From 6984f454ea1c476169b3721721529c2c5bb13eb9 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 16 Apr 2019 16:09:37 +0200 Subject: [PATCH] Move buildbot secrets to a secure location Related issue: https://git.immae.eu/mantisbt/view.php?id=122 --- nixops/modules/buildbot/default.nix | 86 +++++++++++++++++++++-------- 1 file changed, 64 insertions(+), 22 deletions(-) diff --git a/nixops/modules/buildbot/default.nix b/nixops/modules/buildbot/default.nix index ff1c697..057b58b 100644 --- a/nixops/modules/buildbot/default.nix +++ b/nixops/modules/buildbot/default.nix @@ -96,6 +96,7 @@ in group = "buildbot"; description = "Buildbot user"; home = varDir; + extraGroups = [ "keys" ]; }; services.myWebsites.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: '' @@ -115,18 +116,70 @@ in Require local Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu - ${if lib.attrsets.hasAttr "webhookTokens" project then '' - Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }" - '' else ""} + Include /run/keys/buildbot/${project.name}/buildbot-${project.name}-webhook-httpd-include '') myconfig.env.buildbot.projects; system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { deps = [ "users" "wrappers" ]; - text = let + text = '' + install -m 0755 -o buildbot -g buildbot -d /run/buildbot/ + install -m 0755 -o buildbot -g buildbot -d ${varDir} + ${project.activationScript} + ''; + }) myconfig.env.buildbot.projects; + + deployment.keys = lib.attrsets.listToAttrs ( + lib.lists.flatten ( + lib.attrsets.mapAttrsToList (k: project: + lib.attrsets.mapAttrsToList (k: v: + lib.attrsets.nameValuePair "buildbot-${project.name}-${k}" { + permissions = "0600"; + user = "buildbot"; + group = "buildbot"; + text = v; + destDir = "/run/keys/buildbot/${project.name}"; + } + ) project.secrets + ++ [ + (lib.attrsets.nameValuePair "buildbot-${project.name}-webhook-httpd-include" { + permissions = "0600"; + user = "wwwrun"; + group = "wwwrun"; + text = lib.optionalString (lib.attrsets.hasAttr "webhookTokens" project) '' + Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }" + ''; + destDir = "/run/keys/buildbot/${project.name}"; + }) + ] + ) myconfig.env.buildbot.projects + ) + ) // { + buildbot-ldap = { + permissions = "0600"; + user = "buildbot"; + group = "buildbot"; + text = myconfig.env.buildbot.ldap.password; + destDir = "/run/keys/buildbot"; + }; + buildbot-ssh-key = { + permissions = "0600"; + user = "buildbot"; + group = "buildbot"; + text = builtins.readFile "${myconfig.privateFiles}/buildbot_ssh_key"; + destDir = "/run/keys/buildbot"; + }; + }; + + systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { + description = "Buildbot Continuous Integration Server ${project.name}."; + after = [ "network-online.target" "keys.target" ]; + wants = [ "keys.target" ]; + wantedBy = [ "multi-user.target" ]; + path = project.packages pkgs ++ (project.pythonPackages buildbot.pythonModule pkgs); + preStart = let master-cfg = "${buildbot_common}/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common/master.cfg"; - buildbot_key = pkgs.writeText "buildbot_key" (builtins.readFile "${myconfig.privateFiles}/buildbot_ssh_key"); tac_file = pkgs.writeText "buildbot.tac" '' import os @@ -161,32 +214,20 @@ in m.log_rotation.maxRotatedFiles = maxRotatedFiles ''; in '' - install -m 0755 -o buildbot -g buildbot -d /run/buildbot/ - install -m 0755 -o buildbot -g buildbot -d ${varDir} if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then - $wrapperDir/sudo -u buildbot ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}" + ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}" rm -f ${varDir}/${project.name}/master.cfg.sample rm -f ${varDir}/${project.name}/buildbot.tac fi ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac - install -Dm600 -o buildbot -g buildbot -T ${buildbot_key} ${varDir}/buildbot_key + install -Dm600 -o buildbot -g buildbot -T /run/keys/buildbot/buildbot-ssh-key ${varDir}/buildbot_key buildbot_secrets=${varDir}/${project.name}/secrets - install -m 0600 -o buildbot -g buildbot -d $buildbot_secrets - echo "${myconfig.env.buildbot.ldap.password}" > $buildbot_secrets/ldap + install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets + install -Dm600 -o buildbot -g buildbot -T /run/keys/buildbot/buildbot-ldap $buildbot_secrets/ldap ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList - (k: v: "echo ${lib.strings.escapeShellArg v} > $buildbot_secrets/${k}") project.secrets + (k: v: "install -Dm600 -o buildbot -g buildbot -T /run/keys/buildbot/${project.name}/buildbot-${project.name}-${k} $buildbot_secrets/${k}") project.secrets )} - chown -R buildbot:buildbot $buildbot_secrets - chmod -R u=rX,go=- $buildbot_secrets - ${project.activationScript} ''; - }) myconfig.env.buildbot.projects; - - systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { - description = "Buildbot Continuous Integration Server ${project.name}."; - after = [ "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; - path = project.packages pkgs ++ (project.pythonPackages buildbot.pythonModule pkgs); environment = let project_env = lib.attrsets.mapAttrs' (k: v: lib.attrsets.nameValuePair "BUILDBOT_${k}" v) project.environment; buildbot_config = pkgs.python3Packages.buildPythonPackage (rec { @@ -211,6 +252,7 @@ in Type = "forking"; User = "buildbot"; Group = "buildbot"; + SupplementaryGroups = "keys"; WorkingDirectory = "${varDir}/${project.name}"; ExecStart = "${buildbot}/bin/buildbot start"; }; -- 2.41.0