the-distro/infra
9
0
Fork 5
Code Issues 39 Pull requests 8 Packages Projects 1 Releases Wiki Activity

WIP: feat: introduce ofborg builder #151

Draft
raito wants to merge 9 commits from ofborg into main
pull from: ofborg
merge into: the-distro:main
Conversation 0 Commits 9 Files changed 7 +177 -23
7 changed files with 177 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
flake.lock
View file

@ -745,6 +745,23 @@
"type": "github"
}
},
"ofborg": {
"flake": false,
"locked": {
"lastModified": 1731621460,
"narHash": "sha256-aqv8K7mhsRo8fUYzomYf0UzVsFK+ikONqInn9pkWhik=",
"ref": "refs/heads/vcs-generalization",
"rev": "c922e6e4557d08d7969c8fb0d4abb1f840dab2de",
"revCount": 1470,
"type": "git",
"url": "https://git.lix.systems/the-distro/ofborg.git"
},
"original": {
"ref": "refs/heads/vcs-generalization",
"type": "git",
"url": "https://git.lix.systems/the-distro/ofborg.git"
}
},
"pre-commit-hooks": {
"flake": false,
"locked": {
@ -793,6 +810,7 @@
],
"nix-gerrit": "nix-gerrit",
"nixpkgs": "nixpkgs_2",
"ofborg": "ofborg",
"stateless-uptime-kuma": "stateless-uptime-kuma",
"terranix": "terranix"
}

8
flake.nix
View file

@ -19,6 +19,9 @@
nix-gerrit.url = "git+https://git.lix.systems/the-distro/nix-gerrit.git";
nix-gerrit.inputs.nixpkgs.follows = "nixpkgs";
ofborg.url = "git+https://git.lix.systems/the-distro/ofborg.git?ref=refs/heads/vcs-generalization";
ofborg.flake = false;
gerrit-dashboard.url = "git+https://git.lix.systems/the-distro/gerrit-monitoring.git";
gerrit-dashboard.flake = false;
@ -42,7 +45,7 @@
};
};
outputs = { self, nixpkgs, terranix, colmena, ... } @ inputs:
outputs = { self, nixpkgs, terranix, colmena, ofborg, ... } @ inputs:
let
supportedSystems = [ "x86_64-linux" "aarch64-linux" ];
forEachSystem = f: builtins.listToAttrs (map (system: {
@ -58,6 +61,9 @@
inputs.lix.overlays.default
inputs.nix-gerrit.overlays.default
inputs.channel-scripts.overlays.default
(import inputs.ofborg {
pkgs = import nixpkgs { localSystem = system; };
}).overlay
(import "${inputs.stateless-uptime-kuma}/overlay.nix")
];
};

8
hosts/bagel-box/default.nix
View file

@ -37,7 +37,13 @@
bagel.services = {
postgres.enable = true;
ofborg.enable = true;
ofborg = {
rabbitmq.enable = true;
mass-rebuilder.enable = true;
pastebin.enable = true;
builder.enable = true;
stats.enable = true;
};
};
bagel.sysadmin.enable = true;

1
secrets.nix
View file

@ -46,6 +46,7 @@ let
postgres-ca-priv = [ machines.bagel-box ];
postgres-tls-priv = [ machines.bagel-box ];
rabbitmq-password = [ machines.bagel-box ];
newsletter-secrets = [ machines.public01 ];
s3-revproxy-api-keys = [ machines.public01 ];

20
secrets/floral/rabbitmq-password.age Normal file
View file

@ -0,0 +1,20 @@
age-encryption.org/v1
-> ssh-ed25519 +HUDfA N/08Rh4cN52OOLk3Mp7n71mqU0zRvXeFr+HNXPVudSw
txBFV3BJLmUng4cq5AEuSHQ4wUozc82hbMH9eA4AcqU
-> ssh-ed25519 +qVung ryhY0CsF0pyJoCFGHdVaBS3S1rbEwPx6K/xEmKeI8js
2dvCxR1w1uEf1Qq7lRqZJfGRUw2gsKH5DgrPe5HWUk0
-> ssh-rsa krWCLQ
adfK11ogZxXsenyFYgyIgOSsekwDTcMmOdTD4GXPjGGSOfXhxOTq9CsWfMksSDXq
HIPTZLK7oYSvlNxvnqITGv4ESJGQMBat3TjZ4TTb2+hczWpzg3CqMeNluPDX4A2h
dr+0TZH3XuHOuCrmukQ/EirBxnODBtSPqheZLqp562nrrpxDqqKdJkzwYWamu9H3
S2pZFYtWe1YX0+1dooH/KqCTCR6yI7u0g9J/uxP2uPN2pgvD95mSpzd7nvfsKv7b
kejB/5Gg5w0WNYwqi7uTnrL8l7WVtYLdIziK83RGviau5Grtuv+18Mj/a8YeupiQ
B2tCRddiS/1DvlfobRtqtw
-> ssh-ed25519 /vwQcQ sHef1IQRAJXykiG82Madjb+FTaNZKg2PpJONHmEKsEU
NuBmo4GlVYc7Asy4gGiAE6Be2xS8t9ZYDgI8cF0rHms
-> ssh-ed25519 0R97PA wQLniyviNyifUhEIlFqk+kDKNo5AUy4Vrh/gGweGygM
7v/82hVu8d+RuZGxq9xmAiacv0ddUW7HDVGKVFgYrAw
-> ssh-ed25519 K3b7BA SUF2L0mvu+7Pn8NZArC3tT7sr4FivAUjFexWXnLfckc
QDnle9e13/Ch9DjXdYDzC1jsCH81HB2m+97CaRrZLAI
--- PMNk1z2Vk3cRHqaB3G1/giBnOVduxex6tfwR3ihc4pE
M踝ヽ齘暞堗)5m<35>"H唢罡<E594A2>7fs+R郑o/J 1N槇e<E6A787>F<>罐<EFBFBD>鲈衅Oじ７&蟒至

142
services/ofborg/default.nix
View file

@ -1,35 +1,137 @@
{ config, lib, ... }:
{ pkgs, config, lib, ... }:
let
inherit (lib) mkIf mkMerge;
cfg = config.bagel.services.ofborg;
amqpHost = "amqp.forkos.org";
amqpPort = 5671;
generators = pkgs.formats.json { };
configFile = generators.generate "ofborg-config.json" config.bagel.services.ofborg.settings;
mkOfborgWorker = binaryName: extra: extra // {
wantedBy = [ "multi-user.target" ];
description = "ofborg CI service - ${binaryName} worker";
after = [ "rabbitmq.service" ];
serviceConfig = {
DynamicUser = true;
ExecStart = "${cfg.package}/bin/${binaryName} ${configFile}";
# TODO: more hardening.
StateDirectory = "ofborg";
LogsDirectory = "ofborg";
WorkingDirectory = "/var/lib/ofborg";
LoadCredential = [ "rabbitmq-password:${config.age.secrets.rabbitmq-password.path}" ];
};
};
in {
options.bagel.services.ofborg = with lib; {
enable = mkEnableOption "ofborg coordinator";
rabbitmq.enable = mkEnableOption "ofborg AMQP queue";
builder.enable = mkEnableOption "ofborg builder worker";
pastebin.enable = mkEnableOption "ofborg pastebin service";
statcheck-worker.enable = mkEnableOption "ofborg status & checks worker";
mass-rebuilder.enable = mkEnableOption "ofborg evaluator worker for mass rebuilds jobs";
stats.enable = mkEnableOption "ofborg prometheus worker";
gerrit-events-streamer.enable = mkEnableOption "ofborg's Gerrit event streamer";
package = mkPackageOption pkgs "ofborg" { };
settings = mkOption {
type = generators.type;
};
};
config = lib.mkIf cfg.enable {
services.rabbitmq = {
enable = true;
configItems = {
"listeners.tcp" = "none";
"listeners.ssl.default" = builtins.toString amqpPort;
config = mkMerge [
{
age.secrets.rabbitmq-password.file = ../../secrets/floral/rabbitmq-password.age;
# TODO: move this to global.
bagel.services.ofborg.settings = {
rabbitmq = {
ssl = true;
host = "amqp.forkos.org";
virtualhost = "amqp.forkos.org";
username = "worker";
password_file = "$CREDENTIALS_DIRECTORY/rabbitmq-password";
};
feedback.full_logs = lib.mkDefault true;
log_storage.path = lib.mkDefault "/var/log/ofborg";
runner = {
identity = config.networking.fqdn;
repos = lib.mkDefault [
"nixpkgs"
"ofborg"
];
"ssl_options.certfile" = "${config.security.acme.certs.${amqpHost}.directory}/cert.pem";
"ssl_options.keyfile" = "${config.security.acme.certs.${amqpHost}.directory}/key.pem";
disable_trusted_users = true;
};
checkout.root = lib.mkDefault "/var/lib/ofborg/checkouts";
nix = {
system = "x86_64-linux";
remote = "daemon";
build_timeout_seconds = 3600;
initial_heap_size = "4g";
};
pastebin = {
root = "$STATE_DIRECTORY/pastebins";
db = "$STATE_DIRECTORY/db.json";
};
statcheck = {
db = "$STATE_DIRECTORY/db.sqlite";
};
# We use Gerrit.
vcs = "Gerrit";
gerrit = {
instance_uri = "cl.forkos.org";
ssh_private_key_file = "$CREDENTIALS_DIRECTORY/gerrit-ssh-key";
ssh_port = 29418;
};
};
};
}
(mkIf cfg.rabbitmq.enable {
services.rabbitmq = {
enable = true;
configItems = {
"listeners.tcp" = "none";
"listeners.ssl.default" = builtins.toString amqpPort;
security.acme.certs.${amqpHost} = {
webroot = "/var/lib/acme/.challenges";
group = "rabbitmq";
};
services.nginx.virtualHosts.${amqpHost}.locations."/.well-known/acme-challenge".root =
"/var/lib/acme/.challenges";
systemd.services.rabbitmq.requires = ["acme-finished-${amqpHost}.target"];
"ssl_options.certfile" = "${config.security.acme.certs.${amqpHost}.directory}/cert.pem";
"ssl_options.keyfile" = "${config.security.acme.certs.${amqpHost}.directory}/key.pem";
};
};
networking.firewall.allowedTCPPorts = [ amqpPort ];
};
security.acme.certs.${amqpHost} = {
webroot = "/var/lib/acme/.challenges";
group = "rabbitmq";
};
services.nginx.virtualHosts.${amqpHost}.locations."/.well-known/acme-challenge".root =
"/var/lib/acme/.challenges";
systemd.services.rabbitmq.requires = ["acme-finished-${amqpHost}.target"];
networking.firewall.allowedTCPPorts = [ amqpPort ];
})
(mkIf cfg.pastebin.enable {
systemd.services.ofborg-pastebin = mkOfborgWorker "pastebin-worker" { };
})
(mkIf cfg.statcheck-worker.enable {
systemd.services.ofborg-statcheck-worker = mkOfborgWorker "statcheck-worker" { };
})
(mkIf cfg.gerrit-events-streamer.enable {
systemd.services.ofborg-gerrit-streamer = mkOfborgWorker "gerrit-events-streamer" { };
})
(mkIf cfg.mass-rebuilder.enable {
systemd.services.ofborg-mass-rebuilder = mkOfborgWorker "mass-rebuilder" { };
})
(mkIf cfg.builder.enable {
systemd.services.ofborg-builder = mkOfborgWorker "builder" { };
})
(mkIf cfg.stats.enable {
systemd.services.ofborg-stats = mkOfborgWorker "stats" { };
})
];
# systemd.services.ofborg-log-message-collector = {};
# systemd.services.ofborg-evaluation-filter = {};
# systemd.services.ofborg-vcs-comment-filter = {};
# systemd.services.ofborg-vcs-comment-poster = {};
}

3
terraform/dnsimple.nix
View file

@ -101,7 +101,8 @@ in
# git.p.forkos.org is the proxy variant of the Forgejo server.
(record "git" 300 "CNAME" "git.p.forkos.org")
(record "netbox" 300 "CNAME" "meta01.infra.p.forkos.org")
(record "amqp" 300 "CNAME" "bagel-box.infra.p.forkos.org")
# It's not a public service, so no IPv4 for it.
(record "amqp" 300 "CNAME" "bagel-box.infra.forkos.org")
(record "grafana" 300 "CNAME" "meta01.infra.p.forkos.org")
(record "hydra" 300 "CNAME" "build-coord.wob01.infra.p.forkos.org")
(record "loki" 300 "CNAME" "meta01.infra.p.forkos.org")