0c178a0ef6
Upstream nixpkgs removed a lot of aliases this time, so we needed to do the following transformations. It's a real shame that aliases only really become discoverable easily when they are removed. * runCommandNoCC -> runCommand * gmailieer -> lieer We also need to work around the fact that home-manager hasn't catched on to this rename. * mysql -> mariadb * pkgconfig -> pkg-config This also affects our Nix fork which needs to be bumped. * prometheus_client -> prometheus-client * rxvt_unicode -> rxvt-unicode-unwrapped * nix-review -> nixpkgs-review * oauth2_proxy -> oauth2-proxy Additionally, some Go-related builders decided to drop support for passing the sha256 hash in directly, so we need to use the generic hash arguments. Change-Id: I84aaa225ef18962937f8616a9ff064822f0d5dc3 Reviewed-on: https://cl.tvl.fyi/c/depot/+/6792 Autosubmit: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: flokli <flokli@flokli.de> Reviewed-by: tazjin <tazjin@tvl.su> Reviewed-by: wpcarro <wpcarro@gmail.com>
77 lines
2.2 KiB
Nix
77 lines
2.2 KiB
Nix
# Configuration for the TVL buildkite agents.
|
|
{ config, depot, pkgs, lib, ... }:
|
|
|
|
let
|
|
cfg = config.services.depot.buildkite;
|
|
agents = lib.range 1 cfg.agentCount;
|
|
description = "Buildkite agents for TVL";
|
|
|
|
besadiiWithConfig = name: pkgs.writeShellScript "besadii-whitby" ''
|
|
export BESADII_CONFIG=/run/agenix/buildkite-besadii-config
|
|
exec -a ${name} ${depot.ops.besadii}/bin/besadii "$@"
|
|
'';
|
|
|
|
# All Buildkite hooks are actually besadii, but it's being invoked
|
|
# with different names.
|
|
buildkiteHooks = pkgs.runCommand "buildkite-hooks" { } ''
|
|
mkdir -p $out/bin
|
|
ln -s ${besadiiWithConfig "post-command"} $out/bin/post-command
|
|
'';
|
|
|
|
credentialHelper = pkgs.writeShellScriptBin "git-credential-gerrit-creds" ''
|
|
echo 'username=buildkite'
|
|
echo "password=$(jq -r '.gerritPassword' /run/agenix/buildkite-besadii-config)"
|
|
'';
|
|
in
|
|
{
|
|
options.services.depot.buildkite = {
|
|
enable = lib.mkEnableOption description;
|
|
agentCount = lib.mkOption {
|
|
type = lib.types.int;
|
|
description = "Number of Buildkite agents to launch";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# Run the Buildkite agents using the default upstream module.
|
|
services.buildkite-agents = builtins.listToAttrs (map
|
|
(n: rec {
|
|
name = "whitby-${toString n}";
|
|
value = {
|
|
inherit name;
|
|
enable = true;
|
|
tokenPath = config.age.secretsDir + "/buildkite-agent-token";
|
|
privateSshKeyPath = config.age.secretsDir + "/buildkite-private-key";
|
|
hooks.post-command = "${buildkiteHooks}/bin/post-command";
|
|
|
|
runtimePackages = with pkgs; [
|
|
bash
|
|
coreutils
|
|
credentialHelper
|
|
curl
|
|
git
|
|
gnutar
|
|
gzip
|
|
jq
|
|
nix
|
|
];
|
|
};
|
|
})
|
|
agents);
|
|
|
|
# Set up a group for all Buildkite agent users
|
|
users = {
|
|
groups.buildkite-agents = { };
|
|
users = builtins.listToAttrs (map
|
|
(n: rec {
|
|
name = "buildkite-agent-whitby-${toString n}";
|
|
value = {
|
|
isSystemUser = true;
|
|
group = lib.mkForce "buildkite-agents";
|
|
extraGroups = [ name "docker" ];
|
|
};
|
|
})
|
|
agents);
|
|
};
|
|
};
|
|
}
|