aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2021-01-29 14:14:41 +0100
committerIsmaël Bouya <ismael.bouya@normalesup.org>2021-01-29 14:14:41 +0100
commitdcb8ad4c0358735ba97fe83071f79b294bed8967 (patch)
treeda1adcaf5687a0dda70e6006b6b213101f9a0c70
parent50abe6fce134066851479a0df09a1db0a7219df2 (diff)
downloadNix-dcb8ad4c0358735ba97fe83071f79b294bed8967.tar.gz
Nix-dcb8ad4c0358735ba97fe83071f79b294bed8967.tar.zst
Nix-dcb8ad4c0358735ba97fe83071f79b294bed8967.zip
Change buildbot environment variables to secrets location
-rw-r--r--modules/private/buildbot/default.nix21
m---------nixops/secrets0
2 files changed, 16 insertions, 5 deletions
diff --git a/modules/private/buildbot/default.nix b/modules/private/buildbot/default.nix
index 6674ad7..d6753e5 100644
--- a/modules/private/buildbot/default.nix
+++ b/modules/private/buildbot/default.nix
@@ -98,6 +98,19 @@ in
98 ''; 98 '';
99 dest = "buildbot/${project.name}/webhook-httpd-include"; 99 dest = "buildbot/${project.name}/webhook-httpd-include";
100 } 100 }
101 {
102 permissions = "0600";
103 user = "buildbot";
104 group = "buildbot";
105 dest = "buildbot/${project.name}/environment_file";
106 text = let
107 project_env = with lib.attrsets;
108 mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment //
109 mapAttrs' (k: v: nameValuePair "BUILDBOT_PATH_${k}" (v pkgs)) (attrByPath ["builderPaths"] {} project) //
110 { BUILDBOT_PROJECT_DIR = ./projects + "/${project.name}"; };
111 in builtins.concatStringsSep "\n"
112 (lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
113 }
101 ] 114 ]
102 ) config.myEnv.buildbot.projects 115 ) config.myEnv.buildbot.projects
103 ) 116 )
@@ -123,6 +136,7 @@ in
123 paths = [ 136 paths = [
124 "/var/secrets/buildbot/ldap" 137 "/var/secrets/buildbot/ldap"
125 "/var/secrets/buildbot/ssh_key" 138 "/var/secrets/buildbot/ssh_key"
139 "/var/secrets/buildbot/${project.name}/environment_file"
126 ] ++ lib.attrsets.mapAttrsToList (k: v: "/var/secrets/buildbot/${project.name}/${k}") project.secrets; 140 ] ++ lib.attrsets.mapAttrsToList (k: v: "/var/secrets/buildbot/${project.name}/${k}") project.secrets;
127 }) config.myEnv.buildbot.projects; 141 }) config.myEnv.buildbot.projects;
128 142
@@ -188,10 +202,6 @@ in
188 ${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name} 202 ${buildbot}/bin/buildbot upgrade-master ${varDir}/${project.name}
189 ''; 203 '';
190 environment = let 204 environment = let
191 project_env = with lib.attrsets;
192 mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment //
193 mapAttrs' (k: v: nameValuePair "BUILDBOT_PATH_${k}" (v pkgs)) (attrByPath ["builderPaths"] {} project) //
194 { BUILDBOT_PROJECT_DIR = ./projects + "/${project.name}"; };
195 buildbot_config = pkgs.python3Packages.buildPythonPackage (rec { 205 buildbot_config = pkgs.python3Packages.buildPythonPackage (rec {
196 name = "buildbot_config-${project.name}"; 206 name = "buildbot_config-${project.name}";
197 src = ./projects + "/${project.name}"; 207 src = ./projects + "/${project.name}";
@@ -208,7 +218,7 @@ in
208 pkgs.python3Packages.buildbot-worker 218 pkgs.python3Packages.buildbot-worker
209 buildbot_common buildbot_config 219 buildbot_common buildbot_config
210 ])}/${buildbot.pythonModule.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${pkgs.python3.pythonForBuild.sitePackages}" else ""}"; 220 ])}/${buildbot.pythonModule.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${pkgs.python3.pythonForBuild.sitePackages}" else ""}";
211 in project_env // { inherit PYTHONPATH HOME; }; 221 in { inherit PYTHONPATH HOME; };
212 222
213 serviceConfig = { 223 serviceConfig = {
214 Slice = "buildbot.slice"; 224 Slice = "buildbot.slice";
@@ -221,6 +231,7 @@ in
221 SupplementaryGroups = "keys"; 231 SupplementaryGroups = "keys";
222 WorkingDirectory = "${varDir}/${project.name}"; 232 WorkingDirectory = "${varDir}/${project.name}";
223 ExecStart = "${buildbot}/bin/buildbot start"; 233 ExecStart = "${buildbot}/bin/buildbot start";
234 EnvironmentFile = "/var/secrets/buildbot/${project.name}/environment_file";
224 }; 235 };
225 }) config.myEnv.buildbot.projects; 236 }) config.myEnv.buildbot.projects;
226 }; 237 };
diff --git a/nixops/secrets b/nixops/secrets
Subproject 3a74f309999f47dc843a61a23bd4799a23f8ffa Subproject e570ae5038b922f24b946b2c54af2d4b51f1bae