xin/configs/ci.nix

120 lines
2.9 KiB
Nix
Raw Normal View History

2023-07-11 09:12:50 -06:00
{
config,
lib,
pkgs,
inputs,
xinlib,
...
}: let
inherit (xinlib) prIsOpen;
jobs = [
{
name = "xin-ci-update";
2023-03-03 07:06:30 -07:00
user = "qbit";
2023-02-10 05:19:13 -07:00
script = "cd ~/src/xin && ./bin/ci update";
2023-02-04 09:12:08 -07:00
startAt = "23:00";
2023-07-11 09:12:50 -06:00
path = [];
}
{
name = "xin-ci";
2023-03-03 07:06:30 -07:00
user = "qbit";
2023-02-10 05:19:13 -07:00
script = "cd ~/src/xin && ./bin/ci";
2023-02-04 07:12:41 -07:00
startAt = "*:30:00";
2023-07-11 09:12:50 -06:00
path = [];
}
];
2023-07-11 09:12:50 -06:00
in
with lib; {
options = {
xinCI = {
enable = mkEnableOption "Configure host as a xin CI host.";
2023-07-11 09:12:50 -06:00
user = mkOption {
type = types.str;
default = "root";
description = ''
User who will own the CI private key.
'';
};
2023-01-31 12:55:00 -07:00
};
};
2023-07-11 09:12:50 -06:00
imports = [../modules/ts-rev-prox.nix];
config = mkIf config.xinCI.enable {
sops.defaultSopsFile = config.xin-secrets.ci;
sops.secrets = {
po_env = {owner = config.xinCI.user;};
ci_ed25519_key = {
mode = "400";
owner = config.xinCI.user;
};
ci_ed25519_pub = {
mode = "444";
owner = config.xinCI.user;
};
ci_signing_ed25519_key = {
mode = "400";
owner = config.xinCI.user;
};
ci_signing_ed25519_pub = {
mode = "444";
owner = config.xinCI.user;
};
bin_cache_priv_key = {
mode = "400";
owner = "root";
group = "wheel";
};
bin_cache_pub_key = {
mode = "444";
owner = "root";
group = "wheel";
};
ts_proxy_env = {
mode = "400";
owner = config.services.tsrevprox.user;
};
2023-01-31 12:55:00 -07:00
};
2023-07-11 09:12:50 -06:00
environment.systemPackages = with pkgs; [
inputs.po.packages.${pkgs.system}.po
keychain
];
2023-07-11 09:12:50 -06:00
nix = {
#settings.allowed-users = [ "root" config.xinCI.user "nix-serve" ];
settings.allowed-users = ["root" config.xinCI.user "harmonia"];
};
2023-07-11 09:12:50 -06:00
systemd.services = lib.listToAttrs (builtins.map xinlib.jobToService jobs);
2023-07-11 09:12:50 -06:00
services.cron = prIsOpen.option 238971 {
2023-01-31 12:55:00 -07:00
enable = true;
2023-07-11 09:12:50 -06:00
systemCronJobs = [
"0 0 * * * systemctl start xin-ci-update"
"30 * * * * systemctl start xin-ci"
];
2023-01-31 12:55:00 -07:00
};
2023-07-11 09:12:50 -06:00
services = {
tsrevprox = {
enable = true;
reverseName = "nix-binary-cache";
envFile = config.sops.secrets.ts_proxy_env.path;
};
harmonia = {
enable = true;
signKeyPath = config.sops.secrets.bin_cache_priv_key.path;
settings = {bind = "127.0.0.1:5000";};
};
#nix-serve = {
# package = pkgs.nix-serve-ng;
# enable = true;
# secretKeyFile = config.sops.secrets.bin_cache_priv_key.path;
# bindAddress = "127.0.0.1";
#};
2023-01-31 12:55:00 -07:00
};
2023-07-24 10:43:26 -06:00
boot.binfmt.emulatedSystems = ["aarch64-linux" "armv6l-linux"];
2023-07-11 09:12:50 -06:00
};
}