Clean up nix-store on the machines with limited disk space

See merge request !149

Less swap on disk constrained AWS hosts

See merge request !150

Update nixpkgs-ps to include PaymentServer 0.1.1.1

See merge request !147

... fixing the Prometheus metric names a second time.

Prometheus niceties

See merge request !145

We have to explicitely add the port number so the relabel
config can strip it out again.  Else, `instance' seems to
get its value from somewhere else - somewhere our relabel
config does not look at.

Jean-Paul Calderone authored 3 years ago and Florian Sesser committed 3 years ago

This causes NixOS to generate the systemd timer unit for us and saves us
having to explain a lot of subtle systemd features.

It does pin execution to midnight on Monday but scaling to handle load spikes
is Let's Encrypt's problem, I guess.

Add a timer service to periodically trigger the cert renewal service

Closes privatestorageops#222

See merge request !143

This causes NixOS to generate the systemd timer unit for us and saves us
having to explain a lot of subtle systemd features.

It does pin execution to midnight on Monday but scaling to handle load spikes
is Let's Encrypt's problem, I guess.

Add ssh.nix to monitoring systems

See merge request !142

Monitoring: Set admin PW

See merge request !123

Fix deployment key whitespace

Closes #77

See merge request !138

This makes it easier to test outside of GitLab and it also means we don't
depend on whatever wacko shell settings we inherit from GitLab.

Use a new variable which actually holds a path

Closes #76

See merge request !136

Remove group and other permissions from the deploy key

Closes #75

See merge request !134

Propagate morph success/failure out of update-deployment

Closes #74

See merge request !132

Burn in some SSH host key knowledge

Closes #71

See merge request !130

Bounded NIX_PATH

Closes #72

See merge request !131

We can't point it at a Nix expression that evaluates to our desired version of
nixpkgs because certain consumers want it to be a filesystem path instead.

This is what we wanted and much more directly.  It also avoids the gradual
lengthening of the path by always setting the path to nixpkgs-2105 instead of
some derivative of whatever the path was last time.

This avoids a prompt at deploy time and the possibility of an MitM attack
against TOFU.

Various manually-tested fixes for the updater

Closes #70

See merge request !128

Use the GitLab-defined `CI_ENVIRONMENT_NAME`

Closes #69

See merge request !126