In reply to @hacker1024:matrix.org
Is there any way to read a value from another file or environment variable in the Hydra configuration? I've set up sops-nix for all my secrets, but Hydra requires GitLab tokens to be put in the configuration file itself. The NixOS module generates the entire configuration file during evaluation, so there's no way to put secrets inside it.

I have a jobset of NixOS system closures that have custom software installed. The NixOS systems use modules from a third-party repository, and the custom software uses packages from the same third-party repository. The same revision of the repository needs to be used in both cases, as the NixOS modules supply drivers that must be ABI-compatible with the software.

Before making the Hydra jobset, I had a file called revisions.json containing the repository revision and hash. The packages were added in an overlay using self.fetchFromGitHub with those details, and the modules were added using builtins.fetchTarball, as no Nixpkgs is available during module import evaluation.

Is fetchurl disabled in Hydra even when a hash is supplied? It seems so. How then can I use the fixed revision information from inside my main input in another input? Can jobset inputs reference each-other?

Try turning on the nix option builders-use-substitutes and add the S3 cache as a substituter on your ARM machine?

Also be sure to use hydra's store_uri parameter and not a nix post-build-hook to copy built derivations back to S3, otherwise you won't get remote-built derivations into your cache.

Also also, in case it helps: AWS are still running their free tier for graviton t4.small instances: https://aws.amazon.com/ec2/faqs/#t4g-instances