1 files changed, 7 insertions, 1 deletions

diff --git a/nixops/modules/buildbot/default.nix b/nixops/modules/buildbot/default.nix
index 3768bde..21b784b 100644
--- a/nixops/modules/buildbot/default.nix
+++ b/nixops/modules/buildbot/default.nix
@@ -83,7 +83,13 @@ in
           ProxyPreserveHost On
         </Location>
         <Location /buildbot/${project.name}/change_hook/base>
-          Require local
+          <RequireAny>
+            Require local
+            Require ldap-group cn=users,ou=${project.name},cn=buildbot,ou=services,dc=immae,dc=eu
+            ${if lib.attrsets.hasAttr "webhookTokens" project then ''
+              Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
+              '' else ""}
+          </RequireAny>
         </Location>
         '') myconfig.env.buildbot.projects;