From 5f40c7a5b0cb555f64231d18cf105bf0ec7eb0a2 Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Sat, 5 Nov 2022 12:47:02 -0700 Subject: Revert "ref(drone): remove all modules and configurations" This reverts commit 614fc2fcce0e9ae0bcfdc6e08d3c4bac846d02a8. --- modules/services/default.nix | 1 + modules/services/drone/default.nix | 39 +++++++++++++++++ modules/services/drone/runner-docker/default.nix | 40 +++++++++++++++++ modules/services/drone/runner-exec/default.nix | 55 ++++++++++++++++++++++++ modules/services/drone/server/default.nix | 53 +++++++++++++++++++++++ 5 files changed, 188 insertions(+) create mode 100644 modules/services/drone/default.nix create mode 100644 modules/services/drone/runner-docker/default.nix create mode 100644 modules/services/drone/runner-exec/default.nix create mode 100644 modules/services/drone/server/default.nix (limited to 'modules') diff --git a/modules/services/default.nix b/modules/services/default.nix index c67a6cd..73e2e6d 100644 --- a/modules/services/default.nix +++ b/modules/services/default.nix @@ -6,6 +6,7 @@ ./backup ./buildkite ./cgit + ./drone ./fwupd ./gerrit ./gitea diff --git a/modules/services/drone/default.nix b/modules/services/drone/default.nix new file mode 100644 index 0000000..dedf120 --- /dev/null +++ b/modules/services/drone/default.nix @@ -0,0 +1,39 @@ +# A docker-based CI/CD system +# +# Inspired by [1] +# [1]: https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modules/drone.nix +{ lib, ... }: { + imports = [ ./runner-docker ./runner-exec ./server ]; + + options.my.services.drone = with lib; { + enable = mkEnableOption "Drone CI"; + vhostName = mkOption { + type = types.str; + example = "drone.fcuny.net"; + description = "Name for the virtual host"; + }; + runners = mkOption { + type = with types; listOf (enum [ "exec" "docker" ]); + default = [ ]; + example = [ "exec" "docker" ]; + description = "Types of runners to enable"; + }; + admin = mkOption { + type = types.str; + default = "fcuny"; + example = "admin"; + description = "Name of the admin user"; + }; + port = mkOption { + type = types.port; + default = 3030; + example = 8080; + description = "Internal port of the Drone UI"; + }; + sharedSecretFile = mkOption { + type = types.str; + example = "/run/secrets/drone-rpc.env"; + description = "Shared RPC secret to inject into server and runners"; + }; + }; +} diff --git a/modules/services/drone/runner-docker/default.nix b/modules/services/drone/runner-docker/default.nix new file mode 100644 index 0000000..428a8d6 --- /dev/null +++ b/modules/services/drone/runner-docker/default.nix @@ -0,0 +1,40 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + hasRunner = (name: builtins.elem name cfg.runners); + dockerPkg = pkgs.drone-runner-docker; +in +{ + config = lib.mkIf (cfg.enable && hasRunner "docker") { + systemd.services.drone-runner-docker = { + wantedBy = [ "multi-user.target" ]; + after = [ "docker.socket" ]; # Needs the socket to be available + # might break deployment + restartIfChanged = false; + confinement.enable = true; + serviceConfig = { + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_RUNNER_CAPACITY=10" + "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" + ]; + BindPaths = [ "/var/run/docker.sock" ]; + EnvironmentFile = [ cfg.sharedSecretFile ]; + ExecStart = "${dockerPkg}/bin/drone-runner-docker"; + User = "drone-runner-docker"; + Group = "drone-runner-docker"; + }; + }; + + # Make sure it is activated in that case + virtualisation.docker.enable = true; + + users.users.drone-runner-docker = { + isSystemUser = true; + group = "drone-runner-docker"; + extraGroups = [ "docker" ]; # Give access to the daemon + }; + users.groups.drone-runner-docker = { }; + }; +} diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix new file mode 100644 index 0000000..01cc11b --- /dev/null +++ b/modules/services/drone/runner-exec/default.nix @@ -0,0 +1,55 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + hasRunner = (name: builtins.elem name cfg.runners); + execPkg = pkgs.drone-runner-exec; +in +{ + config = lib.mkIf (cfg.enable && hasRunner "exec") { + systemd.services.drone-runner-exec = { + wantedBy = [ "multi-user.target" ]; + # might break deployment + restartIfChanged = false; + confinement.enable = true; + confinement.packages = with pkgs; [ git gnutar bash nixUnstable gzip ]; + path = with pkgs; [ git gnutar bash nixUnstable gzip ]; + serviceConfig = { + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_RUNNER_CAPACITY=10" + "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" + "NIX_REMOTE=daemon" + "PAGER=cat" + ]; + BindPaths = [ "/nix/var/nix/daemon-socket/socket" ]; + BindReadOnlyPaths = [ + "/etc/resolv.conf:/etc/resolv.conf" + "/etc/resolvconf.conf:/etc/resolvconf.conf" + "/etc/passwd:/etc/passwd" + "/etc/group:/etc/group" + "/nix/var/nix/profiles/system/etc/nix:/etc/nix" + "${ + config.environment.etc."ssl/certs/ca-certificates.crt".source + }:/etc/ssl/certs/ca-certificates.crt" + "${ + config.environment.etc."ssh/ssh_known_hosts".source + }:/etc/ssh/ssh_known_hosts" + "/etc/machine-id" + # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing + "/nix/" + ]; + EnvironmentFile = [ cfg.sharedSecretFile ]; + ExecStart = "${execPkg}/bin/drone-runner-exec"; + User = "drone-runner-exec"; + Group = "drone-runner-exec"; + }; + }; + + users.users.drone-runner-exec = { + isSystemUser = true; + group = "drone-runner-exec"; + }; + users.groups.drone-runner-exec = { }; + }; +} diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix new file mode 100644 index 0000000..97e20a3 --- /dev/null +++ b/modules/services/drone/server/default.nix @@ -0,0 +1,53 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.my.services.drone; + secrets = config.age.secrets; +in +{ + config = lib.mkIf cfg.enable { + systemd.services.drone-server = { + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + EnvironmentFile = [ cfg.sharedSecretFile ]; + Environment = [ + "DRONE_DATABASE_DRIVER=sqlite3" + "DRONE_DATABASE_DATASOURCE=/var/lib/drone-server/drone.sqlite" + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_SERVER_PORT=:${toString cfg.port}" + "DRONE_USER_CREATE=username:${cfg.admin},admin:true" + "DRONE_JSONNET_ENABLED=true" + "DRONE_STARLARK_ENABLED=true" + ]; + StateDirectory = "drone-server"; + ExecStart = "${pkgs.drone}/bin/drone-server"; + User = "drone"; + Group = "drone"; + }; + }; + + users.users.drone = { + isSystemUser = true; + createHome = true; + group = "drone"; + }; + + users.groups.drone = { }; + + services.nginx.virtualHosts."${cfg.vhostName}" = { + forceSSL = true; + useACMEHost = cfg.vhostName; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}"; + proxyWebsockets = true; + }; + }; + + security.acme.certs."${cfg.vhostName}" = { + dnsProvider = "gcloud"; + credentialsFile = secrets."acme/credentials".path; + }; + + my.services.backup = { paths = [ "/var/lib/droner-server" ]; }; + }; +} -- cgit 1.4.1 From 9038f3998dcc66f2ca091100f857a518fe201212 Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Sat, 5 Nov 2022 13:26:49 -0700 Subject: fix(services/drone): enable drone The URL for drone changed to https://ci.fcuny.net. The secrets also changed (and we remove the unencrypted file with secrets). --- home/drone-cli/default.nix | 2 +- hosts/aptos/home.nix | 1 + hosts/tahoe/secrets/drone/secrets.age | Bin 697 -> 703 bytes hosts/tahoe/secrets/drone/shared-secrets | 5 ----- hosts/tahoe/secrets/secrets.nix | 5 +++++ hosts/tahoe/services.nix | 6 ++++++ modules/services/drone/runner-exec/default.nix | 7 +++++-- modules/services/drone/server/default.nix | 7 +------ 8 files changed, 19 insertions(+), 14 deletions(-) delete mode 100644 hosts/tahoe/secrets/drone/shared-secrets (limited to 'modules') diff --git a/home/drone-cli/default.nix b/home/drone-cli/default.nix index 948e88a..68173c8 100644 --- a/home/drone-cli/default.nix +++ b/home/drone-cli/default.nix @@ -7,6 +7,6 @@ in }; config = lib.mkIf cfg.enable { home.packages = with pkgs; [ drone-cli ]; - home.sessionVariables = { DRONE_SERVER = "https://drone.fcuny.xyz/"; }; + home.sessionVariables = { DRONE_SERVER = "https://ci.fcuny.net/"; }; }; } diff --git a/hosts/aptos/home.nix b/hosts/aptos/home.nix index 2d60b53..2faaa82 100644 --- a/hosts/aptos/home.nix +++ b/hosts/aptos/home.nix @@ -38,6 +38,7 @@ go.enable = true; python.enable = true; rust.enable = true; + drone-cli.enable = true; # web firefox.enable = true; diff --git a/hosts/tahoe/secrets/drone/secrets.age b/hosts/tahoe/secrets/drone/secrets.age index 618bbc6..c0eb97b 100644 Binary files a/hosts/tahoe/secrets/drone/secrets.age and b/hosts/tahoe/secrets/drone/secrets.age differ diff --git a/hosts/tahoe/secrets/drone/shared-secrets b/hosts/tahoe/secrets/drone/shared-secrets deleted file mode 100644 index 47612be..0000000 --- a/hosts/tahoe/secrets/drone/shared-secrets +++ /dev/null @@ -1,5 +0,0 @@ -DRONE_GITEA_CLIENT_ID=21ef7412-a58a-493c-beec-2e1dc27ebe79 -DRONE_GITEA_CLIENT_SECRET=GCXGi97PXxAoMTpHveMtNJXDyzdvI8jeC0TaEtCgpPab -DRONE_GITEA_SERVER=https://git.fcuny.net -DRONE_GIT_ALWAYS_AUTH=1 -DRONE_RPC_SECRET=d3daa6782d0f4ed66f7f557fa384ff8f diff --git a/hosts/tahoe/secrets/secrets.nix b/hosts/tahoe/secrets/secrets.nix index 390f2b6..7b9500f 100644 --- a/hosts/tahoe/secrets/secrets.nix +++ b/hosts/tahoe/secrets/secrets.nix @@ -22,6 +22,11 @@ in mode = "0440"; }; + "drone/secrets.age" = { + publicKeys = all; + owner = "drone"; + }; + "buildkite/graphql.age" = { publicKeys = all; owner = "buildkite-agent-builder-1"; diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix index f7edfa4..e5f53ab 100644 --- a/hosts/tahoe/services.nix +++ b/hosts/tahoe/services.nix @@ -20,6 +20,12 @@ in enable = true; stateDir = "/var/lib/gitea"; }; + drone = { + enable = true; + vhostName = "ci.fcuny.net"; + runners = [ "docker" "exec" ]; + sharedSecretFile = secrets."drone/secrets".path; + }; prometheus = { enable = true; }; grafana = { enable = true; diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix index 01cc11b..cbfbb9d 100644 --- a/modules/services/drone/runner-exec/default.nix +++ b/modules/services/drone/runner-exec/default.nix @@ -19,10 +19,12 @@ in "DRONE_SERVER_PROTO=https" "DRONE_RUNNER_CAPACITY=10" "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}" - "NIX_REMOTE=daemon" "PAGER=cat" ]; - BindPaths = [ "/nix/var/nix/daemon-socket/socket" ]; + BindPaths = [ + "/nix/var/nix/daemon-socket/socket" + "/var/run/docker.sock" + ]; BindReadOnlyPaths = [ "/etc/resolv.conf:/etc/resolv.conf" "/etc/resolvconf.conf:/etc/resolvconf.conf" @@ -49,6 +51,7 @@ in users.users.drone-runner-exec = { isSystemUser = true; group = "drone-runner-exec"; + extraGroups = [ "docker" ]; # Give access to the daemon }; users.groups.drone-runner-exec = { }; }; diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix index 97e20a3..77f4ee2 100644 --- a/modules/services/drone/server/default.nix +++ b/modules/services/drone/server/default.nix @@ -36,18 +36,13 @@ in services.nginx.virtualHosts."${cfg.vhostName}" = { forceSSL = true; - useACMEHost = cfg.vhostName; + enableACME = true; locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.port}"; proxyWebsockets = true; }; }; - security.acme.certs."${cfg.vhostName}" = { - dnsProvider = "gcloud"; - credentialsFile = secrets."acme/credentials".path; - }; - my.services.backup = { paths = [ "/var/lib/droner-server" ]; }; }; } -- cgit 1.4.1