back round 0 view raw

nix/vm: don't hardcode knot secret and spindle owner #435

merged

opened by

winter.bsky.social 4 months ago targeting master from winter.bsky.social/core: push-ynzsmmzxzqzy

Signed-off-by: Winter winter@winter.cafe

options

unified split

Changed files

+81 -75

docs

hacking.md

nix

vm.nix

+9 -10

docs/hacking.md

···

       56
       56
        
       `nixosConfiguration` to do so.

     

       57
       57
        
       

     

       58
       58
        
       To begin, head to `http://localhost:3000/knots` in the browser

     

       59
       59
       -
       and generate a knot secret. Replace the existing secret in

     

       60
       60
       -
       `nix/vm.nix` (`KNOT_SERVER_SECRET`) with the newly generated

     

       61
       61
       -
       secret.

     

       59
       59
       +
       and generate a knot secret. Set `$TANGLED_KNOT_SECRET` to it,

     

       60
       60
       +
       ideally in a `.envrc` with [direnv](https://direnv.net) so you

     

       61
       61
       +
       don't lose it.

     

       62
       62
        
       

     

       63
       63
        
       You can now start a lightweight NixOS VM using

     

       64
       64
        
       `nixos-shell` like so:

     
···

       91
       91
        
       

     

       92
       92
        
       ## running a spindle

     

       93
       93
        
       

     

       94
       94
       -
       Be sure to change the `owner` field for the spindle in

     

       95
       95
       -
       `nix/vm.nix` to your own DID. The above VM should already

     

       96
       96
       -
       be running a spindle on `localhost:6555`. You can head to

     

       97
       97
       -
       the spindle dashboard on `http://localhost:3000/spindles`,

     

       98
       98
       -
       and register a spindle with hostname `localhost:6555`. It

     

       99
       99
       -
       should instantly be verified. You can then configure each

     

       100
       100
       -
       repository to use this spindle and run CI jobs.

     

       94
       94
       +
       Be sure to set `$TANGLED_SPINDLE_OWNER` to your own DID.

     

       95
       95
       +
       The above VM should already be running a spindle on `localhost:6555`.

     

       96
       96
       +
       You can head to the spindle dashboard on `http://localhost:3000/spindles`,

     

       97
       97
       +
       and register a spindle with hostname `localhost:6555`. It should instantly

     

       98
       98
       +
       be verified. You can then configure each repository to use this spindle

     

       99
       99
       +
       and run CI jobs.

     

       101
       100
        
       

     

       102
       101
        
       Of interest when debugging spindles:

     

       103
       102

+72 -65

nix/vm.nix

···

       2
       2
        
         nixpkgs,

     

       3
       3
        
         system,

     

       4
       4
        
         self,

     

       5
       5
       -
       }:

     

       6
       6
       -
       nixpkgs.lib.nixosSystem {

     

       7
       7
       -
         inherit system;

     

       8
       8
       -
         modules = [

     

       9
       9
       -
           self.nixosModules.knot

     

       10
       10
       -
           self.nixosModules.spindle

     

       11
       11
       -
           ({

     

       12
       12
       -
             config,

     

       13
       13
       -
             pkgs,

     

       14
       14
       -
             ...

     

       15
       15
       -
           }: {

     

       16
       16
       -
             virtualisation = {

     

       17
       17
       -
               memorySize = 2048;

     

       18
       18
       -
               diskSize = 10 * 1024;

     

       19
       19
       -
               cores = 2;

     

       20
       20
       -
               forwardPorts = [

     

       21
       21
       -
                 # ssh

     

       22
       22
       -
                 {

     

       23
       23
       -
                   from = "host";

     

       24
       24
       -
                   host.port = 2222;

     

       25
       25
       -
                   guest.port = 22;

     

       26
       26
       -
                 }

     

       27
       27
       -
                 # knot

     

       28
       28
       -
                 {

     

       29
       29
       -
                   from = "host";

     

       30
       30
       -
                   host.port = 6000;

     

       31
       31
       -
                   guest.port = 6000;

     

       32
       32
       -
                 }

     

       33
       33
       -
                 # spindle

     

       34
       34
       -
                 {

     

       35
       35
       -
                   from = "host";

     

       36
       36
       -
                   host.port = 6555;

     

       37
       37
       -
                   guest.port = 6555;

     

       38
       38
       -
                 }

     

       5
       5
       +
       }: let

     

       6
       6
       +
         envVar = name: let

     

       7
       7
       +
           var = builtins.getEnv name;

     

       8
       8
       +
         in

     

       9
       9
       +
           if var == ""

     

       10
       10
       +
           then throw "\$${name} must be defined, see docs/hacking.md for more details"

     

       11
       11
       +
           else var;

     

       12
       12
       +
       in

     

       13
       13
       +
         nixpkgs.lib.nixosSystem {

     

       14
       14
       +
           inherit system;

     

       15
       15
       +
           modules = [

     

       16
       16
       +
             self.nixosModules.knot

     

       17
       17
       +
             self.nixosModules.spindle

     

       18
       18
       +
             ({

     

       19
       19
       +
               config,

     

       20
       20
       +
               pkgs,

     

       21
       21
       +
               ...

     

       22
       22
       +
             }: {

     

       23
       23
       +
               virtualisation = {

     

       24
       24
       +
                 memorySize = 2048;

     

       25
       25
       +
                 diskSize = 10 * 1024;

     

       26
       26
       +
                 cores = 2;

     

       27
       27
       +
                 forwardPorts = [

     

       28
       28
       +
                   # ssh

     

       29
       29
       +
                   {

     

       30
       30
       +
                     from = "host";

     

       31
       31
       +
                     host.port = 2222;

     

       32
       32
       +
                     guest.port = 22;

     

       33
       33
       +
                   }

     

       34
       34
       +
                   # knot

     

       35
       35
       +
                   {

     

       36
       36
       +
                     from = "host";

     

       37
       37
       +
                     host.port = 6000;

     

       38
       38
       +
                     guest.port = 6000;

     

       39
       39
       +
                   }

     

       40
       40
       +
                   # spindle

     

       41
       41
       +
                   {

     

       42
       42
       +
                     from = "host";

     

       43
       43
       +
                     host.port = 6555;

     

       44
       44
       +
                     guest.port = 6555;

     

       45
       45
       +
                   }

     

       46
       46
       +
                 ];

     

       47
       47
       +
               };

     

       48
       48
       +
               services.getty.autologinUser = "root";

     

       49
       49
       +
               environment.systemPackages = with pkgs; [curl vim git];

     

       50
       50
       +
               systemd.tmpfiles.rules = let

     

       51
       51
       +
                 u = config.services.tangled-knot.gitUser;

     

       52
       52
       +
                 g = config.services.tangled-knot.gitUser;

     

       53
       53
       +
               in [

     

       54
       54
       +
                 "d /var/lib/knot 0770 ${u} ${g} - -" # Create the directory first

     

       55
       55
       +
                 "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=${envVar "TANGLED_VM_KNOT_SECRET"}"

     

       39
       56
        
               ];

     

       40
       40
       -
             };

     

       41
       41
       -
             services.getty.autologinUser = "root";

     

       42
       42
       -
             environment.systemPackages = with pkgs; [curl vim git];

     

       43
       43
       -
             systemd.tmpfiles.rules = let

     

       44
       44
       -
               u = config.services.tangled-knot.gitUser;

     

       45
       45
       -
               g = config.services.tangled-knot.gitUser;

     

       46
       46
       -
             in [

     

       47
       47
       -
               "d /var/lib/knot 0770 ${u} ${g} - -" # Create the directory first

     

       48
       48
       -
               "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=168c426fa6d9829fcbe85c96bdf144e800fb9737d6ca87f21acc543b1aa3e440"

     

       49
       49
       -
             ];

     

       50
       50
       -
             services.tangled-knot = {

     

       51
       51
       -
               enable = true;

     

       52
       52
       -
               motd = "Welcome to the development knot!\n";

     

       53
       53
       -
               server = {

     

       54
       54
       -
                 secretFile = "/var/lib/knot/secret";

     

       55
       55
       -
                 hostname = "localhost:6000";

     

       56
       56
       -
                 listenAddr = "0.0.0.0:6000";

     

       57
       57
       +
               services.tangled-knot = {

     

       58
       58
       +
                 enable = true;

     

       59
       59
       +
                 motd = "Welcome to the development knot!\n";

     

       60
       60
       +
                 server = {

     

       61
       61
       +
                   secretFile = "/var/lib/knot/secret";

     

       62
       62
       +
                   hostname = "localhost:6000";

     

       63
       63
       +
                   listenAddr = "0.0.0.0:6000";

     

       64
       64
       +
                 };

     

       57
       65
        
               };

     

       58
       58
       -
             };

     

       59
       59
       -
             services.tangled-spindle = {

     

       60
       60
       -
               enable = true;

     

       61
       61
       -
               server = {

     

       62
       62
       -
                 owner = "did:plc:qfpnj4og54vl56wngdriaxug";

     

       63
       63
       -
                 hostname = "localhost:6555";

     

       64
       64
       -
                 listenAddr = "0.0.0.0:6555";

     

       65
       65
       -
                 dev = true;

     

       66
       66
       -
                 secrets = {

     

       67
       67
       -
                   provider = "sqlite";

     

       66
       66
       +
               services.tangled-spindle = {

     

       67
       67
       +
                 enable = true;

     

       68
       68
       +
                 server = {

     

       69
       69
       +
                   owner = envVar "TANGLED_VM_SPINDLE_OWNER";

     

       70
       70
       +
                   hostname = "localhost:6555";

     

       71
       71
       +
                   listenAddr = "0.0.0.0:6555";

     

       72
       72
       +
                   dev = true;

     

       73
       73
       +
                   secrets = {

     

       74
       74
       +
                     provider = "sqlite";

     

       75
       75
       +
                   };

     

       68
       76
        
                 };

     

       69
       77
        
               };

     

       70
       70
       -
             };

     

       71
       71
       -
           })

     

       72
       72
       -
         ];

     

       73
       73
       -
       }

     

       78
       78
       +
             })

     

       79
       79
       +
           ];

     

       80
       80
       +
         }