Commit graph

864 commits

Author SHA1 Message Date
Vincent Ambo
e9efa579a7 docs(ops/yandex-cloud-rs): add developer-facing README
Mostly to remind myself about the wonky release process.

Change-Id: I76ea8d9a2ed600ebb31f4b1a5368f3cefa0556d6
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8598
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2023-05-19 09:23:08 +00:00
Florian Klink
14a8ea9eab feat(ops/terraform/deploy-nixos): make target_user_ssh_key optional
In case `target_user_ssh_key` points to an empty string, nixos-copy.sh
just doesn't set `IdentityFile=` at all.

This allows using deploy-nixos without any explicitly passed ssh keys,
but picking up whatever ssh setup the user has configured locally.

Change-Id: If335ce8434627e61da13bf6923b9767085af08a5
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8576
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-05-16 09:55:23 +00:00
sterni
b22b685f0b chore: address renames of boot & tmp related options
Change-Id: I78f2116a63675fff5a36826b3e5390798ab9db9f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8526
Tested-by: BuildkiteCI
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
Reviewed-by: grfn <grfn@gws.fyi>
Reviewed-by: flokli
2023-05-11 10:10:58 +00:00
Florian Klink
b58f6f1d61 feat(ops/modules/open_eid): add support for Web eID extension
Most likely due to bad UX in browsers for hardware-backed TLS client
cert auth, most websites have switched from client-side TLS to the "Web
eID" extension.

Once installed, the extension uses [Native Messaging] to talk to a
`web-eid-app` application, which handles the communication with the
smart card itself.

This can be tested on https://web-eid.eu/ .

The commit needs nixpkgs to be bumped past
https://github.com/NixOS/nixpkgs/pull/227354 .

[Native Messaging]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging

Change-Id: Iffe6d81ecf7cee25406fa39a983ff52cf669c373
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8490
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-04-28 13:14:24 +00:00
Vincent Ambo
ea1383682d feat(ops/yandex-cloud-rs): generated gRPC clients for Yandex Cloud
This uses tonic to generate the full set of gRPC clients for Yandex
Cloud. Includes some utility functions like an authentication
interceptor to make these actually work.

Since the upstream protos are exported regularly I've decided that the
versioning will simply be date-based.

The point of this is journaldriver integration, of course, hence also
the log-centric example code.

Change-Id: I00a615dcba80030e7f9bcfd476b2cfdb298f130d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8525
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2023-04-28 12:50:33 +00:00
Johannes Kirschbauer
f1ca5a3096 feat(ops/users): Add hsjobeki to users
Change-Id: Ib5f8c314d2c7ad6af948ff23754eeb895b1f1e94
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8529
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: flokli <flokli@flokli.de>
2023-04-28 11:17:20 +00:00
Florian Klink
2363a194cd fix(ops/modules/open_eid): use libdigidocpp.bin
nixpkgs commit 134036f642a7f3ba9efeab509727c0989458b02b moved the
digidoc-tool binary to the `bin` output, so this wasn't actually
providing the digidoc-tool binary anymore.

Change-Id: Id5f7cc69d55b7cc058a6361512cc74de0e7bc1b2
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8487
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Autosubmit: flokli <flokli@flokli.de>
2023-04-19 09:11:34 +00:00
sterni
faa45f076d chore: adapt to ssh option renames
Change-Id: I6fc2aaefe40e449bd1937bb68f3a2ab4abaa5cd0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8372
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI
2023-04-11 14:29:06 +00:00
sterni
96d7f4f0ac chore(3p/sources): Bump channels & overlays
* Satisfy new assert that the corresponding shell needs to be enabled
  via programs.* if it is as the login shell of at least one user.

* //users/tazjin: “Address” removal of hardware.video.hidpi option.

* //3p/gerrit: update fetch sha256

Change-Id: Id0988a0ea7f393d6b7848a7104fc3526ee1177f4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8407
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-04-07 09:20:33 +00:00
Florian Klink
e9686f84d9 fix(views/kit): communicate :unsign in the tvl-kit URL directly
Instead of prepending :unsign to all URLs in josh-proxy, and for all
calls to filteredGitPush, explicitly use it only in the filter we use
for the `export-kit` extraStep.

This means, people cloning tvl-kit via

> https://code.tvl.fyi/depot.git:workspace=views/kit.git

now need to update the URL to point to

> https://code.tvl.fyi/depot.git:unsign:workspace=views/kit.git

instead.

git@github.com:tvlfyi/kit.git will keep the same hashes, as it's updated
to export the unsigned workspace view of it.

This is less invasive than dooming every josh workspace to have to strip
signatures.

Change-Id: I6de05182fad4c3695081388c3bbf37306521d255
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8369
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-03-31 08:46:01 +00:00
Vincent Ambo
73c12f7c4f fix(ops/www): allow all indexing on cl.tvl.fyi
I *want* search engines to index our CLs, they might be useful!

Change-Id: I956d92c80d812e1aefefb6daeba77a1588055b94
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8361
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: flokli <flokli@flokli.de>
2023-03-29 12:17:56 +00:00
Vincent Ambo
0965600fe6 feat(ops): serve Tvix website & docs on (docs.)tvix.dev
Change-Id: I198ea197867f9b9a48e51665d0665f722202e02e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8299
Reviewed-by: flokli <flokli@flokli.de>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-03-14 22:10:40 +00:00
Vincent Ambo
790eac5a5c feat(ops/glesys): add CNAME for docs.tvix.dev
Change-Id: Ie1994ac4d14344c82ae184f4e3cd9f5292d96c84
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8297
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2023-03-14 21:59:40 +00:00
Vincent Ambo
3370724062 feat(ops/glesys): point tvix.dev at whitby
Change-Id: Ied022e6c1a8039a9db375a8593afb76edcaa6dbd
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8295
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-03-14 21:59:40 +00:00
Florian Klink
f7439d2526 fix(ops/terraform): s/TARGET_ADDRESS/TARGET_HOST
We missed renaming this as well while iterating over
https://cl.tvl.fyi/c/depot/+/7950.

Change-Id: I704d3b60bb3beb1a2148e27bdd4a49075a6649b3
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8230
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-03-08 16:59:19 +00:00
Vincent Ambo
89d9ce39b4 chore(3p/josh): update josh to recent master commit
It's been a long time since we updated josh, almost 400 commits in
between. I read through the entire changelog, and here are relevant
josh commits from in between that might be interesting to us:

  38eecee Fix optimisation bug for compose filter (#1159)
  e1d10b6 Add :rev(...) filter
  0f1a07b Initial implementation of refs locking (#929)
  88cea2a Initial work on meta repo support
  030ad93 Change magic refs to include "for"
  28b1d75 Add split changes feature (#904)
  1f908d7 Discover filters only on HEAD (#774)
  a368d8f Make --require-auth only apply to push
  8d80230 Add :linear filter (#741)
  3460ec2 Implement redundant refs filtering (#700)
  55b4e50 Implement stacked changes support (#699)
  ea1f814 Handle @sha urls by creating magic ref (#690)
  883a381 Run filter discovery only on changed refs (#685)
  4bb004f Prepend refs/heads to base parameter as default (#664)

Of particular interest is a368d8f, which allows us to drop our
authentication patch and use the standard --require-auth flag again.

The default behaviour of dropping signatures on commits (which are
invalid after filtering) has also been changed in josh, now only
occuring when the `:unsign` filter is present. Since this breaks
commit hashes with our existing exported histories, we are opting to
set a `:unsign` filter prefix on all proxy requests to ensure that the
hashes stay consistent.

During this update we found a bug (josh#1155) which was fixed in the
commit that this CL moves josh to.

Change-Id: I3afac1619f3aa90313a0441da91f0e4a96fe0a3b
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8186
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2023-03-07 16:46:54 +00:00
Florian Klink
774194652b feat(ops/terraform): add trigger to deploy-nixos, remove target_name
This allows passing in custom triggers to trigger a (re)deploy.

For example, a caller can put an AWS instance ID into the triggers to
cause a redeploy whenever the instance ID has changed.

The `target_name` terraform variable was doing something similar, but
`triggers` is more generic, allowing multiple triggers, without having
to stringify them.

We also don't need to trigger on the attrpath - it can be changed, and
as long as it still evaluates to the same
`data.external.nixos_system.result.drv` (which is checked on every
plan), no redeploy needs to be made.

Change-Id: I94ce787a50830b87b6f53c08e042e4abe4036bdd
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8191
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: flokli <flokli@flokli.de>
2023-03-03 14:53:43 +00:00
Florian Klink
c3750079f7 feat(ops/terraform): allow specifying an entrypoint for the attrset
This adds an additional parameter `entrypoint`, pointing to a .nix file
(or a directory containing a `default.nix` file) that's providing the
attribute path asked for.

If not set / kept at the default (empty string), it falls back to the
root dir of the repository as before.

Change-Id: I2e63114f21660c842153ac15424b3491d66624d2
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8190
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Autosubmit: flokli <flokli@flokli.de>
2023-03-03 14:53:43 +00:00
Vincent Ambo
dbca46d052 feat(ops/terraform): add module for deploying NixOS system closures
This module makes it fairly easy to deploy NixOS system closures using
Terraform, while properly separating the evaluation of a
derivation (to determine whether a deploy is needed) from the building
and copying of the closure itself.

This has been on my stack for a while. It was originally developed for
Resoptima, who agreed to open-sourcing it in depot back when we
completed our work with them. Their contribution has been acknowledged
in the README.

Co-Authored-By: Florian Klink <flokli@flokli.de>
Change-Id: Ica4c170658cd25f1fb7072c9a45735fcc4351474
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7950
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-03-03 10:48:13 +00:00
Alyssa Ross
3c68159b81 chore(whitby): enable zram swap
Whitby has a lot of memory, but I've still been fighting with the OOM
Killer trying to build a few big packages at the same time.  Besides,
it's generally a good idea to always have swap available even if
there's lots of memory for caching optimisation reasons[1], and zram
swap is efficient enough to basically provide bonus memory for free.

[1]: https://haydenjames.io/linux-performance-almost-always-add-swap-space/

Change-Id: I1fbe60f7975ebfa38e341e0de76848ec79b6fcf0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8065
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2023-02-11 12:14:35 +00:00
Alyssa Ross
08b300aaa8 chore(ops/modules): add a GECOS for my user
This way, I won't have to teach my name one at a time to every program
that wants to know my it (e.g. git).

Change-Id: I45ddd9c2343a10cd4c13bacd9a97b7470db95c14
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8038
Reviewed-by: tazjin <tazjin@tvl.su>
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2023-02-09 09:43:48 +00:00
Florian Klink
30c4454056 fix(ops/buildkite): set default_branch explicitly
It looks like this needs to be set for the tvix pipeline to succeed.

It was set to `canon` for `tvl-kit` (not sure if manually, or some
autodetection previously did it for us that's not present anymore).

Anyways, this sets it to how it's set in the web interface, to hopefully
fix it.

Change-Id: Ic3eb60e3f421fa949a84dcdaa928823ff45f679a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8008
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Autosubmit: flokli <flokli@flokli.de>
2023-02-01 17:25:06 +00:00
Florian Klink
88d86741dc feat(ops/pipelines): trigger tvix buildkite pipeline
Change-Id: I4e81694b9686f977a6590c5e1703a4ef413b0cf4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8003
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2023-02-01 17:11:50 +00:00
Florian Klink
4a7ec1006d feat(ops/buildkite): add tvix pipeline
Change-Id: Ie701e0b77c596e07600efd1a59749d05068f0dbc
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8006
Tested-by: BuildkiteCI
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
2023-02-01 17:11:50 +00:00
Vincent Ambo
8ed81cf755 feat(ops/secrets): add flokli to terraform secrets access
Change-Id: I9ede20028560f2da0fef89dfe431609c21bda51c
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8005
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2023-02-01 16:39:32 +00:00
Florian Klink
964367044d feat(ops/secrets): add key for flokli
Change-Id: I52299b39d1d68ee1b700b631f70ef809af682e26
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8004
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2023-02-01 16:25:54 +00:00
Vincent Ambo
3caa4c4aa4 fix(ops/www): increase buffer memory size for auth.tvl.fyi
Keycloak seems to have decided today that it will now send headers
that are larger than what the nginx default configuration can handle.

The numbers are a mix of made up and taken from random nginx voodoo
posts on the internet, so they're as good a guess as anyone's.

Change-Id: If037bcba48eee371cc96304b150276c669930c75
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7992
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
Autosubmit: tazjin <tazjin@tvl.su>
2023-02-01 09:30:24 +00:00
Vincent Ambo
9a500c3e9b chore(journaldriver): bump version number
Changes basically only include dependency bumps. This is r/5656.

Change-Id: If2ad8914c45b61de6525e2640a15d167fef1dfd4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7819
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2023-01-13 08:31:14 +00:00
Vincent Ambo
6e66e988df chore(journaldriver): simple dependency bumps
This bumps all dependencies to their newest version that does not
require code changes.

Change-Id: I7c7f01ce08de0cced86bab93b441327d3061f12d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7818
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2023-01-13 08:24:03 +00:00
Vincent Ambo
d62c7ddfda feat(ops/modules): enable mail address obfuscation in public web UI
Change-Id: I47b5313bee84893d405f86aefb3682cda3cfc6d7
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7637
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
2022-12-29 20:11:24 +00:00
Vincent Ambo
45fa75c0cd fix(ops/modules): list IMAP server on public-inbox page
This fix can only be applied after the upstream public-inbox
fix (https://github.com/NixOS/nixpkgs/pull/207693) has been merged.

Change-Id: I957473e2895b7e57baad25c9e908b36aa790f3a6
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7636
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
2022-12-29 20:11:23 +00:00
Vincent Ambo
ee7a724b60 fix(ops/pipelines): explicitly set contexts for annotations
I think what might be going on with b/231 is that the annotations
somehow started conflicting because they don't have contexts set.

Lets try setting a context and see if it changs anything ...

Change-Id: I62ed57f9e24f08e4e7215f05d35cfa769e2e2c24
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7640
Reviewed-by: sterni <sternenseemann@systemli.org>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-12-28 16:35:20 +00:00
Vincent Ambo
62e19a8321 feat(web/inbox): add landing page for inbox.tvl.su
This landing page explains how to use the public-inbox.

Change-Id: I37d74decad5173ab35051970593f1d28001af2b4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7645
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
2022-12-28 08:17:45 +00:00
Vincent Ambo
eb62cb1421 style(ops/modules): add inbox email address to public-inbox header
Change-Id: Ib7d9089b63bba7ebc44d3438ed284e752f0595e9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7638
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2022-12-28 08:17:45 +00:00
Vincent Ambo
6552cf03b3 feat(ops/modules): enable NNTP on inbox.tvl.su
Change-Id: Iec564860a247fe51a5549129be294a3629645519
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7635
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2022-12-28 08:17:45 +00:00
Vincent Ambo
e665f53621 feat(ops/modules): enable IMAP access for public-inbox
This sets up IMAP on inbox.tvl.su:993

I added a hack to work around problems with the NixOS ACME module.
Spent way too much time of my life with problems with that module, so
I only use it with blunt force these days. Others are welcome to make
a cleaner solution.

Change-Id: Ice828766020856cf17d2f0a5b4491f4cec8ad9b4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7633
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2022-12-28 08:17:45 +00:00
Vincent Ambo
81fd9caf3e docs: change email address mentions to depot@tvl.su
This is the new address which leads to the public inbox at inbox.tvl.su

Change-Id: I45d98a373b8acda49b05c4f74669ffb9ad1f1a3c
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7632
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
2022-12-27 19:46:11 +00:00
Vincent Ambo
e68c2f3736 feat(ops/modules): index incoming mail in public-inbox
Change-Id: I8a3e2c0e789057fd1edd015ccb8fdcc0cbb52cd8
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7631
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
2022-12-27 19:46:11 +00:00
Vincent Ambo
aa0197ab83 feat(ops/modules): configure offlineimap for depot@tvl.su
On the machine running public-inbox, this will start automatically
fetching mails from depot@tvl.su and making them available to
public-inbox.

Change-Id: I2469207bd41d64eba747a74ae5fda9fed548cc83
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7630
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2022-12-27 19:46:11 +00:00
Vincent Ambo
477873d7ea feat(ops/secrets): add secret for IMAP to depot@tvl.su
Change-Id: If3b3981e5d68ceba2bcc85ed0ad9cc0b46148b74
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7629
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2022-12-27 19:46:11 +00:00
Vincent Ambo
d446143413 feat(ops/modules): set up public-inbox at inbox.tvl.su
Initial setup which does not yet include fetching mails at all, this
is for now only going to display a manually populated view of the
existing mailing list while the rest of this stuff is set up.

Change-Id: Ie1235bd257c9056fe37d0740dfca771ebdd880eb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7628
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
2022-12-27 19:46:11 +00:00
Vincent Ambo
3b59f1edc1 feat(ops/glesys): set up DNS record for inbox.tvl.su
Change-Id: I85365e5e0bb3e464b439266cb6efad9b2e3763cb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7627
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
2022-12-25 10:27:29 +00:00
Ryan Lahfa
a553e758f1 feat(ops/users): add raitobezarius to users
Change-Id: Ia6cb935f4358526891ece20538d0fa60cfc81095
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7621
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2022-12-24 21:52:14 +00:00
William Carroll
9166a9915a feat(wpcarro/nixos): Support kyoko
Yet Another NixOS System

Change-Id: I29590c5e7c2a651f3ef56642018649dddd9f06b6
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7297
Reviewed-by: wpcarro <wpcarro@gmail.com>
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: wpcarro <wpcarro@gmail.com>
2022-12-12 18:46:16 +00:00
aaqa ishtyaq
2afcbbc451 feat(ops/users): add aaqaishtyaq to users.
Signed-off-by: Aaqa Ishtyaq <aaqaishtyaq@gmail.com>
Change-Id: I0ee0142d6a57c05347de45305d333d1b705928e9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7552
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-12-10 15:16:32 +00:00
Vincent Ambo
ee4b95e470 fix(ops/modules): regularly restart panettone for b/225
Change-Id: I27565e0e462ecb431d0f82bb3f6026b1eb369279
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7504
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-12-05 09:40:38 +00:00
Geoffrey Huntley
eda6b93505 feat(ops/users): add ghuntley to users
Fixed syntax error in the original patch (superfluous quote).

Co-authored-by: sterni <sternenseemann@systemli.org>
Change-Id: I9b6aac345906def185e30f2a9bbecde84848863a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7527
Tested-by: BuildkiteCI
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: grfn <grfn@gws.fyi>
2022-12-05 01:01:39 +00:00
Vincent Ambo
abaa90c3ab fix(ops/pipelines): limit concurrency of 🦙
When pushing a large chain of CLs, builds can fail with OOM issues as
many Nix evaluations of the depot are happening simultaneously.

To work around this, we limit the concurrency of simultaneous Nix
evaluations (i.e. the `:llama` step). This can slow down the start of
builds in a large chain of small changes, but that is a better
tradeoff than failing the builds entirely and making people click
buttons.

Change-Id: If351aaad22d52e2bcf871377f22ab1df594c518d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7501
Reviewed-by: sterni <sternenseemann@systemli.org>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-12-03 14:11:04 +00:00
Lyle Mantooth
4cd4111d0d feat(ops/users): add IslandUsurper to users.
Change-Id: Id6bda45acd33dc4e57775321aa8f318164ca7ee0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7469
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-12-01 10:42:47 +00:00
Márton Boros
c06840ff87 feat(ops/users): Add brainrake to users
Change-Id: I6bb611fd802ed3f1e748d4c75dc2fd4bea9cc91a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7365
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-11-23 13:55:53 +00:00
Vo Minh Thu
888b7faa18 feat(ops/users): Add noteed to users
Change-Id: I40b99a46b76d0df40b811350f3560c629babdbc4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7319
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-11-21 13:40:33 +00:00
jhahn
40826e664d feat(ops/users): Add jrhahn to users
Change-Id: I00913a302ecc23fec2e60875dc164b24d73ba4ad
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7257
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
2022-11-09 21:57:54 +00:00
sterni
83dabf8955 fix(ops/machines/whitby): serve grafana at status.tvl.su again
This is a follow up to cl/7191 which neglected to adjust the
status.tvl.su.nix module and re-enable it.

Change-Id: Icc1917004cd50e5eab61a29bc68b393ba9bd6325
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7226
Tested-by: BuildkiteCI
Reviewed-by: lukegb <lukegb@tvl.fyi>
Reviewed-by: tazjin <tazjin@tvl.su>
Reviewed-by: grfn <grfn@gws.fyi>
2022-11-07 14:43:18 +00:00
Griffin Smith
8240b2959e chore(whitby): Update grafana config
Uncomment and update the grafana config for whitby based on the new
config format that nixos accepts. I've validated this locally by
visually inspecting the resulting `ini` file, but not actually run it
yet.

Change-Id: I12d78ae48146e1b01bd2a4152276d4c6b16c1a3d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7191
Autosubmit: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
2022-11-05 15:06:41 +00:00
sterni
57cf952ea9 chore(3p/sources): Bump channels & overlays (OpenSSL edition)
* //ops/machines/whitby: Disable grafana, since the grafana module was
  changed upstream in a way that our configuration no longer works.
  Since the OpenSSL security update is relatively pressing, adapting the
  grafana configuration beforehand is not a hard requirement. See
  https://github.com/NixOS/nixpkgs/pull/191768.

* //tools/depotfmt: keep Go at version 1.18 to forgo a reformat of the
  tree.

* //nix/buildGo: keep Go at version 1.18, as 1.19 changed the CLI
  interface (?) in a way that breaks buildGo.

* //3p/overlays/tvl: drop upstreamed tdlib upgrade.

* //3p/overlays/tvl: patch buf to work around breakage due to git 2.38.1

TODO items for Go are tracked in b/215.

Change-Id: Ie08fef49cf3db12e6b5225a8b992a990ddc5b642
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7141
Tested-by: BuildkiteCI
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: grfn <grfn@gws.fyi>
Reviewed-by: tazjin <tazjin@tvl.su>
2022-11-03 15:10:39 +00:00
Florian Klink
79ef6ee283 chore(ops/pipelines/depot/protoCheck): include name in label
Change-Id: I2010bd6e4600e9f1dd6e6af40e81ecbbb72c20d0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7054
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
2022-10-27 20:34:58 +00:00
sterni
ca3bd5c7ca feat(ops/pipelines): allow accessing the nix store
This is already allowed de facto, since there seems to be a special
exception for reading from derivation outputs. What is forbidden, is
access to files imported to the store (even via builtins.toFile) and
derivation files. The latter is required for doing dependency analysis
on arbitrary derivations, unfortunately.

Access to the store allows kind of evil things, but it should
be (hopefully) hard to do this by accident, and accessing derivation
files is not impure, though it relies on store implementation internals
so to speak.

Change-Id: I33a7de83ef0ee20a7076690329d62f6caffffe5f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6835
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: grfn <grfn@gws.fyi>
2022-10-08 10:59:45 +00:00
Vincent Ambo
b9bfcf2f33 fix(ops/www): fix port templating for keycloak
Change-Id: I714b12f996d7dbe705f1f553d449f2dbc4910b1e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6848
Reviewed-by: sterni <sternenseemann@systemli.org>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-10-03 17:42:56 +00:00
Vincent Ambo
e255aff849 chore(ops/whitby): use renamed 'kbdInteractiveAuthentication' option
Relates to b/200

Change-Id: Ica7a32e3d2392aba22c2de93cc9be49c4a57eeb9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6838
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-10-02 14:19:33 +00:00
Vincent Ambo
b5cf6b148c chore(ops/whitby): use new keycloak HTTP port option
Relates to b/200

Change-Id: Id8f415d5c4a8947b56031e1671f4f84ac5f2665d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6837
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-10-02 14:19:33 +00:00
sterni
0c178a0ef6 chore(3p/sources): Bump channels & overlays
Upstream nixpkgs removed a lot of aliases this time, so we needed to do
the following transformations. It's a real shame that aliases only
really become discoverable easily when they are removed.

* runCommandNoCC -> runCommand
* gmailieer -> lieer
  We also need to work around the fact that home-manager hasn't catched
  on to this rename.
* mysql -> mariadb
* pkgconfig -> pkg-config
  This also affects our Nix fork which needs to be bumped.
* prometheus_client -> prometheus-client
* rxvt_unicode -> rxvt-unicode-unwrapped
* nix-review -> nixpkgs-review
* oauth2_proxy -> oauth2-proxy

Additionally, some Go-related builders decided to drop support for
passing the sha256 hash in directly, so we need to use the generic hash
arguments.

Change-Id: I84aaa225ef18962937f8616a9ff064822f0d5dc3
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6792
Autosubmit: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
Reviewed-by: grfn <grfn@gws.fyi>
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Reviewed-by: wpcarro <wpcarro@gmail.com>
2022-09-28 08:02:31 +00:00
Vincent Ambo
6576c2f15f feat(ops/keycloak): import github identity provider configuration
For some reason Terraform decided that it would otherwise like
to *delete* this configuration, which is undesirable.

Note that there is a "magic" special behaviour when the `alias` and
`provider_id` are set to the name of a built-in supported
provider (github, gitlab etc.), which lets us skip the
authorization_url setup.

Change-Id: Ib66154c2896dda162c57bdc2d7964a9fa4e15f20
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6706
Tested-by: BuildkiteCI
Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-09-20 09:28:45 +00:00
Vincent Ambo
3a1f4831a8 feat(ops/keycloak): add SMTP settings in configuration
I think these were set up in the UI and previously not supported in
the Terraform config, now they're supported and Terraform wanted to
delete them ...

Change-Id: I83eb49ceb774ac835dc81638f962e937c7e936c6
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6707
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-09-20 09:28:45 +00:00
Luke Granger-Brown
adf092a26b feat(monorepo-gerrit): swap owners plugin for code-owners
Change-Id: I9e05384b58dac258bc2da41c22e321b20451ef00
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6686
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: lukegb <lukegb@tvl.fyi>
Tested-by: BuildkiteCI
2022-09-19 11:17:07 +00:00
Luke Granger-Brown
f190712b7f chore(gerrit): migrate OWNERS files to code-owners style
Change-Id: Iacc521dfdd4b4a2d5cef3920cf8189bcce35a488
2022-09-19 11:13:28 +00:00
talyz
4b1fb8868d feat(ops/users): Add talyz to users
Change-Id: I3bbc9d31e4d00b26dcef470816c0b44a949ecb7a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6614
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-09-16 17:30:26 +00:00
Vincent Ambo
beb78c7104 feat(ops/modules): deploy tvixbolt to tvixbolt.tvl.su
Change-Id: I534cf918fc3e03ce8c14cf15f6d3280b6a657c8d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6536
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-09-13 11:05:54 +00:00
Vincent Ambo
20b855042d feat(ops/glesys): add CNAME for tvixbolt.tvl.su
I could not get nginx to serve it from `tvl.su/tvixbolt`, and ran out
of interest in trying to fix it, so lets put it on a subdomain
instead.

Change-Id: I1313d75cc9831d94a894191376534b1e5186a76a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6537
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-09-13 11:05:53 +00:00
sterni
aaa994137a fix: reflect renames of Nix configuration options
Change-Id: I7e28ac3d71acd7d99a1d3ef97bef9422097e4abf
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6154
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2022-08-25 16:34:39 +00:00
Vincent Ambo
20fc7bc0b2 chore(3p/sources): Bump channels & overlays
* tvl-slapd: move database to subdirectory (somehow now required)

Change-Id: I1792b856cf68b11959c0cc9caab4135e556f8c58
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6090
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: grfn <grfn@gws.fyi>
2022-08-13 14:43:05 +00:00
Vincent Ambo
d2176bb8fb feat(ops/www): add predlozhnik redirect on tazj.in
otherwise posting this to reddit's /r/russian is not possible, as they
ban all links to Russian-affiliated sites

Change-Id: I8d23f0961ec7ef097fc2dbdd0aaa178861a19c10
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5992
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-07-28 17:50:18 +00:00
Jean-François Roche
c04316bdc5 feat(ops/users): Add jfroche to users
Change-Id: I60cb0acffd1d21b4660e819799206a0cde4facb0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5970
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-07-22 12:36:08 +00:00
Vincent Ambo
7d3d3b3c8f refactor(ops/glesys): add explicit records pointing to whitby
instead of setting a wildcard record (which causes really weird
behaviour if you set your search domain to tvl.su/tvl.fyi, which I
do), DNS records for services running on whitby are now set
explicitly.

Change-Id: Ia05399b62dad326942fe0efda30782ce153df99d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5961
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: tazjin <tazjin@tvl.su>
2022-07-22 11:17:58 +00:00
Griffin Smith
7ac9b76c3c feat(grfn/system): Add ogopogo
This is my new work desktop

https://en.wikipedia.org/wiki/Ogopogo

Change-Id: I198d8757ff85eec00a303b990efdd2658cbc3e6a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5963
Tested-by: BuildkiteCI
Reviewed-by: grfn <grfn@gws.fyi>
2022-07-20 02:48:41 +00:00
Vincent Ambo
482e1b201c fix(ops/www): redirect very old tazj.in feed URLs correctly
at some point in the far past, there was an RSS feed at `/en/rss.xml`.
It seems to still get a single hit or so every hour, which currently
404s.

Change-Id: Ieb13c2c0232861a50a54bc2a4087d9ccb21185cf
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5962
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-07-19 15:14:29 +00:00
Vincent Ambo
5d65d8e03a fix(ops/www): issue certificate for 'www.tazj.in'
Change-Id: I6179f785bb6bd6168a2a11836b90da5ee93adc69
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5953
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
2022-07-18 14:02:58 +00:00
Vincent Ambo
fcfd097e65 refactor(ops/cgit): make user configurable
on whitby, cgit runs as the gerrit user to get access to serving
gerrit's repositories directly.

on other machines (e.g. sanduny) this isn't necessary, as we have a
world-readable depot replica.

Change-Id: Ibf7e7cc08e5909e0fa182e561ab0cb472188edcb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5932
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-07-12 08:49:55 +00:00
Vincent Ambo
39d589b84b fix(depot-replica): make the depot replica world readable
Change-Id: Idc0b5210793ab0d83b3ac99cf36d7f7f02a35a37
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5931
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-07-12 08:49:55 +00:00
Vincent Ambo
4c25c29505 feat(ops/sanduny): run cgit instance
Change-Id: Id869fa46d74f215a9034e86f795a4cd9e93acb16
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5930
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-07-12 08:49:55 +00:00
Vincent Ambo
c08e47903e feat(ops): configure depot replication to sanduny
this configures gerrit's built-in replication plugin to push every
change in depot to sanduny.

this allows us to serve a replica of depot from sanduny.

manual config that was needed which needs to be automated:

* system-wide known_hosts does not work, needed one in /var/lib/git
* .ssh/config MUST be present and configured for sanduny.tvl.su

Change-Id: Iba399f2328abb5acb65dae19a36e265eea0952ac
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5915
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-07-03 20:54:06 +00:00
Vincent Ambo
9bc049425a feat(ops/secrets): add private key for depot git replication
Change-Id: Iaf86d1fe635be8fbd9bc8a397999a2cffcc21606
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5914
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-07-03 15:02:21 +00:00
Vincent Ambo
6ab6724e4c feat(ops/modules): add module for receiving a depot replica
This module sets up a user with an SSH key and permissions to receive
a (pushed) replica of depot from Gerrit.

This still needs appropriate configuration in Gerrit's replication
plugin on the other end.

This module has been enabled for sanduny. For now it does not (yet)
configure git serving.

Change-Id: I0fb6f7e696609e71008308e855bdf305dcbcd4f7
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5913
Tested-by: BuildkiteCI
Autosubmit: tazjin <tazjin@tvl.su>
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-07-03 15:02:21 +00:00
Vincent Ambo
f8ed0088ea fix(ops/sanduny): Enable our binary cache
Change-Id: I53f4c5b667018c0d3b01b307411200b66f6a7de3
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5901
Tested-by: BuildkiteCI
Reviewed-by: wpcarro <wpcarro@gmail.com>
Autosubmit: tazjin <tazjin@tvl.su>
2022-06-27 18:17:52 +00:00
Vincent Ambo
1094306aa9 refactor(web/cgit-tvl): Move cgit config back out of module
It occured to me yesterday that with the config inside of the module
it is kind of difficult to test cgit locally.

This moves it back to a separate location (//web/cgit-tvl) and makes
the most important things configurable via overrides.

Change-Id: I9b0f4c60b75c31441e1718e63b5b55aba3100aae
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5893
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-06-27 14:15:07 +00:00
Åsmund Østvold
2caa50c9bd fix(ops/besadii) test trigger.ref against configured branch
Before this commit besadii only worked for repos having
'refs/heads/canon' as main branch.

Change-Id: Ia2ceb8a720c675be84bc3d81b89338522cea6ebd
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5862
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: asmundo <asmundo@gmail.com>
2022-06-09 15:26:25 +00:00
Vincent Ambo
8e8d6eb1df refactor(ops/keycloak): Use tools.checks.validateTerraform
Remove some ~commit message~ ... uh, code duplication.

Change-Id: Id6e8f2132999e153d3984848f95ccabd52e4f45f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5853
Tested-by: BuildkiteCI
Reviewed-by: asmundo <asmundo@gmail.com>
2022-06-07 09:32:13 +00:00
Vincent Ambo
92a6e25380 refactor(ops/glesys): Use tools.checks.validateTerraform
Remove some code duplication.

Change-Id: Ia9e0b3b22926eb9e72f302e2c1ebcee68eaa1db9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5852
Tested-by: BuildkiteCI
Reviewed-by: asmundo <asmundo@gmail.com>
2022-06-07 09:32:13 +00:00
Vincent Ambo
72f91f032b refactor(ops/buildkite): Use tools.checks.validateTerraform
Remove some code duplication.

Change-Id: I7ff49e728e1bd584bca3b84cdc033d93e60aefc2
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5851
Tested-by: BuildkiteCI
Reviewed-by: asmundo <asmundo@gmail.com>
2022-06-07 09:32:13 +00:00
Vincent Ambo
ebd701b221 fix(ops/glesys): Remove now unnecessary workaround
Remove a workaround for a GleSYS provider bug that was fixed in the
last release.

Change-Id: Ibd25de0b4dcccd781518d5d0ae1c75d296f6b05f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5845
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2022-06-06 11:05:12 +00:00
Vincent Ambo
89ba820059 test(ops/keycloak): Validate Terraform configuration in CI
Change-Id: I5602cf722b9fe9502c9d7610eefc7ba0ab647362
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5844
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
2022-06-06 11:05:12 +00:00
Vincent Ambo
fceb3fef73 test(ops/glesys): Validate Terraform configuration in CI
Change-Id: I8d251d3ee1de77feca865d0a677041c9c485d211
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5843
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
2022-06-06 11:05:12 +00:00
Vincent Ambo
af44916312 test(ops/buildkite): Validate Terraform configuration in CI
Change-Id: Ieef4d7d0a717107ee67432474683f3344b6561f8
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5842
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-06-06 11:05:12 +00:00
Vincent Ambo
469189afd3 feat(ops/buildkite): Import tvl-kit pipeline
Change-Id: I21f6e0adba3dca3be741761a226ab6810d8bcf8d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5841
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-06-06 11:05:12 +00:00
Vincent Ambo
831b04a1e9 feat(ops/buildkite): Import main depot pipeline
Change-Id: Id470750aa90505002c6a7e4f840e56c4939ed391
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5840
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-06-06 11:05:12 +00:00
Vincent Ambo
b29b6a092c docs(ops/buildkite): Add documentation about this config
Change-Id: Ia61b15127c67cdd9dddcab9f3540f1aee949cd6b
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5839
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
2022-06-06 11:05:12 +00:00
Vincent Ambo
c58cc1e690 feat(ops/buildkite): Bootstrap Buildkite Terraform configuration
In order to run this the secrets needs to be sourced, e.g.:

  eval $(age --decrypt -i ~/.ssh/id_ed25519 $(git rev-parse --show-toplevel)/ops/secrets/tf-buildkite.age)

Change-Id: I9f6a02c0dac22f584181635861ddbb06cf849f14
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5838
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
2022-06-06 11:05:12 +00:00
Vincent Ambo
4288cf961e feat(ops/secrets): Add Buildkite API token for Terraform
Change-Id: I0930f4fb34015ddcaa791b07e4d5d87d069d2b0a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5837
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
2022-06-06 11:05:12 +00:00
Vincent Ambo
a027ee9f03 refactor(nix/buildkite): Rename "post" steps to "release" steps
This is in preparation for a subsequent CL that will do much more
significant changes in //nix/buildkite.

Change-Id: I80a8d67d3a7d593854c8d711572483c2581e7881
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5824
Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
Tested-by: BuildkiteCI
2022-06-03 17:36:15 +00:00
sterni
e2807ec934 fix(ops/nixos): use builtins.storePath to avoid dumping pkgs.path
This is a less invasive way to achieve the same goal as cl/5681, by
preventing the already existing nixpkgs store path from being dumped
again at the call site. To support nixpkgsBisectPath, we simply check if
pkgs.path is below builtins.storeDir and use builtins.storePath based on
that.

This is actually similar to the approach taken in the nixpkgs
documentation system which tries to limit the amount of nixpkgs that
needs to be dumped by using filterSource on specific subtrees of
nixpkgs. For this to work it has to insist on pkgs.path being an
ordinary Nix path, though.

Change-Id: Idf892f90a5d811184568e4702a901c334d56210e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5787
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
2022-05-29 10:22:25 +00:00
Vincent Ambo
121fb13648 feat(ops/secrets): Add OAuth2 client secret for panettone
Change-Id: Icc53b161b260632e50b7bdc4c908912fd377bb87
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5771
Tested-by: BuildkiteCI
Reviewed-by: grfn <grfn@gws.fyi>
2022-05-28 17:03:36 +00:00