nixos/modules/services/misc/sourcehut/builds.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   scfg = cfg.builds;
   7   rcfg = config.services.redis;
   8   iniKey = "builds.sr.ht";
   9
  10   drv = pkgs.sourcehut.buildsrht;
  11 in
  12 {
  13   options.services.sourcehut.builds = {
  14     user = mkOption {
  15       type = types.str;
  16       default = "buildsrht";
  17       description = ''
  18         User for builds.sr.ht.
  19       '';
  20     };
  21
  22     port = mkOption {
  23       type = types.port;
  24       default = 5002;
  25       description = ''
  26         Port on which the "builds" module should listen.
  27       '';
  28     };
  29
  30     database = mkOption {
  31       type = types.str;
  32       default = "builds.sr.ht";
  33       description = ''
  34         PostgreSQL database name for builds.sr.ht.
  35       '';
  36     };
  37
  38     statePath = mkOption {
  39       type = types.path;
  40       default = "${cfg.statePath}/buildsrht";
  41       description = ''
  42         State path for builds.sr.ht.
  43       '';
  44     };
  45
  46     enableWorker = mkOption {
  47       type = types.bool;
  48       default = false;
  49       description = ''
  50         Run workers for builds.sr.ht.
  51       '';
  52     };
  53
  54     images = mkOption {
  55       type = types.attrsOf (types.attrsOf (types.attrsOf types.package));
  56       default = { };
  57       example = lib.literalExample ''(let
  58           # Pinning unstable to allow usage with flakes and limit rebuilds.
  59           pkgs_unstable = builtins.fetchGit {
  60               url = "https://github.com/NixOS/nixpkgs";
  61               rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
  62               ref = "nixos-unstable";
  63           };
  64           image_from_nixpkgs = pkgs_unstable: (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
  65             pkgs = (import pkgs_unstable {});
  66           });
  67         in
  68         {
  69           nixos.unstable.x86_64 = image_from_nixpkgs pkgs_unstable;
  70         }
  71       )'';
  72       description = ''
  73         Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2.
  74       '';
  75     };
  76
  77   };
  78
  79   config = with scfg; let
  80     image_dirs = lib.lists.flatten (
  81       lib.attrsets.mapAttrsToList
  82         (distro: revs:
  83           lib.attrsets.mapAttrsToList
  84             (rev: archs:
  85               lib.attrsets.mapAttrsToList
  86                 (arch: image:
  87                   pkgs.runCommandNoCC "buildsrht-images" { } ''
  88                     mkdir -p $out/${distro}/${rev}/${arch}
  89                     ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2
  90                   '')
  91                 archs)
  92             revs)
  93         scfg.images);
  94     image_dir_pre = pkgs.symlinkJoin {
  95       name = "builds.sr.ht-worker-images-pre";
  96       paths = image_dirs ++ [
  97         "${pkgs.sourcehut.buildsrht}/lib/images"
  98       ];
  99     };
 100     image_dir = pkgs.runCommandNoCC "builds.sr.ht-worker-images" { } ''
 101       mkdir -p $out/images
 102       cp -Lr ${image_dir_pre}/* $out/images
 103     '';
 104   in
 105   lib.mkIf (cfg.enable && elem "builds" cfg.services) {
 106     users = {
 107       users = {
 108         "${user}" = {
 109           isSystemUser = true;
 110           group = user;
 111           extraGroups = lib.optionals cfg.builds.enableWorker [ "docker" ];
 112           description = "builds.sr.ht user";
 113         };
 114       };
 115
 116       groups = {
 117         "${user}" = { };
 118       };
 119     };
 120
 121     virtualisation.docker.enable = true;
 122
 123     services.postgresql = {
 124       authentication = ''
 125         local ${database} ${user} trust
 126       '';
 127       ensureDatabases = [ database ];
 128       ensureUsers = [
 129         {
 130           name = user;
 131           ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
 132         }
 133       ];
 134     };
 135
 136     systemd = {
 137       tmpfiles.rules = [
 138         "d ${statePath} 0755 ${user} ${user} -"
 139       ] ++ (lib.optionals cfg.builds.enableWorker
 140         [ "d ${statePath}/logs 0775 ${user} ${user} - -" ]
 141       );
 142
 143       services = {
 144         buildsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey
 145           {
 146             after = [ "postgresql.service" "network.target" ];
 147             requires = [ "postgresql.service" ];
 148             wantedBy = [ "multi-user.target" ];
 149
 150             description = "builds.sr.ht website service";
 151
 152             serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 153
 154             # Hack to bypass this hack: https://git.sr.ht/~sircmpwn/core.sr.ht/tree/master/item/srht-update-profiles#L6
 155           } // { preStart = " "; };
 156
 157         buildsrht-worker = {
 158           enable = scfg.enableWorker;
 159           after = [ "postgresql.service" "network.target" ];
 160           requires = [ "postgresql.service" ];
 161           wantedBy = [ "multi-user.target" ];
 162           partOf = [ "buildsrht.service" ];
 163           description = "builds.sr.ht worker service";
 164           path = [ pkgs.openssh pkgs.docker ];
 165           preStart = let qemuPackage = pkgs.qemu_kvm;
 166           in ''
 167             if [[ "$(docker images -q qemu:latest 2> /dev/null)" == "" || "$(cat ${statePath}/docker-image-qemu 2> /dev/null || true)" != "${qemuPackage.version}" ]]; then
 168               # Create and import qemu:latest image for docker
 169               ${
 170                 pkgs.dockerTools.streamLayeredImage {
 171                   name = "qemu";
 172                   tag = "latest";
 173                   contents = [ qemuPackage ];
 174                 }
 175               } | docker load
 176               # Mark down current package version
 177               printf "%s" "${qemuPackage.version}" > ${statePath}/docker-image-qemu
 178             fi
 179           '';
 180           serviceConfig = {
 181             Type = "simple";
 182             User = user;
 183             Group = "nginx";
 184             Restart = "always";
 185           };
 186           serviceConfig.ExecStart = "${pkgs.sourcehut.buildsrht}/bin/builds.sr.ht-worker";
 187         };
 188       };
 189     };
 190
 191     services.sourcehut.settings = {
 192       # URL builds.sr.ht is being served at (protocol://domain)
 193       "builds.sr.ht".origin = mkDefault "http://builds.${cfg.originBase}";
 194       # Address and port to bind the debug server to
 195       "builds.sr.ht".debug-host = mkDefault "0.0.0.0";
 196       "builds.sr.ht".debug-port = mkDefault port;
 197       # Configures the SQLAlchemy connection string for the database.
 198       "builds.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
 199       # builds.sr.ht's OAuth client ID and secret for meta.sr.ht
 200       # Register your client at meta.example.org/oauth
 201       "builds.sr.ht".oauth-client-id = mkDefault null;
 202       "builds.sr.ht".oauth-client-secret = mkDefault null;
 203       # The redis connection used for the celery worker
 204       "builds.sr.ht".redis = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/3";
 205       # The shell used for ssh
 206       "builds.sr.ht".shell = mkDefault "runner-shell";
 207       # Register the builds.sr.ht dispatcher
 208       "git.sr.ht::dispatch".${builtins.unsafeDiscardStringContext "${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys"} = mkDefault "${user}:${user}";
 209
 210       # Location for build logs, images, and control command
 211     } // lib.attrsets.optionalAttrs scfg.enableWorker {
 212       # Default worker stores logs that are accessible via this address:port
 213       "builds.sr.ht::worker".name = mkDefault "127.0.0.1:5020";
 214       "builds.sr.ht::worker".buildlogs = mkDefault "${scfg.statePath}/logs";
 215       "builds.sr.ht::worker".images = mkDefault "${image_dir}/images";
 216       "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control";
 217       "builds.sr.ht::worker".timeout = mkDefault "3m";
 218     };
 219
 220     services.nginx.virtualHosts."logs.${cfg.originBase}" =
 221       if scfg.enableWorker then {
 222         listen = with builtins; let address = split ":" cfg.settings."builds.sr.ht::worker".name;
 223         in [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }];
 224         locations."/logs".root = "${scfg.statePath}";
 225       } else { };
 226
 227     services.nginx.virtualHosts."builds.${cfg.originBase}" = {
 228       forceSSL = true;
 229       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 230       locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
 231       locations."/static".root = "${pkgs.sourcehut.buildsrht}/${pkgs.sourcehut.python.sitePackages}/buildsrht";
 232     };
 233   };
 234 }