Skip to content

Commit 8684614

Browse files
johnalotoskijohnalotoski
authored
Merge pull request #70 from input-output-hk/next-2025-06-06
Node-ng 10.5.0, Cli-ng 10.11.0.0, ssh over ssm
2 parents a531b56 + 9d6cf51 commit 8684614

File tree

17 files changed

+642
-407
lines changed

17 files changed

+642
-407
lines changed

‎.envrc‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,30 @@
1+
# shellcheck disable=SC2148
12
if ! has nix_direnv_version || ! nix_direnv_version 3.0.6; then
23
source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.6/direnvrc" "sha256-RYcUJaRMf8oF5LznDrlCXbkOQrywm0HDv1VjYGaJGdM="
34
fi
45

56
IGREEN='\e[0;92m'
67
IRED='\e[0;91m'
78
NC='\e[0m'
8-
if [ $(nix eval --impure --expr 'let f = builtins.getFlake "git+file://${toString ./.}"; in f.lib.versionAtLeast builtins.nixVersion "2.17.0"') != "true" ]; then
9+
if [ "$(nix eval --impure --expr "let f = builtins.getFlake \"git+file://\${toString ./.}\"; in f.lib.versionAtLeast builtins.nixVersion \"2.17.0\"")" != "true" ]; then
910
echo -e "The nix version must be at least ${IGREEN}2.17.0${NC} for fetchClosure of pure packages."
1011
echo -e "Your version is ${IRED}$(nix --version)${NC}"
1112
exit
1213
fi
1314

14-
if [ $(nix eval --expr 'builtins ? fetchClosure') != "true" ]; then
15+
if [ "$(nix eval --expr 'builtins ? fetchClosure')" != "true" ]; then
1516
echo -e "Experimental nix feature \"${IGREEN}fetch-closure${NC}\" ${IRED}must be enabled${NC} for fetchClosure of pure packages."
1617
echo "You may need to add the following to your nix config:"
1718
echo
1819
echo "nix.settings.extraOptions = \"experimental-features = fetch-closure\";"
1920
exit
2021
fi
2122

23+
# shellcheck disable=SC1091
2224
[ -f .envrc.local ] && source .envrc.local
2325

2426
if [ -n "${DEVSHELL_TARGET:-}" ]; then
25-
use flake .#${DEVSHELL_TARGET}
27+
use flake ".#$DEVSHELL_TARGET"
2628
else
2729
use flake
2830
fi

‎flake.lock‎

Lines changed: 10 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flake.nix‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,7 @@
106106
};
107107

108108
cardano-node-service-ng = {
109-
# Until node >= 10.5.0 is tagged, this commit allows the service to work on nixpkgs >= 25.05
110-
url = "github:IntersectMBO/cardano-node/0983ac29304aadac74a5604eeefa76cfbcc91611";
109+
url = "github:IntersectMBO/cardano-node/10.5.0";
111110
flake = false;
112111
};
113112

‎flake/nixosModules/profile-basic.nix‎

Lines changed: 54 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,7 @@
3030

3131
networking = {
3232
hostName = name;
33-
firewall = {
34-
enable = true;
35-
allowedTCPPorts = [22];
36-
allowedUDPPorts = [];
37-
};
33+
firewall.enable = true;
3834
};
3935

4036
time.timeZone = "UTC";
@@ -53,48 +49,59 @@
5349
doc.enable = false;
5450
};
5551

56-
environment.systemPackages = with pkgs; [
57-
awscli2
58-
age
59-
bat
60-
bind
61-
cloud-utils
62-
di
63-
dnsutils
64-
fd
65-
fx
66-
file
67-
git
68-
glances
69-
helix
70-
htop
71-
icdiff
72-
ijq
73-
iptables
74-
self'.packages.isd
75-
jiq
76-
jq
77-
lsof
78-
nano
79-
# For nix >= 2.24 build compatibility
80-
inputs.nixpkgs-unstable.legacyPackages.${system}.neovim
81-
ncdu
82-
# Add a localFlake pin to avoid downstream repo nixpkgs pins <= 24.11 causing missing features error
83-
inputs.nixpkgs.legacyPackages.${system}.nushell
84-
nvme-cli
85-
parted
86-
pciutils
87-
procps
88-
ripgrep
89-
rsync
90-
smem
91-
ssh-to-age
92-
sops
93-
sysstat
94-
tcpdump
95-
tree
96-
wget
97-
];
52+
environment = {
53+
shellInit = ''
54+
# This can be used to simplify ssh sessions, rsync, ex:
55+
# ssh -o "$(ssm-proxy-cmd "$REGION")" "$INSTANCE_ID"
56+
ssm-proxy-cmd() {
57+
echo "ProxyCommand=sh -c 'aws --region $1 ssm start-session --target %h --document-name AWS-StartSSHSession --parameters portNumber=%p'"
58+
}
59+
'';
60+
61+
systemPackages = with pkgs; [
62+
awscli2
63+
age
64+
bat
65+
bind
66+
cloud-utils
67+
di
68+
dnsutils
69+
fd
70+
fx
71+
file
72+
git
73+
glances
74+
helix
75+
htop
76+
icdiff
77+
ijq
78+
iptables
79+
self'.packages.isd
80+
jiq
81+
jq
82+
lsof
83+
nano
84+
# For nix >= 2.24 build compatibility
85+
inputs.nixpkgs-unstable.legacyPackages.${system}.neovim
86+
ncdu
87+
# Add a localFlake pin to avoid downstream repo nixpkgs pins <= 24.11 causing missing features error
88+
inputs.nixpkgs.legacyPackages.${system}.nushell
89+
nvme-cli
90+
parted
91+
pciutils
92+
procps
93+
ripgrep
94+
rsync
95+
ssm-session-manager-plugin
96+
smem
97+
ssh-to-age
98+
sops
99+
sysstat
100+
tcpdump
101+
tree
102+
wget
103+
];
104+
};
98105

99106
programs = {
100107
tmux = {

‎flake/nixosModules/profile-cardano-node-topology.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@
9797
# These are also set from the role-block-producer nixos module
9898
extraNodeConfig = {
9999
PeerSharing = false;
100+
TargetNumberOfKnownPeers = 100;
100101
TargetNumberOfRootPeers = 100;
101102
};
102103
publicProducers = mkForce (extraNodeListPublicProducers ++ extraPublicProducers);

‎flakeModules/jobs.nix‎

Lines changed: 29 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,15 @@ in {
9494
# Some code paths may not use the era bundled cli
9595
# shellcheck disable=SC2034
9696
CARDANO_CLI=("''${CARDANO_CLI_NO_ERA[@]}" "''${ERA_CMD:+$ERA_CMD}")
97+
98+
# Use a cardano-cli breaking change marker to handle version specific breaking changes
99+
if [ "$(printf "%s\n10.11.0.0" "$("''${CARDANO_CLI_NO_ERA[@]}" --version)" | sort -V | head -n 1)" = "10.11.0.0" ]; then
100+
# shellcheck disable=SC2034
101+
CARDANO_CLI_BREAKING="true"
102+
else
103+
# shellcheck disable=SC2034
104+
CARDANO_CLI_BREAKING="false"
105+
fi
97106
'';
98107

99108
updateProposalTemplate = ''
@@ -166,11 +175,19 @@ in {
166175
function create_proposal {
167176
TARGET_EPOCH="$1"
168177
169-
"''${CARDANO_CLI_NO_ERA[@]}" legacy governance create-update-proposal \
170-
--epoch "$TARGET_EPOCH" \
171-
"''${PROPOSAL_ARGS[@]}" \
172-
"''${PROPOSAL_KEY_ARGS[@]}" \
173-
--out-file update.proposal
178+
if [ "$CARDANO_CLI_BREAKING" = "true" ]; then
179+
"''${CARDANO_CLI_NO_ERA[@]}" compatible "''${ERA_CMD:-alonzo}" governance action create-protocol-parameters-update \
180+
--epoch "$TARGET_EPOCH" \
181+
"''${PROPOSAL_ARGS[@]}" \
182+
"''${PROPOSAL_KEY_ARGS[@]}" \
183+
--out-file update.proposal
184+
else
185+
"''${CARDANO_CLI_NO_ERA[@]}" legacy governance create-update-proposal \
186+
--epoch "$TARGET_EPOCH" \
187+
"''${PROPOSAL_ARGS[@]}" \
188+
"''${PROPOSAL_KEY_ARGS[@]}" \
189+
--out-file update.proposal
190+
fi
174191
175192
"''${CARDANO_CLI_NO_ERA[@]}" compatible "''${ERA_CMD:-alonzo}" transaction signed-transaction \
176193
--tx-in "$TXIN" \
@@ -2058,8 +2075,8 @@ in {
20582075
${selectCardanoCli}
20592076
20602077
"''${CARDANO_CLI_NO_ERA[@]}" latest governance committee create-hot-key-authorization-certificate \
2061-
--cold-verification-key-file "$CC_DIR"/cc-"$INDEX"-cold.vkey \
2062-
--hot-verification-key-file "$CC_DIR"/cc-"$INDEX"-hot.vkey \
2078+
--cold-verification-key-file "$(decrypt_check "$CC_DIR"/cc-"$INDEX"-cold.vkey)" \
2079+
--hot-verification-key-file "$(decrypt_check "$CC_DIR"/cc-"$INDEX"-hot.vkey)" \
20632080
--out-file cc-"$INDEX"-reg.cert
20642081
20652082
WITNESSES=2
@@ -2090,7 +2107,7 @@ in {
20902107
--tx-body-file tx-cc-"$INDEX".txbody \
20912108
--out-file tx-cc-"$INDEX".txsigned \
20922109
--signing-key-file "$(decrypt_check "$PAYMENT_KEY".skey)" \
2093-
--signing-key-file "$CC_DIR"/cc-"$INDEX"-cold.skey
2110+
--signing-key-file "$(decrypt_check "$CC_DIR"/cc-"$INDEX"-cold.skey)"
20942111
20952112
fd --type file . "$CC_DIR"/ --exec bash -c 'encrypt_check {}'
20962113
@@ -2121,12 +2138,12 @@ in {
21212138
mkdir -p "$CC_DIR"
21222139
21232140
"''${CARDANO_CLI_NO_ERA[@]}" latest governance committee key-gen-cold \
2124-
--verification-key-file "$CC_DIR"/cc-"$INDEX"-cold.vkey \
2125-
--signing-key-file "$CC_DIR"/cc-"$INDEX"-cold.skey
2141+
--verification-key-file "$(decrypt_check "$CC_DIR"/cc-"$INDEX"-cold.vkey)" \
2142+
--signing-key-file "$(decrypt_check "$CC_DIR"/cc-"$INDEX"-cold.skey)"
21262143
21272144
"''${CARDANO_CLI_NO_ERA[@]}" latest governance committee key-gen-hot \
2128-
--verification-key-file "$CC_DIR"/cc-"$INDEX"-hot.vkey \
2129-
--signing-key-file "$CC_DIR"/cc-"$INDEX"-hot.skey
2145+
--verification-key-file "$(decrypt_check "$CC_DIR"/cc-"$INDEX"-hot.vkey)" \
2146+
--signing-key-file "$(decrypt-check "$CC_DIR"/cc-"$INDEX"-hot.skey)"
21302147
'';
21312148
};
21322149

0 commit comments

Comments
 (0)