move to docker images

clusters/vit/testnet/default.nix

@@ -22,6 +22,9 @@ in {
     intentions = "write";
   };
 
+  services.nomad.policies.admin.namespace."vit-*".policy = "write";
+  services.nomad.policies.developer.namespace."vit-*".policy = "read";
+
   cluster = {
     name = "vit-testnet";
 

clusters/vit/testnet/host_volumes.nix

@@ -1,10 +1,10 @@
-{ ... }:
-{
-  # services.nomad.client = {
-  #   host_volume = [{
-  #     name = "ca-certificates";
-  #     path = "/etc/ssl/certs";
-  #     read_only = true;
-  #   }];
-  # };
+{ ... }: {
+  services.nomad.client = {
+    host_volume = [{
+      vit-testnet = {
+        path = "/var/lib/seaweedfs-mount/nomad/vit-testnet";
+        read_only = false;
+      };
+    }];
+  };
 }

docker/env.nix

@@ -0,0 +1,18 @@
+{ lib, buildLayeredImage, mkEnv, coreutils, writeShellScript }:
+let
+  entrypoint = writeShellScript "env" ''
+    env
+
+    while true; do
+      sleep 1
+    done
+  '';
+in {
+  env = buildLayeredImage {
+    name = "docker.vit.iohk.io/env";
+    config = {
+      Entrypoint = [ entrypoint ];
+      Env = mkEnv { PATH = lib.makeBinPath [ coreutils ]; };
+    };
+  };
+}

docker/jormungandr.nix

@@ -0,0 +1,42 @@
+{ lib, buildLayeredImage, mkEnv, writeShellScript, jormungandr, jq, remarshal
+, coreutils }:
+let
+  entrypoint = writeShellScript "jormungandr" ''
+    set -exuo pipefail
+
+    set +x
+    echo "waiting for $REQUIRED_PEER_COUNT peers"
+    until [ "$(jq -r '.p2p.trusted_peers | length' < "$NOMAD_TASK_DIR/node-config.json")" -ge $REQUIRED_PEER_COUNT ]; do
+      sleep 0.1
+    done
+    set -x
+
+    remarshal --if json --of yaml "$NOMAD_TASK_DIR/node-config.json" > "$NOMAD_TASK_DIR/running.yaml"
+
+    if [ -n "$PRIVATE" ]; then
+      echo "Running with node with secrets..."
+      exec jormungandr \
+        --storage "$STORAGE_DIR" \
+        --config "$NOMAD_TASK_DIR/running.yaml" \
+        --genesis-block $NOMAD_TASK_DIR/block0.bin/block0.bin \
+        --secret $NOMAD_SECRETS_DIR/bft-secret.yaml
+    else
+      echo "Running with follower node..."
+      exec jormungandr \
+        --storage "$STORAGE_DIR" \
+        --config "$NOMAD_TASK_DIR/running.yaml" \
+        --genesis-block $NOMAD_TASK_DIR/block0.bin/block0.bin
+    fi
+  '';
+in {
+  jormungandr = buildLayeredImage {
+    name = "docker.vit.iohk.io/jormungandr";
+    config = {
+      Entrypoint = [ entrypoint ];
+
+      Env = mkEnv {
+        PATH = lib.makeBinPath [ jormungandr jq remarshal coreutils ];
+      };
+    };
+  };
+}

docker/monitor.nix

@@ -0,0 +1,12 @@
+{ buildLayeredImage, mkEnv, jormungandr-monitor, cacert, coreutils
+, bashInteractive, busybox, curl, lsof }: {
+  monitor = buildLayeredImage {
+    name = "docker.vit.iohk.io/monitor";
+    contents = [ coreutils bashInteractive busybox curl lsof ];
+    config = {
+      Entrypoint = [ jormungandr-monitor ];
+
+      Env = mkEnv { SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt"; };
+    };
+  };
+}

docker/telegraf.nix

@@ -0,0 +1,6 @@
+{ buildLayeredImage, telegraf }: {
+  telegraf = buildLayeredImage {
+    name = "docker.vit.iohk.io/telegraf";
+    config.Entrypoint = [ "${telegraf}/bin/telegraf" ];
+  };
+}

docker/vit-servicing-station.nix

@@ -0,0 +1,7 @@
+{ buildLayeredImage, vit-servicing-station }: {
+  vit-servicing-station = buildLayeredImage {
+    name = "docker.vit.iohk.io/vit-servicing-station";
+    config.Entrypoint =
+      [ "${vit-servicing-station}/bin/vit-servicing-station-server" ];
+  };
+}