};
services.websites.env.tools.watchPaths = lib.attrsets.mapAttrsToList
- (k: project: "/var/secrets/buildbot/${project.name}/webhook-httpd-include")
+ (k: project: config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include")
config.myEnv.buildbot.projects;
services.websites.env.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: ''
<RequireAny>
Require local
Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
- Include /var/secrets/buildbot/${project.name}/webhook-httpd-include
+ Include ${config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include"}
</RequireAny>
</Location>
'') config.myEnv.buildbot.projects;
services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
restart = true;
paths = [
- "/var/secrets/buildbot/ldap"
- "/var/secrets/buildbot/worker_password"
- "/var/secrets/buildbot/ssh_key"
- "/var/secrets/buildbot/${project.name}/environment_file"
- ] ++ lib.attrsets.mapAttrsToList (k: v: "/var/secrets/buildbot/${project.name}/${k}") project.secrets;
+ config.secrets.fullPaths."buildbot/ldap"
+ config.secrets.fullPaths."buildbot/worker_password"
+ config.secrets.fullPaths."buildbot/ssh_key"
+ config.secrets.fullPaths."buildbot/${project.name}/environment_file"
+ ] ++ lib.attrsets.mapAttrsToList (k: v: config.secrets.fullPaths."buildbot/${project.name}/${k}") project.secrets;
}) config.myEnv.buildbot.projects;
systemd.slices.buildbot = {
fi
ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac
# different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race
- install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ssh_key ${varDir}/buildbot_key || true
+ install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_key"} ${varDir}/buildbot_key || true
buildbot_secrets=${varDir}/${project.name}/secrets
install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets
- install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ldap $buildbot_secrets/ldap
- install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/worker_password $buildbot_secrets/worker_password
+ install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ldap"} $buildbot_secrets/ldap
+ install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/worker_password"} $buildbot_secrets/worker_password
${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
- (k: v: "install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/${project.name}/${k} $buildbot_secrets/${k}") project.secrets
+ (k: v: "install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/${project.name}/${k}"} $buildbot_secrets/${k}") project.secrets
)}
${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name}
'';
SupplementaryGroups = "keys";
WorkingDirectory = "${varDir}/${project.name}";
ExecStart = "${buildbot}/bin/buildbot start";
- EnvironmentFile = "/var/secrets/buildbot/${project.name}/environment_file";
+ EnvironmentFile = config.secrets.fullPaths."buildbot/${project.name}/environment_file";
};
}) config.myEnv.buildbot.projects;
};