WIP: feat: introduce ofborg builder #151
18
flake.lock
18
flake.lock
|
|
@ -745,6 +745,23 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"ofborg": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1731621460,
|
||||
"narHash": "sha256-aqv8K7mhsRo8fUYzomYf0UzVsFK+ikONqInn9pkWhik=",
|
||||
"ref": "refs/heads/vcs-generalization",
|
||||
"rev": "c922e6e4557d08d7969c8fb0d4abb1f840dab2de",
|
||||
"revCount": 1470,
|
||||
"type": "git",
|
||||
"url": "https://git.lix.systems/the-distro/ofborg.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "refs/heads/vcs-generalization",
|
||||
"type": "git",
|
||||
"url": "https://git.lix.systems/the-distro/ofborg.git"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
@ -793,6 +810,7 @@
|
|||
],
|
||||
"nix-gerrit": "nix-gerrit",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"ofborg": "ofborg",
|
||||
"stateless-uptime-kuma": "stateless-uptime-kuma",
|
||||
"terranix": "terranix"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -19,6 +19,9 @@
|
|||
nix-gerrit.url = "git+https://git.lix.systems/the-distro/nix-gerrit.git";
|
||||
nix-gerrit.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
ofborg.url = "git+https://git.lix.systems/the-distro/ofborg.git?ref=refs/heads/vcs-generalization";
|
||||
ofborg.flake = false;
|
||||
|
||||
gerrit-dashboard.url = "git+https://git.lix.systems/the-distro/gerrit-monitoring.git";
|
||||
gerrit-dashboard.flake = false;
|
||||
|
||||
|
|
@ -42,7 +45,7 @@
|
|||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, terranix, colmena, ... } @ inputs:
|
||||
outputs = { self, nixpkgs, terranix, colmena, ofborg, ... } @ inputs:
|
||||
let
|
||||
supportedSystems = [ "x86_64-linux" "aarch64-linux" ];
|
||||
forEachSystem = f: builtins.listToAttrs (map (system: {
|
||||
|
|
@ -58,6 +61,9 @@
|
|||
inputs.lix.overlays.default
|
||||
inputs.nix-gerrit.overlays.default
|
||||
inputs.channel-scripts.overlays.default
|
||||
(import inputs.ofborg {
|
||||
pkgs = import nixpkgs { localSystem = system; };
|
||||
}).overlay
|
||||
(import "${inputs.stateless-uptime-kuma}/overlay.nix")
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -37,7 +37,13 @@
|
|||
|
||||
bagel.services = {
|
||||
postgres.enable = true;
|
||||
ofborg.enable = true;
|
||||
ofborg = {
|
||||
rabbitmq.enable = true;
|
||||
mass-rebuilder.enable = true;
|
||||
pastebin.enable = true;
|
||||
builder.enable = true;
|
||||
stats.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
bagel.sysadmin.enable = true;
|
||||
|
|
|
|||
|
|
@ -46,6 +46,7 @@ let
|
|||
|
||||
postgres-ca-priv = [ machines.bagel-box ];
|
||||
postgres-tls-priv = [ machines.bagel-box ];
|
||||
rabbitmq-password = [ machines.bagel-box ];
|
||||
|
||||
newsletter-secrets = [ machines.public01 ];
|
||||
s3-revproxy-api-keys = [ machines.public01 ];
|
||||
|
|
|
|||
20
secrets/floral/rabbitmq-password.age
Normal file
20
secrets/floral/rabbitmq-password.age
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 +HUDfA N/08Rh4cN52OOLk3Mp7n71mqU0zRvXeFr+HNXPVudSw
|
||||
txBFV3BJLmUng4cq5AEuSHQ4wUozc82hbMH9eA4AcqU
|
||||
-> ssh-ed25519 +qVung ryhY0CsF0pyJoCFGHdVaBS3S1rbEwPx6K/xEmKeI8js
|
||||
2dvCxR1w1uEf1Qq7lRqZJfGRUw2gsKH5DgrPe5HWUk0
|
||||
-> ssh-rsa krWCLQ
|
||||
adfK11ogZxXsenyFYgyIgOSsekwDTcMmOdTD4GXPjGGSOfXhxOTq9CsWfMksSDXq
|
||||
HIPTZLK7oYSvlNxvnqITGv4ESJGQMBat3TjZ4TTb2+hczWpzg3CqMeNluPDX4A2h
|
||||
dr+0TZH3XuHOuCrmukQ/EirBxnODBtSPqheZLqp562nrrpxDqqKdJkzwYWamu9H3
|
||||
S2pZFYtWe1YX0+1dooH/KqCTCR6yI7u0g9J/uxP2uPN2pgvD95mSpzd7nvfsKv7b
|
||||
kejB/5Gg5w0WNYwqi7uTnrL8l7WVtYLdIziK83RGviau5Grtuv+18Mj/a8YeupiQ
|
||||
B2tCRddiS/1DvlfobRtqtw
|
||||
-> ssh-ed25519 /vwQcQ sHef1IQRAJXykiG82Madjb+FTaNZKg2PpJONHmEKsEU
|
||||
NuBmo4GlVYc7Asy4gGiAE6Be2xS8t9ZYDgI8cF0rHms
|
||||
-> ssh-ed25519 0R97PA wQLniyviNyifUhEIlFqk+kDKNo5AUy4Vrh/gGweGygM
|
||||
7v/82hVu8d+RuZGxq9xmAiacv0ddUW7HDVGKVFgYrAw
|
||||
-> ssh-ed25519 K3b7BA SUF2L0mvu+7Pn8NZArC3tT7sr4FivAUjFexWXnLfckc
|
||||
QDnle9e13/Ch9DjXdYDzC1jsCH81HB2m+97CaRrZLAI
|
||||
--- PMNk1z2Vk3cRHqaB3G1/giBnOVduxex6tfwR3ihc4pE
|
||||
M踝ヽ齘暞堗)5m<35>"H唢罡<E594A2>7fs+R郑o/J 1N槇e<E6A787>F<>罐<EFBFBD>鲈衅Oじ７&蟒至
|
||||
|
|
@ -1,16 +1,95 @@
|
|||
{ config, lib, ... }:
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (lib) mkIf mkMerge;
|
||||
cfg = config.bagel.services.ofborg;
|
||||
|
||||
amqpHost = "amqp.forkos.org";
|
||||
amqpPort = 5671;
|
||||
generators = pkgs.formats.json { };
|
||||
configFile = generators.generate "ofborg-config.json" config.bagel.services.ofborg.settings;
|
||||
mkOfborgWorker = binaryName: extra: extra // {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "ofborg CI service - ${binaryName} worker";
|
||||
after = [ "rabbitmq.service" ];
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = "${cfg.package}/bin/${binaryName} ${configFile}";
|
||||
# TODO: more hardening.
|
||||
StateDirectory = "ofborg";
|
||||
LogsDirectory = "ofborg";
|
||||
WorkingDirectory = "/var/lib/ofborg";
|
||||
LoadCredential = [ "rabbitmq-password:${config.age.secrets.rabbitmq-password.path}" ];
|
||||
};
|
||||
};
|
||||
in {
|
||||
options.bagel.services.ofborg = with lib; {
|
||||
enable = mkEnableOption "ofborg coordinator";
|
||||
rabbitmq.enable = mkEnableOption "ofborg AMQP queue";
|
||||
builder.enable = mkEnableOption "ofborg builder worker";
|
||||
pastebin.enable = mkEnableOption "ofborg pastebin service";
|
||||
statcheck-worker.enable = mkEnableOption "ofborg status & checks worker";
|
||||
mass-rebuilder.enable = mkEnableOption "ofborg evaluator worker for mass rebuilds jobs";
|
||||
stats.enable = mkEnableOption "ofborg prometheus worker";
|
||||
|
||||
gerrit-events-streamer.enable = mkEnableOption "ofborg's Gerrit event streamer";
|
||||
|
||||
package = mkPackageOption pkgs "ofborg" { };
|
||||
|
||||
settings = mkOption {
|
||||
type = generators.type;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
config = mkMerge [
|
||||
{
|
||||
age.secrets.rabbitmq-password.file = ../../secrets/floral/rabbitmq-password.age;
|
||||
# TODO: move this to global.
|
||||
bagel.services.ofborg.settings = {
|
||||
rabbitmq = {
|
||||
ssl = true;
|
||||
host = "amqp.forkos.org";
|
||||
virtualhost = "amqp.forkos.org";
|
||||
username = "worker";
|
||||
password_file = "$CREDENTIALS_DIRECTORY/rabbitmq-password";
|
||||
};
|
||||
feedback.full_logs = lib.mkDefault true;
|
||||
log_storage.path = lib.mkDefault "/var/log/ofborg";
|
||||
runner = {
|
||||
identity = config.networking.fqdn;
|
||||
repos = lib.mkDefault [
|
||||
"nixpkgs"
|
||||
"ofborg"
|
||||
];
|
||||
|
||||
disable_trusted_users = true;
|
||||
};
|
||||
checkout.root = lib.mkDefault "/var/lib/ofborg/checkouts";
|
||||
nix = {
|
||||
system = "x86_64-linux";
|
||||
remote = "daemon";
|
||||
build_timeout_seconds = 3600;
|
||||
initial_heap_size = "4g";
|
||||
};
|
||||
|
||||
pastebin = {
|
||||
root = "$STATE_DIRECTORY/pastebins";
|
||||
db = "$STATE_DIRECTORY/db.json";
|
||||
};
|
||||
|
||||
statcheck = {
|
||||
db = "$STATE_DIRECTORY/db.sqlite";
|
||||
};
|
||||
|
||||
# We use Gerrit.
|
||||
vcs = "Gerrit";
|
||||
gerrit = {
|
||||
instance_uri = "cl.forkos.org";
|
||||
ssh_private_key_file = "$CREDENTIALS_DIRECTORY/gerrit-ssh-key";
|
||||
ssh_port = 29418;
|
||||
};
|
||||
};
|
||||
}
|
||||
(mkIf cfg.rabbitmq.enable {
|
||||
services.rabbitmq = {
|
||||
enable = true;
|
||||
configItems = {
|
||||
|
|
@ -31,5 +110,28 @@ in {
|
|||
systemd.services.rabbitmq.requires = ["acme-finished-${amqpHost}.target"];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ amqpPort ];
|
||||
};
|
||||
})
|
||||
(mkIf cfg.pastebin.enable {
|
||||
systemd.services.ofborg-pastebin = mkOfborgWorker "pastebin-worker" { };
|
||||
})
|
||||
(mkIf cfg.statcheck-worker.enable {
|
||||
systemd.services.ofborg-statcheck-worker = mkOfborgWorker "statcheck-worker" { };
|
||||
})
|
||||
(mkIf cfg.gerrit-events-streamer.enable {
|
||||
systemd.services.ofborg-gerrit-streamer = mkOfborgWorker "gerrit-events-streamer" { };
|
||||
})
|
||||
(mkIf cfg.mass-rebuilder.enable {
|
||||
systemd.services.ofborg-mass-rebuilder = mkOfborgWorker "mass-rebuilder" { };
|
||||
})
|
||||
(mkIf cfg.builder.enable {
|
||||
systemd.services.ofborg-builder = mkOfborgWorker "builder" { };
|
||||
})
|
||||
(mkIf cfg.stats.enable {
|
||||
systemd.services.ofborg-stats = mkOfborgWorker "stats" { };
|
||||
})
|
||||
];
|
||||
# systemd.services.ofborg-log-message-collector = {};
|
||||
# systemd.services.ofborg-evaluation-filter = {};
|
||||
# systemd.services.ofborg-vcs-comment-filter = {};
|
||||
# systemd.services.ofborg-vcs-comment-poster = {};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -101,7 +101,8 @@ in
|
|||
# git.p.forkos.org is the proxy variant of the Forgejo server.
|
||||
(record "git" 300 "CNAME" "git.p.forkos.org")
|
||||
(record "netbox" 300 "CNAME" "meta01.infra.p.forkos.org")
|
||||
(record "amqp" 300 "CNAME" "bagel-box.infra.p.forkos.org")
|
||||
# It's not a public service, so no IPv4 for it.
|
||||
(record "amqp" 300 "CNAME" "bagel-box.infra.forkos.org")
|
||||
(record "grafana" 300 "CNAME" "meta01.infra.p.forkos.org")
|
||||
(record "hydra" 300 "CNAME" "build-coord.wob01.infra.p.forkos.org")
|
||||
(record "loki" 300 "CNAME" "meta01.infra.p.forkos.org")
|
||||
|
|
|
|||
Loading…
Reference in a new issue