feat(ops/nixos): Deploy Panettone to Whitby

Deploy Panettone to whitby as a systemd service, proxied to from an
nginx virtual host listening at b.tvl.fyi

Change-Id: I69755566151a45120e6b3453751af0e9291fa241
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1339
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>

ops/nixos/panettone.nix

@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.depot.panettone;
+  depot = config.depot;
+in {
+  options.services.depot.panettone = with lib; {
+    enable = mkEnableOption "Panettone issue tracker";
+
+    port = mkOption {
+      description = "Port on which Panettone should listen";
+      type = types.int;
+      default = 7268;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.panettone = {
+      wantedBy = [ "multi-user.target" ];
+      script = "${depot.web.panettone}/bin/panettone";
+
+      serviceConfig = {
+        DynamicUser = true;
+        Restart = "always";
+        StateDirectory = "panettone";
+      };
+
+      environment = {
+        PANETTONE_PORT = toString cfg.port;
+        PANETTONE_DATA_DIR = "/var/lib/panettone";
+      };
+    };
+  };
+}

ops/nixos/whitby/default.nix

@@ -18,6 +18,7 @@ in lib.fix(self: {
     "${depot.depotPath}/ops/nixos/clbot.nix"
     "${depot.depotPath}/ops/nixos/depot.nix"
     "${depot.depotPath}/ops/nixos/monorepo-gerrit.nix"
+    "${depot.depotPath}/ops/nixos/panettone.nix"
     "${depot.depotPath}/ops/nixos/smtprelay.nix"
     "${depot.depotPath}/ops/nixos/sourcegraph.nix"
     "${depot.depotPath}/ops/nixos/tvl-slapd/default.nix"
@@ -28,6 +29,7 @@ in lib.fix(self: {
     "${depot.depotPath}/ops/nixos/www/login.tvl.fyi.nix"
     "${depot.depotPath}/ops/nixos/www/todo.tvl.fyi.nix"
     "${depot.depotPath}/ops/nixos/www/tvl.fyi.nix"
+    "${depot.depotPath}/ops/nixos/www/b.tvl.fyi.nix"
     "${depot.third_party.nixpkgsSrc}/nixos/modules/services/web-apps/gerrit.nix"
   ];
 
@@ -210,8 +212,13 @@ in lib.fix(self: {
     };
   };
 
+  services.depot = {
     # Run a SourceGraph code search instance
-  services.depot.sourcegraph.enable = true;
+    sourcegraph.enable = true;
+
+    # Run the Panettone issue tracker
+    panettone.enable = true;
+  };
 
   environment.systemPackages = with nixpkgs; [
     bb

ops/nixos/www/b.tvl.fyi.nix

@@ -0,0 +1,21 @@
+{ config, ... }:
+
+{
+  imports = [
+    ./base.nix
+  ];
+
+  config = {
+    services.nginx.virtualHosts."b.tvl.fyi" = {
+      serverName = "b.tvl.fyi";
+      enableACME = true;
+      forceSSL = true;
+
+      extraConfig = ''
+        location / {
+          proxy_pass http://localhost:${toString config.services.depot.panettone.port};
+        }
+      '';
+    };
+  };
+}