From 9aaa2621e4b71d1fdea0e42969047a4b8a7aa934 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 6 Oct 2022 22:00:41 +0000 Subject: [PATCH] Add Drone CI --- hosts/linode/default.nix | 1 + hosts/linode/git.nix | 74 ++++++++++++++++++++++++++++++++++++--- hosts/linode/podman.nix | 9 +++++ secrets/drone.age | Bin 0 -> 2545 bytes secrets/secrets.nix | 2 ++ 5 files changed, 82 insertions(+), 4 deletions(-) create mode 100644 hosts/linode/podman.nix create mode 100644 secrets/drone.age diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index d34fc13..fe846a6 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -4,6 +4,7 @@ imports = [ ./git.nix ./hardware-configuration.nix + ./podman.nix ./nextcloud.nix ./nginx.nix ./postgres.nix diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index 51027bf..0d99d49 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -1,6 +1,17 @@ -{ config, ... }: +{ config, pkgs, ... }: -{ +let + srcDomain = "src.thehellings.com"; + ciDomain = "ci.thehellings.com"; + ciPort = "17080"; + droneDir = "/var/lib/drone"; +in { + + ########################################################################################## + ########### + # GIT SERVICES + ########## + ########################################################################################## services.gitea = rec { enable = true; appName = "Greg's Sources"; @@ -10,7 +21,7 @@ user = "gitea"; }; disableRegistration = true; - domain = "src.thehellings.com"; + domain = srcDomain; dump = { enable = true; type = "tar.xz"; @@ -18,7 +29,7 @@ rootUrl = "https://${domain}/"; }; - greg.proxies."src.thehellings.com" = { + greg.proxies."${srcDomain}" = { target = "http://localhost:${toString config.services.gitea.httpPort}"; ssl = true; genAliases = false; @@ -39,4 +50,59 @@ }; }; }; + + ########################################################################################## + ########### + # CI SERVICES + ########## + ########################################################################################## + + # Service user + users.users.drone = { + isSystemUser = true; + group = "drone"; + home = droneDir; + }; + users.groups.drone = {}; + + # Environment secrets + age.secrets.drone = { + file = ../../secrets/drone.age; + owner = "root"; + }; + + virtualisation.oci-containers = { + backend = "podman"; + containers = { + "drone" = { + environment = { + DRONE_GITEA_SERVER = "https://${srcDomain}"; + DRONE_SERVER_HOST = ciDomain; + DRONE_SERVER_PROTO = "https"; + DRONE_SERVER_PROXY_HOST = ciDomain; + DRONE_SERVER_PROXY_PROTO = "https"; + DRONE_TLS_AUTOCERT = "false"; # Suppress it generating SSL certificates, as our proxy handles that + }; + environmentFiles = [ + "/run/agenix/drone" + ]; + extraOptions = [ "--pull=newer" ]; + image = "drone/drone:2.13"; + ports = [ "${ciPort}:80" ]; + volumes = [ "${droneDir}:/data" ]; + }; + }; + }; + + systemd.services."podman-drone".serviceConfig = { + StateDirectory = "drone"; + StateDirectoryMode = pkgs.lib.mkForce "0777"; + WorkingDirectory = droneDir; + }; + + greg.proxies."${ciDomain}" = { + target = "http://localhost:${ciPort}"; + ssl = true; + genAliases = false; + }; } diff --git a/hosts/linode/podman.nix b/hosts/linode/podman.nix new file mode 100644 index 0000000..97ba29d --- /dev/null +++ b/hosts/linode/podman.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + virtualisation.podman = { + enable = true; + dockerCompat = true; + dockerSocket.enable = true; + }; +} diff --git a/secrets/drone.age b/secrets/drone.age new file mode 100644 index 0000000000000000000000000000000000000000..5fb5c5e85c12b593b84a4d6dc5a2e38abc1e13e4 GIT binary patch literal 2545 zcmYk7Tj)Fm9mOT+;z&dwlKJxgOIiNczjNE&*-21$t~)b3GduSSg3fj4y0bg?nZ&n* zB74!y${>g$fEmQeC&{G+_WF%9o{30VsH`G^x*FZy!IWz9MC#qab3zmeA zP1ok7Cwf>wpNne5A|1VWBMYocxHz6sj401I-$RmxYVBz>_M*1x=OGTIPDh7wb7{=D zi@boYuOxSs>6{8*U)x9u?9D?R8e6i9U~((2p;Kd+^vXvl39P$@@kVu#7Xw1nHG>z2 ztBZ`)hZwOGhFd`mRRX*Vjd_92=TKO8tz|-KvA&#rZwj?ewI}GHF|-VpA-|hd(e266 zzNC1O4I;iu^%x5Pj_%rus+XET$c}h9@icxE$xP{LSkwu+3MR8DPeU!Up5f3_f9RD8 zbsB+AmTU!*YhXv_KGm36X?6+Y)f5CS0-skUyO7hCFX?mL(F4C9CqLb>1YwsQMF(EA z)k7y}r>z34Y)h(bWPi}bQ=OIB(QxJtZsDV~R87cOASxOcpn+N5$Xh}<0Hq3L!q=nUXzlkem<7VjuI^%)gt6htp%~&gXR@pXX zyl{6wuBV9R6R;r-i*dpNq0S)Ggm$xY)xP7itf;BXM#vaLoARk$>~Y_7^kd^(a8sdR z4+v+r#*#~VxGO>2|a#8k+nBW2Fur8M~$RZ)UttmW%&j-YH zY?3QEIqoGr5aV382#tZe$~;a)y+d11-G>^K3S(TsK;~{dHc7J#tAhffMAwQLLRG6m zJ_$=G!ZIVHQc=myON6`#41%Pjv{f>HcAz#kD**^)3U+!(RvmUVi|S@0Er&g2^vq0H z+ak1~J<6^~Y*VMFYL3?uY)8ew2GM@Ut=W7L1HOKVTubE;zn0Dmu)@HG2wgc~vvb8R zP?L$S+UteWvWd6pL|DtgGbFg2aMCGc-9Q0B68KXt#6~64ga92UQ(whkW40j&cC?I) z>YQI}0mkyP-a-AuR(=JiAS0NJ1QpcB!9;U&3zM>OGH1uAvQ@Ko95$8_u zX2F(PjGB1P6l5#~>xitQ4oM>;JSRZIk_t>#vDcy(S&fBabir2D3B-;0_z{Jm_JyIauh3#gWj9ND9YOMkXL_oJMBo7}(+V z-M|F)DG;ZOiaF;(`Gq1g)DGC|C1#H}5?u}*l*!Bd%EY?BFiPQBsT2D}fN(hBbw;_| zd(v1`)X3Lhsa2~ekow36awtBcSlrlxwct%-ia8ApiLF6n5yykonhRQp-j@MxIwT_- zOULhLz8*78>^Ivp zY6ljZYJjew;`=HPv<4T70ilHaLM5-L3L>0gZk*O%7ZYc6IzJ`n$li2X+3qs2o_9=T zAl+d>K%IkGC~(l4`I7Nk>ws<}Wwc<>GLQS{5bY9}IT`V^QZjB-WXC7fwA~kOCv4?F zsg};RBcK}SPD+5CJRDDRzN6PplC0B?6OdKt;`{S*n%5M)I|v&lF~Q8Hl!-r+rISV% zbk`dvbqOd78rQ58M+2Q0L;6y0KB4 zeD6KyjH|3`k_?mqGRxs&U6Lrdt@_;4YtJXJ-3Gst2Ufd%HufhWP&+a;5l`s zej}G=F;ANTD2w>eQ05_OOlscJ9_SQ|C%O^V--4l4V&&w?XH9;1Y4= zMuk1ht3y_{>&$39p`qNB$+`m&zBe7ahYnx)_3O9nKk(wmKlSEpJpTHt@Qr*Yz4FK3 zUH|NJkDczhyZP&#|FLep>j!tQ{&mM5iwLf8s;mBp-Jl{LyP)ho5{-d++wQUV0&V{NG==fq(Q5Z&bJZ?B!>F_@%eM z_>!wX^V83K`_|t-4E*wMKl$>z&p+_1XWsF?^}wU?H}1GE{$4(P`k}kt`Oa;m{|_#C J*LeBI{{?f8X)*u+ literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 8e33964..6aee248 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -11,4 +11,6 @@ in # age.secrets.matrix.file = ../../secrets/matrix.age; # Then you can reference the file at /run/agenix/matrix "nextcloudadmin.age".publicKeys = [ linode user ]; + + "drone.age".publicKeys = [ linode user ]; }