fix(services/drone): enable drone

The URL for drone changed to https://ci.fcuny.net. The secrets also
changed (and we remove the unencrypted file with secrets).

8 files changed, 19 insertions, 14 deletions

diff --git a/home/drone-cli/default.nix b/home/drone-cli/default.nix
index 948e88a..68173c8 100644
--- a/home/drone-cli/default.nix
+++ b/home/drone-cli/default.nix
@@ -7,6 +7,6 @@ in
   };
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [ drone-cli ];
-    home.sessionVariables = { DRONE_SERVER = "https://drone.fcuny.xyz/"; };
+    home.sessionVariables = { DRONE_SERVER = "https://ci.fcuny.net/"; };
   };
 }
diff --git a/hosts/aptos/home.nix b/hosts/aptos/home.nix
index 2d60b53..2faaa82 100644
--- a/hosts/aptos/home.nix
+++ b/hosts/aptos/home.nix
@@ -38,6 +38,7 @@
     go.enable = true;
     python.enable = true;
     rust.enable = true;
+    drone-cli.enable = true;
 
     # web
     firefox.enable = true;
diff --git a/hosts/tahoe/secrets/drone/secrets.age b/hosts/tahoe/secrets/drone/secrets.age
index 618bbc6..c0eb97b 100644
--- a/hosts/tahoe/secrets/drone/secrets.age
+++ b/hosts/tahoe/secrets/drone/secrets.age
Binary files differdiff --git a/hosts/tahoe/secrets/drone/shared-secrets b/hosts/tahoe/secrets/drone/shared-secrets
deleted file mode 100644
index 47612be..0000000
--- a/hosts/tahoe/secrets/drone/shared-secrets
+++ /dev/null
@@ -1,5 +0,0 @@
-DRONE_GITEA_CLIENT_ID=21ef7412-a58a-493c-beec-2e1dc27ebe79
-DRONE_GITEA_CLIENT_SECRET=GCXGi97PXxAoMTpHveMtNJXDyzdvI8jeC0TaEtCgpPab
-DRONE_GITEA_SERVER=https://git.fcuny.net
-DRONE_GIT_ALWAYS_AUTH=1
-DRONE_RPC_SECRET=d3daa6782d0f4ed66f7f557fa384ff8f
diff --git a/hosts/tahoe/secrets/secrets.nix b/hosts/tahoe/secrets/secrets.nix
index 390f2b6..7b9500f 100644
--- a/hosts/tahoe/secrets/secrets.nix
+++ b/hosts/tahoe/secrets/secrets.nix
@@ -22,6 +22,11 @@ in
     mode = "0440";
   };
 
+  "drone/secrets.age" = {
+    publicKeys = all;
+    owner = "drone";
+  };
+
   "buildkite/graphql.age" = {
     publicKeys = all;
     owner = "buildkite-agent-builder-1";
diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix
index f7edfa4..e5f53ab 100644
--- a/hosts/tahoe/services.nix
+++ b/hosts/tahoe/services.nix
@@ -20,6 +20,12 @@ in
       enable = true;
       stateDir = "/var/lib/gitea";
     };
+    drone = {
+      enable = true;
+      vhostName = "ci.fcuny.net";
+      runners = [ "docker" "exec" ];
+      sharedSecretFile = secrets."drone/secrets".path;
+    };
     prometheus = { enable = true; };
     grafana = {
       enable = true;
diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix
index 01cc11b..cbfbb9d 100644
--- a/modules/services/drone/runner-exec/default.nix
+++ b/modules/services/drone/runner-exec/default.nix
@@ -19,10 +19,12 @@ in
           "DRONE_SERVER_PROTO=https"
           "DRONE_RUNNER_CAPACITY=10"
           "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}"
-          "NIX_REMOTE=daemon"
           "PAGER=cat"
         ];
-        BindPaths = [ "/nix/var/nix/daemon-socket/socket" ];
+        BindPaths = [
+          "/nix/var/nix/daemon-socket/socket"
+          "/var/run/docker.sock"
+        ];
         BindReadOnlyPaths = [
           "/etc/resolv.conf:/etc/resolv.conf"
           "/etc/resolvconf.conf:/etc/resolvconf.conf"
@@ -49,6 +51,7 @@ in
     users.users.drone-runner-exec = {
       isSystemUser = true;
       group = "drone-runner-exec";
+      extraGroups = [ "docker" ]; # Give access to the daemon
     };
     users.groups.drone-runner-exec = { };
   };
diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix
index 97e20a3..77f4ee2 100644
--- a/modules/services/drone/server/default.nix
+++ b/modules/services/drone/server/default.nix
@@ -36,18 +36,13 @@ in
 
     services.nginx.virtualHosts."${cfg.vhostName}" = {
       forceSSL = true;
-      useACMEHost = cfg.vhostName;
+      enableACME = true;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString cfg.port}";
         proxyWebsockets = true;
       };
     };
 
-    security.acme.certs."${cfg.vhostName}" = {
-      dnsProvider = "gcloud";
-      credentialsFile = secrets."acme/credentials".path;
-    };
-
     my.services.backup = { paths = [ "/var/lib/droner-server" ]; };
   };
 }