1 { lib, pkgs, config, myconfig, mylibs, ... }:
3 varDir = "/var/lib/buildbot";
4 buildslist_src = mylibs.fetchedGitPrivate ./buildslist.json;
5 buildslist_yarn = mylibs.yarn2nixPackage.mkYarnModules rec {
6 name = "buildslist-yarn-modules";
8 inherit (pkgs.buildbot-pkg) version;
9 packageJSON = "${buildslist_src.src}/package.json";
10 yarnLock = "${buildslist_src.src}/yarn.lock";
12 all = { buildInputs = [ mylibs.yarn2nixPackage.src ]; };
15 buildslist_bower = pkgs.buildBowerComponents {
17 generated = ./bower.nix;
18 src = "${buildslist_src.src}/guanlecoja/";
21 buildslist = pkgs.python3Packages.buildPythonPackage rec {
22 pname = "buildbot-buildslist";
23 inherit (pkgs.buildbot-pkg) version;
27 cp -a ${buildslist_yarn}/node_modules .
28 chmod -R u+w node_modules
29 cp -a ${buildslist_bower}/bower_components ./libs
32 propagatedBuildInputs = with pkgs.python3Packages; [
33 (klein.overridePythonAttrs(old: { checkPhase = ""; }))
36 nativeBuildInputs = with pkgs; [ yarn nodejs ];
37 buildInputs = [ buildslist_yarn buildslist_bower ];
40 src = buildslist_src.src;
42 buildbot_common = pkgs.python3Packages.buildPythonPackage rec {
43 name = "buildbot_common";
47 mkdir -p $out/${pkgs.python3.pythonForBuild.sitePackages}
48 cp -a $src $out/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common
51 buildbot = pkgs.python3Packages.buildbot-full.withPlugins ([ buildslist ]);
55 services.buildbot.enable = lib.mkOption {
56 type = lib.types.bool;
59 Whether to enable buildbot.
64 config = lib.mkIf config.services.buildbot.enable {
65 nixpkgs.overlays = [ (self: super: rec {
66 python3 = super.python3.override {
67 packageOverrides = python-self: python-super: {
68 wokkel = python-self.buildPythonPackage rec {
71 src = python-self.fetchPypi {
72 inherit pname version;
73 sha256 = "1spq44gg8gsviqx1dvlmjpgfc0wk0jpyx4ap01y2pad1ai9cw016";
75 propagatedBuildInputs = with python-self; [ twisted.extras.tls twisted incremental dateutil ];
78 apprise = python-self.buildPythonPackage rec {
81 src = (mylibs.fetchedGithub ./apprise.json).src;
82 propagatedBuildInputs = with python-self; [ decorator
83 requests requests_oauthlib oauthlib urllib3 six click
84 markdown pyyaml sleekxmpp
92 ids.uids.buildbot = myconfig.env.buildbot.user.uid;
93 ids.gids.buildbot = myconfig.env.buildbot.user.gid;
95 users.groups.buildbot.gid = config.ids.gids.buildbot;
96 users.users.buildbot = {
98 uid = config.ids.uids.buildbot;
100 description = "Buildbot user";
102 extraGroups = [ "keys" ];
105 services.myWebsites.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: ''
106 RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/"
108 RewriteRule ^/buildbot/${project.name}/ws(.*)$ unix:///run/buildbot/${project.name}.sock|ws://git.immae.eu/ws$1 [P,NE,QSA,L]
109 ProxyPass /buildbot/${project.name}/ unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
110 ProxyPassReverse /buildbot/${project.name}/ unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/
111 <Location /buildbot/${project.name}/>
113 Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
115 SetEnvIf X-Url-Scheme https HTTPS=1
118 <Location /buildbot/${project.name}/change_hook/base>
121 Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
122 Include /var/secrets/buildbot/${project.name}/webhook-httpd-include
125 '') myconfig.env.buildbot.projects;
127 system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
128 deps = [ "users" "wrappers" ];
130 install -m 0755 -o buildbot -g buildbot -d /run/buildbot/
131 install -m 0755 -o buildbot -g buildbot -d ${varDir}
132 ${project.activationScript}
134 }) myconfig.env.buildbot.projects;
138 lib.attrsets.mapAttrsToList (k: project:
139 lib.attrsets.mapAttrsToList (k: v:
141 permissions = "0600";
145 dest = "buildbot/${project.name}/${k}";
150 permissions = "0600";
153 text = lib.optionalString (lib.attrsets.hasAttr "webhookTokens" project) ''
154 Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
156 dest = "buildbot/${project.name}/webhook-httpd-include";
159 ) myconfig.env.buildbot.projects
163 permissions = "0600";
166 text = myconfig.env.buildbot.ldap.password;
167 dest = "buildbot/ldap";
170 permissions = "0600";
173 text = builtins.readFile "${myconfig.privateFiles}/buildbot_ssh_key";
174 dest = "buildbot/ssh_key";
178 systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
179 description = "Buildbot Continuous Integration Server ${project.name}.";
180 after = [ "network-online.target" ];
181 wantedBy = [ "multi-user.target" ];
182 path = project.packages pkgs ++ (project.pythonPackages buildbot.pythonModule pkgs);
184 master-cfg = "${buildbot_common}/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common/master.cfg";
185 tac_file = pkgs.writeText "buildbot.tac" ''
188 from twisted.application import service
189 from buildbot.master import BuildMaster
191 basedir = '${varDir}/${project.name}'
192 rotateLength = 10000000
194 configfile = '${master-cfg}'
196 # Default umask for server
199 # if this is a relocatable tac file, get the directory containing the TAC
202 basedir = os.path.abspath(os.path.dirname(__file__))
204 # note: this line is matched against to check that this is a buildmaster
205 # directory; do not edit it.
206 application = service.Application('buildmaster')
207 from twisted.python.logfile import LogFile
208 from twisted.python.log import ILogObserver, FileLogObserver
209 logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength,
210 maxRotatedFiles=maxRotatedFiles)
211 application.setComponent(ILogObserver, FileLogObserver(logfile).emit)
213 m = BuildMaster(basedir, configfile, umask)
214 m.setServiceParent(application)
215 m.log_rotation.rotateLength = rotateLength
216 m.log_rotation.maxRotatedFiles = maxRotatedFiles
219 if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then
220 ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}"
221 rm -f ${varDir}/${project.name}/master.cfg.sample
222 rm -f ${varDir}/${project.name}/buildbot.tac
224 ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac
225 # different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race
226 install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ssh_key ${varDir}/buildbot_key || true
227 buildbot_secrets=${varDir}/${project.name}/secrets
228 install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets
229 install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ldap $buildbot_secrets/ldap
230 ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
231 (k: v: "install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/${project.name}/${k} $buildbot_secrets/${k}") project.secrets
235 project_env = lib.attrsets.mapAttrs' (k: v: lib.attrsets.nameValuePair "BUILDBOT_${k}" v) project.environment;
236 buildbot_config = pkgs.python3Packages.buildPythonPackage (rec {
237 name = "buildbot_config-${project.name}";
238 src = ./projects + "/${project.name}";
241 mkdir -p $out/${pkgs.python3.pythonForBuild.sitePackages}
242 cp -a $src $out/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_config
245 HOME = "${varDir}/${project.name}";
246 PYTHONPATH = "${buildbot.pythonModule.withPackages (self: project.pythonPackages self pkgs ++ [
247 pkgs.python3Packages.wokkel
248 pkgs.python3Packages.treq pkgs.python3Packages.ldap3 buildbot
249 pkgs.python3Packages.buildbot-worker
250 buildbot_common buildbot_config
251 ])}/${buildbot.pythonModule.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${pkgs.python3.pythonForBuild.sitePackages}" else ""}";
252 in project_env // { inherit PYTHONPATH HOME; };
258 SupplementaryGroups = "keys";
259 WorkingDirectory = "${varDir}/${project.name}";
260 ExecStart = "${buildbot}/bin/buildbot start";
262 }) myconfig.env.buildbot.projects;