From e76f8271c85e8d2e2718c333237cba3b26a5f7ca Mon Sep 17 00:00:00 2001 From: dawn <90008@klbr.net> Date: Thu, 27 Aug 2026 01:51:40 +0900 Subject: [PATCH] hyd-eu-1: init Signed-off-by: dawn --- flake.lock | 35 ++++++++++++ flake.nix | 22 ++++++++ hosts/hyd-eu-1/configuration.nix | 21 +++++++ hosts/hyd-eu-1/disk-config.nix | 77 +++++++++++++++++++++++++ hosts/hyd-eu-1/services/hydrant.nix | 88 +++++++++++++++++++++++++++++ hosts/hyd-eu-1/services/nginx.nix | 18 ++++++ 6 files changed, 261 insertions(+) create mode 100644 hosts/hyd-eu-1/configuration.nix create mode 100644 hosts/hyd-eu-1/disk-config.nix create mode 100644 hosts/hyd-eu-1/services/hydrant.nix create mode 100644 hosts/hyd-eu-1/services/nginx.nix diff --git a/flake.lock b/flake.lock index 45c4ec1..e78ae5a 100644 --- a/flake.lock +++ b/flake.lock @@ -605,6 +605,22 @@ "url": "https://cdn.jsdelivr.net/npm/htmx-ext-ws@2.0.4" } }, + "hydrant": { + "flake": false, + "locked": { + "lastModified": 1786632393, + "narHash": "sha256-aUppz0pbhcwHn7TbattR4aP9sOuYXNmG8znt5Mh/wWk=", + "ref": "refs/heads/main", + "rev": "fd43abb3f8c534b75967155a1d25483a5b089bca", + "revCount": 497, + "type": "git", + "url": "https://tangled.org/ptr.pet/hydrant" + }, + "original": { + "type": "git", + "url": "https://tangled.org/ptr.pet/hydrant" + } + }, "ibm-plex-mono-src": { "flake": false, "locked": { @@ -1029,9 +1045,11 @@ "cloudflare-ips-v6": "cloudflare-ips-v6", "colmena": "colmena", "disko": "disko", + "hydrant": "hydrant", "nixery-flake": "nixery-flake", "nixpkgs": "nixpkgs_3", "tangled": "tangled", + "tangled-lexicons": "tangled-lexicons", "tangled-mirror": "tangled-mirror", "tangled-svfe": "tangled-svfe" } @@ -1324,6 +1342,23 @@ "url": "https://knot1.tangled.sh/tangled.org/core" } }, + "tangled-lexicons": { + "flake": false, + "locked": { + "lastModified": 1787744313, + "narHash": "sha256-MQ/COZnb0zecG5kMu6mr4Z05S8x62pqiNax9Bx98v98=", + "ref": "sv-fe", + "rev": "0691d624e7a504835cde3cebcd0f2c2577407f51", + "revCount": 3582, + "type": "git", + "url": "https://tangled.org/tangled.org/core" + }, + "original": { + "ref": "sv-fe", + "type": "git", + "url": "https://tangled.org/tangled.org/core" + } + }, "tangled-mirror": { "inputs": { "actor-typeahead-src": "actor-typeahead-src_2", diff --git a/flake.nix b/flake.nix index ab66d52..cc3b16b 100644 --- a/flake.nix +++ b/flake.nix @@ -6,6 +6,14 @@ tangled.url = "git+https://knot1.tangled.sh/tangled.org/core"; tangled-mirror.url = "git+https://tangled.org/tangled.org/core?ref=master"; tangled-svfe.url = "git+https://tangled.org/tangled.org/core?ref=sv-fe"; + tangled-lexicons = { + url = "git+https://tangled.org/tangled.org/core?ref=sv-fe"; + flake = false; + }; + hydrant = { + url = "git+https://tangled.org/ptr.pet/hydrant"; + flake = false; + }; colmena.url = "github:zhaofengli/colmena/release-0.4.x"; cloudflare-ips-v4 = { url = "file+https://www.cloudflare.com/ips-v4"; @@ -53,6 +61,8 @@ tangled, tangled-mirror, tangled-svfe, + tangled-lexicons, + hydrant, atlogin, ... }: let @@ -79,6 +89,8 @@ inherit system; specialArgs = { inherit commonArgs cloudflareRanges scraperAsnRanges; + hydrant-src = hydrant; + tangled-lexicons-src = tangled-lexicons; nixery-pkgs = import nixery-flake.outPath { pkgs = import nixpkgs {inherit system;}; }; @@ -110,6 +122,14 @@ port = 2222; }; + hyd-eu-1 = { + modules = [ + ./hosts/hyd-eu-1/services/hydrant.nix + ./hosts/hyd-eu-1/services/nginx.nix + ]; + target = "46.224.9.195"; + }; + pds = { modules = [ ./hosts/pds/services/nginx.nix @@ -213,6 +233,8 @@ nixpkgs = nixpkgs.legacyPackages.${system}; specialArgs = { inherit commonArgs cloudflareRanges scraperAsnRanges; + hydrant-src = hydrant; + tangled-lexicons-src = tangled-lexicons; nixery-pkgs = import nixery-flake.outPath { pkgs = import nixpkgs {inherit system;}; }; diff --git a/hosts/hyd-eu-1/configuration.nix b/hosts/hyd-eu-1/configuration.nix new file mode 100644 index 0000000..69ee9cb --- /dev/null +++ b/hosts/hyd-eu-1/configuration.nix @@ -0,0 +1,21 @@ +{pkgs, ...}: { + imports = [./disk-config.nix]; + networking.hostName = "hyd-eu-1"; + networking.useDHCP = false; + networking.interfaces.eth0 = { + useDHCP = true; + ipv6.addresses = [ + { + address = "2a01:4f8:c17:9340::1"; + prefixLength = 64; + } + ]; + }; + networking.defaultGateway6 = { + address = "fe80::1"; + interface = "eth0"; + }; + services.fstrim.enable = true; + environment.systemPackages = [pkgs.btrfs-progs pkgs.lvm2 pkgs.xfsprogs]; + system.stateVersion = "25.11"; +} diff --git a/hosts/hyd-eu-1/disk-config.nix b/hosts/hyd-eu-1/disk-config.nix new file mode 100644 index 0000000..66bda4f --- /dev/null +++ b/hosts/hyd-eu-1/disk-config.nix @@ -0,0 +1,77 @@ +{lib, ...}: { + disko.devices = { + disk.disk1 = { + device = lib.mkDefault "/dev/sda"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + boot = { + name = "boot"; + size = "1M"; + type = "EF02"; + }; + esp = { + name = "ESP"; + size = "500M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + name = "root"; + size = "100%"; + content = { + type = "lvm_pv"; + vg = "pool"; + }; + }; + }; + }; + }; + lvm_vg = { + pool = { + type = "lvm_vg"; + lvs = { + swap = { + size = "4G"; + content = { + type = "swap"; + discardPolicy = "once"; + }; + }; + root = { + size = "4G"; + content = { + type = "filesystem"; + format = "xfs"; + mountpoint = "/"; + mountOptions = ["defaults" "noatime"]; + }; + }; + nix = { + size = "16G"; + content = { + type = "filesystem"; + format = "btrfs"; + mountpoint = "/nix"; + mountOptions = ["compress=zstd:3" "noatime"]; + }; + }; + hydrant = { + size = "100%FREE"; + content = { + type = "filesystem"; + format = "xfs"; + mountpoint = "/var/lib/hydrant"; + mountOptions = ["defaults" "noatime"]; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/hyd-eu-1/services/hydrant.nix b/hosts/hyd-eu-1/services/hydrant.nix new file mode 100644 index 0000000..8849650 --- /dev/null +++ b/hosts/hyd-eu-1/services/hydrant.nix @@ -0,0 +1,88 @@ +{ + hydrant-src, + tangled-lexicons-src, + lib, + pkgs, + ... +}: let + port = 13010; + lexiconFiles = dir: let + entries = builtins.readDir dir; + in + lib.concatMap ( + name: let + type = entries.${name}; + path = "${dir}/${name}"; + in + if type == "directory" + then lexiconFiles path + else lib.optional (type == "regular" && lib.hasSuffix ".json" name) path + ) (builtins.attrNames entries); + lexicons = + map + (path: builtins.fromJSON (builtins.readFile path)) + (lexiconFiles "${tangled-lexicons-src}/lexicons"); + signals = lib.sort builtins.lessThan ( + map + (lexicon: lexicon.id) + (builtins.filter (lexicon: (lexicon.defs.main.type or null) == "record") lexicons) + ); + hydrant = (pkgs.callPackage "${hydrant-src}/default.nix" {}).overrideAttrs { + cargoBuildFeatures = ["jetstream"]; + }; +in { + systemd.services.hydrant = { + description = "tangled atproto indexer and jetstream service"; + wantedBy = ["multi-user.target"]; + wants = ["network-online.target"]; + after = ["network-online.target"]; + + environment = { + HYDRANT_API_BIND = "127.0.0.1:${toString port}"; + HYDRANT_DATABASE_PATH = "/var/lib/hydrant/db"; + HYDRANT_RELAY_HOSTS = ""; + HYDRANT_SEED_HOSTS = "https://relay.fire.hose.cam,https://bsky.network"; + HYDRANT_CRAWLER_URLS = "list_repos::https://tngl.sh,by_collection::https://lightrail.microcosm.blue"; + HYDRANT_PLC_URL = "https://plc.directory"; + HYDRANT_FILTER_COLLECTIONS = "sh.tangled.*,org.tangled.*"; + HYDRANT_FILTER_SIGNALS = lib.concatStringsSep "," signals; + HYDRANT_VERIFY_SIGNATURES = "full"; + HYDRANT_BACKFILL_CONCURRENCY_LIMIT = "2"; + HYDRANT_CRAWLER_MAX_PENDING_REPOS = "256"; + HYDRANT_CRAWLER_RESUME_PENDING_REPOS = "128"; + HYDRANT_CACHE_SIZE = "128"; + HYDRANT_DATA_COMPRESSION = "lz4"; + HYDRANT_DB_EVENTS_MEMTABLE_SIZE_MB = "16"; + HYDRANT_DB_RECORDS_MEMTABLE_SIZE_MB = "16"; + HYDRANT_DB_REPOS_MEMTABLE_SIZE_MB = "8"; + HYDRANT_DB_WORKER_THREADS = "1"; + HYDRANT_FIREHOSE_MAX_FAILURES = "3"; + HYDRANT_FIREHOSE_WORKERS = "1"; + HYDRANT_GET_REPO_CONCURRENCY_LIMIT = "1"; + HYDRANT_IDENTITY_CACHE_SIZE = "50000"; + HYDRANT_MAX_CAR_BODY_BYTES = "268435456"; + HYDRANT_PER_PDS_CONCURRENCY = "2"; + HYDRANT_OFFLINE_HOST_RETRY_INTERVAL = "6h"; + HYDRANT_STREAM_PENDING_EVENT_LIMIT = "1024"; + HYDRANT_RATE_TIERS = "tngl:9/0.0/32400/777600/10000000"; + HYDRANT_TIER_RULES = "tngl.sh:tngl"; + RUST_LOG = "info"; + }; + + serviceConfig = { + Type = "simple"; + ExecStart = "${hydrant}/bin/hydrant"; + Restart = "on-failure"; + RestartSec = "10s"; + DynamicUser = true; + StateDirectory = "hydrant"; + StateDirectoryMode = "0750"; + WorkingDirectory = "/var/lib/hydrant"; + NoNewPrivileges = true; + PrivateTmp = true; + ProtectSystem = "strict"; + ProtectHome = true; + LimitNOFILE = 1048576; + }; + }; +} diff --git a/hosts/hyd-eu-1/services/nginx.nix b/hosts/hyd-eu-1/services/nginx.nix new file mode 100644 index 0000000..eb1f7d7 --- /dev/null +++ b/hosts/hyd-eu-1/services/nginx.nix @@ -0,0 +1,18 @@ +{...}: { + services.nginx = { + enable = true; + virtualHosts.hydrant = { + default = true; + locations."/" = { + proxyPass = "http://127.0.0.1:13010"; + proxyWebsockets = true; + extraConfig = '' + proxy_read_timeout 86400; + proxy_send_timeout 86400; + ''; + }; + }; + }; + + networking.firewall.interfaces."tailscale0".allowedTCPPorts = [80]; +} -- 2.51.2