feat: enable Lix admins to admin the Buildbot properly

This removes the need for a proxy and let *@lix.systems folks to
be able to admin the Buildbot instance.

Our authentication layer should confirm emails to avoid someone
impersonating a @lix.systems user and grant themselves trivial admin
rights.

Signed-off-by: Raito Bezarius <raito@lix.systems>

buildbot_nix/__init__.py

@@ -17,7 +17,6 @@ from buildbot.process.properties import Interpolate, Properties
 from buildbot.process.results import ALL_RESULTS, statusToString
 from buildbot.steps.trigger import Trigger
 from buildbot.util import asyncSleep
-from buildbot.www.authz.endpointmatchers import EndpointMatcherBase, Match
 from buildbot.www.oauth2 import OAuth2Auth
 from buildbot.changes.gerritchangesource import GerritChangeSource
 from buildbot.reporters.utils import getURLForBuild
@@ -901,3 +900,16 @@ class GerritNixConfigurator(ConfiguratorBase):
 
         if "auth" not in config["www"]:
             config["www"]["auth"] = LixSystemsOAuth2('buildbot', read_secret_file('buildbot-oauth2-secret'), autologin=True)
+
+        if "authz" not in config["www"]:
+            config["www"]["authz"] = util.Authz(
+                allowRules=[
+                    util.AnyEndpointMatcher(role="admins", defaultDeny=False),
+                    util.StopBuildEndpointMatcher(role="owner"),
+                    util.AnyControlEndpointMatcher(role="admins"),
+                ],
+                roleMatcher=[
+                    util.RolesFromDomain(admins=["lix.systems"]),
+                    util.RolesFromOwner(role="owner")
+                ],
+            )