p
15 |          }'  "$1"
16 | 


--------------------------------------------------------------------------------
/benchmarks/shell.nix:
--------------------------------------------------------------------------------
 1 | { commonLib ? import ../lib.nix
 2 | , pkgs ? commonLib.pkgs
 3 | , io-dev-mode ? false
 4 | }:
 5 | 
 6 | let
 7 |   iohk-ops = (import ./default.nix {}).iohk-ops;
 8 |   ioAlias  = if io-dev-mode
 9 |              then ''runhaskell -iiohk ../iohk/iohk-ops.hs''
10 |              else ''${iohk-ops}/bin/iohk-ops'';
11 | in pkgs.lib.overrideDerivation iohk-ops.env
12 |    (old: {
13 |      shellHook = ''
14 |        function io {
15 |         ${ioAlias} "$@"
16 |        }
17 |      '';
18 |     })
19 | 


--------------------------------------------------------------------------------
/bors.toml:
--------------------------------------------------------------------------------
1 | status = [
2 |   "buildkite/iohk-ops",
3 |   "ci/hydra:Cardano:iohk-ops:required",
4 | ]
5 | timeout_sec = 7200
6 | required_approvals = 1
7 | block_labels = [ "WIP", "DO NOT MERGE" ]
8 | delete_merged_branches = true
9 | 


--------------------------------------------------------------------------------
/cardano-node-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/cardano-node",
3 |   "rev": "b9c17c39dcab94ae8a7e62d18616d1a4ad28ff22",
4 |   "sha256": "0ask9pcj8br8xj21587kfxkj546k3g0fip3g52x1n7hlpwxmwngz",
5 |   "fetchSubmodules": false
6 | }
7 | 


--------------------------------------------------------------------------------
/cardano-sl-src.json:
--------------------------------------------------------------------------------
1 | {
2 |     "url": "https://github.com/input-output-hk/cardano-sl",
3 |     "fetchSubmodules": "true",
4 |     "sha256": "0cqaxk3k8i5z4q4b5na0pcln9fblglmn7900vp1xdzmw75pp1rrz",
5 |     "rev": "51ad7c0503b1c52a75a6eb36096c407934136468"
6 | }


--------------------------------------------------------------------------------
/clusters/goguen-ala-cardano/defaults-shared-resources.nix:
--------------------------------------------------------------------------------
1 | ../../deployments/configurator.nix


--------------------------------------------------------------------------------
/clusters/goguen-ala-cardano/goguen-ala-cardano-target-aws.nix:
--------------------------------------------------------------------------------
1 | ../../deployments/mantis/goguen-ala-cardano-target-aws.nix


--------------------------------------------------------------------------------
/clusters/goguen-ala-cardano/goguen-ala-cardano.nix:
--------------------------------------------------------------------------------
1 | ../../deployments/mantis/goguen-ala-cardano.nix


--------------------------------------------------------------------------------
/clusters/mempty/default.nix:
--------------------------------------------------------------------------------
1 | {}
2 | 


--------------------------------------------------------------------------------
/config.nix:
--------------------------------------------------------------------------------
 1 | { deployerIP, accessKeyId, clusterName, tlsCert, tlsCertKey }:
 2 | with (import <nixpkgs/lib>);
 3 | 
 4 | filterAttrsRecursive (n: _: n != "_module") (evalModules {
 5 |   modules = [
 6 |     # Take defaults
 7 |     <module/parameters.nix>
 8 |     # Overlay config values
 9 |     <config>
10 |     # ... and route nixops network arguments to where they're expected. I guess some coupling is unavoidable (or is it? 🧐)
11 |     (_: {
12 |       node = { inherit accessKeyId; };
13 |       cluster = { inherit deployerIP tlsCert tlsCertKey; name = clusterName; };
14 |     })
15 |   ] ++ (optional (builtins.tryEval <local-module/parameters.nix>).success <local-module/parameters.nix>);
16 | }).config
17 | 


--------------------------------------------------------------------------------
/configs/default.nix:
--------------------------------------------------------------------------------
 1 | ## Do not change this file.
 2 | ##
 3 | ## Instead, commit its copy into repository and aim your deployment to it using
 4 | ## the 'configFile' network argument.  You can also drop the comment from the copy : -)
 5 | ##
 6 | ## NOTE: this file is meant to be available for both machine and resource definitions.
 7 | ##       Unfortunately, easy sharing of it across the deployment spec is currently impossible,
 8 | ##       so a complex approach is needed:
 9 | ##
10 | ##       1. ./deployment/config.nix MUST forward all values defined here that are intended
11 | ##          for per-machine consumption, by feeding that through an option appropriately
12 | ##          defined in ./modules/parameters.nix
13 | ##
14 | ##       2. ./deployment/config.nix MUST effectuate all values that are expected to have
15 | ##          influence on resources, that are deployment-independent.
16 | ##
17 | ##       3. For the (unfortunate) remainder of cases, where resource-based interpretation
18 | ##          depends on the deployment, the particular deployment must import this file:
19 | ##
20 | ##          import <config>
21 | {
22 |   node = {
23 |     ## Default values for organisation and region.
24 |     org                        = "IOHK";
25 |     region                     = "eu-central-1";
26 |   };
27 | 
28 |   cluster = {
29 |     ## Do not allocate EIPs by default.
30 |     allocateElasticIP          = false;
31 | 
32 |     ## Do not use oauth proxy by default as it requires a domain and additional setup.
33 |     oauthEnable                = false;
34 | 
35 |     ## Use spot instances priced up to $1 (100c)
36 |     spotInstancePrice = 100;
37 |   };
38 | }
39 | 


--------------------------------------------------------------------------------
/configs/goguen-ala-cardano.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   node = {
 3 |     org                  = "IOHK";
 4 |     region               = "eu-central-1";
 5 |   };
 6 | 
 7 |   cluster = {
 8 |     hostedZone           = "iohkdev.io";
 9 |     allocateElasticIP    = true;
10 |     oauthEnable          = true;
11 |   };
12 | }
13 | 


--------------------------------------------------------------------------------
/deployments/bors-ng.nix:
--------------------------------------------------------------------------------
 1 | { config, pkgs, ... }: {
 2 |   imports = [ ../modules/bors-ng-service.nix ];
 3 | 
 4 |   services.bors-ng = {
 5 |     enable = true;
 6 |     dockerImage = "borsng/bors-ng:latest";
 7 |     databaseURL = "postgresql://bors-ng:bors-ng@localhost:5432/bors_ng";
 8 |   };
 9 |   systemd.services.bors-ng = {
10 |     after = [ "postgresql.service" ];
11 |     requires = [ "postgresql.service" ];
12 |   };
13 | 
14 |   services.postgresql = {
15 |     enable = true;
16 |     enableTCPIP = true;
17 |     initialScript = pkgs.writeText "initial.sql" ''
18 |       CREATE USER "bors-ng" PASSWORD 'bors-ng' SUPERUSER;
19 |       CREATE DATABASE bors_ng OWNER "bors-ng";
20 |     '';
21 |     authentication = ''
22 |       # allow access to bors_ng database from docker container
23 |       # TYPE  DATABASE    USER        CIDR-ADDRESS          METHOD
24 |       host    bors_ng     bors-ng     127.0.0.1/8           md5
25 |       host    bors_ng     bors-ng     ::1/128               md5
26 |     '';
27 |   };
28 | 
29 |   services.nginx = {
30 |     enable = true;
31 |     commonHttpConfig = ''
32 |       log_format x-fwd '$remote_addr - $remote_user [$time_local] '
33 |                        '"$request" $status $body_bytes_sent '
34 |                        '"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
35 |       access_log syslog:server=unix:/dev/log x-fwd;
36 |     '';
37 |     recommendedGzipSettings = true;
38 |     recommendedOptimisation = true;
39 |     recommendedProxySettings = true;
40 |     recommendedTlsSettings = true;
41 |     virtualHosts = {
42 |       "bors-ng.aws.iohkdev.io" = {
43 |         forceSSL = true;
44 |         enableACME = true;
45 |         locations."/" = {
46 |           proxyPass = "http://localhost:${toString config.services.bors-ng.port}";
47 |         };
48 |       };
49 |     };
50 |   };
51 | 
52 |   networking.firewall.allowedTCPPorts = [ 80 443 ];
53 |   environment.systemPackages = with pkgs; [ goaccess ];
54 | }
55 | 


--------------------------------------------------------------------------------
/deployments/cardano-explorer-env-development.nix:
--------------------------------------------------------------------------------
1 | { globals, ... }:
2 | 
3 | with import ../lib.nix;
4 | 
5 | let
6 |   nodeMap = { inherit (globals.fullMap) explorer; };
7 | in
8 |   (flip mapAttrs nodeMap (name: value: ../modules/cardano-development.nix))
9 | 


--------------------------------------------------------------------------------
/deployments/cardano-explorer.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with import ../lib.nix;
 2 | let nodeMap = { inherit (globals.fullMap) explorer; }; in
 3 | 
 4 | {
 5 |   explorer = { config, ... }:
 6 |   {
 7 |     imports = [
 8 |       ../modules/cardano-explorer.nix
 9 |       ../modules/cardano-explorer-python.nix
10 |     ];
11 |     params = nodeMap.explorer;
12 |   };
13 | }
14 | 


--------------------------------------------------------------------------------
/deployments/cardano-faucet-env-development.nix:
--------------------------------------------------------------------------------
1 | { globals, ... }:
2 | 
3 | with import ../lib.nix;
4 | 
5 | let
6 |   nodeMap = { inherit (globals.fullMap) faucet; };
7 | in
8 |   (flip mapAttrs nodeMap (name: value: ../modules/cardano-development.nix))
9 | 


--------------------------------------------------------------------------------
/deployments/cardano-faucet-env-devops.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with (import ../lib.nix);
 2 | let nodeMap = { inherit (globals.fullMap) faucet; }; in
 3 | 
 4 | {
 5 |   faucet = (import ../modules/cardano-devops.nix) nodeMap.faucet;
 6 |   resources = {
 7 |     elasticIPs = nodesElasticIPs nodeMap;
 8 |   };
 9 | }
10 | 


--------------------------------------------------------------------------------
/deployments/cardano-faucet-env-testnet.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with (import ../lib.nix);
 2 | let nodeMap = { inherit (globals.fullMap) faucet; }; in
 3 | 
 4 | {
 5 |   faucet = (import ../modules/cardano-testnet.nix) nodeMap.faucet;
 6 |   monitoring = {
 7 |     services.monitoring-services = {
 8 |       applicationRules = [
 9 |         {
10 |           alert = "cardano_faucet_balance_monitor";
11 |           expr = "faucet_wallet_balance < 10000000000";
12 |           for = "1m";
13 |           labels.severity = "page";
14 |           annotations = {
15 |             description = "{{$labels.alias}} Testnet faucet wallet balance is low";
16 |           };
17 |         }
18 |       ];
19 |     };
20 |   };
21 |   resources = {
22 |     elasticIPs = nodesElasticIPs nodeMap;
23 |   };
24 | }
25 | 


--------------------------------------------------------------------------------
/deployments/cardano-faucet.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with (import ../lib.nix);
 2 | let nodeMap = { inherit (globals.fullMap) faucet; }; in
 3 | 
 4 | {
 5 |   faucet = {
 6 |     imports = [ ../modules/cardano-base.nix ../modules/cardano-faucet.nix ];
 7 |     params = nodeMap.faucet;
 8 |   };
 9 | }
10 | 


--------------------------------------------------------------------------------
/deployments/cardano-nodes-env-development.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | 
 5 | (flip mapAttrs globals.nodeMap (name: value: ../modules/cardano-development.nix))
 6 | // {
 7 |   network.description = "Cardano Development";
 8 |   require = [
 9 |     ./security-groups/allow-all.nix
10 |   ];
11 | 
12 | }
13 | 


--------------------------------------------------------------------------------
/deployments/cardano-nodes-env-devops.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with import ../lib.nix;
 2 | let nodeMap = globals.nodeMap; in
 3 | 
 4 | 
 5 | (flip mapAttrs nodeMap (name: import ../modules/cardano-devops.nix))
 6 | // {
 7 |   network.description = "Cardano Testnet";
 8 | 
 9 |   resources = {
10 |     elasticIPs = nodesElasticIPs nodeMap;
11 |   };
12 | }
13 | 


--------------------------------------------------------------------------------
/deployments/cardano-nodes-env-production.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with import ../lib.nix;
 2 | let nodeMap = globals.nodeMap; in
 3 | 
 4 | 
 5 | (flip mapAttrs nodeMap (name: import ../modules/cardano-production.nix))
 6 | // {
 7 |   network.description = "Mainnet";
 8 | 
 9 |   resources = {
10 |     elasticIPs = nodesElasticIPs nodeMap;
11 |   };
12 | }
13 | 


--------------------------------------------------------------------------------
/deployments/cardano-nodes-env-staging.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with (import ./../lib.nix);
 2 | let nodeMap = globals.nodeMap; in
 3 | 
 4 | 
 5 | (flip mapAttrs nodeMap (name: import ./../modules/cardano-staging.nix))
 6 | //
 7 | {
 8 |   network.description = "Cardano Staging";
 9 | 
10 |   resources = {
11 |     elasticIPs = nodesElasticIPs nodeMap;
12 |   };
13 | }
14 | 


--------------------------------------------------------------------------------
/deployments/cardano-nodes-env-testnet.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }: with import ../lib.nix;
 2 | let nodeMap = globals.nodeMap; in
 3 | 
 4 | 
 5 | (flip mapAttrs nodeMap (name: import ../modules/cardano-testnet.nix))
 6 | // {
 7 |   network.description = "Cardano Testnet";
 8 | 
 9 |   resources = {
10 |     elasticIPs = nodesElasticIPs nodeMap;
11 |   };
12 | }
13 | 


--------------------------------------------------------------------------------
/deployments/cardano-nodes.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | 
 5 | let
 6 |   nodeMap = globals.nodeMap;
 7 |   mkNode = name: value: {
 8 |     imports = [ ../modules/cardano.nix ];
 9 |     params = value;
10 |   };
11 | in
12 | (mapAttrs mkNode nodeMap) // {
13 |   require = [ ./mainnet-noauto-restart.nix ./global.nix ];
14 | }
15 | 


--------------------------------------------------------------------------------
/deployments/configurator.nix:
--------------------------------------------------------------------------------
 1 | { accessKeyId
 2 | , deployerIP
 3 | , config
 4 | , ...
 5 | }:
 6 | with (import <nixpkgs> {}).lib;
 7 | {
 8 |   ## Per-machine defaults:
 9 |   defaults = {
10 |     # For Nixops configs, the `config` object we constructed in `/config.nix` should be sufficient;
11 |     # for NixOS configs however, we need to make a distinction between defaults and and user-supplied parameters.
12 |     imports = [ <module/configurator.nix> ];
13 | 
14 |     # The configurator *module* basically just changes the precedence of everything in `optionDefaults` and `userConfig` and merges them
15 |     # together. The reason we have to send it off to a NixOS module is because we literally can't do it here in nixops. Trust, I tried. There be dragons and hydrae 🐉🐲.
16 |     configurator = {
17 |       # So yeah `config` already has both defaults and user-defined parameters but we can't tell which is which
18 |       optionDefaults = config;
19 |       # So we also pass the bare user config so that we can work the magic of set theory (I think?)
20 |       userConfig     = import <config>;
21 |     };
22 |   };
23 | 
24 |   ## Universal resource logic:
25 |   resources.ec2KeyPairs."cardano-keypair-${config.node.org}-${config.node.region}" = {
26 |     inherit accessKeyId; inherit (config.node) region;
27 |   };
28 | 
29 |   resources.ec2SecurityGroups = {
30 |     "allow-deployer-ssh-${config.node.region}-${config.node.org}" = {
31 |       _file = ./configurator.nix;
32 |       inherit accessKeyId; inherit (config.node) region;
33 |       description = "SSH";
34 |       rules = [{
35 |         protocol = "tcp"; # TCP
36 |         fromPort = 22; toPort = 22;
37 |         sourceIp = deployerIP + "/32";
38 |       }];
39 |     };
40 |   };
41 | }
42 | 


--------------------------------------------------------------------------------
/deployments/deployer.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   network.description = "Deployer";
 3 | 
 4 |   deployer.imports = [
 5 |     ../modules/common.nix
 6 |     ../modules/deployer-base.nix
 7 |     ../modules/deployer-aws.nix
 8 |   ];
 9 | }
10 | 


--------------------------------------------------------------------------------
/deployments/deployer/deployer-dev-access.nix:
--------------------------------------------------------------------------------
1 | with import ../../lib.nix;
2 | let users = import ../../lib/users/deployer-users.nix;
3 | in {
4 |   deployer.users.users.dev = users.dev;
5 | }
6 | 


--------------------------------------------------------------------------------
/deployments/deployer/deployer.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   users = import ../../lib/users/deployer-users.nix;
 3 | in {
 4 |   deployer = {
 5 |     imports = [
 6 |         <module/deployer-base.nix>
 7 |         <module/deployer-aws.nix>
 8 |     ];
 9 |     nix.trustedUsers = [ "root" users.deployer.name users.dev.name ];
10 |   };
11 | }
12 | 


--------------------------------------------------------------------------------
/deployments/edgenodesv2.nix:
--------------------------------------------------------------------------------
 1 | { accessKeyId, nodes ? 1 , walletsPerNode ? 1
 2 | , region ? "eu-central-1"
 3 | , topologyFile, systemStart
 4 | , configKey ? "bench" }:
 5 | 
 6 | with import ../lib.nix;
 7 | let
 8 |   mkNode = index: {
 9 |     name = "edgenode-${toString index}";
10 |     value = {
11 |       imports = [ ../modules/cardano-benchmark.nix ];
12 |       services.cardano-benchmark = {
13 |         inherit configKey index;
14 |       };
15 |     };
16 |   };
17 | in {
18 |   defaults = { resources, ... }: {
19 |     services.cardano-benchmark = {
20 |       inherit systemStart walletsPerNode;
21 |       topologyFile = "${topologyFile}";
22 |     };
23 |     deployment = {
24 |       targetEnv = "ec2";
25 |       ec2 = {
26 |         inherit region accessKeyId;
27 |         instanceType = mkDefault "t2.large";
28 |         keyPair = resources.ec2KeyPairs.edgekey;
29 |         ebsInitialRootDiskSize = 100;
30 |       };
31 |     };
32 |   };
33 |   resources.ec2KeyPairs.edgekey = {
34 |     inherit region accessKeyId;
35 |   };
36 | } // listToAttrs (map mkNode (range 1 nodes))
37 | 


--------------------------------------------------------------------------------
/deployments/env-development.nix:
--------------------------------------------------------------------------------
1 | {
2 |   defaults = {
3 |     imports = [ ../modules/development.nix ];
4 |   };
5 | }
6 | 


--------------------------------------------------------------------------------
/deployments/global.nix:
--------------------------------------------------------------------------------
 1 | { globals, domain, monitorIpOverride ? null, ... }:
 2 | 
 3 | {
 4 |   require = [
 5 |     # TODO, only import if config.global.omitDetailedSecurityGroups
 6 |     ./security-groups/allow-all.nix
 7 |     # TODO, make conditional on omitDetailedSecurityGroups
 8 |     ./security-groups/allow-monitoring-collection.nix
 9 |   ];
10 |   defaults = { config, lib, resources, ... }: {
11 |     _file = ./global.nix;
12 |     imports = [ ../modules/globals.nix ];
13 |     global = {
14 |       inherit (globals) environment systemStart topologyYaml nodeMap nRelays relays;
15 |     } // lib.optionalAttrs (domain != null) {
16 |       dnsDomainname = domain;
17 |     };
18 |     services.monitoring-exporters.graylogHost = lib.mkIf (monitorIpOverride != null) "${monitorIpOverride}:5044";
19 | 
20 |     deployment.ec2.securityGroups = if config.global.omitDetailedSecurityGroups
21 |       then [ resources.ec2SecurityGroups."allow-all-${config.deployment.ec2.region}-${config.global.organisation}" ]
22 |       else [];
23 |   };
24 | }
25 | 


--------------------------------------------------------------------------------
/deployments/hydra-master-wireguard.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   org = "IOHK";
 3 |   region = "eu-central-1";
 4 | in {
 5 |   hydra = { config, resources, ... }: {
 6 |     deployment = {
 7 |       ec2.securityGroups = [
 8 |         resources.ec2SecurityGroups."allow-wireguard-in-${region}-${org}"
 9 |       ];
10 |       keys."hydra.wgprivate" = {
11 |         destDir = "/etc/wireguard";
12 |         keyFile = ../static/hydra.wgprivate;
13 |       };
14 |     };
15 |     networking.firewall.allowedUDPPorts = [ 51820 ];
16 |     networking.wireguard.interfaces.wg0 = {
17 |       ips = [ "192.168.20.2/32" ];
18 |       listenPort = 51820;
19 |       privateKeyFile = "/etc/wireguard/hydra.wgprivate";
20 |       peers = [
21 |         { # sarov
22 |           publicKey = "mC3XblolhrDxerxXCvF1vyXdAY208/1bJhhtsulk5DU=";
23 |           allowedIPs = [ "192.168.20.20/32" ];
24 |           persistentKeepalive = 30;
25 |         }
26 |         { # mac-mini-1
27 |           publicKey = "nvKCarVUXdO0WtoDsEjTzU+bX0bwWYHJAM2Y3XhO0Ao=";
28 |           allowedIPs = [ "192.168.20.21/32" ];
29 |           persistentKeepalive = 30;
30 |         }
31 |         { # mac-mini-2
32 |           publicKey = "VcOEVp/0EG4luwL2bMmvGvlDNDbCzk7Vkazd3RRl51w=";
33 |           allowedIPs = [ "192.168.20.22/32" ];
34 |           persistentKeepalive = 30;
35 |         }
36 |         {
37 |           publicKey = "asG7R996ieVEhoeBHTK2DVNI664dfeBalL5dPqHIcXo=";
38 |           allowedIPs = [ "192.168.20.0/24" ];
39 |           endpoint = "monitoring.${config.global.dnsDomainname}:51820";
40 |           persistentKeepalive = 30;
41 |         }
42 |       ];
43 |     };
44 |   };
45 | }
46 | 


--------------------------------------------------------------------------------
/deployments/hydra/hydra-aws.nix:
--------------------------------------------------------------------------------
 1 | { config, accessKeyId, ... }:
 2 | with config;
 3 | with node;
 4 | with import <nixpkgs/lib>;
 5 | 
 6 | {
 7 |   hydra.imports = [ <module/hydra-aws.nix> ];
 8 | 
 9 |   resources = {
10 |     elasticIPs.hydra-ip = { inherit region accessKeyId; };
11 |     ec2SecurityGroups = {
12 |       "allow-hydra-${region}-${org}" = { resources, ...}: {
13 |         inherit region accessKeyId;
14 |         description = "Hydra Ingress";
15 |         rules = [
16 |           {
17 |             protocol = "tcp"; # TCP
18 |             fromPort = 80; toPort = 80;
19 |             sourceIp = "0.0.0.0/0";
20 |           }{
21 |             protocol = "tcp"; # TCP
22 |             fromPort = 443; toPort = 443;
23 |             sourceIp = "0.0.0.0/0";
24 |           }{
25 |             protocol = "tcp"; # TCP
26 |             fromPort = 22; toPort = 22;
27 |             sourceIp = resources.elasticIPs.hydra-ip;
28 |           }];
29 |       };
30 |     };
31 |   };
32 | }
33 | 


--------------------------------------------------------------------------------
/deployments/hydra/hydra.nix:
--------------------------------------------------------------------------------
1 | {
2 |   hydra.imports = [ <module/hydra-base.nix> ];
3 | }
4 | 


--------------------------------------------------------------------------------
/deployments/infrastructure.nix:
--------------------------------------------------------------------------------
 1 | { ... }:
 2 | 
 3 | with (import ../lib.nix);
 4 | let
 5 |   iohk-pkgs = import ../default.nix {};
 6 |   mkHydra = extraImport: { config, pkgs, ... }: {
 7 |     _file = ./infrastructure.nix;
 8 |     # On first setup:
 9 | 
10 |     # Locally: $ ssh-keygen -C "hydra@hydra.example.org" -N "" -f static/id_buildfarm
11 |     # On Hydra: $ /run/current-system/sw/bin/hydra-create-user alice --full-name 'Alice Q. User' --email-address 'alice@example.org' --password foobar --role admin
12 | 
13 |     imports = [
14 |       ../modules/common.nix
15 |       ../modules/hydra-slave.nix
16 |       ../modules/hydra-master-common.nix
17 |       extraImport
18 |     ];
19 |   };
20 |   mkHydraBuildSlave = { config, name, pkgs, ... }: {
21 |     imports = [
22 |       ../modules/common.nix
23 |       ../modules/hydra-slave.nix
24 |     ];
25 |   };
26 | in {
27 |   hydra        = mkHydra ../modules/hydra-master-main.nix;
28 |   mantis-hydra = mkHydra ../modules/hydra-master-mantis.nix;
29 | 
30 |   cardano-deployer = { config, pkgs, ... }: {
31 |     imports = [
32 |       ../modules/common.nix
33 |     ];
34 | 
35 |     environment.systemPackages = [ iohk-pkgs.iohk-ops ];
36 | 
37 |     networking.firewall.allowedTCPPortRanges = [
38 |       { from = 24962; to = 25062; }
39 |     ];
40 |   };
41 | 
42 |   bors-ng = { config, pkgs, ...}: {
43 |     imports = [
44 |       ../modules/common.nix
45 |       ./bors-ng.nix
46 |     ];
47 |   };
48 | }
49 | 


--------------------------------------------------------------------------------
/deployments/keypairs.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | 
 5 | {
 6 |   resources.ec2KeyPairs =
 7 |     (listToAttrs (flip map globals.orgXRegions
 8 |                  ({ org, region }:
 9 |                   nameValuePair (orgRegionKeyPairName org region)
10 |                                 { inherit region;
11 |                                   accessKeyId = globals.orgAccessKeys.${org};
12 |                                   description = "Keypair for ${org}/${region}";
13 |                                 }))) //
14 |     {
15 |       cardano-test-eu         = { accessKeyId = globals.orgAccessKeys.IOHK; region = "eu-central-1"; };
16 |       cardano-test-eu-central = { accessKeyId = globals.orgAccessKeys.IOHK; region = "eu-central-1"; };
17 |     };
18 | 
19 |   # Create GC generation on deployer machine
20 |   network.enableRollback = true;
21 | }
22 | 


--------------------------------------------------------------------------------
/deployments/mac-metadata.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   mac-mini-1 = {
 3 |     wgip = "192.168.20.21";
 4 |     deployip = "192.168.20.21";
 5 |     hostname = "mac-mini-1";
 6 |     hostid = "742a9d59";
 7 |     deployPort = 22;
 8 |   };
 9 |   mac-mini-2 = {
10 |     wgip = "192.168.20.22";
11 |     deployip = "192.168.20.22";
12 |     hostname = "mac-mini-2";
13 |     hostid = "34d9f89a";
14 |     deployPort = 22;
15 |   };
16 | }
17 | 


--------------------------------------------------------------------------------
/deployments/mainnet-noauto-restart.nix:
--------------------------------------------------------------------------------
1 | { environment, globals, ... }:
2 | 
3 | let
4 |   noRestartNodes = [ "r-a-1" ];
5 |   filteredList = builtins.filter (name: globals.nodeMap ? "${name}") noRestartNodes;
6 |   f = name: { inherit name; value = { systemd.services.cardano-restart.enable = false; }; };
7 |   deployment = builtins.listToAttrs (map f filteredList);
8 | in if environment == "production" then deployment else {}
9 | 


--------------------------------------------------------------------------------
/deployments/mantis-deployer.nix:
--------------------------------------------------------------------------------
 1 | { ... }:
 2 | 
 3 | let lib = import ../lib.nix; in
 4 | with lib;
 5 | with import ../lib/ssh-keys.nix { inherit lib; };
 6 | 
 7 | let
 8 |   iohk-pkgs = import ../default.nix {};
 9 | 
10 | in {
11 |   network.description = "Mantis Dev Deployer";
12 | 
13 |   testnet-deployer = { config, pkgs, resources, ... }: {
14 |     imports = [
15 |       ../modules/common.nix
16 |       ../modules/monitoring-exporters.nix
17 |       ../modules/deployer-base.nix
18 |     ];
19 | 
20 |     nix.binaryCaches = mkForce [
21 |       "https://cache.nixos.org"
22 |       "https://hydra.iohk.io" "https://mantis-hydra.aws.iohkdev.io"
23 |     ];
24 |     nix.binaryCachePublicKeys = mkForce [
25 |       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
26 |       "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
27 |       "hydra.iohk.io-1:E8yDJv2SBXM6PQPVbhCWK7VvitistFYSH2u3AuwCiu4="
28 |     ];
29 | 
30 |     networking.hostName = "devMantis-deployer";
31 | 
32 |     users.groups.developers = {};
33 | 
34 |     users.users = {
35 |       # Deploy cardano-sl testnet
36 |       dev = {
37 |         isNormalUser = true;
38 |         description  = "Mantis Developer";
39 |         group        = "deployers";
40 |         openssh.authorizedKeys.keys = devOpsKeys ++ mantisOpsKeys ++ allKeysFrom csl-developers;
41 |       };
42 |     }
43 |     # Normal users who can deploy developer clusters on AWS.
44 |     // mapAttrs (name: keys: {
45 |       group = "developers";
46 |       isNormalUser = true;
47 |       openssh.authorizedKeys.keys = keys;
48 |     }) (csl-developers // devOps // mantis-devOps);
49 | 
50 |     environment.systemPackages = let
51 |       usernames = attrNames (csl-developers // devOps // mantis-devOps);
52 |       list-developers = pkgs.writeShellScriptBin "list-developers"
53 |         (concatMapStringsSep "\n" (u: "echo ${u}") usernames);
54 |     in [ list-developers ] ++ ( with iohk-pkgs; [ terraform mfa ]);
55 |   };
56 | }
57 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-1/ah1jc8c0jlrirwxhs82rmvylj8m914xi-hardware.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   nixpkgs.config.allowUnfree = true;
 3 | 
 4 |   boot.initrd.availableKernelModules = [
 5 |     "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod"
 6 |   ];
 7 | 
 8 |   boot.kernelModules = [ "kvm-intel" ];
 9 |   boot.kernelParams =  [ "console=ttyS1,115200n8" ];
10 |   boot.extraModulePackages = [ ];
11 | 
12 |   hardware.enableAllFirmware = true;
13 | 
14 |   nix.maxJobs = 8;
15 | }
16 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-1/host-id.nix:
--------------------------------------------------------------------------------
1 | { networking.hostId = "0e8388eb"; }
2 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-1/l73iy1yk17sgw2dsibmxjwxnr049xjmy-installed.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   boot.loader.grub.devices = [ "/dev/sda" "/dev/sdb" ];
 3 |   boot.loader.grub.extraConfig = ''
 4 |     serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
 5 |     terminal_output serial console
 6 |     terminal_input serial console
 7 |   '';
 8 | 
 9 |   fileSystems = {
10 |     "/" = {
11 |       label = "nixos";
12 |       fsType = "ext4";
13 |     };
14 |   };
15 | 
16 |   swapDevices = [
17 |     {
18 |       label = "swap";
19 |     }
20 |   ];
21 | }
22 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-1/nwfi2d1385xfg5f5x4csvr3rndf6060l-standard.nix:
--------------------------------------------------------------------------------
1 | {
2 |   boot.kernelModules = [ "dm_multipath" "dm_round_robin" ];
3 |   services.openssh.enable = true;
4 | }
5 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-2/ah1jc8c0jlrirwxhs82rmvylj8m914xi-hardware.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   nixpkgs.config.allowUnfree = true;
 3 | 
 4 |   boot.initrd.availableKernelModules = [
 5 |     "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod"
 6 |   ];
 7 | 
 8 |   boot.kernelModules = [ "kvm-intel" ];
 9 |   boot.kernelParams =  [ "console=ttyS1,115200n8" ];
10 |   boot.extraModulePackages = [ ];
11 | 
12 |   hardware.enableAllFirmware = true;
13 | 
14 |   nix.maxJobs = 8;
15 | }
16 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-2/host-id.nix:
--------------------------------------------------------------------------------
1 | { networking.hostId = "46249957"; }
2 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-2/l73iy1yk17sgw2dsibmxjwxnr049xjmy-installed.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   boot.loader.grub.devices = [ "/dev/sda" "/dev/sdb" ];
 3 |   boot.loader.grub.extraConfig = ''
 4 |     serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
 5 |     terminal_output serial console
 6 |     terminal_input serial console
 7 |   '';
 8 | 
 9 |   fileSystems = {
10 |     "/" = {
11 |       label = "nixos";
12 |       fsType = "ext4";
13 |     };
14 |   };
15 | 
16 |   swapDevices = [
17 |     {
18 |       label = "swap";
19 |     }
20 |   ];
21 | }
22 | 


--------------------------------------------------------------------------------
/deployments/mantis-slave-packet-2/nwfi2d1385xfg5f5x4csvr3rndf6060l-standard.nix:
--------------------------------------------------------------------------------
1 | {
2 |   boot.kernelModules = [ "dm_multipath" "dm_round_robin" ];
3 |   services.openssh.enable = true;
4 | }
5 | 


--------------------------------------------------------------------------------
/deployments/mantis/goguen-ala-cardano.nix:
--------------------------------------------------------------------------------
 1 | with builtins;
 2 | with import ../../lib.nix;
 3 | 
 4 | let
 5 |   mkExplorer = mantisNodeName: {
 6 |     imports = [ <module/explorer-remix-solidity-services.nix> ];
 7 |     config.services.mantis-explorer.mantis-node = mantisNodeName;
 8 |   };
 9 | 
10 |   mkFaucet = mantisNodeName: {
11 |     imports = [ <module/mantis-faucet-service.nix> ];
12 |     config.services.mantis-faucet.mantis-node = mantisNodeName;
13 |   };
14 | 
15 |   mkMantis = {
16 |     imports = [ <module/mantis-service.pseudo.nix> ];
17 |     config.services.mantis = {};
18 |   };
19 | in {
20 |   network.description = "GMC";
21 | 
22 |   explorer-a = mkExplorer "mantis-a-0";
23 | 
24 |   faucet-a   = mkFaucet "mantis-a-0";
25 | 
26 |   mantis-a-0 = mkMantis;
27 |   mantis-a-1 = mkMantis;
28 |   mantis-b-0 = mkMantis;
29 |   mantis-b-1 = mkMantis;
30 |   mantis-c-0 = mkMantis;
31 | }
32 | 


--------------------------------------------------------------------------------
/deployments/monitoring-aws.nix:
--------------------------------------------------------------------------------
 1 | { globals, IOHKaccessKeyId, IOHKroute53accessKeyId, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | let
 5 |   accessKeyId = IOHKaccessKeyId;
 6 |   nodeMap = { inherit (globals.fullMap) monitoring; };
 7 |   monitoring = nodeMap.monitoring;
 8 |   region = monitoring.region;
 9 |   org = monitoring.org;
10 | in {
11 |   require = [
12 |     ./security-groups/allow-public-www-https.nix
13 |     ./security-groups/allow-deployer-ssh.nix
14 |     ./security-groups/allow-monitoring-collection.nix
15 |     ./global.nix
16 |     ./monitoring.nix
17 |   ];
18 |   resources = {
19 |     ec2SecurityGroups = {
20 |       "allow-wireguard-in-${region}-${org}" = {
21 |         inherit region accessKeyId;
22 |         description = "wireguard";
23 |         rules = [{
24 |           protocol = "udp";
25 |           fromPort = 51820; toPort = 51820;
26 |           sourceIp = "0.0.0.0/0";
27 |         }];
28 |       };
29 |     };
30 |   };
31 |   monitoring = { config, lib, resources, ... }: {
32 |     deployment = {
33 |       route53.accessKeyId = lib.mkForce IOHKroute53accessKeyId;
34 |       ec2 = {
35 |         securityGroups = (optionals (! config.global.omitDetailedSecurityGroups) [
36 |           resources.ec2SecurityGroups."allow-wireguard-in-${region}-${org}"
37 |           resources.ec2SecurityGroups."allow-monitoring-static-peers-${region}-${org}"
38 |           resources.ec2SecurityGroups."allow-public-www-https-${region}-${org}"
39 |         ]);
40 |         region         = mkForce monitoring.region;
41 |         accessKeyId    = monitoring.accessKeyId;
42 |         keyPair        = resources.ec2KeyPairs.${monitoring.keyPairName};
43 |       };
44 |     };
45 |   };
46 | 
47 |   resources.elasticIPs = nodesElasticIPs nodeMap;
48 | }
49 | 


--------------------------------------------------------------------------------
/deployments/monitoring-env-development.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   require = [ ./monitoring.nix ];
 3 |   monitoring = { ... }:
 4 |   {
 5 |     imports = [
 6 |       ../modules/development.nix
 7 |     ];
 8 |     services.monitoring-services.applicationDashboards = ../modules/grafana/cardano;
 9 |     services.monitoring-services.applicationRules = [ ];
10 |     services.monitoring-services.logging = false;
11 |     services.monitoring-services.metrics = true;
12 |   };
13 | }
14 | 


--------------------------------------------------------------------------------
/deployments/monitoring-env-staging.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   require = [ ./monitoring.nix ];
 3 |   monitoring = { pkgs, lib, ... }:
 4 |   {
 5 |     imports = [
 6 |       ../modules/staging.nix
 7 |     ];
 8 | 
 9 |     systemd.services.graylog.environment = { JAVA_OPTS = ''
10 |       -Djava.library.path=${pkgs.graylog}/lib/sigar -Xms3g -Xmx3g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow
11 |     ''; };
12 |     services.elasticsearch.extraJavaOptions = [ "-Xms6g" "-Xmx6g" ];
13 |     services.monitoring-services.applicationDashboards = ../modules/grafana/cardano;
14 |     services.monitoring-services.applicationRules = [
15 |       {
16 |         alert = "chain_quality_degraded";
17 |         expr = "cardano_chain_quality_last_k__2160__blocks__ < 99";
18 |         for = "5m";
19 |         labels = {
20 |           severity = "page";
21 |         };
22 |         annotations = {
23 |           summary = "{{$labels.alias}}: Degraded Chain Quality over last 2160 blocks.";
24 |           description = "{{$labels.alias}}: Degraded Chain Quality over last 2160 blocks (<99%).";
25 |         };
26 |       }
27 |       {
28 |         alert = "mempoolsize_tx_count_too_large";
29 |         expr = "max_over_time(cardano_MemPoolSize[5m]) > 190";
30 |         for = "1m";
31 |         labels = {
32 |           severity = "page";
33 |         };
34 |         annotations = {
35 |           summary = "{{$labels.alias}}: MemPoolSize tx count is larger than expected.";
36 |           description = "{{$labels.alias}}: When a node's MemPoolSize grows larger than the system can handle, transactions will be dropped. The actual thresholds for that in mainnet are unknown, but [based on benchmarks done beforehand](https://input-output-rnd.slack.com/archives/C2VJ41WDP/p1506563332000201) transactions started getting dropped when the MemPoolSize was ~200 txs.";
37 |         };
38 |       }
39 |     ];
40 |   };
41 | }
42 | 


--------------------------------------------------------------------------------
/deployments/monitoring-env-testnet.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   require = [
 3 |     ./monitoring.nix
 4 |   ];
 5 |   monitoring = { pkgs, lib, ... }:
 6 |   {
 7 |     imports = [
 8 |       ../modules/testnet.nix
 9 |       ../modules/monitoring-rules-cardano.nix
10 |     ];
11 | 
12 |     deployment.ec2.instanceType = "t3.xlarge";
13 |     boot.loader.grub.device = lib.mkForce "/dev/nvme0n1"; # t3.xlarge has an nvme disk, and amazon-image.nix isnt handling it right yet
14 |     deployment.ec2.ebsInitialRootDiskSize = 1000;
15 | 
16 |     systemd.services.graylog.environment = { JAVA_OPTS = ''
17 |       -Djava.library.path=${pkgs.graylog}/lib/sigar -Xms3g -Xmx3g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow
18 |     ''; };
19 |     services.elasticsearch.extraJavaOptions = [ "-Xms6g" "-Xmx6g" ];
20 | 
21 |     services.monitoring-services.grafanaAutoLogin = true;
22 |     services.monitoring-services.applicationDashboards = ../modules/grafana/cardano;
23 |   };
24 | }
25 | 


--------------------------------------------------------------------------------
/deployments/security-groups/allow-all.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }:
 2 | 
 3 | let
 4 | 
 5 |   mkRule = { org, region }: {
 6 |     name = "allow-all-${region}-${org}";
 7 |     value = {
 8 |       inherit region;
 9 |       _file = ./allow-all.nix;
10 |       accessKeyId = globals.orgAccessKeys.${org};
11 |       description = "Allow all ${org}/${region}";
12 |       rules = [{
13 |         protocol = "-1"; # all
14 |         fromPort = 0; toPort = 65535;
15 |         sourceIp = "0.0.0.0/0";
16 |       }];
17 |     };
18 |   };
19 | in {
20 |   resources.ec2SecurityGroups = builtins.listToAttrs (map mkRule globals.orgXRegions);
21 | }
22 | 


--------------------------------------------------------------------------------
/deployments/security-groups/allow-deployer-ssh.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }:
 2 | 
 3 | let
 4 | 
 5 |   mkRule = { org, region }: {
 6 |     name = "allow-deployer-ssh-${region}-${org}";
 7 |     value = {
 8 |       inherit region;
 9 |       _file = ./allow-deployer-ssh.nix;
10 |       accessKeyId = globals.orgAccessKeys.${org};
11 |       description = "SSH";
12 |       rules = [
13 |         {
14 |           protocol = "tcp"; # TCP
15 |           fromPort = 22;
16 |           toPort = 22;
17 |           sourceIp = globals.deployerIP + "/32";
18 |         }
19 |       ];
20 |     };
21 |   };
22 | in {
23 |   resources.ec2SecurityGroups = builtins.listToAttrs (map mkRule globals.orgXRegions);
24 | }
25 | 


--------------------------------------------------------------------------------
/deployments/security-groups/allow-explorer-python-monitoring.nix:
--------------------------------------------------------------------------------
 1 | { globals, monitorIpOverride ? null, ... }:
 2 | 
 3 | let
 4 | 
 5 |   mkRule = { org, region }: {
 6 |     name = "allow-explorer-python-monitoring-${region}-${org}";
 7 |     value = { nodes, resources, lib, ... }:
 8 |     let
 9 |       monitoringSourceIp = resources.elasticIPs."${globals.monitoringNV.name}-ip" or monitorIpOverride;
10 |     in {
11 |       inherit region;
12 |       _file = ./allow-explorer-python-monitoring.nix;
13 |       accessKeyId = globals.orgAccessKeys.${org};
14 |       description = "Monitoring Explorer Python";
15 |       rules = lib.optionals (nodes ? "${globals.monitoringNV.name}" || monitorIpOverride != null)
16 |       [
17 |         {
18 |           protocol = "tcp";
19 |           fromPort = 7000; toPort = 7000; # prometheus exporters
20 |           sourceIp = monitoringSourceIp;
21 |         }
22 |         {
23 |           protocol = "tcp";
24 |           fromPort = 7001; toPort = 7001; # prometheus exporters
25 |           sourceIp = monitoringSourceIp;
26 |         }
27 |       ];
28 |     };
29 |   };
30 | in {
31 |   resources.ec2SecurityGroups = builtins.listToAttrs (map mkRule globals.orgXRegions);
32 | }
33 | 


--------------------------------------------------------------------------------
/deployments/security-groups/allow-monitoring-collection.nix:
--------------------------------------------------------------------------------
 1 | { globals, monitorIpOverride ? null, ... }:
 2 | 
 3 | let
 4 | 
 5 |   mkRule = { org, region }: {
 6 |     name = "allow-monitoring-collection-${region}-${org}";
 7 |     value = { nodes, resources, lib, ... }:
 8 |     let
 9 |       monitoringSourceIp = resources.elasticIPs."${globals.monitoringNV.name}-ip" or monitorIpOverride;
10 |     in {
11 |       inherit region;
12 |       _file = ./allow-monitoring-collection.nix;
13 |       accessKeyId = globals.orgAccessKeys.${org};
14 |       description = "Monitoring collection";
15 |       rules = lib.optionals (nodes ? "${globals.monitoringNV.name}" || monitorIpOverride != null)
16 |         [{
17 |           protocol = "tcp";
18 |           fromPort = 9100; toPort = 9100; # prometheus exporters
19 |           sourceIp = monitoringSourceIp;
20 |         }{
21 |           protocol = "tcp";
22 |           fromPort = 9102; toPort = 9102; # statd exporter
23 |           sourceIp = monitoringSourceIp;
24 |         }{
25 |           protocol = "tcp";
26 |           fromPort = 9113; toPort = 9113; # nginx exporter
27 |           sourceIp = monitoringSourceIp;
28 |         }];
29 |     };
30 |   };
31 | in {
32 |   resources.ec2SecurityGroups = builtins.listToAttrs (map mkRule globals.orgXRegions);
33 | }
34 | 


--------------------------------------------------------------------------------
/deployments/security-groups/allow-public-www-https.nix:
--------------------------------------------------------------------------------
 1 | { globals, ... }:
 2 | 
 3 | let
 4 | 
 5 |   mkRule = { org, region }: {
 6 |     name = "allow-public-www-https-${region}-${org}";
 7 |     value = {
 8 |       _file = ./allow-public-www-https.nix;
 9 |       inherit region;
10 |       accessKeyId = globals.orgAccessKeys.${org};
11 |       description = "WWW-http(s)";
12 |       rules = [
13 |         {
14 |           protocol = "tcp";
15 |           fromPort = 80; toPort = 80;
16 |           sourceIp = "0.0.0.0/0";
17 |         }
18 |         {
19 |           protocol = "tcp";
20 |           fromPort = 443; toPort = 443;
21 |           sourceIp = "0.0.0.0/0";
22 |         }
23 |       ];
24 |     };
25 |   };
26 | in {
27 |   resources.ec2SecurityGroups = builtins.listToAttrs (map mkRule globals.orgXRegions);
28 | }
29 | 
30 | 


--------------------------------------------------------------------------------
/deployments/testnet-deployer-aws.nix:
--------------------------------------------------------------------------------
 1 | { ... }:
 2 | 
 3 | with (import ./../lib.nix);
 4 | 
 5 | {
 6 |   testnet-deployer = { config, pkgs, lib, resources, ... }: {
 7 |     imports = [ <nixpkgs/nixos/modules/virtualisation/amazon-image.nix> ];
 8 |     ec2.hvm = true;
 9 | 
10 |     deployment = {
11 |       targetEnv = "none";
12 |       targetHost = "localhost";
13 |     };
14 | 
15 |     # Don't reconfigure the system from EC2 userdata on next startup
16 |     systemd.services.amazon-init.wantedBy = lib.mkForce [ ];
17 |   };
18 | }
19 | 


--------------------------------------------------------------------------------
/deployments/ugly-fix.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   hydra = { resources, ... }: {
 3 |     deployment.ec2.keyPair = resources.ec2KeyPairs.cardano-test-eu;
 4 |   };
 5 | 
 6 |   resources.ec2KeyPairs.cardano-test-eu = {
 7 |     accessKeyId = "cardano-deployer";
 8 |     region = "eu-central-1";
 9 |   };
10 |   resources.ec2KeyPairs.cardano-test-eu-central = {
11 |     accessKeyId = "cardano-deployer";
12 |     region = "eu-central-1";
13 |   };
14 | }
15 | 


--------------------------------------------------------------------------------
/docs/bors.md:
--------------------------------------------------------------------------------
 1 | # Deployment Notes for Bors
 2 | 
 3 | Bors is deployed as part of the `iohk-infra` deployment.
 4 | 
 5 | ## How to set up a new repository with Bors
 6 | 
 7 | ### 1. Bors Admin
 8 | 
 9 | Do this from the web interface https://bors-ng.aws.iohkdev.io/
10 | 
11 | 1. Go to the Bors
12 |    [Repositories List](https://bors-ng.aws.iohkdev.io/repositories) then
13 |    [Add/Remove repositories](https://github.com/apps/iohk-bors/installations/new).
14 | 
15 |    Choose input-output-hk and then your repo.
16 | 
17 | 2. Go to the [Bors admin page](https://bors-ng.aws.iohkdev.io/admin)
18 |    and choose `Sync installations`.
19 | 
20 | 3. Go to back to _Repositories_ and visit the _Settings_ tab of the new repository.
21 |    1. Update the branch names to `bors/staging` and `bors/trying`
22 |    2. Set _Reviewers_ to `Push`, click `Update`.
23 |    3. Set _Members_ to `Push`, click `Update`.
24 | 
25 | 
26 | ### 2. Hydra jobsets
27 | 
28 | If there is `ci/hydra` among the required `status` in `bors.toml`,
29 | then you will need to add Hydra jobsets for the `bors/staging` and
30 | `bors/trying` branches.
31 | 
32 | Look in `iohk-ops/jobsets/default.nix` for examples
33 | (`iohk-bors-{staging,trying}`).
34 | 
35 | 
36 | ### 3. Repo
37 | 
38 | Add your `bors.toml` in a PR and check that `bors ping` works.
39 | 
40 | You should then be able to `bors try` and `bors r+` the PR.
41 | 
42 | If the jobsets/ci status names are wrong/missing then `bors try` will
43 | just time out after 2 hours.
44 | 
45 | 
46 | ## How to add admin users to bors
47 | 
48 | You need to log in to the Bors host and update the PostgreSQL database
49 | which Bors uses. There are instructions in the Bors documentation.
50 | 


--------------------------------------------------------------------------------
/docs/deployments.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/input-output-hk/iohk-ops/b0cffc81170562c3acfe9f6efb5260cf69b4cd6d/docs/deployments.pdf


--------------------------------------------------------------------------------
/docs/github-webhook-util.md:
--------------------------------------------------------------------------------
 1 | # GitHub Webhook Util
 2 | 
 3 | GitHub Webhook Util is a tool written in haskell that listens for GitHub
 4 | webhook events processes those events.
 5 | 
 6 | It requires a token to be able to check status events. In our case, since
 7 | both run on the hydra server, we use the same token.
 8 | 
 9 | It also requires setting up a webhook on the repositories you want to
10 | collect data from.
11 | 
12 | Both credentials are loaded from an EnvironmentFile
13 | by systemd that is deployed using nixops deployment keys.
14 | 
15 | ## Secrets
16 | 
17 | A secret file needs to be created with the following format:
18 | 
19 |     GITHUB_SERVANT_SECRET=foo
20 |     GITHUB_TOKEN=bar
21 | 
22 | The Servant secret is the one that should be configured in github webhook.
23 | The token is the personal access token being used to query API.
24 | 
25 | ## Setup
26 | 
27 | Setup consists of adding a webhook to the repository. This webhook needs
28 | to have access to Status Data. Then both tokens should be place in
29 | `static/github-webhook-util.secret`. After a deploy, the service should
30 | start and nginx should be listening for github notification requests.
31 | 
32 | ## Webhooks
33 | 
34 | ### GitHub Status Event Data Collection
35 | 
36 | Any GitHub Status event will check if the commit attached to that status
37 | has all statuses completed (Success or Failure, not pending or error). If
38 | so, it will query some extra data about those statuses, mainly how long
39 | each one took to complete from the time the first status check arrived.
40 | 
41 | It will then take that data and write it to influxDB to be viewed by
42 | devops/developers with grafana.
43 | 
44 | ## TODO
45 | 
46 | * Add integration to grab hydra phase metrics for all statuses and insert
47 | them into influxDB as well.
48 | * Integrate with the servant graphing utility for generating time lines of
49 | hydra derivations.
50 | * get PR metadata for commits if exists, so individual PR's can be graphed.
51 | 


--------------------------------------------------------------------------------
/fetch-nixpkgs.nix:
--------------------------------------------------------------------------------
1 | (import ./nix/sources.nix).nixpkgs
2 | 


--------------------------------------------------------------------------------
/goguen/docker-image.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , dockerTools
 3 | ###
 4 | , coreutils
 5 | , gnused
 6 | , gawk
 7 | , bashInteractive
 8 | , vim
 9 | , openjdk8
10 | ###
11 | , mantis
12 | , iele-semantics
13 | }:
14 | 
15 | stdenv.mkDerivation {
16 |   name = "mantis-docker";
17 | 
18 |   installPhase = ''
19 |     mkdir $out
20 | 
21 |     cp $src $out/image.tar.gz
22 |   '';
23 | 
24 |   src = dockerTools.buildImage {
25 |     name = "mantis";
26 |     tag = "latest";
27 |     fromImageName = "ubuntu";
28 |     fromImageTag = "16.04";
29 |     contents = [
30 |       coreutils
31 |       gnused
32 |       gawk
33 |       bashInteractive
34 |       vim
35 |       openjdk8
36 |       mantis.out
37 |       iele-semantics
38 |     ];
39 |     config = {
40 |       Env = [
41 |         "_JAVA_OPTIONS=-Duser.home=/home/mantis"
42 |       ];
43 |       ExposedPorts = {
44 |         "9076/tcp" = {}; # Ethereum protocol connections
45 |         "30303/tcp" = {}; # Discovery protocol
46 |         "8546/tcp" = {}; # JSON-RPC http endpoint
47 |         "5679/tcp" = {}; # Raft consensus protocol
48 |         "8099/tcp" = {}; # Faucet.
49 |         "8888/tcp" = {}; # KEVM.
50 |       };
51 |     };
52 |   };
53 | }
54 | 


--------------------------------------------------------------------------------
/goguen/explorer.nix:
--------------------------------------------------------------------------------
 1 | { stdenv, getSrc, nodejs, yarn, fetchurl, linkFarm }:
 2 | 
 3 | let
 4 |   yarnDeps = import ./explorer/yarn.nix { inherit fetchurl linkFarm; };
 5 |   offlineCache = yarnDeps.offline_cache;
 6 | in stdenv.mkDerivation rec {
 7 |   name = "ethereum-explorer";
 8 |   src  = getSrc name;
 9 | 
10 |   buildInputs = [ nodejs yarn ];
11 | 
12 |   configurePhase = ''
13 |     export HOME="$NIX_BUILD_TOP"
14 | 
15 |     yarn config --offline set yarn-offline-mirror ${offlineCache}
16 | 
17 |     yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts
18 |   '';
19 | 
20 |   buildPhase = "yarn run build";
21 | 
22 |   doCheck = true;
23 | 
24 |   checkPhase = "yarn test --coverage --ci --no-color";
25 | 
26 |   installPhase = "mv build $out";
27 | }
28 | 


--------------------------------------------------------------------------------
/goguen/iele-deps.patch:
--------------------------------------------------------------------------------
 1 | diff --git a/Makefile b/Makefile
 2 | index 6b9d146..b314733 100644
 3 | --- a/Makefile
 4 | +++ b/Makefile
 5 | @@ -11,7 +11,7 @@ else
 6 |  EXT=cmx
 7 |  LIBEXT=cmxa
 8 |  DLLEXT=cmxs
 9 | -OCAMLC=opt -O3 -cclib -Wl,-rpath=/usr/local/lib
10 | +OCAMLC=opt -O3 -cclib -Wl,-rpath=${LD_LIBRARY_PATH}
11 |  LIBFLAG=-shared
12 |  endif
13 |  
14 | @@ -22,7 +22,7 @@ BISECT=-package bisect_ppx
15 |  PREDICATES=-predicates coverage
16 |  endif
17 |  
18 | -export PATH:=$(shell cd compiler && stack path --local-install-root)/bin:${PATH}
19 | +export PATH:=$(shell cd compiler && stack path --no-nix --local-install-root --system-ghc)/bin:${PATH}
20 |  
21 |  .PHONY: all clean distclean build tangle defn proofs split-tests test vm-test blockchain-test deps k-deps ocaml-deps assembler iele-test iele-test-node node testnode install
22 |  .SECONDARY:
23 | @@ -33,15 +33,15 @@ clean:
24 |  	rm -rf .build/standalone .build/node .build/check .build/plugin-node .build/plugin-standalone .build/vm compiler/.stack-work
25 |  
26 |  distclean: clean
27 | -	cd tests/ci/rv-k && mvn clean
28 | +	cd tests/ci/rv-k && mvn -Dmaven.repo.local=$(HOME)/.m2 clean
29 |  
30 |  build: tangle .build/standalone/ethereum-kompiled/interpreter .build/vm/iele-vm assembler .build/check/well-formedness-kompiled/interpreter
31 |  
32 |  assembler:
33 | -	cd compiler && stack build --install-ghc
34 | +	cd compiler && stack build --system-ghc --no-nix
35 |  
36 |  install: assembler
37 | -	cd compiler && stack install
38 | +	cd compiler && stack install --system-ghc --no-nix
39 |  	cp .build/vm/iele-vm .build/vm/iele-test-client .build/vm/iele-test-vm ~/.local/bin
40 |  
41 |  # Tangle from *.md files
42 | @@ -169,7 +169,7 @@ coverage:
43 |  
44 |  deps: k-deps ocaml-deps
45 |  k-deps:
46 | -	cd tests/ci/rv-k && mvn package -q -DskipTests -Dllvm.backend.skip
47 | +	cd tests/ci/rv-k && mvn -Dmaven.repo.local=$(HOME)/.m2 package -q -DskipTests -Dllvm.backend.skip
48 |  
49 |  ocaml-deps:
50 |  	opam init
51 | 


--------------------------------------------------------------------------------
/goguen/iele-semantics.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , pkgs
 3 | , gmp
 4 | , secp256k1
 5 | , getSrc
 6 | }:
 7 | 
 8 | let haskellPackages = pkgs.haskellPackages.override {
 9 |       overrides = self: super: {
10 |         stack = pkgs.haskell.lib.overrideCabal super.stack (attrs: {
11 |           patches = [ ./stack.patch ];
12 |         });
13 |       };
14 |     };
15 | in
16 | stdenv.mkDerivation rec {
17 |   name = "iele-semantics";
18 |   src  = getSrc name;
19 | 
20 |   buildInputs = with pkgs; [ autoconf automake libtool secp256k1 maven haskell.compiler.ghc802 haskellPackages.stack perl flex git gcc opam ocaml pandoc curl rsync unzip which pkgconfig zlib ncurses z3 mpfr gmp openjdk8 python2 bash ];
21 | 
22 |   patches = [ ./iele-tests.patch ./iele-deps.patch ];
23 | 
24 |   configurePhase = ''
25 |     export HOME=$NIX_BUILD_TOP
26 |     export LD_LIBRARY_PATH=${gmp.out}/lib:$LD_LIBRARY_PATH
27 |     export NIX_CFLAGS_COMPILE="-Wno-error=unused-result $NIX_CFLAGS_COMPILE"
28 |     make deps
29 |     eval $(opam config env)
30 |   '';
31 | 
32 |   installPhase = ''
33 |     make install
34 |     mv $HOME/.local $out
35 |   '';
36 | }
37 | 


--------------------------------------------------------------------------------
/goguen/iele-tests.patch:
--------------------------------------------------------------------------------
 1 | diff --git a/tests/split-test.py b/tests/split-test.py
 2 | index e054338..6c283ec 100755
 3 | --- a/tests/split-test.py
 4 | +++ b/tests/split-test.py
 5 | @@ -20,4 +20,4 @@ with open (source_file, "r") as source:
 6 |          with open (target_file, "w+") as target:
 7 |              json.dump({ subtest: original_test[subtest] }, target, indent=4)
 8 |          with open (target_iele_file, "w+") as target:
 9 | -	    subprocess.check_call([evm_test_to_iele, target_file, target_iele_file])
10 | +            subprocess.check_call([evm_test_to_iele, target_file, target_iele_file])
11 | 


--------------------------------------------------------------------------------
/goguen/jdk-override/jdk8cpu-linux.nix:
--------------------------------------------------------------------------------
 1 | # http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
 2 | # jce download url: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
 3 | import ./jdk-linux-base.nix {
 4 |   productVersion = "8";
 5 |   patchVersion = "201";
 6 |   buildVersion = "09";
 7 |   sha256.i686-linux = "1f9n93zmkggchaxkchp4bqasvxznn96zjci34f52h7v392jkzqac";
 8 |   sha256.x86_64-linux = "0w730v2q0iaxf2lprabwmy7129byrs0hhdbwas575p1xmk00qw6b";
 9 |   sha256.armv7l-linux = "0y6bvq93lsf21v6ca536dpfhkk5ljsj7c6di0qzkban37bivj0si";
10 |   sha256.aarch64-linux = "1bybysgg9llqzllsmdszmmb73v5az2l1shxn6lxwv3wwiazpf47q";
11 |   releaseToken = "42970487e3af4f5aa5bca3f542482c60";
12 |   jceName = "jce_policy-8.zip";
13 |   sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";
14 | }
15 | 


--------------------------------------------------------------------------------
/goguen/jdk-override/readme.md:
--------------------------------------------------------------------------------
1 | # Oracle JDK Overrides
2 | 
3 | As I am writing this file (<2019-03-27>), the `iohk-ops` nixpkgs
4 | pin is referencing an outdated oracle JDK. We are unable to build this
5 | derivation since oracle only seems to give a public download link for its latest release 8.201 currently.
6 | 
7 | These derivation have been extracted from the Nixpkg's master.
8 | 


--------------------------------------------------------------------------------
/goguen/jobsets/pr-excluded-labels.nix:
--------------------------------------------------------------------------------
1 | [ "hydra-dont-build" ]
2 | 


--------------------------------------------------------------------------------
/goguen/jobsets/simple-pr-dummy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "42": {
 3 |     "base": {
 4 |       "repo": {
 5 |         "clone_url": "https://github.com/user/project.git"
 6 |       }
 7 |     },
 8 |     "head": {
 9 |       "ref": "pr-branch",
10 |       "repo": {
11 |         "name": "reponame",
12 |         "owner": {
13 |           "login": "githubuser"
14 |         }
15 |       }
16 |     },
17 |     "title": "Pull request title"
18 |   },
19 |   "30031": {
20 |     "base": {
21 |       "repo": {
22 |         "clone_url": "https://github.com/user/project.git"
23 |       }
24 |     },
25 |     "head": {
26 |       "ref": "pr-branch",
27 |       "repo": {
28 |         "name": "reponame",
29 |         "owner": {
30 |           "login": "githubuser"
31 |         }
32 |       }
33 |     },
34 |     "labels": [
35 |       {
36 |         "color": "006b75",
37 |         "default": false,
38 |         "id": 692360873,
39 |         "name": "hydra-dont-build",
40 |         "url": "https://api.github.com/repos/input-output-hk/cardano-sl/labels/hydra-dont-build"
41 |       }
42 |     ],
43 |     "title": "Pull request title"
44 |   }
45 | }
46 | 


--------------------------------------------------------------------------------
/goguen/jobsets/spec.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "enabled": 1,
 3 |     "hidden": false,
 4 |     "description": "Jobsets",
 5 |     "nixexprinput": "src",
 6 |     "nixexprpath": "goguen/jobsets/default.nix",
 7 |     "checkinterval": 60,
 8 |     "schedulingshares": 420,
 9 |     "enableemail": true,
10 |     "emailoverride": "",
11 |     "keepnr": 3,
12 |     "inputs":
13 |     {
14 |         "src": { "type": "git", "value": "git@github.com:input-output-hk/iohk-ops.git goguen-ala-cardano", "emailresponsible": false }
15 |         ,"nixpkgs": { "type": "git", "value": "https://github.com/NixOS/nixpkgs-channels.git nixos-18.09", "emailresponsible": false }
16 |         ,"mantisPrsJSON": { "type": "githubpulls", "value": "input-output-hk mantis", "emailresponsible": false }
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/goguen/kevm.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , getSrc
 3 | , pkgs
 4 | }:
 5 | 
 6 | stdenv.mkDerivation rec {
 7 |   name = "evm-semantics";
 8 |   src  = getSrc name;
 9 | 
10 |   patches = [ ./kevm.patch ];
11 |   buildInputs = with pkgs; [ pandoc openjdk8 ocaml opam maven z3 mpfr autoconf automake libtool ncurses unzip git curl rsync gcc perl which pkgconfig flex zlib python3 ];
12 | 
13 |   configurePhase = ''
14 |     export HOME="$NIX_BUILD_TOP"
15 |     export NIX_CFLAGS_COMPILE="-Wno-error=unused-result $NIX_CFLAGS_COMPILE"
16 |     make deps
17 |   '';
18 | 
19 |   installPhase = ''
20 |     mkdir $out
21 |     mv .build/local/lib $out/
22 |     mv .build/vm $out/bin
23 |   '';
24 | }
25 | 


--------------------------------------------------------------------------------
/goguen/mantis.nix:
--------------------------------------------------------------------------------
 1 | { stdenv, pkgs, getSrc, sbt-verify, protobuf }:
 2 | 
 3 | stdenv.mkDerivation rec {
 4 |   name = "mantis-cardano";
 5 |   src  = getSrc name;
 6 | 
 7 |   buildInputs = with pkgs; [ scala sbt sbt-verify unzip protobuf openjdk8 ];
 8 | 
 9 |   outputs = [ "out" "zip" ];
10 | 
11 |   configurePhase = ''
12 |     export HOME="$NIX_BUILD_TOP"
13 |     export "_JAVA_OPTIONS=-Dsbt.global.base=.sbt/1.0 -Dsbt.ivy.home=.ivy"
14 | 
15 |     cp -r ${sbr-verify}/{.ivy,.sbt,target} .
16 |     chmod -R u+w .ivy .sbt target
17 | 
18 |     # Get sbt to pre-fetch its dependencies. The cleanest way I've
19 |     # found of doing this is to get it to list the available projects,
20 |     # which it can only do once deps are downloaded.
21 |     sbt projects
22 | 
23 |     # We have to patch the executable embedded inside protoc-jar for
24 |     # the one nix provides. :-(
25 |     # This would be unnecessary if the mantis project didn't use
26 |     # protoc-jar, and just expected the binary to be on the path as a
27 |     # pre-requisite.
28 |     mkdir -p bin_340/linux/amd64/
29 |     cp ${protobuf}/bin/protoc bin_340/linux/amd64/
30 |     jar uf .ivy/cache/com.github.os72/protoc-jar/jars/protoc-jar-3.4.0.jar bin_340/linux/amd64/protoc
31 |   '';
32 | 
33 |   buildPhase = ''
34 |     # We ignore tests and just build the distribution
35 |     # because we run them on GitHub PRs via CircleCI anyway,
36 |     # so getting here means we a) are clear, b) need to do the build asap.
37 |     sbt --debug 'set test in Test := {}' dist
38 |   '';
39 | 
40 |   installPhase = ''
41 |     mkdir $out $zip
42 |     cp target/universal/mantis-1.0-daedalus-rc1.zip $zip/mantis.zip
43 | 
44 |     unzip $zip/mantis.zip
45 |     rm mantis-1.0-daedalus-rc1/conf/application.ini
46 |     mv mantis-1.0-daedalus-rc1/* $out
47 |   '';
48 | }
49 | 


--------------------------------------------------------------------------------
/goguen/pins/blockchain-k-plugin-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/runtimeverification/blockchain-k-plugin",
3 |   "rev": "d03539df51d1e985801302d227ec2199eaa50f50",
4 |   "sha256": "0njgjz5x5ag6hrbx81c3isq04sbg8nsp4jdm5bhkld3c1gsnwl3b",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/ethereum-explorer-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/ethereum-explorer",
3 |   "rev": "eeecef2a06f4112afa74b29b097eaf1fb8ee4d99",
4 |   "sha256": "1pwxnhhz08ylcayn6h59bixi7a9aghxl5sy3cll6ca9j3izawprg",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/evm-semantics-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/kframework/evm-semantics",
3 |   "rev": "cc9c659510383215e5333d7f60088a2fdf2d120d",
4 |   "sha256": "15w5pxmyac02y28fcv2yrdk108m1hfg5m0x2brxakvzvinmnqfdc",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/fetch-nixpkgs.nix:
--------------------------------------------------------------------------------
1 | let
2 |   spec = builtins.fromJSON (builtins.readFile ./nixpkgs-src.json);
3 | in builtins.fetchTarball {
4 |   url = "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
5 |   inherit (spec) sha256;
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/iele-semantics-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/runtimeverification/iele-semantics",
3 |   "rev": "a5514519a76954aef1dcff89454074e4ca52bd1d",
4 |   "sha256": "1vvwbwzx2iky4vxikwd5i533zg4gp1lxphxvk8hz42h710gdw73p",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/iohk-nix-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/iohk-nix",
3 |   "rev": "cf589aeb1e6ee2aa68317711e37c8350e75acc0d",
4 |   "sha256": "00z2hyd5r9vfrirppczghdpyfk18zb1kss6zwp6l7ydm6b1b2z95",
5 |   "fetchSubmodules": false
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/k-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/runtimeverification/k",
3 |   "rev": "29ed2ba98bf50dfd83035eb77ac409406ed838b5",
4 |   "sha256": "1aydpcl5qn7cmzv1igl4r1sn5z1g1zv98h9n4gmsnczn2gry5rf1",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/mantis-cardano-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "ssh://git@github.com/input-output-hk/mantis-cardano.git",
3 |   "rev": "4848b2d1618b4842412ecfedda6d526ae06316ab",
4 |   "submodules": {
5 |     "tests": "src/ets/resources/ets",
6 |     "mantis-extvm-pb": "src/main/protobuf/extvm"
7 |   }
8 | }
9 | 


--------------------------------------------------------------------------------
/goguen/pins/mantis-extvm-pb-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/mantis-extvm-pb",
3 |   "rev": "0246e8c543f0c826f7034dcd75bcfe988bc476df",
4 |   "sha256": "1y53x8wfgv2xb1v7vgf4yj86y74yw7ds7d7s9w3mfgcqidw1z9ir",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/nixpkgs-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/nixpkgs",
3 |   "rev": "76aafbf4bf4992c82da41ccefd8c6d481744524c",
4 |   "sha256": "sha256:1xz8249i9yag4sxfzd5lkhqsyg7n6h3n2klb1cqqmcsav87f6x65",
5 |   "date": "2019-01-28T17:31:58+00:00",
6 |   "fetchSubmodules": false
7 | }
8 | 


--------------------------------------------------------------------------------
/goguen/pins/pandoc-tangle-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/ehildenb/pandoc-tangle",
3 |   "rev": "381d74fc12d8775fa4c37a7fa4443d0152e71397",
4 |   "sha256": "0k4l23a628bgyw4bmcg90p96k2mv9fabi187l4ngh53zs54r8bi2",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/remix-ide-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/remix-ide",
3 |   "rev": "5ce54ebb325c1d36939e3623116613cd660adf5c",
4 |   "sha256": "0m0g9zs0gnwg9biwb7vssc928lbmbm2p8mq7pylgw4bjzjxs09xb",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/sbt-verify-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/sbt-verify",
3 |   "rev": "af454fe0befa3303481a27adfce0b9042958361a",
4 |   "sha256": "0nwkc4wf02hcxf4bfh62lscbfmavhj6zqmkcp7rc9p381khzg8ac",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/secp256k1-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/bitcoin-core/secp256k1",
3 |   "rev": "b408c6a8b287003d1ade5709e6f7bc3c7f1d5be7",
4 |   "sha256": "16fn3a8ldj8r337a3cmraqml1q4xfznbgqh1gjj4i0lmfm5lg570",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/solc-bin-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/ethereum/solc-bin",
3 |   "rev": "1ca2fb31b2862b4868b2be621cdf7c1716bba5f6",
4 |   "sha256": "0320jcji5d5acjd6xvdldcikh9my8l9whylbzhrqxa98wq82hmnj",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/solidity-service-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/solidity-service",
3 |   "rev": "d01e80031b5310484f329532c9ce186f773b85b0",
4 |   "sha256": "0434i286d8sngcfqcnbgk1n0mj1izmrr781vj5s611ak9qlh4f70",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/solidity-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/runtimeverification/solidity",
3 |   "rev": "124ca40dc525a987a88176c6e5170978e82fa290",
4 |   "sha256": "07l8rfqh95yrdmbxc4pfb77s06k5v65dk3rgdqscqmwchkndrmm0",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/pins/tests-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/ethereum/tests",
3 |   "rev": "b8c9b4a6cdce53f340b588bb05458091f0f4c7e1",
4 |   "sha256": "1l9q87n2m2qqs53iacyi0s028sy4n97wwp8dvlrjw4j5d3j6am64",
5 |   "fetchSubmodules": true
6 | }
7 | 


--------------------------------------------------------------------------------
/goguen/release.nix:
--------------------------------------------------------------------------------
1 | { ... }@args:
2 | let
3 |   ## fetch-nixpkgs.nix uses nixpkgs-src.json from its directory,
4 |   ## ..so we have a Goguen-specific pair of those.
5 |   nixpkgsSrc = (import ../lib.nix).goguenNixpkgs;
6 |   nixpkgs    = import (builtins.trace "nixpkgs=${nixpkgsSrc}" nixpkgsSrc) {};
7 |   goguenPkgs = import ./. (args // { pkgs = nixpkgs; });
8 | in goguenPkgs
9 | 


--------------------------------------------------------------------------------
/goguen/remix-ide.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , getSrc
 3 | , trimmed-solc-bin
 4 | , pkgs
 5 | }:
 6 | 
 7 | with pkgs;
 8 | 
 9 | # solcBin is huge, and we actually don't need all of it We just need
10 | # to be careful that if we leave versions of solidity.js out, we
11 | # update `list.json` accordingly.
12 | stdenv.mkDerivation rec {
13 |   name = "remix-ide";
14 |   src  = getSrc name;
15 | 
16 |   buildInputs = [ nodejs-8_x git cacert python wget ];
17 | 
18 |   patches = [
19 |     ./remix-ide.patch
20 |   ];
21 | 
22 |   configurePhase = ''
23 |     export HOME="$NIX_BUILD_TOP"
24 |     npm install
25 |   '';
26 | 
27 |   buildPhase = ''
28 |     npm run linkremixcore
29 |     npm run linkremixlib
30 |     npm run linkremixsolidity
31 |     npm run build
32 |   '';
33 | 
34 |   installPhase = ''
35 |     mv build $out
36 | 
37 |     ln -s ${trimmed-solc-bin} $out/solc-bin
38 | 
39 |     cp -r index.html soljson.js assets $out/
40 |     substituteInPlace $out/index.html \
41 |       --replace "build/app.js" "app.js" \
42 |       --replace "UA-XXXXXXXXX-X" "UA-119953429-5"
43 |   '';
44 | }
45 | 


--------------------------------------------------------------------------------
/goguen/sbt-verify.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , getSrc
 3 | , scala
 4 | , sbt
 5 | }:
 6 | 
 7 | stdenv.mkDerivation rec {
 8 |   name = "sbt-verify";
 9 |   src  = getSrc name;
10 | 
11 |   buildInputs = [ scala sbt ];
12 | 
13 |   configurePhase = ''
14 |     export HOME="$NIX_BUILD_TOP"
15 |     export "_JAVA_OPTIONS=-Dsbt.global.base=.sbt/1.0 -Dsbt.ivy.home=.ivy"
16 |   '';
17 | 
18 |   buildPhase = "
19 |     sbt publishLocal
20 |   ";
21 | 
22 |   installPhase = ''
23 |     mkdir $out
24 |     cp -r .ivy .sbt target $out
25 |   '';
26 | }
27 | 


--------------------------------------------------------------------------------
/goguen/secp256k1.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , autoreconfHook
 3 | , getSrc
 4 | }:
 5 | 
 6 | stdenv.mkDerivation rec {
 7 |   name = "secp256k1";
 8 |   src  = getSrc name;
 9 | 
10 |   buildInputs = [ autoreconfHook ];
11 | 
12 |   configurePhase = ''
13 |     ./configure --enable-module-recovery --enable-module-ecdh --enable-experimental --prefix $lib
14 |   '';
15 | 
16 |   doCheck = true;
17 |   checkPhase = "./tests";
18 | 
19 |   outputs = [ "out" "lib" ];
20 | }
21 | 


--------------------------------------------------------------------------------
/goguen/solidity-service.nix:
--------------------------------------------------------------------------------
1 | { getSrc
2 | , solidity
3 | , iele-semantics
4 | , callPackage
5 | }:
6 | 
7 | (callPackage (getSrc "solidity-service") { inherit solidity; iele = iele-semantics; })."solidity-service"
8 | 


--------------------------------------------------------------------------------
/goguen/solidity.nix:
--------------------------------------------------------------------------------
 1 | { pkgs
 2 | , iele-semantics
 3 | , getSrc
 4 | }:
 5 | 
 6 | pkgs.gccStdenv.mkDerivation rec {
 7 |   name = "solidity";
 8 |   src  = getSrc name;
 9 | 
10 |   buildInputs = with pkgs; [
11 |     cmake
12 |     llvm
13 |     (boost.override { enableStatic = true; })
14 |     libtool
15 |     autoconf
16 |     automake
17 |     z3
18 |     makeWrapper
19 |   ];
20 | 
21 |   patches = [ ./solidity.patch ];
22 | 
23 |   configurePhase = ''
24 |     export NIX_CFLAGS_COMPILE="-Wno-error=maybe-uninitialized $NIX_CFLAGS_COMPILE"
25 |     mkdir build
26 |     cd build
27 |     cmake ..
28 |   '';
29 | 
30 |   installPhase = ''
31 |     mkdir -p $out/bin
32 |     ls solc/
33 |     mv solc/isolc $out/bin/
34 |     wrapProgram $out/bin/isolc --prefix PATH : ${pkgs.lib.makeBinPath [ iele-semantics ]}
35 |   '';
36 | }
37 | 


--------------------------------------------------------------------------------
/goguen/solidity.patch:
--------------------------------------------------------------------------------
1 | diff --git a/commit_hash.txt b/commit_hash.txt
2 | new file mode 100644
3 | index 00000000..ba139829
4 | --- /dev/null
5 | +++ b/commit_hash.txt
6 | @@ -0,0 +1 @@
7 | +124ca40dc525a987a88176c6e5170978e82fa290
8 | 


--------------------------------------------------------------------------------
/goguen/stack.patch:
--------------------------------------------------------------------------------
 1 | diff --git a/src/Stack/Config/Nix.hs b/src/Stack/Config/Nix.hs
 2 | index 04243ceaa..00307cee3 100644
 3 | --- a/src/Stack/Config/Nix.hs
 4 | +++ b/src/Stack/Config/Nix.hs
 5 | @@ -27,8 +27,7 @@ nixOptsFromMonoid
 6 |      -> OS
 7 |      -> RIO env NixOpts
 8 |  nixOptsFromMonoid NixOptsMonoid{..} os = do
 9 | -    let nixEnable0 = fromFirst False nixMonoidEnable
10 | -        defaultPure = case os of
11 | +    let defaultPure = case os of
12 |            OSX -> False
13 |            _ -> True
14 |          nixPureShell = fromFirst defaultPure nixMonoidPureShell
15 | @@ -38,14 +37,14 @@ nixOptsFromMonoid NixOptsMonoid{..} os = do
16 |                            ++ prefixAll (T.pack "-I") (fromFirst [] nixMonoidPath)
17 |          nixAddGCRoots   = fromFirst False nixMonoidAddGCRoots
18 |  
19 | +    -- Enable Nix-mode by default on NixOS, unless Docker-mode was specified
20 |      osIsNixOS <- isNixOS
21 | +    let nixEnable0 = fromFirst osIsNixOS nixMonoidEnable
22 | +
23 |      nixEnable <- case () of _
24 |                                  | nixEnable0 && osIsWindows -> do
25 |                                        logInfo "Note: Disabling nix integration, since this is being run in Windows"
26 |                                        return False
27 | -                                | not nixEnable0 && osIsNixOS -> do
28 | -                                      logInfo "Note: Enabling Nix integration, as it is required under NixOS"
29 | -                                      return True
30 |                                  | otherwise                 -> return nixEnable0
31 |  
32 |      when (not (null nixPackages) && isJust nixInitFile) $
33 | diff --git a/stack.yaml b/stack.yaml
34 | index 5808aa6e0..e6696b14e 100644
35 | --- a/stack.yaml
36 | +++ b/stack.yaml
37 | @@ -9,7 +9,6 @@ resolver: lts-11.6
38 |  #       name: "fpco/stack-test"
39 |  nix:
40 |    # --nix on the command-line to enable.
41 | -  enable: false
42 |    packages:
43 |      - zlib
44 |      - unzip
45 | 


--------------------------------------------------------------------------------
/goguen/trimmed-solc-bin.nix:
--------------------------------------------------------------------------------
 1 | { stdenv
 2 | , pkgs
 3 | , getSrc
 4 | }:
 5 | 
 6 | with pkgs;
 7 | 
 8 | stdenv.mkDerivation rec {
 9 |     name = "solc-bin";
10 |     src  = getSrc name;
11 |     buildInputs = [ jq ];
12 |     buildPhase = ''
13 |       echo "source size:"
14 |       du --max-depth=1 $src
15 |     '';
16 |     installPhase = ''
17 |       mkdir -p $out/bin
18 | 
19 |       SOLC_VERSION=$(jq .latestRelease $src/bin/list.json)
20 |       SOLC_PATH=$(jq -r .releases.$SOLC_VERSION $src/bin/list.json)
21 |       jq ".releases |= with_entries(select(.key == $SOLC_VERSION)) | .builds |= del(.[] | select(.path != \"$SOLC_PATH\"))"  $src/bin/list.json > $out/bin/list.json
22 |       cp $src/bin/$SOLC_PATH $out/bin/
23 |       du --max-depth=1 $out/bin/
24 |     '';
25 | }
26 | 


--------------------------------------------------------------------------------
/goguen/update-nixpkgs-pin.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | usage() {
 3 |         printf 'Usage: USER [REPO] [REV]  Pin a Github REPO to USER/REV,\n  Defaults: REPO=nixpkgs, REV=HEAD-if-CWD-is-nixpkgs' >&2
 4 |         exit 1
 5 | }
 6 | set -eu
 7 | 
 8 | jq="$(nix-build --no-build-output --no-out-link '<nixpkgs>' -A jq)/bin/jq"
 9 | nixroot="$(realpath "$0" | xargs dirname)"
10 | cwdRepo="$(basename "$(pwd)")"
11 | 
12 | repo=${1:-'nixpkgs'}
13 | git_rev=${2:-$(if test "${cwdRepo}" = "${repo}"; then git rev-parse HEAD; fi)}
14 | test -n "${git_rev}" || usage
15 | 
16 | repo_pin_file="${nixroot}"/pins/${repo}-src.json
17 | repo_url=$(${jq} '.url' < "${repo_pin_file}" | xargs echo)
18 | url=${repo_url}"/archive/"${git_rev}.tar.gz
19 | 
20 | tmp="$(mktemp update-pin.XXXXXXXX)"
21 | cleanup() {
22 |         rm -f "${tmp}"
23 | }
24 | trap cleanup EXIT
25 | 
26 | cat >&2 <<EOF
27 | -- Updating Nix pin for ${repo} to:  ${git_rev}
28 | -- Snapshot URL:  ${url}
29 | EOF
30 | new_sha256=$(nix-prefetch-url --unpack --type sha256 "${url}")
31 | test -n "${new_sha256}" || {
32 |         echo "ERROR:  failed to hash ${url}, is ${git_rev} valid for ${repo_url}?" >&2
33 |         exit 1
34 | }
35 | ${jq} ".rev=\"${git_rev}\" | .sha256=\"${new_sha256}\"" < "${repo_pin_file}" | tee "${tmp}"
36 | 
37 | if test -n "$(cat "${tmp}")"
38 | then mv "${tmp}" "${nixroot}/pins/${repo}-src.json"
39 | else echo "ERROR:  pin update failed" >&2; rm -f "${tmp}"; exit 1
40 | fi
41 | 


--------------------------------------------------------------------------------
/iohk-nix.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/iohk-nix",
3 |   "rev": "25225e9e23d8fe73663c1e958d41d481b0a4e0f0",
4 |   "sha256": "14ab3z1rdzid6mlqfz3sswhvjqn598q6cg8w6ycbs9v8s0jvlzj3",
5 |   "fetchSubmodules": false
6 | }
7 | 


--------------------------------------------------------------------------------
/iohk/Setup.hs:
--------------------------------------------------------------------------------
1 | import Distribution.Simple
2 | main = defaultMain
3 | 


--------------------------------------------------------------------------------
/iohk/amazonka-content-length.patch:
--------------------------------------------------------------------------------
 1 | From 8d1e61900eed6352d5cbf2eb56e649c1f58f41d6 Mon Sep 17 00:00:00 2001
 2 | From: David Turnbull <david@broodax.net>
 3 | Date: Thu, 19 Sep 2019 17:06:20 +1000
 4 | Subject: [PATCH] remove the content-length header when doing V4 streaming
 5 |  signatures
 6 | 
 7 | ---
 8 |  src/Network/AWS/Sign/V4/Base.hs | 1 +
 9 |  1 file changed, 1 insertion(+)
10 | 
11 | diff --git a/src/Network/AWS/Sign/V4/Base.hs b/src/Network/AWS/Sign/V4/Base.hs
12 | index 8e0714444b..5f5a3507a0 100644
13 | --- a/src/Network/AWS/Sign/V4/Base.hs
14 | +++ b/src/Network/AWS/Sign/V4/Base.hs
15 | @@ -267,3 +267,4 @@ normaliseHeaders = Tag
16 |      . nubBy  ((==)    `on` fst)
17 |      . sortBy (compare `on` fst)
18 |      . filter ((/= "authorization") . fst)
19 | +    . filter ((/= "content-length") . fst)
20 | 


--------------------------------------------------------------------------------
/iohk/common/Cardano.hs:
--------------------------------------------------------------------------------
 1 | {-# OPTIONS_GHC -Weverything -Wno-unsafe -Wno-implicit-prelude #-}
 2 | {-# LANGUAGE DeriveGeneric #-}
 3 | 
 4 | module Cardano (
 5 |   ConfigurationYaml,
 6 |   ConfigurationRoot,
 7 |   ConfigurationUpdate,
 8 |   applicationVersion,
 9 |   update
10 | ) where
11 | 
12 | import           Data.Aeson          (FromJSON)
13 | import qualified Data.HashMap.Strict as HashMap
14 | import qualified Data.Text           as T
15 | import           GHC.Generics        (Generic)
16 | 
17 | type ConfigurationYaml = HashMap.HashMap T.Text ConfigurationRoot
18 | 
19 | data ConfigurationRoot = ConfigurationRoot {
20 |     update :: ConfigurationUpdate
21 |   } deriving (Show, Generic, Eq)
22 | 
23 | data ConfigurationUpdate = ConfigurationUpdate {
24 |     applicationVersion :: Int
25 |   } deriving (Show, Generic, Eq)
26 | 
27 | instance FromJSON ConfigurationRoot
28 | instance FromJSON ConfigurationUpdate
29 | 


--------------------------------------------------------------------------------
/iohk/common/CommandLineUtils.hs:
--------------------------------------------------------------------------------
 1 | module CommandLineUtils
 2 |   ( filePathOption
 3 |   , directoryOption
 4 |   ) where
 5 | 
 6 | -- TODO: DEVOPS-1066 clean up command line option parsing and fix various issues.
 7 | 
 8 | import Prelude hiding (FilePath)
 9 | import Options.Applicative
10 | import qualified Filesystem.Path.CurrentOS        as Path
11 | import Filesystem.Path (FilePath)
12 | import Data.Semigroup ((<>))
13 | 
14 | filePathOption :: Mod OptionFields FilePath -> Parser FilePath
15 | filePathOption = completeFileOption "file"
16 | 
17 | directoryOption :: Mod OptionFields FilePath -> Parser FilePath
18 | directoryOption = completeFileOption "directory"
19 | 
20 | -- | Make an option modifier which as a bash completion action.
21 | -- Actions are listed in:
22 | -- https://www.gnu.org/software/bash/manual/html_node/Programmable-Completion-Builtins.html#Programmable-Completion-Builtins
23 | completeFileOption :: String -> Mod OptionFields FilePath -> Parser FilePath
24 | completeFileOption act mods = option (Path.decodeString <$> str) (mods <> comp)
25 |   where comp = completer (bashCompleter act)
26 | 


--------------------------------------------------------------------------------
/iohk/default.nix:
--------------------------------------------------------------------------------
 1 | { mkDerivation, aeson, aeson-pretty, amazonka, amazonka-s3
 2 | , ansi-terminal, base, bytestring, cassava, containers, cryptonite
 3 | , directory, dns, errors, exceptions, foldl, hourglass, hspec
 4 | , http-client, http-client-tls, http-conduit, http-types, lens
 5 | , lens-aeson, managed, memory, mtl, network-uri, optional-args
 6 | , optparse-applicative, process, resourcet, safe, stdenv
 7 | , system-filepath, text, time, turtle, unordered-containers
 8 | , utf8-string, vector, yaml
 9 | }:
10 | mkDerivation {
11 |   pname = "iohk-ops";
12 |   version = "0.1.0.0";
13 |   src = ./.;
14 |   isLibrary = true;
15 |   isExecutable = true;
16 |   libraryHaskellDepends = [
17 |     aeson aeson-pretty amazonka amazonka-s3 ansi-terminal base
18 |     bytestring cassava containers cryptonite directory dns errors
19 |     exceptions foldl hourglass http-client http-client-tls http-conduit
20 |     http-types lens lens-aeson memory network-uri optional-args
21 |     optparse-applicative resourcet safe system-filepath text turtle
22 |     unordered-containers utf8-string vector yaml
23 |   ];
24 |   executableHaskellDepends = [
25 |     aeson base bytestring containers foldl hourglass hspec managed
26 |     optional-args optparse-applicative process system-filepath text
27 |     time turtle unordered-containers yaml
28 |   ];
29 |   testHaskellDepends = [
30 |     aeson base bytestring foldl hspec mtl optparse-applicative process
31 |     system-filepath text time turtle unordered-containers yaml
32 |   ];
33 |   license = stdenv.lib.licenses.bsd3;
34 | }
35 | 


--------------------------------------------------------------------------------
/iohk/shell.nix:
--------------------------------------------------------------------------------
1 | let
2 |   pkgs = import ../. {};
3 | in pkgs.iohk-ops.env
4 | 


--------------------------------------------------------------------------------
/iohk/test/AppveyorSpec.hs:
--------------------------------------------------------------------------------
 1 | {-# LANGUAGE OverloadedStrings #-}
 2 | 
 3 | module AppveyorSpec (spec, main) where
 4 | 
 5 | import Test.Hspec
 6 | import qualified Data.ByteString.Lazy as LBS
 7 | import Data.Aeson
 8 | import Data.HashMap.Strict
 9 | import Appveyor
10 | 
11 | main :: IO ()
12 | main = hspec spec
13 | 
14 | sampleTravisYml :: LBS.ByteString
15 | sampleTravisYml = "env:\n  global:\n    - VERSION=0.6\n    - CARDANO_SL_BRANCH=cardano-sl-0.6\n    - secure: \"ciphertext\"\n"
16 | 
17 | artifactJson :: LBS.ByteString
18 | artifactJson = encode $ Object (fromList [("fileName", "installer.exe"), ("name", "windows installer")])
19 | 
20 | spec :: Spec
21 | spec = do
22 |   describe "Appveyor" $ do
23 |     it "AppveyorArtifact parse" $ do
24 |       (decode artifactJson :: Maybe AppveyorArtifact) `shouldBe` Just (AppveyorArtifact "installer.exe" "windows installer")
25 | 
26 | 


--------------------------------------------------------------------------------
/iohk/test/BuildkiteSpec.hs:
--------------------------------------------------------------------------------
 1 | {-# LANGUAGE OverloadedStrings #-}
 2 | 
 3 | module BuildkiteSpec (spec, main) where
 4 | 
 5 | import           Buildkite.Pipeline
 6 | import           Data.ByteString     (ByteString)
 7 | import qualified Data.HashMap.Strict as HM
 8 | import qualified Data.Yaml           as Y
 9 | import           Test.Hspec
10 | 
11 | main :: IO ()
12 | main = hspec spec
13 | 
14 | samplePipelineYml :: ByteString
15 | samplePipelineYml = "steps:\n  - label: 'daedalus-x86_64-darwin'\n    command: 'scripts/nix-shell.sh --run \"scripts/build-installer-unix.sh $VERSION $CARDANO_SL_BRANCH  --build-id $BUILDKITE_BUILD_NUMBER --pr-id $BUILDKITE_PULL_REQUEST\"'\n    env:\n      VERSION: 0.8.2\n      CARDANO_SL_BRANCH: release/1.0.4\n      NIX_SSL_CERT_FILE: /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt\n    agents:\n      system: x86_64-darwin\n"
16 | 
17 | samplePipeline :: PipelineDefinition
18 | samplePipeline = PipelineDefinition
19 |   { plEnv = HM.fromList []
20 |   , plSteps = [ CommandStep
21 |                 { stepLabel = Just "daedalus-x86_64-darwin"
22 |                 , stepCommand = ["scripts/nix-shell.sh --run \"scripts/build-installer-unix.sh $VERSION $CARDANO_SL_BRANCH  --build-id $BUILDKITE_BUILD_NUMBER --pr-id $BUILDKITE_PULL_REQUEST\""]
23 |                 , stepEnv = HM.fromList
24 |                   [ ("CARDANO_SL_BRANCH","release/1.0.4")
25 |                   , ("NIX_SSL_CERT_FILE","/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt")
26 |                   , ("VERSION","0.8.2") ]
27 |                 , stepAgents = HM.fromList [("system", "x86_64-darwin")]
28 |                 }
29 |               ]
30 |   }
31 | 
32 | spec :: Spec
33 | spec =
34 |   describe "Pipeline YAML Parsing" $
35 |     it "works with a typical pipeline" $ do
36 |       Y.decodeEither samplePipelineYml `shouldBe` Right samplePipeline
37 | 


--------------------------------------------------------------------------------
/iohk/test/Spec.hs:
--------------------------------------------------------------------------------
1 | {-# OPTIONS_GHC -F -pgmF hspec-discover #-}
2 | 


--------------------------------------------------------------------------------
/iohk/update.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | 
3 | cabal2nix . > default.nix
4 | 


--------------------------------------------------------------------------------
/jobsets/cardano.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   fixedNixpkgs = (import ../lib.nix).nixpkgs;
 3 | in { pkgs ? (import fixedNixpkgs {})
 4 |    , supportedSystems ? [ "x86_64-linux" "x86_64-darwin" ]
 5 |    , scrubJobs ? true
 6 |    }:
 7 | 
 8 | with import (fixedNixpkgs + "/pkgs/top-level/release-lib.nix") { inherit supportedSystems scrubJobs; packageSet = import ../.; };
 9 | 
10 | let
11 |   iohkpkgs = import ../. { inherit pkgs; };
12 |   jobs = mapTestOn ((packagePlatforms iohkpkgs) // {
13 |     iohk-ops = [ "x86_64-linux" ];
14 |     iohk-ops-integration-test = [ "x86_64-linux" ];
15 |     nixops = [ "x86_64-linux" ];
16 |   });
17 |   cardanoSrc = pkgs.fetchgit cardano-sl-src;
18 |   cardano-sl-src = builtins.fromJSON (builtins.readFile ./../cardano-sl-src.json);
19 |   cardanoRelease = import "${cardanoSrc}/release.nix" {
20 |     cardano = {
21 |       outPath = cardanoSrc;
22 |       rev = cardano-sl-src.rev;
23 |     };
24 |   };
25 |   tests = import ../tests {
26 |     inherit pkgs;
27 |     supportedSystems = [ "x86_64-linux" ];
28 |   };
29 | in pkgs.lib.fix (jobsets: {
30 |   inherit (jobs) iohk-ops iohk-ops-integration-test nixops;
31 |   inherit (iohkpkgs) checks IFDPins cachecache;
32 |   inherit tests;
33 |   exchange-monitor = pkgs.callPackage ../modules/exchange-monitor {};
34 |   required = pkgs.lib.hydraJob (pkgs.releaseTools.aggregate {
35 |     name = "iohk-ops-required-checks";
36 |     constituents =
37 |       let
38 |         all = x: map (system: x.${system}) supportedSystems;
39 |     in [
40 |       jobsets.iohk-ops.x86_64-linux
41 |       (builtins.attrValues jobsets.tests)
42 |       (builtins.attrValues jobsets.checks)
43 |     ];
44 |   });
45 |   nix-darwin = {
46 |     ci = (import ../nix-darwin/test.nix { role = "ci"; host = "build"; port = "123"; }).system;
47 |   };
48 | })
49 | 


--------------------------------------------------------------------------------
/jobsets/pr-excluded-labels.nix:
--------------------------------------------------------------------------------
1 | [ "hydra-dont-build" ]
2 | 


--------------------------------------------------------------------------------
/jobsets/simple-pr-dummy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "42": {
 3 |     "base": {
 4 |       "repo": {
 5 |         "clone_url": "https://github.com/user/project.git"
 6 |       }
 7 |     },
 8 |     "head": {
 9 |       "ref": "pr-branch",
10 |       "repo": {
11 |         "name": "reponame",
12 |         "owner": {
13 |           "login": "githubuser"
14 |         }
15 |       }
16 |     },
17 |     "title": "Pull request title"
18 |   },
19 |   "30031": {
20 |     "base": {
21 |       "repo": {
22 |         "clone_url": "https://github.com/user/project.git"
23 |       }
24 |     },
25 |     "head": {
26 |       "ref": "pr-branch",
27 |       "repo": {
28 |         "name": "reponame",
29 |         "owner": {
30 |           "login": "githubuser"
31 |         }
32 |       }
33 |     },
34 |     "labels": [
35 |       {
36 |         "color": "006b75",
37 |         "default": false,
38 |         "id": 692360873,
39 |         "name": "hydra-dont-build",
40 |         "url": "https://api.github.com/repos/input-output-hk/cardano-sl/labels/hydra-dont-build"
41 |       }
42 |     ],
43 |     "title": "Pull request title"
44 |   }
45 | }
46 | 


--------------------------------------------------------------------------------
/lib/gpg-keys/ben.ford.base64:
--------------------------------------------------------------------------------
 1 | mQENBFrpdZQBCADchUOsfqCtm96QF0q9JUJwRc38NyCP97qfMzTJKpLCGbJneL47Ei9XjTE4AR67
 2 | d3HFQfy3dczyVu57hyHkw7OFNjMRuAgMA0yDjo1wbEghHFVr6KdVtZ90PjkTbC4ztWqUP5hL76pX
 3 | JAptBqypZ+3veOi1DmSdB6JxMhrFdJ41P8/9TOJtKImVHQH+ykj0aDoCnYcBP4lkga1ImVNjCRyS
 4 | r6hw5Eg1ul2sO/sCGR/IWxegWELdQwHstFIX6vsvA1cMt7wjTJp91xXRfDglxcsU8f+bvIxoMF8c
 5 | Vt4WaBLD0zYgGXx8I/nFtlH2//q8rvzZ4JLJJDScdTohkn3asGkPABEBAAG0HkJlbiBGb3JkIDxi
 6 | ZW5AY29tbWFuZG9kZXYuY29tPokBTgQTAQgAOBYhBKxGXMrx+zuJsB0kaRYGI0H/WDbfBQJa6XWU
 7 | AhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEBYGI0H/WDbf51QIAKMq6sPtQsljj7iUxJ1k
 8 | 5of1p+0gSI/yqnZpFoUM4tbaH1B4b8CbUOUbsIo1YbxsYLdG3F74qJqpdChCHw3KFnq7aQ9kboNC
 9 | NL42/GEsbrENEAn/AQRuftVIhavZEWaYjkNON00QAheeXKQUcieb5XK5Wob8PuCIs0VBCWyaA8RK
10 | zGgfW00wnRMmOXxoY8VSb7ixbTcaBNGEJM2RBmigWhKE25cULYZSy57FoB5gGvNANtOmLTTbHCGw
11 | Kz7MJM/FLfBAe27Dj6pAr3pbvKgyUNcwgMtuXg53sjzdcYiQ3fXazzQJreNSWfRrk0IUQEaV2O9j
12 | hn8mMDBUnmFyZFMzfAq5AQ0EWul1lAEIANELz3i1RoxhPh/mAtNLIT1gmYX/WOe9W+/yJEfWMlJM
13 | oPipbY1CbgAGsE+1A7kqqeC6XFe4M2gAv40yP5iP5kKrIv5doyaAZIViXEYrSxA/mQ8Y9RPT+0ap
14 | wX1LaQBIUuYSIPe8iHUUMAf2UydszLDsgHXfKEmgiddtDDx8+Pn5tYDePIbXXkRhlE2RR/SQsJh8
15 | O77l3NHGmuP78vWBqY2fieuxyY5oirU4ET+OgTKBWs19lrYaqcqBJVnFK6WEKLRctrF8+XGa74Z1
16 | V6+VC3RAxvwzLQRh6rCZ3tFBTAVXUBDOyJBkCIpxBTlVzMDfTSUP0KWHSI5MoM2nn+ZZS78AEQEA
17 | AYkBNgQYAQgAIBYhBKxGXMrx+zuJsB0kaRYGI0H/WDbfBQJa6XWUAhsMAAoJEBYGI0H/WDbfptMI
18 | ANc6nKpzCj8+SJQIbf3p0ZzCQ9boeIzpzSO3l8KZlBFHdJ+MGWNaKlkjN8K8FU/yykwmUrZWHYQD
19 | 3ufoSV9Lqvoumav8vtpT58HZ5FlbgrbA0WmflW+ASsE5973NqvcOkyOe5BzICdnqheoQwhSUVWGy
20 | Oh3LlvduORkK6fKE9W2mA4qW5YVtPoS2zhpdktmEADZoU1PPZnhn3VOtiML8T3CykpgmiHiRWy3U
21 | f1rE/zPUyVNOwi5tcyCO+NckDy/E8Q76qhvlG+knwTb2rj8IXYp7nenmuT1EKdp06IPsggu9SHw3
22 | pkya0It9SiFd3k4R6xWrzR4e0Ua/07WV/a/ExzU=


--------------------------------------------------------------------------------
/lib/gpg-keys/deployer.base64:
--------------------------------------------------------------------------------
 1 | mQENBFsDCQIBCADwBX+FIv+EH2y0nF+JmbQVvH2zfmA0bioUaXhmL3sDVXldrXnvfKujYhgyJk4q
 2 | 0P6iaS+YKPLqn7GW6q3S056Wx8L6PRYE05zzGz/LFguqZFuOjitQ5zKWVKskfQo5zkfOsljX0iq5
 3 | RRTpVFOdgV/3Ak0hMZcgQOMVSdzYbpMVmVEIzgCWdjq0sbj2UhPNyMKsMSlyiPS20GPMDQ6LoS8H
 4 | u56/9r5fPQt4LFew2Mxu4q7FaaPkDUGksFCsIm77IyOymwhZtmYW44a4A20r2rlgkmyyN2D/vT2z
 5 | AzO5fsnUDrFlrDotJcGU3afIsjrpBnASE+bH+0yIu2WefRMOfu+bABEBAAG0IVRlc3RuZXQgRGVw
 6 | bG95ZXIgPGRldm9wc0Bpb2hrLmlvPokBTgQTAQgAOBYhBKNziCjvONK5zldTjGfFJfdBYYYvBQJb
 7 | AwkCAhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEGfFJfdBYYYvHBAIALzLDKpSixLOCfby
 8 | DZHwm+/g/FMENEWCvZ90jhOht2ptpM+VXTGLLZH9G7uKFyat/dJWge3ynZP/Qga1D3Saeq/fEQuq
 9 | tYIbd7bZotkBott1kXl/zPrQNO8t8emP+rXe5aUUwfvpr/9xmWUtt9zRNpgH1ewYix47wlwN94mV
10 | XkOt/hviNKSvL2LYDFPKhC/CLPhPYyehFMxH1cF8u9HSrTA5iktgo0GPCpEfbD8qZmh1U7MqFxXg
11 | T1z0Eq9trQ4lNPhmgRSaWdkSzTENJr7/CzILLeBISlQReVhvGwsvs6CCrP/ylJ4DstFBUjHJSWuV
12 | W1JGZ40zx8eDt0LVxhyqTc+5AQ0EWwMJAgEIAKo9Yfhtj3RNje4pTFpY9SeqRYwWDZ2rC6DkL8+R
13 | vPNa0oz7kIKY0XlW1rZ1c6KeSOlqfO8sFIAgvTgoiLCnsU89lMwyWf+m/K0NbYxQYsPBkCxYy8k8
14 | 5QmYcTgryDCMqB7JisF26Jpywk1PvwkBpr0Waj08klGJCIiGfX+f7WwVQA//4aKtqsLh9Sm4lx56
15 | uglD10acZQUS1LcrdohhnU2Puefnr7nUBbzIRjw/YEOF6zt8rP0zBMjN/Egk50JIphqU5CjR+6Lb
16 | bw90G1T58Sl0wk34N+stVo0pwO3DRSYAHVvRG9YWBCDRYT4nU8JtUdHRS67f1YxCgyiabF5xTD0A
17 | EQEAAYkBNgQYAQgAIBYhBKNziCjvONK5zldTjGfFJfdBYYYvBQJbAwkCAhsMAAoJEGfFJfdBYYYv
18 | dlYH/1Nx2K5AvDsSEHjI+Vp4sWmXgkx/xMOYzLzxmFre+oqI0Lk3/eMbmaclHHEBBRw6HShgoSRm
19 | pc/avLLl+aBz4bO4VvhzEPCPoUfjBR7jNNeF/nXuvGRGe67N1wi5eYjUN34zukY/RuVZjjZNO0Um
20 | wY6dV44uzrQHb4neZtWuyWfgyFZJfu6fpW2kczKxexfEqcezxc1TO8CLZ+B6pr8wHU0yfWpBf1ld
21 | Ky7iRFd8hkSUaRDxcQkS7faXr5Kq9YzH3Z9Zdbc+bqPBkkFlX6FLHr4X262jLCAVnOLg1Sw/O/co
22 | uAHkqxDlGjrFzzsHgr+Hj/WoZrfWm/ZwiBFYOYh5gHI=


--------------------------------------------------------------------------------
/lib/users/deployer-users.nix:
--------------------------------------------------------------------------------
 1 | with (import ../../lib.nix);
 2 | {
 3 |   deployer = {
 4 |     # Heh, did not found a smarter way to
 5 |     # query the user name from somewhere else.
 6 |     name         = "deployer";
 7 |     isNormalUser = true;
 8 |     description  = "Deploy the deployer";
 9 |     group        = "deployers";
10 |     extraGroups  = [ "wheel" ];
11 |     openssh.authorizedKeys.keys = devOpsKeys;
12 |   };
13 | 
14 |   dev = {
15 |       name         = "dev";
16 |       isNormalUser = true;
17 |       description  = "Shared user for develelopment deploys";
18 |       group        = "deployers";
19 |       extraGroups  = [ ];
20 |       openssh.authorizedKeys.keys = devKeys;
21 |   };
22 | }
23 | 


--------------------------------------------------------------------------------
/mainnet-infra.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   IOHKaccessKeyId:
 3 |     tag: NixStr
 4 |     contents: mainnet-iohk
 5 |   CFaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: mainnet-iohk
 8 |   EmurgoaccessKeyId:
 9 |     tag: NixStr
10 |     contents: mainnet-iohk
11 | topology: topology-mainnet-infra.yaml
12 | environment: Production
13 | installer-bucket: stub
14 | name: iohk-infra
15 | files:
16 | - deployments/keypairs.nix
17 | - deployments/infrastructure.nix
18 | - deployments/infrastructure-env-production.nix
19 | - deployments/infrastructure-target-aws.nix
20 | elements:
21 | - Infra
22 | target: AWS
23 | 


--------------------------------------------------------------------------------
/mainnet.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   configurationKey:
 3 |     tag: NixStr
 4 |     contents: mainnet_full
 5 |   EmurgoaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: mainnet-emurgo
 8 |   systemStart:
 9 |     tag: NixInt
10 |     contents: 1506203091
11 |   CFaccessKeyId:
12 |     tag: NixStr
13 |     contents: mainnet-cf
14 |   IOHKaccessKeyId:
15 |     tag: NixStr
16 |     contents: mainnet-iohk
17 |   IOHKroute53accessKeyId:
18 |     tag: NixStr
19 |     contents: mainnet-iohk
20 | gen-cmdline: manual changes from staging-testnet.yaml
21 | environment: Production
22 | topology: topology-production.yaml
23 | installer-bucket:   update-cardano-mainnet.iohk.io
24 | installer-url-base: update-cardano-mainnet.iohk.io
25 | name: mainnet
26 | domain: cardano-mainnet.iohk.io
27 | files:
28 | - deployments/keypairs.nix
29 | - deployments/security-groups.nix
30 | - deployments/cardano-nodes.nix
31 | - deployments/cardano-nodes-env-production.nix
32 | - deployments/cardano-explorer.nix
33 | - deployments/cardano-explorer-env-production.nix
34 | - deployments/monitoring-env-production.nix
35 | - deployments/monitoring-aws.nix
36 | elements:
37 | - Nodes
38 | - Explorer
39 | - Monitoring
40 | nixops: /nix/store/ii82khr2gqg2c0mdaycblssi1as3mp12-nixops-1.6pre0_abcdef/bin/nixops
41 | target: AWS
42 | 


--------------------------------------------------------------------------------
/modules/amazon-base.nix:
--------------------------------------------------------------------------------
 1 | with (import ./../lib.nix);
 2 | 
 3 | { name, config, resources, ... }:
 4 | 
 5 | {
 6 |  deployment.targetEnv = "ec2";
 7 |  deployment.ec2.instanceType = mkDefault "t2.large";
 8 |  deployment.ec2.region  = mkDefault centralRegion;
 9 |  deployment.ec2.keyPair = let keypairName = orgRegionKeyPairName "IOHK" "${config.deployment.ec2.region}";
10 |                           in mkDefault (resources.ec2KeyPairs."${keypairName}");
11 |  deployment.ec2.ebsInitialRootDiskSize = mkDefault 30;
12 |  networking.hostName = mkDefault "${config.deployment.name}.${config.deployment.targetEnv}.${name}";
13 | }
14 | 


--------------------------------------------------------------------------------
/modules/amazon-image.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | with lib;
 4 | 
 5 | {
 6 | 
 7 |   imports =
 8 |     [ <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix>
 9 |       <nixpkgs/nixos/modules/virtualisation/amazon-image.nix>
10 |       ({ ec2.hvm = true; })
11 |     ];
12 | 
13 |   system.build.amazonImage = import <nixpkgs/nixos/lib/make-disk-image.nix> {
14 |     inherit lib config;
15 |     pkgs = import <nixpkgs> { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
16 |     partitioned = config.ec2.hvm;
17 |     diskSize = 6144;
18 |     format = "qcow2";
19 |     configFile = pkgs.writeText "configuration.nix"
20 |       ''
21 |         {
22 |           imports = [ <nixpkgs/nixos/modules/virtualisation/amazon-image.nix> ];
23 |           ${optionalString config.ec2.hvm ''
24 |             ec2.hvm = true;
25 |           ''}
26 |         }
27 |       '';
28 |   };
29 | 
30 | }
31 | 


--------------------------------------------------------------------------------
/modules/amis.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   eu-central-1 = "ami-2869bb47";
 3 |   eu-west-1 = "ami-cccecaaa";
 4 |   eu-west-2 = "ami-a9d9cdcd";
 5 |   ap-southeast-1 = "ami-cc5de4af";
 6 |   ap-southeast-2 = "ami-762f2615";
 7 |   ap-northeast-1 = "ami-5938173e";
 8 |   ap-northeast-2 = "ami-8915c7e7";
 9 | }
10 | 


--------------------------------------------------------------------------------
/modules/auto-gc.nix:
--------------------------------------------------------------------------------
 1 | { pkgs, config, lib, ... }:
 2 | let
 3 |   cfg = config.services.auto-gc;
 4 | in {
 5 |   options = {
 6 |     services.auto-gc = {
 7 |       nixAutoMaxFreedGB = lib.mkOption {
 8 |         type = lib.types.int;
 9 |         default = 110;
10 |         description = "An absolute amount to free at";
11 |       };
12 | 
13 |       nixAutoMinFreeGB = lib.mkOption {
14 |         type = lib.types.int;
15 |         default = 30;
16 |         description = "The minimum amount to trigger a GC at";
17 |       };
18 | 
19 |       nixAbsoluteTimedGB = lib.mkOption {
20 |         type = lib.types.int;
21 |         default = 25;
22 |         description = "The max absolute level to free to on the /nix/store mount for the timed GC";
23 |       };
24 |     };
25 |   };
26 |   config = {
27 |     nix = {
28 |       gc = {
29 |         automatic = true;
30 |         dates = "*:15:00";
31 | 
32 |         # Set the max absolute level to free to nixAbsoluteTimedGB on the /nix/store mount
33 |         options = ''--max-freed "$((${toString cfg.nixAbsoluteTimedGB} * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
34 |       };
35 | 
36 |       # This GC is run automatically by nix-build
37 |       extraOptions = ''
38 |         # Try to ensure between ${toString cfg.nixAutoMinFreeGB}G and ${toString cfg.nixAutoMaxFreedGB}G of free space by
39 |         # automatically triggering a garbage collection if free
40 |         # disk space drops below a certain level during a build.
41 |         min-free = ${toString (cfg.nixAutoMinFreeGB * 1024 * 1024 * 1024)}
42 |         max-free = ${toString (cfg.nixAutoMaxFreedGB * 1024 * 1024 * 1024)}
43 |       '';
44 |     };
45 |   };
46 | }
47 | 


--------------------------------------------------------------------------------
/modules/cachecache.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | with lib;
 4 | 
 5 | let
 6 |   cfg = config.services.cachecache;
 7 |   iohkops = import ../. { inherit pkgs; };
 8 | in {
 9 |   options = {
10 |     services.cachecache.enable = mkEnableOption "enable cachecache";
11 |   };
12 |   config = mkIf cfg.enable {
13 |     users.users.cachecache = {
14 |       home = "/var/lib/cachecache";
15 |       isSystemUser = true;
16 |       createHome = true;
17 |     };
18 |     systemd.services.cachecache = {
19 |       wantedBy = [ "multi-user.target" ];
20 |       path = [ iohkops.cachecache ];
21 |       script = ''
22 |         exec cachecache
23 |       '';
24 |       serviceConfig = {
25 |         User = "cachecache";
26 |         WorkingDirectory = config.users.users.cachecache.home;
27 |       };
28 |     };
29 |   };
30 | }
31 | 


--------------------------------------------------------------------------------
/modules/cardano-base.nix:
--------------------------------------------------------------------------------
 1 | with import ../lib.nix;
 2 | 
 3 | { pkgs, nodes, config, resources, options, ...}:
 4 | 
 5 | {
 6 |     imports = [
 7 |       ./common.nix
 8 |       ./amazon-base.nix
 9 |       ./network-wide.nix
10 |     ];
11 | 
12 |     global.organisation = config.params.org;
13 | 
14 |     services.dnsmasq.enable = true;
15 |     services.dnsmasq.servers = [ "127.0.0.1" ];
16 | 
17 |     # TODO: DEVOPS-8
18 |     #deployment.ec2.ami = (import ./amis.nix).${config.deployment.ec2.region};
19 |     deployment.ec2.region         = mkForce config.params.region;
20 |     deployment.ec2.zone           = mkForce config.params.zone;
21 |     deployment.ec2.accessKeyId    = config.params.accessKeyId;
22 |     deployment.ec2.keyPair        = resources.ec2KeyPairs.${config.params.keyPairName};
23 |     deployment.ec2.securityGroups =
24 |       with config.params;
25 |       let sgNames =
26 |            optionals typeIsExplorer              [ "allow-to-explorer-${config.params.region}" ]
27 |         ++ optionals typeIsFaucet                [ "allow-to-faucet-${config.params.region}" ]
28 |         ++ optionals typeIsCore                  [ "allow-cardano-static-peers-${config.params.name}-${config.params.region}-${config.params.org}" ]
29 |         ++ optionals typeIsRelay                 [ "allow-kademlia-public-udp-${config.params.region}"
30 |                                                    "allow-cardano-public-tcp-${config.params.region}" ]
31 |         ++ optionals typeIsMonitoring            [ "allow-monitoring-static-peers-${config.params.region}-${config.params.org}" ]
32 |         ++ optionals config.global.enableEkgWeb  [ "allow-ekg-public-tcp-${config.params.region}-${config.params.org}" ];
33 |       in map (resolveSGName resources)
34 |              (if config.global.omitDetailedSecurityGroups
35 |               then [ "allow-all-${config.params.region}-${config.params.org}" ]
36 |               else sgNames);
37 | 
38 |   }
39 | 


--------------------------------------------------------------------------------
/modules/cardano-benchmark.nix:
--------------------------------------------------------------------------------
 1 | with (import ./../lib.nix);
 2 | 
 3 | { pkgs, config, resources, options, ...}:
 4 | 
 5 | let
 6 |   cfg = config.services.cardano-benchmark;
 7 |   iohkpkgs = import ../. {};
 8 |   # relies on the commits cleverca22 made in https://github.com/input-output-hk/cardano-sl/commits/6d83230489ff70985ffd6b7c785286d7535566c4
 9 |   params = index: {
10 |     topologyFile = cfg.topologyFile;
11 |     walletListen = "127.0.0.1:${toString (8090 + index)}";
12 |     ekgListen = "127.0.0.1:${toString (8000 + index)}";
13 |     environment = "override";
14 |     confKey = cfg.configKey;
15 |     extraParams = "--system-start ${toString cfg.systemStart}";
16 |   };
17 |   mkService = index: {
18 |     "cardano-node-${toString index}" = {
19 |       wantedBy = [ "multi-user.target" ];
20 |       serviceConfig = {
21 |         User = "cardano-node-${toString index}";
22 |         WorkingDirectory = "/home/cardano-node-${toString index}";
23 |         ExecStart = iohkpkgs.connectScripts.mainnet.wallet.override (params index);
24 |       };
25 |     };
26 |   };
27 |   mkUser = index: {
28 |     "cardano-node-${toString index}" = {
29 |       isNormalUser = true;
30 |     };
31 |   };
32 | in {
33 |   options = {
34 |     services.cardano-benchmark = {
35 |       walletsPerNode = mkOption {
36 |         type = types.int;
37 |       };
38 |       systemStart = mkOption {
39 |         type = types.int;
40 |       };
41 |       index = mkOption {
42 |         type = types.int;
43 |       };
44 |       topologyFile = mkOption {
45 |         type = types.str;
46 |       };
47 |       configKey = mkOption {
48 |         type = types.str;
49 |       };
50 |     };
51 |   };
52 | 
53 |   config = {
54 |     systemd.services = mkMerge (map mkService (range 1 cfg.walletsPerNode));
55 |     users.users = mkMerge (map mkUser (range 1 cfg.walletsPerNode));
56 |   };
57 | }
58 | 


--------------------------------------------------------------------------------
/modules/cardano-development.nix:
--------------------------------------------------------------------------------
1 | with import ../lib.nix;
2 | 
3 | { config, pkgs, resources, ... }: {
4 |   imports = [
5 |     ./development.nix
6 |   ];
7 | }
8 | 


--------------------------------------------------------------------------------
/modules/cardano-devops.nix:
--------------------------------------------------------------------------------
 1 | with (import ./../lib.nix);
 2 | 
 3 | params:
 4 | {
 5 |   imports = [
 6 |     ./devops.nix
 7 |     ./monitoring-exporters.nix
 8 |   ];
 9 | 
10 |   global.dnsHostname = if params.typeIsRelay then "cardano-node-${toString params.relayIndex}" else null;
11 | }
12 | 


--------------------------------------------------------------------------------
/modules/cardano-production.nix:
--------------------------------------------------------------------------------
 1 | with import ../lib.nix;
 2 | 
 3 | params:
 4 | { name, config, pkgs, resources, ... }: {
 5 |   imports = [
 6 |     ./production.nix
 7 |     ./monitoring-exporters.nix
 8 |   ];
 9 | 
10 |   services.monitoring-exporters.papertrail.enable = true;
11 | 
12 |   global.dnsHostname = if params.typeIsRelay then "cardano-node-${toString params.relayIndex}" else null;
13 | 
14 |   # Initial block is big enough to hold 3 months of transactions
15 |   deployment.ec2.ebsInitialRootDiskSize = mkForce 700;
16 | 
17 |   deployment.ec2.instanceType =
18 |     mkForce (if params.typeIsRelay && params.public == true
19 |              then "m4.large"
20 |              else "t2.large");
21 | }
22 | 


--------------------------------------------------------------------------------
/modules/cardano-staging.nix:
--------------------------------------------------------------------------------
 1 | with (import ./../lib.nix);
 2 | 
 3 | params:
 4 | {
 5 |   imports = [
 6 |     ./staging.nix
 7 |     ./monitoring-exporters.nix
 8 |   ];
 9 | 
10 |   global.dnsHostname = if params.typeIsRelay then "cardano-node-${toString params.relayIndex}" else null;
11 | }
12 | 


--------------------------------------------------------------------------------
/modules/cardano-testnet.nix:
--------------------------------------------------------------------------------
 1 | with (import ./../lib.nix);
 2 | 
 3 | params:
 4 | {
 5 |   imports = [
 6 |     ./testnet.nix
 7 |     ./monitoring-exporters.nix
 8 |   ];
 9 | 
10 |   services.monitoring-exporters.papertrail.enable = true;
11 | 
12 |   global.dnsHostname = if params.typeIsRelay then "cardano-node-${toString params.relayIndex}" else null;
13 | }
14 | 


--------------------------------------------------------------------------------
/modules/configurator.nix:
--------------------------------------------------------------------------------
 1 | { lib, config, ... }: with lib; with types; let
 2 |   cfg = config.configurator;
 3 | in {
 4 | 
 5 |   imports = [ <module/parameters.nix> <module/parameters-ops.nix> ];
 6 | 
 7 |   options.configurator = {
 8 |     optionDefaults = mkOption {
 9 |       description = "Option defaults";
10 |       default = {};
11 |       type = attrs;
12 |     };
13 |     userConfig = mkOption {
14 |       description = "Cluster configuration";
15 |       default = {};
16 |       type = attrs;
17 |     };
18 |   };
19 | 
20 |   config = let
21 |     optionDefaults = mapAttrsRecursive (_: mkOverride 1250) cfg.optionDefaults;
22 |     userConfig     = mapAttrsRecursive (_: mkForce)         cfg.userConfig;
23 |     mergedConfig   = builtins.deepSeq [optionDefaults userConfig ] recursiveUpdate optionDefaults userConfig;
24 |   in {
25 |       node    = mergedConfig.node;
26 |       cluster = mergedConfig.cluster;
27 |       hydra   = mergedConfig.hydra;
28 |   };
29 | }
30 | 


--------------------------------------------------------------------------------
/modules/dd-process-monitor.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, ... }:
 2 | 
 3 | with lib;
 4 | let
 5 |   cfg = config.services.dd-agent;
 6 | in {
 7 |   options = {
 8 |     services.dd-agent.processMonitor = mkOption {
 9 |       type = types.nullOr types.str;
10 |       default = null;
11 |     };
12 |   };
13 |   config = mkIf (cfg.processMonitor != null) {
14 |     services.dd-agent.processConfig = ''
15 |       init_config:
16 | 
17 |       instances:
18 |       - name : ${cfg.processMonitor}
19 |         search_string: ['${cfg.processMonitor}']
20 |         exact_match: True
21 |         thresholds:
22 |           critical: [1, 1]
23 |     '';
24 |   };
25 | }
26 | 


--------------------------------------------------------------------------------
/modules/deployer-aws.nix:
--------------------------------------------------------------------------------
 1 | # This is the basic setup of a deployer host.
 2 | # The different deployers will add their own users and config on top.
 3 | #
 4 | # The thing about a deployer host is that it deploys itself through
 5 | # the nixops None backend, and just uses plain nixops, not the
 6 | # iohk-ops wrapper.
 7 | 
 8 | { lib, ... }: {
 9 |   imports = [ <nixpkgs/nixos/modules/virtualisation/amazon-image.nix> ];
10 |   ec2.hvm = true;
11 | 
12 |   deployment = {
13 |     targetEnv = "none";
14 |     targetHost = "localhost";
15 |   };
16 | 
17 |   # Don't reconfigure the system from EC2 userdata on next startup
18 |   systemd.services.amazon-init.wantedBy = lib.mkForce [ ];
19 | }
20 | 


--------------------------------------------------------------------------------
/modules/deployer-base.nix:
--------------------------------------------------------------------------------
 1 | # This is the basic setup of a deployer host.
 2 | # The different deployers will add their own users and config on top.
 3 | #
 4 | # The thing about a deployer host is that it deploys itself through
 5 | # the nixops None backend, and just uses plain nixops, not the
 6 | # iohk-ops wrapper.
 7 | 
 8 | with (import ../lib.nix);
 9 | 
10 | let
11 |   iohk-pkgs = import ../default.nix {};
12 | 
13 | in
14 | 
15 | { config, pkgs, ... }: {
16 | 
17 |   security.sudo.enable = true;
18 |   security.sudo.wheelNeedsPassword = false;
19 | 
20 |   environment = mkDefault {
21 |     systemPackages = (with iohk-pkgs; [
22 |         iohk-ops
23 |         terraform
24 |         mfa
25 |       ]) ++ (with pkgs; [
26 |         psmisc
27 |         gnupg
28 |         nixops
29 |         awscli
30 |         jq
31 |         yq
32 |         python3
33 |         htop
34 |       ]);
35 |   };
36 | 
37 |   users.groups.deployers = {};
38 | 
39 |   users.users = {
40 |     # Re-deploy the deployer host itself,
41 |     # and apply global terraform.
42 |     deployer = mkDefault {
43 |       isNormalUser = true;
44 |       description  = "Deploy the deployer";
45 |       group        = "deployers";
46 |       extraGroups  = [ "wheel" ];
47 |       openssh.authorizedKeys.keys = devOpsKeys;
48 |     };
49 |   };
50 | }
51 | 


--------------------------------------------------------------------------------
/modules/deployer.nix:
--------------------------------------------------------------------------------
1 | { ... }:
2 | 
3 | let
4 |   iohk-pkgs = import ../default.nix {};
5 | in {
6 |   environment.systemPackages = [ iohk-pkgs.nixops ];
7 | }
8 | 


--------------------------------------------------------------------------------
/modules/development.nix:
--------------------------------------------------------------------------------
 1 | { name, config, resources, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | 
 5 | {
 6 |   config = {
 7 | 
 8 |     global = {
 9 |       allocateElasticIP            = false;
10 |       enableEkgWeb                 = true;
11 |       dnsHostname                  = "${name}-${config.deployment.name}";
12 |       omitDetailedSecurityGroups   = true;
13 |     };
14 | 
15 |     services = {
16 |       # DEVOPS-64: disable log bursting
17 |       journald.rateLimitBurst    = 0;
18 |       journald.extraConfig       = "SystemMaxUse=50M";
19 | 
20 |       monitoring-exporters.enable = true;
21 |       monitoring-exporters.metrics = true;
22 |       # Monitoring server currently not enabled in the development environment
23 |       monitoring-exporters.logging = false;
24 |     };
25 | 
26 |   };
27 | }
28 | 


--------------------------------------------------------------------------------
/modules/devops.nix:
--------------------------------------------------------------------------------
 1 | { name, config, resources, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | {
 5 |   config = {
 6 | 
 7 |     global = {
 8 |       allocateElasticIP = true;
 9 |       enableEkgWeb      = false;
10 |     };
11 | 
12 |     services = {
13 | 
14 |       # DEVOPS-64: disable log bursting
15 |       journald.rateLimitBurst    = 0;
16 | 
17 |       monitoring-exporters.enable = true;
18 |       monitoring-exporters.metrics = true;
19 |       monitoring-exporters.logging = true;
20 |     };
21 |   };
22 | }
23 | 


--------------------------------------------------------------------------------
/modules/docker-builder.nix:
--------------------------------------------------------------------------------
 1 | { name, pkgs, ... }:
 2 | 
 3 | {
 4 |   virtualisation.docker = {
 5 |     enable = true;
 6 |     autoPrune.enable = true;
 7 |     autoPrune.dates = "daily";
 8 |     autoPrune.flags = [ "--all" "--force" ];
 9 |   };
10 | 
11 |   # Provide dockerhub credentials to buildkite
12 |   systemd.services.buildkite-agent-setup-docker = {
13 |     wantedBy = [ "buildkite-agent.service" ];
14 |     script = ''
15 |       mkdir -p ~buildkite-agent/.docker
16 |       ln -sf /run/keys/dockerhub-auth ~buildkite-agent/.docker/config.json
17 |       chown -R buildkite-agent:nogroup ~buildkite-agent/.docker
18 |     '';
19 |     serviceConfig = {
20 |       Type = "oneshot";
21 |     };
22 |   };
23 | }
24 | 


--------------------------------------------------------------------------------
/modules/exchange-monitor.nix:
--------------------------------------------------------------------------------
 1 | { pkgs, lib, config, ... }:
 2 | 
 3 | let
 4 |   cfg = config.services.exchange-monitor;
 5 | in {
 6 |   options = {
 7 |     services.exchange-monitor = {
 8 |       enable = lib.mkEnableOption "exchange monitor";
 9 |     };
10 |   };
11 |   config = lib.mkIf cfg.enable {
12 |     users.users.exchange-monitor = {
13 |       home = "/var/empty";
14 |       isSystemUser = true;
15 |     };
16 |     systemd.services.exchange-monitor = {
17 |       wantedBy = [ "multi-user.target" ];
18 |       script = ''
19 |         exec ${pkgs.callPackage ./exchange-monitor {}}
20 |       '';
21 |       serviceConfig = {
22 |         User = "exchange-monitor";
23 |         Restart = "always";
24 |         RestartSec = "15s";
25 |       };
26 |     };
27 |     services.prometheus2.scrapeConfigs = [
28 |       {
29 |         job_name = "exchange-monitor";
30 |         scrape_interval = "60s";
31 |         metrics_path = "/";
32 |         static_configs = [
33 |           {
34 |             targets = [
35 |               "localhost:8000"
36 |             ];
37 |             labels = { alias = "exchange-monitor"; };
38 |           }
39 |         ];
40 |       }
41 |     ];
42 |   };
43 | }
44 | 


--------------------------------------------------------------------------------
/modules/exchange-monitor/default.nix:
--------------------------------------------------------------------------------
 1 | { python3, makeWrapper, runCommand }:
 2 | 
 3 | let
 4 |   python = python3.withPackages (ps: with ps; [ prometheus_client requests ]);
 5 | in runCommand "exchange-monitor-binance" {
 6 |   buildInputs = [ makeWrapper ];
 7 | } ''
 8 |   makeWrapper ${python}/bin/python $out --add-flags ${./exchange-monitor.py}
 9 | ''
10 | 


--------------------------------------------------------------------------------
/modules/exchange-monitor/shell.nix:
--------------------------------------------------------------------------------
 1 | 
 2 | let
 3 |   iohkNix = (import ../../lib.nix).iohkNix;
 4 |   pkgs = iohkNix.pkgs;
 5 |   dependencies = with pkgs.python3Packages; [
 6 |     requests
 7 |     prometheus_client
 8 |     ipython
 9 |   ];
10 |   shell = pkgs.mkShell {
11 |     name = "exchange-monitor";
12 |     buildInputs = dependencies;
13 |   };
14 | 
15 | in shell
16 | 


--------------------------------------------------------------------------------
/modules/extra-statsd.nix:
--------------------------------------------------------------------------------
 1 | { pkgs, lib, config, ... }:
 2 | 
 3 | with lib;
 4 | let
 5 |   extra-statsd = pkgs.callPackage (pkgs.fetchFromGitHub {
 6 |     owner = "cleverca22";
 7 |     repo = "extra-statsd";
 8 |     rev = "343e8793594c91126dfd18fb31b07fba605711ab";
 9 |     sha256 = "1qf1grqcp232s3vafvrq58xa29yqbnhfnpq2v03dhsfcqr63pdvz";
10 |   }) {};
11 | in {
12 |   options = {
13 |     services.extra-statsd = mkEnableOption "extra-statsd";
14 |   };
15 |   config = mkIf config.services.extra-statsd {
16 |     systemd.services.extra-statsd = {
17 |       wantedBy = [ "multi-user.target" ];
18 |       after = [ "dd-agent.service" ];
19 |       script = ''
20 |         sleep 30
21 |         exec ${extra-statsd.static}/bin/extra-statsd
22 |       '';
23 |     };
24 |   };
25 | }
26 | 


--------------------------------------------------------------------------------
/modules/gen-grafana-creds.nix:
--------------------------------------------------------------------------------
 1 | { user ? null, password ? null }:
 2 | 
 3 | let
 4 |   pkgs = import (import ../fetch-nixpkgs.nix) {};
 5 | in pkgs.stdenv.mkDerivation {
 6 |   name = "gen-grafana-creds";
 7 |   buildInputs = with pkgs; [ pwgen ];
 8 |   shellHook = ''
 9 |     credsFilename="grafana-creds.nix"    # Default grafana static filename
10 |     defaultUser="root"                   # Default administrative user
11 |     password="${toString password}"      # password supplied by cli arg
12 |     passwordChar="32"                    # Default grafana password length
13 |     staticPath=${toString ../static}     # Absolute path to the static dir
14 |     user="${toString user}"              # user supplied by cli arg
15 | 
16 |     if [[ -e "$staticPath/$credsFilename" ]]; then
17 |       echo "File already exists: $staticPath/$credsFilename, aborting!"
18 |       exit 1
19 |     elif [[ -z $user ]]; then
20 |       echo "User is empty -- setting to a default administrative user of $defaultUser"
21 |       user=$defaultUser
22 |     fi
23 |     echo "Writing grafana creds for user $user..."
24 |     if [[ -z $password ]]; then
25 |       echo "Password is empty -- setting to a random alphanumeric password of length $passwordChar"
26 |       password=$(pwgen $passwordChar 1)
27 |     fi
28 | 
29 |     umask 077
30 |     cd $path
31 |     cat << EOF > $staticPath/$credsFilename
32 |     {
33 |       user = "$user";
34 |       password = "$password";
35 |     }
36 |     EOF
37 |     exit 0
38 |   '';
39 | }
40 | 


--------------------------------------------------------------------------------
/modules/gen-graylog-creds.nix:
--------------------------------------------------------------------------------
 1 | { user ? null, password ? null }:
 2 | 
 3 | let
 4 |   pkgs = import (import ../fetch-nixpkgs.nix) {};
 5 | in pkgs.stdenv.mkDerivation {
 6 |   name = "gen-graylog-creds";
 7 |   buildInputs = with pkgs; [ pwgen gnused ];
 8 |   shellHook = ''
 9 |     clusterChar="96"                     # Default graylog cluster secret length
10 |     clusterSecret=""                     # Var for the clusterSecret
11 |     credsFilename="graylog-creds.nix"    # Default graylog static filename
12 |     defaultUser="root"                   # Default administrative user
13 |     password="${toString password}"      # password supplied by cli arg
14 |     passwordChar="32"                    # Default graylog password length
15 |     passwordHash=""                      # Sha256 hash of the plaintext password
16 |     staticPath=${toString ../static}     # Absolute path to the static dir
17 |     user="${toString user}"              # user supplied by cli arg
18 | 
19 |     if [[ -e "$staticPath/$credsFilename" ]]; then
20 |       echo "File already exists: $staticPath/$credsFilename, aborting!"
21 |       exit 1
22 |     elif [[ -z $user ]]; then
23 |       echo "User is empty -- setting to a default administrative user of $defaultUser"
24 |       user=$defaultUser
25 |     fi
26 |     echo "Writing graylog creds for user $user..."
27 |     if [[ -z $password ]]; then
28 |       echo "Password is empty -- setting to a random alphanumeric password of length $passwordChar"
29 |       password=$(pwgen $passwordChar 1)
30 |     fi
31 | 
32 |     passwordHash=$(echo -n $password | sha256sum | sed -z 's/  -\n//g')
33 |     clusterSecret=$(pwgen $clusterChar 1)
34 | 
35 |     umask 077
36 |     cd $path
37 |     cat << EOF > $staticPath/$credsFilename
38 |     {
39 |       user = "$user";
40 |       password = "$password";
41 |       passwordHash = "$passwordHash";
42 |       clusterSecret = "$clusterSecret";
43 |     }
44 |     EOF
45 |     exit 0
46 |   '';
47 | }
48 | 


--------------------------------------------------------------------------------
/modules/gen-wireguard-keys.nix:
--------------------------------------------------------------------------------
 1 | { hosts ? [ "monitoring" ] }:
 2 | 
 3 | let
 4 |   pkgs = import (import ../fetch-nixpkgs.nix) {};
 5 | in pkgs.stdenv.mkDerivation {
 6 |   name = "gen-wireguard-keys";
 7 |   buildInputs = [ pkgs.wireguard ];
 8 |   shellHook = ''
 9 |     cd ${toString ../static}
10 |     umask 077
11 |     for host in ${toString hosts}; do
12 |       if [[ -e ''${host}.wgprivate ]]; then
13 |         echo "File \"''${host}.wgprivate\" already exists -- skipping public and private wg key creation for the host \"''${host}"\"
14 |       else
15 |         wg genkey > ''${host}.wgprivate
16 |         wg pubkey < ''${host}.wgprivate > ''${host}.wgpublic
17 |       fi
18 |     done
19 |     exit 0
20 |   '';
21 | }
22 | 


--------------------------------------------------------------------------------
/modules/hydra-aws.nix:
--------------------------------------------------------------------------------
 1 | { name, config, lib, resources, ... }:
 2 | let inherit (config.node) region org;
 3 | in
 4 | {
 5 |   imports = [  ./amazon-base.nix ];
 6 |   ec2.hvm = true;
 7 |   deployment.ec2 = {
 8 |     ebsInitialRootDiskSize = lib.mkForce 200;
 9 |     associatePublicIpAddress = true;
10 |     securityGroups = [
11 |       resources.ec2SecurityGroups."allow-deployer-ssh-${region}-${org}"
12 |       resources.ec2SecurityGroups."allow-hydra-${region}-${org}"
13 |     ];
14 |   };
15 | }
16 | 


--------------------------------------------------------------------------------
/modules/hydra-base.nix:
--------------------------------------------------------------------------------
1 | { config, ... }: {
2 |   imports = [
3 |     ./common.nix
4 |     ./hydra-master-common.nix
5 |   ];
6 | }
7 | 


--------------------------------------------------------------------------------
/modules/hydra-slave.nix:
--------------------------------------------------------------------------------
 1 | { lib, ... }:
 2 | 
 3 | with lib;
 4 | 
 5 | let
 6 |   commonLib = import ../lib.nix;
 7 | in
 8 | {
 9 |   imports = [ ./auto-gc.nix
10 |               ./nix_nsswitch.nix
11 |             ];
12 | 
13 |   nix = {
14 |     binaryCaches = mkForce [ "https://cache.nixos.org" ];
15 |     extraOptions = ''
16 |       # Max of 2 hours to build any given derivation on Linux.
17 |       # See ../nix-darwin/modules/basics.nix for macOS.
18 |       timeout = ${toString (3600 * 2)}
19 |     '';
20 |   };
21 | 
22 |   users.extraUsers.root.openssh.authorizedKeys.keys =
23 |     commonLib.ciInfraKeys ++
24 |     map (key: ''
25 |       command="nice -n20 nix-store --serve --write" ${key}
26 |     '') commonLib.buildSlaveKeys.linux;
27 | }
28 | 


--------------------------------------------------------------------------------
/modules/iohk-logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/input-output-hk/iohk-ops/b0cffc81170562c3acfe9f6efb5260cf69b4cd6d/modules/iohk-logo.png


--------------------------------------------------------------------------------
/modules/log-classifier.nix:
--------------------------------------------------------------------------------
 1 | { ... }:
 2 | 
 3 | {
 4 |   imports = [
 5 |     ./log-classifier-service.nix
 6 |   ];
 7 | 
 8 |   services.log-classifier = {
 9 |     enable = true;
10 |     secrets = builtins.toFile "log-classifier-env" ''
11 |       LCPATH=/var/run/keys
12 |     '';
13 |   };
14 |   networking.firewall.allowedTCPPorts = [ 80 443 ];
15 |   systemd.services.log-classifier.after = [ "keys.target" ];
16 |   systemd.services.log-classifier.requires = [ "keys.target" ];
17 |   users.users.log-classifier.extraGroups = [ "keys" ];
18 | 
19 |   deployment.keys = {
20 |     "app_users.json" = {
21 |       keyFile = ../static/log-classifier/app_users.json;
22 |       user = "log-classifier";
23 |     };
24 |     token = {
25 |       keyFile = ../static/log-classifier/zendesk_token.secret;
26 |       user = "log-classifier";
27 |     };
28 |     assign_to = {
29 |       keyFile = ../static/log-classifier/assign_to;
30 |       user = "log-classifier";
31 |     };
32 |     "knowledge.csv" = {
33 |       keyFile = ../static/log-classifier/knowledge.csv;
34 |       user = "log-classifier";
35 |     };
36 |   };
37 | }
38 | 


--------------------------------------------------------------------------------
/modules/macs/config.plist.template:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 3 | <plist version="1.0">
 4 | <dict>
 5 | 	<key>Boot</key>
 6 | 	<dict>
 7 | 		<key>Arguments</key>
 8 | 		<string>@params@</string>
 9 | 		<key>DefaultVolume</key>
10 | 		<string>system</string>
11 | 		<key>Log</key>
12 | 		<true/>
13 | 		<key>Secure</key>
14 | 		<false/>
15 | 		<key>Timeout</key>
16 | 		<integer>@timeout@</integer>
17 | 	</dict>
18 | 	<key>GUI</key>
19 | 	<dict>
20 | 		<key>Scan</key>
21 | 		<dict>
22 | 			<key>Entries</key>
23 | 			<true/>
24 | 			<key>Tool</key>
25 | 			<true/>
26 | 		</dict>
27 | 		<key>ScreenResolution</key>
28 | 		<string>@resolution@</string>
29 | 		<key>Theme</key>
30 | 		<string>embedded</string>
31 | 	</dict>
32 | 	<key>RtVariables</key>
33 | 	<dict>
34 | 		<key>BooterConfig</key>
35 | 		<string>0x28</string>
36 | 		<key>CsrActiveConfig</key>
37 | 		<string>@csrFlag@</string>
38 | 	</dict>
39 | 	<key>SMBIOS</key>
40 | 	<dict>
41 | 		<key>Trust</key>
42 | 		<false/>
43 | 	</dict>
44 | 	<key>SystemParameters</key>
45 | 	<dict>
46 | 		<key>InjectKexts</key>
47 | 		<false/>
48 | 		<key>InjectSystemID</key>
49 | 		<true/>
50 | 	</dict>
51 | </dict>
52 | </plist>
53 | 


--------------------------------------------------------------------------------
/modules/macs/dist/OVMF_CODE.fd:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/input-output-hk/iohk-ops/b0cffc81170562c3acfe9f6efb5260cf69b4cd6d/modules/macs/dist/OVMF_CODE.fd


--------------------------------------------------------------------------------
/modules/macs/dist/OVMF_VARS-1024x768.fd:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/input-output-hk/iohk-ops/b0cffc81170562c3acfe9f6efb5260cf69b4cd6d/modules/macs/dist/OVMF_VARS-1024x768.fd


--------------------------------------------------------------------------------
/modules/macs/host/installer-image/mac-mini-nixos-installer.nix:
--------------------------------------------------------------------------------
 1 | {
 2 |   boot.supportedFilesystems = [ "zfs" ];
 3 |   imports = [
 4 |     <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
 5 |     ../macmini-boot-fixes.nix
 6 |     ./justdoit.nix
 7 |   ];
 8 |   kexec.justdoit = {
 9 |     rootDevice = "/dev/nvme0n1";
10 |     bootSize = 1024;
11 |     bootType = "vfat";
12 |     swapSize = 1024 * 16;
13 |     poolName = "tank";
14 |     uefi = true;
15 |     nvme = true;
16 |   };
17 | }
18 | 


--------------------------------------------------------------------------------
/modules/macs/host/macmini-boot-fixes.nix:
--------------------------------------------------------------------------------
 1 | { pkgs, ... }:
 2 | let
 3 |   # TODO: switch to 19.03 if this PR gets merged before freeze
 4 |   pkgsUnstable = import (builtins.fetchTarball "https://github.com/nixos/nixpkgs/archive/a8d26fc34a7ceb52d098e384f316b8e4b19651bb.tar.gz") {
 5 |     config = {};
 6 |     overlays = [];
 7 |   };
 8 |   macBootOverlay = self: super: {
 9 |     inherit (pkgsUnstable) grub2;
10 |   };
11 | in {
12 |   nixpkgs = {
13 |     overlays = [
14 |       macBootOverlay
15 |     ];
16 |   };
17 |   boot.kernelPatches = [ pkgsUnstable.kernelPatches.mac_nvme_t2 ];
18 |   boot.kernelPackages = pkgsUnstable.linuxPackages_5_2;
19 | }
20 | 


--------------------------------------------------------------------------------
/modules/macs/host/monitorama.nix:
--------------------------------------------------------------------------------
 1 | { lib, config, ... }:
 2 | let
 3 |   inherit (lib) mkIf;
 4 | in {
 5 |   config = mkIf config.monitorama.enable {
 6 |     networking.firewall.allowedTCPPorts = [ 9111 ];
 7 |     services.nginx = {
 8 |       enable = true;
 9 |       virtualHosts = {
10 |         default = {
11 |           default = true;
12 |           listen = [ { addr = "0.0.0.0"; port = 9111; } ];
13 |           locations = builtins.mapAttrs (name: value: { proxyPass = value; }) config.monitorama.hosts;
14 |         };
15 |       } // (
16 |       builtins.mapAttrs (name: value: {
17 |           listen = [ { addr = "0.0.0.0"; port = 9111; } ];
18 |           locations."/metrics".proxyPass = value;
19 |         })
20 |         config.monitorama.hosts
21 |         );
22 |     };
23 |   };
24 | }
25 | 


--------------------------------------------------------------------------------
/modules/monitoring-rules-cardano.nix:
--------------------------------------------------------------------------------
 1 | { ... }:
 2 | 
 3 | # To be called from a monitoring-env-*.nix file for adding cardano service monitoring
 4 | 
 5 | {
 6 |   services.monitoring-services.applicationRules = [
 7 |     {
 8 |       alert = "chain_quality_degraded";
 9 |       expr = "cardano_chain_quality_last_k__2160__blocks__ < 99";
10 |       for = "5m";
11 |       labels = {
12 |         severity = "page";
13 |       };
14 |       annotations = {
15 |         summary = "{{$labels.alias}}: Degraded Chain Quality over last 2160 blocks.";
16 |         description = "{{$labels.alias}}: Degraded Chain Quality over last 2160 blocks (<99%).";
17 |       };
18 |     }
19 |     {
20 |       alert = "mempoolsize_tx_count_too_large";
21 |       expr = "max_over_time(cardano_MemPoolSize[5m]) > 190";
22 |       for = "1m";
23 |       labels = {
24 |         severity = "page";
25 |       };
26 |       annotations = {
27 |         summary = "{{$labels.alias}}: MemPoolSize tx count is larger than expected.";
28 |         description = "{{$labels.alias}}: When a node's MemPoolSize grows larger than the system can handle, transactions will be dropped. The actual thresholds for that in mainnet are unknown, but [based on benchmarks done beforehand](https://input-output-rnd.slack.com/archives/C2VJ41WDP/p1506563332000201) transactions started getting dropped when the MemPoolSize was ~200 txs.";
29 |       };
30 |     }
31 |   ];
32 | }
33 | 


--------------------------------------------------------------------------------
/modules/network-wide.nix:
--------------------------------------------------------------------------------
 1 | { name, config, resources, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | 
 5 | {
 6 |   imports = [ ./globals.nix ];
 7 |   config.deployment = {
 8 |     ec2 = {
 9 |       elasticIPv4 = if config.global.allocateElasticIP
10 |                     then resources.elasticIPs.${name + "-ip"} else "";
11 |       securityGroups = map (resolveSGName resources)
12 |         (optionals (! config.global.omitDetailedSecurityGroups) [
13 |           "allow-deployer-ssh-${config.deployment.ec2.region}-${config.global.organisation}"
14 |           "allow-monitoring-collection-${config.deployment.ec2.region}-${config.global.organisation}"
15 |         ]);
16 |     };
17 | 
18 |     route53 = optionalAttrs (config.global.dnsHostname   != null &&
19 |                              config.global.dnsDomainname != null) {
20 |       accessKeyId = config.deployment.ec2.accessKeyId;
21 |       hostName    = config.global.dnsHostname +"."+ config.global.dnsDomainname;
22 |     };
23 |   };
24 |   options = {
25 |   };
26 | }
27 | 


--------------------------------------------------------------------------------
/modules/nix_nsswitch.nix:
--------------------------------------------------------------------------------
1 | { ... }:
2 | 
3 | {
4 |   nix = {
5 |     sandboxPaths = [ "/etc/nsswitch.conf" "/etc/protocols" ];
6 |   };
7 | }
8 | 


--------------------------------------------------------------------------------
/modules/parameters-ops.nix:
--------------------------------------------------------------------------------
 1 | # Since we aim to be able to use the options defined in `parameters.nix` both in
 2 | # nixops and NixOS contexts we can't use anything node-specific there.
 3 | # `name` is node-specific so everything that uses it directly or indirectly had
 4 | # to be taken out of `parameters.nix`. That way we can use `evalModules` it
 5 | # and avoid having to repeat all parameters in all `configs/*.nix` files.
 6 | { config, lib, name, resources, ... }:
 7 | 
 8 | {
 9 |   node.fqdn = let
10 |     inherit (config.cluster) subDomain toplevelDomain;
11 |   in lib.mkDefault "${name}.${lib.optionalString (subDomain != null) "${subDomain}."}${toplevelDomain}";
12 | 
13 |   deployment.ec2 = {
14 |     inherit (config.node) accessKeyId region instanceType spotInstancePrice;
15 |   } // lib.optionalAttrs config.node.allocateElasticIP {
16 |     elasticIPv4 = resources.elasticIPs."${name}-ip";
17 |   };
18 |   deployment.route53 = lib.mkIf (config.cluster.hostedZone != null) {
19 |     inherit (config.node) accessKeyId;
20 |     hostName    = "${config.node.fqdn}";
21 |   };
22 | }
23 | 


--------------------------------------------------------------------------------
/modules/production.nix:
--------------------------------------------------------------------------------
 1 | { name, config, resources, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | {
 5 |   config = {
 6 | 
 7 |     global = {
 8 |       allocateElasticIP = true;
 9 |       enableEkgWeb      = false;
10 |     };
11 | 
12 |     services = {
13 | 
14 |       # DEVOPS-64: disable log bursting
15 |       journald.rateLimitBurst    = 0;
16 | 
17 |       monitoring-exporters.enable = true;
18 |       monitoring-exporters.metrics = true;
19 |       monitoring-exporters.logging = true;
20 |     };
21 |   };
22 | }
23 | 


--------------------------------------------------------------------------------
/modules/staging.nix:
--------------------------------------------------------------------------------
 1 | { name, config, resources, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | {
 5 |   config = {
 6 | 
 7 |     global = {
 8 |       allocateElasticIP = true;
 9 |       enableEkgWeb      = true;
10 |     };
11 | 
12 |     services = {
13 | 
14 |       # DEVOPS-64: disable log bursting
15 |       journald.rateLimitBurst    = 0;
16 | 
17 |       monitoring-exporters.enable = true;
18 |       monitoring-exporters.metrics = true;
19 |       monitoring-exporters.logging = true;
20 |     };
21 | 
22 |   };
23 | }
24 | 


--------------------------------------------------------------------------------
/modules/test-hydra-locally.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   pkgsSrc = import ../fetch-nixpkgs.nix;
 3 |   eval = import (pkgsSrc + "/nixos") {
 4 |     configuration = cfg;
 5 |   };
 6 |   cfg = { lib, ... }: {
 7 |     imports = [
 8 |       ./hydra-master-main.nix
 9 |       ./common.nix
10 |       ./hydra-slave.nix
11 |       ./hydra-master-common.nix
12 |     ];
13 |     virtualisation = {
14 |       memorySize = 2 * 1024;
15 |       graphics = false;
16 |       qemu.networkingOptions = [
17 |         "-net nic,netdev=user.0,model=virtio"
18 |         "-netdev user,id=user.0,hostfwd=tcp:127.0.0.1:8080-:80"
19 |       ];
20 |     };
21 |     services = {
22 |       mingetty.autologinUser = "root";
23 |       grafana.extraOptions.AUTH_GOOGLE_CLIENT_SECRET = lib.mkForce "";
24 |       nginx.virtualHosts."hydra.iohk.io" = {
25 |         forceSSL = lib.mkForce false;
26 |         enableACME = lib.mkForce false;
27 |       };
28 |     };
29 |   };
30 | in eval.vm
31 | 


--------------------------------------------------------------------------------
/modules/test-monitoring-locally.nix:
--------------------------------------------------------------------------------
 1 | with import ./../lib.nix;
 2 | let
 3 |   eval = import <nixpkgs/nixos> {
 4 |     configuration = cfg;
 5 |   };
 6 |   cfg = { ... }: {
 7 |     imports = [
 8 |       ./monitoring-services.nix
 9 |       <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix>
10 |     ];
11 |     virtualisation.memorySize = 4 * 1024;
12 |     virtualisation.graphics = false;
13 |     services.mingetty.autologinUser = "root";
14 | 
15 |     virtualisation.qemu.networkingOptions = [
16 |       "-net nic,netdev=user.0,model=virtio"
17 |       "-netdev user,id=user.0,hostfwd=tcp:127.0.0.1:8080-:80"
18 |     ];
19 |     services.monitoring-services = {
20 |       enable = true;
21 |       enableACME = false;
22 |       webhost = "localhost";
23 |       grafanaCreds = makeCreds "grafana" { user = "changeme"; password = "changeme"; };
24 |       graylogCreds = makeCreds "graylog" { user = "changeme"; password = "changeme"; };
25 |       oauth = {
26 |         enable = false;
27 |       };
28 |     };
29 |   };
30 | in {
31 |   vm = eval.vm;
32 |   config = eval.config;
33 | }
34 | 


--------------------------------------------------------------------------------
/modules/testnet.nix:
--------------------------------------------------------------------------------
 1 | { name, config, resources, ... }:
 2 | 
 3 | with import ../lib.nix;
 4 | {
 5 |   config = {
 6 | 
 7 |     global = {
 8 |       allocateElasticIP = true;
 9 |       enableEkgWeb      = false;
10 |     };
11 | 
12 |     services = {
13 | 
14 |       # DEVOPS-64: disable log bursting
15 |       journald.rateLimitBurst    = 0;
16 | 
17 |       monitoring-exporters.enable = true;
18 |       monitoring-exporters.metrics = true;
19 |       monitoring-exporters.logging = true;
20 |     };
21 |   };
22 | }
23 | 


--------------------------------------------------------------------------------
/network.nix:
--------------------------------------------------------------------------------
1 | { nixpkgsSrc, depl }:
2 | {
3 |   inherit nixpkgsSrc depl;
4 |   nixpkgs = import nixpkgsSrc {};
5 | }
6 | 


--------------------------------------------------------------------------------
/nix-darwin/default.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   nixpkgs = import (builtins.fetchTarball https://nixos.org/channels/nixpkgs-18.03-darwin/nixexprs.tar.xz);
 3 |   pkgs_mac = nixpkgs {system = "x86_64-darwin";};
 4 |   pkgs_native = nixpkgs {};
 5 | 
 6 | in rec {
 7 |   darwin-tools = let
 8 |     ghc = pkgs_mac.haskellPackages.ghcWithPackages (ps: [ ps.turtle ps.universum ps.megaparsec ]);
 9 |   in pkgs_mac.stdenv.mkDerivation {
10 |     name = "deploy-nix-darwin";
11 |     buildInputs = [ ghc pkgs_mac.nixStable ];
12 |     shellHook = "eval $(egrep ^export ${ghc}/bin/ghc)";
13 |     src = ./.;
14 |     installPhase = ''
15 |       mkdir -p $out/bin
16 |       ghc -o patch-prepare patch-prepare.hs
17 |       ghc -o $out/bin/prepare everything.hs
18 |       ln -s prepare $out/bin/nuke-nix
19 |       ./patch-prepare
20 |     '';
21 |   };
22 |   prepare-mac = pkgs_native.writeScriptBin "prepare-mac" ''
23 |     #!${pkgs_native.stdenv.shell}
24 |     set -e
25 |     ssh -t $1 "chmod -R +w darwin-tools; rm -rf darwin-tools" || true
26 |     scp -r ${darwin-tools}/bin $1:darwin-tools
27 |     ssh -t $1 "sudo darwin-tools/nuke-nix"
28 |     ssh -t $1 "darwin-tools/prepare $2"
29 |   '';
30 |   deploy-darwin = let
31 |     ghc = pkgs_native.haskellPackages.ghcWithPackages (ps: [ ps.turtle ps.universum ps.megaparsec ]);
32 |   in pkgs_native.stdenv.mkDerivation {
33 |     name = "deploy-darwin";
34 |     buildInputs = [ ghc ];
35 |     shellHook = "eval $(egrep ^export ${ghc}/bin/ghc)";
36 |     src = ./.;
37 |     installPhase = ''
38 |       mkdir -p $out/bin
39 |       ghc -o $out/bin/deploy deploy-darwin.hs
40 |     '';
41 |   };
42 |   tools = pkgs_native.buildEnv {
43 |     name = "scripts";
44 |     paths = [ prepare-mac deploy-darwin ];
45 |   };
46 | }
47 | 


--------------------------------------------------------------------------------
/nix-darwin/everything.hs:
--------------------------------------------------------------------------------
 1 | {-# LANGUAGE LambdaCase #-}
 2 | module Main where
 3 | 
 4 | import           Data.Monoid
 5 | import           NukeNix
 6 | import           PrepareDarwin
 7 | import           System.Environment
 8 | 
 9 | main :: IO ()
10 | main = getProgName >>= \case
11 |   "prepare" -> prepare
12 |   "nuke-nix" -> nuke
13 |   _ -> putStrLn "invalid command ran"
14 | 


--------------------------------------------------------------------------------
/nix-darwin/lib/build.nix:
--------------------------------------------------------------------------------
 1 | { configuration, system ? "x86_64-darwin" }:
 2 | 
 3 | let
 4 |   hostpkgs = import <nixpkgs> {};
 5 | 
 6 |   importJSON = file:
 7 |     let
 8 |       srcAttrs = builtins.fromJSON (builtins.readFile file);
 9 |       src = hostpkgs.fetchgit {
10 |         inherit (srcAttrs) url rev sha256;
11 |       };
12 |     in import src;
13 | 
14 |   nixpkgs = importJSON ./nixpkgs.json {
15 |     inherit system;
16 |   };
17 |   darwin = importJSON ./nix-darwin.json {
18 |     nixpkgs = nixpkgs.path;
19 |     inherit configuration system;
20 |   };
21 | in darwin
22 | 


--------------------------------------------------------------------------------
/nix-darwin/lib/nix-darwin.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/LnL7/nix-darwin",
3 |   "rev": "192e2b40e059efdffcfa4b7122b0547874f3278b",
4 |   "date": "2018-05-10T11:43:49+01:00",
5 |   "sha256": "1pxd2p72dsh510ri5c9nzava3mm23rfj8687s55fajhcv8paynd0",
6 |   "fetchSubmodules": true
7 | }
8 | 


--------------------------------------------------------------------------------
/nix-darwin/lib/nixpkgs.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/NixOS/nixpkgs",
3 |   "rev": "8bf6df2b8e8fc9e2f012901af48214feff918d9d",
4 |   "date": "2018-05-08T23:10:53+02:00",
5 |   "sha256": "0r46s5smnd16xq2yyz5v8v14bw8kwh8n3ic4c3jhv46aqpzik84w",
6 |   "fetchSubmodules": true
7 | }
8 | 


--------------------------------------------------------------------------------
/nix-darwin/modules/caffeinate.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | {
 4 |   # dd-agent module is not in nix-darwin upstream
 5 |   imports = [ ../services/caffeinate.nix ];
 6 | 
 7 |   services.caffeinate = {
 8 |     enable = true;
 9 |   };
10 | }
11 | 


--------------------------------------------------------------------------------
/nix-darwin/modules/double-builder-gc.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | let
 4 |   nixAutoMaxFreedMB = 33000;     # An absolute amount to free
 5 |   nixAutoMinFreeMB = 14000;
 6 |   maxFreedMB = 25000;            # A relative amount to free
 7 |   minFreeMB = 15000;
 8 | 
 9 | in {
10 |   imports = [ ../services/builder-gc.nix ];
11 | 
12 |   # This GC is run automatically by nix-build
13 |   nix.extraOptions = ''
14 |     # Try to ensure between ${toString nixAutoMinFreeMB}M and ${toString nixAutoMaxFreedMB}M of free space by
15 |     # automatically triggering a garbage collection if free
16 |     # disk space drops below a certain level during a build.
17 |     min-free = ${toString (nixAutoMinFreeMB * 1048576)}
18 |     max-free = ${toString (nixAutoMaxFreedMB * 1048576)}
19 |   '';
20 | 
21 |   # This GC is run on 15 minute intervals
22 |   nix.builder-gc = {
23 |     enable = true;
24 |     inherit maxFreedMB minFreeMB;
25 |   };
26 |   # TODO, switch over?
27 |   #nix.gc.automatic = true;
28 |   #nix.gc.options = let
29 |   #    gbFree = 25;
30 |   #in "--max-freed $((${toString gbFree} * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | awk '{ print $4 }')))";
31 | }
32 | 


--------------------------------------------------------------------------------
/nix-darwin/modules/hydra-slave.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | with lib;
 4 | 
 5 | let
 6 |   opsLib = import ../../lib.nix;
 7 | 
 8 |   environment = concatStringsSep " "
 9 |     [ "NIX_REMOTE=daemon"
10 |       "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
11 |     ];
12 | in
13 | 
14 | {
15 |   users.knownUsers = [ "builder" ];
16 |   users.users.builder = {
17 |     uid = 502;
18 |     gid = 20;  # staff
19 |     description = "Hydra";
20 |     home = "/Users/builder";
21 |     shell = "/bin/bash";
22 |   };
23 | 
24 |   nix.trustedUsers = [ "root" "builder" ];
25 | 
26 |   # Create a ~/.bashrc containing source /etc/profile
27 |   # (bash doesn't source the ones in /etc for non-interactive
28 |   # shells and that breaks everything nix)
29 |   system.activationScripts.postActivation.text = ''
30 |     mkdir -p /Users/builder
31 |     echo "source /etc/profile" > /Users/builder/.bashrc
32 |     chown builder: /Users/builder/.bashrc
33 |     dseditgroup -o edit -a builder -t user com.apple.access_ssh
34 |   '';
35 | 
36 |   environment.etc."per-user/builder/ssh/authorized_keys".text =
37 |     concatMapStringsSep "\n" (key: ''command="${environment} ${config.nix.package}/bin/nix-store --serve --write" ${key}'') opsLib.buildSlaveKeys.macos + "\n";
38 | 
39 | }
40 | 


--------------------------------------------------------------------------------
/nix-darwin/patch-prepare.hs:
--------------------------------------------------------------------------------
 1 | {-# LANGUAGE OverloadedStrings #-}
 2 | 
 3 | import           Data.Monoid               ((<>))
 4 | import           Data.Text
 5 | import           Filesystem.Path.CurrentOS (encodeString)
 6 | import           RewriteLibs               (chain)
 7 | import           System.Environment        (getEnv)
 8 | 
 9 | main :: IO ()
10 | main = do
11 |   path  <- getEnv "out"
12 |   _ <- chain (path <> "/bin") [ pack path <> "/bin/prepare", pack path <> "/bin/nuke-nix" ]
13 |   putStrLn "done"
14 | 


--------------------------------------------------------------------------------
/nix-darwin/roles/buildkite-agent.nix:
--------------------------------------------------------------------------------
1 | { config, lib, pkgs, ... }:
2 | 
3 | {
4 |   imports = [
5 |     ../modules/basics.nix
6 |     ../modules/buildkite-agent.nix
7 |   ];
8 | }
9 | 


--------------------------------------------------------------------------------
/nix-darwin/roles/ci.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | {
 4 |   imports = [
 5 |     ../modules/basics.nix
 6 |     ../modules/hydra-slave.nix
 7 |     ../modules/buildkite-agent.nix
 8 |   ];
 9 | }
10 | 


--------------------------------------------------------------------------------
/nix-darwin/roles/hydra-slave.nix:
--------------------------------------------------------------------------------
1 | { config, lib, pkgs, ... }:
2 | 
3 | {
4 |   imports = [
5 |     ../modules/basics.nix
6 |     ../modules/hydra-slave.nix
7 |   ];
8 | }
9 | 


--------------------------------------------------------------------------------
/nix-darwin/roles/signing.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | {
 4 |   imports = [
 5 |     ../modules/basics.nix
 6 |     ../modules/buildkite-agent.nix
 7 |   ];
 8 |   services.buildkite-services-darwin.metadata = "system=x86_64-darwin,queue=daedalus";
 9 | }
10 | 


--------------------------------------------------------------------------------
/nix-darwin/services/caffeinate.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | with lib;
 4 | 
 5 | let
 6 |   cfg = config.services.caffeinate;
 7 | in {
 8 |   options.services.caffeinate = {
 9 |     enable = mkOption {
10 |       description = "Whether to enable the caffeinate daemon";
11 |       default = false;
12 |       type = types.bool;
13 |     };
14 |   };
15 | 
16 |   config = mkIf cfg.enable {
17 |     launchd.daemons.caffeinate = {
18 |       script = ''
19 |         exec /usr/bin/caffeinate -s
20 |       '';
21 |       serviceConfig = {
22 |         RunAtLoad = true;
23 |         UserName = "root";
24 |         GroupName = "admin";
25 |         KeepAlive = true;
26 |       };
27 |     };
28 |   };
29 | }
30 | 


--------------------------------------------------------------------------------
/nix-darwin/test.nix:
--------------------------------------------------------------------------------
 1 | { role ? "ci", host, port, hostname }:
 2 | 
 3 | let
 4 |   pkgs = import (import ../fetch-nixpkgs.nix) {};
 5 |   nix-darwin = pkgs.fetchFromGitHub {
 6 |     owner = "LnL7";
 7 |     repo = "nix-darwin";
 8 |     rev = "8d557721a9511d8e6b26c140363ab44d2c98f76b";
 9 |     sha256 = "0gv4b3yfi4k01gyy6djjmln44q7hg3iqm4lalm9b7kgzmgnpx4fp";
10 |   };
11 |   system = (import nix-darwin {
12 |     nixpkgs = pkgs.path;
13 |     configuration = "${guestConfDir}/darwin-configuration.nix";
14 |     system = "x86_64-darwin";
15 |   }).system;
16 |   lib = pkgs.lib;
17 | 
18 |   # this ensures that nix-darwin can find everything it needs, but wont see things it doesnt need
19 |   # that prevents the guest from being rebooted when things it doesnt read get modified
20 |   guestConfDir = pkgs.runCommand "guest-config-dir" {
21 |     inherit host port hostname;
22 |   } ''
23 |     mkdir -pv $out
24 |     cd $out
25 |     mkdir -pv iohk-ops/nix-darwin
26 |     cd iohk-ops
27 |     cp -r --no-preserve=mode ${./roles} nix-darwin/roles
28 |     cp -r --no-preserve=mode ${./modules} nix-darwin/modules
29 |     cp -r --no-preserve=mode ${./services} nix-darwin/services
30 |     cp -r --no-preserve=mode ${../nix} nix
31 |     cp ${./test.nix} nix-darwin/test.nix
32 |     cp ${../lib.nix} lib.nix
33 |     cp ${../iohk-nix.json} iohk-nix.json
34 |     cp ${../nixpkgs-src.json} nixpkgs-src.json
35 |     mkdir lib
36 |     cp ${../lib/ssh-keys.nix} lib/ssh-keys.nix
37 |     cp ${../fetch-nixpkgs.nix} fetch-nixpkgs.nix
38 |     cd ..
39 |     cp -r ${../modules/macs/guest}/* .
40 |     substituteAll apply.sh apply.sh
41 |     cd iohk-ops/nix-darwin/roles
42 |     ln -sv ${role}.nix active-role.nix
43 |   '';
44 | in {
45 |   inherit nix-darwin system guestConfDir;
46 | }
47 | 


--------------------------------------------------------------------------------
/nixpkgs-src.json:
--------------------------------------------------------------------------------
1 | {
2 |   "url": "https://github.com/input-output-hk/nixpkgs",
3 |   "rev": "47fc288743637b7bb4e015a70c4a754afda65b5c",
4 |   "date": "2019-08-13T11:50:57-04:00",
5 |   "sha256": "1cpwrliim2p7zx9iwxazq925fn4wh37ny7j0f34xg3jvgppcmj2c",
6 |   "fetchSubmodules": false
7 | }
8 | 


--------------------------------------------------------------------------------
/overlays/monitoring-exporters.nix:
--------------------------------------------------------------------------------
 1 | self: super:
 2 | {
 3 |   nginxMainline = super.nginxMainline.override (oldAttrs: {
 4 |     modules = oldAttrs.modules ++ [ super.nginxModules.vts ];
 5 |   });
 6 | 
 7 |   nginxStable = super.nginxStable.override (oldAttrs: {
 8 |     modules = oldAttrs.modules ++ [ super.nginxModules.vts ];
 9 |   });
10 | }
11 | 


--------------------------------------------------------------------------------
/pkgs/hydra-fork.nix:
--------------------------------------------------------------------------------
 1 | { fetchFromGitHub, nixpkgsPath, src, patches }:
 2 | 
 3 | let
 4 |   hydraRelease = (import (src + "/release.nix") {
 5 |     nixpkgs = nixpkgsPath;
 6 |     hydraSrc = {
 7 |       outPath = src;
 8 |       rev = builtins.substring 0 6 src.rev;
 9 |       revCount = 1234;
10 |     };
11 |   });
12 | 
13 | in
14 |   hydraRelease.build.x86_64-linux.overrideAttrs (drv: { inherit patches; })
15 | 


--------------------------------------------------------------------------------
/pkgs/hydra.nix:
--------------------------------------------------------------------------------
 1 | { pkgs }:
 2 | 
 3 | let
 4 |   hydraSrc = (import ../lib.nix).sources.hydra;
 5 | in
 6 |   pkgs.callPackage ./hydra-fork.nix {
 7 |       nixpkgsPath = pkgs.path;
 8 |       patches = [
 9 |         (pkgs.fetchpatch {
10 |           url = "https://github.com/NixOS/hydra/pull/648/commits/4171ab4c4fd576c516dc03ba64d1c7945f769af0.patch";
11 |           sha256 = "1fxa2459kdws6qc419dv4084c1ssmys7kqg4ic7n643kybamsgrx";
12 |         })
13 |       ];
14 |       src = hydraSrc;
15 |     }
16 | 


--------------------------------------------------------------------------------
/production-infra.yaml:
--------------------------------------------------------------------------------
 1 | # staging deployer infra, deployer, ci systems
 2 | args:
 3 |   IOHKaccessKeyId:
 4 |     tag: NixStr
 5 |     contents: cardano-deployer
 6 |   IOHKroute53accessKeyId:
 7 |     tag: NixStr
 8 |     contents: iohkroot-cardano-deployer
 9 |   CFaccessKeyId:
10 |     tag: NixStr
11 |     contents: cardano-deployer
12 |   EmurgoaccessKeyId:
13 |     tag: NixStr
14 |     contents: cardano-deployer
15 |   systemStart:
16 |     tag: NixInt
17 |     contents: 1519242329
18 | topology: topology-mainnet-infra.yaml
19 | environment: Production
20 | installer-bucket: stub
21 | name: iohk-infra
22 | domain: aws.iohkdev.io
23 | files:
24 | - deployments/keypairs.nix
25 | - deployments/infrastructure.nix
26 | - deployments/infrastructure-env-production.nix
27 | - deployments/infrastructure-target-aws.nix
28 | - deployments/packet-net.nix
29 | - deployments/monitoring-aws.nix
30 | - deployments/monitoring-env-production.nix
31 | - deployments/security-groups.nix
32 | elements:
33 | - Infra
34 | - Monitoring
35 | target: AWS
36 | 


--------------------------------------------------------------------------------
/relay-batch-3.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   configurationKey:
 3 |     tag: NixStr
 4 |     contents: mainnet_full
 5 |   EmurgoaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: mainnet-emurgo
 8 |   CFaccessKeyId:
 9 |     tag: NixStr
10 |     contents: mainnet-cf
11 |   IOHKaccessKeyId:
12 |     tag: NixStr
13 |     contents: mainnet-iohk
14 | gen-cmdline: manually written
15 | environment: Production
16 | topology: topology-bulk3.yaml
17 | name: relays3
18 | installer-bucket: none
19 | installer-url-base: none
20 | files:
21 | - deployments/keypairs.nix
22 | - deployments/security-groups.nix
23 | - deployments/cardano-nodes.nix
24 | - deployments/cardano-nodes-env-production.nix
25 | elements:
26 | - Nodes
27 | nixops: /nix/store/ii82khr2gqg2c0mdaycblssi1as3mp12-nixops-1.6pre0_abcdef/bin/nixops
28 | target: AWS
29 | 


--------------------------------------------------------------------------------
/relay-batch-4.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   configurationKey:
 3 |     tag: NixStr
 4 |     contents: mainnet_full
 5 |   EmurgoaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: mainnet-emurgo
 8 |   CFaccessKeyId:
 9 |     tag: NixStr
10 |     contents: mainnet-cf
11 |   IOHKaccessKeyId:
12 |     tag: NixStr
13 |     contents: mainnet-iohk
14 | gen-cmdline: manually written
15 | environment: Production
16 | topology: topology-bulk4.yaml
17 | name: relays4
18 | installer-bucket: none
19 | installer-url-base: none
20 | files:
21 | - deployments/keypairs.nix
22 | - deployments/security-groups.nix
23 | - deployments/cardano-nodes.nix
24 | - deployments/cardano-nodes-env-production.nix
25 | elements:
26 | - Nodes
27 | nixops: /nix/store/ii82khr2gqg2c0mdaycblssi1as3mp12-nixops-1.6pre0_abcdef/bin/nixops
28 | target: AWS
29 | 


--------------------------------------------------------------------------------
/relay-batch-5.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   configurationKey:
 3 |     tag: NixStr
 4 |     contents: mainnet_full
 5 |   EmurgoaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: mainnet-emurgo
 8 |   CFaccessKeyId:
 9 |     tag: NixStr
10 |     contents: mainnet-cf
11 |   IOHKaccessKeyId:
12 |     tag: NixStr
13 |     contents: mainnet-iohk
14 | gen-cmdline: manually written
15 | environment: Production
16 | topology: topology-bulk5.yaml
17 | name: relays5
18 | installer-bucket: none
19 | installer-url-base: none
20 | files:
21 | - deployments/keypairs.nix
22 | - deployments/security-groups.nix
23 | - deployments/cardano-nodes.nix
24 | - deployments/cardano-nodes-env-production.nix
25 | elements:
26 | - Nodes
27 | nixops: /nix/store/ii82khr2gqg2c0mdaycblssi1as3mp12-nixops-1.6pre0_abcdef/bin/nixops
28 | target: AWS
29 | 


--------------------------------------------------------------------------------
/relay-batch-6.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   configurationKey:
 3 |     tag: NixStr
 4 |     contents: mainnet_full
 5 |   EmurgoaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: mainnet-emurgo
 8 |   CFaccessKeyId:
 9 |     tag: NixStr
10 |     contents: mainnet-cf
11 |   IOHKaccessKeyId:
12 |     tag: NixStr
13 |     contents: mainnet-iohk
14 | gen-cmdline: manually written
15 | environment: Production
16 | topology: topology-bulk6.yaml
17 | name: relays6
18 | installer-bucket: none
19 | installer-url-base: none
20 | files:
21 | - deployments/keypairs.nix
22 | - deployments/security-groups.nix
23 | - deployments/cardano-nodes.nix
24 | - deployments/cardano-nodes-env-production.nix
25 | elements:
26 | - Nodes
27 | nixops: /nix/store/ii82khr2gqg2c0mdaycblssi1as3mp12-nixops-1.6pre0_abcdef/bin/nixops
28 | target: AWS
29 | 


--------------------------------------------------------------------------------
/scripts/blocks.sh:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env bash
 2 | 
 3 | for f in node*.log; do
 4 |      grep -n 'Created a new block' "$f" \
 5 | 	     | sed -r 's/^([0-9]+):\S*\s\S*\s.....(\S*)\s(\S*)\s\S*.\s.*$/\2_\3 \1/' \
 6 | 	| while read -r l; do
 7 |      	    echo "$l $f"	
 8 |      done
 9 | done | sort | while read -r -a l; do
10 |    t=${l[0]}
11 |    n=${l[1]}
12 |    f=${l[2]}
13 |    n2=$(tail -n +$((n+1)) "$f" | grep -nE 'ERROR|WARN|DEBUG|INFO|NOTICE'| head -1 | sed -r 's/^([0-9]*):.*$/\1/')
14 |    echo -n "[$t] $f: "
15 |    # we actually want to do arithmetic here on n and n2, they aren't strings
16 |    # shellcheck disable=SC2086
17 |    tail -n +$((n+1)) $f | head -n $((n2-1))
18 | done
19 | 


--------------------------------------------------------------------------------
/scripts/check-hydra.sh:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env nix-shell
 2 | #!nix-shell -p "(jq.overrideAttrs (drv: { doCheck = false; }))" -i bash
 3 | 
 4 | nix-build https://github.com/NixOS/nixpkgs/archive/09195057114a0a8d112c847a9a8f52957420857d.tar.gz -A hydra
 5 | echo '~~~ Evaluating release.nix'
 6 | command time --format '%e' -o eval-time.txt \
 7 |     ./result/bin/hydra-eval-jobs \
 8 |     --option allowed-uris "https://github.com/NixOS https://github.com/input-output-hk" \
 9 |     -I . jobsets/cardano.nix > eval.json
10 | EVAL_EXIT_CODE="$?"
11 | if [ "$EVAL_EXIT_CODE" != 0 ]
12 | then
13 |   rm eval.json eval-time.txt
14 |   echo -e "\\e[31;1mERROR: Failed to evaluate release.nix\\e[0m"
15 |   exit 1
16 | fi
17 | EVAL_TIME=$(cat eval-time.txt)
18 | jq . < eval.json
19 | ERRORS=$(jq -r 'map_values(.error)|to_entries[]|select(.value)|@text "\(.key): \(.value)"' < eval.json)
20 | NUM_ERRORS=$(jq -r '[ map_values(.error)|to_entries[]|select(.value) ] |length' < eval.json)
21 | rm eval.json eval-time.txt
22 | 
23 | if [ "$NUM_ERRORS" != 0 ]
24 | then
25 |   echo -e "\\e[31;1mERROR: evaluation completed in $EVAL_TIME seconds with $NUM_ERRORS errors\\e[0m"
26 |   echo "$ERRORS"
27 |   exit 1
28 | else
29 |   echo -e "\\e[32;1mOK: evaluation completed in $EVAL_TIME seconds with no errors\\e[0m"
30 |   exit 0
31 | fi
32 | 


--------------------------------------------------------------------------------
/scripts/collect_csv.py:
--------------------------------------------------------------------------------
 1 | import pandas as pd
 2 | import glob
 3 | import sys
 4 | 
 5 | def collect_tps_stat(folder):
 6 |     tps_files = glob.glob(folder + '/*-tps.csv')
 7 |     tpss = []
 8 |     for tfile in tps_files:
 9 |         tpss.append(pd.read_csv(tfile))
10 |         
11 |     for i in range(0, len(tpss)):
12 |         tpss[i] = tpss[i].rename(columns={"tps": "tps_node{}".format(i)})
13 |     
14 |     all_tps = tpss[0]
15 |     for i in range(1, len(tpss)):
16 |         all_tps = all_tps.merge(tpss[i], on='time')
17 |     
18 |     tps_cols = ["tps_node{}".format(i) for i in range(0, len(tpss))]
19 |     all_tps['tps_avg'] = all_tps[tps_cols].mean(axis=1)
20 |     
21 |     all_tps['time'] = pd.to_datetime(all_tps['time'])
22 |     return all_tps
23 | 
24 | def strip_zeros(df):
25 |     return df[df['tps_avg'] > 0]
26 | 
27 | all_tps = collect_tps_stat('.')
28 | all_tps = strip_zeros(all_tps).sort_values('time')
29 | all_tps.to_csv('measurements.csv', index=False)
30 | 


--------------------------------------------------------------------------------
/scripts/enroll-packetnet-machine.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | machine_name=$1
 4 | 
 5 | test -n "$machine_name" || {
 6 |         echo "Usage: $(basename "$0") MACHINE-NAME" >&2
 7 |         exit 1
 8 | }
 9 | test ! -d deployments/"${machine_name}" || {
10 |         echo "FATAL: deployments/${machine_name} already exists" >&2
11 |         exit 1
12 | }
13 | 
14 | scp -r -o StrictHostKeyChecking=accept-new root@"${machine_name}".aws.iohkdev.io:/etc/nixos/packet/ deployments/"${machine_name}"
15 | 


--------------------------------------------------------------------------------
/scripts/enumerate-nixops-instances.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -e
 4 | 
 5 | ACCESS_KEY_ID=${1:-'iohk'}
 6 | export ACCESS_KEY_ID
 7 | REGIONS="$(aws ec2 describe-regions --query 'Regions[].{Name:RegionName}' --output text)"
 8 | 
 9 | for region in ${REGIONS}
10 | do
11 |         echo "-- region: ${region}"
12 |         # shellcheck disable=SC2016
13 |         aws ec2 describe-instances \
14 |             --region "${region}" \
15 |             --output text \
16 |             --query 'Reservations[].Instances[].[Tags[?Key==`CharonMachineName`].Value,Tags[?Key==`CharonNetworkUUID`].Value[]]' \
17 |             --filters "Name=tag:CharonNetworkUUID,Values=*"
18 | done
19 | 


--------------------------------------------------------------------------------
/scripts/find-all-revisions.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | git ls-files | grep -v pkgs/default.nix | xargs grep -EH --color '[^a-z0-9][a-z0-9]{40}[^a-z0-9]'
3 | exit 0
4 | 


--------------------------------------------------------------------------------
/scripts/rotate-keys.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | # goes from 3 regions to 4 regions topology and corresponding key index
 3 |                                                                                                                                                                                           
 4 | set +x                                                                                                                                                                                   
 5 |                                                                                                                                                                                         
 6 | #                                      previous -> new (4 regions)                                                                                                                     
 7 | mv node0.key mainnet/keys/key0.key   # IOHK c-a-1                                                                                                                                     
 8 | mv node1.key mainnet/keys/key1.key   # IOHK c-a-2                                                                                                                                    
 9 | mv node3.key mainnet/keys/key2.key   # Emurgo c-b-1                                                                                                                                 
10 | mv node4.key mainnet/keys/key3.key   # Emurgo c-b-2                                                                                                                                 
11 | mv node5.key mainnet/keys/key4.key   # CF c-c-1                                                                                                                                    
12 | mv node6.key mainnet/keys/key5.key   # CF  c-c-2
13 | mv node2.key mainnet/keys/key6.key   # IOHK c-a-3 -> c-d-1
14 | 


--------------------------------------------------------------------------------
/scripts/shellcheck.nix:
--------------------------------------------------------------------------------
 1 | { runCommand, shellcheck, src, lib }:
 2 | 
 3 | runCommand "iohk-ops-shellcheck" { buildInputs = [ shellcheck ]; } ''
 4 |   EXIT_STATUS=0
 5 |   cd ${src}
 6 |   while IFS= read -r -d ''' i
 7 |   do
 8 |     if shellcheck -x -e 1008 -e 2148 "$i"
 9 |     then
10 |       echo "$i [ PASSED ]"
11 |     else
12 |       echo "$i [ FAILED ]"
13 |       EXIT_STATUS=$(($EXIT_STATUS+1))
14 |     fi
15 |   done <  <(find -name '*.sh' -print0)
16 |   echo $EXIT_STATUS > $out
17 |   echo Total Failed Files: $EXIT_STATUS
18 |   exit "$EXIT_STATUS"
19 | ''
20 | 


--------------------------------------------------------------------------------
/scripts/stack.yaml:
--------------------------------------------------------------------------------
 1 | ##
 2 | ## ATTENTION with regard to this file:
 3 | ##
 4 | ##  1. it is not intended to be used for building things -- only Nix is supported for that purpose
 5 | ##  2. its only purpose is to facilitate 'intero' working inside nix-shell, and the following content
 6 | ##     was carefully crafted to that end -- please, don't change it without ensuring that:
 7 | ##     - 'intero' continues to work inside nix-shell, and
 8 | ##     - it doesn't have to rebuild Haskell dependencies that nix-shell already provided
 9 | ##
10 | nix:
11 |   enable: false
12 | system-ghc: true
13 | resolver: ghc-8.0.2
14 | packages:
15 | - '../iohk'
16 | project-root: ../iohk
17 | 


--------------------------------------------------------------------------------
/scripts/test-builder-performance.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | run_build() {
 4 |         nix-build --no-out-link default.nix -A cardano-sl-wallet-new "$@"
 5 | }
 6 | 
 7 | run_scenario() {
 8 |         scenario=$1
 9 |         nix-store --gc
10 |         echo "Running scenario ${scenario}:"
11 |         case ${scenario} in
12 |                 serial )            run_build                   --no-build-output;;
13 |                 maxcores )          run_build --cores 0         --no-build-output;;
14 |                 parallel )          run_build -j auto           --no-build-output;;
15 |                 parallel-maxcores ) run_build -j auto --cores 0 --no-build-output;;
16 |                 best-logged )       run_build -j auto --cores 0;;
17 |         esac 2>&1 | ts -s | ts -i | tee build."${scenario}"."$(date +%s)"
18 | }
19 | 
20 | for s in "$@"
21 | do run_scenario "$s"
22 | done
23 | 


--------------------------------------------------------------------------------
/shell.nix:
--------------------------------------------------------------------------------
 1 | { commonLib ? import ./lib.nix
 2 | , pkgs ? commonLib.pkgs
 3 | }:
 4 | 
 5 | let
 6 |   iohkpkgs = import ./default.nix {};
 7 |   iohk-ops = iohkpkgs.iohk-ops;
 8 |   niv = (import commonLib.sources.niv {}).niv;
 9 |   justIo = pkgs.mkShell {
10 |     name = "io";
11 |     buildInputs = with pkgs; [
12 |       iohk-ops
13 |       #iohkpkgs.cardano-node-pkgs.nix-tools.exes.cardano-node
14 |       (import (import ./nix/sources.nix).niv {}).niv
15 |       terraform_0_11
16 |       iohkpkgs.nixops ];
17 |     passthru = {
18 |       inherit ioSelfBuild withAuxx;
19 |     };
20 |     shellHook = ioShellHook;
21 |   };
22 |   ioSelfBuild = pkgs.lib.overrideDerivation iohk-ops.env (drv: {
23 |     shellHook = ''
24 |       function io {
25 |         cabal exec iohk-ops -- "$@"
26 |       }
27 |       function ghcid-io {
28 |         ${pkgs.haskellPackages.ghcid}/bin/ghcid -c "ghci -iiohk -iiohk/common iohk/iohk-ops.hs"
29 |       }
30 |     '';
31 |   });
32 |   withAuxx = pkgs.mkShell {
33 |     name = "io-with-auxx";
34 |     buildInputs = [
35 |       iohk-ops
36 |       iohkpkgs.nix-tools.exes.cardano-sl-auxx
37 |       iohkpkgs.nix-tools.exes.cardano-sl-tools
38 |       # todo, switch run nix-shell to nix run
39 |       pkgs.bashInteractive
40 |     ];
41 |     shellHook = ''
42 |       ${ioShellHook}
43 |       for prog in cardano-keygen cardano-x509-certificates cardano-auxx; do
44 |         source <($prog --bash-completion-script `type -p $prog`)
45 |       done
46 |     '';
47 |   };
48 |   ioShellHook = ''
49 |     source <(iohk-ops --bash-completion-script `type -p iohk-ops`)
50 |     complete -o filenames -F _iohk-ops io
51 |   '';
52 | in justIo
53 | 


--------------------------------------------------------------------------------
/staging-infra.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   IOHKaccessKeyId:
 3 |     tag: NixStr
 4 |     contents: cardano-deployer
 5 |   CFaccessKeyId:
 6 |     tag: NixStr
 7 |     contents: cardano-deployer
 8 |   EmurgoaccessKeyId:
 9 |     tag: NixStr
10 |     contents: cardano-deployer
11 | topology: topology-staging.yaml
12 | environment: Staging
13 | installer-bucket: stub
14 | name: staging-infra
15 | files:
16 | - deployments/keypairs.nix
17 | - deployments/infrastructure.nix
18 | - deployments/infrastructure-env-staging.nix
19 | - deployments/infrastructure-target-aws.nix
20 | elements:
21 | - Infra
22 | target: AWS
23 | 


--------------------------------------------------------------------------------
/staging-testnet.yaml:
--------------------------------------------------------------------------------
 1 | # staging cardano network
 2 | args:
 3 |   configurationKey:
 4 |     tag: NixStr
 5 |     contents: mainnet_dryrun_full
 6 |   EmurgoaccessKeyId:
 7 |     tag: NixStr
 8 |     contents: fifth-party
 9 |   systemStart:
10 |     tag: NixInt
11 |     contents: 1506450213
12 |   CFaccessKeyId:
13 |     tag: NixStr
14 |     contents: third-party
15 |   IOHKaccessKeyId:
16 |     tag: NixStr
17 |     contents: iohk
18 |   IOHKroute53accessKeyId:
19 |     tag: NixStr
20 |     contents: iohk
21 | gen-cmdline: template -c staging-testnet.yaml --environment staging --nixops /nix/store/mb4rfbkliwjvcdcnqzgg4bgi45i8pb3s-nixops-1.6pre0_abcdef/bin/nixops
22 |   --here staging nodes reportserver explorer
23 | environment: Staging
24 | topology: topology-staging.yaml
25 | installer-bucket:   update-awstest.iohkdev.io
26 | installer-url-base: update-awstest.iohkdev.io
27 | name: rc-staging
28 | domain: awstest.iohkdev.io
29 | files:
30 | - deployments/keypairs.nix
31 | - deployments/security-groups.nix
32 | - deployments/cardano-nodes.nix
33 | - deployments/cardano-nodes-env-staging.nix
34 | - deployments/cardano-explorer.nix
35 | - deployments/cardano-explorer-env-staging.nix
36 | - deployments/monitoring-env-staging.nix
37 | - deployments/monitoring-aws.nix
38 | elements:
39 | - Nodes
40 | - Explorer
41 | - Monitoring
42 | nixops: /nix/store/mb4rfbkliwjvcdcnqzgg4bgi45i8pb3s-nixops-1.6pre0_abcdef/bin/nixops
43 | target: AWS
44 | 


--------------------------------------------------------------------------------
/static/id_buildfarm.pub:
--------------------------------------------------------------------------------
1 | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCx2oZoaoHu8YjD94qNp8BfST12FDvgevWloTXqjPQD+diOL1I6nC+nDT2hroAOIkShlM4O2OgbUArmTWc8nPTBUvRClYgjd7jPpVhkyTm9tsHlAFTpgv1n2GPIOK9e97dgU3ZB5phx58WcLVtBeCChFce4EM7oLMKYeo/4pggtal8rtqFjyViPrXncZLtYkIcaKFGBTUMeHi/S3GUiLIlp5VF34L21lPZCy5oZKf70kWWkT52coE4EyEx9fipp2vybMdB/qT4r9pMqa3mmf9IXwfIhoKadpMhPfyaYm+oxmddrSv6aDMjs89fB6cJGpLA5gQFfISQUD1DB8ufjW43v hi@serokell.io
2 | 
3 | 


--------------------------------------------------------------------------------
/static/txgen-logging-warnonly.yaml:
--------------------------------------------------------------------------------
1 | loggerTree:
2 |     severity: Warning
3 |     file: txgen.log
4 | 


--------------------------------------------------------------------------------
/static/txgen-logging.yaml:
--------------------------------------------------------------------------------
1 | loggerTree:
2 |      severity: Info
3 |      file: txgen.log
4 | 


--------------------------------------------------------------------------------
/terraform/appveyor-deploy-s3/README.md:
--------------------------------------------------------------------------------
 1 | # Prerequisites
 2 | 
 3 | See the [iohk-ops terraform main readme](../README.md).
 4 | 
 5 | # Provisioning appveyor deployment bucket
 6 | 
 7 | Go ahead by making changes and output variables we need:
 8 | 
 9 |     terraform apply
10 | 
11 | You'll have to decrypt secret_key:
12 | 
13 |     terraform output secret_key | base64 --decode | gpg --decrypt
14 | 
15 | For each of the outputs use following form to encrypt them:
16 | 
17 | https://ci.appveyor.com/tools/encrypt
18 | 
19 | And then modify `appveyor.yml` with the output values:
20 | 
21 |     deploy:
22 |       provider: S3
23 |       access_key_id:
24 |         secure: **encrypted value**
25 |       secret_access_key:
26 |         secure: **encrypted value**
27 |       bucket: **value of bucket_name output**
28 |       region: **value of bucket_region output**
29 |       folder: 
30 |       artifact: **name of your artifact**
31 |       set_public: true
32 | 
33 | # Bucket index file
34 | 
35 | Pop an `index.html` file in the bucket to enable readable directory
36 | listings for users.
37 | 
38 |     aws s3 cp --acl public-read bucket-index.html s3://appveyor-ci-deploy/index.html
39 | 


--------------------------------------------------------------------------------
/terraform/appveyor-deploy-s3/bucket-index.html:
--------------------------------------------------------------------------------
 1 | <div id="listing"></div>
 2 | 
 3 | <!-- add jQuery - if you already have it just ignore this line -->
 4 | <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js"></script>
 5 | 
 6 | <!-- the JS variables for the listing -->
 7 | <script type="text/javascript">
 8 |    var S3BL_IGNORE_PATH = true;
 9 |    var BUCKET_NAME = 'appveyor-ci-deploy';
10 |    // var BUCKET_URL = 'https://appveyor-ci-deploy.s3-ap-northeast-1.amazonaws.com';
11 |    var S3B_ROOT_DIR = 'installers/';
12 |    // var S3B_SORT = 'DEFAULT';
13 |    var EXCLUDE_FILE = 'index.html';
14 |    // var AUTO_TITLE = true;
15 |    // var S3_REGION = 'ap-northeast-1';
16 | </script>
17 | 
18 | <!-- the JS to the do the listing -->
19 | <script type="text/javascript" src="https://rawgit.com/rufuspollock/s3-bucket-listing/gh-pages/list.js"></script>
20 | 


--------------------------------------------------------------------------------
/terraform/appveyor-deploy-s3/main.tf:
--------------------------------------------------------------------------------
 1 | provider "aws" {
 2 |   region = "ap-northeast-1"
 3 | }
 4 | 
 5 | terraform {
 6 |   backend "s3" {
 7 |     bucket  = "iohk-ops-tfstate"
 8 |     key     = "remote-tfstate/appveyor-deploy-s3/terraform.tfstate"
 9 |     region  = "us-west-1"
10 |     encrypt = true
11 |   }
12 | }
13 | 
14 | module "appveyor-deploy-s3" {
15 |   source      = "../modules/ci-deploy-s3"
16 |   prefix      = "appveyor-"              # <-- make sure to set this to a custom value.
17 |   pgp_key     = "keybase:rvliohk"        # <-- or a base64 encoded PGP public key
18 | }
19 | 
20 | output "bucket_name" {
21 |   value = "${module.appveyor-deploy-s3.bucket_name}"
22 | }
23 | 
24 | output "bucket_region" {
25 |   value = "${module.appveyor-deploy-s3.bucket_region}"
26 | }
27 | 
28 | output "access_key" {
29 |   value = "${module.appveyor-deploy-s3.access_key}"
30 | }
31 | 
32 | output "secret_key" {
33 |   value = "${module.appveyor-deploy-s3.secret_key}"
34 | }
35 | 


--------------------------------------------------------------------------------
/terraform/appveyor-s3-cache/README.md:
--------------------------------------------------------------------------------
 1 | # Prerequisites
 2 | 
 3 | See the [iohk-ops terraform main readme](../README.md).
 4 | 
 5 | # Provisioning appveyor bucket
 6 | 
 7 | Go ahead by making changes and output variables we need:
 8 | 
 9 |     terraform apply
10 | 
11 | You'll have to decrypt secret_key:
12 | 
13 |     terraform output secret_key | base64 --decode | gpg --decrypt
14 | 
15 | For each of the outputs use following form to encrypt them:
16 | 
17 | https://ci.appveyor.com/tools/encrypt
18 | 
19 | And then modify appveyor.yml with the output values:
20 | 
21 | environment:
22 |   global:
23 |     AWS_ACCESS_KEY_ID:
24 |       secure: BSNfEghh/xxx=
25 |     AWS_SECRET_ACCESS_KEY
26 |       secure: BSNfEghh/xxx=
27 |     S3_BUCKET: XXX
28 | 


--------------------------------------------------------------------------------
/terraform/appveyor-s3-cache/main.tf:
--------------------------------------------------------------------------------
 1 | provider "aws" {
 2 |   region = "us-west-1"
 3 | }
 4 | 
 5 | terraform {
 6 |   backend "s3" {
 7 |     bucket  = "iohk-ops-tfstate"
 8 |     key     = "remote-tfstate/cache-s3-iam-policy/terraform.tfstate"
 9 |     region  = "us-west-1"
10 |     encrypt = true
11 |   }
12 | }
13 | 
14 | module "ci-cache" {
15 |   source     = "../modules/ci-cache-s3"
16 |   prefix     = "appveyor-"              # <-- make sure to set this to a custom value.
17 |   pgp_key    = "keybase:ielectric"      # <-- or a base64 encoded PGP public key
18 |   cache_days = 30
19 | }
20 | 
21 | output "bucket_name" {
22 |   value = "${module.ci-cache.bucket_name}"
23 | }
24 | 
25 | output "access_key" {
26 |   value = "${module.ci-cache.access_key}"
27 | }
28 | 
29 | output "secret_key" {
30 |   value = "${module.ci-cache.secret_key}"
31 | }
32 | 


--------------------------------------------------------------------------------
/terraform/cardano-deployer/aws.tf:
--------------------------------------------------------------------------------
 1 | terraform {
 2 |   required_version = "~> 0.11"
 3 | 
 4 |   backend "s3" {
 5 |     bucket  = "iohk-ops-tfstate"
 6 |     key     = "remote-tfstate/cardano-deployer/terraform.tfstate"
 7 |     region  = "us-west-1"
 8 |     encrypt = true  # AWS KMS encryption of S3 files
 9 |   }
10 | }
11 | 
12 | provider "aws" {
13 |   # No credentials explicitly set here because they come from either the
14 |   # environment or the global credentials file.
15 | 
16 |   version = "~> 1.19"
17 |   region  = "eu-west-1"
18 | 
19 |   assume_role {
20 |     role_arn = "${var.workspace_iam_roles[terraform.workspace]}"
21 |   }
22 | }
23 | 
24 | provider "template" {
25 |   version = "~> 1.0"
26 | }
27 | 


--------------------------------------------------------------------------------
/terraform/cardano-deployer/configuration.nix:
--------------------------------------------------------------------------------
 1 | { config, lib, pkgs, ... }:
 2 | 
 3 | # This is a minimal NixOS configuration for the deployer so that
 4 | # devops can login and run iohk-ops to fully deploy the deployer and
 5 | # then other hosts.
 6 | 
 7 | let
 8 |   # templated by terraform
 9 |   env = "${env}";
10 |   username = "${username}";
11 | 
12 |   src = pkgs.fetchFromGitHub {
13 |     owner = "input-output-hk";
14 |     repo = "iohk-ops";
15 |     rev = "2ecf92b2c105abbcbc72abb90cc89fbcdedf1bd9";
16 |     sha256 = "19p0722w135l36y64vmn5x1imqxmkx8gzrw2zzkmnh7xd0c1fyay";
17 |   };
18 |   iohk-pkgs = import src {};
19 |   commonLib = import (src + "/lib.nix");
20 | 
21 | in {
22 |     imports = [
23 |       <nixpkgs/nixos/modules/virtualisation/amazon-image.nix>
24 |     ];
25 |     ec2.hvm = true;
26 | 
27 |     users.users.${username} = {
28 |       isNormalUser = true;
29 |       description = "Deploy the deployer";
30 |       extraGroups = [ "wheel" ];
31 |       openssh.authorizedKeys.keys = commonLib.devOpsKeys;
32 |     };
33 | 
34 |     users.extraUsers.root.openssh.authorizedKeys.keys = commonLib.devOpsKeys;
35 | 
36 |     security.sudo.enable = true;
37 |     security.sudo.wheelNeedsPassword = false;
38 | 
39 |     networking.hostName = "${env}-deployer";
40 | 
41 |     nix = {
42 |       binaryCaches = [
43 |         "https://cache.nixos.org"
44 |         "https://hydra.iohk.io"
45 |       ];
46 |       binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
47 |     };
48 | 
49 |     environment.systemPackages =
50 |       with pkgs; [ tmux git vim ] ++
51 |       (with iohk-pkgs; [ nixops iohk-ops ]);
52 | }
53 | 


--------------------------------------------------------------------------------
/terraform/cardano-deployer/outputs.tf:
--------------------------------------------------------------------------------
1 | output "deployer_ip" {
2 |   value = "${aws_eip.deployer_eip.public_ip}"
3 | }
4 | 
5 | output "deployer_ssh" {
6 |   value = "${var.username}@${aws_eip.deployer_eip.public_ip}"
7 | }
8 | 


--------------------------------------------------------------------------------
/terraform/cardano-deployer/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "workspace_iam_roles" {
 2 |   description = "AWS subaccount role for deploying resources"
 3 | 
 4 |   default = {
 5 |     testnet = "arn:aws:iam::117127962627:role/cardano-public-testnet"
 6 |     mainnet = "arn:aws:iam::PRODUCTION-ACCOUNT-ID:role/Terraform"
 7 |   }
 8 | }
 9 | 
10 | variable "aws_region" {
11 |   description = "AWS region to put deployer in"
12 |   default = "eu-west-1"
13 | }
14 | 
15 | variable "instance_type" {
16 |   description = "Size of EC2 instance"
17 |   # 8 vCPU / 61GB RAM - $0.593 per hour in Ireland
18 |   default = "r4.2xlarge"
19 | }
20 | 
21 | variable "volume_size" {
22 |   description = "Size in GB of deployer root filesystem volume"
23 |   default = 100
24 | }
25 | 
26 | variable "username" {
27 |   description = "Username for deployer login"
28 |   default = "deployer"
29 | }
30 | 
31 | variable "termination_protection" {
32 |   description = "Prevent the instance being destroyed, except through web console."
33 |   default = true
34 | }
35 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/aws.tf:
--------------------------------------------------------------------------------
 1 | # Proxy configuration blocks
 2 | # https://www.terraform.io/docs/modules/usage.html#passing-providers-explicitly
 3 | 
 4 | provider "aws" {
 5 | }
 6 | 
 7 | provider "aws" {
 8 |   alias = "singapore"
 9 | }
10 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/groups.tf:
--------------------------------------------------------------------------------
 1 | # resource "aws_iam_group" "tweag" {
 2 | #   name = "tweag"
 3 | # }
 4 | 
 5 | ############################################################################
 6 | 
 7 | resource "aws_iam_group" "developers" {
 8 |   name = "developers"
 9 | }
10 | 
11 | resource "aws_iam_group_policy_attachment" "developers_ec2" {
12 |   group      = "${aws_iam_group.developers.name}"
13 |   policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
14 | }
15 | 
16 | resource "aws_iam_group_policy_attachment" "developers_enforce_mfa" {
17 |   group      = "${aws_iam_group.developers.name}"
18 |   policy_arn = "${aws_iam_policy.enforce_mfa.arn}"
19 | }
20 | 
21 | ############################################################################
22 | 
23 | resource "aws_iam_group" "deployers" {
24 |   name = "deployers"
25 | }
26 | 
27 | resource "aws_iam_group_policy_attachment" "deployers_staging_ec2" {
28 |   group      = "${aws_iam_group.deployers.name}"
29 |   policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
30 | }
31 | resource "aws_iam_group_policy_attachment" "deployers_staging_route53" {
32 |   group      = "${aws_iam_group.deployers.name}"
33 |   policy_arn = "arn:aws:iam::aws:policy/AmazonRoute53FullAccess"
34 | }
35 | 
36 | # Alas! NixOps does not support session credentials necessary for MFA.
37 | # resource "aws_iam_group_policy_attachment" "deployers_enforce_mfa" {
38 | #   group      = "${aws_iam_group.deployers.name}"
39 | #   policy_arn = "${aws_iam_policy.enforce_mfa.arn}"
40 | # }
41 | 
42 | ############################################################################
43 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/main.tf:
--------------------------------------------------------------------------------
 1 | 
 2 | resource "aws_route53_zone" "cardano_testnet" {
 3 |   name = "cardano-testnet.iohkdev.io"
 4 |   tags {
 5 |     Environment = "testnet"
 6 |   }
 7 | }
 8 | 
 9 | resource "aws_route53_record" "cardano_testnet_ns" {
10 |   zone_id = "${aws_route53_zone.cardano_testnet.zone_id}"
11 |   name    = "cardano-testnet.iohkdev.io"
12 |   type    = "NS"
13 |   ttl     = "300"
14 | 
15 |   records = [
16 |     "${aws_route53_zone.cardano_testnet.name_servers.0}",
17 |     "${aws_route53_zone.cardano_testnet.name_servers.1}",
18 |     "${aws_route53_zone.cardano_testnet.name_servers.2}",
19 |     "${aws_route53_zone.cardano_testnet.name_servers.3}",
20 |   ]
21 | }
22 | 
23 | # Put this temporary zone into cardano public testnet to keep nixops happy.
24 | # It's only for development clusters so should be moved to development account.
25 | resource "aws_route53_zone" "aws_iohkdev_temporary" {
26 |   name = "aws.iohkdev.io"
27 |   tags {
28 |     Environment = "development"
29 |   }
30 | }
31 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/modules/installer_bucket/bucket-index.html:
--------------------------------------------------------------------------------
 1 | <!doctype html>
 2 | <html lang="en">
 3 |   <head>
 4 |     <meta charset="utf-8">
 5 |     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 6 |     <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.1/css/bootstrap.min.css" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId/iRN3ewGhXQFZCSftd1LZCfmhktB" crossorigin="anonymous">
 7 |     <title>Cardano SL Testnet Installers</title>
 8 | 
 9 |     <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js" integrity="sha384-3ceskX3iaEnIogmQchP8opvBy3Mi7Ce34nWjpBIwVTHfGYWQS9jwHDVRnpKKHJg7" crossorigin="anonymous"></script>
10 |   </head>
11 | 
12 |   <body>
13 |     <main role="main" class="container" id="app">
14 |       <h1 class="mt-5">Cardano SL Testnet Installers</h1>
15 |       <p class="lead">
16 |         These are the released Daedalus installers for Cardano
17 |         SL <em>Testnet</em>.
18 |       </p>
19 | 
20 |       <p class="lead">
21 |         For mainnet releases, visit
22 |         the <a href="https://daedaluswallet.io/#download">Daedalus
23 |         Wallet downloads page</a>.
24 |       </p>
25 | 
26 |       <div id="listing"></div>      
27 |     </main>
28 | 
29 |     <!-- the JS variables for the listing -->
30 |     <script type="text/javascript">
31 |        var S3BL_IGNORE_PATH = true;
32 |        var BUCKET_NAME = '${bucket_name}';
33 |        var EXCLUDE_FILE = 'index.html';
34 |     </script>
35 | 
36 |     <!-- the JS to do the listing -->
37 |     <script type="text/javascript" src="https://rawgit.com/rufuspollock/s3-bucket-listing/3d0774ea03d810d85099ef516ff5eeddbdd9cf5e/list.js"></script>
38 |   </body>
39 | </html>
40 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/modules/installer_bucket/output.tf:
--------------------------------------------------------------------------------
1 | output "bucket_name" {
2 |   value = "${aws_s3_bucket.bucket.id}"
3 | }
4 | 
5 | output "bucket_region" {
6 |   value = "${aws_s3_bucket.bucket.region}"
7 | }
8 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/modules/installer_bucket/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "aws_region" {
 2 |   description = "Region for bucket"
 3 | }
 4 | 
 5 | variable "bucket_name" {
 6 |   description = "Name for the S3 bucket. Full DNS name is best to allow for HTTPS access"
 7 | }
 8 | 
 9 | variable "prefix" {
10 |   description = "Text to make unique resource names"
11 | }
12 | 
13 | variable "group" {
14 |   description = "The group that can write to the bucket."
15 | }
16 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/modules/user/main.tf:
--------------------------------------------------------------------------------
 1 | data "aws_caller_identity" "current" {}
 2 | 
 3 | resource "aws_iam_user" "self" {
 4 |   name = "${var.name}"
 5 | }
 6 | 
 7 | resource "aws_iam_user_login_profile" "self" {
 8 |   user    = "${aws_iam_user.self.name}"
 9 |   pgp_key = "${var.pgp_user}"
10 | }
11 | 
12 | resource "aws_iam_access_key" "self" {
13 |   user    = "${aws_iam_user.self.name}"
14 |   pgp_key = "${var.pgp_key}"
15 | }
16 | 
17 | resource "aws_iam_user_policy_attachment" "self_mfa" {
18 |   user       = "${aws_iam_user.self.name}"
19 |   policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SelfManageMFADevice"
20 | }
21 | 
22 | resource "aws_iam_user_policy_attachment" "self_create_access_key" {
23 |   user       = "${aws_iam_user.self.name}"
24 |   policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/CreateAWSAccessKey"
25 | }
26 | 
27 | resource "local_file" "self_password" {
28 |   filename = "${path.module}/private/${var.name}.password"
29 |   content  = "${aws_iam_user_login_profile.self.encrypted_password}"
30 | }
31 | 
32 | resource "local_file" "self_secret" {
33 |   filename = "${path.module}/private/${var.name}.secret"
34 |   content  = "${aws_iam_access_key.self.encrypted_secret}"
35 | }
36 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/modules/user/outputs.tf:
--------------------------------------------------------------------------------
 1 | output "name" {
 2 |   value = "${aws_iam_user.self.name}"
 3 | }
 4 | 
 5 | # output "aws_credentials" {
 6 | #   value = <<EOF
 7 | # [${aws_iam_user.self.name}]
 8 | # aws_access_key_id = ${aws_iam_access_key.self.id}
 9 | # aws_secret_access_key = ${aws_iam_access_key.self.encrypted_secret}
10 | # EOF
11 | # }
12 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/modules/user/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "name" {
 2 |   description = "User name"
 3 | }
 4 | 
 5 | variable "policy" {
 6 |   description = "Policy name"
 7 |   default = "AmazonEC2FullAccess"
 8 | }
 9 | 
10 | variable "pgp_key" {
11 |   description = "Name of PGP key to use for secret_key encryption, eg. keybase:username"
12 | }
13 | 
14 | variable "pgp_user" {
15 |   description = "Name of PGP key to use for console password, eg. keybase:username"
16 | }
17 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/roles.tf:
--------------------------------------------------------------------------------
 1 | ############################################################################
 2 | # Roles: Elastic Container Repository
 3 | 
 4 | data "aws_iam_policy_document" "ecr_login_role_policy" {
 5 |   statement {
 6 |     actions   = ["ecr:GetAuthorizationToken"]
 7 |     resources = ["*"]
 8 |     effect    = "Allow"
 9 |   }
10 | }
11 | 
12 | resource "aws_iam_policy" "ecr_login_policy" {
13 |   name        = "ECRLogin"
14 |   path        = "/"
15 |   description = "Login to ECR"
16 | 
17 |   policy = <<EOF
18 | {
19 |     "Version": "2012-10-17",
20 |     "Statement": [
21 |         {
22 |             "Effect": "Allow",
23 |             "Action": [
24 |                 "ecr:GetAuthorizationToken",
25 |                 "ecr:BatchCheckLayerAvailability",
26 |                 "ecr:GetDownloadUrlForLayer",
27 |                 "ecr:GetRepositoryPolicy",
28 |                 "ecr:DescribeRepositories",
29 |                 "ecr:ListImages",
30 |                 "ecr:DescribeImages",
31 |                 "ecr:BatchGetImage"
32 |             ],
33 |             "Resource": "*"
34 |         }
35 |     ]
36 | }
37 | EOF
38 | }
39 | 
40 | resource "aws_iam_role" "ecr_login_role" {
41 |   name = "ECRLogin"
42 | 
43 |   assume_role_policy = <<EOF
44 | {
45 |   "Version": "2012-10-17",
46 |   "Statement": [
47 |     {
48 |       "Sid": "",
49 |       "Effect": "Allow",
50 |       "Principal": {
51 |         "Service": [
52 |           "ec2.amazonaws.com"
53 |         ]
54 |       },
55 |       "Action": "sts:AssumeRole"
56 |     }
57 |   ]
58 | }
59 | EOF
60 | }
61 | 
62 | resource "aws_iam_role_policy_attachment" "ecr_login_policy_attachment" {
63 |   role       = "${aws_iam_role.ecr_login_role.name}"
64 |   policy_arn = "${aws_iam_policy.ecr_login_policy.arn}"
65 | }
66 | 
67 | resource "aws_iam_instance_profile" "ecr_login" {
68 |   name = "ecr_login"
69 |   role = "${aws_iam_role.ecr_login_role.name}"
70 | }
71 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/s3.tf:
--------------------------------------------------------------------------------
 1 | module "testnet_installer_bucket" {
 2 |   source      = "./modules/installer_bucket"
 3 |   bucket_name = "updates-cardano-testnet"
 4 |   prefix      = "updates-cardano-testnet"
 5 |   aws_region  = "ap-southeast-1"
 6 |   providers = {
 7 |     aws = "aws.singapore"
 8 |   }
 9 |   group       = "${aws_iam_group.deployers.name}"
10 | }
11 | 
12 | # Friendly DNS entry for S3 bucket.
13 | # fixme: use testnet_installer_bucket.bucket_name variable
14 | resource "aws_route53_record" "testnet_installer_bucket" {
15 |   zone_id = "${aws_route53_zone.cardano_testnet.zone_id}"
16 |   name    = "updates"
17 |   type    = "CNAME"
18 |   ttl     = "300"
19 |   records = ["updates-cardano-testnet.s3.amazonaws.com"]
20 | }
21 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/templates/assume_role_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Action": "sts:AssumeRole",
 6 |       "Principal": {
 7 |         "Service": "ec2.amazonaws.com"
 8 |       },
 9 |       "Effect": "Allow",
10 |       "Sid": ""
11 |     }
12 |   ]
13 | }
14 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/templates/s3_bucket_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect": "Allow",
 6 |       "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
 7 |       "Resource": ["arn:aws:s3:::${bucket}"]
 8 |     },
 9 |     {
10 |       "Effect": "Allow",
11 |         "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
12 |       "Resource": ["arn:aws:s3:::${bucket}/*"]
13 |     }
14 |   ]
15 | }
16 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/global/variables.tf:
--------------------------------------------------------------------------------
1 | variable "deployer_pgp_key" {
2 |   description = "Public key of deployer user"
3 | }
4 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/main.tf:
--------------------------------------------------------------------------------
 1 | terraform {
 2 |   required_version = "~> 0.11"
 3 | 
 4 |   backend "s3" {
 5 |     bucket  = "iohk-ops-tfstate"
 6 |     key     = "remote-tfstate/global-state/terraform.tfstate"
 7 |     region  = "us-west-1"
 8 |     encrypt = true  # AWS KMS encryption of S3 files
 9 |   }
10 | }
11 | 
12 | provider "aws" {
13 |   version = "~> 1.19"
14 |   region  = "eu-west-1"
15 |   assume_role {
16 |     role_arn = "${var.profile_arn}"
17 |   }
18 | }
19 | 
20 | provider "aws" {
21 |   alias = "singapore"
22 |   region = "ap-southeast-1"
23 |   assume_role {
24 |     role_arn = "${var.profile_arn}"
25 |   }
26 | }
27 | 
28 | provider "local" {
29 |   version = "~> 1.1"
30 | }
31 | 
32 | provider "template" {
33 |   version = "~> 1.0"
34 | }
35 | 
36 | # module "eu-west-1" {
37 | #   source     = "./regional"
38 | #   aws_region = "eu-west-1"
39 | # }
40 | 
41 | # module "eu-west-2" {
42 | #   source     = "./regional"
43 | #   aws_region = "eu-west-2"
44 | # }
45 | 
46 | module "global" {
47 |   source = "./global"
48 |   deployer_pgp_key = "${file("${path.module}/../../lib/gpg-keys/deployer.base64")}"
49 |   providers = {
50 |     aws = "aws"
51 |     aws.singapore = "aws.singapore"
52 |   }
53 | }
54 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/regional/main.tf:
--------------------------------------------------------------------------------
 1 | terraform {
 2 |   required_version = "~> 0.11"
 3 | }
 4 | 
 5 | variable "aws_region" {}
 6 | 
 7 | provider "aws" {
 8 |   version = "~> 1.10"
 9 |   alias  = "${var.aws_region}"
10 |   region = "${var.aws_region}"
11 | }
12 | 


--------------------------------------------------------------------------------
/terraform/cardano-public-testnet/variables.tf:
--------------------------------------------------------------------------------
1 | variable "profile_arn" {
2 |   default = "arn:aws:iam::117127962627:role/cardano-public-testnet"
3 |   description = "AWS subaccount for deploying resources"
4 | }
5 | 


--------------------------------------------------------------------------------
/terraform/devops-839-hermes/README.md:
--------------------------------------------------------------------------------
 1 | ### Setup
 2 | 
 3 | 1. AWS credentials.
 4 | 
 5 |        export AWS_PROFILE=iohk
 6 | 
 7 | 2. Clone `iohk-ops`.
 8 | 
 9 |        git clone iohk-ops devops-839-hermes
10 |        cd terraform/devops-839-hermes
11 | 
12 | 3. Get a `nix-shell` with terraform.
13 | 
14 |        nix-shell ../shell.nix
15 | 
16 | 4. Terraform wants to init.
17 | 
18 |        terraform init
19 | 
20 | 5. Create new SSH key.
21 | 
22 |        ssh-keygen -f ssh-key -N "" -C devops-839-hermes
23 |        eval `ssh-agent`
24 |        ssh-add ssh-key
25 | 
26 | 6. Provision and deploy.
27 | 
28 |        terraform apply
29 | 
30 | 
31 | ### Details
32 | 
33 | This terraform deployment uses the S3 state backend so can be run from
34 | anywhere.
35 | 
36 | The resources are provisioned under the development AWS account.
37 | 
38 | 
39 | ### Using
40 | 
41 | The storage volume is mounted at `/data`.
42 | 
43 | To login, do `ssh -i ssh-key vincent@hermes.dev.iohkdev.io`.
44 | 
45 | It's a NixOS system, and the user has `sudo` access.
46 | 


--------------------------------------------------------------------------------
/terraform/devops-839-hermes/aws.tf:
--------------------------------------------------------------------------------
 1 | terraform {
 2 |   required_version = "~> 0.11"
 3 | 
 4 |   backend "s3" {
 5 |     bucket  = "iohk-ops-tfstate"
 6 |     key     = "remote-tfstate/devops-839-hermes/terraform.tfstate"
 7 |     region  = "us-west-1"
 8 |     encrypt = true  # fixme: what key does this use?
 9 |   }
10 | }
11 | 
12 | provider "aws" {
13 |   version = "~> 1.10"
14 |   region  = "eu-west-1"
15 |   assume_role {
16 |     role_arn = "${var.development_arn}"
17 |   }
18 | }
19 | 
20 | provider "template" {
21 |   version = "~> 1.0"
22 | }
23 | 


--------------------------------------------------------------------------------
/terraform/devops-839-hermes/configuration.nix:
--------------------------------------------------------------------------------
 1 | { config, pkgs, ... }:
 2 | {
 3 |   imports = [
 4 |     <nixpkgs/nixos/modules/virtualisation/amazon-image.nix>
 5 |   ];
 6 |   ec2.hvm = true;
 7 | 
 8 |   users.users.vincent =
 9 |     { isNormalUser = true;
10 |       description = "Vincent Hanquez";
11 |       extraGroups = [ "users" "wheel" ];
12 |       openssh.authorizedKeys.keys = [ "${ssh_key}" ];
13 |     };
14 | 
15 |   security.sudo.enable = true;
16 |   security.sudo.wheelNeedsPassword = false;
17 | 
18 |   environment.systemPackages = with pkgs;
19 |     [ tmux htop psmisc which lsof strace ncdu
20 |       wget vim git ];
21 | 
22 |   services.fail2ban.enable = true;
23 | 
24 |   networking.hostName = "${hostname}";
25 | 
26 |   fileSystems = {
27 |     "/data" = {
28 |       device = "/dev/xvdf";
29 |       fsType = "ext4";
30 |       label = "data";
31 |       autoFormat = true;
32 |       autoResize = true;
33 |     };
34 |   };
35 | }
36 | 


--------------------------------------------------------------------------------
/terraform/devops-839-hermes/outside.tf:
--------------------------------------------------------------------------------
 1 | 
 2 | # provider "aws" {
 3 | #   alias  = "dns"
 4 | #   region = "eu-west-1"
 5 | # }
 6 | 
 7 | resource "aws_route53_zone" "dev" {
 8 |   # provider = "aws.dns"
 9 |   name = "${var.zone}"
10 | 
11 |   tags {
12 |     Environment = "Development"
13 |     Ticket = "DEVOPS-839"
14 |   }
15 | }
16 | 
17 | resource "aws_route53_record" "dev-ns" {
18 |   # provider = "aws.dns"
19 |   zone_id = "${aws_route53_zone.dev.zone_id}"
20 |   name    = "${var.zone}"
21 |   type    = "NS"
22 |   ttl     = "30"
23 | 
24 |   records = [
25 |     "${aws_route53_zone.dev.name_servers.0}",
26 |     "${aws_route53_zone.dev.name_servers.1}",
27 |     "${aws_route53_zone.dev.name_servers.2}",
28 |     "${aws_route53_zone.dev.name_servers.3}",
29 |   ]
30 | }
31 | 
32 | resource "aws_route53_record" "web_dns" {
33 |   # provider = "aws.dns"
34 |   zone_id = "${aws_route53_zone.dev.zone_id}"
35 |   name    = "${var.hostname}.${var.zone}"
36 |   type    = "A"
37 |   ttl     = "30"
38 |   records = [ "${aws_instance.web.public_ip}" ]
39 | }
40 | 


--------------------------------------------------------------------------------
/terraform/devops-839-hermes/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "aws_region" {
 2 |   default = "eu-west-1"
 3 |   description = "AWS region to deploy resources"
 4 | }
 5 | 
 6 | variable "instance_type" {
 7 |   default = "t2.small"
 8 | }
 9 | 
10 | variable "storage_size" {
11 |   default = 30
12 |   description = "Size in GB of attached EBS volume"
13 | }
14 | 
15 | variable "public_key_path" {
16 |   default = "ssh-key.pub"
17 |   description = "Filename of the SSH public key to use. This file must exist."
18 | }
19 | 
20 | variable "key_name" {
21 |   default = "devops-839-hermes"
22 |   description = "Name for keypair entry in EC2"
23 | }
24 | 
25 | variable "development_arn" {
26 |   default = "arn:aws:iam::341718127296:role/development"
27 |   description = "IAM role to switch to for deploying resources"
28 | }
29 | 
30 | variable "hostname" {
31 |   default = "hermes"
32 |   description = "Name of instance."
33 | }
34 | 
35 | variable "zone" {
36 |   default = "dev.iohkdev.io"
37 |   description = "Domain of instance."
38 | }
39 | 


--------------------------------------------------------------------------------
/terraform/mfa.nix:
--------------------------------------------------------------------------------
 1 | { stdenv, writeScriptBin, awscli, jq, gnused }:
 2 | 
 3 | writeScriptBin "aws-mfa" ''
 4 |   #!${stdenv.shell}
 5 |   set -euo pipefail
 6 |   export PATH=${awscli}/bin:${jq}/bin:${gnused}/bin
 7 | 
 8 |   unset AWS_SECRET_ACCESS_KEY
 9 |   unset AWS_SESSION_TOKEN
10 |   unset AWS_ACCESS_KEY_ID
11 | 
12 |   token="''${1:-}"
13 |   username=$(aws sts get-caller-identity | jq -re .Arn | sed 's=.*user/==')
14 |   serial_number=$(aws iam list-mfa-devices --user-name $username | jq -re '.MFADevices[0].SerialNumber')
15 | 
16 |   if [ -z "$token" ]; then
17 |     echo -n "Enter MFA Token and press [ENTER]: " >&2
18 |     read token
19 |   fi
20 | 
21 |   creds=$(aws sts get-session-token --serial-number "$serial_number" --token-code "$token" | jq -re .Credentials)
22 | 
23 |   jq -re '@text "\(.AccessKeyId) \(.SecretAccessKey) \(.SessionToken) default"' > ~/.ec2-keys <<< "$creds"
24 |   jq -re '@text "export AWS_ACCESS_KEY_ID=\"\(.AccessKeyId)\"\nexport AWS_SECRET_ACCESS_KEY=\"\(.SecretAccessKey)\"\nexport AWS_SESSION_TOKEN=\"\(.SessionToken)\""' <<< "$creds"
25 | ''
26 | 


--------------------------------------------------------------------------------
/terraform/modules/ci-cache-s3/output.tf:
--------------------------------------------------------------------------------
 1 | output "bucket_name" {
 2 |   value = "${aws_s3_bucket.bucket.id}"
 3 | }
 4 | 
 5 | output "access_key" {
 6 |   value = "${aws_iam_access_key.cache-s3-user-access-key.id}"
 7 | }
 8 | 
 9 | output "secret_key" {
10 |   value = "${aws_iam_access_key.cache-s3-user-access-key.encrypted_secret}"
11 | }
12 | 


--------------------------------------------------------------------------------
/terraform/modules/ci-cache-s3/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "prefix" {
 2 |   description = "Name prefix for all of the resources"
 3 | }
 4 | 
 5 | variable "user_name" {
 6 |   description = "Username for the IAM user that will be created with full access to the newly created S3 bucket (will be prefixed by `prefix` variable)"
 7 |   default     = "ci-cache-user"
 8 | }
 9 | 
10 | variable "bucket_name" {
11 |   description = "Name for the S3 bucket (will be prefixed by `prefix` variable)"
12 |   default     = "ci-cache"
13 | }
14 | 
15 | variable "pgp_key" {
16 |   description = "Name of PGP key to use for secret_key encryption, eg. keybase:username"
17 | }
18 | 
19 | variable "cache_days" {
20 |   description = "Number of days after which cache expires. Setting it to 0 will disable expiration"
21 |   default     = 7
22 | }
23 | 
24 | variable "user_grants_public" {
25 |   description = "There is a separate capability of cache-s3 to make cache publically readable with --public flag, which has to be explicitly allowed at AWS level"
26 |   default     = false
27 | }
28 | 


--------------------------------------------------------------------------------
/terraform/modules/ci-deploy-s3/main.tf:
--------------------------------------------------------------------------------
 1 | /**
 2 |  * ## ci-deploy-s3
 3 |  *
 4 |  * Adapted from: https://raw.githubusercontent.com/fpco/fpco-terraform-aws/master/tf-modules/ci-cache-s3/main.tf
 5 |  *
 6 |  * This module will create an S3 bucket and IAM user with write access
 7 |  * to it, so it can be used by the S3 deployer on Appveyor.
 8 |  *
 9 |  */
10 | 
11 | resource "aws_iam_user" "deploy-s3-user" {
12 |   name = "${var.prefix}${var.user_name}"
13 | }
14 | 
15 | resource "aws_iam_access_key" "deploy-s3-user-access-key" {
16 |   user    = "${aws_iam_user.deploy-s3-user.name}"
17 |   pgp_key = "${var.pgp_key}"
18 | }
19 | 
20 | resource "aws_s3_bucket" "bucket" {
21 |   bucket = "${var.prefix}${var.bucket_name}"
22 |   acl    = "public-read"
23 | }
24 | 
25 | module "s3-full-access" {
26 |   source       = "../s3-full-access-policy"
27 |   name         = "${var.prefix}ci-deploy-s3-access"
28 |   bucket_names = ["${aws_s3_bucket.bucket.id}"]
29 | }
30 | 
31 | resource "aws_iam_user_policy_attachment" "s3-full-access-attachment" {
32 |   user       = "${aws_iam_user.deploy-s3-user.name}"
33 |   policy_arn = "${module.s3-full-access.arn}"
34 | }
35 | 
36 | resource "aws_iam_user_policy_attachment" "s3-grant-public-read" {
37 |   user       = "${aws_iam_user.deploy-s3-user.name}"
38 |   policy_arn = "${element(aws_iam_policy.s3-grant-public-read.*.arn, 0)}"
39 | }
40 | 
41 | resource "aws_iam_policy" "s3-grant-public-read" {
42 |   name   = "${var.prefix}ci-deploy-s3-grant-public-read"
43 |   policy = "${data.aws_iam_policy_document.s3-grant-public-read.json}"
44 | }
45 | 
46 | data "aws_iam_policy_document" "s3-grant-public-read" {
47 |   statement {
48 |     effect = "Allow"
49 | 
50 |     actions = [
51 |       "s3:PutObjectAcl",
52 |     ]
53 | 
54 |     condition {
55 |       test     = "StringEquals"
56 |       variable = "s3:x-amz-acl"
57 |       values   = ["public-read"]
58 |     }
59 | 
60 |     resources = ["arn:aws:s3:::${aws_s3_bucket.bucket.id}/*"]
61 |   }
62 | }
63 | 


--------------------------------------------------------------------------------
/terraform/modules/ci-deploy-s3/output.tf:
--------------------------------------------------------------------------------
 1 | output "bucket_name" {
 2 |   value = "${aws_s3_bucket.bucket.id}"
 3 | }
 4 | 
 5 | output "bucket_region" {
 6 |   value = "${aws_s3_bucket.bucket.region}"
 7 | }
 8 | 
 9 | output "access_key" {
10 |   value = "${aws_iam_access_key.deploy-s3-user-access-key.id}"
11 | }
12 | 
13 | output "secret_key" {
14 |   value = "${aws_iam_access_key.deploy-s3-user-access-key.encrypted_secret}"
15 | }
16 | 


--------------------------------------------------------------------------------
/terraform/modules/ci-deploy-s3/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "prefix" {
 2 |   description = "Name prefix for all of the resources"
 3 | }
 4 | 
 5 | variable "user_name" {
 6 |   description = "Username for the IAM user that will be created with full access to the newly created S3 bucket (will be prefixed by `prefix` variable)"
 7 |   default     = "ci-deploy-user"
 8 | }
 9 | 
10 | variable "bucket_name" {
11 |   description = "Name for the S3 bucket (will be prefixed by `prefix` variable)"
12 |   default     = "ci-deploy"
13 | }
14 | 
15 | variable "pgp_key" {
16 |   description = "Name of PGP key to use for secret_key encryption, eg. keybase:username"
17 | }
18 | 


--------------------------------------------------------------------------------
/terraform/modules/s3-full-access-policy/main.tf:
--------------------------------------------------------------------------------
 1 | /**
 2 |  * ## IAM Policy for Full Access on a List of S3 Buckets
 3 |  *
 4 |  */
 5 | variable "name" {
 6 |   description = "the name of the account or deployment to use with this policy"
 7 | }
 8 | 
 9 | variable "bucket_names" {
10 |   description = "list of bucket names to grant access to"
11 |   type        = "list"
12 | }
13 | 
14 | variable "aws_cloud" {
15 |   description = "set to 'aws-us-gov' if using GovCloud, otherwise leave the default"
16 |   default     = "aws"
17 | }
18 | 
19 | //`id` exported from `aws_iam_policy`
20 | output "id" {
21 |   value = "${aws_iam_policy.s3-full-access.id}"
22 | }
23 | 
24 | //`arn` exported from `aws_iam_policy`
25 | output "arn" {
26 |   value = "${aws_iam_policy.s3-full-access.arn}"
27 | }
28 | 
29 | //`name` exported from `aws_iam_policy`
30 | output "name" {
31 |   value = "${aws_iam_policy.s3-full-access.name}"
32 | }
33 | 
34 | data "aws_iam_policy_document" "s3-full-access" {
35 |   statement {
36 |     effect = "Allow"
37 | 
38 |     actions = [
39 |       "s3:ListBucket",
40 |       "s3:GetBucketLocation",
41 |       "s3:ListBucketMultipartUploads",
42 |     ]
43 | 
44 |     resources = ["${formatlist("arn:${var.aws_cloud}:s3:::%s",var.bucket_names)}"]
45 |   }
46 | 
47 |   statement {
48 |     effect = "Allow"
49 | 
50 |     actions = [
51 |       "s3:ListObjects",
52 |       "s3:PutObject",
53 |       "s3:GetObject",
54 |       "s3:DeleteObject",
55 |       "s3:CreateMultipartUpload",
56 |       "s3:ListMultipartUploadParts",
57 |       "s3:AbortMultipartUpload",
58 |     ]
59 | 
60 |     resources = ["${formatlist("arn:${var.aws_cloud}:s3:::%s/*",var.bucket_names)}"]
61 |   }
62 | }
63 | 
64 | resource "aws_iam_policy" "s3-full-access" {
65 |   name   = "${var.name}_s3_bucket_access"
66 |   policy = "${data.aws_iam_policy_document.s3-full-access.json}"
67 | }
68 | 


--------------------------------------------------------------------------------
/terraform/shell.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   commonLib = import ../lib.nix;
 3 | in
 4 | { system ? builtins.currentSystem
 5 | , config ? {}
 6 | , pkgs ? (import (commonLib.nixpkgs) { inherit system config; })
 7 | }:
 8 | 
 9 | let
10 |   iohk-pkgs = import ../default.nix { inherit system config pkgs; };
11 | 
12 | in pkgs.stdenv.mkDerivation {
13 |   name = "iohk-ops-terraform";
14 |   buildInputs = [ iohk-pkgs.terraform pkgs.jq pkgs.awscli pkgs.keybase pkgs.gnupg ];
15 |   src = null;
16 | }
17 | 


--------------------------------------------------------------------------------
/terraform/terraform.nix:
--------------------------------------------------------------------------------
 1 | { buildGoPackage, fetchFromGitHub, terraform_0_11 }:
 2 | 
 3 | let
 4 |   awsProvider = buildGoPackage rec {
 5 |     owner   = "terraform-providers";
 6 |     repo    = "terraform-provider-aws";
 7 |     version = "1.19.0";
 8 |     sha256  = "14ap1gfhp04jcy0kwfghaqwm4ywm7zwqk3132iybmp2zx0rjf1np";
 9 | 
10 |     name = "${repo}-${version}";
11 |     goPackagePath = "github.com/${owner}/${repo}";
12 |     src = fetchFromGitHub {
13 |       inherit owner repo sha256;
14 |       rev = "v${version}";
15 |     };
16 | 
17 |     # Terraform allow checking the provider versions, but this breaks
18 |     # if the versions are not provided via file paths.
19 |     postBuild = "mv go/bin/${repo}{,_v${version}}";
20 |   };
21 | 
22 | in terraform_0_11.withPlugins (ps: [
23 |   awsProvider
24 |   ps.local
25 |   ps.template
26 | ])
27 | 


--------------------------------------------------------------------------------
/testnet.yaml:
--------------------------------------------------------------------------------
 1 | args:
 2 |   configurationKey:
 3 |     tag: NixStr
 4 |     contents: testnet_full
 5 |   systemStart:
 6 |     tag: NixInt
 7 |     contents: 1563999616
 8 |   IOHKaccessKeyId:
 9 |     tag: NixStr
10 |     contents: default
11 |   IOHKroute53accessKeyId:
12 |     tag: NixStr
13 |     contents: default
14 |   CFaccessKeyId:
15 |     tag: NixStr
16 |     contents: default
17 |   EmurgoaccessKeyId:
18 |     tag: NixStr
19 |     contents: default
20 | environment: Testnet
21 | topology: topology-testnet.yaml
22 | installer-bucket: updates-cardano-testnet
23 | installer-url-base: updates-cardano-testnet.s3.amazonaws.com
24 | name: testnet
25 | domain: cardano-testnet.iohkdev.io
26 | files:
27 | - deployments/keypairs.nix
28 | - deployments/security-groups.nix
29 | - deployments/cardano-nodes.nix
30 | - deployments/cardano-nodes-env-testnet.nix
31 | - deployments/cardano-explorer.nix
32 | - deployments/cardano-explorer-env-testnet.nix
33 | - deployments/cardano-faucet.nix
34 | - deployments/cardano-faucet-env-testnet.nix
35 | - deployments/monitoring-env-testnet.nix
36 | - deployments/monitoring-aws.nix
37 | elements:
38 | - Nodes
39 | - Explorer
40 | - Faucet
41 | - Monitoring
42 | target: AWS
43 | 


--------------------------------------------------------------------------------
/tests/cardano-node-simple-config.nix:
--------------------------------------------------------------------------------
 1 | ## NOTE: this file should be kept in structural sync with 'srcroot://topology.yaml'
 2 | { machine = {
 3 |                 i = 0;
 4 |              name = "machine"; # Must be the same ass the attribute set name
 5 |            region = "eu-central-1";
 6 |              type = "core";
 7 |             peers = [];
 8 |            relays = [];
 9 |       systemStart = 0;
10 |          allNames = [ "machine" ];
11 |   };
12 | }
13 | 


--------------------------------------------------------------------------------
/tests/default.nix:
--------------------------------------------------------------------------------
 1 | { pkgs ? (import <nixpkgs> {}), supportedSystems ? [ "x86_64-linux" ] }:
 2 | 
 3 | with pkgs;
 4 | with pkgs.lib;
 5 | 
 6 | let
 7 |   forAllSystems = genAttrs supportedSystems;
 8 |   importTest = fn: args: system: import fn ({
 9 |     inherit system;
10 |   } // args);
11 |   callTest = fn: args: forAllSystems (system: hydraJob (importTest fn args system));
12 | in rec {
13 |   # TODO: tests of images
14 |   # simpleNode = callTest ./simple-node.nix {};
15 |   # simpleNodeNixOps = callTest ./simple-node-nixops.nix {};
16 | }
17 | 


--------------------------------------------------------------------------------
/tests/simple-node-nixops.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   nodeMap = import ./cardano-node-simple-config.nix;
 3 | in
 4 | import <nixpkgs/nixos/tests/make-test.nix> ({ pkgs, ... }: {
 5 |   name = "boot";
 6 |   nodes = {
 7 |     machine = { config, pkgs, ... }: {
 8 |       imports = [ (import ../modules/cardano.nix (nodeMap.machine)) <nixops/nix/options.nix> <nixops/nix/resource.nix> ];
 9 |       services.cardano-node = {
10 |         autoStart = true;
11 |         neighbours = [];
12 |       };
13 |     };
14 |   };
15 |   testScript = ''
16 |     startAll
17 |     $machine->waitForUnit("cardano-node.service");
18 |     # TODO, implement sd_notify?
19 |     $machine->waitForOpenPort(3000);
20 |   '';
21 | })
22 | 


--------------------------------------------------------------------------------
/tests/simple-node.nix:
--------------------------------------------------------------------------------
 1 | let
 2 |   nodeMap = import ./cardano-node-simple-config.nix;
 3 | in
 4 | import <nixpkgs/nixos/tests/make-test.nix> ({ pkgs, ... }: {
 5 |   name = "simple-node";
 6 |   nodes = {
 7 |     machine = { config, pkgs, ... }: {
 8 |       imports = [ (import ../modules/cardano.nix (nodeMap.machine)) ];
 9 |       virtualisation.qemu.options = [ "-cpu Haswell" ];
10 |       services.cardano-node = {
11 |         autoStart = true;
12 |         neighbours = [];
13 |       };
14 |     };
15 |   };
16 |   testScript = ''
17 |     startAll
18 |     $machine->waitForUnit("cardano-node.service");
19 |     # TODO, implement sd_notify?
20 |     $machine->waitForOpenPort(3000);
21 |   '';
22 | })
23 | 


--------------------------------------------------------------------------------
/topology-development.yaml:
--------------------------------------------------------------------------------
 1 | nodes:
 2 |   'a1':
 3 |     type: core
 4 |     region: eu-central-1
 5 |     zone:   eu-central-1b
 6 |     static-routes: [["b1","c1"], ["r1"]]
 7 |     host: a1.cardano
 8 |     port: 3000
 9 |   'b1':
10 |     type: core
11 |     region: eu-central-1
12 |     zone:   eu-central-1b
13 |     static-routes: [["c1","a1"], ["r1"]]
14 |     host: b1.cardano
15 |     port: 3000
16 |   'c1':
17 |     type: core
18 |     region: eu-central-1
19 |     zone:   eu-central-1a
20 |     static-routes: [["b1","a1"], ["r1"]]
21 |     host: c1.cardano
22 |     port: 3000
23 | 
24 |   'r1':
25 |     type: relay
26 |     region: eu-central-1
27 |     zone:   eu-central-1b
28 |     static-routes: [["a1"], ["b1"], ["c1"]]
29 |     host: r1.cardano
30 |     port: 3000
31 |     kademlia: false
32 |     public: true
33 | 


--------------------------------------------------------------------------------
/topology-devops.yaml:
--------------------------------------------------------------------------------
 1 | nodes:
 2 |   'a1':
 3 |     type: core
 4 |     impl: legacy
 5 |     region: eu-central-1
 6 |     zone:   eu-central-1b
 7 |     static-routes: [["b1","c1"], ["r1"]]
 8 |     host: a1.cardano
 9 |     port: 3000
10 |   'b1':
11 |     type: core
12 |     impl: haskell
13 |     region: eu-central-1
14 |     zone:   eu-central-1b
15 |     static-routes: [["c1","a1"], ["r1"]]
16 |     host: b1.cardano
17 |     port: 3000
18 |   'c1':
19 |     type: core
20 |     impl: rust
21 |     region: eu-central-1
22 |     zone:   eu-central-1a
23 |     static-routes: [["b1","a1"], ["r1"]]
24 |     host: c1.cardano
25 |     port: 3000
26 | 
27 |   'r1':
28 |     type: relay
29 |     impl: legacy
30 |     region: eu-central-1
31 |     zone:   eu-central-1b
32 |     static-routes: [["a1"], ["b1"], ["c1"]]
33 |     host: r1.cardano
34 |     port: 3000
35 |     kademlia: false
36 |     public: true
37 | 


--------------------------------------------------------------------------------
/topology-edgenode.yaml:
--------------------------------------------------------------------------------
 1 | wallet:
 2 |   # these addresses certainly have to be adapted for a new environment
 3 |   relays: [
 4 |     [
 5 |       addr: 35.156.233.94
 6 |     ]
 7 |   ]
 8 |   valency: 1
 9 |   fallbacks: 7
10 | 


--------------------------------------------------------------------------------
/topology-min.yaml:
--------------------------------------------------------------------------------
 1 | nodes:
 2 |   'left':
 3 |     type: core
 4 |     region: eu-central-1
 5 |     zone:   eu-central-1b
 6 |     static-routes: [["right"]]
 7 |     host: left.cardano
 8 |     port: 3000
 9 |   'right':
10 |     type: relay
11 |     region: ap-southeast-1
12 |     zone:   ap-southeast-1b
13 |     static-routes: [["left"]]
14 |     host: right.cardano
15 |     port: 3000
16 | 


--------------------------------------------------------------------------------