M2: Drone server + exec runner up; infra as idempotent-reconcile oneshots

Convert proxy+drone bring-up to writeShellApplication systemd oneshots that reconcile every activation (orchestrator steer). pkgs.abra overlay. Runner connected via RPC (polling, capacity=2). install.md = clone + nixos-rebuild switch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 22:59:59 +01:00
parent 62b23e3a41
commit a385148af9
11 changed files with 296 additions and 113 deletions
@@ -0,0 +1,64 @@
+# Drone CI server = coop-cloud `drone` recipe via abra (swarm, traefik-routed at
+# drone.ci.commoninternet.net, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
+# separate host systemd service (modules/drone-runner.nix). See DECISIONS.md "CI engine"/"Drone
+# deployment shape".
+#
+# Idempotent-RECONCILE oneshot (same pattern as proxy/swarm-init): converges every boot/activation.
+# RPC + OAuth-client secrets come from sops (/run/secrets), inserted as swarm secrets here.
+{ pkgs, ... }:
+let
+  giteaClientId = "ab4cdb9d-ee96-4867-875f-87384505fc52";
+  reconcile = pkgs.writeShellApplication {
+    name = "cc-ci-reconcile-drone";
+    runtimeInputs = with pkgs; [ abra docker jq gnused gnugrep coreutils git ];
+    text = ''
+      DRONE_DOMAIN="drone.ci.commoninternet.net"
+      ENV_FILE="$HOME/.abra/servers/default/$DRONE_DOMAIN.env"
+
+      if [ ! -r /run/secrets/drone_rpc_secret ] || [ ! -r /run/secrets/drone_gitea_client_secret ]; then
+        echo "FATAL: drone sops secrets missing at /run/secrets (rebuild ordering?)" >&2
+        exit 1
+      fi
+
+      abra server ls -m -n >/dev/null 2>&1 || abra server add --local -n || true
+      abra recipe fetch drone -n >/dev/null
+
+      [ -f "$ENV_FILE" ] || abra app new drone -s default -D "$DRONE_DOMAIN" -n
+
+      set_env() {
+        sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
+      }
+      set_env LETS_ENCRYPT_ENV ""
+      set_env EXTRA_DOMAINS ""
+      set_env DRONE_USER_CREATE "username:autonomic-bot,admin:true"
+      set_env GITEA_DOMAIN "git.autonomic.zone"
+      set_env GITEA_CLIENT_ID "${giteaClientId}"
+      set_env RPC_SECRET_VERSION "v1"
+      set_env CLIENT_SECRET_VERSION "v1"
+      set_env DRONE_ENV_VERSION "v1"
+      set_env COMPOSE_FILE '"compose.yml:compose.gitea.yml"'
+
+      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "_$1_v1$"; }
+      have_secret rpc_secret    || abra app secret insert "$DRONE_DOMAIN" rpc_secret    v1 /run/secrets/drone_rpc_secret          -f -n
+      have_secret client_secret || abra app secret insert "$DRONE_DOMAIN" client_secret v1 /run/secrets/drone_gitea_client_secret -f -n
+
+      abra app deploy "$DRONE_DOMAIN" -n -C
+    '';
+  };
+in
+{
+  systemd.services.deploy-drone = {
+    description = "Reconcile the Drone CI server (coop-cloud recipe, Gitea SSO) via abra";
+    after = [ "deploy-proxy.service" "swarm-init.service" "docker.service" "network-online.target" ];
+    requires = [ "swarm-init.service" "docker.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    environment.HOME = "/root";
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${reconcile}/bin/cc-ci-reconcile-drone";
+    };
+  };
+}