From 7994b362507b1455ce98376ce4a1f8145da9339d Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Mon, 24 Nov 2025 23:31:58 -0500
Subject: [PATCH 01/16] ansible: add a-sea-us to buildworkers, add host
 vars/volumes for building

---
 .../host_vars/a-sea-us.m.voidlinux.org.yml    | 21 +++++++++++++++++++
 ansible/inventory                             |  1 +
 2 files changed, 22 insertions(+)

diff --git a/ansible/host_vars/a-sea-us.m.voidlinux.org.yml b/ansible/host_vars/a-sea-us.m.voidlinux.org.yml
index fdbb5580..477757b0 100644
--- a/ansible/host_vars/a-sea-us.m.voidlinux.org.yml
+++ b/ansible/host_vars/a-sea-us.m.voidlinux.org.yml
@@ -8,3 +8,24 @@ xbps_repository_nonfree: https://{{ xbps_repository_address }}/current/aarch64/n
 xbps_repoconf_repos_enabled:
   - 00-repository-main
   - 10-repository-nonfree
+
+sshd_AllowGroups:
+  - build-ops
+
+buildworker_archs:
+  - aarch64
+  - aarch64-musl
+
+nomad_host_volumes:
+  - name: ccache
+    path: /hostdir/ccache
+    read_only: true
+  - name: aarch64_hostdir
+    path: /hostdir
+    read_only: false
+  - name: aarch64_workdir
+    path: /builder/workdir
+    read_only: false
+  - name: aarch64_buildrootdir
+    path: /builder/buildroot
+    read_only: false
diff --git a/ansible/inventory b/ansible/inventory
index d661ecf6..40f73d18 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -2,6 +2,7 @@
 a-hel-fi.m.voidlinux.org
 a-fsn-de.m.voidlinux.org
 b-fsn-de.m.voidlinux.org
+a-sea-us.m.voidlinux.org
 
 [root_mirror]
 a-fsn-de.m.voidlinux.org

From c1ceb0d5d4993771780b02d506ec882e401de9c2 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Mon, 24 Nov 2025 23:32:32 -0500
Subject: [PATCH 02/16] ansible: add incoming_pkgs volume, update root-pkgs
 path for a-fsn-de

---
 ansible/host_vars/a-fsn-de.m.voidlinux.org.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ansible/host_vars/a-fsn-de.m.voidlinux.org.yml b/ansible/host_vars/a-fsn-de.m.voidlinux.org.yml
index 5f0617bc..a362a9a6 100644
--- a/ansible/host_vars/a-fsn-de.m.voidlinux.org.yml
+++ b/ansible/host_vars/a-fsn-de.m.voidlinux.org.yml
@@ -31,7 +31,7 @@ nomad_host_volumes:
     path: /data/void-packages
     read_only: false
   - name: root-pkgs
-    path: /hostdir/binpkgs
+    path: /srv/www/void-repo/current
     read_only: false
   - name: root_mirror
     path: /srv/www/void-repo
@@ -48,3 +48,6 @@ nomad_host_volumes:
   - name: ccache
     path: /hostdir/ccache
     read_only: true
+  - name: incoming_pkgs
+    path: /incoming
+    read_only: false

From 1b74ac0d348ca1a1c7eceb659b424d2a8bfca0fe Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 14:06:04 -0500
Subject: [PATCH 03/16] ansible/host_vars/a-hel-fi: decommission as a builder

---
 ansible/host_vars/a-hel-fi.m.voidlinux.org.yml | 15 ---------------
 ansible/inventory                              |  1 -
 2 files changed, 16 deletions(-)

diff --git a/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml b/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml
index 315a44f5..eaf8494d 100644
--- a/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml
+++ b/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml
@@ -12,22 +12,7 @@ network_static_interfaces:
       - 95.216.76.97/26
       - 2a01:4f9:2b:c9e::2/64
 
-sshd_AllowGroups:
-  - build-ops
-
 nomad_host_volumes:
   - name: terrastate
     path: /nomad/terrastate
     read_only: false
-  - name: musl_hostdir
-    path: /hostdir
-    read_only: false
-  - name: musl_workdir
-    path: /workdir
-    read_only: false
-  - name: musl_buildrootdir
-    path: /buildroot
-    read_only: false
-  - name: ccache
-    path: /hostdir/ccache
-    read_only: true
diff --git a/ansible/inventory b/ansible/inventory
index 40f73d18..27e9a497 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -1,5 +1,4 @@
 [buildworker]
-a-hel-fi.m.voidlinux.org
 a-fsn-de.m.voidlinux.org
 b-fsn-de.m.voidlinux.org
 a-sea-us.m.voidlinux.org

From 196700dd307610e9062d655f9c4f0a63e33da7b7 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 14:00:29 -0500
Subject: [PATCH 04/16] ansible/host_vars/b-fsn-de: rename builder volumes

b-fsn-de will now have the musl builders
---
 ansible/host_vars/b-fsn-de.m.voidlinux.org.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml b/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml
index 7f0247cb..3d94e6d0 100644
--- a/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml
+++ b/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml
@@ -10,12 +10,12 @@ nomad_host_volumes:
   - name: ccache
     path: /hostdir/ccache
     read_only: true
-  - name: aarch64_hostdir
+  - name: musl_hostdir
     path: /hostdir
     read_only: false
-  - name: aarch64_workdir
+  - name: musl_workdir
     path: /workdir
     read_only: false
-  - name: aarch64_buildrootdir
+  - name: musl_buildrootdir
     path: /buildroot
     read_only: false

From d38851f4439d1f5bfc3dd06a330de6232ab470c1 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Fri, 25 Jul 2025 21:27:00 -0400
Subject: [PATCH 05/16] services/nomad/build/buildbot: native aarch64 worker,
 use remote repo (shadow) only

---
 services/nomad/build/buildbot.cfg   | 70 +++++++++++------------------
 services/nomad/build/buildbot.nomad | 18 ++++----
 2 files changed, 34 insertions(+), 54 deletions(-)

diff --git a/services/nomad/build/buildbot.cfg b/services/nomad/build/buildbot.cfg
index 83f80d4c..e996c764 100644
--- a/services/nomad/build/buildbot.cfg
+++ b/services/nomad/build/buildbot.cfg
@@ -10,7 +10,7 @@ from pathlib import Path
 from twisted.internet import defer
 from twisted.python import log
 
-from buildbot.process.results import SUCCESS, SKIPPED
+from buildbot.process.results import SUCCESS
 from buildbot.plugins import util, secrets, reporters, worker, schedulers
 from buildbot.plugins import steps
 
@@ -129,13 +129,19 @@ c['schedulers'].append(schedulers.ForceScheduler(
 
 # ###### BUILDERS
 
-distdir = lambda f: util.Interpolate(f'/workdir/%(prop:name)s/void-packages/{f}')
-bulkdir = lambda f: util.Interpolate(f'/workdir/%(prop:name)s/xbps-bulk/{f}')
+def distdir(f):
+    return util.Interpolate(f'/workdir/%(prop:name)s/void-packages/{f}')
+
+def bulkdir(f):
+    return util.Interpolate(f'/workdir/%(prop:name)s/xbps-bulk/{f}')
+
 hostdir = '/hostdir'
-buildroot = lambda: util.Interpolate(f'/buildroots/%(prop:name)s/buildroot')
-builddir = lambda: util.Interpolate('builddir-%(prop:buildnumber)s')
-do_sync = lambda: util.Interpolate('%(prop:sync)s') == "True"
-hide_skipped = lambda results, _: results == SKIPPED
+
+def buildroot():
+    return util.Interpolate('/buildroots/%(prop:name)s/buildroot')
+
+def builddir():
+    return util.Interpolate('builddir-%(prop:buildnumber)s')
 
 
 factory = util.BuildFactory()
@@ -198,7 +204,7 @@ def make_xbps_bulk_cmd(props):
         '-h', hostdir,
         '-d', distdir(''),
         '-m', buildroot(),
-        '-t',
+        '-t', '-s', '-S',
     ]
     if props.getProperty('cross') == 'True':
         command += ['-a', props.getProperty('target')]
@@ -229,32 +235,21 @@ def build_packages(props):
     return cmds
 
 
-@util.renderer
-def make_prune_cmd(props):
-    return ['bash', '-c',
-            util.Interpolate(f"""
-export XBPS_TARGET_ARCH="%(prop:target)s"
-for repo in / /debug /nonfree /bootstrap; do
-    xbps-rindex -r "{hostdir}/binpkgs/$repo"
-done
-if [ "$XBPS_TARGET_ARCH" = i686 ]; then
-    for repo in /multilib /multilib/nonfree /multilib/bootstrap; do
-        XBPS_TARGET_ARCH=x86_64 xbps-rindex -r "{hostdir}/binpkgs/$repo"
-    done
-fi
-""")]
-
 @util.renderer
 def make_rsync_cmd(props):
-    return ['bash', '-c',
+    return ['bash', '-e', '-c',
             util.Interpolate("""
-rsync -vurk --delete-after --delay-updates \
---filter='+ */' --filter='+ %(prop:target)s-repodata' --filter='+ *.%(prop:target)s.xbps' \
---filter='+ otime' --filter='- .*' --filter='- *' \
+echo "=> Syncing packages to the shadow repository..."
+rsync -vurk --delete-after \
+--filter='+ */' --filter='+ *.%(prop:target)s.xbps' \
+--filter='- .*' --filter='- *' \
 --password-file=/secrets/rsync/password /hostdir/binpkgs/ \
 {{ range nomadService 1 $allocID "build-rsyncd" -}}
-rsync://buildsync-%(prop:worker)s@{{ .Address }}:{{ .Port }}/%(prop:worker)s
-{{ end -}}""")]
+rsync://buildsync@{{ .Address }}:{{ .Port }}/incoming-%(prop:target)s
+{{ end -}}
+echo "=> Cleaning built packages..."
+find /hostdir/binpkgs -name '*.xbps' -o -name '*-repodata' -print -delete
+""")]
 
 
 factory.addStep(GitWithDiff(
@@ -350,18 +345,6 @@ factory.addStep(steps.ShellSequence(
     timeout=14400,
 ))
 
-factory.addStep(steps.ShellCommand(
-    command=make_prune_cmd,
-    name='prune_packages',
-    description='removing obsolete packages',
-    descriptionDone='removed obsolete packages',
-    haltOnFailure=True,
-    logEnviron=False,
-    usePTY=True,
-    workdir='.',
-    timeout=14400,
-))
-
 factory.addStep(steps.ShellCommand(
     command=make_rsync_cmd,
     name='sync_packages',
@@ -371,8 +354,6 @@ factory.addStep(steps.ShellCommand(
     logEnviron=False,
     usePTY=True,
     workdir='.',
-    doStepIf=do_sync(),
-    hideStepIf=hide_skipped,
     timeout=14400,
     decodeRC={
         0: SUCCESS,
@@ -393,8 +374,7 @@ for b in builders:
         'target': targetarch,
         'cross': str(hostarch != targetarch),
         'worker': b['worker'],
-        'sync': str(b['sync']),
-        'bootstrap_args': b.get('bootstrap_args', '-N'),
+        'bootstrap_args': b.get('bootstrap_args', ''),
     }
 
     c['builders'].append(util.BuilderConfig(
diff --git a/services/nomad/build/buildbot.nomad b/services/nomad/build/buildbot.nomad
index 3b7e5d25..85524a72 100644
--- a/services/nomad/build/buildbot.nomad
+++ b/services/nomad/build/buildbot.nomad
@@ -107,15 +107,15 @@ EOF
             { name = "aarch64", max-builds = 2 },
           ],
           builders = [
-            { name = "x86_64",       host = "x86_64",                               worker = "glibc",   sync = false                     },
-            { name = "i686",         host = "i686",                                 worker = "glibc",   sync = false                     },
-            { name = "armv7l",       host = "x86_64",      target = "armv7l",       worker = "glibc",   sync = false                     },
-            { name = "armv6l",       host = "x86_64",      target = "armv6l",       worker = "glibc",   sync = false                     },
-            { name = "x86_64-musl",  host = "x86_64-musl",                          worker = "musl",    sync = true                      },
-            { name = "armv7l-musl",  host = "x86_64-musl", target = "armv7l-musl",  worker = "musl",    sync = true                      },
-            { name = "armv6l-musl",  host = "x86_64-musl", target = "armv6l-musl",  worker = "musl",    sync = true                      },
-            { name = "aarch64",      host = "x86_64",      target = "aarch64",      worker = "aarch64", sync = true, bootstrap_args = "" },
-            { name = "aarch64-musl", host = "x86_64-musl", target = "aarch64-musl", worker = "aarch64", sync = true, bootstrap_args = "" },
+            { name = "x86_64",       host = "x86_64",                               worker = "glibc",  },
+            { name = "i686",         host = "i686",                                 worker = "glibc",  },
+            { name = "armv7l",       host = "x86_64",      target = "armv7l",       worker = "glibc",  },
+            { name = "armv6l",       host = "x86_64",      target = "armv6l",       worker = "glibc",  },
+            { name = "x86_64-musl",  host = "x86_64-musl",                          worker = "musl",   },
+            { name = "armv7l-musl",  host = "x86_64-musl", target = "armv7l-musl",  worker = "musl",   },
+            { name = "armv6l-musl",  host = "x86_64-musl", target = "armv6l-musl",  worker = "musl",   },
+            { name = "aarch64",      host = "aarch64",                              worker = "aarch64" },
+            { name = "aarch64-musl", host = "aarch64-musl",                         worker = "aarch64" },
           ],
         })
         destination = "local/workers.json"

From db49f01e3b7f7678c3e6dee36c4fa1dd8c725b3c Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Fri, 25 Jul 2025 21:27:46 -0400
Subject: [PATCH 06/16] services/nomad/build/buildbot-worker: native aarch64
 worker, use remote repo (shadow) only

---
 services/nomad/build/buildbot-worker.nomad | 29 +++++++++++-----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/services/nomad/build/buildbot-worker.nomad b/services/nomad/build/buildbot-worker.nomad
index 1f866cb1..01c39bd4 100644
--- a/services/nomad/build/buildbot-worker.nomad
+++ b/services/nomad/build/buildbot-worker.nomad
@@ -9,8 +9,8 @@ job "buildbot-worker" {
       // memory is ~90% of capacity
       // memory_max is ~95% of capacity
       { name = "glibc",   jobs = 10, cpu = 38100, mem = 115840, mem_max = 122270 },
-      { name = "musl",    jobs = 6,  cpu = 21700, mem = 57690,  mem_max = 60890  },
-      { name = "aarch64", jobs = 6,  cpu = 12000, mem = 28500,  mem_max = 30500  },
+      { name = "musl",    jobs = 6,  cpu = 12000, mem = 28500,  mem_max = 30500  },
+      { name = "aarch64", jobs = 12, cpu = 16000, mem = 27500,  mem_max = 29500  },
     ]
     labels = [ "buildbot-worker-${group.value.name}" ]
 
@@ -160,22 +160,21 @@ EOF
           destination = "local/info/host"
         }
 
-        // the builders should use local repos
-        // except for aarch64, which must be able to get hostmakedepends from repo-default
+        // the builders should use the internal mirror
         template {
           data = <<EOF
-repository=/hostdir/binpkgs/bootstrap
-repository=/hostdir/binpkgs
-repository=/hostdir/binpkgs/nonfree
-{{ if eq "${group.value.name}" "glibc" }}
-repository=/hostdir/binpkgs/multilib/bootstrap
-repository=/hostdir/binpkgs/multilib
-repository=/hostdir/binpkgs/multilib/nonfree
-{{ end }}
-{{ if eq "${group.value.name}" "aarch64" }}
 {{ range service "root-pkgs-internal" }}
+{{ if eq "${group.value.name}" "glibc" }}
+repository=http://{{ .Address }}:{{ .Port }}/bootstrap
 repository=http://{{ .Address }}:{{ .Port }}
-repository=http://{{ .Address }}:{{ .Port }}/musl
+repository=http://{{ .Address }}:{{ .Port }}/nonfree
+repository=http://{{ .Address }}:{{ .Port }}/multilib/bootstrap
+repository=http://{{ .Address }}:{{ .Port }}/multilib
+repository=http://{{ .Address }}:{{ .Port }}/multilib/nonfree
+{{ else }}
+repository=http://{{ .Address }}:{{ .Port }}/${group.value.name}/bootstrap
+repository=http://{{ .Address }}:{{ .Port }}/${group.value.name}
+repository=http://{{ .Address }}:{{ .Port }}/${group.value.name}/nonfree
 {{ end }}
 {{ end }}
 EOF
@@ -205,7 +204,7 @@ EOF
         template {
           data = <<EOF
 {{- with nomadVar "nomad/jobs/buildsync" -}}
-{{ .${group.value.name}_password }}
+{{ .password }}
 {{- end -}}
 EOF
           destination = "secrets/rsync/password"

From 7956fcf682b335a119d1594aa0bda86df247e4da Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Tue, 25 Nov 2025 01:42:19 -0500
Subject: [PATCH 07/16] services/nomad/build/timefiles: only run on shadow

now that shadow is the first place a repository is assembled, this
shouldn't run on builders
---
 services/nomad/build/timefiles.nomad | 63 ++++++++++++----------------
 1 file changed, 27 insertions(+), 36 deletions(-)

diff --git a/services/nomad/build/timefiles.nomad b/services/nomad/build/timefiles.nomad
index c31c4258..af3a9d23 100644
--- a/services/nomad/build/timefiles.nomad
+++ b/services/nomad/build/timefiles.nomad
@@ -3,53 +3,44 @@ job "timefiles" {
   datacenters = ["VOID"]
   namespace = "build"
 
-  dynamic "group" {
-    for_each = [ "glibc", "aarch64", "musl", ]
-    labels = [ "timefiles-${group.value}" ]
+  group "timefiles" {
+    count = 1
 
-    content {
-      count = 1
-      network { mode = "bridge" }
+    volume "root_mirror" {
+      type = "host"
+      source = "root_mirror"
+      read_only = false
+    }
 
-      dynamic "volume" {
-        for_each = [ "${group.value}" ]
-        labels = [ "${volume.value}_hostdir" ]
+    task "timefiles" {
+      driver = "docker"
 
-        content {
-          type = "host"
-          source = "${volume.value}_hostdir"
-          read_only = false
-        }
+      config {
+        image = "ghcr.io/void-linux/void-glibc:20240526R1"
+        command = "/local/run.sh"
       }
 
-      task "timefiles" {
-        driver = "docker"
-
-        config {
-          image = "ghcr.io/void-linux/void-glibc:20240526R1"
-          command = "/local/run.sh"
-        }
-
-        volume_mount {
-          volume = "${group.value}_hostdir"
-          destination = "/hostdir"
-        }
+      volume_mount {
+        volume = "root_mirror"
+        destination = "/mirror"
+      }
 
-        template {
-          data = <<EOF
+      template {
+        data = <<EOF
 #!/bin/sh
 
 while true ; do
-    t="$(date +%s)"
-    for dir in / /nonfree /debug /multilib /multilib/nonfree /nonfree ; do
-        echo "$t">"/hostdir/binpkgs/$dir/otime"
-    done
-    sleep 60
+  t="$(date +%s)"
+  for dir in / /nonfree /debug /multilib /multilib/nonfree /nonfree; do
+    [ -e "/mirror/current/$dir" ] && echo "$t">"/mirror/current/$dir/otime"
+    [ -e "/mirror/current/musl/$dir" ] && echo "$t">"/mirror/current/musl/$dir/otime"
+    [ -e "/mirror/current/aarch64/$dir" ] && echo "$t">"/mirror/current/aarch64/$dir/otime"
+  done
+  sleep 60
 done
 EOF
-          destination = "local/run.sh"
-          perms = "0755"
-        }
+        destination = "local/run.sh"
+        perms = "0755"
       }
     }
   }

From 3125d21b19077fa7a1f1a85b9e00b20262ab0005 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Tue, 25 Nov 2025 01:43:44 -0500
Subject: [PATCH 08/16] services/nomad/build/root-pkgs-httpd: update to 1.37

---
 services/nomad/build/root-pkgs-httpd.nomad | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/nomad/build/root-pkgs-httpd.nomad b/services/nomad/build/root-pkgs-httpd.nomad
index 87766f69..fd1aa1b4 100644
--- a/services/nomad/build/root-pkgs-httpd.nomad
+++ b/services/nomad/build/root-pkgs-httpd.nomad
@@ -27,7 +27,7 @@ job "build-mirror" {
       driver = "docker"
 
       config {
-        image = "busybox:1.32-musl"
+        image = "busybox:1.37-musl"
         args = ["httpd", "-f", "-p", "80", "-h", "/pkgs"]
         network_mode = "host"
       }

From ad11db9f5a8d79022f09fff3d613a68b8834dba6 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Tue, 25 Nov 2025 01:50:51 -0500
Subject: [PATCH 09/16] services/nomad/build/build-rsyncd: reorganise sync
 architecture

now packages get synced to an incoming directory. a script runs after
each rsync to move and register the packages into the repo
---
 services/nomad/build/build-rsyncd.nomad | 69 ++++++++++++++++++-------
 services/nomad/build/rsync-post-xfer    | 48 +++++++++++++++++
 services/nomad/build/xbps-clean-sigs    |  6 ---
 3 files changed, 97 insertions(+), 26 deletions(-)
 create mode 100644 services/nomad/build/rsync-post-xfer
 delete mode 100644 services/nomad/build/xbps-clean-sigs

diff --git a/services/nomad/build/build-rsyncd.nomad b/services/nomad/build/build-rsyncd.nomad
index f9c3e300..58cb1c5f 100644
--- a/services/nomad/build/build-rsyncd.nomad
+++ b/services/nomad/build/build-rsyncd.nomad
@@ -19,6 +19,18 @@ job "build-rsyncd" {
       read_only = false
     }
 
+    volume "root_mirror" {
+      type = "host"
+      source = "root_mirror"
+      read_only = false
+    }
+
+    volume "incoming_pkgs" {
+      type = "host"
+      source = "incoming_pkgs"
+      read_only = false
+    }
+
     service {
       provider = "nomad"
       name = "build-rsyncd"
@@ -29,8 +41,7 @@ job "build-rsyncd" {
       driver = "docker"
 
       config {
-        image = "ghcr.io/void-linux/infra-rsync:20240709R1"
-        volumes = [ "local/buildsync.conf:/etc/rsyncd.conf.d/buildsync.conf" ]
+        image = "ghcr.io/void-linux/infra-rsync:20251102R1"
       }
 
       resources {
@@ -43,17 +54,26 @@ job "build-rsyncd" {
         destination = "/hostdir"
       }
 
+      volume_mount {
+        volume = "root_mirror"
+        destination = "/mirror"
+      }
+
+      volume_mount {
+        volume = "incoming_pkgs"
+        destination = "/incoming"
+      }
+
       template {
-        data = file("xbps-clean-sigs")
-        destination = "local/xbps-clean-sigs"
+        data = file("rsync-post-xfer")
+        destination = "local/rsync-post-xfer"
         perms = "0755"
       }
 
       template {
         data = <<EOF
 {{- with nomadVar "nomad/jobs/buildsync" }}
-buildsync-aarch64:{{ .aarch64_password }}
-buildsync-musl:{{ .musl_password }}
+buildsync:{{ .password }}
 {{- end }}
 EOF
         destination = "secrets/buildsync.secrets"
@@ -75,21 +95,30 @@ incoming chmod = D0755,F0644
 [sources]
 path = /hostdir/sources
 filter = - by_sha256/ - .* - *.part
-auth users = buildsync-*:rw
-
-[aarch64]
-path = /hostdir/binpkgs/aarch64
-auth users = buildsync-aarch64:rw
-filter = + */ + *-repodata + otime + *.xbps - *.sig - *.sig2 - *-repodata.* - *-stagedata.* - *.x86_64* - x86_64*-repodata - .*
-post-xfer exec = /local/xbps-clean-sigs
-
-[musl]
-path = /hostdir/binpkgs/musl
-auth users = buildsync-musl:rw
-filter = + */ + *-repodata + otime + *.xbps - *.sig - *.sig2 - *-repodata.* - *-stagedata.* - .*
-post-xfer exec = /local/xbps-clean-sigs
+auth users = buildsync:rw
+
+&merge /local/rsyncd.conf.d
+EOF
+        destination = "local/rsyncd.conf.d/buildsync.conf"
+      }
+
+      dynamic "template" {
+        for_each = [
+          "x86_64", "i686", "armv7l", "armv6l",
+          "x86_64-musl", "armv7l-musl", "armv6l-musl",
+          "aarch64", "aarch64-musl",
+        ]
+
+        content {
+          data = <<EOF
+[incoming-${template.value}]
+path = /incoming/${template.value}
+auth users = buildsync:rw
+filter = + */ + *.${template.value}.xbps - *.sig - *.sig2 - *-repodata* - .*
+post-xfer exec = /local/rsync-post-xfer
 EOF
-        destination = "local/buildsync.conf"
+          destination = "local/rsyncd.conf.d/${template.value}.conf.inc"
+        }
       }
     }
   }
diff --git a/services/nomad/build/rsync-post-xfer b/services/nomad/build/rsync-post-xfer
new file mode 100644
index 00000000..7d70ceef
--- /dev/null
+++ b/services/nomad/build/rsync-post-xfer
@@ -0,0 +1,48 @@
+#!/bin/sh
+
+set -e
+
+TGT_BASE="/mirror/current"
+
+process_repo() {
+    repo="$1"
+    if [ ! -d "$RSYNC_MODULE_PATH/$repo" ] || [ ! -d "$TGT_BASE/$TGT/$repo" ]; then
+        return
+    fi
+    # add to repodata
+    find "$RSYNC_MODULE_PATH"/"$repo" -maxdepth 1 -type f -printf "$TGT_BASE/$TGT/$repo/%f\0" | \
+        xargs -r0 xbps-rindex -a
+    # clean old packages from repodata
+    xbps-rindex -c "$TGT_BASE/$TGT/$repo"
+    # remove old packages
+    xbps-rindex -r "$TGT_BASE/$TGT/$repo"
+    # Remove signatures that don't have a corresponding package
+    find "$TGT_BASE/$TGT/$repo" -maxdepth 1 \( -name '*.xbps.sig' -o -name '*.xbps.sig2' \) \
+        -exec sh -c 'for x in "$@"; do [ -e "${x%.sig*}" ] || rm -- $x; done' _ {} +
+}
+
+export XBPS_TARGET_ARCH="${RSYNC_MODULE_NAME#*-}"
+
+case "$XBPS_TARGET_ARCH" in
+    aarch64*) TGT="aarch64" ;;
+    *-musl) TGT="musl" ;;
+    *) TGT="" ;;
+esac
+
+# copy files to repo
+rsync -va "${RSYNC_MODULE_PATH:?}"/ "$TGT_BASE/$TGT/"
+
+for repo in / /bootstrap /debug /nonfree; do
+    process_repo "$repo"
+done
+
+if [ "$XBPS_TARGET_ARCH" = 'i686' ]; then
+    for repo in /multilib /multilib/bootstrap /multilib/nonfree; do
+        process_repo "$repo"
+    done
+fi
+
+# clean up incoming
+rm -r "${RSYNC_MODULE_PATH:?}"/*
+
+exit 0
diff --git a/services/nomad/build/xbps-clean-sigs b/services/nomad/build/xbps-clean-sigs
deleted file mode 100644
index 85c8f3b0..00000000
--- a/services/nomad/build/xbps-clean-sigs
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh
-
-# Remove signatures that don't have a corresponding package.
-find /hostdir/binpkgs \( -name '*.xbps.sig' -o -name '*.xbps.sig2' \) -exec sh -c 'for x in "$@"; do [ -e "${x%.sig*}" ] || rm -- $x; done' _ {} +
-
-exit 0

From aded2a8de6888e4c617ead6bc2e63ff5f662b5eb Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 15:43:00 -0500
Subject: [PATCH 10/16] services/nomad/build/buildbot: sync after every package
 build

this should help make hostmakedepends build races less common
---
 services/nomad/build/buildbot.cfg | 63 ++++++++++++++++++-------------
 1 file changed, 37 insertions(+), 26 deletions(-)

diff --git a/services/nomad/build/buildbot.cfg b/services/nomad/build/buildbot.cfg
index e996c764..cc3391fe 100644
--- a/services/nomad/build/buildbot.cfg
+++ b/services/nomad/build/buildbot.cfg
@@ -217,6 +217,34 @@ def make_xbps_bulk_cmd(props):
     return command
 
 
+@util.renderer
+def make_rsync_cmd(props):
+    return ['bash', '-e', '-c',
+            util.Interpolate("""
+echo "=> Syncing packages to the shadow repository..."
+rsync -vurk --delete-after \
+--filter='+ */' --filter='+ *.%(prop:target)s.xbps' \
+--filter='- .*' --filter='- *' \
+--password-file=/secrets/rsync/password /hostdir/binpkgs/ \
+{{ range nomadService 1 $allocID "build-rsyncd" -}}
+rsync://buildsync@{{ .Address }}:{{ .Port }}/incoming-%(prop:target)s
+{{ end -}}
+case "$?" in
+    0|23|24) exit 0 ;;
+    *) exit 1 ;;
+esac
+""")]
+
+
+@util.renderer
+def make_clean_cmd(props):
+    return [
+        'find', '/hostdir/binpkgs', '(',
+            '-name', util.Interpolate('*.%(prop:target)s.xbps'), '-o', '-name', util.Interpolate('%(prop:target)s-repodata'),
+        ')', '-print', '-delete',
+    ],
+
+
 @util.renderer
 def build_packages(props):
     cmds = []
@@ -226,6 +254,11 @@ def build_packages(props):
             logname=f'pkg:{p}',
             haltOnFailure=True,
         ))
+        cmds.append(util.ShellArg(
+            command=make_rsync_cmd,
+            logname=f'sync:{p}',
+            haltOnFailure=True,
+        ))
     if cmds:
         cmds.append(util.ShellArg(
             command=['make', 'clean'],
@@ -235,23 +268,6 @@ def build_packages(props):
     return cmds
 
 
-@util.renderer
-def make_rsync_cmd(props):
-    return ['bash', '-e', '-c',
-            util.Interpolate("""
-echo "=> Syncing packages to the shadow repository..."
-rsync -vurk --delete-after \
---filter='+ */' --filter='+ *.%(prop:target)s.xbps' \
---filter='- .*' --filter='- *' \
---password-file=/secrets/rsync/password /hostdir/binpkgs/ \
-{{ range nomadService 1 $allocID "build-rsyncd" -}}
-rsync://buildsync@{{ .Address }}:{{ .Port }}/incoming-%(prop:target)s
-{{ end -}}
-echo "=> Cleaning built packages..."
-find /hostdir/binpkgs -name '*.xbps' -o -name '*-repodata' -print -delete
-""")]
-
-
 factory.addStep(GitWithDiff(
     repourl='https://github.com/void-linux/void-packages.git',
     mode='incremental',
@@ -346,20 +362,15 @@ factory.addStep(steps.ShellSequence(
 ))
 
 factory.addStep(steps.ShellCommand(
-    command=make_rsync_cmd,
-    name='sync_packages',
-    description='syncing packages to the shadow repository',
-    descriptionDone='synced packages to the shadow repository',
+    command=make_clean_cmd,
+    name='clean_packages',
+    description='cleaning packages from hostdir',
+    descriptionDone='cleaned packages from hostdir',
     alwaysRun=True,
     logEnviron=False,
     usePTY=True,
     workdir='.',
     timeout=14400,
-    decodeRC={
-        0: SUCCESS,
-        23: SUCCESS,
-        24: SUCCESS,
-    },
 ))
 
 for b in builders:

From 0c1a0f8976e72517bcf6f9627dc13a02df945952 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 22:57:27 -0500
Subject: [PATCH 11/16] Revert "ansible: add a-sea-us to buildworkers, add host
 vars/volumes for building"

This reverts commit 7994b362507b1455ce98376ce4a1f8145da9339d.
---
 .../host_vars/a-sea-us.m.voidlinux.org.yml    | 21 -------------------
 ansible/inventory                             |  1 -
 2 files changed, 22 deletions(-)

diff --git a/ansible/host_vars/a-sea-us.m.voidlinux.org.yml b/ansible/host_vars/a-sea-us.m.voidlinux.org.yml
index 477757b0..fdbb5580 100644
--- a/ansible/host_vars/a-sea-us.m.voidlinux.org.yml
+++ b/ansible/host_vars/a-sea-us.m.voidlinux.org.yml
@@ -8,24 +8,3 @@ xbps_repository_nonfree: https://{{ xbps_repository_address }}/current/aarch64/n
 xbps_repoconf_repos_enabled:
   - 00-repository-main
   - 10-repository-nonfree
-
-sshd_AllowGroups:
-  - build-ops
-
-buildworker_archs:
-  - aarch64
-  - aarch64-musl
-
-nomad_host_volumes:
-  - name: ccache
-    path: /hostdir/ccache
-    read_only: true
-  - name: aarch64_hostdir
-    path: /hostdir
-    read_only: false
-  - name: aarch64_workdir
-    path: /builder/workdir
-    read_only: false
-  - name: aarch64_buildrootdir
-    path: /builder/buildroot
-    read_only: false
diff --git a/ansible/inventory b/ansible/inventory
index 27e9a497..14d7796c 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -1,7 +1,6 @@
 [buildworker]
 a-fsn-de.m.voidlinux.org
 b-fsn-de.m.voidlinux.org
-a-sea-us.m.voidlinux.org
 
 [root_mirror]
 a-fsn-de.m.voidlinux.org

From 66ebc6ca67a60bf98692e5cea22ec79c7ad55728 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 22:57:57 -0500
Subject: [PATCH 12/16] Revert "ansible/host_vars/a-hel-fi: decommission as a
 builder"

This reverts commit 1b74ac0d348ca1a1c7eceb659b424d2a8bfca0fe.
---
 ansible/host_vars/a-hel-fi.m.voidlinux.org.yml | 15 +++++++++++++++
 ansible/inventory                              |  1 +
 2 files changed, 16 insertions(+)

diff --git a/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml b/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml
index eaf8494d..315a44f5 100644
--- a/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml
+++ b/ansible/host_vars/a-hel-fi.m.voidlinux.org.yml
@@ -12,7 +12,22 @@ network_static_interfaces:
       - 95.216.76.97/26
       - 2a01:4f9:2b:c9e::2/64
 
+sshd_AllowGroups:
+  - build-ops
+
 nomad_host_volumes:
   - name: terrastate
     path: /nomad/terrastate
     read_only: false
+  - name: musl_hostdir
+    path: /hostdir
+    read_only: false
+  - name: musl_workdir
+    path: /workdir
+    read_only: false
+  - name: musl_buildrootdir
+    path: /buildroot
+    read_only: false
+  - name: ccache
+    path: /hostdir/ccache
+    read_only: true
diff --git a/ansible/inventory b/ansible/inventory
index 14d7796c..d661ecf6 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -1,4 +1,5 @@
 [buildworker]
+a-hel-fi.m.voidlinux.org
 a-fsn-de.m.voidlinux.org
 b-fsn-de.m.voidlinux.org
 

From 74c9ca63874e6e710392dfadaa90a48f34c808d1 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 22:58:11 -0500
Subject: [PATCH 13/16] Revert "ansible/host_vars/b-fsn-de: rename builder
 volumes"

This reverts commit 196700dd307610e9062d655f9c4f0a63e33da7b7.
---
 ansible/host_vars/b-fsn-de.m.voidlinux.org.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml b/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml
index 3d94e6d0..7f0247cb 100644
--- a/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml
+++ b/ansible/host_vars/b-fsn-de.m.voidlinux.org.yml
@@ -10,12 +10,12 @@ nomad_host_volumes:
   - name: ccache
     path: /hostdir/ccache
     read_only: true
-  - name: musl_hostdir
+  - name: aarch64_hostdir
     path: /hostdir
     read_only: false
-  - name: musl_workdir
+  - name: aarch64_workdir
     path: /workdir
     read_only: false
-  - name: musl_buildrootdir
+  - name: aarch64_buildrootdir
     path: /buildroot
     read_only: false

From d3f70a3fbc0f253e3bcc2f5dc4b2076d8683b1ab Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sun, 15 Feb 2026 23:04:42 -0500
Subject: [PATCH 14/16] services/nomad/build/buildbot{,-worker}: partially
 revert changes for a-sea-us

keep builders where they are for now while we solve a-sea-us instability
---
 services/nomad/build/buildbot-worker.nomad | 14 ++++++++++++--
 services/nomad/build/buildbot.nomad        |  4 ++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/services/nomad/build/buildbot-worker.nomad b/services/nomad/build/buildbot-worker.nomad
index 01c39bd4..ecab439f 100644
--- a/services/nomad/build/buildbot-worker.nomad
+++ b/services/nomad/build/buildbot-worker.nomad
@@ -9,8 +9,8 @@ job "buildbot-worker" {
       // memory is ~90% of capacity
       // memory_max is ~95% of capacity
       { name = "glibc",   jobs = 10, cpu = 38100, mem = 115840, mem_max = 122270 },
-      { name = "musl",    jobs = 6,  cpu = 12000, mem = 28500,  mem_max = 30500  },
-      { name = "aarch64", jobs = 12, cpu = 16000, mem = 27500,  mem_max = 29500  },
+      { name = "musl",    jobs = 6,  cpu = 21700, mem = 57690,  mem_max = 60890  },
+      { name = "aarch64", jobs = 6,  cpu = 12000, mem = 28500,  mem_max = 30500  },
     ]
     labels = [ "buildbot-worker-${group.value.name}" ]
 
@@ -171,6 +171,16 @@ repository=http://{{ .Address }}:{{ .Port }}/nonfree
 repository=http://{{ .Address }}:{{ .Port }}/multilib/bootstrap
 repository=http://{{ .Address }}:{{ .Port }}/multilib
 repository=http://{{ .Address }}:{{ .Port }}/multilib/nonfree
+{{ else if eq "${group.value.name}" "aarch64" }}
+repository=http://{{ .Address }}:{{ .Port }}/bootstrap
+repository=http://{{ .Address }}:{{ .Port }}
+repository=http://{{ .Address }}:{{ .Port }}/nonfree
+repository=http://{{ .Address }}:{{ .Port }}/musl/bootstrap
+repository=http://{{ .Address }}:{{ .Port }}/musl
+repository=http://{{ .Address }}:{{ .Port }}/musl/nonfree
+repository=http://{{ .Address }}:{{ .Port }}/aarch64/bootstrap
+repository=http://{{ .Address }}:{{ .Port }}/aarch64
+repository=http://{{ .Address }}:{{ .Port }}/aarch64/nonfree
 {{ else }}
 repository=http://{{ .Address }}:{{ .Port }}/${group.value.name}/bootstrap
 repository=http://{{ .Address }}:{{ .Port }}/${group.value.name}
diff --git a/services/nomad/build/buildbot.nomad b/services/nomad/build/buildbot.nomad
index 85524a72..7ee1b02e 100644
--- a/services/nomad/build/buildbot.nomad
+++ b/services/nomad/build/buildbot.nomad
@@ -114,8 +114,8 @@ EOF
             { name = "x86_64-musl",  host = "x86_64-musl",                          worker = "musl",   },
             { name = "armv7l-musl",  host = "x86_64-musl", target = "armv7l-musl",  worker = "musl",   },
             { name = "armv6l-musl",  host = "x86_64-musl", target = "armv6l-musl",  worker = "musl",   },
-            { name = "aarch64",      host = "aarch64",                              worker = "aarch64" },
-            { name = "aarch64-musl", host = "aarch64-musl",                         worker = "aarch64" },
+            { name = "aarch64",      host = "x86_64",      target = "aarch64",      worker = "aarch64" },
+            { name = "aarch64-musl", host = "x86_64-musl", target = "aarch64-musl", worker = "aarch64" },
           ],
         })
         destination = "local/workers.json"

From a1decba3bce0dfc3f323b82453381ffae758ba36 Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Mon, 16 Feb 2026 00:17:08 -0500
Subject: [PATCH 15/16] services/nomad/build/buildsync: fix rsync
 username/password

---
 services/nomad/build/buildsync.nomad | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/nomad/build/buildsync.nomad b/services/nomad/build/buildsync.nomad
index 86a1fef1..4a8db1c2 100644
--- a/services/nomad/build/buildsync.nomad
+++ b/services/nomad/build/buildsync.nomad
@@ -37,7 +37,7 @@ job "buildsync" {
         template {
           data = <<EOF
 {{- with nomadVar "nomad/jobs/buildsync" -}}
-{{.${group.value}_password}}
+{{.password}}
 {{- end -}}
 EOF
           destination = "secrets/rsync_passwd"
@@ -56,7 +56,7 @@ sync {
     default.rsync,
     source = "/hostdir/sources",
     {{- range nomadService 1 $allocID "build-rsyncd" -}}
-    target = "rsync://buildsync-${group.value}@{{ .Address }}:{{ .Port }}/sources",
+    target = "rsync://buildsync@{{ .Address }}:{{ .Port }}/sources",
     {{- end -}}
     delay = 15,
     filter = {

From 4a38755cac7d4b25a28d8456d3ce2a60c7db4195 Mon Sep 17 00:00:00 2001
From: Michael Aldridge <aldridge.mac@gmail.com>
Date: Sun, 15 Feb 2026 22:22:56 -0600
Subject: [PATCH 16/16] ansible/roles: Add tags around tasks that use xbps

---
 ansible/roles/consul/tasks/main.yml | 1 +
 ansible/roles/docker/tasks/main.yml | 5 +++++
 ansible/roles/nomad/tasks/main.yml  | 1 +
 3 files changed, 7 insertions(+)

diff --git a/ansible/roles/consul/tasks/main.yml b/ansible/roles/consul/tasks/main.yml
index 51fb749f..4c96865d 100644
--- a/ansible/roles/consul/tasks/main.yml
+++ b/ansible/roles/consul/tasks/main.yml
@@ -3,6 +3,7 @@
   xbps:
     pkg: consul
     state: present
+  tags: [install_consul]
 
 - name: Install Core Configuration
   template:
diff --git a/ansible/roles/docker/tasks/main.yml b/ansible/roles/docker/tasks/main.yml
index 00764189..206e973e 100644
--- a/ansible/roles/docker/tasks/main.yml
+++ b/ansible/roles/docker/tasks/main.yml
@@ -3,6 +3,7 @@
   xbps:
     pkg: docker
     state: present
+  tags: [install_docker]
 
 - name: Create config directory
   file:
@@ -11,6 +12,7 @@
     owner: root
     group: root
     mode: 0755
+  tags: [install_docker]
 
 - name: Install daemon.json
   template:
@@ -21,6 +23,7 @@
     mode: 0644
   notify:
     - docker
+  tags: [install_docker, configure_docker]
 
 - name: Install Firewall Rules
   copy:
@@ -31,9 +34,11 @@
     mode: 0640
   notify:
     - iptables
+  tags: [install_docker, configure_docker]
 
 - name: Enable Service
   service:
     name: docker
     state: started
     enabled: true
+  tags: [install_docker, enable_docker]
diff --git a/ansible/roles/nomad/tasks/main.yml b/ansible/roles/nomad/tasks/main.yml
index 0d7917ee..ff51b5da 100644
--- a/ansible/roles/nomad/tasks/main.yml
+++ b/ansible/roles/nomad/tasks/main.yml
@@ -3,6 +3,7 @@
   xbps:
     pkg: nomad
     state: present
+  tags: [install_nomad]
 
 - name: Install base configuration
   template: