kiara/Fediversity
1
0
Fork 0
forked from fediversity/fediversity
Code Pull requests Activity

disable exec agent

Browse source 
make service group setting conditional

make secrets conditional

make things conditional
This commit is contained in:
Kiara Grouwstra 2025-07-27 10:30:23 +02:00
parent 68e9c41eff
commit 6eefd19a67
Signed by: kiara
SSH key fingerprint: SHA256:COspvLoLJ5WC5rFb9ZDe5urVCkK4LJZOsjfF4duRJFU
1 changed files with 96 additions and 71 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

167
machines/dev/fedi203/woodpecker.nix
View file

@ -22,12 +22,28 @@
inherit group; inherit group;
mode = "440"; mode = "440";
}) })
{ (
woodpecker-gitea-client = "woodpecker-server"; {
woodpecker-gitea-secret = "woodpecker-server"; woodpecker-gitea-client = "woodpecker-server";
woodpecker-agent-exec = "woodpecker-agent-exec"; woodpecker-gitea-secret = "woodpecker-server";
woodpecker-agent-container = "woodpecker-agent-docker"; }
}; // (
if config.services.woodpecker-agents.agents.exec.enable then
{
woodpecker-agent-exec = "woodpecker-agent-exec";
}
else
{ }
)
// (
if config.services.woodpecker-agents.agents.docker.enable then
{
woodpecker-agent-container = "woodpecker-agent-docker";
}
else
{ }
)
);
# needs `sudo generate-vars` # needs `sudo generate-vars`
vars.settings.on-machine.enable = true; vars.settings.on-machine.enable = true;
@ -53,12 +69,13 @@
vars.generators.woodpecker = vars.generators.woodpecker =
let let
fileNames = [ fileNames =
"woodpecker-gitea-client" [
"woodpecker-gitea-secret" "woodpecker-gitea-client"
"woodpecker-agent-exec" "woodpecker-gitea-secret"
"woodpecker-agent-container" ]
]; ++ (lib.lists.optional config.services.woodpecker-agents.agents.exec.enable "woodpecker-agent-exec")
++ (lib.lists.optional config.services.woodpecker-agents.agents.docker.enable "woodpecker-agent-container");
in in
{ {
runtimeInputs = [ runtimeInputs = [
@ -126,60 +143,64 @@
WOODPECKER_GRPC_SECURE=false WOODPECKER_GRPC_SECURE=false
''; '';
in in
{ (lib.mkMerge [
# https://woodpecker-ci.org/docs/administration/configuration/server {
"woodpecker-server.conf" = { # https://woodpecker-ci.org/docs/administration/configuration/server
secret = true; "woodpecker-server.conf" = {
template = pkgs.writeText "woodpecker-server.conf" '' secret = true;
WOODPECKER_DATABASE_DRIVER=sqlite3 template = pkgs.writeText "woodpecker-server.conf" ''
WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=false WOODPECKER_DATABASE_DRIVER=sqlite3
WOODPECKER_OPEN=false WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=false
WOODPECKER_ADMIN=kiara,fricklerhandwerk,niols WOODPECKER_OPEN=false
WOODPECKER_HOST=https://woodpecker.fediversity.eu WOODPECKER_ADMIN=kiara,fricklerhandwerk,niols
WOODPECKER_GITEA=true WOODPECKER_HOST=https://woodpecker.fediversity.eu
WOODPECKER_GITEA_URL=https://git.fediversity.eu WOODPECKER_GITEA=true
WOODPECKER_GITEA_CLIENT=${config.vars.generators.woodpecker.files.woodpecker-gitea-client.placeholder} WOODPECKER_GITEA_URL=https://git.fediversity.eu
WOODPECKER_GITEA_SECRET=${config.vars.generators.woodpecker.files.woodpecker-gitea-secret.placeholder} WOODPECKER_GITEA_CLIENT=${config.vars.generators.woodpecker.files.woodpecker-gitea-client.placeholder}
WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker-agent-secret.files.my-secret.placeholder} WOODPECKER_GITEA_SECRET=${config.vars.generators.woodpecker.files.woodpecker-gitea-secret.placeholder}
WOODPECKER_GRPC_SECRET=${config.vars.generators.woodpecker-rpc-secret.files.rpc-secret.placeholder} WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker-agent-secret.files.my-secret.placeholder}
WOODPECKER_LOG_LEVEL=info WOODPECKER_GRPC_SECRET=${config.vars.generators.woodpecker-rpc-secret.files.rpc-secret.placeholder}
WOODPECKER_DEFAULT_CLONE_PLUGIN=docker.io/woodpeckerci/plugin-git WOODPECKER_LOG_LEVEL=info
WOODPECKER_SERVER_ADDR=:8000 WOODPECKER_DEFAULT_CLONE_PLUGIN=docker.io/woodpeckerci/plugin-git
WOODPECKER_GRPC_ADDR=:9000 WOODPECKER_SERVER_ADDR=:8000
''; WOODPECKER_GRPC_ADDR=:9000
}; '';
};
# https://woodpecker-ci.org/docs/administration/configuration/backends/local#environment-variables }
"woodpecker-agent-exec.conf" = { (lib.mkIf config.services.woodpecker-agents.agents.exec.enable {
secret = true; # https://woodpecker-ci.org/docs/administration/configuration/backends/local#environment-variables
template = pkgs.writeText "woodpecker-agent-exec.conf" ( "woodpecker-agent-exec.conf" = {
lib.concatStringsSep "\n" [ secret = true;
shared template = pkgs.writeText "woodpecker-agent-exec.conf" (
'' lib.concatStringsSep "\n" [
WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker.files.woodpecker-agent-exec.placeholder} shared
WOODPECKER_BACKEND=local ''
WOODPECKER_AGENT_LABELS=type=local WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker.files.woodpecker-agent-exec.placeholder}
'' WOODPECKER_BACKEND=local
] WOODPECKER_AGENT_LABELS=type=local
); ''
}; ]
);
# https://woodpecker-ci.org/docs/administration/configuration/backends/docker#environment-variables };
"woodpecker-agent-podman.conf" = { })
secret = true; (lib.mkIf config.services.woodpecker-agents.agents.docker.enable {
template = pkgs.writeText "woodpecker-agent-podman.conf" ( # https://woodpecker-ci.org/docs/administration/configuration/backends/docker#environment-variables
lib.concatStringsSep "\n" [ "woodpecker-agent-podman.conf" = {
shared secret = true;
'' template = pkgs.writeText "woodpecker-agent-podman.conf" (
WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker.files.woodpecker-agent-container.placeholder} lib.concatStringsSep "\n" [
WOODPECKER_BACKEND=docker shared
WOODPECKER_AGENT_LABELS=type=docker ''
DOCKER_HOST=unix:///run/podman/podman.sock WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker.files.woodpecker-agent-container.placeholder}
'' WOODPECKER_BACKEND=docker
] WOODPECKER_AGENT_LABELS=type=docker
); DOCKER_HOST=unix:///run/podman/podman.sock
}; ''
}; ]
);
};
})
]);
}; };
# enable git-lfs # enable git-lfs
@ -212,7 +233,7 @@
# https://woodpecker-ci.org/docs/administration/configuration/agent # https://woodpecker-ci.org/docs/administration/configuration/agent
woodpecker-agents.agents = { woodpecker-agents.agents = {
exec = { exec = {
enable = true; # enable = true;
path = with pkgs; [ path = with pkgs; [
git git
git-lfs git-lfs
@ -254,9 +275,13 @@
}; };
}; };
systemd.services.woodpecker-agent-docker = { systemd.services = {
wants = [ "podman.socket" ]; woodpecker-agent-docker = lib.mkIf config.services.woodpecker-agents.agents.docker.enable {
after = [ "podman.socket" ]; wants = [ "podman.socket" ];
serviceConfig.SupplementaryGroups = [ "podman" ]; after = [ "podman.socket" ];
serviceConfig = {
SupplementaryGroups = [ "podman" ];
};
};
}; };
} }