summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/0tests/data/secrets/konsens.id_ed255190
-rw-r--r--krebs/2configs/buildbot-stockholm.nix18
-rw-r--r--krebs/2configs/repo-sync.nix26
-rw-r--r--krebs/3modules/default.nix1
-rw-r--r--krebs/3modules/git.nix11
-rw-r--r--krebs/3modules/jeschli/default.nix1
-rw-r--r--krebs/3modules/konsens.nix80
-rw-r--r--krebs/3modules/lass/default.nix64
-rw-r--r--krebs/5pkgs/simple/cgit-clear-cache.nix8
-rw-r--r--krebs/5pkgs/simple/krops.nix4
-rw-r--r--krebs/krops.nix5
-rw-r--r--krebs/nixpkgs.json6
12 files changed, 157 insertions, 67 deletions
diff --git a/krebs/0tests/data/secrets/konsens.id_ed25519 b/krebs/0tests/data/secrets/konsens.id_ed25519
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/krebs/0tests/data/secrets/konsens.id_ed25519
diff --git a/krebs/2configs/buildbot-stockholm.nix b/krebs/2configs/buildbot-stockholm.nix
index 62a5f9ab5..13d4c6729 100644
--- a/krebs/2configs/buildbot-stockholm.nix
+++ b/krebs/2configs/buildbot-stockholm.nix
@@ -4,6 +4,14 @@ let
hostname = config.networking.hostName;
+ build = pkgs.writeDash "build" ''
+ set -eu
+ export USER="$1"
+ export SYSTEM="$2"
+ $(nix-build $USER/krops.nix --no-out-link --argstr name "$SYSTEM" --argstr target "$HOME/stockholm-build" -A ci)
+ '';
+
+
in
{
networking.firewall.allowedTCPPorts = [ 80 ];
@@ -24,7 +32,7 @@ in
testslave = "lasspass";
};
change_source.stockholm = ''
- stockholm_repo = 'http://cgit.prism.r/stockholm'
+ stockholm_repo = 'http://cgit.hotdog.r/stockholm'
cs.append(
changes.GitPoller(
stockholm_repo,
@@ -95,15 +103,9 @@ in
env={
"NIX_PATH": "secrets=/var/src/stockholm/null:stockholm=./:/var/src",
"NIX_REMOTE": "daemon",
- "dummy_secrets": "true",
},
command=[
- "nix-shell", "-I", "stockholm=.", "--run", " ".join(["test",
- "--user={}".format(user),
- "--system={}".format(host),
- "--force-populate",
- "--target=$LOGNAME@${config.krebs.build.host.name}$HOME/{}".format(user),
- ])
+ "${build}", user, host
],
timeout=90001,
workdir='build', # TODO figure out why we need this?
diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index 7c3b2c90e..813dc154b 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -3,6 +3,10 @@
with import <stockholm/lib>;
let
+ konsens-user = {
+ name = "konsens";
+ pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKKozGNGBAzHnyj6xUlsjGxxknyChXvuyrddkWVVnz7";
+ };
mirror = "git@${config.networking.hostName}:";
defineRepo = {
@@ -20,7 +24,7 @@ let
verbose = false;
channel = "#xxx";
server = "irc.r";
- branches = [ "newest" ];
+ branches = [ "master" "newest" ];
};
};
};
@@ -38,6 +42,13 @@ let
perm = push ''refs/*'' [ non-fast-forward create delete merge ];
}
{
+ user = [
+ konsens-user
+ ];
+ repo = [ repo ];
+ perm = push ''refs/heads/master'' [ create merge ];
+ }
+ {
user = attrValues config.krebs.users;
repo = [ repo ];
perm = fetch;
@@ -108,6 +119,19 @@ in {
krebs.repo-sync = {
enable = true;
};
+ krebs.konsens = {
+ enable = true;
+ repos = {
+ krops = { branchesToCheck = [ "lassulus" "tv" ]; };
+ stockholm = {};
+ };
+ };
+ krebs.secret.files.konsens = {
+ path = "/var/lib/konsens/.ssh/id_ed25519";
+ owner = konsens-user;
+ source-path = "${<secrets/konsens.id_ed25519>}";
+ };
+
imports = [
(sync-retiolum { name = "the_playlist"; desc = "Good Music collection + tools"; section = "art"; })
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index afc96e9ee..833349769 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -26,6 +26,7 @@ let
./iana-etc.nix
./iptables.nix
./kapacitor.nix
+ ./konsens.nix
./monit.nix
./newsbot-js.nix
./nixpkgs.nix
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 5ae24b40b..8a923efd2 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -348,6 +348,10 @@ let
users.users.${cfg.user.name} = {
inherit (cfg.user) home name uid;
description = "Git repository hosting user";
+ extraGroups = [
+ # To allow running cgit-clear-cache via hooks.
+ cfg.cgit.fcgiwrap.group.name
+ ];
shell = "/bin/sh";
openssh.authorizedKeys.keys =
unique
@@ -403,13 +407,12 @@ let
));
environment.systemPackages = [
- (pkgs.writeDashBin "cgit-clear-cache" ''
- ${pkgs.coreutils}/bin/rm -f ${cfg.cgit.settings.cache-root}/*
- '')
+ (pkgs.cgit-clear-cache.override { inherit (cfg.cgit.settings) cache-root; })
];
system.activationScripts.cgit = ''
- mkdir -m 0700 -p ${cfg.cgit.settings.cache-root}
+ mkdir -m 0770 -p ${cfg.cgit.settings.cache-root}
+ chmod 0770 ${cfg.cgit.settings.cache-root}
chown ${toString cfg.cgit.fcgiwrap.user.uid}:${toString cfg.cgit.fcgiwrap.group.gid} ${cfg.cgit.settings.cache-root}
'';
diff --git a/krebs/3modules/jeschli/default.nix b/krebs/3modules/jeschli/default.nix
index ed9bfad29..ab8fe097d 100644
--- a/krebs/3modules/jeschli/default.nix
+++ b/krebs/3modules/jeschli/default.nix
@@ -132,6 +132,7 @@ with import <stockholm/lib>;
ip6.addr = "42::30";
aliases = [
"enklave.r"
+ "cgit.enklave.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
new file mode 100644
index 000000000..47316d5d6
--- /dev/null
+++ b/krebs/3modules/konsens.nix
@@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+let
+ cfg = config.krebs.konsens;
+
+ out = {
+ options.krebs.konsens = api;
+ config = lib.mkIf cfg.enable imp;
+ };
+
+ api = {
+ enable = mkEnableOption "git konsens finder";
+ repos = mkOption {
+ type = types.attrsOf (types.submodule ({ config, ...}: {
+ options = {
+ url = mkOption {
+ type = types.str;
+ default = "git@localhost:${config._module.args.name}";
+ };
+ branchesToCheck = mkOption {
+ type = types.listOf types.str;
+ default = [ "lassulus" "makefu" "tv" ];
+ };
+ target = mkOption {
+ type = types.str;
+ default = "master";
+ };
+ timerConfig = mkOption {
+ type = types.attrsOf types.str;
+ default = {
+ OnCalendar = "*:00,15,30,45";
+ };
+ };
+ };
+ }));
+ };
+ };
+
+ imp = {
+ users.users.konsens = rec {
+ name = "konsens";
+ uid = genid name;
+ home = "/var/lib/konsens";
+ createHome = true;
+ };
+
+ systemd.timers = mapAttrs' (name: repo:
+ nameValuePair "konsens-${name}" {
+ description = "konsens timer";
+ wantedBy = [ "timers.target" ];
+ timerConfig = repo.timerConfig;
+ }
+ ) cfg.repos;
+
+ systemd.services = mapAttrs' (name: repo:
+ nameValuePair "konsens-${name}" {
+ after = [ "network.target" "secret.service" ];
+ path = [ pkgs.git ];
+ restartIfChanged = false;
+ serviceConfig = {
+ Type = "simple";
+ PermissionsStartOnly = true;
+ ExecStart = pkgs.writeDash "konsens-${name}" ''
+ if ! test -e ${name}; then
+ git clone ${repo.url} ${name}
+ fi
+ cd ${name}
+ git fetch origin
+ git push origin $(git merge-base ${concatMapStringsSep " " (branch: "origin/${branch}") repo.branchesToCheck}):refs/heads/master
+ '';
+ WorkingDirectory = /var/lib/konsens;
+ User = "konsens";
+ };
+ }
+ ) cfg.repos;
+ };
+
+in out
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index c4a5bbb0d..7d9ef5075 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -11,39 +11,6 @@ with import <stockholm/lib>;
ci = true;
monitoring = true;
}) {
- dishfire = {
- cores = 4;
- nets = rec {
- internet = {
- ip4.addr = "144.76.172.188";
- aliases = [
- "dishfire.i"
- ];
- ssh.port = 45621;
- };
- retiolum = {
- via = internet;
- ip4.addr = "10.243.133.99";
- ip6.addr = "42:0000:0000:0000:0000:0000:d15f:1233";
- aliases = [
- "dishfire.r"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEAwKi49fN+0s5Cze6JThM7f7lj4da27PSJ/3w3tDFPvtQco11ksNLs
- Xd3qPaQIgmcNVCR06aexae3bBeTx9y3qHvKqZVE1nCtRlRyqy1LVKSj15J1D7yz7
- uS6u/BSZiCzmdZwu3Fq5qqoK0nfzWe/NKEDWNa5l4Mz/BZQyI/hbOpn6UfFD0LpK
- R4jzc9Dbk/IFNAvwb5yrgEYtwBzlXzeDvHW2JcPq3qQjK2byQYNiIyV3g0GHppEd
- vDbIPDFhTn3Hv5zz/lX+/We8izzRge7MEd+Vn9Jwb5NAzwDsOHl6ExpqASv9H49U
- HwgPw5pstabyrsDWXybSYUb+8LcZf+unGwIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- tinc.port = 993;
- };
- };
- ssh.privkey.path = <secrets/ssh.id_ed25519>;
- ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGv0JMp0y+E5433GRSFKVK3cQmP0AAlS9aH9fk49yFxy";
- };
prism = rec {
cores = 4;
extraZones = {
@@ -441,7 +408,7 @@ with import <stockholm/lib>;
};
};
};
- borg = {
+ rock = {
monitoring = false;
ci = false;
external = true;
@@ -449,22 +416,21 @@ with import <stockholm/lib>;
retiolum = {
ip4.addr = "10.243.29.171";
ip6.addr = "42:4992:6a6d:700::2";
- aliases = [ "borg.r" ];
+ aliases = [ "rock.r" ];
tinc.pubkey = ''
- -----BEGIN PUBLIC KEY-----
- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHZApTM7Hl4qqNakSwq
- bt7zJoTVK9ePoC3Mue1VmJ1mCKMaxKdzlO31kPeHtkilAzgyIJdgikyKFlApGsQL
- aIuU9h55X7TbikoDD6ghbSrAe3Pgc+sJ3OZ7wO7Qb8CKgJvEbkk/u68YiJgyTjYD
- HNjIQzlsGdpoSke9vwC8qWanfgN7c2MMGtakqfXDjYjCgp7O43i+SMupkMSXIXMA
- 5XUFh/vVp6xgPxBofcw0uQIyZ5v4PPFjnGPm4rnMbFzbhubntHjDadwGd5Niyw4O
- zNNKNchTLfNiuNGqTZeYd0kJ5fNMKykhpSs+ou34MvexvpuyPlFuotnPXN/nOMml
- 3nwiqzthzPuBZRLswxT0WvlA8wlbeTOKJ0wTIR4dDuAF+euDtoNocVEN5PJNc7yN
- fmwAV6geESoJbZQMSCtAp1NioaBlRPp1pFfoM/GotHywuFrTIxyoIBiYhkpWyQvq
- WYw5j13IKqkL7jDchhoBmcardmh+AP5bL3uQ84BgaYNwFzHp04qIRrrdpF0eMaHB
- /8zaqsNLn4/zQJB5ffkelwoIqfvLPQeCMLzHGHgP5xUnWgmZZGiiDLvhuaMeNq4U
- EpCKoTL178sPOgNfHfd8mEqx0qKYuPrNQEdlpa5xOZqwx56pfYpGWY+KtF2FHLhS
- iO64GCJqCi1MKBYx/NhaxKMCAwEAAQ==
- -----END PUBLIC KEY-----
+ -----BEGIN RSA PUBLIC KEY-----
+ MIICCgKCAgEAsMJbXDhkaLZcEzCIe8G+rHyLulWIqrUAmDT4Vbtv4r0QhPBsqwjM
+ DuvRtX5SNHdjfZWnUZoOlmXrmIo07exPFQvyrnppm6DNx+IZ5mNMNVIFUoojRhF7
+ HS2jubcjTEib56XEYWKly0olrVMbsJk5THJqRQyOQuTPCFToxXVRcT5t/UK6Dzgh
+ mp+suJ7IcmmO80IwfZrQrQslkQ6TdOy1Vs908GacSQJyRxdRxLraU/98iMhFbAQf
+ Ap+qVSUU88iCi+tcoSYzKhqU2N0AhRGcsE073B3Px8CAgPK/juwTrFElKEc17X9M
+ Rh41DvUjrtG4ERPmbwKPtsLagmnZUlU8A5YC8wtV08RI5QBsbbOsKInareV1aLeD
+ 91ZVCBPFTz8IM6Mc6H435eMCMC2ynFCDyRGdcue3tBQoaTGe1dbduIZkPGn+7cg4
+ fef1db6SQD4HCwDLv8CTFLACR/jmAapwZEgvJ3u3bpgMGzt+QNvL1cxUr3TBUWRv
+ 3f0R+Dj8DCUWTJUE7K5LO7bL4p9Ht0yIsVH+/DucyoMQqRwCwWSr7+H2MAsWviav
+ ZRRfH0RqZPEzCxyLDBtkVrx+GRAUZxy1xlqmN16O/sRHiqq3bv8Jk3dwuRZlFu6q
+ cOFu4g9XsamHkmCuVkvTGjnC2h21MjUUr3PGHzOMtiM/18LcfX730f8CAwEAAQ==
+ -----END RSA PUBLIC KEY-----
'';
};
};
diff --git a/krebs/5pkgs/simple/cgit-clear-cache.nix b/krebs/5pkgs/simple/cgit-clear-cache.nix
new file mode 100644
index 000000000..28402c39c
--- /dev/null
+++ b/krebs/5pkgs/simple/cgit-clear-cache.nix
@@ -0,0 +1,8 @@
+with import <stockholm/lib>;
+
+{ cache-root ? "/tmp/cgit", findutils, writeDashBin }:
+
+writeDashBin "cgit-clear-cache" ''
+ set -efu
+ ${findutils}/bin/find ${shell.escape cache-root} -type f -delete
+''
diff --git a/krebs/5pkgs/simple/krops.nix b/krebs/5pkgs/simple/krops.nix
index e4e9928d4..23cc224b8 100644
--- a/krebs/5pkgs/simple/krops.nix
+++ b/krebs/5pkgs/simple/krops.nix
@@ -2,6 +2,6 @@
fetchgit {
url = https://cgit.krebsco.de/krops;
- rev = "refs/tags/v1.1.0";
- sha256 = "19z5385rdci2bj0l7ksjbgyj84vsb29kz87j9x6vj5vv16y7y4ll";
+ rev = "refs/tags/v1.3.1";
+ sha256 = "0bv984bjc6r1ys1q0wnszv1v1g1wdvjb6i0ibj7namwz0mhg67a7";
}
diff --git a/krebs/krops.nix b/krebs/krops.nix
index c334bc07d..c71e60571 100644
--- a/krebs/krops.nix
+++ b/krebs/krops.nix
@@ -60,4 +60,9 @@
source = source { test = true; };
target = "${lib.getEnv "HOME"}/tmp/${name}-krops-test-src";
};
+
+ ci = pkgs.krops.writeTest "${name}-test" {
+ source = source { test = true; };
+ target = "${lib.getEnv "HOME"}/stockholm-build";
+ };
}
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 13bed8bfe..a9a0f6634 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
{
"url": "https://github.com/NixOS/nixpkgs-channels",
- "rev": "4df3426f5a5e78cef4835897a43abd9e2a092b74",
- "date": "2018-08-19T09:20:40+02:00",
- "sha256": "05k5mssiqxffxi45mss9wjns6k76i248rpasa48akdcriry1mp63",
+ "rev": "a37638d46706610d12c9747614fd1b8f8d35ad48",
+ "date": "2018-08-30T21:03:26+02:00",
+ "sha256": "0rsdkk4z7pkqr2mw0pq7i6fkqs7gbi5kral3c8smm9bw104sn8v7",
"fetchSubmodules": true
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 11:47:28 +0000