diff --git a/flake.lock b/flake.lock index 0f3747d..9c928e2 100644 --- a/flake.lock +++ b/flake.lock @@ -64,11 +64,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1715022238, - "narHash": "sha256-sDD6WWJXJ/1j07aQE0RAUlrQBekXABtEKm7gtaTN45w=", + "lastModified": 1721226289, + "narHash": "sha256-4yckSZkrP1dNIWXdB2YPM7jLfe24NscNmwQZGrBtcs4=", "ref": "refs/heads/refactor", - "rev": "d5e3345097cdda5c74bccddb27abb5b5c84eff5b", - "revCount": 257, + "rev": "13e4d080c3c7419610cca04bd20fe5335f78621d", + "revCount": 259, "type": "git", "url": "https://git.lix.systems/lix-project/buildbot-nix.git" }, diff --git a/secrets.nix b/secrets.nix index e4b3446..6bc7773 100644 --- a/secrets.nix +++ b/secrets.nix @@ -13,6 +13,15 @@ let loki-environment = [ machines.meta01 ]; gerrit-prometheus-bearer-token = [ machines.gerrit01 machines.meta01 ]; + buildbot-worker-password = [ machines.buildbot ]; + buildbot-oauth-secret = [ machines.buildbot ]; + buildbot-workers = [ machines.buildbot ]; + # Private SSH key to Gerrit + # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHx52RUPWzTa2rBA96xcnGjjzAboNN/hm6gW+Q6JiSos + buildbot-service-key = [ machines.buildbot ]; + # Signing key for Buildbot's specific cache + buildbot-signing-key = [ machines.buildbot ]; + # These are the same password, but nginx wants it in htpasswd format metrics-push-htpasswd = [ machines.meta01 ]; metrics-push-password = builtins.attrValues machines; diff --git a/secrets/buildbot-oauth-secret.age b/secrets/buildbot-oauth-secret.age new file mode 100644 index 0000000..94e62b4 --- /dev/null +++ b/secrets/buildbot-oauth-secret.age @@ -0,0 +1,20 @@ +age-encryption.org/v1 +-> ssh-ed25519 87T2Ig vfLpqc38U9RwGG1QmSSl5YTXcOU0eoTrpmBjVpP+9xE +XbCUtuC9G9zSyVIgUmH0TO2sdH/3YjAf1erstVAUnHQ +-> ssh-ed25519 K3b7BA zk89m8PXhx59Jf7ovoSvASaaOZqMQxiGMEB/ZF2iFFs +pCfQv3PRw0IMjjXnjTxasVaAZVdfrRhmiRDVK3Pr2GI +-> ssh-ed25519 +qVung ry8P1mOJwSHAXk9XaNGOLRLH2Q6QIxTueoBz+IcS/0M +q9JsGjlS7HQqscAvOO2aSWlH3ruQC5ozDCkDBwp7g0o +-> ssh-rsa krWCLQ +DG2BpVdLziPUuo2HJfzDg/+aqugaOTfmVV+hEFjRV/B9pX90WnLCxp0lNpeNpTdU +v889q7ojKs6jHuJGsUwUPy29Jn9PHOecE/gpcRTt6BI4/2JiwF2brLV+dVbWSOEv +6lf9ecjmbJ/vbHnh94Aqa6kfBREazsZSYPGTAwNdcOdHRsoiK1PKCJmxPvZnfGuY +o6144GTqTIGnxvbdlJ7XPzS8KEoP0SfPb2PFhfq6+z4JPdm116rhXIErPZNcQynP +y0f/TRJPSu5QZ2YzZmwyBTpUqSQx1MWrY/5T3e0cCLY6d2E6evbnPb8eauJl3XHd +I/kqqFKigixDBUPNlwW19Q +-> ssh-ed25519 /vwQcQ Q1589zmSRC/Wvgi1TUfsr6itT7QvBpqsNteNmPhHtHs +Gt3/5u8NW8dcJubLZuiBQjwPIfLNbFQNIAk5+MIoSo0 +-> ssh-ed25519 0R97PA j2DEcmdRz8hOGvkwn6r/6vqPTdNo2AtZKSAjBdQ2n1Y ++w7ky1+gP0O93DXeADjMdBu43Dxno1meh7idgjNdojg +--- 2exgH3r1FIdc2mrQEC0XQmqO3r1bfKZdjWZttrilThE +],A``ㅊ'&T }q1\K7K'K`lxF i# \ No newline at end of file diff --git a/secrets/buildbot-service-key.age b/secrets/buildbot-service-key.age new file mode 100644 index 0000000..d4bad7f Binary files /dev/null and b/secrets/buildbot-service-key.age differ diff --git a/secrets/buildbot-signing-key.age b/secrets/buildbot-signing-key.age new file mode 100644 index 0000000..2028dbf Binary files /dev/null and b/secrets/buildbot-signing-key.age differ diff --git a/secrets/buildbot-worker-password.age b/secrets/buildbot-worker-password.age new file mode 100644 index 0000000..6422c56 --- /dev/null +++ b/secrets/buildbot-worker-password.age @@ -0,0 +1,20 @@ +age-encryption.org/v1 +-> ssh-ed25519 87T2Ig y4P08L2yYSjVcWdbRCqWSCM+WcgqXpxOwr1Ip2Ipd3Q +7C/3MXVbAX0HIdEULKu0bc9q2U+4mPDiDb2l5rRwBI4 +-> ssh-ed25519 K3b7BA wl46ZMqLHMOTG3RojLVgwC2hskjUJWUGZ4h9dwBYaws +xxrJQ8Ws1evKgfKej8WwbucuArULWNtCdMlSDdVNe6E +-> ssh-ed25519 +qVung 4fix0OAAyW/34W1HVfc5ivIr8ijqNz0Vz8oWaSY2lyk +8ZAguZR31I0hysn265ELYeYwrLiDx07BepG0w1R8uhU +-> ssh-rsa krWCLQ +vRU5uF64cQZwJrGr0oBRBJFo2mr30pz6yhXwEm4BJjKt/yCCikggPUFTW/KOjnqZ +JcUoLpeDVIk3+FBJl4p3PVRn1pjRUve4vEcNAEjmkVgBwiZWtpfE6vVLn5pIvm+A +nwybTTwMJomDTLDsMOq0Ur+S3rw4Nb6ADqDKhmjlmlaSlTqxUmZoznQduoSSINI/ +VJw/+VjwFxsMxdD5swxEAcrDk2rKoQLrfO83PO3HNMX5SmYHHYEaWB0/YeLgvi8a +4OBueRKLWOiy2WUCqtxiQG5XYGYNdgOKIeNLnPNH6RRwFoBz7Zmn2uuQjmysY9h8 +lryoR6quxdOTRTL2WwGPAw +-> ssh-ed25519 /vwQcQ 8sOHrthroDrjuL14hij7sPiK9BGlOLzKG1pBe5+HMFw +vQqm96T/H5tINHJxnfi6DYm9YO9UAaj8etmk7K0GJ7U +-> ssh-ed25519 0R97PA Dd3db0zh0/ZUsm3UgsWRbGz9mVvm8s3W2HQkjTM6L3k +/+IRsPs2KoqEYnxmFoKmNc/00jOesKXv33rO4Yx+l68 +--- jPrqv7h6AGoqNl1LCOtzXvU4dKK2PnGsj/FqhstbSGw +f+`ϙ+]&w=:$UQ7hKU1_Yz0%\NL0o ޼5~_ Z7x[\v[o \ No newline at end of file diff --git a/secrets/buildbot-workers.age b/secrets/buildbot-workers.age new file mode 100644 index 0000000..dcd9c20 --- /dev/null +++ b/secrets/buildbot-workers.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 87T2Ig arwhM8DLVpft4PdPw4A6ZoPk5KqXORhE9iDG6etDOzk +ZVNgF/J3YiCTj2lq2280vU95pX36cpH+sT/wRjmExHk +-> ssh-ed25519 K3b7BA fBr1rUtTQVs0LLSR6RVX1eJBEpYs3COyJITpGm4ngi0 +jfYyrD/0gh1QCAq8SnsWjUQin3g21NEgCQAlCc6uQ9g +-> ssh-ed25519 +qVung cJEfk9HdCsdVmuhI7OAgWsly4P5o/n9JbPRtsDZ2FVY +MJvfsbd9+pbhG1BwF4xVafqu+LvPy3geN7n9MALFP68 +-> ssh-rsa krWCLQ +PuiiAwETSr4SDb4XOtn6AECDJedzd3KfTAsjrq3giwCrjfSqYeTpBaH8mhf4t5D5 +fAXHtIoChcZNb1dhxQtP0r4A4cy1faf87XGkOwAeikFv9S8cMjjgZ71sX8g8Srp/ +Mjla0+5CVGRsUMcev/t9uMj04qHDtr7swbjLoOPwvCQBUWHZrOA/Fq/T2g9qU32g +YQgxtR3zzseb/vOFHzpWc6fkR8UO0j1H1hyFkJ1XkipeQ5UIwg0g57lsPkNXuZfI +BbKzzg521HChK5ssibITLdtp6piwIpxHUxwSNpLXG8vbT33e24kFEeTZ0QX4NStl +r6U4j3NL1lPChpdSIhy/2Q +-> ssh-ed25519 /vwQcQ Q8Hxbxto0EN1odEFt/dNfeK1l4xSIO9lY/ewYpa1DgY +4jeNmuwK4tvJzX62/x/1aq+L4R6dD61akUmo0+GCICc +-> ssh-ed25519 0R97PA of4aEATYi3ad7nYvexirIErAWbsLOW1ijGPc/IETSCU +qT/O8DIYaMm0MlvS9eVBSe2th16yDHODlT1VgF9iLDI +--- rWScSs0yVovPOWI2zmDTIyLJdBIRlKIPu6jivzty7p8 +d}EmiKCy5L`GTZ^Q?g2|S +g2F `_jl 1GfWƃ0 H) +{\í<^#JgJJGJh>2G%Tra B \ No newline at end of file diff --git a/services/buildbot/default.nix b/services/buildbot/default.nix new file mode 100644 index 0000000..f30a438 --- /dev/null +++ b/services/buildbot/default.nix @@ -0,0 +1,100 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.bagel.services.buildbot; + cfgGerrit = config.bagel.services.gerrit; + inherit (lib) mkEnableOption mkOption mkIf types; +in +{ + options.bagel.services.buildbot = { + enable = mkEnableOption "Buildbot"; + domain = mkOption { + type = types.str; + }; + }; + + config = mkIf cfg.enable { + age.secrets.buildbot-worker-password.file = ../../secrets/buildbot-worker-password.age; + age.secrets.buildbot-oauth-secret.file = ../../secrets/buildbot-oauth-secret.age; + age.secrets.buildbot-workers.file = ../../secrets/buildbot-workers.age; + age.secrets.buildbot-service-key.file = ../../secrets/buildbot-service-key.age; + age.secrets.buildbot-signing-key.file = ../../secrets/buildbot-signing-key.age; + + services.nginx.virtualHosts.${cfg.domain} = { + forceSSL = true; + enableACME = true; + }; + + services.buildbot-nix.worker = { + enable = true; + workerPasswordFile = config.age.secrets.buildbot-worker-password.path; + # All credits to eldritch horrors for this beauty. + workerArchitectures = + { + # nix-eval-jobs runs under a lock, error reports do not (but are cheap) + other = 8; + } // ( + lib.filterAttrs + (n: v: lib.elem n config.services.buildbot-nix.coordinator.buildSystems) + (lib.zipAttrsWith + (_: lib.foldl' lib.add 0) + (lib.concatMap + (m: map (s: { ${s} = m.maxJobs; }) m.systems) + config.nix.buildMachines)) + ); + }; + + services.buildbot-nix.coordinator = { + enable = true; + + inherit (cfg) domain; + + oauth2 = { + clientId = "forkos-buildbot"; + clientSecretFile = config.age.secrets.buildbot-oauth-secret.path; + resourceEndpoint = "https://identity.lix.systems"; + authUri = "https://identity.lix.systems/realms/lix-project/protocol/openid-connect/auth"; + tokenUri = "https://identity.lix.systems/realms/lix-project/protocol/openid-connect/token"; + }; + + workersFile = config.age.secrets.buildbot-workers.path; + + allowedOrigins = [ + "*.forkos.org" + ]; + + buildSystems = [ + "x86_64-linux" + ]; + + gerrit = { + domain = cfgGerrit.canonicalDomain; + # Manually managed account… + # TODO: https://git.lix.systems/the-distro/infra/issues/69 + username = "buildbot"; + port = cfgGerrit.port; + privateKeyFile = config.age.secrets.buildbot-service-key.path; + projects = [ + "buildbot-test" + "nixpkgs" + "infra" + ]; + }; + + evalWorkerCount = 6; + evalMaxMemorySize = 4096; + + signingKeyFile = config.age.secrets.buildbot-signing-key.path; + }; + + nix.settings.keep-derivations = true; + nix.gc = { + automatic = true; + dates = "hourly"; + }; + }; +} diff --git a/services/default.nix b/services/default.nix index 0599eb5..27dacfd 100644 --- a/services/default.nix +++ b/services/default.nix @@ -8,5 +8,6 @@ ./postgres ./forgejo ./baremetal-builder + ./buildbot ]; }