pyrox.dev
1import ./make-test-python.nix ({ pkgs, lib, ... }:
2let
3 domain = "sourcehut.localdomain";
4
5 # Note that wildcard certificates just under the TLD (eg. *.com)
6 # would be rejected by clients like curl.
7 tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
8 openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
9 -subj '/CN=${domain}' -extensions v3_req \
10 -addext 'subjectAltName = DNS:*.${domain}'
11 install -D -t $out key.pem cert.pem
12 '';
13
14 images = {
15 nixos.unstable.x86_64 =
16 let
17 systemConfig = { pkgs, ... }: {
18 # passwordless ssh server
19 services.openssh = {
20 enable = true;
21 settings = {
22 PermitRootLogin = "yes";
23 PermitEmptyPasswords = true;
24 };
25 };
26
27 users = {
28 mutableUsers = false;
29 # build user
30 extraUsers."build" = {
31 isNormalUser = true;
32 uid = 1000;
33 extraGroups = [ "wheel" ];
34 password = "";
35 };
36 users.root.password = "";
37 };
38
39 security.sudo.wheelNeedsPassword = false;
40 nix.settings.trusted-users = [ "root" "build" ];
41 documentation.nixos.enable = false;
42
43 # builds.sr.ht-image-specific network settings
44 networking = {
45 hostName = "build";
46 dhcpcd.enable = false;
47 defaultGateway.address = "10.0.2.2";
48 usePredictableInterfaceNames = false;
49 interfaces."eth0".ipv4.addresses = [{
50 address = "10.0.2.15";
51 prefixLength = 25;
52 }];
53 enableIPv6 = false;
54 nameservers = [
55 # OpenNIC anycast
56 "185.121.177.177"
57 "169.239.202.202"
58 # Google
59 "8.8.8.8"
60 ];
61 firewall.allowedTCPPorts = [ 22 ];
62 };
63
64 environment.systemPackages = [
65 pkgs.gitMinimal
66 #pkgs.mercurial
67 pkgs.curl
68 pkgs.gnupg
69 ];
70 };
71 qemuConfig = { pkgs, ... }: {
72 imports = [ systemConfig ];
73 fileSystems."/".device = "/dev/disk/by-label/nixos";
74 boot.initrd.availableKernelModules = [
75 "ahci"
76 "ehci_pci"
77 "sd_mod"
78 "usb_storage"
79 "usbhid"
80 "virtio_balloon"
81 "virtio_blk"
82 "virtio_pci"
83 "virtio_ring"
84 "xhci_pci"
85 ];
86 boot.loader = {
87 grub = {
88 version = 2;
89 device = "/dev/vda";
90 };
91 timeout = 0;
92 };
93 };
94 config = (import (pkgs.path + "/nixos/lib/eval-config.nix") {
95 inherit pkgs; modules = [ qemuConfig ];
96 system = "x86_64-linux";
97 }).config;
98 in
99 import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
100 inherit pkgs lib config;
101 diskSize = 16000;
102 format = "qcow2-compressed";
103 contents = [
104 { source = pkgs.writeText "gitconfig" ''
105 [user]
106 name = builds.sr.ht
107 email = build@sr.ht
108 '';
109 target = "/home/build/.gitconfig";
110 user = "build";
111 group = "users";
112 mode = "644";
113 }
114 ];
115 };
116 };
117
118in
119{
120 name = "sourcehut";
121
122 meta.maintainers = [ pkgs.lib.maintainers.tomberek ];
123
124 nodes.machine = { config, pkgs, nodes, ... }: {
125 # buildsrht needs space
126 virtualisation.diskSize = 4 * 1024;
127 virtualisation.memorySize = 2 * 1024;
128 networking.domain = domain;
129 networking.extraHosts = ''
130 ${config.networking.primaryIPAddress} builds.${domain}
131 ${config.networking.primaryIPAddress} git.${domain}
132 ${config.networking.primaryIPAddress} meta.${domain}
133 '';
134
135 services.sourcehut = {
136 enable = true;
137 services = [
138 "builds"
139 "git"
140 "meta"
141 ];
142 nginx.enable = true;
143 nginx.virtualHost = {
144 forceSSL = true;
145 sslCertificate = "${tls-cert}/cert.pem";
146 sslCertificateKey = "${tls-cert}/key.pem";
147 };
148 postgresql.enable = true;
149 redis.enable = true;
150
151 meta.enable = true;
152 builds = {
153 enable = true;
154 # FIXME: see why it does not seem to activate fully.
155 #enableWorker = true;
156 inherit images;
157 };
158 git.enable = true;
159
160 settings."sr.ht" = {
161 global-domain = config.networking.domain;
162 service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
163 network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
164 };
165 settings."builds.sr.ht" = {
166 oauth-client-secret = pkgs.writeText "buildsrht-oauth-client-secret" "2260e9c4d9b8dcedcef642860e0504bc";
167 oauth-client-id = "299db9f9c2013170";
168 };
169 settings."git.sr.ht" = {
170 oauth-client-secret = pkgs.writeText "gitsrht-oauth-client-secret" "3597288dc2c716e567db5384f493b09d";
171 oauth-client-id = "d07cb713d920702e";
172 };
173 settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
174 settings.mail = {
175 smtp-from = "root+hut@${domain}";
176 # WARNING: take care to keep pgp-privkey outside the Nix store in production,
177 # or use LoadCredentialEncrypted=
178 pgp-privkey = toString (pkgs.writeText "sourcehut.pgp-privkey" ''
179 -----BEGIN PGP PRIVATE KEY BLOCK-----
180
181 lFgEYqDRORYJKwYBBAHaRw8BAQdAehGoy36FUx2OesYm07be2rtLyvR5Pb/ltstd
182 Gk7hYQoAAP9X4oPmxxrHN8LewBpWITdBomNqlHoiP7mI0nz/BOPJHxEktDZuaXhv
183 cy90ZXN0cy9zb3VyY2VodXQgPHJvb3QraHV0QHNvdXJjZWh1dC5sb2NhbGRvbWFp
184 bj6IlwQTFgoAPxYhBPqjgjnL8RHN4JnADNicgXaYm0jJBQJioNE5AhsDBQkDwmcA
185 BgsJCAcDCgUVCgkICwUWAwIBAAIeBQIXgAAKCRDYnIF2mJtIySVCAP9e2nHsVHSi
186 2B1YGZpVG7Xf36vxljmMkbroQy+0gBPwRwEAq+jaiQqlbGhQ7R/HMFcAxBIVsq8h
187 Aw1rngsUd0o3dAicXQRioNE5EgorBgEEAZdVAQUBAQdAXZV2Sd5ZNBVTBbTGavMv
188 D6ORrUh8z7TI/3CsxCE7+yADAQgHAAD/c1RU9xH+V/uI1fE7HIn/zL0LUPpsuce2
189 cH++g4u3kBgTOYh+BBgWCgAmFiEE+qOCOcvxEc3gmcAM2JyBdpibSMkFAmKg0TkC
190 GwwFCQPCZwAACgkQ2JyBdpibSMlKagD/cTre6p1m8QuJ7kwmCFRSz5tBzIuYMMgN
191 xtT7dmS91csA/35fWsOykSiFRojQ7ccCSUTHL7ApF2EbL968tP/D2hIG
192 =Hjoc
193 -----END PGP PRIVATE KEY BLOCK-----
194 '');
195 pgp-pubkey = pkgs.writeText "sourcehut.pgp-pubkey" ''
196 -----BEGIN PGP PUBLIC KEY BLOCK-----
197
198 mDMEYqDRORYJKwYBBAHaRw8BAQdAehGoy36FUx2OesYm07be2rtLyvR5Pb/ltstd
199 Gk7hYQq0Nm5peG9zL3Rlc3RzL3NvdXJjZWh1dCA8cm9vdCtodXRAc291cmNlaHV0
200 LmxvY2FsZG9tYWluPoiXBBMWCgA/FiEE+qOCOcvxEc3gmcAM2JyBdpibSMkFAmKg
201 0TkCGwMFCQPCZwAGCwkIBwMKBRUKCQgLBRYDAgEAAh4FAheAAAoJENicgXaYm0jJ
202 JUIA/17acexUdKLYHVgZmlUbtd/fq/GWOYyRuuhDL7SAE/BHAQCr6NqJCqVsaFDt
203 H8cwVwDEEhWyryEDDWueCxR3Sjd0CLg4BGKg0TkSCisGAQQBl1UBBQEBB0BdlXZJ
204 3lk0FVMFtMZq8y8Po5GtSHzPtMj/cKzEITv7IAMBCAeIfgQYFgoAJhYhBPqjgjnL
205 8RHN4JnADNicgXaYm0jJBQJioNE5AhsMBQkDwmcAAAoJENicgXaYm0jJSmoA/3E6
206 3uqdZvELie5MJghUUs+bQcyLmDDIDcbU+3ZkvdXLAP9+X1rDspEohUaI0O3HAklE
207 xy+wKRdhGy/evLT/w9oSBg==
208 =pJD7
209 -----END PGP PUBLIC KEY BLOCK-----
210 '';
211 pgp-key-id = "0xFAA38239CBF111CDE099C00CD89C8176989B48C9";
212 };
213 };
214
215 networking.firewall.allowedTCPPorts = [ 443 ];
216 security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
217 services.nginx = {
218 enable = true;
219 recommendedGzipSettings = true;
220 recommendedOptimisation = true;
221 recommendedTlsSettings = true;
222 recommendedProxySettings = true;
223 };
224
225 services.postgresql = {
226 enable = true;
227 enableTCPIP = false;
228 settings.unix_socket_permissions = "0770";
229 };
230 };
231
232 testScript = ''
233 start_all()
234 machine.wait_for_unit("multi-user.target")
235
236 # Testing metasrht
237 machine.wait_for_unit("metasrht-api.service")
238 machine.wait_for_unit("metasrht.service")
239 machine.wait_for_unit("metasrht-webhooks.service")
240 machine.wait_for_open_port(5000)
241 machine.succeed("curl -sL http://localhost:5000 | grep meta.${domain}")
242 machine.succeed("curl -sL http://meta.${domain} | grep meta.${domain}")
243
244 # Testing buildsrht
245 machine.wait_for_unit("buildsrht.service")
246 machine.wait_for_open_port(5002)
247 machine.succeed("curl -sL http://localhost:5002 | grep builds.${domain}")
248 #machine.wait_for_unit("buildsrht-worker.service")
249
250 # Testing gitsrht
251 machine.wait_for_unit("gitsrht-api.service")
252 machine.wait_for_unit("gitsrht.service")
253 machine.wait_for_unit("gitsrht-webhooks.service")
254 machine.succeed("curl -sL http://git.${domain} | grep git.${domain}")
255 '';
256})