infra_wiki

forge

A Raspberry Pi 5 on NVMe that is the lab's native arm64 build host.

vendorRaspberry Pi
modelRaspberry Pi 5 Model B Rev 1.1 (8 GB)
serialaed421e548c12e74
revisiond04171
cpuBCM2712, Cortex-A76 (4c)
ram8 GB LPDDR4X-4267
gpuBroadcom VideoCore VII
storage256 GB Patriot P300 NVMe
osNixOS 26.05 (Yarara)

forge is the lab's native arm64 build host, a Raspberry Pi 5 on the Anchor network, folly's network for lab hosts. nix/hosts/forge.nix configures it.

What it runs#

  • The build host role, which runs Nix builds for other machines over SSH, including the armv6l cross-builds
  • Docker with buildx for arm64 images
  • CoreDNS and chrony through the anchor profile (nix/profiles/anchor.nix), which makes forge one of the three anchors that serve lab DNS and time
  • harmonia, a Nix binary cache behind nginx on port 80, which the firewall blocks. No host trusts its key.
  • A node of folly's Garage cluster, with data in /var/lib/garage (nix/services/garage.nix)

See Build host and cache.

clusters/folly/monitoring/forge.yaml declares the alerts ForgeCoreDnsDown and ForgeChronyDown.

Reach#

Reach it at forge.lolwtf.ca or forge.<tailnet>.

Quirks#

  • The EEPROM boot settings are outside git. BOOT_ORDER=0xf1276 tries the NVMe, then rackpi5 from spore. See Netboot.
  • A stock EEPROM update erases the enrolled public key of spore's /var/lib/pi-boot-sign/private.pem. HTTP boot fails until the key is enrolled again.

Edit on GitHub

Linked from 9
  • capsuleA Raspberry Pi 5 on NVMe that is one of the three lab DNS and time anchors, and runs NetBox.
  • HostsEvery host in the homelab, with its role, site, hardware, OS and status, and how to reach it.
  • rackpi5The image-only NixOS config that spore signs and serves, and that forge boots over HTTP when its NVMe does not boot.
  • radiopi0A Raspberry Pi Zero W with a pHAT BEAT that runs Raspbian and a CloudEvents LED service that is not in git.
  • BackupsHow Garage, Velero, CloudNativePG and etcd snapshots back up the lab's databases, volumes and etcd, and how each site copies them to GCS.
  • Ingress and DNSThe Gateways, DNS records, certificates, tunnels and lab resolvers that give cluster services a name and a path from the LAN, tailnet or internet.
  • Build host and cacheHow GitHub Actions builds NixOS closures and images, the Nix binary caches that hosts pull from, and the arm64 build role of forge.
  • NetbootThe network boot service on spore, with TFTP and HTTP for folly's boot files and a signed RAM-boot image that forge falls back to.
  • Change the forge EEPROMChange the boot settings in the EEPROM of forge, and keep its HTTP boot fallback to the rackpi5 image.

↑↓ move ↵ open esc close