macs: create darwin bootstrap closure

macs/common.nix

@@ -1,97 +1,8 @@
 # used with https://github.com/DeterminateSystems/macos-ephemeral
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  sshKeys = {
-    hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
-  };
-  environment = lib.concatStringsSep " " [
-    "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-  ];
-
-  authorizedNixStoreKey =
-    key:
-    "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
-in
 
 {
   imports = [
     ./hydra-queue-builder.nix
+    ./minimal.nix
   ];
-
-  environment.darwinConfig = "/nix/home/darwin-config/macs/nix-darwin.nix";
-  environment.systemPackages = [
-    config.nix.package
-    pkgs.nix-top
-  ];
-
-  system.stateVersion = 5;
-
-  programs = {
-    zsh = {
-      enable = true;
-      enableCompletion = false;
-    };
-    bash = {
-      enable = true;
-      completion.enable = true;
-    };
-  };
-
-  nix = {
-    settings = {
-      extra-experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-      max-silent-time = 7200; # 2h
-      timeout = 43200; # 12h
-    };
-    gc = {
-      automatic = true;
-      interval = [
-        {
-          Minute = 15;
-        }
-        {
-          Minute = 45;
-        }
-      ];
-      # ensure up to 100G free space every half hour
-      options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=100*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
-    };
-  };
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    (authorizedNixStoreKey sshKeys.hydra-queue-runner)
-  ]
-  ++ (import ../ssh-keys.nix).infra-core;
-
-  system.activationScripts.postActivation.text = ''
-    printf "disabling spotlight indexing... "
-    mdutil -i off -d / &> /dev/null
-    mdutil -E / &> /dev/null
-    echo "ok"
-  '';
-
-  services.prometheus.exporters.node.enable = true;
-
-  # https://github.com/LnL7/nix-darwin/issues/1256
-  users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
-
-  launchd.daemons.rosetta2-gc = {
-    script = ''
-      date
-      exec /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -P -minsize 0 /System/Volumes/Data
-    '';
-    serviceConfig.StartInterval = 3600 * 2;
-    serviceConfig.RunAtLoad = true;
-    serviceConfig.StandardErrorPath = "/var/log/rosetta2-gc.log";
-    serviceConfig.StandardOutPath = "/var/log/rosetta2-gc.log";
-  };
 }

macs/flake-module.nix

@@ -3,7 +3,7 @@
   flake.darwinConfigurations =
     let
       mkNixDarwin =
-        localHostName: entrypoint:
+        hostname: entrypoint:
         inputs.darwin.lib.darwinSystem {
           system = "aarch64-darwin";
 
@@ -13,14 +13,20 @@
 
           modules = [
             {
-              networking = { inherit localHostName; };
+              networking = {
+                # the name used to resolve the flake output
+                localHostName = hostname;
+                # the name that propagates into the MDM
+                computerName = hostname;
+              };
             }
-            ./common.nix
             entrypoint
           ];
         };
     in
     {
+      bootstrap = mkNixDarwin "bootstrap" ./profiles/bootstrap.nix;
+
       # M1 8C, 16G, 256G (Hetzner)
       enormous-catfish = mkNixDarwin "enormous-catfish" ./profiles/m1.nix;
       growing-jennet = mkNixDarwin "growing-jennet" ./profiles/m1.nix;

macs/minimal.nix

@@ -0,0 +1,106 @@
+# used with https://github.com/DeterminateSystems/macos-ephemeral
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  sshKeys = {
+    hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
+  };
+  environment = lib.concatStringsSep " " [
+    "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+  ];
+
+  authorizedNixStoreKey =
+    key:
+    "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
+in
+
+{
+  environment.darwinConfig = "/nix/home/darwin-config/macs/nix-darwin.nix";
+  environment.systemPackages = [
+    config.nix.package
+    pkgs.nix-top
+  ];
+
+  system.stateVersion = 5;
+
+  programs = {
+    zsh = {
+      enable = true;
+      enableCompletion = false;
+    };
+    bash = {
+      enable = true;
+      completion.enable = true;
+    };
+  };
+
+  nix = {
+    settings = {
+      extra-experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      max-silent-time = 7200; # 2h
+      timeout = 43200; # 12h
+    };
+    gc = {
+      automatic = true;
+      interval = [
+        {
+          Minute = 15;
+        }
+        {
+          Minute = 45;
+        }
+      ];
+      # ensure up to 100G free space every half hour
+      options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=100*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
+    };
+  };
+
+  services.openssh.enable = true;
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    (authorizedNixStoreKey sshKeys.hydra-queue-runner)
+  ]
+  ++ (import ../ssh-keys.nix).infra-core;
+
+  system.activationScripts.postActivation.text = ''
+    printf "disabling spotlight indexing... "
+    mdutil -i off -d / &> /dev/null
+    mdutil -E / &> /dev/null
+    echo "ok"
+  '';
+
+  services.prometheus.exporters.node.enable = true;
+
+  # https://github.com/LnL7/nix-darwin/issues/1256
+  users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
+
+  launchd.daemons.rosetta2-gc = {
+    script = ''
+      date
+      exec /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -P -minsize 0 /System/Volumes/Data
+    '';
+    serviceConfig.StartInterval = 3600 * 2;
+    serviceConfig.RunAtLoad = true;
+    serviceConfig.StandardErrorPath = "/var/log/rosetta2-gc.log";
+    serviceConfig.StandardOutPath = "/var/log/rosetta2-gc.log";
+  };
+
+  # MacOS stores extensive logs in /var/db/uuidtext, which cause high disk usage
+  launchd.daemons.uuidtext-gc = {
+    script = ''
+      date
+      find /var/db/uuidtext -type f -mtime +7 -delete
+    '';
+    serviceConfig.StartInterval = 3600 * 24;
+    serviceConfig.StandardErrorPath = "/var/log/uuidtext-gc.log";
+    serviceConfig.StandardOutPath = "/var/log/uuidtext-gc.log";
+  };
+}

macs/profiles/bootstrap.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../minimal.nix
+  ];
+}

macs/profiles/m1.nix

@@ -1,4 +1,8 @@
 {
+  imports = [
+    ../common.nix
+  ];
+
   # 8 Cores, 16 GB RAM, 256 GB Disk
   # split into 4 jobs with 2C/4G
   nix.settings = {

macs/profiles/m2.large.nix

@@ -1,4 +1,8 @@
 {
+  imports = [
+    ../common.nix
+  ];
+
   # 8 Cores, 24 GB RAM, 1 TB Disk
   # split into 2 jobs with 4C/12G
   nix.settings = {