[perso/Immae/Config/Nix.git] / systems / eldiron / buildbot / default.nix

{ lib, pkgs, config, buildbot, ... }:
let
  varDir = "/var/lib/buildbot";
  bb-python = buildbot.pythonModule;
in
{
  options = {
    myServices.buildbot.enable = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = ''
        Whether to enable buildbot.
      '';
    };
  };

  config = lib.mkIf config.myServices.buildbot.enable {
    myEnv.buildbot.projects.test = {
      name = "test";
      workerPort = config.myEnv.ports.buildbot_test;
      packages = [ pkgs.git pkgs.gzip pkgs.openssh ];
      pythonPathHome = false;
      secrets = {
        apprise_webhooks = builtins.concatStringsSep "\n" [
          "{{ .apprise_webhooks.matrix_immae_eu_alert }}"
        ];
        notify_xmpp_password = "{{ .xmpp.notify_bot }}";
      };
      activationScript = ''
        install -m 0755 -o buildbot -g buildbot -d /var/lib/ftp/release.immae.eu/test
        '';
      webhookTokens = [
        "{{ .buildbot.webhookTokens.Immae }}"
        "{{ .buildbot.webhookTokens.Immae }}"
      ];
    };

    myServices.chatonsProperties.hostings.buildbot = {
      file.datetime = "2022-08-21T10:37:00";
      hosting = {
        name = "Buildbot";
        description = "Python-based continuous integration testing framework";
        type = "INSTANCE";
        website = "https://git.immae.eu";
        logo = "https://www.buildbot.net/img/icon.png";
        status.level = "OK";
        status.description = "OK";
        registration.load = "OPEN";
        install.type = "PACKAGE";
        guide.user = "https://www.immae.eu/docs/forge-logicielle.html";
      };
      software = {
        name = "Buildbot";
        website = "https://www.buildbot.net/";
        license.url = "https://github.com/buildbot/buildbot/blob/master/LICENSE";
        license.name = "GNU General Public License v2.0";
        version = pkgs.buildbot.version;
        source.url = "https://github.com/buildbot/buildbot";
      };
    };
    nixpkgs.overlays = [
      (self: super: {
        follow-systemd-unit = self.writeScriptBin "follow-systemd-unit" ''
          #!${self.stdenv.shell}

          set -euo pipefail

          service=$1
          before_invocation_id=$2

          get_id() {
            systemctl show -p InvocationID --value "$service"
          }

          while [ "$(get_id)" = "$before_invocation_id" ]; do sleep 1; done

          invocation_id="$(get_id)"
          cursor="$(mktemp)"
          trap "rm -f $cursor" EXIT

          get_logs() {
            journalctl --quiet --cursor-file=$cursor INVOCATION_ID=$invocation_id + _SYSTEMD_INVOCATION_ID=$invocation_id
          }

          while [ -n "$(systemctl show -p Job --value "$service")" ]; do
            get_logs
          done
          get_logs
        '';
      })
    ];
    ids.uids.buildbot = config.myEnv.buildbot.user.uid;
    ids.gids.buildbot = config.myEnv.buildbot.user.gid;

    users.groups.buildbot.gid = config.ids.gids.buildbot;
    users.users.buildbot = {
      name = "buildbot";
      uid = config.ids.uids.buildbot;
      group = "buildbot";
      description = "Buildbot user";
      home = varDir;
      extraGroups = [ "keys" "systemd-journal" ];
      useDefaultShell = true;
      openssh.authorizedKeys.keys = [ config.myEnv.buildbot.ssh_key.public ];
    };

    services.websites.env.tools.watchPaths = lib.attrsets.mapAttrsToList
      (k: project: config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include")
      config.myEnv.buildbot.projects;

    services.websites.env.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: ''
        RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/"
        RewriteEngine On
        RewriteRule ^/buildbot/${project.name}/ws(.*)$   unix:///run/buildbot/${project.name}.sock|ws://git.immae.eu/ws$1 [P,NE,QSA,L]
        ProxyPass /buildbot/${project.name}/             unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
        ProxyPassReverse /buildbot/${project.name}/      unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
        <Location /buildbot/${project.name}/>
          Use LDAPConnect
          Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu

          SetEnvIf X-Url-Scheme https HTTPS=1
          ProxyPreserveHost On
        </Location>
        <Location /buildbot/${project.name}/change_hook/base>
          <RequireAny>
            Require local
            Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
            Include ${config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include"}
          </RequireAny>
        </Location>
        '') config.myEnv.buildbot.projects;

    system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
      deps = [ "users" "wrappers" ];
      text = ''
        install -m 755 -o buildbot -g buildbot -d ${varDir}/${project.name}

        ${project.activationScript}
        '';
    }) config.myEnv.buildbot.projects;

    secrets.keys = lib.listToAttrs (
      lib.lists.flatten (
        lib.attrsets.mapAttrsToList (k: project:
          lib.attrsets.mapAttrsToList (k: v:
            (lib.nameValuePair "buildbot/${project.name}/${k}" {
              permissions = "0600";
              user = "buildbot";
              group = "buildbot";
              text = v;
            })
          ) project.secrets
          ++ [
            (lib.nameValuePair "buildbot/${project.name}/webhook-httpd-include" {
              permissions = "0600";
              user = "wwwrun";
              group = "wwwrun";
              text = lib.optionalString (project.webhookTokens != null) ''
                Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
                '';
            })
            (lib.nameValuePair "buildbot/${project.name}/environment_file" {
              permissions = "0600";
              user = "buildbot";
              group = "buildbot";
              keyDependencies = [ (buildbot.buildbot_config project).src ] ++ project.secretsDeps;
              text = let
                project_env = with lib.attrsets;
                  mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment //
                  {
                    BUILDBOT_PROJECT_DIR = (buildbot.buildbot_config project).src;
                    BUILDBOT_WORKER_PORT = builtins.toString project.workerPort;
                    BUILDBOT_HOST = config.hostEnv.fqdn;
                    BUILDBOT_VIRT_URL = "qemu+ssh://libvirt@dilion.immae.eu/system";
                  };
                in builtins.concatStringsSep "\n"
                  (lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
            })
          ]
        ) config.myEnv.buildbot.projects
      )
    ) // {
      "buildbot/ldap" = {
        permissions = "0600";
        user = "buildbot";
        group = "buildbot";
        text = config.myEnv.buildbot.ldap.password;
      };
      "buildbot/worker_password" = {
        permissions = "0600";
        user = "buildbot";
        group = "buildbot";
        text = config.myEnv.buildbot.workerPassword;
      };
      "buildbot/ssh_key" = {
        permissions = "0600";
        user = "buildbot";
        group = "buildbot";
        text = config.myEnv.buildbot.ssh_key.private;
      };
      "buildbot/ssh_known_hosts" = {
        permissions = "0644";
        user = "buildbot";
        group = "buildbot";
        text = ''
          git.immae.eu          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbhFTl2A2RJn5L51yxJM4XfCS2ZaiSX/jo9jFSdghF
          eldiron               ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbhFTl2A2RJn5L51yxJM4XfCS2ZaiSX/jo9jFSdghF
          phare.normalesup.org  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2GomItXICXpCtCFRMT2xuerqx2nLMO/3mNUuWyzFr1
        '';
      };
    };

    services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
      restart = true;
      paths = [
        config.secrets.fullPaths."buildbot/ldap"
        config.secrets.fullPaths."buildbot/worker_password"
        config.secrets.fullPaths."buildbot/ssh_key"
        config.secrets.fullPaths."buildbot/${project.name}/environment_file"
      ] ++ lib.attrsets.mapAttrsToList (k: v: config.secrets.fullPaths."buildbot/${project.name}/${k}") project.secrets;
    }) config.myEnv.buildbot.projects;

    systemd.slices.buildbot = {
      description = "buildbot slice";
    };

    networking.firewall.allowedTCPPorts = lib.attrsets.mapAttrsToList (k: v: v.workerPort) config.myEnv.buildbot.projects;
    systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
      description = "Buildbot Continuous Integration Server ${project.name}.";
      after = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
      path = project.packages;
      preStart = let
        master-cfg = "${buildbot.buildbot_common}/${bb-python.pythonForBuild.sitePackages}/buildbot_common/master.cfg";
        tac_file = pkgs.writeText "buildbot.tac" ''
            import os

            from twisted.application import service
            from buildbot.master import BuildMaster

            basedir = '${varDir}/${project.name}'
            rotateLength = 10000000
            maxRotatedFiles = 10
            configfile = '${master-cfg}'

            # Default umask for server
            umask = None

            # if this is a relocatable tac file, get the directory containing the TAC
            if basedir == '.':
                import os
                basedir = os.path.abspath(os.path.dirname(__file__))

            # note: this line is matched against to check that this is a buildmaster
            # directory; do not edit it.
            application = service.Application('buildmaster')
            from twisted.python.logfile import LogFile
            from twisted.python.log import ILogObserver, FileLogObserver
            logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength,
                                            maxRotatedFiles=maxRotatedFiles)
            application.setComponent(ILogObserver, FileLogObserver(logfile).emit)

            m = BuildMaster(basedir, configfile, umask)
            m.setServiceParent(application)
            m.log_rotation.rotateLength = rotateLength
            m.log_rotation.maxRotatedFiles = maxRotatedFiles
          '';
      in ''
      if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then
        ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}"
        rm -f ${varDir}/${project.name}/master.cfg.sample
        rm -f ${varDir}/${project.name}/buildbot.tac
      fi
      ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac
      # different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race
      install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_key"} ${varDir}/buildbot_key || true
      install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_known_hosts"} ${varDir}/buildbot_hosts || true
      buildbot_secrets=${varDir}/${project.name}/secrets
      install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets
      install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ldap"} $buildbot_secrets/ldap
      install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/worker_password"} $buildbot_secrets/worker_password
      ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
        (k: v: "install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/${project.name}/${k}"} $buildbot_secrets/${k}") project.secrets
      )}
      ${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name}
      '';
      environment = let
        HOME = "${varDir}/${project.name}";
        PYTHONPATH = "${bb-python.withPackages (self:
          buildbot.common_packages self ++
          [ (buildbot.buildbot_config project) ]
        )}/${bb-python.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${bb-python.sitePackages}" else ""}";
      in { inherit PYTHONPATH HOME; };

      serviceConfig = {
        Slice = "buildbot.slice";
        Type = "forking";
        User = "buildbot";
        Group = "buildbot";
        RuntimeDirectory = "buildbot";
        RuntimeDirectoryPreserve = "yes";
        StateDirectory = "buildbot";
        SupplementaryGroups = "keys";
        WorkingDirectory = "${varDir}/${project.name}";
        ExecStart = "${buildbot}/bin/buildbot start";
        EnvironmentFile = config.secrets.fullPaths."buildbot/${project.name}/environment_file";
      };
    }) config.myEnv.buildbot.projects;
  };
}
Commit	Line	Data
1a64deeb	1	{ lib, pkgs, config, buildbot, ... }:
9fb4205e IB	2	let
9fb4205e IB	3	varDir = "/var/lib/buildbot";
1a64deeb	4	bb-python = buildbot.pythonModule;
9fb4205e IB	5	in
	6	{
	7	options = {
8d213e2b	8	myServices.buildbot.enable = lib.mkOption {
9fb4205e IB	9	type = lib.types.bool;
	10	default = false;
	11	description = ''
	12	Whether to enable buildbot.
	13	'';
	14	};
	15	};
	16
8d213e2b	17	config = lib.mkIf config.myServices.buildbot.enable {
1a64deeb IB	18	myEnv.buildbot.projects.test = {
	19	name = "test";
	20	workerPort = config.myEnv.ports.buildbot_test;
	21	packages = [ pkgs.git pkgs.gzip pkgs.openssh ];
	22	pythonPathHome = false;
	23	secrets = {
	24	apprise_webhooks = builtins.concatStringsSep "\n" [
	25	"{{ .apprise_webhooks.matrix_immae_eu_alert }}"
	26	];
	27	notify_xmpp_password = "{{ .xmpp.notify_bot }}";
	28	};
	29	activationScript = ''
	30	install -m 0755 -o buildbot -g buildbot -d /var/lib/ftp/release.immae.eu/test
	31	'';
	32	webhookTokens = [
	33	"{{ .buildbot.webhookTokens.Immae }}"
	34	"{{ .buildbot.webhookTokens.Immae }}"
	35	];
	36	};
	37
	38	myServices.chatonsProperties.hostings.buildbot = {
	39	file.datetime = "2022-08-21T10:37:00";
	40	hosting = {
	41	name = "Buildbot";
	42	description = "Python-based continuous integration testing framework";
	43	type = "INSTANCE";
	44	website = "https://git.immae.eu";
	45	logo = "https://www.buildbot.net/img/icon.png";
	46	status.level = "OK";
	47	status.description = "OK";
	48	registration.load = "OPEN";
	49	install.type = "PACKAGE";
	50	guide.user = "https://www.immae.eu/docs/forge-logicielle.html";
	51	};
	52	software = {
	53	name = "Buildbot";
	54	website = "https://www.buildbot.net/";
	55	license.url = "https://github.com/buildbot/buildbot/blob/master/LICENSE";
	56	license.name = "GNU General Public License v2.0";
	57	version = pkgs.buildbot.version;
	58	source.url = "https://github.com/buildbot/buildbot";
	59	};
	60	};
	61	nixpkgs.overlays = [
	62	(self: super: {
	63	follow-systemd-unit = self.writeScriptBin "follow-systemd-unit" ''
	64	#!${self.stdenv.shell}
	65
	66	set -euo pipefail
	67
	68	service=$1
	69	before_invocation_id=$2
	70
	71	get_id() {
	72	systemctl show -p InvocationID --value "$service"
	73	}
	74
	75	while [ "$(get_id)" = "$before_invocation_id" ]; do sleep 1; done
	76
	77	invocation_id="$(get_id)"
	78	cursor="$(mktemp)"
	79	trap "rm -f $cursor" EXIT
	80
	81	get_logs() {
82	journalctl --quiet --cursor-file=$cursor INVOCATION_ID=$invocation_id + _SYSTEMD_INVOCATION_ID=$invocation_id
83	}
84
85	while [ -n "$(systemctl show -p Job --value "$service")" ]; do
86	get_logs
87	done
88	get_logs
89	'';
90	})
91	];
ab8f306d IB	92	ids.uids.buildbot = config.myEnv.buildbot.user.uid;
ab8f306d IB	93	ids.gids.buildbot = config.myEnv.buildbot.user.gid;
9fb4205e IB	94
	95	users.groups.buildbot.gid = config.ids.gids.buildbot;
	96	users.users.buildbot = {
	97	name = "buildbot";
	98	uid = config.ids.uids.buildbot;
	99	group = "buildbot";
	100	description = "Buildbot user";
	101	home = varDir;
1a64deeb IB	102	extraGroups = [ "keys" "systemd-journal" ];
	103	useDefaultShell = true;
	104	openssh.authorizedKeys.keys = [ config.myEnv.buildbot.ssh_key.public ];
9fb4205e IB	105	};
9fb4205e IB	106
29f8cb85	107	services.websites.env.tools.watchPaths = lib.attrsets.mapAttrsToList
da30ae4f	108	(k: project: config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include")
ab8f306d	109	config.myEnv.buildbot.projects;
17f6eae9	110
29f8cb85	111	services.websites.env.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: ''
9fb4205e IB	112	RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/"
	113	RewriteEngine On
	114	RewriteRule ^/buildbot/${project.name}/ws(.*)$ unix:///run/buildbot/${project.name}.sock\|ws://git.immae.eu/ws$1 [P,NE,QSA,L]
	115	ProxyPass /buildbot/${project.name}/ unix:///run/buildbot/${project.name}.sock\|http://${project.name}-git.immae.eu/
	116	ProxyPassReverse /buildbot/${project.name}/ unix:///run/buildbot/${project.name}.sock\|http://${project.name}-git.immae.eu/
	117	<Location /buildbot/${project.name}/>
	118	Use LDAPConnect
e2b96bf5	119	Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
9fb4205e IB	120
	121	SetEnvIf X-Url-Scheme https HTTPS=1
	122	ProxyPreserveHost On
	123	</Location>
	124	<Location /buildbot/${project.name}/change_hook/base>
85817848 IB	125	<RequireAny>
	126	Require local
	127	Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
da30ae4f	128	Include ${config.secrets.fullPaths."buildbot/${project.name}/webhook-httpd-include"}
85817848	129	</RequireAny>
9fb4205e	130	</Location>
ab8f306d	131	'') config.myEnv.buildbot.projects;
9fb4205e IB	132
	133	system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
	134	deps = [ "users" "wrappers" ];
8fa7ff2c IB	135	text = ''
	136	install -m 755 -o buildbot -g buildbot -d ${varDir}/${project.name}
	137
	138	${project.activationScript}
	139	'';
ab8f306d	140	}) config.myEnv.buildbot.projects;
6984f454	141
4c4652aa	142	secrets.keys = lib.listToAttrs (
6984f454 IB	143	lib.lists.flatten (
	144	lib.attrsets.mapAttrsToList (k: project:
	145	lib.attrsets.mapAttrsToList (k: v:
4c4652aa	146	(lib.nameValuePair "buildbot/${project.name}/${k}" {
6984f454 IB	147	permissions = "0600";
	148	user = "buildbot";
	149	group = "buildbot";
	150	text = v;
4c4652aa	151	})
6984f454 IB	152	) project.secrets
6984f454 IB	153	++ [
4c4652aa	154	(lib.nameValuePair "buildbot/${project.name}/webhook-httpd-include" {
6984f454 IB	155	permissions = "0600";
	156	user = "wwwrun";
	157	group = "wwwrun";
ab8f306d	158	text = lib.optionalString (project.webhookTokens != null) ''
6984f454 IB	159	Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
6984f454 IB	160	'';
4c4652aa IB	161	})
4c4652aa IB	162	(lib.nameValuePair "buildbot/${project.name}/environment_file" {
dcb8ad4c IB	163	permissions = "0600";
	164	user = "buildbot";
	165	group = "buildbot";
1a64deeb	166	keyDependencies = [ (buildbot.buildbot_config project).src ] ++ project.secretsDeps;
dcb8ad4c IB	167	text = let
	168	project_env = with lib.attrsets;
	169	mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment //
200690c9	170	{
1a64deeb	171	BUILDBOT_PROJECT_DIR = (buildbot.buildbot_config project).src;
200690c9 IB	172	BUILDBOT_WORKER_PORT = builtins.toString project.workerPort;
	173	BUILDBOT_HOST = config.hostEnv.fqdn;
	174	BUILDBOT_VIRT_URL = "qemu+ssh://libvirt@dilion.immae.eu/system";
	175	};
dcb8ad4c IB	176	in builtins.concatStringsSep "\n"
dcb8ad4c IB	177	(lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
4c4652aa	178	})
6984f454	179	]
ab8f306d	180	) config.myEnv.buildbot.projects
6984f454	181	)
4c4652aa IB	182	) // {
4c4652aa IB	183	"buildbot/ldap" = {
6984f454 IB	184	permissions = "0600";
	185	user = "buildbot";
	186	group = "buildbot";
ab8f306d	187	text = config.myEnv.buildbot.ldap.password;
4c4652aa IB	188	};
4c4652aa IB	189	"buildbot/worker_password" = {
200690c9 IB	190	permissions = "0600";
	191	user = "buildbot";
	192	group = "buildbot";
	193	text = config.myEnv.buildbot.workerPassword;
4c4652aa IB	194	};
4c4652aa IB	195	"buildbot/ssh_key" = {
6984f454 IB	196	permissions = "0600";
	197	user = "buildbot";
	198	group = "buildbot";
282c67a1	199	text = config.myEnv.buildbot.ssh_key.private;
4c4652aa	200	};
1a64deeb IB	201	"buildbot/ssh_known_hosts" = {
	202	permissions = "0644";
	203	user = "buildbot";
	204	group = "buildbot";
	205	text = ''
	206	git.immae.eu ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbhFTl2A2RJn5L51yxJM4XfCS2ZaiSX/jo9jFSdghF
	207	eldiron ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbhFTl2A2RJn5L51yxJM4XfCS2ZaiSX/jo9jFSdghF
	208	phare.normalesup.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2GomItXICXpCtCFRMT2xuerqx2nLMO/3mNUuWyzFr1
	209	'';
	210	};
4c4652aa	211	};
6984f454	212
17f6eae9 IB	213	services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
	214	restart = true;
	215	paths = [
da30ae4f IB	216	config.secrets.fullPaths."buildbot/ldap"
	217	config.secrets.fullPaths."buildbot/worker_password"
	218	config.secrets.fullPaths."buildbot/ssh_key"
	219	config.secrets.fullPaths."buildbot/${project.name}/environment_file"
	220	] ++ lib.attrsets.mapAttrsToList (k: v: config.secrets.fullPaths."buildbot/${project.name}/${k}") project.secrets;
ab8f306d	221	}) config.myEnv.buildbot.projects;
17f6eae9	222
850adcf4 IB	223	systemd.slices.buildbot = {
	224	description = "buildbot slice";
	225	};
	226
200690c9	227	networking.firewall.allowedTCPPorts = lib.attrsets.mapAttrsToList (k: v: v.workerPort) config.myEnv.buildbot.projects;
6984f454 IB	228	systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
6984f454 IB	229	description = "Buildbot Continuous Integration Server ${project.name}.";
ca330baa	230	after = [ "network-online.target" ];
6984f454	231	wantedBy = [ "multi-user.target" ];
1a64deeb	232	path = project.packages;
6984f454	233	preStart = let
1a64deeb	234	master-cfg = "${buildbot.buildbot_common}/${bb-python.pythonForBuild.sitePackages}/buildbot_common/master.cfg";
e2b96bf5 IB	235	tac_file = pkgs.writeText "buildbot.tac" ''
	236	import os
	237
	238	from twisted.application import service
	239	from buildbot.master import BuildMaster
	240
	241	basedir = '${varDir}/${project.name}'
	242	rotateLength = 10000000
	243	maxRotatedFiles = 10
	244	configfile = '${master-cfg}'
	245
	246	# Default umask for server
	247	umask = None
	248
	249	# if this is a relocatable tac file, get the directory containing the TAC
	250	if basedir == '.':
	251	import os
	252	basedir = os.path.abspath(os.path.dirname(__file__))
	253
	254	# note: this line is matched against to check that this is a buildmaster
	255	# directory; do not edit it.
	256	application = service.Application('buildmaster')
	257	from twisted.python.logfile import LogFile
	258	from twisted.python.log import ILogObserver, FileLogObserver
	259	logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength,
	260	maxRotatedFiles=maxRotatedFiles)
	261	application.setComponent(ILogObserver, FileLogObserver(logfile).emit)
	262
	263	m = BuildMaster(basedir, configfile, umask)
	264	m.setServiceParent(application)
	265	m.log_rotation.rotateLength = rotateLength
	266	m.log_rotation.maxRotatedFiles = maxRotatedFiles
	267	'';
9fb4205e	268	in ''
9fb4205e	269	if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then
6984f454	270	${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}"
9fb4205e	271	rm -f ${varDir}/${project.name}/master.cfg.sample
e2b96bf5	272	rm -f ${varDir}/${project.name}/buildbot.tac
9fb4205e	273	fi
e2b96bf5	274	ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac
ca330baa	275	# different buildbots may be trying that simultaneously, add the \|\| true to avoid complaining in case of race
da30ae4f	276	install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_key"} ${varDir}/buildbot_key \|\| true
1a64deeb	277	install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ssh_known_hosts"} ${varDir}/buildbot_hosts \|\| true
9fb4205e	278	buildbot_secrets=${varDir}/${project.name}/secrets
6984f454	279	install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets
da30ae4f IB	280	install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/ldap"} $buildbot_secrets/ldap
da30ae4f IB	281	install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/worker_password"} $buildbot_secrets/worker_password
9fb4205e	282	${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
da30ae4f	283	(k: v: "install -Dm600 -o buildbot -g buildbot -T ${config.secrets.fullPaths."buildbot/${project.name}/${k}"} $buildbot_secrets/${k}") project.secrets
9fb4205e	284	)}
5400b9b6	285	${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name}
9fb4205e	286	'';
9fb4205e	287	environment = let
9fb4205e	288	HOME = "${varDir}/${project.name}";
1a64deeb IB	289	PYTHONPATH = "${bb-python.withPackages (self:
	290	buildbot.common_packages self ++
	291	[ (buildbot.buildbot_config project) ]
	292	)}/${bb-python.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${bb-python.sitePackages}" else ""}";
dcb8ad4c	293	in { inherit PYTHONPATH HOME; };
9fb4205e IB	294
9fb4205e IB	295	serviceConfig = {
850adcf4	296	Slice = "buildbot.slice";
9fb4205e IB	297	Type = "forking";
	298	User = "buildbot";
	299	Group = "buildbot";
81b9ff89 IB	300	RuntimeDirectory = "buildbot";
	301	RuntimeDirectoryPreserve = "yes";
	302	StateDirectory = "buildbot";
6984f454	303	SupplementaryGroups = "keys";
9fb4205e IB	304	WorkingDirectory = "${varDir}/${project.name}";
9fb4205e IB	305	ExecStart = "${buildbot}/bin/buildbot start";
da30ae4f	306	EnvironmentFile = config.secrets.fullPaths."buildbot/${project.name}/environment_file";
9fb4205e	307	};
ab8f306d	308	}) config.myEnv.buildbot.projects;
9fb4205e IB	309	};
9fb4205e IB	310	}