Commit graph

726 commits

Author SHA1 Message Date
Vincent Ambo
b1f0de3fde chore(nixos/whitby): Bootstrap //ops/nixos/whitby folder
Change-Id: I7d77c3ea48b181d7b9f754ac4807ed44735a8925
Reviewed-on: https://cl.tvl.fyi/c/depot/+/841
Reviewed-by: BuildkiteCI
Reviewed-by: isomer <isomer@tvl.fyi>
Reviewed-by: lukegb <lukegb@tvl.fyi>
Reviewed-by: glittershark <grfn@gws.fyi>
Tested-by: BuildkiteCI
2020-07-02 18:32:47 +00:00
Kane York
2215ae98b9 chore(tvl-slapd): rotate password for riking
Change-Id: I3ec53d5223a4ff0871eed7615f11f534ed74653b
Reviewed-on: https://cl.tvl.fyi/c/depot/+/839
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: BuildkiteCI
Tested-by: BuildkiteCI
2020-07-02 06:20:04 +00:00
Vincent Ambo
7dbdd2d13e chore(tvl-slapd): Remove old password generation script
This does not work for ARGON2 hashes.

Change-Id: I1e070fa0ff17ef21632e94e6777da637deb6f54f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/834
Reviewed-by: Kane York <rikingcoding@gmail.com>
Reviewed-by: BuildkiteCI
Tested-by: BuildkiteCI
2020-07-01 20:55:48 +00:00
Vincent Ambo
a1556d71e6 chore(tvl-slapd): Rotate my LDAP passwords and use ARGON2 hashes
Change-Id: Id1a60121e4254e7ccff77ac17fd39d0955aedc8f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/832
Reviewed-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: isomer <isomer@tvl.fyi>
Tested-by: BuildkiteCI
2020-07-01 19:10:13 +00:00
Vincent Ambo
5b4ff0c393 feat(tvl-slapd): Load Argon2 password module in OpenLDAP
This makes it possible to use {ARGON2} hashes instead of the current
salted SHA hashes, which is a much better idea.

Unfortunately the nixpkgs module does not have an option for
overridding the package used, so it is overlaid into the system
package set - this causes widespread rebuilds.

This is fine for us for now, but I have opened a PR upstream to add a
package option: https://github.com/NixOS/nixpkgs/pull/91963

Change-Id: Ib4be931d88e74b91566639f8656742cf096f6cc3
Reviewed-on: https://cl.tvl.fyi/c/depot/+/831
Reviewed-by: BuildkiteCI
Reviewed-by: isomer <isomer@tvl.fyi>
Tested-by: BuildkiteCI
2020-07-01 19:10:13 +00:00
Vincent Ambo
03076c3977 fix(besadii): Do not pass on update values for meta refs
Before this change, besadii would skip further processing of meta refs (which happen for every CL metadata change), but it would still schedule a build by returning an update - which would then inevitably fail.

This change makes besadii skip meta refs the same way it skips non-depot builds, i.e. completely.

Move *on* from meta refs, do *not* collect $100.

Change-Id: I269d2299f4d3cb1f9c041da8c92fa00ae7794b38
Reviewed-on: https://cl.tvl.fyi/c/depot/+/825
Reviewed-by: eta <eta@theta.eu.org>
Reviewed-by: BuildkiteCI
Tested-by: BuildkiteCI
2020-07-01 16:51:50 +00:00
Vincent Ambo
feb3f1a374 feat(nixos/clbot): Add a module for running clbot
Change-Id: I9c10906441c3222b74bcc820a67f11d96462fcfa
Reviewed-on: https://cl.tvl.fyi/c/depot/+/821
Tested-by: BuildkiteCI
Reviewed-by: lukegb <lukegb@tvl.fyi>
Reviewed-by: BuildkiteCI
2020-06-30 23:39:48 +00:00
Cameron Kingsbury
7839b7b7a3 feat(tvl-slapd): update camsbury in slapd
Change-Id: Idce92352ad01f85bd7fbb102decdd1df26dda5f4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/823
Reviewed-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
Tested-by: BuildkiteCI
2020-06-30 23:34:04 +00:00
Vincent Ambo
1eb8067bb0 fix(nixos/smtprelay): Only enable if the user asks for it
Change-Id: Ifbdf9bf9e89a1da68e8c823f61a33275183afcb1
Reviewed-on: https://cl.tvl.fyi/c/depot/+/822
Reviewed-by: BuildkiteCI
Reviewed-by: lukegb <lukegb@tvl.fyi>
Tested-by: BuildkiteCI
2020-06-30 23:32:45 +00:00
Vincent Ambo
0380841eb1 fix(besadii): Don't log errors for /meta refs
These are updated for all sorts of things and should just be silently
ignored by besadii.

Change-Id: I0a6de373b21d6bef5fd31d0a1d3f72c501073bba
Reviewed-on: https://cl.tvl.fyi/c/depot/+/801
Reviewed-by: BuildkiteCI
Reviewed-by: Kane York <rikingcoding@gmail.com>
Tested-by: BuildkiteCI
2020-06-30 02:51:45 +00:00
Vincent Ambo
dc07977866 chore(ops): Clean up old GCP infrastructure files
This removes almost all of the GCP-infrastructure leftovers from my
previous setup.

The DNS configuration is retained, but moves to my user folder
instead.

Change-Id: I1867acd379443882f11a3c645846c9902eadd5b0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/782
Tested-by: BuildkiteCI
Reviewed-by: eta <eta@theta.eu.org>
Reviewed-by: isomer <isomer@tvl.fyi>
2020-06-29 21:24:49 +00:00
Vincent Ambo
d3f9cb0ec3 feat(besadii): Temporarily add Code-Review labels on CLs
Besadii already adds 'Verified'-labels, which are used to signal CI
status on CLs, however we don't actually use these labels (yet) which
also means that they are not displayed in the Gerrit UI.

This change temporarily introduces the Code-Review label *in
addition* (with the same values as Verified), providing a build status
signal on the CL but without being required for submission.

Change-Id: I2c3a37c59aceb426815ad4e400c80ab85be482dd
Reviewed-on: https://cl.tvl.fyi/c/depot/+/781
Tested-by: BuildkiteCI
Reviewed-by: ericvolp12 <ericvolp12@gmail.com>
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-29 19:06:37 +00:00
Vincent Ambo
6d3a9e7b5f feat(besadii): Implement support for Buildkite's post-command hook
This hook is invoked by Buildkite (on the runner) after every build
stage. This change adds support in Besadii to run as this hook and
update the build status on a Gerrit CL.

Change-Id: Ie07a94d9b41645a77681cf42f6969d218abf93c1
Reviewed-on: https://cl.tvl.fyi/c/depot/+/761
Tested-by: BuildkiteCI
Reviewed-by: Kane York <rikingcoding@gmail.com>
2020-06-29 15:15:19 +00:00
Vincent Ambo
0bb24ed700 feat(besadii): Propagate Gerrit change ID & patchset to Buildkite
I previously implemented this in a CL that ended up being abandoned,
but it turns out we need it for the hook setup, anyways.

These environment variables become available during the build and,
crucially, to the post-build hooks.

Change-Id: Id6c1657947995e8bae1fa7b76184dd8be4c01525
Reviewed-on: https://cl.tvl.fyi/c/depot/+/739
Reviewed-by: Kane York <rikingcoding@gmail.com>
2020-06-29 01:19:51 +00:00
Griffin Smith
93d1ab7a54 feat(pipelines/depot): Run with --show-trace
So if an evaluation fails we get a stacktrace

Change-Id: I54cdc9e93c765ef7cf3a4d0cd79e6d067f4789d3
Reviewed-on: https://cl.tvl.fyi/c/depot/+/733
2020-06-29 00:38:32 +00:00
Vincent Ambo
15335e7b3d feat(besadii): Enable automatic builds for CLs
This expands builds to also be triggered for updates to CL refs.

The message displayed on Buildkite will contain a link back to the
CL (& patchset) from which the build was triggered.

Change-Id: Ib36dee454aeb11d623b89c78b384359ee7ea3477
Reviewed-on: https://cl.tvl.fyi/c/depot/+/708
Reviewed-by: ericvolp12 <ericvolp12@gmail.com>
Reviewed-by: isomer <isomer@tvl.fyi>
2020-06-28 17:56:10 +00:00
Vincent Ambo
d3284112f6 refactor(besadii): Rename branchUpdate -> refUpdated
The name of the hook this type represents is 'refUpdated'. Since we're
adding support for additional hooks, it makes sense to to rename this
accordingly.

Change-Id: Ia568c85493813f5e754c77d0b993aaf246d3d595
Reviewed-on: https://cl.tvl.fyi/c/depot/+/667
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-28 17:20:22 +00:00
Vincent Ambo
1380d5998a feat(besadii): Trigger builds on Buildkite instead of Sourcehut
These builds run on runners that we control and disk space is (less
of) an issue there.

Change-Id: Id0a1436b2368418e447f6d5298ab474f829d4c97
Reviewed-on: https://cl.tvl.fyi/c/depot/+/628
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-27 18:02:04 +00:00
Vincent Ambo
22b8a49b87 feat(ops/pipelines): Add Buildkite pipeline configuration
This adds configuration which generates the structure expected for
Buildkite pipelines, which can then be dynamically ingested by
Buildkite when a pipeline is triggered.

Change-Id: I61e3dc3affb19c1f2550ef827fa73b17f8d8ae47
Reviewed-on: https://cl.tvl.fyi/c/depot/+/627
Reviewed-by: ericvolp12 <ericvolp12@gmail.com>
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-27 16:55:18 +00:00
Profpatsch
d640027f66 chore(tvl-slapd): sort alphabetically
bad ericvolp12

Change-Id: I508c7de48d4c2a7c734c38f79d0efeafec5d1e34
Reviewed-on: https://cl.tvl.fyi/c/depot/+/622
Reviewed-by: Profpatsch <mail@profpatsch.de>
2020-06-27 02:39:15 +00:00
Profpatsch
9851063f93 feat(tvl-slapd): add Profpatsch
Change-Id: I2d865a5271e7a3a2fe17009b306fe3f561a1290f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/621
Reviewed-by: tazjin <mail@tazj.in>
2020-06-27 02:38:33 +00:00
Artemis Tosini
41a094bf87 feat(tvl-slapd): add artemist to slapd
Signed-off-by: Artemis Tosini <me@artem.ist>
Change-Id: I11fc0cb58660d3cc55c6cf5489cc872a51454cb5
Reviewed-on: https://cl.tvl.fyi/c/depot/+/609
Reviewed-by: tazjin <mail@tazj.in>
2020-06-26 22:50:29 +00:00
Vincent Ambo
6edf69da4b feat(besadii): Trigger separate builds for build target sets
In CL/570 we split up the build targets into different buckets, with
the idea that this should help us avoid the disk space issues on
Sourcehut.

This commit changes Besadii to read the list of target sets from a
file and trigger a separate build for each one of them.

Change-Id: If280fda5f40cd130c534c40911072e47c2d8f2be
Reviewed-on: https://cl.tvl.fyi/c/depot/+/608
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-26 22:50:29 +00:00
Vincent Ambo
8dedf9d0be chore: Update 'master -> canon' in various places
Change-Id: I901c023f707a0223af673c217c65434e26e2ab1f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/568
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-24 01:33:43 +00:00
Cameron Kingsbury
e7dd5e30e9 feat(tvl-slapd): add camsbury to slapd
add camsbury

From ccd385879ed384389983f4ddc55ef675f40e6119 Mon Sep 17 00:00:00 2001
From: Cameron Kingsbury <camsbury7@gmail.com>
Date: Tue, 23 Jun 2020 14:13:51 -0400
Subject: [PATCH] feat(tvl-slapd): add camsbury to slapd

Change-Id: I0fbf05ca80a006c9b2055509661fc1e93211e30f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/565
Reviewed-by: glittershark <grfn@gws.fyi>
Reviewed-by: tazjin <mail@tazj.in>
2020-06-23 18:56:19 +00:00
Vincent Ambo
3b05be2fd0 feat(monorepo-gerrit): Use Sourcegraph as the gitweb for Gerrit
This points commit/file/etc. links from Gerrit to Sourcegraph instead
of cgit.

There's a minor problem with this: Some, but not all unsubmitted CLs
are missing in Sourcegraph for unclear reasons so they lead to 404s.

That problem is unrelated to this change and something we need to
investigate separately.

Change-Id: I9b0c1eca8781dc96984ba09b4a71960eb43583bd
Reviewed-on: https://cl.tvl.fyi/c/depot/+/541
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-20 17:29:50 +00:00
Vincent Ambo
d18faddba3 chore(nixos/sourcegraph): Configure Sourcegraph to use Cheddar
Change-Id: I2b91bef97c16254ffefcbc4da48ef161a859e7a0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/521
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-20 03:00:46 +00:00
Vincent Ambo
a37b4fbef3 feat(besadii): Add Sourcegraph index update triggers
Sourcegraph has a heuristic for determining when to update the
repository that doesn't work for the TVL repository, where commits are
often in irregular short bursts.

This changes besadii to trigger Sourcegraph index updates when invoked
by Gerrit.

Change-Id: Ifcfc25406d9e25bbdc93e79c23608ce4c6b10ba8
2020-06-19 01:35:11 +01:00
Vincent Ambo
2183cfe5de chore(besadii): Make besadii a Go2 project
Change-Id: Id5aef73b131252fb9c880dd95fc72bfe083f1b75
2020-06-18 02:33:23 +01:00
Vincent Ambo
8f6309fe22 fix(monorepo-gerrit): Use displayName attribute as accountFullName
This attribute makes much more sense in this position semantically.

Change-Id: I16cc6304f42c577a2368bd7c9573fcb7dd276a9d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/448
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-17 03:03:22 +00:00
Vincent Ambo
27db1fc86b refactor(tvl-slapd): Move user definitions into Nix code
Implements a function that generates the LDIF record for each user and
templates it into the configuration.

This is slightly more user-friendly and less error-prone (people kept
getting the DNs wrong) than editing the contents manually.

Change-Id: Ic419d2ef464f9a94be5d54b666f7d53134b53eed
Reviewed-on: https://cl.tvl.fyi/c/depot/+/447
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-17 03:03:22 +00:00
Vincent Ambo
9a7a0aa597 chore: Remove traces of Hound
We can always revert this if we want it back.

Change-Id: I1332b6dd541199584b7b5b94a8651172d79e53a9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/442
Reviewed-by: glittershark <grfn@gws.fyi>
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-16 20:32:18 +00:00
Vincent Ambo
2a764503be fix(monorepo-gerrit): Don't expire sessions unreasonably quickly
Changes the default session timeout to 3 months, which is a lot more
reasonable than the default of 12 hours.

See https://gerrit-review.googlesource.com/Documentation/config-gerrit.html#cache.name.maxAge

Change-Id: I33bce8b072d64ab07f1b954c11068595dca5def7
Reviewed-on: https://cl.tvl.fyi/c/depot/+/431
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-16 17:42:03 +00:00
Vincent Ambo
654f13d405 feat(nixos/sourcegraph): Add a module for running SourceGraph
This module spins up the Sourcegraph container.

Builds:

Note that this is contrary to how our other deployments work, but
packaging Sourcegraph is quite difficult (it's a Gitlab style
deployment with a lot of moving parts and third-party things that it
bundles).

If we decide to keep it around, we will want to look at packaging it
in Nix in the future.

Deployment:

The deployment is a hack. Sourcegraph does not support public
instances, but we want it to be public. To work around this we have
configured HTTP-proxy based authentication (i.e. auth via a header)
and hardcoded a static header.

This works, but lets anonymous users change the "Anonymous" user's
settings. We can expect this to get defaced (profile picture, name
etc), until we figure out how to write some nginx configuration to
drop those requests. See git-bug for details.

The Sourcegraph configuration is also not checked in to the
repository. It's unclear where in the data directory it is stored.

Change-Id: I414ff11c3b49989b6792d697bffc8a0edf96c9cb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/425
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-16 13:40:49 +00:00
Eric Volpert
bf911a119e feat(tvl-slapd): Enable ericvolp12 user in LDAP
Thanks.

Change-Id: I5df1e5075b2e056ebde3e66e1cf17b220d650977
Reviewed-on: https://cl.tvl.fyi/c/depot/+/398
Reviewed-by: tazjin <mail@tazj.in>
2020-06-16 02:19:09 +00:00
Vincent Ambo
76c20f6bf7 fix(ops/nixos/tvl-slapd): Sort users & fix glittershark's DN
Change-Id: I33feedacfadaae53da000aff7d42fa06d2189f52
Reviewed-on: https://cl.tvl.fyi/c/depot/+/391
Reviewed-by: tazjin <mail@tazj.in>
2020-06-15 23:18:57 +00:00
Griffin Smith
849afbaeef chore(ops/nixos/tvl-slapd): add glittershark
Change-Id: I2e537079b88a3857964c6b7c66cd9221ca580958
Reviewed-on: https://cl.tvl.fyi/c/depot/+/390
Reviewed-by: tazjin <mail@tazj.in>
2020-06-15 23:17:06 +00:00
Vincent Ambo
a577fd83d6 chore(monorepo-gerrit): Remove 'owners-autoassign' plugin
This plugin just blindly assigns everyone and, as q3k has already
pointed out, just isn't particularly useful.

We might want to roll our own, for example:

19: 40:41 <+Remosi> I want the virtual owner thing, we could call it
 Gerrit Workgroup Synthesizer Queuing, or gwsq for short.
Change-Id: Ib12a921ae4047ac6a734035dd0900c8964fb12d8
Reviewed-on: https://cl.tvl.fyi/c/depot/+/350
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-15 00:38:48 +00:00
Vincent Ambo
a4b3f9af93 fix(3p/gerrit): Fix Gerrit derivation name and module configuration
Without these changes, the NixOS module isn't able to use the new
Gerrit derivation.

These changes are already deployed as I needed to make them to get
Gerrit back up.

Change-Id: Iad3aa6158789a014134fddccd40b508b81486100
Reviewed-on: https://cl.tvl.fyi/c/depot/+/301
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-14 18:50:16 +00:00
Cynthia Revström
8dda9e56d7 feat(tvl-slapd): add cynthia to slapd
Change-Id: Ifb55ebd234d15fbaa6ef2e71f97ba7b8203ffcd9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/255
Reviewed-by: tazjin <mail@tazj.in>
2020-06-14 13:37:26 +00:00
Vincent Ambo
268729083e refactor(ops/nixos): Move my NixOS configurations to //users/tazjin
NixOS modules move one level up because it's unlikely that //ops/nixos
will contain actual systems at this point (they're user-specific).

This is the first users folder, so it is also added to the root
readTree invocation for the repository.

Change-Id: I546c701145fa204b7ba7518a8a56a783588629e0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/244
Reviewed-by: tazjin <mail@tazj.in>
2020-06-13 23:52:35 +00:00
eta
ae85e8a871 feat(tvl-slapd): add eta to slapd
Change-Id: Ib34d59006645b992bd7b6cbd04fc7121ad3f0219
Reviewed-on: https://cl.tvl.fyi/c/depot/+/223
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-13 19:01:42 +00:00
Vincent Ambo
95e4faf464 feat(monorepo-gerrit): Include owners & owners-autoassign plugins
Change-Id: I62b90fb94293fc5148fe0fd7a06ea3d0e4d44199
Reviewed-on: https://cl.tvl.fyi/c/depot/+/222
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-13 18:59:12 +00:00
Vincent Ambo
9d01000257 fix(monorepo-gerrit): Do not place hooks in $out/bin
Gerrit does not expect a bin/ there.

Change-Id: I907f96690b8c6bb614dc11889712d7b122c5d5cf
Reviewed-on: https://cl.tvl.fyi/c/depot/+/181
Reviewed-by: tazjin <mail@tazj.in>
2020-06-13 05:15:15 +00:00
Kane York
665f131dda feat(camden): add builds shortlink
Change-Id: Iedd524d775349f24c13fe7c118830b7d4dfdec49
Reviewed-on: https://cl.tvl.fyi/c/depot/+/81
Reviewed-by: tazjin <mail@tazj.in>
2020-06-13 05:06:18 +00:00
Vincent Ambo
b88cbe0dab feat(monorepo-gerrit): Enable Gerrit hooks & configure besadii
Loads the 'hooks' plugin into Gerrit, which - as per my interpretation
of the docs - is going to execute any hooks for which there are
matching binaries.

The intention here is that besadii should implement most of the hooks
we care about. As a start, it is symlinked here to the `ref-updated`
hook.

Change-Id: I6482a9d71cc08908c29dd10f786cbba32b33d04d
2020-06-13 06:04:02 +01:00
Vincent Ambo
b094e65bfc feat(besadii): Adapt into a Gerrit ref-updated-hook
Besadii was previously invoked as a git post-update hook, but Gerrit
does not use these hooks and instead has its own concept of hooks.

This change adapts besadii to be compatible with the way Gerrit hooks
are invoked (arguments being passed as flags, rather than via stdin).

Change-Id: I487b3a9e15810583bc5442fdc024ee2771c580cb
2020-06-13 06:03:45 +01:00
Vincent Ambo
8735c63e97 feat(monorepo-gerrit): Enable download-commands plugin
This enables the display of various download commands on change pages,
which makes things like checking out refs for review locally easier.

Change-Id: I3c29854aa0cf1aa393efb89b7516bbf84e0083d4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/162
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-13 03:16:24 +00:00
Vincent Ambo
213d637ca9 fix(monorepo-gerrit): Configure advertised address for SSH correctly
This is a prerequisite for setting up the download-commands plugin.

Change-Id: I7803ef18be759f95aec020e4a00ca8e0fb48bfe0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/161
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-13 03:15:58 +00:00
Vincent Ambo
e09c4a0ae8 chore(monorepo-gerrit): Point SMTP configuration at smtprelay
Change-Id: I33085974fb3764f8a6df7f16245b2f5602f94118
Reviewed-on: https://cl.tvl.fyi/c/depot/+/102
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-13 02:16:58 +00:00
nyanotech
b994d28ccc feat(tvl-slapd): Add nyanotech to slapd, sort the list
Change-Id: I9ffd2fb3b9ae3f6c8c381f496769eb8977caadeb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/124
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-13 01:34:55 +00:00
Vincent Ambo
c2a5073339 feat(nixos/smtprelay): Add derivation & module for SMTP relay
This adds a little tool that can be used to relay mail to Gmail (and
other SMTP servers). It is intended to be used by Gerrit, which is
incompatible with Gmail's SMTP servers.

Configuration has been tested by performing a few sends through the
tvlbot@tazj.in account.

Note that this is using the standard Gmail SMTP server. Using the
smtp-relay server relies on IP whitelisting, but camden.tazj.in has a
larger number of IPv6 addresses than can be whitelisted (the maximum
is 65k). This means that we are limited to 2000 mails per recipient
per day, which should be fine.

Change-Id: Ie43564d753030f5c800a9cdb4ae98292877d80dc
Reviewed-on: https://cl.tvl.fyi/c/depot/+/101
Reviewed-by: edef <edef@edef.eu>
2020-06-13 01:23:01 +00:00
Vincent Ambo
de4f540ed1 feat(monorepo-gerrit): Configure outbound emails for reviews
Configures Gerrit send emails from tvlbot@tazj.in for outgoing review
notifications. Emails are always plain-text and can contain diffs (up
to a maximum size of 256KiB).

The configuration options for this are documented at:

https://gerrit-review.googlesource.com/Documentation/config-gerrit.html#sendemail

Note: The password for this user is stored on the host, in a file that
is not part of version-control and is only readable by the 'git' user.

We should probably figure out a way to do secrets management ...

Change-Id: I2f99b34b1a774c28d814b0aba1f1b78fd512854e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/92
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-12 22:36:10 +00:00
Vincent Ambo
a9f3621fd7 feat(camden): Move hound to cs.tvl.fyi
The old host at cs.tazj.in now redirects there, and I've added a
helper function for creating these redirections.

Change-Id: I66794d752df46c8e795e47aedfaffd8c27c45627
Reviewed-on: https://cl.tvl.fyi/c/depot/+/89
Reviewed-by: riking <rikingcoding@gmail.com>
Reviewed-by: tazjin <mail@tazj.in>
2020-06-12 02:17:02 +00:00
Vincent Ambo
7bad1fe852 fix(camden): addSSL -> forceSSL for all pages
Change-Id: I451d1bc1a21d4ff25c0c70c963cf17bb924961db
Reviewed-on: https://cl.tvl.fyi/c/depot/+/84
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-12 01:51:32 +00:00
edef
52c0be524e chore(ops/nixos/modules): Add edef to slapd
Change-Id: I063a09cdc3bb81397a44f7356f1c11ebd715f74f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/88
Reviewed-by: tazjin <mail@tazj.in>
2020-06-12 01:44:51 +00:00
Kane York
1783239c3f feat(camden): add /irc/ shortlink
Change-Id: If17c758c323aaf00fdf26ddfafaea10acbf1453e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/70
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: riking <rikingcoding@gmail.com>
2020-06-12 01:15:02 +00:00
Vincent Ambo
37bbc43146 feat(camden): Move cgit to code.tvl.fyi
Moves the host at which cgit is served to 'code.tvl.fyi'.

Also updates related projects that link to this, most importantly:

* Hound's & Gerrit's cgit link bases have been updated
* besadii is updated to request CI builds for the new location

Change-Id: I44e3e584010ac29cc913ebb1a197c996eb024d80
Reviewed-on: https://cl.tvl.fyi/c/depot/+/71
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-12 01:14:21 +00:00
Sergiusz Bazanski
79fdb0bb5f chore(ops/nixos/modules): Add q3k to slapd
Change-Id: I083bc4e9283a882e97a6b9098d6a126ca7bb0a93
Reviewed-on: https://cl.tvl.fyi/c/depot/+/68
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-12 00:44:36 +00:00
Vincent Ambo
dc2fd3b521 chore(nixos/camden): Point hound at the depot on gerrit
Change-Id: I19cbffae75017ceefbc19397c54156eb348eda27
Reviewed-on: https://cl.tvl.fyi/c/depot/+/65
Reviewed-by: lukegb <lukegb@tvl.fyi>
2020-06-11 23:47:24 +00:00
Vincent Ambo
4e3d3b6c22 chore(nixos/frog): Move frog to nixos-unstable
There are no remaining traces of Emacs breakage in unstable - as far
as I can tell.

Change-Id: I06c5d78aa3ff9c0cc00c62e6d6966c5079fb3b24
Reviewed-on: https://cl.tvl.fyi/c/depot/+/63
Reviewed-by: tazjin <mail@tazj.in>
2020-06-11 23:20:41 +00:00
Vincent Ambo
80d324b53b feat(nixos/frog): Enable lieer sync for mail@tazj.in
Change-Id: I38a338143d57d5f49532d200910f9406fa49f535
Reviewed-on: https://cl.tvl.fyi/c/depot/+/61
Reviewed-by: tazjin <mail@tazj.in>
2020-06-11 23:18:25 +00:00
Luke Granger-Brown
a342bdb80b feat(monorepo-gerrit): link to git.tazj.in as source browser
Change-Id: Ia31389a958c1927b63dfebb7c2ed2054177410b4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/23
Reviewed-by: tazjin <mail@tazj.in>
2020-06-11 22:17:23 +00:00
Vincent Ambo
7875753659 fix(monorepo-gerrit): Disable 'DynamicUser' feature for Gerrit
This change makes Gerrit run as the 'git' user, which can be shared by
other services such as hound or cgit to access the git trees.

Change-Id: Ic6c91f3e852184f5ef21f4374738cbf687462194
Reviewed-on: https://cl.tvl.fyi/c/depot/+/21
Reviewed-by: lukegb <lukegb@tvl.fyi>
Reviewed-by: isomer <isomer@tvl.in>
2020-06-11 21:52:30 +00:00
Vincent Ambo
ea3cab8755 fix(monorepo-gerrit): Extract SSH username from LDAP correctly 2020-06-11 21:13:04 +00:00
Vincent Ambo
fba9d0b387 feat(tvl-slapd): Add lukegb's user account 2020-06-11 21:13:04 +00:00
Vincent Ambo
1d40329609 fix(monorepo-gerrit): Configure nginx reverse proxy correctly
Configures the reverse-proxy as per Gerrit's documentation at
https://gerrit-review.googlesource.com/Documentation/config-reverseproxy.html
2020-06-11 21:13:04 +00:00
Perry Lorier
8ace1010bc feat(ops/nixos/modules): Add myself.
Also alphabetise
2020-06-11 21:13:04 +00:00
Kane York
6d4cae9359 chore(ops/nixos/modules): Add riking to slapd 2020-06-11 21:13:04 +00:00
Vincent Ambo
35df1b94fc fix(ops/nixos/camden): Include /var/cache/nginx in nginx fix timer 2020-06-11 21:13:04 +00:00
Vincent Ambo
4000a76678 feat(monorepo-gerrit): Configure Gerrit for LDAP authentication 2020-06-11 21:13:04 +00:00
Vincent Ambo
740b4b37fc feat(ops/nixos/modules): Add TVL slapd module
This initialises an OpenLDAP server for tvl.fyi

This is the least annoying way to bootstrap Gerrit. Yep.
2020-06-11 21:13:04 +00:00
Vincent Ambo
afe0841e9d feat(ops/nixos): Add module for configuring Gerrit for the repo 2020-06-11 21:13:04 +00:00
Vincent Ambo
b7766431f4 chore(ops/nixos/camden): Move camden back to nixos-unstable 2020-06-11 21:13:04 +00:00
Vincent Ambo
9ed7f13ab9 feat(nixos/frog): Enable settings required for hardware support
... also updates to the latest kernel (this is 5.4 -> 5.6 atm)
2020-06-11 18:28:17 +01:00
Vincent Ambo
ccd63aae8d fix(nixos/frog): Use correct label for LUKS device 2020-06-11 18:27:56 +01:00
Vincent Ambo
eda1616242 feat(ops/nixos): Initial NixOS configuration for frog
This is mostly based on the nugget configuration, because frog
replaces nugget.
2020-06-11 12:21:10 +01:00
Vincent Ambo
923ca074ff feat(ops/nixos/camden): Link to the TVL monorepo doc 2020-06-07 17:48:24 +01:00
Vincent Ambo
976b49f2ed feat(ops/nixos/nugget): Install zoxide 2020-05-31 19:16:05 +01:00
Vincent Ambo
dcb39d3198 feat(ops/nixos/camden): Index nixpkgs in hound
There is a local nixpkgs clone at /var/git/nixpkgs which must be
manually set to have 'master' point at the desired ref (hound only
supports master).
2020-05-26 11:55:13 +01:00
Vincent Ambo
b9b741287a feat(ops/nixos/camden): Set up hound at cs.tazj.in 2020-05-26 00:19:27 +00:00
Vincent Ambo
587b0a8b0b feat(ops/nixos): Add a module for hound
This module sets up hound, a generic code search engine.
2020-05-26 00:18:53 +00:00
Vincent Ambo
68e384a77f ffeat(ops/nixos): Add a dummy to make depot available in modules
Because modules are not called via the default depot setup (for now
...), this introduces a dummy module that stores the depot tree itself
in the module configurations.

This makes it possible to write modules that use packages from the
depot.
2020-05-26 00:17:55 +00:00
Vincent Ambo
41bf99bd9e feat(ops/nixos/nugget): Add sysctl setting necessary for perf 2020-05-24 17:32:48 +01:00
Vincent Ambo
d53f0a2d05 feat(ops/nixos/nugget): Install perf tool 2020-05-24 02:48:49 +01:00
Vincent Ambo
06217f70d2 feat(ops/nixos/nugget): Install rr and hyperfine 2020-05-23 20:37:26 +01:00
Vincent Ambo
56261f1c08 fix(ops/nixos): Pin systems to stable channel
NixOS unstable has some software I want when building things, but it's
also broken.

This pins systems to the stable channel for now.
2020-05-22 20:50:25 +01:00
Vincent Ambo
f459332f32 chore: Update from Clang 9 to Clang 10 for all projects 2020-05-22 18:29:47 +01:00
Vincent Ambo
0623fec60a chore(ops/nixos/nugget): Increase user RuntimeDirectory size to 4GB
clangd needs more space to run successfully on the Nix repository.
2020-05-22 18:06:14 +01:00
Vincent Ambo
f2b211131f chore(ops/nixos/nugget): Use upstream Chromium again
Ostensibly there is also a new way to enable VAAPI, need to look into that.
2020-05-22 17:44:16 +01:00
Vincent Ambo
1bb9cd7749 chore(ops/nixos/nugget): Enable fstrim service 2020-05-21 16:56:18 +01:00
Vincent Ambo
f605577d5c feat(ops/nixos/nugget): Replace system-nix with meson-built one
What could possibly go wrong.
2020-05-17 20:49:44 +01:00
Vincent Ambo
3a7434a088 feat(ops/nixos/nugget): Install meson build system 2020-05-17 02:43:05 +01:00
Luke Granger-Brown
9993b0beba feat(ops/nixos/camden): add /meet/ redirect to tvl.fyi
I'm too lazy to keep going to the website to click the button
and also too lazy to add my own redirect.

Add one to tvl.fyi.
2020-05-11 01:24:13 +01:00
Vincent Ambo
30ebf2ee9e feat(ops/nixos/nugget): Enable SSH agent on nugget 2020-04-26 18:40:16 +01:00
Vincent Ambo
7ef00d0f27 feat(ops/nixos/camden): Enable SSH agent auth 2020-04-26 18:34:10 +01:00
Vincent Ambo
15323a6ee4 feat(ops/nixos/nugget): Install idualctl 2020-04-26 15:52:23 +01:00
Vincent Ambo
322a76cb7a fix(ops/nixos/camden): Use new //fun/idual CLI structure 2020-04-26 15:51:38 +01:00
Vincent Ambo
64894062a9 feat(ops/nixos/camden): Disable camden firewall
The local network is considered trusted and ingress from the outside
world is now handled by the Edgerouter.
2020-04-26 14:58:42 +01:00
Vincent Ambo
6644d0031d feat(fun/idual && nixos/camden): Add light alarm systemd units
Adds a systemd unit to run the idual light alarm using a transient
timer created by systemd-run.
2020-04-26 00:28:19 +01:00
Vincent Ambo
eac683f69c chore(ops/nixos/nugget): Remove camden from /etc/hosts
The new router can actually deal with this sensibly.
2020-04-25 21:46:27 +01:00
Vincent Ambo
8465a5435b fix(ops/nixos/camden): Introduce brute-force nginx issue fix
This adds a timer running every minute that fixes the nginx
permissions that were broken in NixOS 20.03
2020-04-22 12:04:05 +01:00
Vincent Ambo
a488bd3702 feat(ops/nixos/camden): Install 'bat' and 'ripgrep' on camden 2020-04-21 22:56:37 +01:00
Vincent Ambo
2ca4287cf0 feat(ops/nixos/camden): Use my cachix cache on camden
This cache is populated by sourcehut builds.
2020-04-21 22:55:32 +01:00
Vincent Ambo
6a2beb5a6a feat(ops/nixos/camden): Add vhost for TVL homepage 2020-04-21 03:17:30 +01:00
Vincent Ambo
1229621d7b feat(ops/nixos/camden): Provision certificate for tvl.fyi 2020-04-21 03:05:03 +01:00
Vincent Ambo
d6f5ca7caf feat(ops/nixos/camden): Add static IPv6 address to camden 2020-04-20 17:06:19 +01:00
Vincent Ambo
0f0f1a547f feat(ops/nixos/camden): Configure honk service 2020-04-19 22:58:41 +00:00
Vincent Ambo
688175c1f7 feat(ops/nixos/camden): Install honk 2020-04-19 23:30:19 +01:00
Vincent Ambo
066d34b50e feat(ops/nixos/nugget): Add chromium with VAAPI patches
These patches enable hardware-accelerated video decoding, which is
useful for Stadia.

The main issue with this is that Hydra doesn't currently cache
Chromium with these patches, which means that it is built from scratch
which takes in the order of 5 hours on an otherwise unused nugget.
2020-04-17 12:43:25 +01:00
Vincent Ambo
b4bf0b37b0 chore(ops/nixos/nugget): Install steam again 2020-04-11 13:31:17 +01:00
Vincent Ambo
e90e3153f8 chore(ops/nixos/camden): Enable HSTS headers on *.tazj.in 2020-04-04 21:49:03 +01:00
Vincent Ambo
f43294cd90 chore(ops/nixos/camden): Use upstream tailscale module 2020-04-04 13:17:18 +01:00
Vincent Ambo
de81e087d4 chore(ops/nixos/nugget): Use upstream tailscale module 2020-04-04 13:16:39 +01:00
Vincent Ambo
0f3d11f541 chore(third_party): Remove Tailscale derivation
This is now part of nixpkgs itself.
2020-04-04 13:02:57 +01:00
Vincent Ambo
9caf09a244 feat(ops/nixos/camden): Enable RTMP support in nginx
This makes it possible to live-stream various things at rtmp://tazj.in/tvl
2020-04-04 01:39:37 +00:00
Vincent Ambo
c3de37f54d fix(ops/nixos/nugget): Point camden host at new internal IP
This changed due to the router replacement.
2020-04-04 02:36:20 +01:00
Vincent Ambo
a89d22eb75 chore(ops/nixos/nugget): Install ffmpeg (including libnpp support) 2020-04-04 02:36:20 +01:00
Vincent Ambo
d2d7385833 feat(ops/nixos/nugget): Add module for v4l2loopback support
This kernel module creates a fake video input device to which I can
stream various things, such as screen grabs or qyliss' video stream
for TVL.
2020-04-04 02:36:20 +01:00
Vincent Ambo
9b606e2c4e feat(ops/nixos/nugget): Install clang & friends system-wide 2020-04-04 02:36:20 +01:00
Vincent Ambo
576f190972 fix(ops/nixos/nugget): Ensure that 'nuggetEmacs' is used for EXWM 2020-03-12 23:49:39 +00:00
Vincent Ambo
080c3591ca chore(ops/nixos/nugget): Disable DHCP for Remarkable USB conn
This otherwise holds up the boot process if the device is not
connected, which is annoying.
2020-03-12 23:27:12 +00:00
Vincent Ambo
de362fd278 feat(ops/nixos/nugget): Install google-c-style in Emacs 2020-03-12 23:27:12 +00:00
Vincent Ambo
814729bd04 fix(ops/nixos/camden): Add required options for ACME updates
The implementation for provisioning ACME certificates has changed in
nixos-unstable[0] and now requires a few extra options to be set.

[0]: https://github.com/NixOS/nixpkgs/pull/77578
2020-03-01 01:11:28 +00:00
Vincent Ambo
1f5d2d424c chore(third_party): Remove guile 3.0 override
I don't actually use guile at all, this was just for experimentation.
2020-03-01 01:07:48 +00:00
Vincent Ambo
d38995385b chore(ops/nixos/nugget): Use DHCP for Remarkable USB connection 2020-03-01 00:50:16 +00:00
Vincent Ambo
5faa737ead fix(ops/besadii): Remove branch tag after checking for it
... oops. The problem with working on besadii is that testing it
always lags one commit behind.
2020-02-21 23:35:42 +00:00
Vincent Ambo
a2bb8a7e1d fix(ops/besadii): Do not trigger builds for deleted branches 2020-02-21 23:30:05 +00:00
Vincent Ambo
28560fcf8a fix(ops/besadii): Include branch name in build note 2020-02-21 23:27:41 +00:00
Vincent Ambo
ca7c8fe9f0 fix(ops/besadii): Clone from git.tazj.in, not git.camden.* 2020-02-21 23:20:22 +00:00
Vincent Ambo
5ed68f0f6b fix(ops/besadii): Only trigger builds for branches 2020-02-21 23:16:28 +00:00
Vincent Ambo
8fe90430ee chore(ops/besadii): Pin git version used in besadii 2020-02-21 23:13:53 +00:00
Vincent Ambo
c689df0dc7 fix(ops/besadii): Replace slashes in branch names
Submitting a build with a branch containing a slash (which is common
for my branches) returns this error:

    Invalid tag name, tags must use lowercase alphanumeric characters,
    underscores, dashes, or dots

This commit replaces all slashes with underscores to work around that.
2020-02-21 23:06:19 +00:00
Vincent Ambo
21b76cb023 feat(ops/besadii): Run 'git update-server-info' at startup
Since besadii is effectively the entire post-receive hook, it also
needs to do the entire job of the hook.
2020-02-21 22:58:34 +00:00
Vincent Ambo
8377fd48f5 fix(ops/besadii): Send auth token in correct format 2020-02-21 22:51:40 +00:00
Vincent Ambo
59d02771b5 refactor(ops/besadii): Log to syslog instead of stdout 2020-02-21 22:46:34 +00:00
Vincent Ambo
dcbe3d1f9b feat(ops/besadii): Use post-receive hook input to trigger builds
Parses the input passed to besadii from git to extract ref updates and
trigger builds.
2020-02-21 22:32:23 +00:00
Vincent Ambo
5058f3928a feat(ops/besadii): Read sourcehut token from secrets file on disk 2020-02-21 22:31:57 +00:00
Vincent Ambo
0a34810e27 chore(ops/besadii): Fail if sourcehut token is unset 2020-02-21 22:09:23 +00:00
Vincent Ambo
80c6680eda feat(ops/besadii): Refactored tool to trigger sourcehut builds
Refactors //ops/sync-gcsr which was previously responsible for
synchronising the git repository between GCSR and the git.tazj.in cgit
instance to simply be responsible for triggering builds on sourcehut.

This program is intended to run as a git post-update hook.

Note: Not yet feature complete, as interpolation of concrete git
values and also sourcehut secrets is missing.
2020-02-21 22:05:43 +00:00
Vincent Ambo
68d1d87a9b fix(ops/nixos/camden): Add missing quote in nginx config 2020-02-21 16:12:48 +00:00
Vincent Ambo
25d8e7ce25 feat(ops/nixos/camden): Modify nginx log format
This log format contains more structured and correctly typed
information, which I can now use for dashboards and stuff in Stackdriver.
2020-02-21 16:10:08 +00:00
Vincent Ambo
1e51a2135d fix(ops/nixos/camden): Configure nginx to not log hostnames
Hostname prefixes break JSON serialisation, leading to useless
Stackdriver Logging entries.
2020-02-21 16:01:54 +00:00
Vincent Ambo
703aebe6a9 feat(ops/nixos/camden): Install jq 2020-02-21 15:43:07 +00:00
Vincent Ambo
6e4df43f62 feat(ops/nixos/camden): Forward logs to Stackdriver Logging
Enables the journaldriver service to forward logs into a "home"
log-stream in the "tazjins-infrastructure" project.

The service account key for camden has been placed on the machine
manually.
2020-02-21 15:35:51 +00:00
Vincent Ambo
7290a18cb1 chore(ops/nixos/nugget): Remove input-fonts package
My default font is now Jetbrains Mono everywhere.
2020-02-21 13:54:53 +00:00
Vincent Ambo
4bbbb58cb5 chore: Rename pkgs->depot in all Nix file headers 2020-02-21 13:54:53 +00:00
Vincent Ambo
0e54b3eb6a Merge branch 'fix/camden-trusted-users' 2020-02-17 01:02:06 +00:00
Vincent Ambo
ce4042ede7 fix(ops/nixos/camden): Add myself to trusted Nix users 2020-02-17 01:00:12 +00:00
Vincent Ambo
494e006c6b fix(ops/nixos/camden): Use pounce from //third_party 2020-02-17 00:52:07 +00:00
Vincent Ambo
1b31b47ef1 feat(ops/nixos/camden): Install pounce on camden 2020-02-17 00:22:19 +00:00
Vincent Ambo
5bfd2f70ad feat(ops/nixos/camden): Enable support for mosh 2020-02-17 00:06:55 +00:00
Vincent Ambo
4fed63d892 Merge branch 'feat/camden-migration' 2020-02-17 00:04:38 +00:00
Vincent Ambo
120ec820d1 chore(ops/nixos/nugget): Add /etc/hosts entries for camden hostnames 2020-02-17 00:03:31 +00:00
Vincent Ambo
2fd6ec650b refactor(ops/nixos/camden): Merge ACME certificate blocks 2020-02-14 12:00:12 +00:00
Vincent Ambo
bcc797fa2f feat(camden): Move to actual tazj.in hostnames 2020-02-14 11:49:04 +00:00
Vincent Ambo
c5806a44a7 feat(ops/nixos/nugget): Add camden to /etc/hosts
At the moment there is no other way for requests from nugget to camden
to resolve correctly, as the Hyperoptic router is eating this traffic
on the LAN.
2020-02-12 01:11:10 +00:00
Vincent Ambo
4feb306763 feat(ops/nixos/camden): Add nginx vhost for cgit at git.camden 2020-02-12 01:09:03 +00:00
Vincent Ambo
7373edf73a feat(ops/nixos/camden): Move ACME configuration out of nginx
This makes it possible to re-use the same provisioning mechanism for
multiple related domains.
2020-02-12 01:08:27 +00:00
Vincent Ambo
8e52e74bd3 feat(ops/nixos/camden): Set up cgit service
Adds a user & group which are configured to own the local depot copy,
and a cgit service to serve it.

The depot checkout was configured as:

  mkdir -p /var/git && chown git: /var/git

  # now, as the git user, in /var/git
  git clone --bare ... depot
  chmod -R g+rw /var/git
  chmod g+s (find /var/git -type d)
  git init --bare --shared=all depot

My personal user is a member of the git group, which means that after
the above configuration I can push to the bare repo as my user and
things work.

Also, crucially, the `post-update` hook must be enabled as cgit uses
the dumb HTTP transport.
2020-02-12 01:04:12 +00:00
Vincent Ambo
b4c0292753 fix(nix/tailscale): Fix incorrect Tailscale ACL config type 2020-02-11 21:00:50 +00:00
Vincent Ambo
675fed2dca feat(ops/nixos/camden): Serve /blobs/ from /var/www/blobs
This directory is writeable by me and is intended to make it easy to
serve random blobs.
2020-02-11 20:54:50 +00:00
Vincent Ambo
31b021e629 feat(ops/nixos/camden): Enable haveged entropy "generator" 2020-02-11 20:54:31 +00:00
Vincent Ambo
dbb24e0377 feat(ops/nixos/nugget): Set up nginx serving homepage & blog
This nginx does not currently log access correctly because for some
impenetrable reason (as is tradition), neither /dev/stdout nor
/dev/fd/1 exist for nginx at runtime. This is probably systemd's
doing, but I'll debug it later.
2020-02-11 19:32:21 +00:00
Vincent Ambo
2e95822712 fix(ops/nixos/camden): Use package set from depot pin 2020-02-11 16:46:15 +00:00
Vincent Ambo
df1a4fef2b feat(nix/tailscale): Add function for generating tailscale ACLs
... and use it on Camden!
2020-02-11 16:36:28 +00:00
Vincent Ambo
44b57d095b feat(ops/nixos/camden): Join camden.tazj.in into Tailscale mesh 2020-02-11 16:27:34 +00:00
Vincent Ambo
aaa0119a37 fix(ops/nixos): Add camden to rebuilder script
This should probably be templated instead.
2020-02-11 15:49:29 +00:00
Vincent Ambo
3b88611336 feat(ops/nixos): Add initial configuration for host camden 2020-02-11 15:41:00 +00:00
Vincent Ambo
a8792f8372 feat(ops/nixos/nugget): Enable tailscale-relay 2020-02-11 00:55:46 +00:00
Vincent Ambo
b586a04a0a feat(ops/nixos): Add NixOS module for running tailscale
This uses the "legacy" tailscale Linux client, but built from source
as per the previous commits.
2020-02-11 00:53:09 +00:00
Vincent Ambo
77085f5876 chore(ops/nixos/nugget): Install tailscale on nugget 2020-02-11 00:09:34 +00:00
Vincent Ambo
21e0279e08 chore(ops/infra/k8s): Bump website replicas to 3
There are typically 3 machines in the cluster, might as well have 3
website instances!
2020-02-09 02:21:09 +00:00
Vincent Ambo
4a18b3971a fix(ops/infra/k8s): Send www.* to nginx for redirections 2020-02-09 01:54:13 +00:00
Vincent Ambo
d0800197c4 feat(ops/infra/k8s): Add website deployment configuration 2020-02-09 01:30:56 +00:00
Vincent Ambo
87967d5be3 docs: Update README with new website setup 2020-02-09 01:30:34 +00:00
Vincent Ambo
eb6e64ad47 chore(ops/infra/k8s): Delete tazblog deployment 2020-02-09 01:27:46 +00:00
Vincent Ambo
1d7b1334fd feat(ops/nixos/nugget): Install i3lock 2020-02-08 13:32:25 +00:00
Vincent Ambo
ba20ee65f6 feat(ops/nixos/nugget): Enable pcscd & install Yubikey tools 2020-02-07 12:14:37 +00:00
Vincent Ambo
76f7ace273 feat(ops/nixos/nugget): Enable U2F hardware support 2020-02-04 23:41:52 +00:00
Vincent Ambo
264a55e2e0 feat(ops/nixos/nugget): Install unzip 2020-01-25 20:39:54 +00:00
Vincent Ambo
e50c669310 feat(ops/nixos/nugget): Enable Keybase "service" 2020-01-20 22:31:29 +00:00
Vincent Ambo
e93913d6cd feat(ops/mq_cli): Bump dependencies & add derivation 2020-01-20 13:50:29 +00:00
Vincent Ambo
336937814c feat(ops/posix_mq.rs): Set up Nix build 2020-01-20 11:59:21 +00:00
Vincent Ambo
0d4c93878d chore(ops): Remove deprecated .travis.yml files 2020-01-20 11:51:24 +00:00
Vincent Ambo
0b146dc079 chore(ops/posix_mq.rs): Update crate dependencies to recent versions
First bump since 2017! This changes the code to be compatible with
newer versions of the `nix` crate, which has shuffled things around a
bit.
2020-01-20 11:51:24 +00:00
Vincent Ambo
4bc3196c9a Add 'ops/mq_cli/' from commit 'df29b08bffc90cfd4f2d963a8e48d89f7a86308d'
git-subtree-dir: ops/mq_cli
git-subtree-mainline: b59c7e693c
git-subtree-split: df29b08bff
2020-01-20 11:32:26 +00:00
Vincent Ambo
b59c7e693c Add 'ops/posix_mq.rs/' from commit 'f7d1a38da67e92e0e87dbb988d288f0be2714f5c'
git-subtree-dir: ops/posix_mq.rs
git-subtree-mainline: 8f68497269
git-subtree-split: f7d1a38da6
2020-01-20 11:32:02 +00:00
Vincent Ambo
1f68644dc9 feat(third_party/guile): Override guile to version 3.0.0
Lets try this thing out!
2020-01-19 19:34:39 +00:00
Vincent Ambo
0a3613996f feat(ops/nixos/nugget): Install miller 2020-01-19 18:56:44 +00:00
Vincent Ambo
7b011de1b8 chore(ops/nixos/nugget): Aimlessly tweak font configuration
These settings seem to be very mildly better than what I had before,
but I'm not entirely sure.
2020-01-19 16:38:32 +00:00
Vincent Ambo
ee34920a98 fix(infra/k8s/nixery): Add GCSR hosts to SSH known_hosts for Nixery
Unsure how this worked at all previously?
2020-01-19 02:17:52 +00:00
Vincent Ambo
89b0a43786 feat(ops/nixos/nugget): Connect to wifi & install Google Chrome
This adds configuration which, sometimes, when the stars align just
right, makes it possible to cast to the Chromecast from nugget.
2020-01-19 01:44:40 +00:00
Vincent Ambo
d05489adaa chore(build): Rename tazjins-depot -> depot
Sourcehut namespaces this under ~tazjin/ anyways.
2020-01-19 01:44:26 +00:00
Vincent Ambo
028559610f chore(ops/sync-gcsr): Rotate Cachix secret in sourcehut 2020-01-19 01:08:00 +00:00
Vincent Ambo
6a0b37a196 fix(ops/sync-gcsr): Ensure cachix is installed 2020-01-18 17:33:21 +00:00
Vincent Ambo
7aa8f32065 docs(ops/kontemplate): Update installation notes
Removed the AUR package (which has not been updated since 2017) and
made Nix the recommended installation method.
2020-01-18 17:31:28 +00:00
Vincent Ambo
48d31b7770 fix(ops/sync-gcsr): Avoid echoing the Cachix secret
sourcehut does not censor secret strings in build logs, but this
workaround should avoid the issue.
2020-01-18 16:34:54 +00:00
Vincent Ambo
526b9c4572 feat(ops/sync-gcsr): Log successful build triggers 2020-01-18 15:49:12 +00:00
Vincent Ambo
61830ebc5b feat(ops/infra/k8s): Add sourcehut configuration to sync-gcsr 2020-01-18 15:48:52 +00:00
Vincent Ambo
af63d2604e feat(sync-gcsr): Add builds.sr.ht build manifest
Adds a simple build manifest that builds everything in ci-builds.nix
and pushes results to Cachix on success.
2020-01-18 15:37:05 +00:00
Vincent Ambo
b8355066e8 feat(sync-gcsr): Trigger sourcehut builds on master branch changes
Calls the sourcehut API at builds.sr.ht to trigger a build if the
master branch changes.

The build manifest is going to be stored in the depot too, coming up
next ...
2020-01-18 15:36:15 +00:00
Vincent Ambo
44116522dd feat(ops/sync-gcsr): Skip unneccessary branch updates
Checks whether branches are already up-to-date before setting
references.

This also makes it possible to hook additional logic on the update
flow.
2020-01-18 14:49:34 +00:00
Vincent Ambo
a21be17719 chore(ops/infra/gcp): Update enabled GCP APIs 2020-01-18 12:43:53 +00:00
Vincent Ambo
a52c0c4198 feat(nixos/nugget): Install cachix binary 2020-01-18 11:29:18 +00:00
Vincent Ambo
31f66491a9 feat(ops/nixos/nugget): Install SBCL in system packages 2020-01-07 22:26:01 +00:00
Vincent Ambo
33a9dccba1 chore(ops/secrets): Add Google Maps API key 2020-01-05 21:12:08 +00:00
Vincent Ambo
d66c7a8942 feat(ops/nixos/nugget): Install msmtp & lieer timers 2020-01-05 16:59:52 +00:00
Vincent Ambo
e5608cf079 chore(ops/nixos/nugget): Install various needed packages 2020-01-05 16:59:52 +00:00
Vincent Ambo
85ee07457c feat(ops/nixos): Add 'rebuilder' helper script
This script rebuilds & activates system configuration based on the
hostname.

Currently since there is only one host this isn't particularly
interesting.
2020-01-04 22:50:34 +00:00
Vincent Ambo
63dc41bcf3 feat(ops/nixos): Check in updated system configuration for 'nugget'
This is the rebrand of the desktop machine, now running a config
straight out of the depot.
2020-01-04 22:50:34 +00:00
Vincent Ambo
496648f237 chore(ops/nixos): Remove deprecated NixOS config files 2020-01-04 22:50:34 +00:00
Vincent Ambo
1d687c5303 chore(ops/nixos): Move NixOS configuration one level up 2020-01-04 22:50:19 +00:00
Vincent Ambo
fd5fd57cc1 docs(kontemplate): Update documentation for depot changes 2019-12-30 17:01:22 +01:00
Vincent Ambo
36beb6d43c feat(sync-gcsr): Synchronise all remote branches
Explicitly sets all local branches to all equivalent remote branches
after each update.

Branches deleted on the remote will eventually disappear when the
container is restarted.
2019-12-30 05:06:46 +01:00
Vincent Ambo
7c52a205ee refactor(sync-gcsr): Split clone into separate function
This is in preparation for adding more complex branch-related logic to
both functions.
2019-12-29 04:50:31 +01:00
Vincent Ambo
3c94625a5f chore(lieer): Remove OAuth client patch
This is now done in my work-specific configuration, which is
elsewhere.
2019-12-25 14:09:09 +01:00
Vincent Ambo
41eea96e63 feat(third_party/lieer): Overwrite included client secret 2019-12-23 13:26:30 +01:00
Vincent Ambo
a260eba3cf refactor(ops/kms_pass): Pin encrypted secrets into Nix store 2019-12-23 13:26:09 +01:00
Landon Spear
98f8b660e2 docs(cluster-config): Correct term in cluster config doc
Including external variables does not work. You must import them. This
change corrects the External Variables section of the cluster-config
README.

Signed-off-by: Vincent Ambo <tazjin@google.com>
2019-12-20 22:32:06 +00:00
Vincent Ambo
db30770101 fix(kontemplate): Make build compatible with readTree
The kontemplate build will keep using `buildGoPackage` for now until
I've had the time to add tests to //nix/buildGo
2019-12-20 22:19:52 +00:00
Vincent Ambo
a9f5c63707 merge(kontemplate): Integrate kontemplate at //depot/ops/kontemplate 2019-12-20 22:14:40 +00:00
Vincent Ambo
795a974665 chore(kontemplate): Prepare kontemplate for depot-merge
This merge will not yet include moving over to buildGo.nix, as support
for testing and such is not present in that library yet.
2019-12-20 22:13:07 +00:00
Vincent Ambo
61c8ac4338 fix(infra/k8s): Fix Nixery image URLs for moved local projects 2019-12-20 20:39:27 +00:00
Vincent Ambo
8de5d093d8 refactor: Fix a variety of filepaths for repo relayouting
This fixes readTree and the various project builds, as well
as (hopefully) most documentation links inside of the projects.
2019-12-20 20:37:02 +00:00
Vincent Ambo
03bfe08e1d chore: Significantly restructure folder layout
This moves the various projects from "type-based" folders (such as
"services" or "tools") into more appropriate semantic folders (such as
"nix", "ops" or "web").

Deprecated projects (nixcon-demo & gotest) which only existed for
testing/demonstration purposes have been removed.

(Note: *all* builds are broken with this commit)
2019-12-20 20:18:41 +00:00