lix-project/buildbot-nix
15
0
Fork 0
Code Issues 12 Pull requests 6 Packages Projects Releases Wiki Activity

fix(gerrit): make buildbot able to read the priv ssh key

Browse source 
Signed-off-by: Raito Bezarius <raito@lix.systems>
This commit is contained in:
raito 2024-07-19 19:24:33 +02:00 committed by Jade Lovelace
parent 965cd014b3
commit b20d0a17ba
2 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
buildbot_nix/__init__.py
View file

@ -627,15 +627,15 @@ def nix_build_config(
factory=factory, factory=factory,
) )
def assemble_secret_file_path(secret_name: str) -> Path:
def read_secret_file(secret_name: str) -> str:
directory = os.environ.get("CREDENTIALS_DIRECTORY") directory = os.environ.get("CREDENTIALS_DIRECTORY")
if directory is None: if directory is None:
print("directory not set", file=sys.stderr) print("directory not set", file=sys.stderr)
sys.exit(1) sys.exit(1)
return Path(directory).joinpath(secret_name).read_text().rstrip() return Path(directory).joinpath(secret_name)
def read_secret_file(secret_name: str) -> str:
return assemble_secret_file_path(secret_name).read_text().rstrip()
def config_for_project( def config_for_project(
config: dict[str, Any], config: dict[str, Any],

5
nix/coordinator.nix
View file

@ -207,7 +207,7 @@ in
home = "/var/lib/buildbot"; home = "/var/lib/buildbot";
extraImports = '' extraImports = ''
from datetime import timedelta from datetime import timedelta
from buildbot_nix import GerritNixConfigurator, read_secret_file, make_oauth2_method, OAuth2Config from buildbot_nix import GerritNixConfigurator, read_secret_file, make_oauth2_method, OAuth2Config, assemble_secret_file_path
# TODO(raito): make me configurable from the NixOS module. # TODO(raito): make me configurable from the NixOS module.
# how? # how?
@ -229,7 +229,7 @@ in
"${cfg.gerrit.domain}", "${cfg.gerrit.domain}",
"${cfg.gerrit.username}", "${cfg.gerrit.username}",
"${toString cfg.gerrit.port}", "${toString cfg.gerrit.port}",
"${cfg.gerrit.privateKeyFile}", assemble_secret_file_path('buildbot-service-private-key'),
projects=${builtins.toJSON cfg.gerrit.projects}, projects=${builtins.toJSON cfg.gerrit.projects},
allowed_origins=${builtins.toJSON cfg.allowedOrigins}, allowed_origins=${builtins.toJSON cfg.allowedOrigins},
url=${builtins.toJSON config.services.buildbot-master.buildbotUrl}, url=${builtins.toJSON config.services.buildbot-master.buildbotUrl},
@ -293,6 +293,7 @@ in
LoadCredential = [ LoadCredential = [
"buildbot-nix-workers:${cfg.workersFile}" "buildbot-nix-workers:${cfg.workersFile}"
"buildbot-oauth2-secret:${cfg.oauth2.clientSecretFile}" "buildbot-oauth2-secret:${cfg.oauth2.clientSecretFile}"
"buildbot-service-private-key:${cfg.gerrit.privateKeyFile}"
]; ];
}; };
}; };