From 6ab41de256066d9870a8f2e260781a9a10365a94 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 13 Dec 2015 15:08:35 +0100 Subject: l 5 xmonad: add binding for mute buttons --- lass/5pkgs/xmonad-lass/Main.hs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lass/5pkgs/xmonad-lass/Main.hs b/lass/5pkgs/xmonad-lass/Main.hs index ce5afe33a..faaa00aab 100644 --- a/lass/5pkgs/xmonad-lass/Main.hs +++ b/lass/5pkgs/xmonad-lass/Main.hs @@ -125,6 +125,8 @@ myKeyMap = --, ("M4-r", spawn "exe=$(yeganesh -x) && eval \"exec $exe\"") , ("", spawn "pactl -- set-sink-volume 0 +4%") , ("", spawn "pactl -- set-sink-volume 0 -4%") + , ("", spawn "pactl -- set-sink-mute 0 toggle") + , ("", spawn "pactl -- set-source-mute 1 toggle") , ("", gridselectWorkspace myWSConfig W.view) , ("M4-a", focusUrgent) -- cgit v1.2.3 From 9c1207a52825da2f7d9c55304f864d68055cedb8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 14 Dec 2015 14:06:05 +0100 Subject: l 5 newsbot-js: rev b227296 -> 6ee4884 --- lass/5pkgs/newsbot-js/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lass/5pkgs/newsbot-js/default.nix b/lass/5pkgs/newsbot-js/default.nix index ace2a976f..0d194e6f3 100644 --- a/lass/5pkgs/newsbot-js/default.nix +++ b/lass/5pkgs/newsbot-js/default.nix @@ -26,8 +26,8 @@ in nodePackages.buildNodePackage { src = fetchgit { url = "http://cgit.echelon/newsbot-js/"; - rev = "b22729670236bfa6491207d57c5d7565137625ca"; - sha256 = "8ff00de56d85543399776c82d41d92ccc68000e5dce0f008d926748e188f3c69"; + rev = "6ee488430c6915eeae03f1569084577d39cef51d"; + sha256 = "00xmn7hzcs0mm6hjf5i37d9nna5rcd0gra0ynch7x2id8liazksx"; }; phases = [ -- cgit v1.2.3 From 57feffb3f65876cca3f10ef82e6e82283c02852d Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 21 Dec 2015 13:47:22 +0100 Subject: l 2 base: nixpkgs rev: 363c843 -> 93d8671 --- lass/2configs/base.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index 40f4e12c7..66e12b262 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -50,7 +50,7 @@ with lib; source = { git.nixpkgs = { url = https://github.com/Lassulus/nixpkgs; - rev = "363c8430f1efad8b03d5feae6b3a4f2fe7b29251"; + rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119"; }; dir.secrets = { host = config.krebs.hosts.mors; -- cgit v1.2.3 From 14d1655deb456d6be95463af2ca1524f7a1b7a98 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 16:30:01 +0100 Subject: s 1 test-centos7: prepare for ci --- shared/1systems/test-centos7.nix | 3 ++- shared/2configs/base.nix | 4 ++-- shared/2configs/temp/dirs.nix | 1 + shared/2configs/temp/networking.nix | 1 + 4 files changed, 6 insertions(+), 3 deletions(-) create mode 100644 shared/2configs/temp/dirs.nix create mode 100644 shared/2configs/temp/networking.nix diff --git a/shared/1systems/test-centos7.nix b/shared/1systems/test-centos7.nix index 077a5d61b..48cecc877 100644 --- a/shared/1systems/test-centos7.nix +++ b/shared/1systems/test-centos7.nix @@ -7,7 +7,8 @@ in { imports = [ ../2configs/base.nix ../2configs/os-templates/CAC-CentOS-7-64bit.nix - ../2configs/os-templates/temp-networking.nix + ../2configs/temp/networking.nix + ../2configs/temp/dirs.nix ]; sound.enable = false; diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index df41eae1a..fceea67d1 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -20,11 +20,11 @@ with lib; }; dir.secrets = { host = config.krebs.current.host; - path = "${getEnv "HOME"}/secrets/krebs/wolf"; + path = mkDefault "${getEnv "HOME"}/secrets/krebs/wolf"; }; dir.stockholm = { host = config.krebs.current.host; - path = "${getEnv "HOME"}/stockholm"; + path = mkDefault "${getEnv "HOME"}/stockholm"; }; }; diff --git a/shared/2configs/temp/dirs.nix b/shared/2configs/temp/dirs.nix new file mode 100644 index 000000000..958608a54 --- /dev/null +++ b/shared/2configs/temp/dirs.nix @@ -0,0 +1 @@ +_: { } diff --git a/shared/2configs/temp/networking.nix b/shared/2configs/temp/networking.nix new file mode 100644 index 000000000..958608a54 --- /dev/null +++ b/shared/2configs/temp/networking.nix @@ -0,0 +1 @@ +_: { } -- cgit v1.2.3 From e6b1003fe26e340be21a12e6e531259fd698f33f Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 16:30:23 +0100 Subject: k 5 krebs-ci: initial commit --- krebs/5pkgs/krebs-ci/default.nix | 37 +++++++++++++ krebs/5pkgs/krebs-ci/notes | 111 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 148 insertions(+) create mode 100644 krebs/5pkgs/krebs-ci/default.nix create mode 100755 krebs/5pkgs/krebs-ci/notes diff --git a/krebs/5pkgs/krebs-ci/default.nix b/krebs/5pkgs/krebs-ci/default.nix new file mode 100644 index 000000000..f5b302b52 --- /dev/null +++ b/krebs/5pkgs/krebs-ci/default.nix @@ -0,0 +1,37 @@ +{ stdenv, coreutils,makeWrapper, cac, cacpanel, gnumake, gnused, jq, openssh, ... }: + +stdenv.mkDerivation rec { + name = "krebs-ci-0.1.0"; + + src = ./notes; + + phases = [ + "installPhase" + ]; + buildInputs = [ makeWrapper ]; + + path = stdenv.lib.makeSearchPath "bin" [ + coreutils + cac + cacpanel + gnumake + gnused + jq + openssh + ]; + + installPhase = + '' + mkdir -p $out/bin + cp ${src} $out/bin/krebs-ci + chmod +x $out/bin/krebs-ci + wrapProgram $out/bin/krebs-ci \ + --prefix PATH : ${path} + ''; + meta = with stdenv.lib; { + homepage = http://krebsco.de; + description = "Krebs CI Scripts"; + license = licenses.wtfpl; + maintainers = [ maintainers.makefu ]; + }; +} diff --git a/krebs/5pkgs/krebs-ci/notes b/krebs/5pkgs/krebs-ci/notes new file mode 100755 index 000000000..7e34d6a28 --- /dev/null +++ b/krebs/5pkgs/krebs-ci/notes @@ -0,0 +1,111 @@ +#! /bin/sh + +# nix-shell -p gnumake jq openssh cac cacpanel +set -euf + +# 2 secrets are required: +krebs_cred=${krebs_cred-./cac.json} +retiolum_key=${retiolum_key-./retiolum.rsa_key.priv} + +# Sanity +if test ! -r "$krebs_cred";then + echo "\$krebs_cred=$krebs_cred must be readable"; exit 1 +fi +if test ! -r "$retiolum_key";then + echo "\$retiolum_key=$retiolum_key must be readable"; exit 1 +fi + +krebs_secrets=$(mktemp -d) +sec_file=$krebs_secrets/cac_config +krebs_ssh=$krebs_secrets/tempssh +# we need to receive this key from buildmaster to speed up tinc bootstrap +TRAP="rm $sec_file;rm -r $krebs_secrets" +trap "$TRAP" INT TERM EXIT + +cat > $sec_file <&1\ + | jq -r .servername) + +id=servername:$name +trap "cac delete $id;$TRAP" INT TERM EXIT +# TODO: timeout? +always_update=true cac waitstatus $id "Powered On" + +wait_login_cac(){ + # timeout + for t in `seq 60`;do + # now we have a working cac server + if cac ssh $1 cat /etc/redhat-release | \ + grep CentOS ;then + return 0 + fi + sleep 10 + done + return 1 +} +# die on timeout +wait_login_cac $id + +mkdir -p shared/2configs/temp +cac generatenetworking $id > \ + shared/2configs/temp/networking.nix +# new temporary ssh key we will use to log in after infest +ssh-keygen -f $krebs_ssh -N "" +cp $retiolum_key $krebs_secrets/retiolum.rsa_key.priv +# we override the directories for secrets and stockholm +# additionally we set the ssh key we generated +ip=$(cac getserver $id | jq -r .ip) + +cat > shared/2configs/temp/dirs.nix < $krebs_secrets/infest +sh -x $krebs_secrets/infest + +# TODO: generate secrets directory $krebs_secrets for nix import +cac powerop $id reset + +wait_login(){ + # timeout + for t in `seq 20`;do + # now we have a working cac server + if ssh -o StrictHostKeyChecking=no \ + -o UserKnownHostsFile=/dev/null \ + -i $krebs_ssh \ + -o ConnectTimeout=10 \ + -o BatchMode=yes \ + root@$1 nixos-version ;then + return 0 + fi + sleep 10 + done + return 1 +} +wait_login $ip -- cgit v1.2.3 From adbe4a5b4aaed8ea9a7edf20e088f2b74ec3216b Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 16:38:31 +0100 Subject: m 2 default: bump revision --- makefu/2configs/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index c0d7685e3..a0b49edaf 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -24,7 +24,7 @@ with lib; git.nixpkgs = { #url = https://github.com/NixOS/nixpkgs; url = mkDefault https://github.com/makefu/nixpkgs; - rev = mkDefault "78340b042463fd35caa587b0db2e400e5666dbe1"; # nixos-15.09 + cherry-picking + rev = mkDefault "3fd2c24685f604edc925f73ed56600b8c66236b3"; # nixos-15.09 + cherry-picking target-path = "/var/src/nixpkgs"; }; -- cgit v1.2.3 From 9ec4c5df3d132db078e89cb577860b6ec416be04 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 16:42:28 +0100 Subject: s 2 base: fix user,pubkey,secrets path --- shared/2configs/base.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index fceea67d1..c36061e38 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -13,6 +13,8 @@ with lib; ]; }; + # TODO rename shared user to "krebs" + krebs.build.user = config.krebs.users.shared; krebs.build.source = { git.nixpkgs = { url = https://github.com/NixOS/nixpkgs; @@ -20,7 +22,7 @@ with lib; }; dir.secrets = { host = config.krebs.current.host; - path = mkDefault "${getEnv "HOME"}/secrets/krebs/wolf"; + path = mkDefault "${getEnv "HOME"}/secrets/krebs/${config.krebs.build.host.name}"; }; dir.stockholm = { host = config.krebs.current.host; @@ -65,7 +67,7 @@ with lib; config.krebs.users.lass.pubkey config.krebs.users.makefu.pubkey # TODO HARDER: - (readFile ../../krebs/Zpubkeys/makefu_omo.ssh.pub) + config.krebs.users.makefu-omo.pubkey config.krebs.users.tv.pubkey ]; -- cgit v1.2.3 From c26ba8d7e674a02995ae613327208f4d9771546b Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 18:53:53 +0100 Subject: m 2 base: build user defaults to shared --- shared/1systems/wolf.nix | 2 -- shared/2configs/base.nix | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index 2c51ac8fe..fba4bd9b9 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -33,8 +33,6 @@ in # uninteresting stuff ##################### krebs.build.host = config.krebs.hosts.wolf; - # TODO rename shared user to "krebs" - krebs.build.user = config.krebs.users.shared; krebs.build.target = "wolf"; boot.kernel.sysctl = { diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index c36061e38..0ce336558 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -14,7 +14,7 @@ with lib; }; # TODO rename shared user to "krebs" - krebs.build.user = config.krebs.users.shared; + krebs.build.user = mkDefault config.krebs.users.shared; krebs.build.source = { git.nixpkgs = { url = https://github.com/NixOS/nixpkgs; -- cgit v1.2.3 From bf1b6482ce3535ef7e7b3f77879def12ff454c0c Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 19:36:19 +0100 Subject: mv makefu->krebs 3 buildbot --- krebs/3modules/buildbot/master.nix | 263 ++++++++++++++++++++++++++++++++ krebs/3modules/buildbot/slave.nix | 185 ++++++++++++++++++++++ krebs/3modules/default.nix | 2 + makefu/3modules/buildbot/master.nix | 263 -------------------------------- makefu/3modules/buildbot/slave.nix | 185 ---------------------- makefu/3modules/default.nix | 2 - shared/1systems/wolf.nix | 2 +- shared/2configs/buildbot-standalone.nix | 31 ++++ shared/2configs/cac-ci.nix | 11 -- 9 files changed, 482 insertions(+), 462 deletions(-) create mode 100644 krebs/3modules/buildbot/master.nix create mode 100644 krebs/3modules/buildbot/slave.nix delete mode 100644 makefu/3modules/buildbot/master.nix delete mode 100644 makefu/3modules/buildbot/slave.nix create mode 100644 shared/2configs/buildbot-standalone.nix delete mode 100644 shared/2configs/cac-ci.nix diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix new file mode 100644 index 000000000..2f73e44bc --- /dev/null +++ b/krebs/3modules/buildbot/master.nix @@ -0,0 +1,263 @@ +{ config, pkgs, lib, ... }: + +with lib; +let + buildbot = pkgs.buildbot; + buildbot-master-config = pkgs.writeText "buildbot-master.cfg" '' + # -*- python -*- + from buildbot.plugins import * + import re + + c = BuildmasterConfig = {} + + c['slaves'] = [] + # TODO: template potential buildslaves + # TODO: set password? + slavenames= [ 'testslave' ] + for i in slavenames: + c['slaves'].append(buildslave.BuildSlave(i, "krebspass")) + + c['protocols'] = {'pb': {'port': 9989}} + + ####### Build Inputs + stockholm_repo = 'http://cgit.gum/stockholm' + c['change_source'] = [] + c['change_source'].append(changes.GitPoller( + stockholm_repo, + workdir='stockholm-poller', branch='master', + project='stockholm', + pollinterval=120)) + + ####### Build Scheduler + # TODO: configure scheduler + c['schedulers'] = [] + + # test the master real quick + fast = schedulers.SingleBranchScheduler( + change_filter=util.ChangeFilter(branch="master"), + name="fast-master-test", + builderNames=["fast-tests"]) + + force = schedulers.ForceScheduler( + name="force", + builderNames=["full-tests"]) + + # files everyone depends on or are part of the share branch + def shared_files(change): + r =re.compile("^((krebs|share)/.*|Makefile|default.nix)") + for file in change.files: + if r.match(file): + return True + return False + + full = schedulers.SingleBranchScheduler( + change_filter=util.ChangeFilter(branch="master"), + fileIsImportant=shared_files, + name="full-master-test", + builderNames=["full-tests"]) + c['schedulers'] = [ fast, force, full ] + ###### The actual build + # couple of fast steps: + f = util.BuildFactory() + ## fetch repo + grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') + f.addStep(grab_repo) + + # the dependencies which are used by the test script + deps = [ "gnumake", "jq" ] + nixshell = ["nix-shell", "-p" ] + deps + [ "--run" ] + def addShell(f,**kwargs): + f.addStep(steps.ShellCommand(**kwargs)) + + addShell(f,name="centos7-eval",env={"LOGNAME": "shared", + "get" : "krebs.deploy", + "filter" : "json" + }, + command=nixshell + ["make -s eval system=test-centos7"]) + + addShell(f,name="wolf-eval",env={"LOGNAME": "shared", + "get" : "krebs.deploy", + "filter" : "json" + }, + command=nixshell + ["make -s eval system=wolf"]) + + c['builders'] = [] + c['builders'].append( + util.BuilderConfig(name="fast-tests", + slavenames=slavenames, + factory=f)) + + # TODO slow build + c['builders'].append( + util.BuilderConfig(name="full-tests", + slavenames=slavenames, + factory=f)) + + ####### Status of Builds + c['status'] = [] + + from buildbot.status import html + from buildbot.status.web import authz, auth + # TODO: configure if http is wanted + authz_cfg=authz.Authz( + # TODO: configure user/pw + auth=auth.BasicAuth([("krebs","bob")]), + gracefulShutdown = False, + forceBuild = 'auth', + forceAllBuilds = 'auth', + pingBuilder = False, + stopBuild = False, + stopAllBuilds = False, + cancelPendingBuild = False, + ) + # TODO: configure nginx + c['status'].append(html.WebStatus(http_port=8010, authz=authz_cfg)) + + from buildbot.status import words + ${optionalString (cfg.irc.enable) '' + irc = words.IRC("${cfg.irc.server}", "krebsbuild", + # TODO: multiple channels + channels=["${cfg.irc.channel}"], + notify_events={ + #'success': 1, + #'failure': 1, + 'exception': 1, + 'successToFailure': 1, + 'failureToSuccess': 1, + }${optionalString cfg.irc.allowForce ",allowForce=True"}) + c['status'].append(irc) + ''} + + ####### PROJECT IDENTITY + c['title'] = "Stockholm" + c['titleURL'] = "http://krebsco.de" + + #c['buildbotURL'] = "http://buildbot.krebsco.de/" + # TODO: configure url + c['buildbotURL'] = "http://vbob:8010/" + + ####### DB URL + c['db'] = { + 'db_url' : "sqlite:///state.sqlite", + } + ${cfg.extraConfig} + ''; + + cfg = config.krebs.buildbot.master; + + api = { + enable = mkEnableOption "Buildbot Master"; + workDir = mkOption { + default = "/var/lib/buildbot/master"; + type = types.str; + description = '' + Path to build bot master directory. + Will be created on startup. + ''; + }; + irc = mkOption { + default = {}; + type = types.submodule ({ config, ... }: { + options = { + enable = mkEnableOption "Buildbot Master IRC Status"; + channel = mkOption { + default = "nix-buildbot-meetup"; + type = types.str; + description = '' + irc channel the bot should connect to + ''; + }; + allowForce = mkOption { + default = false; + type = types.bool; + description = '' + Determines if builds can be forced via IRC + ''; + }; + nick = mkOption { + default = "nix-buildbot"; + type = types.str; + description = '' + nickname for IRC + ''; + }; + server = mkOption { + default = "irc.freenode.net"; + type = types.str; + description = '' + Buildbot Status IRC Server to connect to + ''; + }; + }; + }); + }; + + extraConfig = mkOption { + default = ""; + type = types.lines; + description = '' + extra config appended to the generated master.cfg + ''; + }; + }; + + imp = { + + users.extraUsers.buildbotMaster = { + uid = 672626386; #genid buildbotMaster + description = "Buildbot Master"; + home = cfg.workDir; + createHome = false; + }; + + users.extraGroups.buildbotMaster = { + gid = 672626386; + }; + + systemd.services.buildbotMaster = { + description = "Buildbot Master"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + path = [ pkgs.git ]; + serviceConfig = let + workdir="${lib.shell.escape cfg.workDir}"; + # TODO: check if git is the only dep + in { + PermissionsStartOnly = true; + Type = "forking"; + PIDFile = "${workdir}/twistd.pid"; + # TODO: maybe also prepare buildbot.tac? + ExecStartPre = pkgs.writeScript "buildbot-master-init" '' + #!/bin/sh + set -efux + if [ ! -e ${workdir} ];then + mkdir -p ${workdir} + ${buildbot}/bin/buildbot create-master -r -l 10 -f ${workdir} + fi + # always override the master.cfg + cp ${buildbot-master-config} ${workdir}/master.cfg + # sanity + ${buildbot}/bin/buildbot checkconfig ${workdir} + + # TODO: maybe upgrade? not sure about this + # normally we should write buildbot.tac by our own + # ${buildbot}/bin/buildbot upgrade-master ${workdir} + + chmod 700 -R ${workdir} + chown buildbotMaster:buildbotMaster -R ${workdir} + ''; + ExecStart = "${buildbot}/bin/buildbot start ${workdir}"; + ExecStop = "${buildbot}/bin/buildbot stop ${workdir}"; + ExecReload = "${buildbot}/bin/buildbot reconfig ${workdir}"; + PrivateTmp = "true"; + User = "buildbotMaster"; + Restart = "always"; + RestartSec = "10"; + }; + }; + }; +in +{ + options.krebs.buildbot.master = api; + config = mkIf cfg.enable imp; +} diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix new file mode 100644 index 000000000..65291f63e --- /dev/null +++ b/krebs/3modules/buildbot/slave.nix @@ -0,0 +1,185 @@ +{ config, pkgs, lib, ... }: + +with lib; +let + buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" '' + import os + + from buildslave.bot import BuildSlave + from twisted.application import service + + basedir = '${cfg.workDir}' + rotateLength = 10000000 + maxRotatedFiles = 10 + + application = service.Application('buildslave') + + from twisted.python.logfile import LogFile + from twisted.python.log import ILogObserver, FileLogObserver + logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength, + maxRotatedFiles=maxRotatedFiles) + application.setComponent(ILogObserver, FileLogObserver(logfile).emit) + + buildmaster_host = '${cfg.masterhost}' + # TODO: masterport? + port = 9989 + slavename = '${cfg.username}' + passwd = '${cfg.password}' + keepalive = 600 + usepty = 0 + umask = None + maxdelay = 300 + allow_shutdown = None + + ${cfg.extraConfig} + + s = BuildSlave(buildmaster_host, port, slavename, passwd, basedir, + keepalive, usepty, umask=umask, maxdelay=maxdelay, + allow_shutdown=allow_shutdown) + s.setServiceParent(application) + ''; + default-packages = [ pkgs.git pkgs.bash ]; + cfg = config.krebs.buildbot.slave; + + api = { + enable = mkEnableOption "Buildbot Slave"; + + workDir = mkOption { + default = "/var/lib/buildbot/slave"; + type = types.str; + description = '' + Path to build bot slave directory. + Will be created on startup. + ''; + }; + + masterhost = mkOption { + default = "localhost"; + type = types.str; + description = '' + Hostname/IP of the buildbot master + ''; + }; + + username = mkOption { + type = types.str; + description = '' + slavename used to authenticate with master + ''; + }; + + password = mkOption { + type = types.str; + description = '' + slave password used to authenticate with master + ''; + }; + + contact = mkOption { + default = "nix slave "; + type = types.str; + description = '' + contact to be announced by buildslave + ''; + }; + + description = mkOption { + default = "Nix Generated BuildSlave"; + type = types.str; + description = '' + description for hostto be announced by buildslave + ''; + }; + + packages = mkOption { + default = [ pkgs.git ]; + type = with types; listOf package; + description = '' + packages which should be in path for buildslave + ''; + }; + + extraEnviron = mkOption { + default = {}; + example = { + NIX_PATH = "nixpkgs=/path/to/my/nixpkgs"; + }; + type = types.attrsOf types.str; + description = '' + extra environment variables to be provided to the buildslave service + if you need nixpkgs, e.g. for running nix-shell you can set NIX_PATH here. + ''; + }; + + extraConfig = mkOption { + default = ""; + type = types.lines; + example = '' + port = 443 + keepalive = 600 + ''; + description = '' + extra config evaluated before calling BuildSlave init in .tac file + ''; + }; + }; + + imp = { + + users.extraUsers.buildbotSlave = { + uid = 1408105834; #genid buildbotMaster + description = "Buildbot Slave"; + home = cfg.workDir; + createHome = false; + }; + + users.extraGroups.buildbotSlave = { + gid = 1408105834; + }; + + systemd.services."buildbotSlave-${cfg.username}-${cfg.masterhost}" = { + description = "Buildbot Slave for ${cfg.username}@${cfg.masterhost}"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + path = default-packages ++ cfg.packages; + + environment = { + NIX_REMOTE="daemon"; + } // cfg.extraEnviron; + + serviceConfig = let + workdir = "${lib.shell.escape cfg.workDir}"; + contact = "${lib.shell.escape cfg.contact}"; + description = "${lib.shell.escape cfg.description}"; + buildbot = pkgs.buildbot-slave; + # TODO:make this + in { + PermissionsStartOnly = true; + Type = "forking"; + PIDFile = "${workdir}/twistd.pid"; + # TODO: maybe also prepare buildbot.tac? + ExecStartPre = pkgs.writeScript "buildbot-master-init" '' + #!/bin/sh + set -efux + mkdir -p ${workdir}/info + cp ${buildbot-slave-init} ${workdir}/buildbot.tac + echo ${contact} > ${workdir}/info/admin + echo ${description} > ${workdir}/info/host + + chown buildbotSlave:buildbotSlave -R ${workdir} + chmod 700 -R ${workdir} + ''; + ExecStart = "${buildbot}/bin/buildslave start ${workdir}"; + ExecStop = "${buildbot}/bin/buildslave stop ${workdir}"; + PrivateTmp = "true"; + User = "buildbotSlave"; + Restart = "always"; + RestartSec = "10"; + }; + }; + }; +in +{ + options.krebs.buildbot.slave = api; + config = mkIf cfg.enable imp; +} diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 740ba67b8..cbc1291fa 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -9,6 +9,8 @@ let ./apt-cacher-ng.nix ./bepasty-server.nix ./build.nix + ./buildbot/master.nix + ./buildbot/slave.nix ./current.nix ./exim-retiolum.nix ./exim-smarthost.nix diff --git a/makefu/3modules/buildbot/master.nix b/makefu/3modules/buildbot/master.nix deleted file mode 100644 index 58e2f8175..000000000 --- a/makefu/3modules/buildbot/master.nix +++ /dev/null @@ -1,263 +0,0 @@ -{ config, pkgs, lib, ... }: - -with lib; -let - buildbot = pkgs.buildbot; - buildbot-master-config = pkgs.writeText "buildbot-master.cfg" '' - # -*- python -*- - from buildbot.plugins import * - import re - - c = BuildmasterConfig = {} - - c['slaves'] = [] - # TODO: template potential buildslaves - # TODO: set password? - slavenames= [ 'testslave' ] - for i in slavenames: - c['slaves'].append(buildslave.BuildSlave(i, "krebspass")) - - c['protocols'] = {'pb': {'port': 9989}} - - ####### Build Inputs - stockholm_repo = 'http://cgit.gum/stockholm' - c['change_source'] = [] - c['change_source'].append(changes.GitPoller( - stockholm_repo, - workdir='stockholm-poller', branch='master', - project='stockholm', - pollinterval=120)) - - ####### Build Scheduler - # TODO: configure scheduler - c['schedulers'] = [] - - # test the master real quick - fast = schedulers.SingleBranchScheduler( - change_filter=util.ChangeFilter(branch="master"), - name="fast-master-test", - builderNames=["fast-tests"]) - - force = schedulers.ForceScheduler( - name="force", - builderNames=["full-tests"]) - - # files everyone depends on or are part of the share branch - def shared_files(change): - r =re.compile("^((krebs|share)/.*|Makefile|default.nix)") - for file in change.files: - if r.match(file): - return True - return False - - full = schedulers.SingleBranchScheduler( - change_filter=util.ChangeFilter(branch="master"), - fileIsImportant=shared_files, - name="full-master-test", - builderNames=["full-tests"]) - c['schedulers'] = [ fast, force, full ] - ###### The actual build - # couple of fast steps: - f = util.BuildFactory() - ## fetch repo - grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') - f.addStep(grab_repo) - - # the dependencies which are used by the test script - deps = [ "gnumake", "jq" ] - nixshell = ["nix-shell", "-p" ] + deps + [ "--run" ] - def addShell(f,**kwargs): - f.addStep(steps.ShellCommand(**kwargs)) - - addShell(f,name="centos7-eval",env={"LOGNAME": "shared", - "get" : "krebs.deploy", - "filter" : "json" - }, - command=nixshell + ["make -s eval system=test-centos7"]) - - addShell(f,name="wolf-eval",env={"LOGNAME": "shared", - "get" : "krebs.deploy", - "filter" : "json" - }, - command=nixshell + ["make -s eval system=wolf"]) - - c['builders'] = [] - c['builders'].append( - util.BuilderConfig(name="fast-tests", - slavenames=slavenames, - factory=f)) - - # TODO slow build - c['builders'].append( - util.BuilderConfig(name="full-tests", - slavenames=slavenames, - factory=f)) - - ####### Status of Builds - c['status'] = [] - - from buildbot.status import html - from buildbot.status.web import authz, auth - # TODO: configure if http is wanted - authz_cfg=authz.Authz( - # TODO: configure user/pw - auth=auth.BasicAuth([("krebs","bob")]), - gracefulShutdown = False, - forceBuild = 'auth', - forceAllBuilds = 'auth', - pingBuilder = False, - stopBuild = False, - stopAllBuilds = False, - cancelPendingBuild = False, - ) - # TODO: configure nginx - c['status'].append(html.WebStatus(http_port=8010, authz=authz_cfg)) - - from buildbot.status import words - ${optionalString (cfg.irc.enable) '' - irc = words.IRC("${cfg.irc.server}", "krebsbuild", - # TODO: multiple channels - channels=["${cfg.irc.channel}"], - notify_events={ - #'success': 1, - #'failure': 1, - 'exception': 1, - 'successToFailure': 1, - 'failureToSuccess': 1, - }${optionalString cfg.irc.allowForce ",allowForce=True"}) - c['status'].append(irc) - ''} - - ####### PROJECT IDENTITY - c['title'] = "Stockholm" - c['titleURL'] = "http://krebsco.de" - - #c['buildbotURL'] = "http://buildbot.krebsco.de/" - # TODO: configure url - c['buildbotURL'] = "http://vbob:8010/" - - ####### DB URL - c['db'] = { - 'db_url' : "sqlite:///state.sqlite", - } - ${cfg.extraConfig} - ''; - - cfg = config.makefu.buildbot.master; - - api = { - enable = mkEnableOption "Buildbot Master"; - workDir = mkOption { - default = "/var/lib/buildbot/master"; - type = types.str; - description = '' - Path to build bot master directory. - Will be created on startup. - ''; - }; - irc = mkOption { - default = {}; - type = types.submodule ({ config, ... }: { - options = { - enable = mkEnableOption "Buildbot Master IRC Status"; - channel = mkOption { - default = "nix-buildbot-meetup"; - type = types.str; - description = '' - irc channel the bot should connect to - ''; - }; - allowForce = mkOption { - default = false; - type = types.bool; - description = '' - Determines if builds can be forced via IRC - ''; - }; - nick = mkOption { - default = "nix-buildbot"; - type = types.str; - description = '' - nickname for IRC - ''; - }; - server = mkOption { - default = "irc.freenode.net"; - type = types.str; - description = '' - Buildbot Status IRC Server to connect to - ''; - }; - }; - }); - }; - - extraConfig = mkOption { - default = ""; - type = types.lines; - description = '' - extra config appended to the generated master.cfg - ''; - }; - }; - - imp = { - - users.extraUsers.buildbotMaster = { - uid = 672626386; #genid buildbotMaster - description = "Buildbot Master"; - home = cfg.workDir; - createHome = false; - }; - - users.extraGroups.buildbotMaster = { - gid = 672626386; - }; - - systemd.services.buildbotMaster = { - description = "Buildbot Master"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = [ pkgs.git ]; - serviceConfig = let - workdir="${lib.shell.escape cfg.workDir}"; - # TODO: check if git is the only dep - in { - PermissionsStartOnly = true; - Type = "forking"; - PIDFile = "${workdir}/twistd.pid"; - # TODO: maybe also prepare buildbot.tac? - ExecStartPre = pkgs.writeScript "buildbot-master-init" '' - #!/bin/sh - set -efux - if [ ! -e ${workdir} ];then - mkdir -p ${workdir} - ${buildbot}/bin/buildbot create-master -r -l 10 -f ${workdir} - fi - # always override the master.cfg - cp ${buildbot-master-config} ${workdir}/master.cfg - # sanity - ${buildbot}/bin/buildbot checkconfig ${workdir} - - # TODO: maybe upgrade? not sure about this - # normally we should write buildbot.tac by our own - # ${buildbot}/bin/buildbot upgrade-master ${workdir} - - chmod 700 -R ${workdir} - chown buildbotMaster:buildbotMaster -R ${workdir} - ''; - ExecStart = "${buildbot}/bin/buildbot start ${workdir}"; - ExecStop = "${buildbot}/bin/buildbot stop ${workdir}"; - ExecReload = "${buildbot}/bin/buildbot reconfig ${workdir}"; - PrivateTmp = "true"; - User = "buildbotMaster"; - Restart = "always"; - RestartSec = "10"; - }; - }; - }; -in -{ - options.makefu.buildbot.master = api; - config = mkIf cfg.enable imp; -} diff --git a/makefu/3modules/buildbot/slave.nix b/makefu/3modules/buildbot/slave.nix deleted file mode 100644 index 69d0361bf..000000000 --- a/makefu/3modules/buildbot/slave.nix +++ /dev/null @@ -1,185 +0,0 @@ -{ config, pkgs, lib, ... }: - -with lib; -let - buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" '' - import os - - from buildslave.bot import BuildSlave - from twisted.application import service - - basedir = '${cfg.workDir}' - rotateLength = 10000000 - maxRotatedFiles = 10 - - application = service.Application('buildslave') - - from twisted.python.logfile import LogFile - from twisted.python.log import ILogObserver, FileLogObserver - logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength, - maxRotatedFiles=maxRotatedFiles) - application.setComponent(ILogObserver, FileLogObserver(logfile).emit) - - buildmaster_host = '${cfg.masterhost}' - # TODO: masterport? - port = 9989 - slavename = '${cfg.username}' - passwd = '${cfg.password}' - keepalive = 600 - usepty = 0 - umask = None - maxdelay = 300 - allow_shutdown = None - - ${cfg.extraConfig} - - s = BuildSlave(buildmaster_host, port, slavename, passwd, basedir, - keepalive, usepty, umask=umask, maxdelay=maxdelay, - allow_shutdown=allow_shutdown) - s.setServiceParent(application) - ''; - default-packages = [ pkgs.git pkgs.bash ]; - cfg = config.makefu.buildbot.slave; - - api = { - enable = mkEnableOption "Buildbot Slave"; - - workDir = mkOption { - default = "/var/lib/buildbot/slave"; - type = types.str; - description = '' - Path to build bot slave directory. - Will be created on startup. - ''; - }; - - masterhost = mkOption { - default = "localhost"; - type = types.str; - description = '' - Hostname/IP of the buildbot master - ''; - }; - - username = mkOption { - type = types.str; - description = '' - slavename used to authenticate with master - ''; - }; - - password = mkOption { - type = types.str; - description = '' - slave password used to authenticate with master - ''; - }; - - contact = mkOption { - default = "nix slave "; - type = types.str; - description = '' - contact to be announced by buildslave - ''; - }; - - description = mkOption { - default = "Nix Generated BuildSlave"; - type = types.str; - description = '' - description for hostto be announced by buildslave - ''; - }; - - packages = mkOption { - default = [ pkgs.git ]; - type = with types; listOf package; - description = '' - packages which should be in path for buildslave - ''; - }; - - extraEnviron = mkOption { - default = {}; - example = { - NIX_PATH = "nixpkgs=/path/to/my/nixpkgs"; - }; - type = types.attrsOf types.str; - description = '' - extra environment variables to be provided to the buildslave service - if you need nixpkgs, e.g. for running nix-shell you can set NIX_PATH here. - ''; - }; - - extraConfig = mkOption { - default = ""; - type = types.lines; - example = '' - port = 443 - keepalive = 600 - ''; - description = '' - extra config evaluated before calling BuildSlave init in .tac file - ''; - }; - }; - - imp = { - - users.extraUsers.buildbotSlave = { - uid = 1408105834; #genid buildbotMaster - description = "Buildbot Slave"; - home = cfg.workDir; - createHome = false; - }; - - users.extraGroups.buildbotSlave = { - gid = 1408105834; - }; - - systemd.services."buildbotSlave-${cfg.username}-${cfg.masterhost}" = { - description = "Buildbot Slave for ${cfg.username}@${cfg.masterhost}"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = default-packages ++ cfg.packages; - - environment = { - NIX_REMOTE="daemon"; - } // cfg.extraEnviron; - - serviceConfig = let - workdir = "${lib.shell.escape cfg.workDir}"; - contact = "${lib.shell.escape cfg.contact}"; - description = "${lib.shell.escape cfg.description}"; - buildbot = pkgs.buildbot-slave; - # TODO:make this - in { - PermissionsStartOnly = true; - Type = "forking"; - PIDFile = "${workdir}/twistd.pid"; - # TODO: maybe also prepare buildbot.tac? - ExecStartPre = pkgs.writeScript "buildbot-master-init" '' - #!/bin/sh - set -efux - mkdir -p ${workdir}/info - cp ${buildbot-slave-init} ${workdir}/buildbot.tac - echo ${contact} > ${workdir}/info/admin - echo ${description} > ${workdir}/info/host - - chown buildbotSlave:buildbotSlave -R ${workdir} - chmod 700 -R ${workdir} - ''; - ExecStart = "${buildbot}/bin/buildslave start ${workdir}"; - ExecStop = "${buildbot}/bin/buildslave stop ${workdir}"; - PrivateTmp = "true"; - User = "buildbotSlave"; - Restart = "always"; - RestartSec = "10"; - }; - }; - }; -in -{ - options.makefu.buildbot.slave = api; - config = mkIf cfg.enable imp; -} diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix index ffbf54cc0..a8a1f69d0 100644 --- a/makefu/3modules/default.nix +++ b/makefu/3modules/default.nix @@ -2,8 +2,6 @@ _: { imports = [ - ./buildbot/master.nix - ./buildbot/slave.nix ]; } diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index fba4bd9b9..f05356f0f 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -11,7 +11,7 @@ in ../2configs/collectd-base.nix ../2configs/shack-nix-cacher.nix ../2configs/shack-drivedroid.nix - ../2configs/cac-ci.nix + ../2configs/buildbot-standalone.nix ../2configs/graphite.nix ]; # use your own binary cache, fallback use cache.nixos.org (which is used by diff --git a/shared/2configs/buildbot-standalone.nix b/shared/2configs/buildbot-standalone.nix new file mode 100644 index 000000000..adf44cada --- /dev/null +++ b/shared/2configs/buildbot-standalone.nix @@ -0,0 +1,31 @@ +{ lib, config, pkgs, ... }: +let + pkgs-unst = import (fetchTarball https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz) {}; +in { + nixpkgs.config.packageOverrides = pkgs: { + buildbot = pkgs-unst.buildbot; + buildbot-slave = pkgs-unst.buildbot-slave; + }; + networking.firewall.allowedTCPPorts = [ 8010 ]; + krebs.buildbot.master = { + enable = true; + irc = { + enable = true; + server = "cd.retiolum"; + channel = "retiolum"; + allowForce = true; + }; + extraConfig = '' + c['buildbotURL'] = "http://${config.krebs.build.host.name}:8010/" + ''; + }; + + krebs.buildbot.slave = { + enable = true; + masterhost = "localhost"; + username = "testslave"; + password = "krebspass"; + packages = with pkgs;[ git nix ]; + extraEnviron = { NIX_PATH="nixpkgs=${toString }"; }; + }; +} diff --git a/shared/2configs/cac-ci.nix b/shared/2configs/cac-ci.nix deleted file mode 100644 index 06cce2746..000000000 --- a/shared/2configs/cac-ci.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; -{ - environment.systemPackages = with pkgs;[ - get - cac - cacpanel - jq - ]; -} -- cgit v1.2.3 From 6c5921c9fc84211b42a93ab715a25dc7d77a1907 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 20:31:21 +0100 Subject: Makefile: fail if nix-instantiate fails --- Makefile | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index aefd17147..5b898c54c 100644 --- a/Makefile +++ b/Makefile @@ -35,7 +35,7 @@ ifeq ($(filter),json) else filter() { cat; } endif - nix-instantiate \ + result=$$(nix-instantiate \ $${extraArgs-} \ --eval \ -A "$$get" \ @@ -45,8 +45,9 @@ endif --argstr current-host-name "$$HOSTNAME" \ --argstr current-user-name "$$LOGNAME" \ $${system+--argstr system "$$system"} \ - $${target+--argstr target "$$target"} \ - | filter + $${target+--argstr target "$$target"}) + echo "$$result" | filter + else $(error unbound variable: system[s]) endif -- cgit v1.2.3 From 56e8346faa75fc42f65d11ea3569a3e5bdd252ec Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 20:53:11 +0100 Subject: k 5 krebs-ci: remove obsolete trap rm --- krebs/3modules/buildbot/master.nix | 2 +- krebs/5pkgs/krebs-ci/notes | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix index 2f73e44bc..e66e0d6b2 100644 --- a/krebs/3modules/buildbot/master.nix +++ b/krebs/3modules/buildbot/master.nix @@ -44,7 +44,7 @@ let # files everyone depends on or are part of the share branch def shared_files(change): - r =re.compile("^((krebs|share)/.*|Makefile|default.nix)") + r =re.compile("^((krebs|shared)/.*|Makefile|default.nix)") for file in change.files: if r.match(file): return True diff --git a/krebs/5pkgs/krebs-ci/notes b/krebs/5pkgs/krebs-ci/notes index 7e34d6a28..f6b193ddb 100755 --- a/krebs/5pkgs/krebs-ci/notes +++ b/krebs/5pkgs/krebs-ci/notes @@ -19,7 +19,7 @@ krebs_secrets=$(mktemp -d) sec_file=$krebs_secrets/cac_config krebs_ssh=$krebs_secrets/tempssh # we need to receive this key from buildmaster to speed up tinc bootstrap -TRAP="rm $sec_file;rm -r $krebs_secrets" +TRAP="rm -r $krebs_secrets" trap "$TRAP" INT TERM EXIT cat > $sec_file < Date: Tue, 22 Dec 2015 22:00:30 +0100 Subject: s 1 test-failing: add for CI --- shared/1systems/test-failing.nix | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 shared/1systems/test-failing.nix diff --git a/shared/1systems/test-failing.nix b/shared/1systems/test-failing.nix new file mode 100644 index 000000000..81a9e48d6 --- /dev/null +++ b/shared/1systems/test-failing.nix @@ -0,0 +1,6 @@ +{ config, pkgs, ... }: + +{ + programs.ssh.startAgent = true; + programs.ssh.startAgent = false; +} -- cgit v1.2.3 From 1a184c98a21ed32447bb4a88f7c865adef5a535f Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 22 Dec 2015 23:37:12 +0100 Subject: k 5 krebs-ci: set cache files manually --- krebs/5pkgs/krebs-ci/notes | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/krebs/5pkgs/krebs-ci/notes b/krebs/5pkgs/krebs-ci/notes index f6b193ddb..f6f3da8db 100755 --- a/krebs/5pkgs/krebs-ci/notes +++ b/krebs/5pkgs/krebs-ci/notes @@ -1,9 +1,10 @@ #! /bin/sh # nix-shell -p gnumake jq openssh cac cacpanel -set -euf +set -eufx # 2 secrets are required: + krebs_cred=${krebs_cred-./cac.json} retiolum_key=${retiolum_key-./retiolum.rsa_key.priv} @@ -18,8 +19,12 @@ fi krebs_secrets=$(mktemp -d) sec_file=$krebs_secrets/cac_config krebs_ssh=$krebs_secrets/tempssh +cac_resources_cache=$krebs_secrets/res_cache.json +cac_servers_cache=$krebs_secrets/servers_cache.json +cac_tasks_cache=$krebs_secrets/tasks_cache.json +cac_templates_cache=$krebs_secrets/templates_cache.json # we need to receive this key from buildmaster to speed up tinc bootstrap -TRAP="rm -r $krebs_secrets" +TRAP="rm -r $krebs_secrets;exit" trap "$TRAP" INT TERM EXIT cat > $sec_file <&1\ id=servername:$name trap "cac delete $id;$TRAP" INT TERM EXIT # TODO: timeout? -always_update=true cac waitstatus $id "Powered On" +# cac_always_update=true cac waitstatus $id "Powered On" wait_login_cac(){ # timeout - for t in `seq 60`;do + for t in `seq 180`;do # now we have a working cac server if cac ssh $1 cat /etc/redhat-release | \ grep CentOS ;then -- cgit v1.2.3 From f59080e76f950a5a8e33d1edd4314ffaa14187fc Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 23 Dec 2015 00:06:27 +0100 Subject: m 3 buildbot: add new slow factory to complete integration test --- krebs/3modules/buildbot/master.nix | 47 +++++++++++++++++++++++++------------- krebs/5pkgs/krebs-ci/notes | 8 +++---- 2 files changed, 35 insertions(+), 20 deletions(-) diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix index e66e0d6b2..0d9c53977 100644 --- a/krebs/3modules/buildbot/master.nix +++ b/krebs/3modules/buildbot/master.nix @@ -59,27 +59,28 @@ let ###### The actual build # couple of fast steps: f = util.BuildFactory() + # some slow steps + s = util.BuildFactory() ## fetch repo grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') f.addStep(grab_repo) + s.addStep(grab_repo) # the dependencies which are used by the test script - deps = [ "gnumake", "jq" ] - nixshell = ["nix-shell", "-p" ] + deps + [ "--run" ] + deps = [ "gnumake", "jq", "(import {}).pkgs.krebs-ci" ] + nixshell = ["nix-shell", "-I", ".", "-p" ] + deps + [ "--run" ] + def addShell(f,**kwargs): f.addStep(steps.ShellCommand(**kwargs)) - addShell(f,name="centos7-eval",env={"LOGNAME": "shared", - "get" : "krebs.deploy", - "filter" : "json" - }, - command=nixshell + ["make -s eval system=test-centos7"]) + addShell(f,name="centos7-eval",env={"LOGNAME": "shared"}, + command=nixshell + ["make -s eval get=krebs.deploy filter=json system=test-centos7"]) + + addShell(f,name="wolf-eval",env={"LOGNAME": "shared"}, + command=nixshell + ["make -s eval get=krebs.deploy filter=json system=wolf"]) - addShell(f,name="wolf-eval",env={"LOGNAME": "shared", - "get" : "krebs.deploy", - "filter" : "json" - }, - command=nixshell + ["make -s eval system=wolf"]) + addShell(f,name="eval-cross-check",env={"LOGNAME": "shared"}, + command=nixshell + ["! make eval get=krebs.deploy filter=json system=test-failing"]) c['builders'] = [] c['builders'].append( @@ -87,11 +88,20 @@ let slavenames=slavenames, factory=f)) - # TODO slow build + # slave needs 2 files: + # * cac.json + # * retiolum + for file in ["cac.json", "retiolum.rsa_key.priv"]: + s.addStep(steps.FileDownload(mastersrc="${cfg.workDir}/{}".format(file), + slavedest=file)) + + addShell(s,name="complete-build-centos7",env={"LOGNAME": "shared"}, + command=nix-shell + ["krebs-ci"]) + c['builders'].append( util.BuilderConfig(name="full-tests", slavenames=slavenames, - factory=f)) + factory=s)) ####### Status of Builds c['status'] = [] @@ -119,8 +129,8 @@ let # TODO: multiple channels channels=["${cfg.irc.channel}"], notify_events={ - #'success': 1, - #'failure': 1, + 'success': 1, + 'failure': 1, 'exception': 1, 'successToFailure': 1, 'failureToSuccess': 1, @@ -221,6 +231,7 @@ let path = [ pkgs.git ]; serviceConfig = let workdir="${lib.shell.escape cfg.workDir}"; + secretsdir="${lib.shell.escape (toString )}"; # TODO: check if git is the only dep in { PermissionsStartOnly = true; @@ -236,6 +247,10 @@ let fi # always override the master.cfg cp ${buildbot-master-config} ${workdir}/master.cfg + # copy secrets + cp ${secretsdir}/cac.json ${workdir} + cp ${secretsdir}/retiolum-ci.rsa_key.priv \ + ${workdir}/retiolum.rsa_key.priv # sanity ${buildbot}/bin/buildbot checkconfig ${workdir} diff --git a/krebs/5pkgs/krebs-ci/notes b/krebs/5pkgs/krebs-ci/notes index f6f3da8db..f162656f7 100755 --- a/krebs/5pkgs/krebs-ci/notes +++ b/krebs/5pkgs/krebs-ci/notes @@ -19,10 +19,10 @@ fi krebs_secrets=$(mktemp -d) sec_file=$krebs_secrets/cac_config krebs_ssh=$krebs_secrets/tempssh -cac_resources_cache=$krebs_secrets/res_cache.json -cac_servers_cache=$krebs_secrets/servers_cache.json -cac_tasks_cache=$krebs_secrets/tasks_cache.json -cac_templates_cache=$krebs_secrets/templates_cache.json +export cac_resources_cache=$krebs_secrets/res_cache.json +export cac_servers_cache=$krebs_secrets/servers_cache.json +export cac_tasks_cache=$krebs_secrets/tasks_cache.json +export cac_templates_cache=$krebs_secrets/templates_cache.json # we need to receive this key from buildmaster to speed up tinc bootstrap TRAP="rm -r $krebs_secrets;exit" trap "$TRAP" INT TERM EXIT -- cgit v1.2.3 From dc8e270d2a5346e4316b7c2050b26fd428ec3fc3 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 23 Dec 2015 00:06:27 +0100 Subject: m 3 buildbot: add new slow factory to complete integration test --- krebs/3modules/buildbot/master.nix | 52 +++++++++++++++++++++++++------------- krebs/3modules/buildbot/slave.nix | 1 + krebs/5pkgs/krebs-ci/notes | 8 +++--- 3 files changed, 40 insertions(+), 21 deletions(-) diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix index e66e0d6b2..b4fd6bb2f 100644 --- a/krebs/3modules/buildbot/master.nix +++ b/krebs/3modules/buildbot/master.nix @@ -59,27 +59,28 @@ let ###### The actual build # couple of fast steps: f = util.BuildFactory() + # some slow steps + s = util.BuildFactory() ## fetch repo grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') f.addStep(grab_repo) + s.addStep(grab_repo) # the dependencies which are used by the test script - deps = [ "gnumake", "jq" ] - nixshell = ["nix-shell", "-p" ] + deps + [ "--run" ] + deps = [ "gnumake", "jq", "(import {}).pkgs.krebs-ci" ] + nixshell = ["nix-shell", "-I", "stockholm=.", "-p" ] + deps + [ "--run" ] + def addShell(f,**kwargs): f.addStep(steps.ShellCommand(**kwargs)) - addShell(f,name="centos7-eval",env={"LOGNAME": "shared", - "get" : "krebs.deploy", - "filter" : "json" - }, - command=nixshell + ["make -s eval system=test-centos7"]) + addShell(f,name="centos7-eval",env={"LOGNAME": "shared"}, + command=nixshell + ["make -s eval get=krebs.deploy filter=json system=test-centos7"]) + + addShell(f,name="wolf-eval",env={"LOGNAME": "shared"}, + command=nixshell + ["make -s eval get=krebs.deploy filter=json system=wolf"]) - addShell(f,name="wolf-eval",env={"LOGNAME": "shared", - "get" : "krebs.deploy", - "filter" : "json" - }, - command=nixshell + ["make -s eval system=wolf"]) + addShell(f,name="eval-cross-check",env={"LOGNAME": "shared"}, + command=nixshell + ["! make eval get=krebs.deploy filter=json system=test-failing"]) c['builders'] = [] c['builders'].append( @@ -87,11 +88,20 @@ let slavenames=slavenames, factory=f)) - # TODO slow build + # slave needs 2 files: + # * cac.json + # * retiolum + for file in ["cac.json", "retiolum.rsa_key.priv"]: + s.addStep(steps.FileDownload(mastersrc="${cfg.workDir}/{}".format(file), + slavedest=file)) + + addShell(s,name="complete-build-centos7",env={"LOGNAME": "shared"}, + command=nixshell + ["krebs-ci"]) + c['builders'].append( util.BuilderConfig(name="full-tests", slavenames=slavenames, - factory=f)) + factory=s)) ####### Status of Builds c['status'] = [] @@ -106,7 +116,7 @@ let forceBuild = 'auth', forceAllBuilds = 'auth', pingBuilder = False, - stopBuild = False, + stopBuild = 'auth', stopAllBuilds = False, cancelPendingBuild = False, ) @@ -119,8 +129,8 @@ let # TODO: multiple channels channels=["${cfg.irc.channel}"], notify_events={ - #'success': 1, - #'failure': 1, + 'success': 1, + 'failure': 1, 'exception': 1, 'successToFailure': 1, 'failureToSuccess': 1, @@ -219,8 +229,12 @@ let after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; path = [ pkgs.git ]; + environment = { + SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + }; serviceConfig = let workdir="${lib.shell.escape cfg.workDir}"; + secretsdir="${lib.shell.escape (toString )}"; # TODO: check if git is the only dep in { PermissionsStartOnly = true; @@ -236,6 +250,10 @@ let fi # always override the master.cfg cp ${buildbot-master-config} ${workdir}/master.cfg + # copy secrets + cp ${secretsdir}/cac.json ${workdir} + cp ${secretsdir}/retiolum-ci.rsa_key.priv \ + ${workdir}/retiolum.rsa_key.priv # sanity ${buildbot}/bin/buildbot checkconfig ${workdir} diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix index 65291f63e..8711a287a 100644 --- a/krebs/3modules/buildbot/slave.nix +++ b/krebs/3modules/buildbot/slave.nix @@ -144,6 +144,7 @@ let path = default-packages ++ cfg.packages; environment = { + SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; NIX_REMOTE="daemon"; } // cfg.extraEnviron; diff --git a/krebs/5pkgs/krebs-ci/notes b/krebs/5pkgs/krebs-ci/notes index f6f3da8db..f162656f7 100755 --- a/krebs/5pkgs/krebs-ci/notes +++ b/krebs/5pkgs/krebs-ci/notes @@ -19,10 +19,10 @@ fi krebs_secrets=$(mktemp -d) sec_file=$krebs_secrets/cac_config krebs_ssh=$krebs_secrets/tempssh -cac_resources_cache=$krebs_secrets/res_cache.json -cac_servers_cache=$krebs_secrets/servers_cache.json -cac_tasks_cache=$krebs_secrets/tasks_cache.json -cac_templates_cache=$krebs_secrets/templates_cache.json +export cac_resources_cache=$krebs_secrets/res_cache.json +export cac_servers_cache=$krebs_secrets/servers_cache.json +export cac_tasks_cache=$krebs_secrets/tasks_cache.json +export cac_templates_cache=$krebs_secrets/templates_cache.json # we need to receive this key from buildmaster to speed up tinc bootstrap TRAP="rm -r $krebs_secrets;exit" trap "$TRAP" INT TERM EXIT -- cgit v1.2.3 From 14ddb767eb10dbe43d3112c4b4674f6c1d4ff32a Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 23 Dec 2015 11:18:00 +0100 Subject: k 5 mv krebs-ci test/infest-cac-centos7 --- krebs/3modules/buildbot/master.nix | 6 +- krebs/5pkgs/default.nix | 4 + krebs/5pkgs/krebs-ci/default.nix | 37 -------- krebs/5pkgs/krebs-ci/notes | 116 ----------------------- krebs/5pkgs/test/infest-cac-centos7/default.nix | 39 ++++++++ krebs/5pkgs/test/infest-cac-centos7/notes | 117 ++++++++++++++++++++++++ 6 files changed, 163 insertions(+), 156 deletions(-) delete mode 100644 krebs/5pkgs/krebs-ci/default.nix delete mode 100755 krebs/5pkgs/krebs-ci/notes create mode 100644 krebs/5pkgs/test/infest-cac-centos7/default.nix create mode 100755 krebs/5pkgs/test/infest-cac-centos7/notes diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix index b4fd6bb2f..483ba18e7 100644 --- a/krebs/3modules/buildbot/master.nix +++ b/krebs/3modules/buildbot/master.nix @@ -67,7 +67,7 @@ let s.addStep(grab_repo) # the dependencies which are used by the test script - deps = [ "gnumake", "jq", "(import {}).pkgs.krebs-ci" ] + deps = [ "gnumake", "jq", "(import {}).pkgs.test.infest-cac-centos7" ] nixshell = ["nix-shell", "-I", "stockholm=.", "-p" ] + deps + [ "--run" ] def addShell(f,**kwargs): @@ -95,8 +95,8 @@ let s.addStep(steps.FileDownload(mastersrc="${cfg.workDir}/{}".format(file), slavedest=file)) - addShell(s,name="complete-build-centos7",env={"LOGNAME": "shared"}, - command=nixshell + ["krebs-ci"]) + addShell(s,name="infest-cac-centos7",env={"LOGNAME": "shared"}, + command=nixshell + ["infest-cac-centos7"]) c['builders'].append( util.BuilderConfig(name="full-tests", diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index 7df7b7d3c..0562fe836 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -40,6 +40,10 @@ subdirs // rec { } ''; + test = { + infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {}; + }; + execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; }); writeC = name: { destination ? "" }: src: pkgs.runCommand name {} '' diff --git a/krebs/5pkgs/krebs-ci/default.nix b/krebs/5pkgs/krebs-ci/default.nix deleted file mode 100644 index f5b302b52..000000000 --- a/krebs/5pkgs/krebs-ci/default.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ stdenv, coreutils,makeWrapper, cac, cacpanel, gnumake, gnused, jq, openssh, ... }: - -stdenv.mkDerivation rec { - name = "krebs-ci-0.1.0"; - - src = ./notes; - - phases = [ - "installPhase" - ]; - buildInputs = [ makeWrapper ]; - - path = stdenv.lib.makeSearchPath "bin" [ - coreutils - cac - cacpanel - gnumake - gnused - jq - openssh - ]; - - installPhase = - '' - mkdir -p $out/bin - cp ${src} $out/bin/krebs-ci - chmod +x $out/bin/krebs-ci - wrapProgram $out/bin/krebs-ci \ - --prefix PATH : ${path} - ''; - meta = with stdenv.lib; { - homepage = http://krebsco.de; - description = "Krebs CI Scripts"; - license = licenses.wtfpl; - maintainers = [ maintainers.makefu ]; - }; -} diff --git a/krebs/5pkgs/krebs-ci/notes b/krebs/5pkgs/krebs-ci/notes deleted file mode 100755 index f162656f7..000000000 --- a/krebs/5pkgs/krebs-ci/notes +++ /dev/null @@ -1,116 +0,0 @@ -#! /bin/sh - -# nix-shell -p gnumake jq openssh cac cacpanel -set -eufx - -# 2 secrets are required: - -krebs_cred=${krebs_cred-./cac.json} -retiolum_key=${retiolum_key-./retiolum.rsa_key.priv} - -# Sanity -if test ! -r "$krebs_cred";then - echo "\$krebs_cred=$krebs_cred must be readable"; exit 1 -fi -if test ! -r "$retiolum_key";then - echo "\$retiolum_key=$retiolum_key must be readable"; exit 1 -fi - -krebs_secrets=$(mktemp -d) -sec_file=$krebs_secrets/cac_config -krebs_ssh=$krebs_secrets/tempssh -export cac_resources_cache=$krebs_secrets/res_cache.json -export cac_servers_cache=$krebs_secrets/servers_cache.json -export cac_tasks_cache=$krebs_secrets/tasks_cache.json -export cac_templates_cache=$krebs_secrets/templates_cache.json -# we need to receive this key from buildmaster to speed up tinc bootstrap -TRAP="rm -r $krebs_secrets;exit" -trap "$TRAP" INT TERM EXIT - -cat > $sec_file <&1\ - | jq -r .servername) - -id=servername:$name -trap "cac delete $id;$TRAP" INT TERM EXIT -# TODO: timeout? -# cac_always_update=true cac waitstatus $id "Powered On" - -wait_login_cac(){ - # timeout - for t in `seq 180`;do - # now we have a working cac server - if cac ssh $1 cat /etc/redhat-release | \ - grep CentOS ;then - return 0 - fi - sleep 10 - done - return 1 -} -# die on timeout -wait_login_cac $id - -mkdir -p shared/2configs/temp -cac generatenetworking $id > \ - shared/2configs/temp/networking.nix -# new tem