✨ add drone-ci

Closes #8

hosts/plato/configuration.nix

@@ -6,6 +6,8 @@
 
     ../../modules/coredns
     ../../modules/code-server
+    ../../modules/drone
+    ../../modules/drone/runner-docker.nix
     ../../modules/gitea
     ../../modules/home-assistant
     ../../modules/matrix

hosts/socrates/configuration.nix

@@ -6,6 +6,7 @@
 
     ../../modules/coredns
     ../../modules/code-server/nginx.nix
+    ../../modules/drone/nginx.nix
     ../../modules/gitea/nginx.nix
     ../../modules/home-assistant/nginx.nix
     ../../modules/ipfs/gateway.nix

modules/drone/default.nix

@@ -0,0 +1,48 @@
+{ pkgs, config, ... }: {
+  sops.secrets.drone = {
+    owner = "drone";
+  };
+
+  services = {
+    postgresql = {
+      ensureDatabases = [ "drone" ];
+      ensureUsers = [
+        {
+          name = "drone";
+          ensurePermissions = {
+            "DATABASE drone" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+    postgresqlBackup.databases = [ "drone" ];
+  };
+
+  systemd.services.drone = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      Environment = [
+        "DRONE_GITEA_SERVER=https://walkah.dev"
+        "DRONE_DATABASE_DATASOURCE=postgres:///drone?host=/run/postgresql"
+        "DRONE_DATABASE_DRIVER=postgres"
+        "DRONE_SERVER_HOST=https://drone.walkah.dev"
+        "DRONE_SERVER_PORT=:3030"
+        "DRONE_SERVER_PROTO=https"
+        "DRONE_USER_CREATE=username:walkah,admin:true"
+      ];
+      ExecStart = "${pkgs.drone}/bin/drone-server";
+      User = "drone";
+      Group = "drone";
+    };
+  };
+
+  users.users.drone = {
+    isSystemUser = true;
+    createHome = true;
+    group = "drone";
+  };
+  users.groups.drone = { };
+}

modules/drone/nginx.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "drone.walkah.dev" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.111.208.75:3030";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+}

modules/drone/runner-docker.nix

@@ -0,0 +1,22 @@
+{ pkgs, config, lib, ... }: {
+  systemd.services.drone-runner-docker = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Environment = [
+      ];
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      ExecStart = "${pkgs.drone-runner-docker}/bin/drone-runner-docker";
+      User = "drone-runner-docker";
+      Group = "drone-runner-docker";
+    };
+  };
+
+  users.users.drone-runner-docker = {
+    isSystemUser = true;
+    group = "drone-runner-docker";
+    extraGroups = [ "docker" ];
+  };
+  users.groups.drone-runner-docker = { };
+}

modules/drone/runner-exec.nix

@@ -0,0 +1,68 @@
+{ pkgs, config, lib, ... }:
+let
+  droneserver = config.users.users.droneserver.name;
+in
+{
+  nix.settings.allowed-users = [ "drone-runner-exec" ];
+  systemd.services.drone-runner-exec = {
+    wantedBy = [ "multi-user.target" ];
+    # might break deployment
+    restartIfChanged = false;
+    confinement.enable = true;
+    confinement.packages = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nix
+      pkgs.gzip
+    ];
+    path = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nix
+      pkgs.gzip
+    ];
+    serviceConfig = {
+      Environment = [
+        "DRONE_RUNNER_CAPACITY=10"
+        "CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
+        "NIX_REMOTE=daemon"
+        "PAGER=cat"
+      ];
+      BindPaths = [
+        "/nix/var/nix/daemon-socket/socket"
+        "/run/nscd/socket"
+        "/var/lib/drone"
+      ];
+      BindReadOnlyPaths = [
+        "/etc/passwd:/etc/passwd"
+        "/etc/group:/etc/group"
+        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
+        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${
+          builtins.toFile "ssh_config" ''
+            Host eve.thalheim.io
+              ForwardAgent yes
+          ''
+        }:/etc/ssh/ssh_config"
+        "/etc/machine-id"
+        # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing
+        "/nix/"
+      ];
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec";
+      User = "drone-runner-exec";
+      Group = "drone-runner-exec";
+    };
+  };
+
+  users.users.drone-runner-exec = {
+    isSystemUser = true;
+    group = "drone-runner-exec";
+  };
+  users.groups.drone-runner-exec = { };
+}

secrets/secrets.yaml

@@ -1,5 +1,6 @@
 matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
 ipfs-cluster-secret: ENC[AES256_GCM,data:Z9i7ZLhlXw4m8myNUSiY5ej2/6UIwCwIe0bvbCttVLdv8cAHwzR2f22poKD6KnPBe9yaym+X3YtrHTCM4pVIbiSzMsHwYZ00vRQi35ZmYg==,iv:9PBz/olzA4X7JEL1xG8ACUaH1WDHSzApzlG5q0ZqSYk=,tag:9I4PGf91MHAKNeG4fVKIow==,type:str]
+drone: ENC[AES256_GCM,data:UKh2qyZq5eTiEpdbGve+fCQZzSx/j+wUv9eHT/ToU9b51rwA7XJQC4g3rvljBL9X7DFVVdsWOdG6y1eRGImdelJ5hwxa8oK5CBpaGLGjd9+Hm8SS+Q+PAFDW6fdsPtDDgK5jjykcIlJ7u9mjCffFsCGw3UWfHxnniCnIba9e499XU+VR6l96U3oGOsrr0XO/d2zwrOm3mvXQL1P3cE+se4/UDKrdABGfKWyGqZ9xgi6Q7PTSmRv4AtpwpgF1URBvPVqs6yoexWetksLv+Xk5H50EeucbMOA+oUSJ06fUMECFRF9thRrdUbtK,iv:CiZz6NSksNMGmZxWS7uE69O6UnvTkRWbeBwC1bUqR9o=,tag:qcLmseQgkjMVv2uNXPFHzw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -60,8 +61,8 @@ sops:
             alB4LzZGSTJmUEt0TFBkUTdzR1pOOTQKG8T65JhLKx602YnEmG/Gqi/rY8X/9XgF
             61ejhZ1DucTrM3sfUKjTFwaNVJLJgGEoPRioZW0SJkckjm5NNlutLw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-11-16T01:39:44Z"
+    lastmodified: "2022-06-30T20:47:05Z"
-    mac: ENC[AES256_GCM,data:fDm9ReOiKh0QpKXxL+1BBj8Ewa0rGNeeacRr2L2IWeb51i6KhE+9q/9s6/x3m1z9NcR3BFrdw/yhOakYjcfrMiBtgZMwkJ+17KieKrgPz95lKD/udZeiemlimUQZn6E2HuTj8lGRw1mJLGdlSgZrAtTKYzuUezcvqtX/zmMahmw=,iv:ju81TbXRZRhGI6oGn2NSpXCMnK7PtcaHH8RmDAOjP8k=,tag:z8pt/6a1WXVOB3hndZPGJw==,type:str]
+    mac: ENC[AES256_GCM,data:S/DfCcsk7oURR8zHW5jkLsDExNBl8G4gPJ5CQzS1R6i38ncEP7yT0pMiwizvZEVHHLP8lxTqsnyquEWhQfcKxojOysgiuGOl/SiiuXGBA91vWzURNN1ricJ+g5SXp593+0cMnkpC8ej6Bkja/QX/DORn74BF+dKLFT3InRi0ucI=,iv:btU0YLRTSnqlOIFzlI0Xbd6IX0noOo0ORqG7+nd8qHs=,tag:JUEWkaaFt0lm5YyW73q7ug==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.1
+    version: 3.7.3