autonomic-bot
a385148af9
Convert proxy+drone bring-up to writeShellApplication systemd oneshots that reconcile every activation (orchestrator steer). pkgs.abra overlay. Runner connected via RPC (polling, capacity=2). install.md = clone + nixos-rebuild switch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
2.7 KiB
Nix
65 lines
2.7 KiB
Nix
# Drone CI server = coop-cloud `drone` recipe via abra (swarm, traefik-routed at
|
|
# drone.ci.commoninternet.net, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
|
|
# separate host systemd service (modules/drone-runner.nix). See DECISIONS.md "CI engine"/"Drone
|
|
# deployment shape".
|
|
#
|
|
# Idempotent-RECONCILE oneshot (same pattern as proxy/swarm-init): converges every boot/activation.
|
|
# RPC + OAuth-client secrets come from sops (/run/secrets), inserted as swarm secrets here.
|
|
{ pkgs, ... }:
|
|
let
|
|
giteaClientId = "ab4cdb9d-ee96-4867-875f-87384505fc52";
|
|
reconcile = pkgs.writeShellApplication {
|
|
name = "cc-ci-reconcile-drone";
|
|
runtimeInputs = with pkgs; [ abra docker jq gnused gnugrep coreutils git ];
|
|
text = ''
|
|
DRONE_DOMAIN="drone.ci.commoninternet.net"
|
|
ENV_FILE="$HOME/.abra/servers/default/$DRONE_DOMAIN.env"
|
|
|
|
if [ ! -r /run/secrets/drone_rpc_secret ] || [ ! -r /run/secrets/drone_gitea_client_secret ]; then
|
|
echo "FATAL: drone sops secrets missing at /run/secrets (rebuild ordering?)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
abra server ls -m -n >/dev/null 2>&1 || abra server add --local -n || true
|
|
abra recipe fetch drone -n >/dev/null
|
|
|
|
[ -f "$ENV_FILE" ] || abra app new drone -s default -D "$DRONE_DOMAIN" -n
|
|
|
|
set_env() {
|
|
sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
|
|
printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
|
|
}
|
|
set_env LETS_ENCRYPT_ENV ""
|
|
set_env EXTRA_DOMAINS ""
|
|
set_env DRONE_USER_CREATE "username:autonomic-bot,admin:true"
|
|
set_env GITEA_DOMAIN "git.autonomic.zone"
|
|
set_env GITEA_CLIENT_ID "${giteaClientId}"
|
|
set_env RPC_SECRET_VERSION "v1"
|
|
set_env CLIENT_SECRET_VERSION "v1"
|
|
set_env DRONE_ENV_VERSION "v1"
|
|
set_env COMPOSE_FILE '"compose.yml:compose.gitea.yml"'
|
|
|
|
have_secret() { docker secret ls --format '{{.Name}}' | grep -q "_$1_v1$"; }
|
|
have_secret rpc_secret || abra app secret insert "$DRONE_DOMAIN" rpc_secret v1 /run/secrets/drone_rpc_secret -f -n
|
|
have_secret client_secret || abra app secret insert "$DRONE_DOMAIN" client_secret v1 /run/secrets/drone_gitea_client_secret -f -n
|
|
|
|
abra app deploy "$DRONE_DOMAIN" -n -C
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
systemd.services.deploy-drone = {
|
|
description = "Reconcile the Drone CI server (coop-cloud recipe, Gitea SSO) via abra";
|
|
after = [ "deploy-proxy.service" "swarm-init.service" "docker.service" "network-online.target" ];
|
|
requires = [ "swarm-init.service" "docker.service" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
environment.HOME = "/root";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = "${reconcile}/bin/cc-ci-reconcile-drone";
|
|
};
|
|
};
|
|
}
|