No description
Find a file
Vincent Ambo c1bddf191f feat(web/panettone): Implement OAuth2-based authentication
Instead of directly connecting to LDAP and attempting to bind
usernames/password, authenticate users through an OAuth2 flow to
Keycloak.

This has the advantage of reusing the same SSO we already have for
Gerrit, Buildkite, ...

However, much of panettone's functionality makes assumptions about
LDAP being used. As a result there are some warts introduced by
this (for now):

* Since LDAP DNs are used as primary keys for users, we have to
  construct fake DNs based on LDAP usernames

  It might be sensible to migrate this to the UUIDs used by Keycloak
  eventually.

* LDAP is part of the serving path for issues (for fetching user
  information), however panettone no longer has a way to fetch
  arbitrary user information unless it is persisted in its database.

  To work around this, we construct a "fake" user based only on its
  DN (i.e. only the username is going to be "correct") and use that to
  serve issues.

* Email notifications no longer work (panettone can not access email
  addresses)

Some of these need to be worked around by persisting some of that
information in the panettone database instead, as we don't want to
give the service the ability to access arbitrary user information
anymore.

We can probably do this with the user settings feature that already
exists and populate it on launch, but as of this commit email and
displayName functionality is simply broken.

Change-Id: Id32bf5e09d67f0f1e883024c6e013eb342f03b05
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5772
Reviewed-by: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI
2022-05-28 18:00:02 +00:00
.nixery feat(ops/modules): Add module for running Nixery 2021-08-12 14:55:59 +00:00
corp style: format entire depot with nixpkgs-fmt 2022-01-31 16:11:53 +00:00
docs docs(CONTRIBUTING): Mention new subtree commit type 2021-11-30 22:42:34 +00:00
fun chore(paroxysm): Bump dependencies within constraints 2022-05-19 14:46:28 +00:00
lisp feat(nix/buildLisp): add ecl 2021-08-24 22:00:15 +00:00
net chore(alcoholic_jwt): prepare release v4091 2022-05-16 18:53:30 +00:00
nix feat(nix/utils): add onlyDrvPath to get the drvPath w/o the outputs 2022-05-28 12:01:46 +00:00
ops feat(ops/secrets): Add OAuth2 client secret for panettone 2022-05-28 17:03:36 +00:00
third_party chore(3p/sources): Bump channels & overlays 2022-05-27 21:15:10 +00:00
tools test(tools/hash-password): ensure that script can execute correctly 2022-05-27 23:48:37 +00:00
tvix style(rust): Format all Rust code with rustfmt 2022-02-08 12:06:39 +00:00
users feat(wpcarro/tarasco): firewall.checkReversePath = loose 2022-05-27 23:31:34 +00:00
views docs(views/kit): mention magrathea 2022-05-27 22:15:59 +00:00
web feat(web/panettone): Implement OAuth2-based authentication 2022-05-28 18:00:02 +00:00
.envrc fix(.envrc): Add /bin to the PATH of our lazy dispatch 2022-05-07 12:14:13 +00:00
.git-blame-ignore-revs fix: add cl/4397 (treewide nixpkgs-fmt) to git-blame-ignore-revs 2022-02-07 18:15:09 +00:00
.gitignore chore(gitignore): Ignore garbage/ folder 2019-12-20 20:05:40 +00:00
.hgignore chore(hgignore): ignore .git for hg 2020-06-14 18:23:13 +00:00
.mailmap chore(mailmap): add my name to mailmap 2020-07-18 18:15:05 +00:00
.rgignore chore: Only exclude //third_party/git from ripgrep 2020-05-17 23:58:22 +01:00
buf.yaml feat(buf.yaml): add protobuf linter config 2020-07-17 20:01:29 +00:00
default.nix style: format entire depot with nixpkgs-fmt 2022-01-31 16:11:53 +00:00
LICENSE Add license file 2022-02-10 00:00:00 +00:00
OWNERS feat(depot): Add grfn and sterni to top-level owners 2021-12-10 18:11:16 +03:00
README.md docs(README.md): reflect recent upheaval in depot 2022-05-27 23:24:28 +00:00
RULES feat(whitby): Let sterni bear the wheel 2021-05-23 19:06:15 +00:00
rustfmt.toml feat(depotfmt): Check & format Rust code with rustfmt 2022-02-08 12:06:39 +00:00

depot

Build status

This repository is the monorepo for the community around The Virus Lounge, containing our personal tools and infrastructure. Everything in here is built using Nix.

A large portion of the software here is very self-referential, meaning that it exists to sustain the operation of the repository. This is the case because we partially see this as an experiment in tooling for monorepos.

Highlights

Services

  • Source code is available primarily through Sourcegraph on cs.tvl.fyi, where it is searchable and even semantically indexed. A lower-tech view of the repository is also available via cgit-pink on code.tvl.fyi.

    The repository can be cloned using git from https://cl.tvl.fyi/depot.

  • All code in the depot, with the exception of code that is checked in to individual //users folders, needs to be reviewed. We use Gerrit on cl.tvl.fyi for this.

  • Issues are tracked via our own issue tracker on b.tvl.fyi. Its source code lives at //web/panettone/.

  • Smaller todo-list entries which do not warrant a separate issue are listed at todo.tvl.fyi.

  • We use Buildkite for CI. Recent builds are listed on tvl.fyi/builds and pipelines are configured dynamically via //ops/pipelines.

  • A search service that makes TVL services available via textual shortcuts is available: atward

All services that we host are deployed on NixOS machines that we manage. Their configuration is tracked in //ops/{modules,machines}.

Nix

  • //nix/readTree contains the Nix code which automatically registers projects in our Nix attribute hierarchy based on their in-tree location
  • //tools/nixery contains the source code of Nixery, a container registry that can build images ad-hoc from Nix packages
  • //nix/yants contains Yet Another Nix Type System, which we use for a variety of things throughout the repository
  • //nix/buildGo implements a Nix library that can build Go software in the style of Bazel's rules_go. Go programs in this repository are built using this library.
  • //nix/buildLisp implements a Nix library that can build Common Lisp software. Currently only SBCL is supported. Lisp programs in this repository are built using this library.
  • //web/blog and //web/atom-feed: A Nix-based static site generator which generates the web page and Atom feed for tazj.in (//users/tazjin/homepage) and tvl.fyi (//web/tvl)
  • //web/bubblegum contains a CGI-based web framework written in Nix.
  • //nix/nint: A shebang-compatible interpreter wrapper for Nix.
  • //tvix contains initial work towards a modular architecture for Nix.

We have a variety of other tools and libraries in the //nix folder which may be of interest.

Packages / Libraries

  • //net/alcoholic_jwt contains an easy-to-use JWT-validation library for Rust
  • //net/crimp contains a high-level HTTP client using cURL for Rust
  • //tools/emacs-pkgs contains various useful Emacs libraries, for example:
    • dottime.el provides dottime in the Emacs modeline
    • nix-util.el provides editing utilities for Nix files
    • term-switcher.el is an ivy-function for switching between vterm buffers
    • tvl.el provides helper functions for interacting with the TVL monorepo
  • //lisp/klatre provides a grab-bag utility library for Common Lisp

User packages

Contributors to the repository have user directories under //users, which can be used for personal or experimental code that does not require review.

Some examples:

  • //users/grfn/xanthous: A (WIP) TUI RPG, written in Haskell.
  • //users/tazjin/emacs: tazjin's Emacs & EXWM configuration
  • //users/tazjin/finito: A persistent finite-state machine library for Rust.

Licensing

Unless otherwise stated in a subdirectory, all code is licensed under the MIT license. See LICENSE for details.

Contributing

If you'd like to contribute to any of the tools in here, please check out the contribution guidelines and our code of conduct.

IRC users can find us in #tvl on hackint, which is also reachable via XMPP at #tvl@irc.hackint.org (sic!).

Hackint also provide a web chat.