PL-132122 upgrade hardware to 24.11

.gitignore

@@ -21,6 +21,8 @@ result-*
 share/
 target/
 tmp/
-# direnv
 .envrc
-.direnv/
+.direnv
+pkgs/fc/agent/.envrc
+pyenv
+.vscode/settings.json

.hydra/config.json

@@ -4,12 +4,12 @@
     "inputs": {
         "nixpkgs": {
             "type": "git",
-            "value": "https://github.com/flyingcircusio/nixpkgs.git nixos-24.05",
+            "value": "https://github.com/flyingcircusio/nixpkgs.git nixos-24.11",
             "emailresponsible": false
         },
         "branch": {
             "type": "string",
-            "value": "fc-24.05-dev",
+            "value": "fc-24.11-dev",
             "emailresponsible": false
         }
     }

.pre-commit-config-local.yaml

@@ -1 +1 @@
-exclude: "pkgs/fc/sensusyntax/fixtures/(syntaxerror|empty).json|(nixos/infrastructure/container.nix|tests/testlib.nix|nixos/roles/devhost/vm.nix)"
+exclude: "pkgs/fc/sensusyntax/fixtures/(syntaxerror|empty).json|(tests/testlib.nix|nixos/roles/devhost/vm.nix|tests/physical-installer.nix)"

.pre-commit-config.yaml

@@ -1,4 +1,4 @@
-exclude: ^secrets/|^appenv$|pkgs/fc/sensusyntax/fixtures/(syntaxerror|empty).json|(nixos/infrastructure/container.nix|tests/testlib.nix|nixos/roles/devhost/vm.nix)|^changelog.d/new_fragment.md.j2$
+exclude: ^secrets/|^appenv$|pkgs/fc/sensusyntax/fixtures/(syntaxerror|empty).json|(tests/testlib.nix|nixos/roles/devhost/vm.nix|tests/physical-installer.nix)|^changelog.d/new_fragment.md.j2$
 repos:
 - hooks:
   - exclude: "(?x)^(\n  secrets/|environments/.*/secret.*|\n  .*\\.patch\n)$\n"
@@ -14,15 +14,12 @@ repos:
   repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v3.2.0
 - hooks:
-  - args:
-    - --profile
-    - black
-    - --filter-files
+  - args: ["--profile", "black", "--filter-files"]
     id: isort
     name: isort (python)
   repo: https://github.com/pycqa/isort
-  rev: 5.12.0
+  rev: 5.13.1
 - hooks:
   - id: black
   repo: https://github.com/psf/black
-  rev: 23.1.0
+  rev: 24.4.2

README.md

@@ -80,6 +80,20 @@ Or build package by directly calling a Nix expression:
 
     nix-build -E 'with import <fc> {}; callPackage path/to/file.nix {}'
 
+Editable development versions of our core packages
+--------------------------------------------------
+
+fc.agent
+
+    $ cd fc-nixos
+    $ eval $(./dev-setup)  # not nix-shell!
+    $ nix-shell pkgs/fc/agent
+    $ which fc-manage
+    /tmp/.../bin/fc-manage
+
+fc.qemu
+
+    TBD
 
 (Dry-)Build System
 ------------------

changelog.d/CHANGELOG.md

@@ -1,3 +1,26 @@
+# Release 2024_035
+
+
+## Impact
+
+## NixOS XX.XX platform
+
+- S3 users are now managed automatically and can be viewed and managed via our
+  customer portal. (PL-133084)
+
+- Fix systemd units managing flooding suppression and MAC learning
+  configuration so that settings are restored to their defaults when
+  the units are stopped. (PL-133202)
+
+- Add sensu check on routers to monitor whether flooding suppression
+  is correctly configured on gateway interfaces. (PL-133202)
+
+- kvm_host: fix fc-qemu-scrub timer which was not properly activating
+  after boot. (PL-133211)
+
+- Updated Nix to 2.3.18 to be able to download `zstd`-compressed paths from our Hydra. It will
+  switch from `xz` to `zstd` to increase its throughput.
+
 # Release 2024_034
 
 ## Impact
@@ -60,6 +83,33 @@
   This may have impact if you have multiple unauthenticated SSH connections in a short time.
   We tested this change on non-production machines over the last 3 weeks and got no reports of problems.
 
+- fc-luks: fix rekeying to use the specified encryption parameters. We accidentally fell back to defaults before. (PL-133174)
+
+- router: the ISC DHCP server, which is end-of-life, has been replaced
+  with its successor implementation, Kea. (PL-133205)
+
+- pkgs: fix the monitoring script for the IPv4 underlay network to
+  correctly handle next hop addresses sent by Nokia SR Linux
+  switches. (PL-133199)
+
+- router: fix radvd config generation to use the correct derived
+  interface name. (PL-133201)
+
+# Release 2024_033
+
+## NixOS XX.XX platform
+
+- physical machines: load `dm_mirror` kernel module by default, to support several LVM disk migration scenarios
+
+- Update fc.qemu to ensure reduce cluster load on rbd list. (PL-133194)
+
+
+# Release 2024_032
+
+## NixOS XX.XX platform
+
+- fc.qemu: fix bug that may cause accidental root disk shrinks after a
+  cold reboot. (PL-133166)
 
 # Release 2024_031
 
@@ -75,6 +125,17 @@
 
 ## NixOS XX.XX platform
 
+- Implement automatic (offline) migration of VM disks between different pools
+  (SSD <-> HDD). (PL-131857)
+
+- Switch our central DNS recursive resolvers to prefer the default Quad9
+  servers to alleviate reliability issues. We used to prefer the Quad9
+  servers with improved geolocation capabilities, but experienced subtle
+  DNS issues while using them and were advised by Quad9 to switch to the
+  default servers. (PL-133125)
+
+- Improve central DNS recursive resolver debugging capabilities. (PL-133125)
+
 - Make NFS clients more resilient against missing servers during bootstrap,
   upgrades, and reboot scenarios. (PL-133062)
 

dev-setup

@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 echo "This will set up the channels dir and show the export command to set the NIX_PATH accordingly." >&2
-echo "You can also use 'nix develop --impure' to open the dev shell and run build_channels_dir from there." >&2
-# ensure PWD is the directory this script resides in (allows calls like ../dev-setup or $HOME/fc-nixos/dev-setup)
-cd "$(dirname "$(readlink -f "$0")")"
-nix develop --impure "$@" --command dev_setup
+
+if [[ "$(nixos-version)" =~ ^"21" ]]; then
+    ./dev-setup-from-21.05
+else
+    # ensure PWD is the directory this script resides in (allows calls like ../dev-setup or $HOME/fc-nixos/dev-setup)
+    echo "You can also use 'nix develop --impure' to open the dev shell and run build_channels_dir from there." >&2
+    cd "$(dirname "$(readlink -f "$0")")"
+    nix develop --impure "$@" --command dev_setup
+fi

dev-setup-from-21.05

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Usage: eval `./dev-setup2`
+set -e
+
+# ensure PWD is the directory this script resides in (allows calls like ../dev-setup or $HOME/fc-nixos/dev-setup)
+cd "$(dirname "$(readlink -f "$0")")"
+
+base=$PWD
+# preserve nixos-config
+config=$(nix-instantiate --find-file nixos-config 2>/dev/null) || true
+
+# bootstrapping with what we find on the system
+if [[ ! -e /tmp/nixos-2411-bootstrap/nixpkgs ]]; then
+    rm -rf /tmp/nixos-2411-bootstrap
+    mkdir /tmp/nixos-2411-bootstrap
+    cd /tmp/nixos-2411-bootstrap
+    curl -o nixpkgs.tar.gz -L https://github.com/flyingcircusio/nixpkgs/archive/refs/heads/nixos-24.11.tar.gz
+    tar xf nixpkgs.tar.gz
+    ln -s nixpkgs-nixos-24.11 nixpkgs
+fi
+cd $base
+NIX_PATH="/tmp/nixos-2411-bootstrap"
+export NIX_PATH
+channels=`nix-build -Q --quiet versions.nix -A allUpstreams --no-out-link`
+if [[ -z $channels ]]; then
+    echo "$0: failed to build nixpkgs+overlay" >&2
+    exit 1
+fi
+mkdir -p channels
+find $channels -maxdepth 1 -type l | while read channel; do
+    target="channels/${channel##*/}"
+    # don't toucn anything which is not a link into the nix store
+    if [[ ! -L $target && -d $target ]]; then
+        echo "$0: warning: $target appears to be a local dev checkout" >&2
+        continue
+    elif [[ -L $target && $(readlink $target) != /nix/store/* ]]; then
+        echo "$0: warning: $target appears to be a local dev checkout" >&2
+        continue
+    fi
+    ln -fs $channel channels
+done
+if ! [[ -e channels/fc ]]; then
+    ln -s .. channels/fc
+fi
+
+NIX_PATH="$base/channels"
+if [[ -n "$config" ]]; then
+    NIX_PATH="${NIX_PATH}:nixos-config=$config"
+else
+    NIX_PATH="${NIX_PATH}:nixos-config=${base}/nixos"
+fi
+
+echo "export NIX_PATH=$NIX_PATH"

doc/default.nix

@@ -3,16 +3,11 @@
 # Run without arguments to get a local build:
 #
 # nix-build
-#
-# A a path/URL to the objects inventory (objects.inv) of flyingcircusio/doc can be passed explicitly,
-# , e.g.:
-# --arg docObjectsInventory https://hydra.flyingcircus.io/job/flyingcircus/doc-test/platformDoc/latest/download-by-type/file/inventory
 
 {
   pkgs ? import (fetchTarball "https://hydra.flyingcircus.io/build/457353/download/1/nixexprs.tar.xz") {}
 , branch ? "24.05"
 , updated ? "1970-01-01 01:00"
-, docObjectsInventory ? null # path to objects.inv generated by flyingcircusio/doc
 , failOnWarnings ? false
 }:
 
@@ -32,7 +27,7 @@ in pkgs.stdenv.mkDerivation rec {
   version = "${branch}-${builtins.substring 0 10 updated}";
   src = pkgs.lib.cleanSource ./.;
 
-  inherit branch updated docObjectsInventory;
+  inherit branch updated;
 
   configurePhase = ":";
   buildInputs = [ buildEnv ] ++ (with pkgs; [ python3 git ]);