From a25e93a2bfd2feb4a65a84bc1d493457f6a40db9 Mon Sep 17 00:00:00 2001
From: dawn <dawn@tangled.org>
Date: Fri, 19 Jun 2026 07:34:59 +0300
Subject: [PATCH] spindle-hel: bump tangled, configure microvm spindle

Signed-off-by: dawn <dawn@tangled.org>
---
 flake.lock                             | 53 ++++++++++++++++++++++----
 flake.nix                              |  8 +++-
 hosts/spindle-hel/services/spindle.nix | 32 ++++++++++++++--
 3 files changed, 82 insertions(+), 11 deletions(-)

diff --git a/flake.lock b/flake.lock
index 870a52f..6a7168a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -345,14 +345,14 @@
     "ibm-plex-mono-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1731402384,
+        "lastModified": 1731402378,
         "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
       }
     },
     "ibm-plex-mono-src_2": {
@@ -476,6 +476,28 @@
         "url": "https://cdn.jsdelivr.net/npm/mermaid@11.12.3/dist/mermaid.min.js"
       }
     },
+    "microvm": {
+      "inputs": {
+        "nixpkgs": [
+          "tangled",
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1779970379,
+        "narHash": "sha256-ZHsxoYXXnfJtMVh1/yY+1Eh9hHcPBhE28Qvinauh+BQ=",
+        "owner": "microvm-nix",
+        "repo": "microvm.nix",
+        "rev": "0d49083ba2d7419b22908ac392777c16df9a032e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "microvm-nix",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
     "nixery-flake": {
       "flake": false,
       "locked": {
@@ -617,6 +639,22 @@
         "type": "github"
       }
     },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1778940603,
+        "narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
+        "ref": "refs/heads/main",
+        "rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
+        "revCount": 1265,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
     "sqlite-lib-src": {
       "flake": false,
       "locked": {
@@ -717,15 +755,16 @@
         "inter-fonts-src": "inter-fonts-src",
         "lucide-src": "lucide-src",
         "mermaid-src": "mermaid-src",
+        "microvm": "microvm",
         "nixpkgs": "nixpkgs_4",
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1781711822,
-        "narHash": "sha256-dZbFW2gzjCN4tCinxRqY6+exaCZN5Hi1j8E6vmntqsU=",
+        "lastModified": 1781868454,
+        "narHash": "sha256-Cs+uVvGD5bINmEFm+zwM6/NtS9nGpZo97DdpPxDU5hM=",
         "ref": "master",
-        "rev": "761e710f29fba3ea2408c889261a55bfcbd06777",
-        "revCount": 2703,
+        "rev": "7358ef5a847ea2734790814b1b80299b4dd66230",
+        "revCount": 2717,
         "type": "git",
         "url": "https://knot1.tangled.sh/tangled.org/core"
       },
diff --git a/flake.nix b/flake.nix
index 9d550b0..41539e5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,7 +42,13 @@
     mkHost = hostname: extraModules:
       lib.nixosSystem {
         inherit system;
-        specialArgs = {inherit commonArgs;};
+        specialArgs = {
+          inherit commonArgs;
+          nixery-pkgs = import nixery-flake.outPath {
+            pkgs = import nixpkgs {inherit system;};
+          };
+          tangled-pkgs = tangled.packages.x86_64-linux;
+        };
         modules = baseModules ++ [./hosts/${hostname}/configuration.nix] ++ extraModules;
       };
 
diff --git a/hosts/spindle-hel/services/spindle.nix b/hosts/spindle-hel/services/spindle.nix
index 46019f6..e1f8299 100644
--- a/hosts/spindle-hel/services/spindle.nix
+++ b/hosts/spindle-hel/services/spindle.nix
@@ -1,8 +1,9 @@
 {
   config,
-  pkgs,
+  tangled-pkgs,
   ...
-}: {
+}:
+{
   services.tangled.spindle = {
     enable = true;
     server = {
@@ -11,13 +12,38 @@
       listenAddr = "127.0.0.1:6555";
       queueSize = 100;
       maxJobCount = 8;
-      maxConcurrentWorkflows = 16;
       secrets = {
         provider = "openbao";
       };
     };
     pipelines = {
       workflowTimeout = "15m";
+      nixery.maxConcurrentWorkflows = 16;
+      microvm = {
+        limits.total.memoryMiB = 40 * 1024; # 30gb + 10gb overcommit
+        cgroup = {
+          enable = true;
+          swapMaxMiB = 512; # don't let workflows use too much swap, will be too slow
+        };
+      };
+      nixCache = {
+        readUrls = [
+          "https://cache.nixos.org"
+          "http://${config.services.harmonia.settings.bind}"
+        ];
+        trustedPublicKeys = [
+          "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "spindle-hel-cache-1:r4faXZnMLFyTJeIQn+sQuO/Pgu2ZMTMncmXb2CPZtUw="
+        ];
+        uploadUrl = "local";
+      };
     };
   };
+
+  systemd.tmpfiles.rules = [
+    "L+ /var/lib/spindle/images/nixos-x86_64 - - - - ${tangled-pkgs.spindle-nixos-image}"
+    "L+ /var/lib/spindle/images/nixos - - - - /var/lib/spindle/images/nixos-x86_64"
+    "L+ /var/lib/spindle/images/alpine-x86_64 - - - - ${tangled-pkgs.spindle-alpine-image}"
+    "L+ /var/lib/spindle/images/alpine - - - - /var/lib/spindle/images/alpine-x86_64"
+  ];
 }
-- 
2.51.2