improve master module

buildbot_nix/master.py

@@ -33,6 +33,7 @@ def read_secret_file(secret_name: str) -> str:
 
 GITHUB_OAUTH_ID = os.environ.get("GITHUB_OAUTH_ID")
 GITHUB_OAUTH_SECRET = read_secret_file("github-oauth-secret")
+GITHUB_ADMINS = os.environ.get("GITHUB_ADMINS", "").split(" ")
 GITHUB_TOKEN_SECRET_NAME = "github-token"
 GITHUB_TOKEN = read_secret_file(GITHUB_TOKEN_SECRET_NAME)
 GITHUB_WEBHOOK_SECRET = read_secret_file("github-webhook-secret")
@@ -199,15 +200,13 @@ def build_config() -> dict[str, Any]:
     systemd_secrets = secrets.SecretInAFile(dirname=credentials)
     c["secretsProviders"] = [systemd_secrets]
 
-    github_admins = os.environ.get("GITHUB_ADMINS", "").split(",")
-
     c["www"] = {
         "avatar_methods": [util.AvatarGitHub()],
         "port": int(os.environ.get("PORT", "1810")),
         "auth": util.GitHubAuth(GITHUB_OAUTH_ID, GITHUB_OAUTH_SECRET),
         "authz": util.Authz(
             roleMatchers=[
-                util.RolesFromUsername(roles=["admin"], usernames=github_admins)
+                util.RolesFromUsername(roles=["admin"], usernames=GITHUB_ADMINS)
             ],
             allowRules=[
                 util.AnyEndpointMatcher(role="admin", defaultDeny=False),

nix/master.nix

@@ -1,22 +1,84 @@
 { config
 , pkgs
+, lib
 , ...
 }:
 let
+  cfg = config.services.buildbot-nix.master;
+in
+{
+  options = {
+    services.buildbot-nix.master = {
+      port = lib.mkOption {
+        type = lib.types.int;
+        default = 1810;
+        description = "Port on which buildbot-master is listening";
+      };
+      dbUrl = lib.mkOption {
+        type = lib.types.str;
+        default = "postgresql://@/buildbot";
+        description = "Postgresql database url";
+      };
+      github = {
+        tokenFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Github token file";
+        };
+        webhookSecretFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Github webhook secret file";
+        };
+        oauthSecretFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Github oauth secret file";
+        };
         # TODO: make this an option
         # https://github.com/organizations/numtide/settings/applications
         # Application name: BuildBot
         # Homepage URL: https://buildbot.numtide.com
         # Authorization callback URL: https://buildbot.numtide.com/auth/login
         # oauth_token:  2516248ec6289e4d9818122cce0cbde39e4b788d
-  buildbotDomain = "buildbot.thalheim.io";
+        oauthId = lib.mkOption {
-  githubOauthId = "d1b24258af1abc157934";
+          type = lib.types.str;
-in
+          description = "Github oauth id. Used for the login button";
-{
+        };
+        # Most likely you want to use the same user as for the buildbot
+        githubUser = lib.mkOption {
+          type = lib.types.str;
+          description = "Github user that is used for the buildbot";
+        };
+        githubAdmins = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "Users that are allowed to login to buildbot and do stuff";
+        };
+      };
+      workersFile = lib.mkOption {
+        type = lib.types.path;
+        description = "File containing a list of nix workers";
+      };
+      buildSystems = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "Systems that we will be build";
+      };
+      evalMaxMemorySize = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Maximum memory size for nix-eval-jobs (in MiB) per
+          worker. After the limit is reached, the worker is
+          restarted.
+        '';
+      };
+      url = lib.mkOption {
+        type = lib.types.str;
+        description = "Buildbot url";
+      };
+    };
+  };
+  config = {
     services.buildbot-master = {
       enable = true;
-    masterCfg = "${./.}/master.py";
+      masterCfg = "${../buildbot_nix/master.py}";
-    dbUrl = "postgresql://@/buildbot";
+      dbUrl = config.services.buildbot-nix.master.dbUrl;
       pythonPackages = ps: [
         ps.requests
         ps.treq
@@ -29,37 +91,25 @@ in
 
     systemd.services.buildbot-master = {
       environment = {
-      PORT = "1810";
+        PORT = builtins.toString cfg.port;
-      DB_URL = config.services.buildbot-master.dbUrl;
+        DB_URL = cfg.dbUrl;
-      # Github app used for the login button
+        GITHUB_OAUTH_ID = cfg.github.oauthId;
-      GITHUB_OAUTH_ID = githubOauthId;
+        BUILDBOT_URL = cfg.url;
-
+        BUILDBOT_GITHUB_USER = cfg.github.githubUser;
-      # XXX replace this with renovate
+        GITHUB_ADMINS = builtins.toString cfg.github.githubAdmins;
-      REPO_FOR_FLAKE_UPDATE = "Mic92/dotfiles/main";
+        NIX_SUPPORTED_SYSTEMS = builtins.toString cfg.buildSystems;
-
+        NIX_EVAL_MAX_MEMORY_SIZE = builtins.toString cfg.evalMaxMemorySize;
-      BUILDBOT_URL = "https://${buildbotDomain}/";
-      BUILDBOT_GITHUB_USER = "mic92-buildbot";
-      # comma seperated list of users that are allowed to login to buildbot and do stuff
-      GITHUB_ADMINS = "Mic92";
-      NIX_SUPPORTED_SYSTEMS = builtins.toString [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
-      NIX_EVAL_MAX_MEMORY_SIZE = "2048";
       };
       serviceConfig = {
         # in master.py we read secrets from $CREDENTIALS_DIRECTORY
         LoadCredential = [
-        "github-token:${config.sops.secrets.buildbot-github-token.path}"
+          "github-token:${cfg.github.tokenFile}"
-        "github-webhook-secret:${config.sops.secrets.buildbot-github-webhook-secret.path}"
+          "github-webhook-secret:${cfg.github.webhookSecretFile}"
-        "github-oauth-secret:${config.sops.secrets.buildbot-github-oauth-secret.path}"
+          "github-oauth-secret:${cfg.github.oauthSecretFile}"
-        "buildbot-nix-workers:${config.sops.secrets.buildbot-nix-workers.path}"
+          "buildbot-nix-workers:${cfg.workersFile}"
         ];
       };
     };
-  sops.secrets = {
-    buildbot-github-token = { };
-    buildbot-github-webhook-secret = { };
-    buildbot-github-oauth-secret = { };
-    buildbot-nix-workers = { };
-  };
 
     services.postgresql = {
       ensureDatabases = [ "buildbot" ];
@@ -71,17 +121,15 @@ in
       ];
     };
 
-  services.nginx.virtualHosts.${buildbotDomain} = {
+    services.nginx.virtualHosts.${cfg.url} = {
-    forceSSL = true;
+      locations."/".proxyPass = "http://127.0.0.1:${cfg.port}/";
-    useACMEHost = "thalheim.io";
-    locations."/".proxyPass = "http://127.0.0.1:1810/";
       locations."/sse" = {
-      proxyPass = "http://127.0.0.1:1810/sse/";
+        proxyPass = "http://127.0.0.1:${cfg.port}/sse";
         # proxy buffering will prevent sse to work
         extraConfig = "proxy_buffering off;";
       };
       locations."/ws" = {
-      proxyPass = "http://127.0.0.1:1810/ws";
+        proxyPass = "http://127.0.0.1:${cfg.port}/ws";
         proxyWebsockets = true;
         # raise the proxy timeout for the websocket
         extraConfig = "proxy_read_timeout 6000s;";
@@ -95,4 +143,5 @@ in
     systemd.tmpfiles.rules = [
       "d /var/www/buildbot/nix-outputs 0755 buildbot buildbot - -"
     ];
+  };
 }