nixos/woodpecker: init
This commit is contained in:
parent
7067edc68c
commit
dafedbbba6
|
@ -377,6 +377,8 @@
|
||||||
./services/continuous-integration/jenkins/default.nix
|
./services/continuous-integration/jenkins/default.nix
|
||||||
./services/continuous-integration/jenkins/job-builder.nix
|
./services/continuous-integration/jenkins/job-builder.nix
|
||||||
./services/continuous-integration/jenkins/slave.nix
|
./services/continuous-integration/jenkins/slave.nix
|
||||||
|
./services/continuous-integration/woodpecker/agent.nix
|
||||||
|
./services/continuous-integration/woodpecker/server.nix
|
||||||
./services/databases/aerospike.nix
|
./services/databases/aerospike.nix
|
||||||
./services/databases/cassandra.nix
|
./services/databases/cassandra.nix
|
||||||
./services/databases/clickhouse.nix
|
./services/databases/clickhouse.nix
|
||||||
|
|
|
@ -0,0 +1,99 @@
|
||||||
|
{ config
|
||||||
|
, lib
|
||||||
|
, pkgs
|
||||||
|
, ...
|
||||||
|
}:
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.woodpecker-agent;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
meta.maintainers = [ lib.maintainers.janik ];
|
||||||
|
|
||||||
|
options = {
|
||||||
|
services.woodpecker-agent = {
|
||||||
|
enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent");
|
||||||
|
package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { };
|
||||||
|
|
||||||
|
environment = lib.mkOption {
|
||||||
|
default = { };
|
||||||
|
type = lib.types.attrsOf lib.types.str;
|
||||||
|
example = lib.literalExpression ''
|
||||||
|
{
|
||||||
|
WOODPECKER_SERVER = "localhost:9000";
|
||||||
|
WOODPECKER_BACKEND = "docker";
|
||||||
|
DOCKER_HOST = "unix:///run/podman/podman.sock";
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraGroups = lib.mkOption {
|
||||||
|
default = null;
|
||||||
|
type = lib.types.nullOr (lib.types.listOf lib.types.str);
|
||||||
|
example = [ "podman" ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Additional groups for the systemd service.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
environmentFile = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
example = "/root/woodpecker-agent.env";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
File to load environment variables
|
||||||
|
from. This is helpful for specifying secrets.
|
||||||
|
Example content of environmentFile:
|
||||||
|
```
|
||||||
|
WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here
|
||||||
|
```
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
systemd.services = {
|
||||||
|
woodpecker-agent = {
|
||||||
|
description = "Woodpecker-Agent Service";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
after = [ "network-online.target" ];
|
||||||
|
wants = [ "network-online.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
DynamicUser = true;
|
||||||
|
SupplementaryGroups = lib.optionals (cfg.extraGroups != null) cfg.extraGroups;
|
||||||
|
EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
|
||||||
|
ExecStart = "${cfg.package}/bin/woodpecker-agent";
|
||||||
|
Restart = "on-failure";
|
||||||
|
RestartSec = 15;
|
||||||
|
CapabilityBoundingSet = "";
|
||||||
|
# Security
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
# Sandboxing
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
PrivateMounts = true;
|
||||||
|
# System Call Filtering
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
||||||
|
};
|
||||||
|
inherit (cfg) environment;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
|
@ -0,0 +1,98 @@
|
||||||
|
{ config
|
||||||
|
, lib
|
||||||
|
, pkgs
|
||||||
|
, ...
|
||||||
|
}:
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.woodpecker-server;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
meta.maintainers = [ lib.maintainers.janik ];
|
||||||
|
|
||||||
|
|
||||||
|
options = {
|
||||||
|
services.woodpecker-server = {
|
||||||
|
enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Server, a CI/CD application for automatic builds, deployments and tests");
|
||||||
|
package = lib.mkPackageOptionMD pkgs "woodpecker-server" { };
|
||||||
|
environment = lib.mkOption {
|
||||||
|
default = { };
|
||||||
|
type = lib.types.attrsOf lib.types.str;
|
||||||
|
example = lib.literalExpression
|
||||||
|
''
|
||||||
|
{
|
||||||
|
WOODPECKER_HOST = "https://woodpecker.example.com";
|
||||||
|
WOODPECKER_OPEN = "true";
|
||||||
|
WOODPECKER_GITEA = "true";
|
||||||
|
WOODPECKER_GITEA_CLIENT = "ffffffff-ffff-ffff-ffff-ffffffffffff";
|
||||||
|
WOODPECKER_GITEA_URL = "https://git.example.com";
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
description = lib.mdDoc "woodpecker-server config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/server-config)";
|
||||||
|
};
|
||||||
|
environmentFile = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
example = "/root/woodpecker-server.env";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
File to load environment variables
|
||||||
|
from. This is helpful for specifying secrets.
|
||||||
|
Example content of environmentFile:
|
||||||
|
```
|
||||||
|
WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here
|
||||||
|
WOODPECKER_GITEA_SECRET=gto_**************************************
|
||||||
|
```
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
systemd.services = {
|
||||||
|
woodpecker-server = {
|
||||||
|
description = "Woodpecker-Server Service";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
after = [ "network-online.target" ];
|
||||||
|
wants = [ "network-online.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
DynamicUser = true;
|
||||||
|
WorkingDirectory = "%S/woodpecker-server";
|
||||||
|
StateDirectory = "woodpecker-server";
|
||||||
|
StateDirectoryMode = "0700";
|
||||||
|
UMask = "0007";
|
||||||
|
ConfigurationDirectory = "woodpecker-server";
|
||||||
|
EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
|
||||||
|
ExecStart = "${cfg.package}/bin/woodpecker-server";
|
||||||
|
Restart = "on-failure";
|
||||||
|
RestartSec = 15;
|
||||||
|
CapabilityBoundingSet = "";
|
||||||
|
# Security
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
# Sandboxing
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
ProtectHome = true;
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
PrivateMounts = true;
|
||||||
|
# System Call Filtering
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
||||||
|
};
|
||||||
|
inherit (cfg) environment;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
Loading…
Reference in a new issue