stockholm/lass/2configs/buildbot-standalone.nix

{ lib, config, pkgs, ... }:

with import <stockholm/lib>;

let
  sshHostConfig = pkgs.writeText "ssh-config" ''
    ControlMaster auto
    ControlPath /tmp/%u_sshmux_%r@%h:%p
    ControlPersist 4h
  '';

in {
  config.services.nginx.virtualHosts.build = {
    serverAliases = [ "build.prism.r" ];
    locations."/".extraConfig = ''
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_pass http://localhost:${toString config.krebs.buildbot.master.web.port};
    '';
  };

  config.krebs.buildbot.master = let
    stockholm-mirror-url = http://cgit.lassul.us/stockholm ;
  in {
    workers = {
      testworker = "lasspass";
    };
    change_source.stockholm = ''
      stockholm_repo = '${stockholm-mirror-url}'
      cs.append(
          changes.GitPoller(
              stockholm_repo,
              workdir='stockholm-poller', branches=True,
              project='stockholm',
              pollinterval=120
          )
      )
    '';
    scheduler = {
      build-scheduler = ''
        # build all hosts
        sched.append(
              schedulers.SingleBranchScheduler(
                  change_filter=util.ChangeFilter(branch_re=".*"),
                  treeStableTimer=10,
                  name="build-all-branches",
                  builderNames=["build-hosts", "build-pkgs"]
              )
        )
      '';
    };
    builder_pre = ''
      # prepare grab_repo step for stockholm
      grab_repo = steps.Git(
          repourl=stockholm_repo,
          mode='full'
      )

      # TODO: get nixpkgs/stockholm paths from krebs
      env_lass = {
        "LOGNAME": "lass",
        "NIX_REMOTE": "daemon",
        "dummy_secrets": "true",
      }
      env_makefu = {
        "LOGNAME": "makefu",
        "NIX_REMOTE": "daemon",
        "dummy_secrets": "true",
      }
      env_nin = {
        "LOGNAME": "nin",
        "NIX_REMOTE": "daemon",
        "dummy_secrets": "true",
      }
      env_shared = {
        "LOGNAME": "shared",
        "NIX_REMOTE": "daemon",
        "dummy_secrets": "true",
      }

      # prepare nix-shell
      # the dependencies which are used by the test script
      deps = [
        "gnumake",
        "jq",
        "nix",
        "(import <stockholm>).pkgs.populate",
        "openssh"
      ]
      # TODO: --pure , prepare ENV in nix-shell command:
      #                   SSL_CERT_FILE,LOGNAME,NIX_REMOTE
      nixshell = [
        "nix-shell",
        "-I", "stockholm=.",
        "-I", "nixpkgs=/var/src/nixpkgs",
        "-p"
      ] + deps + [ "--run" ]

      # prepare addShell function
      def addShell(factory,**kwargs):
        factory.addStep(steps.ShellCommand(**kwargs))
    '';
    builder = {
      build-hosts = ''
        f = util.BuildFactory()
        f.addStep(grab_repo)
        for i in [ "test-minimal-deploy", "test-all-krebs-modules", "wolf", "test-centos7" ]:
            addShell(f,name="build-{}".format(i),env=env_shared,
                command=nixshell + \
                    ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
                        make \
                            test \
                            target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
                            method=build \
                            system={}".format(i)
                    ]
            )

        for i in [ "mors", "uriel", "shodan", "helios", "icarus", "cloudkrebs", "echelon", "dishfire", "prism" ]:
            addShell(f,name="build-{}".format(i),env=env_lass,
                command=nixshell + \
                    ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
                        make \
                            test \
                            target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
                            method=build \
                            system={}".format(i)
                    ]
            )

        for i in [ "x", "wry", "vbob", "wbob", "shoney" ]:
            addShell(f,name="build-{}".format(i),env=env_makefu,
                command=nixshell + \
                    ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
                        make \
                            test \
                            target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
                            method=build \
                            system={}".format(i)
                    ]
            )

        for i in [ "hiawatha", "onondaga" ]:
            addShell(f,name="build-{}".format(i),env=env_nin,
                command=nixshell + \
                    ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
                        make \
                            test \
                            target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
                            method=build \
                            system={}".format(i)
                    ]
            )

        bu.append(
            util.BuilderConfig(
                name="build-hosts",
                workernames=workernames,
                factory=f
            )
        )

      '';

      build-pkgs = ''
        f = util.BuildFactory()
        f.addStep(grab_repo)
        for i in [
          "apt-cacher-ng",
          "bepasty-client-cli",
          "cac-api",
          "cac-cert",
          "cac-panel",
          "charybdis",
          "collectd-connect-time",
          "dic",
          "drivedroid-gen-repo",
          "exim",
          "fortclientsslvpn",
          "get",
          "git-hooks",
          "github-hosts-sync",
          "go",
          "hashPassword",
          "haskellPackages.blessings",
          "haskellPackages.email-header",
          "haskellPackages.scanner",
          "haskellPackages.xmonad-stockholm",
          "krebspaste",
          "krebszones",
          "logf",
          "much",
          "newsbot-js",
          "noVNC",
          "passwdqc-utils",
          "populate",
          "posix-array",
          "pssh",
          "push",
          "Reaktor",
          "realwallpaper",
          "repo-sync",
          "retiolum-bootstrap",
          "tarantool",
          "test",
          "tinc_graphs",
          "translate-shell",
          "urlwatch",
          "with-tmpdir",
          "youtube-tools",
        ]:
          addShell(f,name="build-{}".format(i),env=env_lass,
                  command=nixshell + \
                      ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
                        make system=prism pkgs.{}".format(i)])

        bu.append(util.BuilderConfig(name="build-pkgs",
              workernames=workernames,
              factory=f))
            '';
    };
    enable = true;
    web.enable = true;
    irc = {
      enable = true;
      nick = "buildbot-lass";
      server = "ni.r";
      channels = [ { channel = "retiolum"; } { channel = "noise"; } ];
      allowForce = true;
    };
    extraConfig = ''
      c['buildbotURL'] = "http://build.prism.r/"
    '';
  };

  config.krebs.buildbot.worker = {
    enable = true;
    masterhost = "localhost";
    username = "testworker";
    password = "lasspass";
    packages = with pkgs; [ gnumake jq nix populate ];
    extraEnviron = {
      NIX_PATH="/var/src";
    };
  };
  config.krebs.iptables = {
    tables = {
      filter.INPUT.rules = [
        { predicate = "-p tcp --dport 9989"; target = "ACCEPT"; }
      ];
    };
  };

  #ssh workaround for make test
  options.lass.build-ssh-privkey = mkOption {
    type = types.secret-file;
    default = {
      path = "${config.users.users.buildbotworker.home}/ssh.privkey";
      owner = { inherit (config.users.users.buildbotworker ) name uid;};
      source-path = toString <secrets> + "/build.ssh.key";
    };
  };
  config.krebs.secret.files = {
    build-ssh-privkey = config.lass.build-ssh-privkey;
  };
  config.users.users = {
    build = {
      name = "build";
      uid = genid "build";
      home = "/home/build";
      useDefaultShell = true;
      createHome = true;
      openssh.authorizedKeys.keys = [
        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDiV0Xn60aVLHC/jGJknlrcxSvKd/MVeh2tjBpxSBT3II9XQGZhID2Gdh84eAtoWyxGVFQx96zCHSuc7tfE2YP2LhXnwaxHTeDc8nlMsdww53lRkxihZIEV7QHc/3LRcFMkFyxdszeUfhWz8PbJGL2GYT+s6CqoPwwa68zF33U1wrMOAPsf/NdpSN4alsqmjFc2STBjnOd9dXNQn1VEJQqGLG3kR3WkCuwMcTLS5eu0KLwG4i89Twjy+TGp2QsF5K6pNE+ZepwaycRgfYzGcPTn5d6YQXBgcKgHMoSJsK8wqpr0+eFPCDiEA3HDnf76E4mX4t6/9QkMXCLmvs0IO/WP lass@mors"
      ];
    };
  };
}