lix-project/buildbot-nix
15
0
Fork 0
Code Issues 6 Pull requests 2 Packages Projects Releases Wiki Activity

feat: enable Lix admins to admin the Buildbot properly

Browse source 
This removes the need for a proxy and let *@lix.systems folks to
be able to admin the Buildbot instance.

Our authentication layer should confirm emails to avoid someone
impersonating a @lix.systems user and grant themselves trivial admin
rights.

Signed-off-by: Raito Bezarius <raito@lix.systems>
This commit is contained in:
raito 2024-06-09 17:01:32 +02:00
parent 45135d249b
commit 97a2b79dba
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
buildbot_nix/__init__.py
View file

@ -17,7 +17,6 @@ from buildbot.process.properties import Interpolate, Properties
from buildbot.process.results import ALL_RESULTS, statusToString from buildbot.process.results import ALL_RESULTS, statusToString
from buildbot.steps.trigger import Trigger from buildbot.steps.trigger import Trigger
from buildbot.util import asyncSleep from buildbot.util import asyncSleep
from buildbot.www.authz.endpointmatchers import EndpointMatcherBase, Match
from buildbot.www.oauth2 import OAuth2Auth from buildbot.www.oauth2 import OAuth2Auth
from buildbot.changes.gerritchangesource import GerritChangeSource from buildbot.changes.gerritchangesource import GerritChangeSource
from buildbot.reporters.utils import getURLForBuild from buildbot.reporters.utils import getURLForBuild
@ -901,3 +900,16 @@ class GerritNixConfigurator(ConfiguratorBase):
if "auth" not in config["www"]: if "auth" not in config["www"]:
config["www"]["auth"] = LixSystemsOAuth2('buildbot', read_secret_file('buildbot-oauth2-secret'), autologin=True) config["www"]["auth"] = LixSystemsOAuth2('buildbot', read_secret_file('buildbot-oauth2-secret'), autologin=True)
if "authz" not in config["www"]:
config["www"]["authz"] = util.Authz(
allowRules=[
util.AnyEndpointMatcher(role="admins", defaultDeny=False),
util.StopBuildEndpointMatcher(role="owner"),
util.AnyControlEndpointMatcher(role="admins"),
],
roleMatcher=[
util.RolesFromDomain(admins=["lix.systems"]),
util.RolesFromOwner(role="owner")
],
)