Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-04-04 03:01:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Cleaned drone a little bit

Browse source
This commit is contained in:
Julien Malka 2021-12-27 22:14:37 +01:00
parent 66230c5efc
commit 61e2ddc881
No known key found for this signature in database
GPG key ID: 3C68E13964FEA07F
2 changed files with 68 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
machines/lisa/default.nix
View file

@ -19,12 +19,9 @@
subdomain = "bin"; subdomain = "bin";
}; };
drone = { drone = {
enable = true;
nginx = {
enable = true; enable = true;
subdomain = "ci"; subdomain = "ci";
}; };
};
status = { status = {
enable = true; enable = true;
nginx = { nginx = {

59
modules/drone/default.nix
View file

@ -2,25 +2,33 @@
with lib; with lib;
let let
cfg = config.luj.drone; cfg = config.luj.drone;
droneserver = config.users.users.droneserver.name; drone = config.users.users.drone.name;
port = 3030; port = 3030;
in in
{ {
options.luj.drone = { options.luj.drone = {
enable = mkEnableOption "activate drone CI"; enable = mkEnableOption "activate drone CI";
nginx.enable = mkEnableOption "activate nginx"; subdomain = mkOption {
nginx.subdomain = mkOption {
type = types.str; type = types.str;
}; };
}; };
config = mkIf cfg.enable ( config = mkIf cfg.enable {
mkMerge [{
users.users.droneserver = {
isNormalUser = true;
createHome = true;
home = "/home/droneserver";
extraGroups = [ droneserver config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.droneserver = { };
luj.hmgr.droneserver.luj.programs.git.enable = true; luj.hmgr.droneserver.luj.programs.git.enable = true;
nix.allowedUsers = [ drone ];
sops.secrets.drone = { }; sops.secrets.drone = { };
nix.allowedUsers = [ "droneserver"];
systemd.services.drone-server = { systemd.services.drone-server = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
@ -35,64 +43,47 @@ in
"DRONE_USER_CREATE=username:Julien,admin:true" "DRONE_USER_CREATE=username:Julien,admin:true"
]; ];
ExecStart = "${pkgs.drone}/bin/drone-server"; ExecStart = "${pkgs.drone}/bin/drone-server";
User = droneserver; User = drone;
Group = droneserver; Group = drone;
}; };
}; };
services.postgresql = { services.postgresql = {
enable = true; enable = true;
ensureDatabases = [ droneserver ]; ensureDatabases = [ drone ];
ensureUsers = [{ ensureUsers = [{
name = droneserver; name = drone;
ensurePermissions = { ensurePermissions = {
"DATABASE ${droneserver}" = "ALL PRIVILEGES"; "DATABASE ${drone}" = "ALL PRIVILEGES";
}; };
}]; }];
}; };
users.users.droneserver = {
isNormalUser = true;
createHome = true;
home = "/home/droneserver";
extraGroups = [ droneserver config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.droneserver = { };
systemd.services.drone-runner-exec = { systemd.services.drone-runner-exec = {
description = "Drone Exec Runner"; description = "Drone Exec Runner";
startLimitIntervalSec = 5; startLimitIntervalSec = 5;
serviceConfig = { serviceConfig = {
User = droneserver; User = drone;
Group = droneserver; Group = drone;
EnvironmentFile = [ config.sops.secrets.drone.path ]; EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [ Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me" "DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https" "DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030" "CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
]; ];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run"; ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
}; };
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.docker pkgs.docker-compose pkgs.openssh ]; path = [ pkgs.nixUnstable pkgs.git pkgs.openssh ];
}; };
}
(mkIf cfg.nginx.enable {
luj.nginx.enable = true;
services.nginx.virtualHosts."${cfg.nginx.subdomain}.julienmalka.me" = { services.nginx.virtualHosts."${cfg.nginx.subdomain}.julienmalka.me" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:${toString port}"; proxyPass = "http://localhost:${toString port}";
}; };
};
}; };
})]);
} }