X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fbuildbot%2Fdefault.nix;h=903f453094c3041695b4c68fa5f826ffb207f61b;hb=da30ae4ffdd153a1eb32fb86f9ca9a65aa19e4e2;hp=88bab9b687f88841e8db9cd76d28ae5ddfa65718;hpb=6a8252b11bb02f3e67857d5a9d733b1affa6a625;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/modules/private/buildbot/default.nix b/modules/private/buildbot/default.nix index 88bab9b..903f453 100644 --- a/modules/private/buildbot/default.nix +++ b/modules/private/buildbot/default.nix @@ -1,4 +1,4 @@ -{ lib, pkgs, config, myconfig, ... }: +{ lib, pkgs, config, ... }: let varDir = "/var/lib/buildbot"; buildbot_common = pkgs.python3Packages.buildPythonPackage rec { @@ -24,11 +24,12 @@ in }; config = lib.mkIf config.myServices.buildbot.enable { - services.backup.profiles.buildbot = { + services.duplyBackup.profiles.buildbot = { rootDir = varDir; + remotes = [ "eriomem" "ovh" ]; }; - ids.uids.buildbot = myconfig.env.buildbot.user.uid; - ids.gids.buildbot = myconfig.env.buildbot.user.gid; + ids.uids.buildbot = config.myEnv.buildbot.user.uid; + ids.gids.buildbot = config.myEnv.buildbot.user.gid; users.groups.buildbot.gid = config.ids.gids.buildbot; users.users.buildbot = { @@ -41,8 +42,8 @@ in }; services.websites.env.tools.watchPaths = lib.attrsets.mapAttrsToList - (k: project: "/var/secrets/buildbot/${project.name}/webhook-httpd-include") - myconfig.env.buildbot.projects; + (k: project: config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include") + config.myEnv.buildbot.projects; services.websites.env.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: '' RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/" @@ -61,15 +62,19 @@ in Require local Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu - Include /var/secrets/buildbot/${project.name}/webhook-httpd-include + Include ${config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include"} - '') myconfig.env.buildbot.projects; + '') config.myEnv.buildbot.projects; system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { deps = [ "users" "wrappers" ]; - text = project.activationScript; - }) myconfig.env.buildbot.projects; + text = '' + install -m 755 -o buildbot -g buildbot -d ${varDir}/${project.name} + + ${project.activationScript} + ''; + }) config.myEnv.buildbot.projects; secrets.keys = ( lib.lists.flatten ( @@ -88,27 +93,52 @@ in permissions = "0600"; user = "wwwrun"; group = "wwwrun"; - text = lib.optionalString (lib.attrsets.hasAttr "webhookTokens" project) '' + text = lib.optionalString (project.webhookTokens != null) '' Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }" ''; dest = "buildbot/${project.name}/webhook-httpd-include"; } + { + permissions = "0600"; + user = "buildbot"; + group = "buildbot"; + dest = "buildbot/${project.name}/environment_file"; + text = let + project_env = with lib.attrsets; + mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment // + mapAttrs' (k: v: nameValuePair "BUILDBOT_PATH_${k}" (v pkgs)) (attrByPath ["builderPaths"] {} project) // + { + BUILDBOT_PROJECT_DIR = ./projects + "/${project.name}"; + BUILDBOT_WORKER_PORT = builtins.toString project.workerPort; + BUILDBOT_HOST = config.hostEnv.fqdn; + BUILDBOT_VIRT_URL = "qemu+ssh://libvirt@dilion.immae.eu/system"; + }; + in builtins.concatStringsSep "\n" + (lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env); + } ] - ) myconfig.env.buildbot.projects + ) config.myEnv.buildbot.projects ) ) ++ [ { permissions = "0600"; user = "buildbot"; group = "buildbot"; - text = myconfig.env.buildbot.ldap.password; + text = config.myEnv.buildbot.ldap.password; dest = "buildbot/ldap"; } { permissions = "0600"; user = "buildbot"; group = "buildbot"; - text = builtins.readFile "${myconfig.privateFiles}/buildbot_ssh_key"; + text = config.myEnv.buildbot.workerPassword; + dest = "buildbot/worker_password"; + } + { + permissions = "0600"; + user = "buildbot"; + group = "buildbot"; + text = config.myEnv.buildbot.ssh_key.private; dest = "buildbot/ssh_key"; } ]; @@ -116,11 +146,18 @@ in services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { restart = true; paths = [ - "/var/secrets/buildbot/ldap" - "/var/secrets/buildbot/ssh_key" - ] ++ lib.attrsets.mapAttrsToList (k: v: "/var/secrets/buildbot/${project.name}/${k}") project.secrets; - }) myconfig.env.buildbot.projects; + config.secrets.fullPaths."buildbot/ldap" + config.secrets.fullPaths."buildbot/worker_password" + config.secrets.fullPaths."buildbot/ssh_key" + config.secrets.fullPaths."buildbot/${project.name}/environment_file" + ] ++ lib.attrsets.mapAttrsToList (k: v: config.secrets.fullPaths."buildbot/${project.name}/${k}") project.secrets; + }) config.myEnv.buildbot.projects; + + systemd.slices.buildbot = { + description = "buildbot slice"; + }; + networking.firewall.allowedTCPPorts = lib.attrsets.mapAttrsToList (k: v: v.workerPort) config.myEnv.buildbot.projects; systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { description = "Buildbot Continuous Integration Server ${project.name}."; after = [ "network-online.target" ]; @@ -169,16 +206,17 @@ in fi ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac # different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race - install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ssh_key ${varDir}/buildbot_key || true + install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_key"} ${varDir}/buildbot_key || true buildbot_secrets=${varDir}/${project.name}/secrets install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets - install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ldap $buildbot_secrets/ldap + install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ldap"} $buildbot_secrets/ldap + install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/worker_password"} $buildbot_secrets/worker_password ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList - (k: v: "install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/${project.name}/${k} $buildbot_secrets/${k}") project.secrets + (k: v: "install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/${project.name}/${k}"} $buildbot_secrets/${k}") project.secrets )} + ${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name} ''; environment = let - project_env = lib.attrsets.mapAttrs' (k: v: lib.attrsets.nameValuePair "BUILDBOT_${k}" v) project.environment; buildbot_config = pkgs.python3Packages.buildPythonPackage (rec { name = "buildbot_config-${project.name}"; src = ./projects + "/${project.name}"; @@ -190,14 +228,16 @@ in }); HOME = "${varDir}/${project.name}"; PYTHONPATH = "${buildbot.pythonModule.withPackages (self: project.pythonPackages self pkgs ++ [ + pkgs.python3Packages.libvirt pkgs.python3Packages.wokkel pkgs.python3Packages.treq pkgs.python3Packages.ldap3 buildbot pkgs.python3Packages.buildbot-worker buildbot_common buildbot_config ])}/${buildbot.pythonModule.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${pkgs.python3.pythonForBuild.sitePackages}" else ""}"; - in project_env // { inherit PYTHONPATH HOME; }; + in { inherit PYTHONPATH HOME; }; serviceConfig = { + Slice = "buildbot.slice"; Type = "forking"; User = "buildbot"; Group = "buildbot"; @@ -207,7 +247,8 @@ in SupplementaryGroups = "keys"; WorkingDirectory = "${varDir}/${project.name}"; ExecStart = "${buildbot}/bin/buildbot start"; + EnvironmentFile = config.secrets.fullPaths."buildbot/${project.name}/environment_file"; }; - }) myconfig.env.buildbot.projects; + }) config.myEnv.buildbot.projects; }; }