nixos/woodpecker: refactor to multi-agents setup
The module file has been renamed from `agent.nix` to `agents.nix` to mirror the change.
This commit is contained in:
Bruno BELANYI
parent
658070e636
commit
e4f5f1b718
4 changed files with 133 additions and 101 deletions
|
|
@ -71,7 +71,7 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
|
||||
- [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm.
|
||||
|
||||
- [woodpecker-agent](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agent](#opt-services.woodpecker-agent.enable).
|
||||
- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.enable).
|
||||
|
||||
- [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).
|
||||
|
||||
|
|
|
|||
|
|
@ -377,7 +377,7 @@
|
|||
./services/continuous-integration/jenkins/default.nix
|
||||
./services/continuous-integration/jenkins/job-builder.nix
|
||||
./services/continuous-integration/jenkins/slave.nix
|
||||
./services/continuous-integration/woodpecker/agent.nix
|
||||
./services/continuous-integration/woodpecker/agents.nix
|
||||
./services/continuous-integration/woodpecker/server.nix
|
||||
./services/databases/aerospike.nix
|
||||
./services/databases/cassandra.nix
|
||||
|
|
|
|||
|
|
@ -1,99 +0,0 @@
|
|||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, ...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.services.woodpecker-agent;
|
||||
in
|
||||
{
|
||||
meta.maintainers = [ lib.maintainers.janik ];
|
||||
|
||||
options = {
|
||||
services.woodpecker-agent = {
|
||||
enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent");
|
||||
package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { };
|
||||
|
||||
environment = lib.mkOption {
|
||||
default = { };
|
||||
type = lib.types.attrsOf lib.types.str;
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
WOODPECKER_SERVER = "localhost:9000";
|
||||
WOODPECKER_BACKEND = "docker";
|
||||
DOCKER_HOST = "unix:///run/podman/podman.sock";
|
||||
}
|
||||
'';
|
||||
description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
|
||||
};
|
||||
|
||||
extraGroups = lib.mkOption {
|
||||
default = null;
|
||||
type = lib.types.nullOr (lib.types.listOf lib.types.str);
|
||||
example = [ "podman" ];
|
||||
description = lib.mdDoc ''
|
||||
Additional groups for the systemd service.
|
||||
'';
|
||||
};
|
||||
|
||||
environmentFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
example = "/root/woodpecker-agent.env";
|
||||
description = lib.mdDoc ''
|
||||
File to load environment variables
|
||||
from. This is helpful for specifying secrets.
|
||||
Example content of environmentFile:
|
||||
```
|
||||
WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here
|
||||
```
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services = {
|
||||
woodpecker-agent = {
|
||||
description = "Woodpecker-Agent Service";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
SupplementaryGroups = lib.optionals (cfg.extraGroups != null) cfg.extraGroups;
|
||||
EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
|
||||
ExecStart = "${cfg.package}/bin/woodpecker-agent";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 15;
|
||||
CapabilityBoundingSet = "";
|
||||
# Security
|
||||
NoNewPrivileges = true;
|
||||
# Sandboxing
|
||||
ProtectSystem = "strict";
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProtectHostname = true;
|
||||
ProtectClock = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
PrivateMounts = true;
|
||||
# System Call Filtering
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
||||
};
|
||||
inherit (cfg) environment;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, ...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.services.woodpecker-agents;
|
||||
|
||||
agentModule = lib.types.submodule {
|
||||
options = {
|
||||
package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { };
|
||||
|
||||
environment = lib.mkOption {
|
||||
default = { };
|
||||
type = lib.types.attrsOf lib.types.str;
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
WOODPECKER_SERVER = "localhost:9000";
|
||||
WOODPECKER_BACKEND = "docker";
|
||||
DOCKER_HOST = "unix:///run/podman/podman.sock";
|
||||
}
|
||||
'';
|
||||
description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
|
||||
};
|
||||
|
||||
extraGroups = lib.mkOption {
|
||||
default = null;
|
||||
type = lib.types.nullOr (lib.types.listOf lib.types.str);
|
||||
example = [ "podman" ];
|
||||
description = lib.mdDoc ''
|
||||
Additional groups for the systemd service.
|
||||
'';
|
||||
};
|
||||
|
||||
environmentFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
example = "/var/secrets/woodpecker-agent.env";
|
||||
description = lib.mdDoc ''
|
||||
File to load environment variables
|
||||
from. This is helpful for specifying secrets.
|
||||
Example content of environmentFile:
|
||||
```
|
||||
WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here
|
||||
```
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
mkAgentService = name: agentCfg: {
|
||||
name = "woodpecker-agent-${name}";
|
||||
value = {
|
||||
description = "Woodpecker-Agent Service - ${name}";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
SupplementaryGroups = lib.optionals (agentCfg.extraGroups != null) agentCfg.extraGroups;
|
||||
EnvironmentFile = lib.optional (agentCfg.environmentFile != null) agentCfg.environmentFile;
|
||||
ExecStart = lib.getExe agentCfg.package;
|
||||
Restart = "on-failure";
|
||||
RestartSec = 15;
|
||||
CapabilityBoundingSet = "";
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProtectHostname = true;
|
||||
ProtectClock = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
PrivateMounts = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
||||
};
|
||||
inherit (agentCfg) environment;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
meta.maintainers = [ lib.maintainers.janik ];
|
||||
|
||||
options = {
|
||||
services.woodpecker-agents = {
|
||||
enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent");
|
||||
|
||||
agents = lib.mkOption {
|
||||
default = { };
|
||||
type = lib.types.attrsOf agentModule;
|
||||
example = {
|
||||
docker = {
|
||||
environment = {
|
||||
WOODPECKER_SERVER = "localhost:9000";
|
||||
WOODPECKER_BACKEND = "docker";
|
||||
DOCKER_HOST = "unix:///run/podman/podman.sock";
|
||||
};
|
||||
|
||||
extraGroups = [ "docker" ];
|
||||
|
||||
environmentFile = "/run/secrets/woodpecker/agent-secret.txt";
|
||||
};
|
||||
|
||||
exec = {
|
||||
environment = {
|
||||
WOODPECKER_SERVER = "localhost:9000";
|
||||
WOODPECKER_BACKEND = "exec";
|
||||
};
|
||||
|
||||
environmentFile = "/run/secrets/woodpecker/agent-secret.txt";
|
||||
};
|
||||
};
|
||||
description = lib.mdDoc "woodpecker-agents configurations";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services = lib.mapAttrs' mkAgentService cfg.agents;
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue