X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fbuildbot%2Fdefault.nix;fp=nixops%2Fmodules%2Fbuildbot%2Fdefault.nix;h=21b784bb50b7c8b006b8a04cc706e5491a413bc1;hb=85817848f29f1e2c3680da216a8dfc54a2ad3932;hp=3768bde552673d53ced9b3954d13ea5ed60b73ee;hpb=587b9e340bb5cb14ca55e62a0498295e702b56c5;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/nixops/modules/buildbot/default.nix b/nixops/modules/buildbot/default.nix
index 3768bde..21b784b 100644
--- a/nixops/modules/buildbot/default.nix
+++ b/nixops/modules/buildbot/default.nix
@@ -83,7 +83,13 @@ in
           ProxyPreserveHost On
         </Location>
         <Location /buildbot/${project.name}/change_hook/base>
-          Require local
+          <RequireAny>
+            Require local
+            Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
+            ${if lib.attrsets.hasAttr "webhookTokens" project then ''
+              Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
+              '' else ""}
+          </RequireAny>
         </Location>
         '') myconfig.env.buildbot.projects;