diff options
author | Franck <franck@fcuny.net> | 2022-11-07 08:09:25 -0800 |
---|---|---|
committer | Franck <franck@fcuny.net> | 2022-11-07 08:09:25 -0800 |
commit | bb7025da134fef21f4ccafee74a75428b56a27de (patch) | |
tree | 6e0ff5e7b3ee7367d1fedbf57a407040b8b8ec49 /modules | |
parent | ref(home/git): update mapping for the git-helper (diff) | |
parent | fix(services/drone): enable drone (diff) | |
download | world-bb7025da134fef21f4ccafee74a75428b56a27de.tar.gz |
Merge pull request 'fcuny/ci-drone' (#1) from fcuny/test-woodpecker into main
Reviewed-on: https://git.fcuny.net/fcuny/world/pulls/1
Diffstat (limited to 'modules')
-rw-r--r-- | modules/services/default.nix | 1 | ||||
-rw-r--r-- | modules/services/drone/default.nix | 39 | ||||
-rw-r--r-- | modules/services/drone/runner-docker/default.nix | 40 | ||||
-rw-r--r-- | modules/services/drone/runner-exec/default.nix | 58 | ||||
-rw-r--r-- | modules/services/drone/server/default.nix | 48 |
5 files changed, 186 insertions, 0 deletions
diff --git a/modules/services/default.nix b/modules/services/default.nix index c67a6cd..73e2e6d 100644 --- a/modules/services/default.nix +++ b/modules/services/default.nix @@ -6,6 +6,7 @@ ./backup ./buildkite ./cgit + ./drone ./fwupd ./gerrit ./gitea diff --git a/modules/services/drone/default.nix b/modules/services/drone/default.nix new file mode 100644 index 0000000..dedf120 --- /dev/null +++ b/modules/services/drone/default.nix @@ -0,0 +1,39 @@ +# A docker-based CI/CD system +# +# Inspired by [1] +# [1]: https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modules/drone.nix +{ lib, ... }: { + imports = [ ./runner-docker ./runner-exec ./server ]; + + options.my.services.drone = with lib; { + enable = mkEnableOption "Drone CI"; + vhostName = mkOption { + type = types.str; + example = "drone.fcuny.net"; + description = "Name for the virtual host"; + }; + runners = mkOption { + type = with types; listOf (enum [ "exec" "docker" ]); + default = [ ]; + example = [ "exec" "docker" ]; + description = "Types of runners to enable"; + }; + admin = mkOption { + type = types.str; + default = "fcuny"; + example = "admin"; + description = "Name of the admin user"; + }; + port = mkOption { + type = types.port; + default = 3030; + example = 8080; + description = "Internal port of the Drone UI"; + }; + sharedSecretFile = mkOption { + type = types.str; + example = "/run/secrets/drone-rpc.env"; + description = "Shared RPC secret to inject into server and runners"; + }; + }; +} diff --git a/modules/services/drone/runner-docker/default.nix b/modules/services/drone/runner-docker/default.nix new file mode 100644 index 0000000..428a8d6 --- /dev/null +++ b/modules/services/drone/runner-docker/default.nix @@ -0,0 +1,40 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + hasRunner = (name: builtins.elem name cfg.runners); + dockerPkg = pkgs.drone-runner-docker; +in +{ + config = lib.mkIf (cfg.enable && hasRunner "docker") { + systemd.services.drone-runner-docker = { + wantedBy = [ "multi-user.target" ]; + after = [ "docker.socket" ]; # Needs the socket to be available + # might break deployment + restartIfChanged = false; + confinement.enable = true; + serviceConfig = { + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_RUNNER_CAPACITY=10" + "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" + ]; + BindPaths = [ "/var/run/docker.sock" ]; + EnvironmentFile = [ cfg.sharedSecretFile ]; + ExecStart = "${dockerPkg}/bin/drone-runner-docker"; + User = "drone-runner-docker"; + Group = "drone-runner-docker"; + }; + }; + + # Make sure it is activated in that case + virtualisation.docker.enable = true; + + users.users.drone-runner-docker = { + isSystemUser = true; + group = "drone-runner-docker"; + extraGroups = [ "docker" ]; # Give access to the daemon + }; + users.groups.drone-runner-docker = { }; + }; +} diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix new file mode 100644 index 0000000..cbfbb9d --- /dev/null +++ b/modules/services/drone/runner-exec/default.nix @@ -0,0 +1,58 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + hasRunner = (name: builtins.elem name cfg.runners); + execPkg = pkgs.drone-runner-exec; +in +{ + config = lib.mkIf (cfg.enable && hasRunner "exec") { + systemd.services.drone-runner-exec = { + wantedBy = [ "multi-user.target" ]; + # might break deployment + restartIfChanged = false; + confinement.enable = true; + confinement.packages = with pkgs; [ git gnutar bash nixUnstable gzip ]; + path = with pkgs; [ git gnutar bash nixUnstable gzip ]; + serviceConfig = { + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_RUNNER_CAPACITY=10" + "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" + "PAGER=cat" + ]; + BindPaths = [ + "/nix/var/nix/daemon-socket/socket" + "/var/run/docker.sock" + ]; + BindReadOnlyPaths = [ + "/etc/resolv.conf:/etc/resolv.conf" + "/etc/resolvconf.conf:/etc/resolvconf.conf" + "/etc/passwd:/etc/passwd" + "/etc/group:/etc/group" + "/nix/var/nix/profiles/system/etc/nix:/etc/nix" + "${ + config.environment.etc."ssl/certs/ca-certificates.crt".source + }:/etc/ssl/certs/ca-certificates.crt" + "${ + config.environment.etc."ssh/ssh_known_hosts".source + }:/etc/ssh/ssh_known_hosts" + "/etc/machine-id" + # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing + "/nix/" + ]; + EnvironmentFile = [ cfg.sharedSecretFile ]; + ExecStart = "${execPkg}/bin/drone-runner-exec"; + User = "drone-runner-exec"; + Group = "drone-runner-exec"; + }; + }; + + users.users.drone-runner-exec = { + isSystemUser = true; + group = "drone-runner-exec"; + extraGroups = [ "docker" ]; # Give access to the daemon + }; + users.groups.drone-runner-exec = { }; + }; +} diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix new file mode 100644 index 0000000..77f4ee2 --- /dev/null +++ b/modules/services/drone/server/default.nix @@ -0,0 +1,48 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + secrets = config.age.secrets; +in +{ + config = lib.mkIf cfg.enable { + systemd.services.drone-server = { + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + EnvironmentFile = [ cfg.sharedSecretFile ]; + Environment = [ + "DRONE_DATABASE_DRIVER=sqlite3" + "DRONE_DATABASE_DATASOURCE=/var/lib/drone-server/drone.sqlite" + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_SERVER_PORT=:${toString cfg.port}" + "DRONE_USER_CREATE=username:${cfg.admin},admin:true" + "DRONE_JSONNET_ENABLED=true" + "DRONE_STARLARK_ENABLED=true" + ]; + StateDirectory = "drone-server"; + ExecStart = "${pkgs.drone}/bin/drone-server"; + User = "drone"; + Group = "drone"; + }; + }; + + users.users.drone = { + isSystemUser = true; + createHome = true; + group = "drone"; + }; + + users.groups.drone = { }; + + services.nginx.virtualHosts."${cfg.vhostName}" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}"; + proxyWebsockets = true; + }; + }; + + my.services.backup = { paths = [ "/var/lib/droner-server" ]; }; + }; +} |