From 5f40c7a5b0cb555f64231d18cf105bf0ec7eb0a2 Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Sat, 5 Nov 2022 12:47:02 -0700 Subject: Revert "ref(drone): remove all modules and configurations" This reverts commit 614fc2fcce0e9ae0bcfdc6e08d3c4bac846d02a8. --- modules/services/drone/default.nix | 39 +++++++++++++++++ modules/services/drone/runner-docker/default.nix | 40 +++++++++++++++++ modules/services/drone/runner-exec/default.nix | 55 ++++++++++++++++++++++++ modules/services/drone/server/default.nix | 53 +++++++++++++++++++++++ 4 files changed, 187 insertions(+) create mode 100644 modules/services/drone/default.nix create mode 100644 modules/services/drone/runner-docker/default.nix create mode 100644 modules/services/drone/runner-exec/default.nix create mode 100644 modules/services/drone/server/default.nix (limited to 'modules/services/drone') diff --git a/modules/services/drone/default.nix b/modules/services/drone/default.nix new file mode 100644 index 0000000..dedf120 --- /dev/null +++ b/modules/services/drone/default.nix @@ -0,0 +1,39 @@ +# A docker-based CI/CD system +# +# Inspired by [1] +# [1]: https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modules/drone.nix +{ lib, ... }: { + imports = [ ./runner-docker ./runner-exec ./server ]; + + options.my.services.drone = with lib; { + enable = mkEnableOption "Drone CI"; + vhostName = mkOption { + type = types.str; + example = "drone.fcuny.net"; + description = "Name for the virtual host"; + }; + runners = mkOption { + type = with types; listOf (enum [ "exec" "docker" ]); + default = [ ]; + example = [ "exec" "docker" ]; + description = "Types of runners to enable"; + }; + admin = mkOption { + type = types.str; + default = "fcuny"; + example = "admin"; + description = "Name of the admin user"; + }; + port = mkOption { + type = types.port; + default = 3030; + example = 8080; + description = "Internal port of the Drone UI"; + }; + sharedSecretFile = mkOption { + type = types.str; + example = "/run/secrets/drone-rpc.env"; + description = "Shared RPC secret to inject into server and runners"; + }; + }; +} diff --git a/modules/services/drone/runner-docker/default.nix b/modules/services/drone/runner-docker/default.nix new file mode 100644 index 0000000..428a8d6 --- /dev/null +++ b/modules/services/drone/runner-docker/default.nix @@ -0,0 +1,40 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + hasRunner = (name: builtins.elem name cfg.runners); + dockerPkg = pkgs.drone-runner-docker; +in +{ + config = lib.mkIf (cfg.enable && hasRunner "docker") { + systemd.services.drone-runner-docker = { + wantedBy = [ "multi-user.target" ]; + after = [ "docker.socket" ]; # Needs the socket to be available + # might break deployment + restartIfChanged = false; + confinement.enable = true; + serviceConfig = { + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_RUNNER_CAPACITY=10" + "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" + ]; + BindPaths = [ "/var/run/docker.sock" ]; + EnvironmentFile = [ cfg.sharedSecretFile ]; + ExecStart = "${dockerPkg}/bin/drone-runner-docker"; + User = "drone-runner-docker"; + Group = "drone-runner-docker"; + }; + }; + + # Make sure it is activated in that case + virtualisation.docker.enable = true; + + users.users.drone-runner-docker = { + isSystemUser = true; + group = "drone-runner-docker"; + extraGroups = [ "docker" ]; # Give access to the daemon + }; + users.groups.drone-runner-docker = { }; + }; +} diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix new file mode 100644 index 0000000..01cc11b --- /dev/null +++ b/modules/services/drone/runner-exec/default.nix @@ -0,0 +1,55 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + hasRunner = (name: builtins.elem name cfg.runners); + execPkg = pkgs.drone-runner-exec; +in +{ + config = lib.mkIf (cfg.enable && hasRunner "exec") { + systemd.services.drone-runner-exec = { + wantedBy = [ "multi-user.target" ]; + # might break deployment + restartIfChanged = false; + confinement.enable = true; + confinement.packages = with pkgs; [ git gnutar bash nixUnstable gzip ]; + path = with pkgs; [ git gnutar bash nixUnstable gzip ]; + serviceConfig = { + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_RUNNER_CAPACITY=10" + "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" + "NIX_REMOTE=daemon" + "PAGER=cat" + ]; + BindPaths = [ "/nix/var/nix/daemon-socket/socket" ]; + BindReadOnlyPaths = [ + "/etc/resolv.conf:/etc/resolv.conf" + "/etc/resolvconf.conf:/etc/resolvconf.conf" + "/etc/passwd:/etc/passwd" + "/etc/group:/etc/group" + "/nix/var/nix/profiles/system/etc/nix:/etc/nix" + "${ + config.environment.etc."ssl/certs/ca-certificates.crt".source + }:/etc/ssl/certs/ca-certificates.crt" + "${ + config.environment.etc."ssh/ssh_known_hosts".source + }:/etc/ssh/ssh_known_hosts" + "/etc/machine-id" + # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing + "/nix/" + ]; + EnvironmentFile = [ cfg.sharedSecretFile ]; + ExecStart = "${execPkg}/bin/drone-runner-exec"; + User = "drone-runner-exec"; + Group = "drone-runner-exec"; + }; + }; + + users.users.drone-runner-exec = { + isSystemUser = true; + group = "drone-runner-exec"; + }; + users.groups.drone-runner-exec = { }; + }; +} diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix new file mode 100644 index 0000000..97e20a3 --- /dev/null +++ b/modules/services/drone/server/default.nix @@ -0,0 +1,53 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + secrets = config.age.secrets; +in +{ + config = lib.mkIf cfg.enable { + systemd.services.drone-server = { + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + EnvironmentFile = [ cfg.sharedSecretFile ]; + Environment = [ + "DRONE_DATABASE_DRIVER=sqlite3" + "DRONE_DATABASE_DATASOURCE=/var/lib/drone-server/drone.sqlite" + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_SERVER_PORT=:${toString cfg.port}" + "DRONE_USER_CREATE=username:${cfg.admin},admin:true" + "DRONE_JSONNET_ENABLED=true" + "DRONE_STARLARK_ENABLED=true" + ]; + StateDirectory = "drone-server"; + ExecStart = "${pkgs.drone}/bin/drone-server"; + User = "drone"; + Group = "drone"; + }; + }; + + users.users.drone = { + isSystemUser = true; + createHome = true; + group = "drone"; + }; + + users.groups.drone = { }; + + services.nginx.virtualHosts."${cfg.vhostName}" = { + forceSSL = true; + useACMEHost = cfg.vhostName; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}"; + proxyWebsockets = true; + }; + }; + + security.acme.certs."${cfg.vhostName}" = { + dnsProvider = "gcloud"; + credentialsFile = secrets."acme/credentials".path; + }; + + my.services.backup = { paths = [ "/var/lib/droner-server" ]; }; + }; +} -- cgit 1.4.1