modules/private/buildbot/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   varDir = "/var/lib/buildbot";
   4   buildbot_common = pkgs.python3Packages.buildPythonPackage rec {
   5     name = "buildbot_common";
   6     src = ./common;
   7     format = "other";
   8     installPhase = ''
   9       mkdir -p $out/${pkgs.python3.pythonForBuild.sitePackages}
  10       cp -a $src $out/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common
  11       '';
  12   };
  13   buildbot = pkgs.python3Packages.buildbot-full;
  14 in
  15 {
  16   options = {
  17     myServices.buildbot.enable = lib.mkOption {
  18       type = lib.types.bool;
  19       default = false;
  20       description = ''
  21         Whether to enable buildbot.
  22       '';
  23     };
  24   };
  25
  26   config = lib.mkIf config.myServices.buildbot.enable {
  27     nixpkgs.overlays = [
  28       (self: super: {
  29         follow-systemd-unit = self.writeScriptBin "follow-systemd-unit" ''
  30           #!${self.stdenv.shell}
  31
  32           set -euo pipefail
  33
  34           service=$1
  35           before_invocation_id=$2
  36
  37           get_id() {
  38             systemctl show -p InvocationID --value "$service"
  39           }
  40
  41           while [ "$(get_id)" = "$before_invocation_id" ]; do sleep 1; done
  42
  43           invocation_id="$(get_id)"
  44           cursor="$(mktemp)"
  45           trap "rm -f $cursor" EXIT
  46
  47           get_logs() {
  48             journalctl --quiet --cursor-file=$cursor INVOCATION_ID=$invocation_id + _SYSTEMD_INVOCATION_ID=$invocation_id
  49           }
  50
  51           while [ -n "$(systemctl show -p Job --value "$service")" ]; do
  52             get_logs
  53           done
  54           get_logs
  55         '';
  56       })
  57     ];
  58     ids.uids.buildbot = config.myEnv.buildbot.user.uid;
  59     ids.gids.buildbot = config.myEnv.buildbot.user.gid;
  60
  61     users.groups.buildbot.gid = config.ids.gids.buildbot;
  62     users.users.buildbot = {
  63       name = "buildbot";
  64       uid = config.ids.uids.buildbot;
  65       group = "buildbot";
  66       description = "Buildbot user";
  67       home = varDir;
  68       extraGroups = [ "keys" "systemd-journal" ];
  69       useDefaultShell = true;
  70       openssh.authorizedKeys.keys = [ config.myEnv.buildbot.ssh_key.public ];
  71     };
  72
  73     services.websites.env.tools.watchPaths = lib.attrsets.mapAttrsToList
  74       (k: project: config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include")
  75       config.myEnv.buildbot.projects;
  76
  77     services.websites.env.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: ''
  78         RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/"
  79         RewriteEngine On
  80         RewriteRule ^/buildbot/${project.name}/ws(.*)$   unix:///run/buildbot/${project.name}.sock|ws://git.immae.eu/ws$1 [P,NE,QSA,L]
  81         ProxyPass /buildbot/${project.name}/             unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
  82         ProxyPassReverse /buildbot/${project.name}/      unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
  83         <Location /buildbot/${project.name}/>
  84           Use LDAPConnect
  85           Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
  86
  87           SetEnvIf X-Url-Scheme https HTTPS=1
  88           ProxyPreserveHost On
  89         </Location>
  90         <Location /buildbot/${project.name}/change_hook/base>
  91           <RequireAny>
  92             Require local
  93             Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
  94             Include ${config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include"}
  95           </RequireAny>
  96         </Location>
  97         '') config.myEnv.buildbot.projects;
  98
  99     system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
 100       deps = [ "users" "wrappers" ];
 101       text = ''
 102         install -m 755 -o buildbot -g buildbot -d ${varDir}/${project.name}
 103
 104         ${project.activationScript}
 105         '';
 106     }) config.myEnv.buildbot.projects;
 107
 108     secrets.keys = lib.listToAttrs (
 109       lib.lists.flatten (
 110         lib.attrsets.mapAttrsToList (k: project:
 111           lib.attrsets.mapAttrsToList (k: v:
 112             (lib.nameValuePair "buildbot/${project.name}/${k}" {
 113               permissions = "0600";
 114               user = "buildbot";
 115               group = "buildbot";
 116               text = if builtins.isFunction v then v pkgs config else v;
 117             })
 118           ) project.secrets
 119           ++ [
 120             (lib.nameValuePair "buildbot/${project.name}/webhook-httpd-include" {
 121               permissions = "0600";
 122               user = "wwwrun";
 123               group = "wwwrun";
 124               text = lib.optionalString (project.webhookTokens != null) ''
 125                 Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
 126                 '';
 127             })
 128             (lib.nameValuePair "buildbot/${project.name}/environment_file" {
 129               permissions = "0600";
 130               user = "buildbot";
 131               group = "buildbot";
 132               text = let
 133                 project_env = with lib.attrsets;
 134                   mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" (if builtins.isFunction v then v pkgs else v)) project.environment //
 135                   mapAttrs' (k: v: nameValuePair "BUILDBOT_PATH_${k}" (v pkgs)) (attrByPath ["builderPaths"] {} project) //
 136                   {
 137                     BUILDBOT_PROJECT_DIR = ./projects + "/${project.name}";
 138                     BUILDBOT_WORKER_PORT = builtins.toString project.workerPort;
 139                     BUILDBOT_HOST = config.hostEnv.fqdn;
 140                     BUILDBOT_VIRT_URL = "qemu+ssh://libvirt@dilion.immae.eu/system";
 141                   };
 142                 in builtins.concatStringsSep "\n"
 143                   (lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
 144             })
 145           ]
 146         ) config.myEnv.buildbot.projects
 147       )
 148     ) // {
 149       "buildbot/ldap" = {
 150         permissions = "0600";
 151         user = "buildbot";
 152         group = "buildbot";
 153         text = config.myEnv.buildbot.ldap.password;
 154       };
 155       "buildbot/worker_password" = {
 156         permissions = "0600";
 157         user = "buildbot";
 158         group = "buildbot";
 159         text = config.myEnv.buildbot.workerPassword;
 160       };
 161       "buildbot/ssh_key" = {
 162         permissions = "0600";
 163         user = "buildbot";
 164         group = "buildbot";
 165         text = config.myEnv.buildbot.ssh_key.private;
 166       };
 167     };
 168
 169     services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
 170       restart = true;
 171       paths = [
 172         config.secrets.fullPaths."buildbot/ldap"
 173         config.secrets.fullPaths."buildbot/worker_password"
 174         config.secrets.fullPaths."buildbot/ssh_key"
 175         config.secrets.fullPaths."buildbot/${project.name}/environment_file"
 176       ] ++ lib.attrsets.mapAttrsToList (k: v: config.secrets.fullPaths."buildbot/${project.name}/${k}") project.secrets;
 177     }) config.myEnv.buildbot.projects;
 178
 179     systemd.slices.buildbot = {
 180       description = "buildbot slice";
 181     };
 182
 183     networking.firewall.allowedTCPPorts = lib.attrsets.mapAttrsToList (k: v: v.workerPort) config.myEnv.buildbot.projects;
 184     systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
 185       description = "Buildbot Continuous Integration Server ${project.name}.";
 186       after = [ "network-online.target" ];
 187       wantedBy = [ "multi-user.target" ];
 188       path = project.packages pkgs ++ (project.pythonPackages buildbot.pythonModule pkgs);
 189       preStart = let
 190         master-cfg = "${buildbot_common}/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common/master.cfg";
 191         tac_file = pkgs.writeText "buildbot.tac" ''
 192             import os
 193
 194             from twisted.application import service
 195             from buildbot.master import BuildMaster
 196
 197             basedir = '${varDir}/${project.name}'
 198             rotateLength = 10000000
 199             maxRotatedFiles = 10
 200             configfile = '${master-cfg}'
 201
 202             # Default umask for server
 203             umask = None
 204
 205             # if this is a relocatable tac file, get the directory containing the TAC
 206             if basedir == '.':
 207                 import os
 208                 basedir = os.path.abspath(os.path.dirname(__file__))
 209
 210             # note: this line is matched against to check that this is a buildmaster
 211             # directory; do not edit it.
 212             application = service.Application('buildmaster')
 213             from twisted.python.logfile import LogFile
 214             from twisted.python.log import ILogObserver, FileLogObserver
 215             logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength,
 216                                             maxRotatedFiles=maxRotatedFiles)
 217             application.setComponent(ILogObserver, FileLogObserver(logfile).emit)
 218
 219             m = BuildMaster(basedir, configfile, umask)
 220             m.setServiceParent(application)
 221             m.log_rotation.rotateLength = rotateLength
 222             m.log_rotation.maxRotatedFiles = maxRotatedFiles
 223           '';
 224       in ''
 225       if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then
 226         ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}"
 227         rm -f ${varDir}/${project.name}/master.cfg.sample
 228         rm -f ${varDir}/${project.name}/buildbot.tac
 229       fi
 230       ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac
 231       # different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race
 232       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_key"} ${varDir}/buildbot_key || true
 233       buildbot_secrets=${varDir}/${project.name}/secrets
 234       install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets
 235       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ldap"} $buildbot_secrets/ldap
 236       install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/worker_password"} $buildbot_secrets/worker_password
 237       ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
 238         (k: v: "install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/${project.name}/${k}"} $buildbot_secrets/${k}") project.secrets
 239       )}
 240       ${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name}
 241       '';
 242       environment = let
 243         buildbot_config = pkgs.python3Packages.buildPythonPackage (rec {
 244           name = "buildbot_config-${project.name}";
 245           src = ./projects + "/${project.name}";
 246           format = "other";
 247           installPhase = ''
 248             mkdir -p $out/${pkgs.python3.pythonForBuild.sitePackages}
 249             cp -a $src $out/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_config
 250             '';
 251         });
 252         HOME = "${varDir}/${project.name}";
 253         PYTHONPATH = "${buildbot.pythonModule.withPackages (self: project.pythonPackages self pkgs ++ [
 254           pkgs.python3Packages.libvirt
 255           pkgs.python3Packages.wokkel
 256           pkgs.python3Packages.treq pkgs.python3Packages.ldap3 buildbot
 257           pkgs.python3Packages.buildbot-worker
 258           buildbot_common buildbot_config
 259         ])}/${buildbot.pythonModule.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${pkgs.python3.pythonForBuild.sitePackages}" else ""}";
 260       in { inherit PYTHONPATH HOME; };
 261
 262       serviceConfig = {
 263         Slice = "buildbot.slice";
 264         Type = "forking";
 265         User = "buildbot";
 266         Group = "buildbot";
 267         RuntimeDirectory = "buildbot";
 268         RuntimeDirectoryPreserve = "yes";
 269         StateDirectory = "buildbot";
 270         SupplementaryGroups = "keys";
 271         WorkingDirectory = "${varDir}/${project.name}";
 272         ExecStart = "${buildbot}/bin/buildbot start";
 273         EnvironmentFile = config.secrets.fullPaths."buildbot/${project.name}/environment_file";
 274       };
 275     }) config.myEnv.buildbot.projects;
 276   };
 277 }