A complete example of a working Hydra build machine and other stuff.

snake-nginx.nix

let
  # Wrap a nginx server block in an HTTPS site
  wrapSSL = site: cert: key: block: ''
    server {
        listen      80;
        listen [::]:80;
        server_name ${site};

        location /nginx_status {
            stub_status  on;
            access_log   off;
            allow        127.0.0.1;
            deny         all;
        }

        location / {
            return 302 https://$host$request_uri;
        }
    }

    server {
        listen      443 ssl spdy;
        listen [::]:443 ssl spdy;
        server_name ${site};

        ssl on;
        ssl_certificate     ${cert};
        ssl_certificate_key ${key};

        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH;
        ssl_prefer_server_ciphers on;

        add_header Strict-Transport-Security "max-age=31536000";
        add_header X-Frame-Options DENY;

        ${block}
    }
  '';

  makeAuth = passwd:
    if passwd == null then "" else ''
      auth_basic "Restricted";
      auth_basic_user_file ${passwd};
    '';

  makeProxy = upstream: ''
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-Ssl   on;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header Host              $http_host;
    proxy_set_header X-Url-Scheme      $scheme;
    proxy_redirect off;
    proxy_pass http://${upstream};
  '';

  # Wrap an nginx upstream in an HTTPS site
  wrapSSLUpstream = upstream: site: passwd: cert: key:
    wrapSSL site cert key ''
      location / {
          ${makeAuth passwd}
          ${makeProxy upstream}
      }
    '';
in
{
  conf = ''
    events { worker_connections  1024; }
    worker_processes  1;
    error_log  logs/error.log;
    pid        logs/nginx.pid;

    http {
        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';

        access_log  logs/access.log  main;

        sendfile       on;
        tcp_nopush     on;
        tcp_nodelay    off;
        keepalive_timeout  65;

        gzip              on;
        gzip_vary         on;
        gzip_http_version 1.1;
        gzip_comp_level   2;
        gzip_proxied      any;
        gzip_types text/plain text/css application/x-javascript
          text/xml application/xml application/xml+rss text/javascript;

        upstream hydra {
          server 127.0.0.1:3000 fail_timeout=0;
        }

        upstream btsync {
          server 127.0.0.1:9000 fail_timeout=0;
        }

        upstream transmission {
          server 127.0.0.1:9091 fail_timeout=0;
        }

        # WWW configuration
        ${wrapSSL "example.org www.example.org" "/root/ssl/www.crt" "/root/ssl/www.key" ''

            location ~ ^/~(.+?)(/.*)?$ {
                alias /home/$1/public_html$2;
                index  index.html index.htm;
                autoindex on;
            }
        ''}

        # Hydra configuration
        ${wrapSSLUpstream "hydra" "hydra.example.org" null
            "/root/ssl/hydra.crt"  "/root/ssl/hydra.key"}

        # Transmission
        ${wrapSSLUpstream "transmission" "tr.example.org" "/var/spool/nginx/htpasswd"
            "/root/ssl/transmission.crt" "/root/ssl/transmission.key"}

        # BitTorrent Sync
        ${wrapSSLUpstream "btsync" "btsync.example.org" "/var/spool/nginx/htpasswd"
            "/root/ssl/btsync.crt" "/root/ssl/btsync.key"}
    }
  '';
}

snake.nix

{ config, pkgs, resources, ... }:

with builtins;

{
  ## -- Global networking/system options ---------------------------------------
  imports = [ ../hydra/hydra-module.nix ];

  nixpkgs.config.allowUnfree = true;

  networking.firewall.enable          = true;
  networking.firewall.rejectPackets   = false;
  networking.firewall.allowPing       = false;
  networking.firewall.allowedTCPPorts =
    [ 22 80 443   # SSH, HTTP(S)
      25565       # Minecraft server
      21025       # Starbound server
      64738       # Mumble
    ];
  networking.firewall.allowedUDPPorts =
    [ 21025       # Starbound server
      64738       # Mumble
    ];
  networking.firewall.allowedUDPPortRanges =
    [ { from = 60000; to = 61000; } ]; # Mosh port ranges


  services.printing.enable = false;
  security.polkit.enable   = false;
  services.xserver.enable  = false;
  time.timeZone = "America/Chicago";

  networking.extraHosts =
    with import ../resources/hosts.nix; extraHosts;
  services.openssh.knownHosts = with import ../resources/hosts.nix;
    sshKnownHosts;
  programs.ssh.extraConfig = ''
    Host goethe
      HostName localhost
      Port 30000
  '';

  # -- Nix options
  nix = {
    gc.automatic = true;
    useChroot    = true;
    extraOptions = ''
      build-cores = 0
      auto-optimise-store = true
      extra-binary-caches = http://hydra.nixos.org
    '';
  };

  ## -- Users, packages --------------------------------------------------------

  users.mutableUsers         = false;
  users.extraUsers.goethe    = with import ../resources/users.nix; goethe;
  users.extraUsers.a         = with import ../resources/users.nix; austin;
  users.extraGroups.duosec   = with import ../resources/groups.nix; duosec;
  security.sudo.wheelNeedsPassword = false;

  environment.systemPackages = with import ../resources/pkgs.nix { pkgs=pkgs; };
    with pkgs; commonPkgs ++ [ cryptol1 hol_light cov-build framac ];

  ## -- Services ---------------------------------------------------------------

  # -- Tarsnap
  services.tarsnap.enable = true;
  services.tarsnap.config =
    { nixos =
        { directories =
          [ "/home" "/root"
            "/var/lib/murmur" "/var/spool/nginx"
            "/var/lib/hydra/.ssh/"
          ];
        };

      minecraft =
        { directories = [ "/var/lib/minecraft" ];
          period      = "0 * * * *";
        };

      postgresql =
        { directories = [ "/var/db/postgresql" ];
          period      = "0 */2 * * *";
        };

      hydra =
        { directories =
            [ "/var/lib/hydra/data/logs" ];
          period      = "0 * * * *";
        };
    };

  # -- Minecraft/Starbound
  services.minecraft-server.enable = true;
  #services.starbound-server.enable = false;

  # -- Mumble daemon
  services.murmur.enable       = true;
  services.murmur.registerName = "SNAKE";
  services.murmur.sslCert      = "/var/lib/murmur/murmur.crt";
  services.murmur.sslKey       = "/var/lib/murmur/murmur.key";

  # -- Transmission
  boot.kernel.sysctl."net.core.wmem_max" = 1048576;
  boot.kernel.sysctl."net.core.rmem_max" = 4194304;
  services.transmission.enable = true;

  # -- Duo Security
  security.duosec.ssh.enable = true;
  security.duosec.autopush   = true;
  security.duosec.ikey       = readFile ../resources/private/snake/duosec-ikey;
  security.duosec.skey       = readFile ../resources/private/snake/duosec-skey;
  security.duosec.host       = readFile ../resources/private/snake/duosec-host;
  security.duosec.group      = "duosec";
  security.duosec.allowTcpForwarding = true;

  # -- Datadog
  services.dd-agent.enable   = true;
  services.dd-agent.api_key  = readFile ../resources/private/datadog-key;

  services.dd-agent.nginxConfig = ''
    init_config:

    instances:
        -   nginx_status_url: http://127.0.0.1/nginx_status/
  '';

  services.dd-agent.postgresqlConfig = ''
    init_config:

    instances:
       -   host: localhost
           port: 5432
           username: datadog
           password: lWiOt5urS3V41JA8pGTqZezA
  '';

  # -- BitTorrent Sync
  services.btsync.enable       = true;
  services.btsync.deviceName   = "Snake (NixOS 14.02-git-HEAD)";
  services.btsync.enableWebUI  = true;

  ## -- grsecurity -------------------------------------------------------------

  security.grsecurity.enable  = false;
  security.grsecurity.testing = true;
  security.grsecurity.config = {
    system                 = "server";
    virtualisationConfig   = "host";
    hardwareVirtualisation = true;
    virtualisationSoftware = "kvm";

    denyChrootChmod = false;

    kernelExtraConfig = with import ../resources/kernel.nix; grsecExtraConf;
  };

  ## -- Nginx ------------------------------------------------------------------

  services.nginx.enable = true;
  services.nginx.config = with import ../resources/snake-nginx.nix; conf;

  ## -- Hydra ------------------------------------------------------------------

  services.hydra = {
    enable                   = true;
    package                  =
      (import ../hydra/release.nix {}).build.x86_64-linux;
    hydraURL                 = "https://hydra.example.org";
    listenHost               = "127.0.0.1";
    port                     = 3000;
    minimumDiskFree          = 5; # in GB
    minimumDiskFreeEvaluator = 2;
    notificationSender       = "[email protected]";
    logo                     = ../resources/img/hydra-logo.png;
    debugServer              = false;
  };

  # -- Sendmail
  networking.defaultMailServer = {
    directDelivery = true;
    hostName = "hydra.example.org";
    domain   = "example.org";
  };

  # -- PostgreSQL
  services.postgresql.enable  = true;
  services.postgresql.package = pkgs.postgresql93;

  # -- Build machines
  nix.distributedBuilds = false;
  nix.buildMachines =
    [ { hostName    = "goethe";
        maxJobs     = 8;
        sshKey      = "/root/.ssh/id_buildfarm";
        sshUser     = "a";
        system      = "x86_64-darwin";
        speedFactor = 40;
      }
    ];
}