modules/private/buildbot/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   varDir = "/var/lib/buildbot";
   4   bb-python = buildbot.pythonModule;
   5   buildbot = pkgs.immae-buildbot;
   6 in
   7 {
   8   options = {
   9     myServices.buildbot.enable = lib.mkOption {
  10       type = lib.types.bool;
  11       default = false;
  12       description = ''
  13         Whether to enable buildbot.
  14       '';
  15     };
  16   };
  17
  18   config = lib.mkIf config.myServices.buildbot.enable {
  19     nixpkgs.overlays = [
  20       (self: super: {
  21         follow-systemd-unit = self.writeScriptBin "follow-systemd-unit" ''
  22           #!${self.stdenv.shell}
  23
  24           set -euo pipefail
  25
  26           service=$1
  27           before_invocation_id=$2
  28
  29           get_id() {
  30             systemctl show -p InvocationID --value "$service"
  31           }
  32
  33           while [ "$(get_id)" = "$before_invocation_id" ]; do sleep 1; done
  34
  35           invocation_id="$(get_id)"
  36           cursor="$(mktemp)"
  37           trap "rm -f $cursor" EXIT
  38
  39           get_logs() {
  40             journalctl --quiet --cursor-file=$cursor INVOCATION_ID=$invocation_id + _SYSTEMD_INVOCATION_ID=$invocation_id
  41           }
  42
  43           while [ -n "$(systemctl show -p Job --value "$service")" ]; do
  44             get_logs
  45           done
  46           get_logs
  47         '';
  48       })
  49     ];
  50     ids.uids.buildbot = config.myEnv.buildbot.user.uid;
  51     ids.gids.buildbot = config.myEnv.buildbot.user.gid;
  52
  53     users.groups.buildbot.gid = config.ids.gids.buildbot;
  54     users.users.buildbot = {
  55       name = "buildbot";
  56       uid = config.ids.uids.buildbot;
  57       group = "buildbot";
  58       description = "Buildbot user";
  59       home = varDir;
  60       extraGroups = [ "keys" "systemd-journal" ];
  61       useDefaultShell = true;
  62       openssh.authorizedKeys.keys = [ config.myEnv.buildbot.ssh_key.public ];
  63     };
  64
  65     services.websites.env.tools.watchPaths = lib.attrsets.mapAttrsToList
  66       (k: project: config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include")
  67       config.myEnv.buildbot.projects;
  68
  69     services.websites.env.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: ''
  70         RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/"
  71         RewriteEngine On
  72         RewriteRule ^/buildbot/${project.name}/ws(.*)$   unix:///run/buildbot/${project.name}.sock|ws://git.immae.eu/ws$1 [P,NE,QSA,L]
  73         ProxyPass /buildbot/${project.name}/             unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
  74         ProxyPassReverse /buildbot/${project.name}/      unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
  75         <Location /buildbot/${project.name}/>
  76           Use LDAPConnect
  77           Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
  78
  79           SetEnvIf X-Url-Scheme https HTTPS=1
  80           ProxyPreserveHost On
  81         </Location>
  82         <Location /buildbot/${project.name}/change_hook/base>
  83           <RequireAny>
  84             Require local
  85             Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
  86             Include ${config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include"}
  87           </RequireAny>
  88         </Location>
  89         '') config.myEnv.buildbot.projects;
  90
  91     system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
  92       deps = [ "users" "wrappers" ];
  93       text = ''
  94         install -m 755 -o buildbot -g buildbot -d ${varDir}/${project.name}
  95
  96         ${project.activationScript}
  97         '';
  98     }) config.myEnv.buildbot.projects;
  99
 100     secrets.keys = lib.listToAttrs (
 101       lib.lists.flatten (
 102         lib.attrsets.mapAttrsToList (k: project:
 103           lib.attrsets.mapAttrsToList (k: v:
 104             (lib.nameValuePair "buildbot/${project.name}/${k}" {
 105               permissions = "0600";
 106               user = "buildbot";
 107               group = "buildbot";
 108               text = if builtins.isFunction v then v pkgs config else v;
 109             })
 110           ) project.secrets
 111           ++ [
 112             (lib.nameValuePair "buildbot/${project.name}/webhook-httpd-include" {
 113               permissions = "0600";
 114               user = "wwwrun";
 115               group = "wwwrun";
 116               text = lib.optionalString (project.webhookTokens != null) ''
 117                 Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
 118                 '';
 119             })
 120             (lib.nameValuePair "buildbot/${project.name}/environment_file" {
 121               permissions = "0600";
 122               user = "buildbot";
 123               group = "buildbot";
 124               text = let
 125                 project_env = with lib.attrsets;
 126                   mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" (if builtins.isFunction v then v pkgs else v)) project.environment //
 127                   {
 128                     BUILDBOT_PROJECT_DIR = ./projects + "/${project.name}";
 129                     BUILDBOT_WORKER_PORT = builtins.toString project.workerPort;
 130                     BUILDBOT_HOST = config.hostEnv.fqdn;
 131                     BUILDBOT_VIRT_URL = "qemu+ssh://libvirt@dilion.immae.eu/system";
 132                   };
 133                 in builtins.concatStringsSep "\n"
 134                   (lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
 135             })
 136           ]
 137         ) config.myEnv.buildbot.projects
 138       )
 139     ) // {
 140       "buildbot/ldap" = {
 141         permissions = "0600";
 142         user = "buildbot";
 143         group = "buildbot";
 144         text = config.myEnv.buildbot.ldap.password;
 145       };
 146       "buildbot/worker_password" = {
 147         permissions = "0600";
 148         user = "buildbot";
 149         group = "buildbot";
 150         text = config.myEnv.buildbot.workerPassword;
 151       };
 152       "buildbot/ssh_key" = {
 153         permissions = "0600";
 154         user = "buildbot";
 155         group = "buildbot";
 156         text = config.myEnv.buildbot.ssh_key.private;
 157       };
 158       "buildbot/ssh_known_hosts" = {
 159         permissions = "0644";
 160         user = "buildbot";
 161         group = "buildbot";
 162         text = ''
 163           git.immae.eu          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbhFTl2A2RJn5L51yxJM4XfCS2ZaiSX/jo9jFSdghF
 164           eldiron               ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbhFTl2A2RJn5L51yxJM4XfCS2ZaiSX/jo9jFSdghF
 165           phare.normalesup.org  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2GomItXICXpCtCFRMT2xuerqx2nLMO/3mNUuWyzFr1
 166         '';
 167       };
 168     };
 169
 170     services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
 171       restart = true;
 172       paths = [
 173         config.secrets.fullPaths."buildbot/ldap"
 174         config.secrets.fullPaths."buildbot/worker_password"
 175         config.secrets.fullPaths."buildbot/ssh_key"
 176         config.secrets.fullPaths."buildbot/${project.name}/environment_file"
 177       ] ++ lib.attrsets.mapAttrsToList (k: v: config.secrets.fullPaths."buildbot/${project.name}/${k}") project.secrets;
 178     }) config.myEnv.buildbot.projects;
 179
 180     systemd.slices.buildbot = {
 181       description = "buildbot slice";
 182     };
 183
 184     networking.firewall.allowedTCPPorts = lib.attrsets.mapAttrsToList (k: v: v.workerPort) config.myEnv.buildbot.projects;
 185     systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
 186       description = "Buildbot Continuous Integration Server ${project.name}.";
 187       after = [ "network-online.target" ];
 188       wantedBy = [ "multi-user.target" ];
 189       path = project.packages pkgs;
 190       preStart = let
 191         master-cfg = "${buildbot.buildbot_common}/${bb-python.pythonForBuild.sitePackages}/buildbot_common/master.cfg";
 192         tac_file = pkgs.writeText "buildbot.tac" ''
 193             import os
 194
 195             from twisted.application import service
 196             from buildbot.master import BuildMaster
 197
 198             basedir = '${varDir}/${project.name}'
 199             rotateLength = 10000000
 200             maxRotatedFiles = 10
 201             configfile = '${master-cfg}'
 202
 203             # Default umask for server
 204             umask = None
 205
 206             # if this is a relocatable tac file, get the directory containing the TAC
 207             if basedir == '.':
 208                 import os
 209                 basedir = os.path.abspath(os.path.dirname(__file__))
 210
 211             # note: this line is matched against to check that this is a buildmaster
 212             # directory; do not edit it.
 213             application = service.Application('buildmaster')
 214             from twisted.python.logfile import LogFile
 215             from twisted.python.log import ILogObserver, FileLogObserver
 216             logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength,
 217                                             maxRotatedFiles=maxRotatedFiles)
 218             application.setComponent(ILogObserver, FileLogObserver(logfile).emit)
 219
 220             m = BuildMaster(basedir, configfile, umask)
 221             m.setServiceParent(application)
 222             m.log_rotation.rotateLength = rotateLength
 223             m.log_rotation.maxRotatedFiles = maxRotatedFiles
 224           '';
 225       in ''
 226       if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then
 227         ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}"
 228         rm -f ${varDir}/${project.name}/master.cfg.sample
 229         rm -f ${varDir}/${project.name}/buildbot.tac
 230       fi
 231       ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac
 232       # different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race
 233       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_key"} ${varDir}/buildbot_key || true
 234       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_known_hosts"} ${varDir}/buildbot_hosts || true
 235       buildbot_secrets=${varDir}/${project.name}/secrets
 236       install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets
 237       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ldap"} $buildbot_secrets/ldap
 238       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/worker_password"} $buildbot_secrets/worker_password
 239       ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
 240         (k: v: "install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/${project.name}/${k}"} $buildbot_secrets/${k}") project.secrets
 241       )}
 242       ${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name}
 243       '';
 244       environment = let
 245         HOME = "${varDir}/${project.name}";
 246         PYTHONPATH = "${bb-python.withPackages (self:
 247           buildbot.common_packages self ++
 248           [ (buildbot.buildbot_config project) ]
 249         )}/${bb-python.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${bb-python.sitePackages}" else ""}";
 250       in { inherit PYTHONPATH HOME; };
 251
 252       serviceConfig = {
 253         Slice = "buildbot.slice";
 254         Type = "forking";
 255         User = "buildbot";
 256         Group = "buildbot";
 257         RuntimeDirectory = "buildbot";
 258         RuntimeDirectoryPreserve = "yes";
 259         StateDirectory = "buildbot";
 260         SupplementaryGroups = "keys";
 261         WorkingDirectory = "${varDir}/${project.name}";
 262         ExecStart = "${buildbot}/bin/buildbot start";
 263         EnvironmentFile = config.secrets.fullPaths."buildbot/${project.name}/environment_file";
 264       };
 265     }) config.myEnv.buildbot.projects;
 266   };
 267 }