Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-03-27 06:10:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Cleaned drone a little bit

Browse source
This commit is contained in:
Julien Malka 2021-12-27 22:14:37 +01:00
parent 66230c5efc
commit 61e2ddc881
No known key found for this signature in database
GPG key ID: 3C68E13964FEA07F
2 changed files with 68 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
machines/lisa/default.nix
View file

@ -20,10 +20,7 @@
};
drone = {
enable = true;
nginx = {
enable = true;
subdomain = "ci";
};
subdomain = "ci";
};
status = {
enable = true;

143
modules/drone/default.nix
View file

@ -2,97 +2,88 @@
with lib;
let
cfg = config.luj.drone;
droneserver = config.users.users.droneserver.name;
drone = config.users.users.drone.name;
port = 3030;
in
{
options.luj.drone = {
enable = mkEnableOption "activate drone CI";
nginx.enable = mkEnableOption "activate nginx";
nginx.subdomain = mkOption {
subdomain = mkOption {
type = types.str;
};
};
config = mkIf cfg.enable (
mkMerge [{
config = mkIf cfg.enable {
luj.hmgr.droneserver.luj.programs.git.enable = true;
sops.secrets.drone = { };
nix.allowedUsers = [ "droneserver"];
users.users.droneserver = {
isNormalUser = true;
createHome = true;
home = "/home/droneserver";
extraGroups = [ droneserver config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.droneserver = { };
luj.hmgr.droneserver.luj.programs.git.enable = true;
nix.allowedUsers = [ drone ];
systemd.services.drone-server = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"DRONE_DATABASE_DATASOURCE=postgres:///droneserver?host=/run/postgresql"
"DRONE_DATABASE_DRIVER=postgres"
"DRONE_SERVER_PORT=:3030"
"DRONE_USER_CREATE=username:Julien,admin:true"
];
ExecStart = "${pkgs.drone}/bin/drone-server";
User = droneserver;
Group = droneserver;
sops.secrets.drone = { };
systemd.services.drone-server = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"DRONE_DATABASE_DATASOURCE=postgres:///droneserver?host=/run/postgresql"
"DRONE_DATABASE_DRIVER=postgres"
"DRONE_SERVER_PORT=:3030"
"DRONE_USER_CREATE=username:Julien,admin:true"
];
ExecStart = "${pkgs.drone}/bin/drone-server";
User = drone;
Group = drone;
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ drone ];
ensureUsers = [{
name = drone;
ensurePermissions = {
"DATABASE ${drone}" = "ALL PRIVILEGES";
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ droneserver ];
ensureUsers = [{
name = droneserver;
ensurePermissions = {
"DATABASE ${droneserver}" = "ALL PRIVILEGES";
};
}];
};
users.users.droneserver = {
isNormalUser = true;
createHome = true;
home = "/home/droneserver";
extraGroups = [ droneserver config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.droneserver = { };
}];
};
systemd.services.drone-runner-exec = {
description = "Drone Exec Runner";
startLimitIntervalSec = 5;
serviceConfig = {
User = drone;
Group = drone;
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
};
wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.openssh ];
};
systemd.services.drone-runner-exec = {
description = "Drone Exec Runner";
startLimitIntervalSec = 5;
serviceConfig = {
User = droneserver;
Group = droneserver;
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
};
wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.docker pkgs.docker-compose pkgs.openssh ];
services.nginx.virtualHosts."${cfg.nginx.subdomain}.julienmalka.me" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:${toString port}";
};
}
(mkIf cfg.nginx.enable {
luj.nginx.enable = true;
services.nginx.virtualHosts."${cfg.nginx.subdomain}.julienmalka.me" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:${toString port}";
};
};
})]);
};
};
}