Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-04-04 03:01:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Cleaned drone a little bit

Browse source
This commit is contained in:
Julien Malka 2021-12-27 22:14:37 +01:00
parent 66230c5efc
commit 61e2ddc881
No known key found for this signature in database
GPG key ID: 3C68E13964FEA07F
2 changed files with 68 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
machines/lisa/default.nix
View file

@ -20,10 +20,7 @@
}; };
drone = { drone = {
enable = true; enable = true;
nginx = { subdomain = "ci";
enable = true;
subdomain = "ci";
};
}; };
status = { status = {
enable = true; enable = true;

143
modules/drone/default.nix
View file

@ -2,97 +2,88 @@
with lib; with lib;
let let
cfg = config.luj.drone; cfg = config.luj.drone;
droneserver = config.users.users.droneserver.name; drone = config.users.users.drone.name;
port = 3030; port = 3030;
in in
{ {
options.luj.drone = { options.luj.drone = {
enable = mkEnableOption "activate drone CI"; enable = mkEnableOption "activate drone CI";
nginx.enable = mkEnableOption "activate nginx"; subdomain = mkOption {
nginx.subdomain = mkOption {
type = types.str; type = types.str;
}; };
}; };
config = mkIf cfg.enable ( config = mkIf cfg.enable {
mkMerge [{
luj.hmgr.droneserver.luj.programs.git.enable = true; users.users.droneserver = {
sops.secrets.drone = { }; isNormalUser = true;
nix.allowedUsers = [ "droneserver"]; createHome = true;
home = "/home/droneserver";
extraGroups = [ droneserver config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.droneserver = { };
luj.hmgr.droneserver.luj.programs.git.enable = true;
nix.allowedUsers = [ drone ];
systemd.services.drone-server = { sops.secrets.drone = { };
wantedBy = [ "multi-user.target" ];
serviceConfig = {
EnvironmentFile = [ config.sops.secrets.drone.path ]; systemd.services.drone-server = {
Environment = [ wantedBy = [ "multi-user.target" ];
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me" serviceConfig = {
"DRONE_SERVER_PROTO=https" EnvironmentFile = [ config.sops.secrets.drone.path ];
"DRONE_DATABASE_DATASOURCE=postgres:///droneserver?host=/run/postgresql" Environment = [
"DRONE_DATABASE_DRIVER=postgres" "DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PORT=:3030" "DRONE_SERVER_PROTO=https"
"DRONE_USER_CREATE=username:Julien,admin:true" "DRONE_DATABASE_DATASOURCE=postgres:///droneserver?host=/run/postgresql"
]; "DRONE_DATABASE_DRIVER=postgres"
ExecStart = "${pkgs.drone}/bin/drone-server"; "DRONE_SERVER_PORT=:3030"
User = droneserver; "DRONE_USER_CREATE=username:Julien,admin:true"
Group = droneserver; ];
ExecStart = "${pkgs.drone}/bin/drone-server";
User = drone;
Group = drone;
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ drone ];
ensureUsers = [{
name = drone;
ensurePermissions = {
"DATABASE ${drone}" = "ALL PRIVILEGES";
}; };
}; }];
services.postgresql = { };
enable = true;
ensureDatabases = [ droneserver ];
ensureUsers = [{
name = droneserver;
ensurePermissions = {
"DATABASE ${droneserver}" = "ALL PRIVILEGES";
};
}];
};
users.users.droneserver = {
isNormalUser = true;
createHome = true;
home = "/home/droneserver";
extraGroups = [ droneserver config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.droneserver = { };
systemd.services.drone-runner-exec = {
description = "Drone Exec Runner";
startLimitIntervalSec = 5;
serviceConfig = {
User = drone;
Group = drone;
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
};
wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.openssh ];
};
systemd.services.drone-runner-exec = { services.nginx.virtualHosts."${cfg.nginx.subdomain}.julienmalka.me" = {
description = "Drone Exec Runner"; enableACME = true;
startLimitIntervalSec = 5; forceSSL = true;
serviceConfig = { locations."/" = {
User = droneserver; proxyPass = "http://localhost:${toString port}";
Group = droneserver;
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.nginx.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
};
wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.docker pkgs.docker-compose pkgs.openssh ];
}; };
};
};
}
(mkIf cfg.nginx.enable {
luj.nginx.enable = true;
services.nginx.virtualHosts."${cfg.nginx.subdomain}.julienmalka.me" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:${toString port}";
};
};
})]);
} }