diff options
Diffstat (limited to 'modules/private/buildbot/default.nix')
-rw-r--r-- | modules/private/buildbot/default.nix | 198 |
1 files changed, 198 insertions, 0 deletions
diff --git a/modules/private/buildbot/default.nix b/modules/private/buildbot/default.nix new file mode 100644 index 0000000..fa6a6f2 --- /dev/null +++ b/modules/private/buildbot/default.nix | |||
@@ -0,0 +1,198 @@ | |||
1 | { lib, pkgs, config, myconfig, ... }: | ||
2 | let | ||
3 | varDir = "/var/lib/buildbot"; | ||
4 | buildbot_common = pkgs.python3Packages.buildPythonPackage rec { | ||
5 | name = "buildbot_common"; | ||
6 | src = ./common; | ||
7 | format = "other"; | ||
8 | installPhase = '' | ||
9 | mkdir -p $out/${pkgs.python3.pythonForBuild.sitePackages} | ||
10 | cp -a $src $out/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common | ||
11 | ''; | ||
12 | }; | ||
13 | buildbot = pkgs.python3Packages.buildbot-full; | ||
14 | in | ||
15 | { | ||
16 | options = { | ||
17 | myServices.buildbot.enable = lib.mkOption { | ||
18 | type = lib.types.bool; | ||
19 | default = false; | ||
20 | description = '' | ||
21 | Whether to enable buildbot. | ||
22 | ''; | ||
23 | }; | ||
24 | }; | ||
25 | |||
26 | config = lib.mkIf config.myServices.buildbot.enable { | ||
27 | ids.uids.buildbot = myconfig.env.buildbot.user.uid; | ||
28 | ids.gids.buildbot = myconfig.env.buildbot.user.gid; | ||
29 | |||
30 | users.groups.buildbot.gid = config.ids.gids.buildbot; | ||
31 | users.users.buildbot = { | ||
32 | name = "buildbot"; | ||
33 | uid = config.ids.uids.buildbot; | ||
34 | group = "buildbot"; | ||
35 | description = "Buildbot user"; | ||
36 | home = varDir; | ||
37 | extraGroups = [ "keys" ]; | ||
38 | }; | ||
39 | |||
40 | services.websites.tools.vhostConfs.git.extraConfig = lib.attrsets.mapAttrsToList (k: project: '' | ||
41 | RedirectMatch permanent "^/buildbot/${project.name}$" "/buildbot/${project.name}/" | ||
42 | RewriteEngine On | ||
43 | RewriteRule ^/buildbot/${project.name}/ws(.*)$ unix:///run/buildbot/${project.name}.sock|ws://git.immae.eu/ws$1 [P,NE,QSA,L] | ||
44 | ProxyPass /buildbot/${project.name}/ unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/ | ||
45 | ProxyPassReverse /buildbot/${project.name}/ unix:///run/buildbot/${project.name}.sock|http://${project.name}-git.immae.eu/ | ||
46 | <Location /buildbot/${project.name}/> | ||
47 | Use LDAPConnect | ||
48 | Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu | ||
49 | |||
50 | SetEnvIf X-Url-Scheme https HTTPS=1 | ||
51 | ProxyPreserveHost On | ||
52 | </Location> | ||
53 | <Location /buildbot/${project.name}/change_hook/base> | ||
54 | <RequireAny> | ||
55 | Require local | ||
56 | Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu | ||
57 | Include /var/secrets/buildbot/${project.name}/webhook-httpd-include | ||
58 | </RequireAny> | ||
59 | </Location> | ||
60 | '') myconfig.env.buildbot.projects; | ||
61 | |||
62 | system.activationScripts = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { | ||
63 | deps = [ "users" "wrappers" ]; | ||
64 | text = project.activationScript; | ||
65 | }) myconfig.env.buildbot.projects; | ||
66 | |||
67 | secrets.keys = ( | ||
68 | lib.lists.flatten ( | ||
69 | lib.attrsets.mapAttrsToList (k: project: | ||
70 | lib.attrsets.mapAttrsToList (k: v: | ||
71 | { | ||
72 | permissions = "0600"; | ||
73 | user = "buildbot"; | ||
74 | group = "buildbot"; | ||
75 | text = v; | ||
76 | dest = "buildbot/${project.name}/${k}"; | ||
77 | } | ||
78 | ) project.secrets | ||
79 | ++ [ | ||
80 | { | ||
81 | permissions = "0600"; | ||
82 | user = "wwwrun"; | ||
83 | group = "wwwrun"; | ||
84 | text = lib.optionalString (lib.attrsets.hasAttr "webhookTokens" project) '' | ||
85 | Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }" | ||
86 | ''; | ||
87 | dest = "buildbot/${project.name}/webhook-httpd-include"; | ||
88 | } | ||
89 | ] | ||
90 | ) myconfig.env.buildbot.projects | ||
91 | ) | ||
92 | ) ++ [ | ||
93 | { | ||
94 | permissions = "0600"; | ||
95 | user = "buildbot"; | ||
96 | group = "buildbot"; | ||
97 | text = myconfig.env.buildbot.ldap.password; | ||
98 | dest = "buildbot/ldap"; | ||
99 | } | ||
100 | { | ||
101 | permissions = "0600"; | ||
102 | user = "buildbot"; | ||
103 | group = "buildbot"; | ||
104 | text = builtins.readFile "${myconfig.privateFiles}/buildbot_ssh_key"; | ||
105 | dest = "buildbot/ssh_key"; | ||
106 | } | ||
107 | ]; | ||
108 | |||
109 | systemd.services = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" { | ||
110 | description = "Buildbot Continuous Integration Server ${project.name}."; | ||
111 | after = [ "network-online.target" ]; | ||
112 | wantedBy = [ "multi-user.target" ]; | ||
113 | path = project.packages pkgs ++ (project.pythonPackages buildbot.pythonModule pkgs); | ||
114 | preStart = let | ||
115 | master-cfg = "${buildbot_common}/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_common/master.cfg"; | ||
116 | tac_file = pkgs.writeText "buildbot.tac" '' | ||
117 | import os | ||
118 | |||
119 | from twisted.application import service | ||
120 | from buildbot.master import BuildMaster | ||
121 | |||
122 | basedir = '${varDir}/${project.name}' | ||
123 | rotateLength = 10000000 | ||
124 | maxRotatedFiles = 10 | ||
125 | configfile = '${master-cfg}' | ||
126 | |||
127 | # Default umask for server | ||
128 | umask = None | ||
129 | |||
130 | # if this is a relocatable tac file, get the directory containing the TAC | ||
131 | if basedir == '.': | ||
132 | import os | ||
133 | basedir = os.path.abspath(os.path.dirname(__file__)) | ||
134 | |||
135 | # note: this line is matched against to check that this is a buildmaster | ||
136 | # directory; do not edit it. | ||
137 | application = service.Application('buildmaster') | ||
138 | from twisted.python.logfile import LogFile | ||
139 | from twisted.python.log import ILogObserver, FileLogObserver | ||
140 | logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength, | ||
141 | maxRotatedFiles=maxRotatedFiles) | ||
142 | application.setComponent(ILogObserver, FileLogObserver(logfile).emit) | ||
143 | |||
144 | m = BuildMaster(basedir, configfile, umask) | ||
145 | m.setServiceParent(application) | ||
146 | m.log_rotation.rotateLength = rotateLength | ||
147 | m.log_rotation.maxRotatedFiles = maxRotatedFiles | ||
148 | ''; | ||
149 | in '' | ||
150 | if [ ! -f ${varDir}/${project.name}/buildbot.tac ]; then | ||
151 | ${buildbot}/bin/buildbot create-master -c "${master-cfg}" "${varDir}/${project.name}" | ||
152 | rm -f ${varDir}/${project.name}/master.cfg.sample | ||
153 | rm -f ${varDir}/${project.name}/buildbot.tac | ||
154 | fi | ||
155 | ln -sf ${tac_file} ${varDir}/${project.name}/buildbot.tac | ||
156 | # different buildbots may be trying that simultaneously, add the || true to avoid complaining in case of race | ||
157 | install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ssh_key ${varDir}/buildbot_key || true | ||
158 | buildbot_secrets=${varDir}/${project.name}/secrets | ||
159 | install -m 0700 -o buildbot -g buildbot -d $buildbot_secrets | ||
160 | install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/ldap $buildbot_secrets/ldap | ||
161 | ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList | ||
162 | (k: v: "install -Dm600 -o buildbot -g buildbot -T /var/secrets/buildbot/${project.name}/${k} $buildbot_secrets/${k}") project.secrets | ||
163 | )} | ||
164 | ''; | ||
165 | environment = let | ||
166 | project_env = lib.attrsets.mapAttrs' (k: v: lib.attrsets.nameValuePair "BUILDBOT_${k}" v) project.environment; | ||
167 | buildbot_config = pkgs.python3Packages.buildPythonPackage (rec { | ||
168 | name = "buildbot_config-${project.name}"; | ||
169 | src = ./projects + "/${project.name}"; | ||
170 | format = "other"; | ||
171 | installPhase = '' | ||
172 | mkdir -p $out/${pkgs.python3.pythonForBuild.sitePackages} | ||
173 | cp -a $src $out/${pkgs.python3.pythonForBuild.sitePackages}/buildbot_config | ||
174 | ''; | ||
175 | }); | ||
176 | HOME = "${varDir}/${project.name}"; | ||
177 | PYTHONPATH = "${buildbot.pythonModule.withPackages (self: project.pythonPackages self pkgs ++ [ | ||
178 | pkgs.python3Packages.wokkel | ||
179 | pkgs.python3Packages.treq pkgs.python3Packages.ldap3 buildbot | ||
180 | pkgs.python3Packages.buildbot-worker | ||
181 | buildbot_common buildbot_config | ||
182 | ])}/${buildbot.pythonModule.sitePackages}${if project.pythonPathHome then ":${varDir}/${project.name}/.local/${pkgs.python3.pythonForBuild.sitePackages}" else ""}"; | ||
183 | in project_env // { inherit PYTHONPATH HOME; }; | ||
184 | |||
185 | serviceConfig = { | ||
186 | Type = "forking"; | ||
187 | User = "buildbot"; | ||
188 | Group = "buildbot"; | ||
189 | RuntimeDirectory = "buildbot"; | ||
190 | RuntimeDirectoryPreserve = "yes"; | ||
191 | StateDirectory = "buildbot"; | ||
192 | SupplementaryGroups = "keys"; | ||
193 | WorkingDirectory = "${varDir}/${project.name}"; | ||
194 | ExecStart = "${buildbot}/bin/buildbot start"; | ||
195 | }; | ||
196 | }) myconfig.env.buildbot.projects; | ||
197 | }; | ||
198 | } | ||