walkah/athens
1
0
Fork 0
Code Issues 9 Pull Requests Projects Releases Wiki Activity

✨ add drone-ci

Browse Source 
Closes #8
This commit is contained in:
James Walker 2022-06-30 17:43:11 -04:00
parent 56dd538a97
commit be946e58bd
Signed by: walkah
GPG Key ID: 3C127179D6086E93
7 changed files with 162 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hosts/plato/configuration.nix
View File

@ -6,6 +6,8 @@
../../modules/coredns
../../modules/code-server
../../modules/drone
../../modules/drone/runner-docker.nix
../../modules/gitea
../../modules/home-assistant
../../modules/matrix

1
hosts/socrates/configuration.nix
View File

@ -6,6 +6,7 @@
../../modules/coredns
../../modules/code-server/nginx.nix
../../modules/drone/nginx.nix
../../modules/gitea/nginx.nix
../../modules/home-assistant/nginx.nix
../../modules/ipfs/gateway.nix

48
modules/drone/default.nix Normal file
View File

@ -0,0 +1,48 @@
{ pkgs, config, ... }: {
sops.secrets.drone = {
owner = "drone";
};
services = {
postgresql = {
ensureDatabases = [ "drone" ];
ensureUsers = [
{
name = "drone";
ensurePermissions = {
"DATABASE drone" = "ALL PRIVILEGES";
};
}
];
};
postgresqlBackup.databases = [ "drone" ];
};
systemd.services.drone = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
EnvironmentFile = [
config.sops.secrets.drone.path
];
Environment = [
"DRONE_GITEA_SERVER=https://walkah.dev"
"DRONE_DATABASE_DATASOURCE=postgres:///drone?host=/run/postgresql"
"DRONE_DATABASE_DRIVER=postgres"
"DRONE_SERVER_HOST=https://drone.walkah.dev"
"DRONE_SERVER_PORT=:3030"
"DRONE_SERVER_PROTO=https"
"DRONE_USER_CREATE=username:walkah,admin:true"
];
ExecStart = "${pkgs.drone}/bin/drone-server";
User = "drone";
Group = "drone";
};
};
users.users.drone = {
isSystemUser = true;
createHome = true;
group = "drone";
};
users.groups.drone = { };
}

17
modules/drone/nginx.nix Normal file
View File

@ -0,0 +1,17 @@
{ config, lib, pkgs, ... }:
{
services.nginx = {
enable = true;
virtualHosts = {
"drone.walkah.dev" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://100.111.208.75:3030";
proxyWebsockets = true;
};
};
};
};
}

22
modules/drone/runner-docker.nix Normal file
View File

@ -0,0 +1,22 @@
{ pkgs, config, lib, ... }: {
systemd.services.drone-runner-docker = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Environment = [
];
EnvironmentFile = [
config.sops.secrets.drone.path
];
ExecStart = "${pkgs.drone-runner-docker}/bin/drone-runner-docker";
User = "drone-runner-docker";
Group = "drone-runner-docker";
};
};
users.users.drone-runner-docker = {
isSystemUser = true;
group = "drone-runner-docker";
extraGroups = [ "docker" ];
};
users.groups.drone-runner-docker = { };
}

68
modules/drone/runner-exec.nix Normal file
View File

@ -0,0 +1,68 @@
{ pkgs, config, lib, ... }:
let
droneserver = config.users.users.droneserver.name;
in
{
nix.settings.allowed-users = [ "drone-runner-exec" ];
systemd.services.drone-runner-exec = {
wantedBy = [ "multi-user.target" ];
# might break deployment
restartIfChanged = false;
confinement.enable = true;
confinement.packages = [
pkgs.git
pkgs.gnutar
pkgs.bash
pkgs.nix
pkgs.gzip
];
path = [
pkgs.git
pkgs.gnutar
pkgs.bash
pkgs.nix
pkgs.gzip
];
serviceConfig = {
Environment = [
"DRONE_RUNNER_CAPACITY=10"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
"NIX_REMOTE=daemon"
"PAGER=cat"
];
BindPaths = [
"/nix/var/nix/daemon-socket/socket"
"/run/nscd/socket"
"/var/lib/drone"
];
BindReadOnlyPaths = [
"/etc/passwd:/etc/passwd"
"/etc/group:/etc/group"
"/nix/var/nix/profiles/system/etc/nix:/etc/nix"
"${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
"${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
"${
builtins.toFile "ssh_config" ''
Host eve.thalheim.io
ForwardAgent yes
''
}:/etc/ssh/ssh_config"
"/etc/machine-id"
# channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing
"/nix/"
];
EnvironmentFile = [
config.sops.secrets.drone.path
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec";
User = "drone-runner-exec";
Group = "drone-runner-exec";
};
};
users.users.drone-runner-exec = {
isSystemUser = true;
group = "drone-runner-exec";
};
users.groups.drone-runner-exec = { };
}

7
secrets/secrets.yaml
View File

@ -1,5 +1,6 @@
matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
ipfs-cluster-secret: ENC[AES256_GCM,data:Z9i7ZLhlXw4m8myNUSiY5ej2/6UIwCwIe0bvbCttVLdv8cAHwzR2f22poKD6KnPBe9yaym+X3YtrHTCM4pVIbiSzMsHwYZ00vRQi35ZmYg==,iv:9PBz/olzA4X7JEL1xG8ACUaH1WDHSzApzlG5q0ZqSYk=,tag:9I4PGf91MHAKNeG4fVKIow==,type:str]
drone: ENC[AES256_GCM,data:UKh2qyZq5eTiEpdbGve+fCQZzSx/j+wUv9eHT/ToU9b51rwA7XJQC4g3rvljBL9X7DFVVdsWOdG6y1eRGImdelJ5hwxa8oK5CBpaGLGjd9+Hm8SS+Q+PAFDW6fdsPtDDgK5jjykcIlJ7u9mjCffFsCGw3UWfHxnniCnIba9e499XU+VR6l96U3oGOsrr0XO/d2zwrOm3mvXQL1P3cE+se4/UDKrdABGfKWyGqZ9xgi6Q7PTSmRv4AtpwpgF1URBvPVqs6yoexWetksLv+Xk5H50EeucbMOA+oUSJ06fUMECFRF9thRrdUbtK,iv:CiZz6NSksNMGmZxWS7uE69O6UnvTkRWbeBwC1bUqR9o=,tag:qcLmseQgkjMVv2uNXPFHzw==,type:str]
sops:
kms: []
gcp_kms: []
@ -60,8 +61,8 @@ sops:
alB4LzZGSTJmUEt0TFBkUTdzR1pOOTQKG8T65JhLKx602YnEmG/Gqi/rY8X/9XgF
61ejhZ1DucTrM3sfUKjTFwaNVJLJgGEoPRioZW0SJkckjm5NNlutLw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2021-11-16T01:39:44Z"
mac: ENC[AES256_GCM,data:fDm9ReOiKh0QpKXxL+1BBj8Ewa0rGNeeacRr2L2IWeb51i6KhE+9q/9s6/x3m1z9NcR3BFrdw/yhOakYjcfrMiBtgZMwkJ+17KieKrgPz95lKD/udZeiemlimUQZn6E2HuTj8lGRw1mJLGdlSgZrAtTKYzuUezcvqtX/zmMahmw=,iv:ju81TbXRZRhGI6oGn2NSpXCMnK7PtcaHH8RmDAOjP8k=,tag:z8pt/6a1WXVOB3hndZPGJw==,type:str]
lastmodified: "2022-06-30T20:47:05Z"
mac: ENC[AES256_GCM,data:S/DfCcsk7oURR8zHW5jkLsDExNBl8G4gPJ5CQzS1R6i38ncEP7yT0pMiwizvZEVHHLP8lxTqsnyquEWhQfcKxojOysgiuGOl/SiiuXGBA91vWzURNN1ricJ+g5SXp593+0cMnkpC8ej6Bkja/QX/DORn74BF+dKLFT3InRi0ucI=,iv:btU0YLRTSnqlOIFzlI0Xbd6IX0noOo0ORqG7+nd8qHs=,tag:JUEWkaaFt0lm5YyW73q7ug==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.1
version: 3.7.3