From e4f5f1b7187162c15b1a35df8772375cf878ab19 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Sat, 18 Mar 2023 17:05:05 +0000 Subject: [PATCH 1/6] nixos/woodpecker: refactor to multi-agents setup The module file has been renamed from `agent.nix` to `agents.nix` to mirror the change. --- .../manual/release-notes/rl-2305.section.md | 2 +- nixos/modules/module-list.nix | 2 +- .../woodpecker/agent.nix | 99 ------------- .../woodpecker/agents.nix | 131 ++++++++++++++++++ 4 files changed, 133 insertions(+), 101 deletions(-) delete mode 100644 nixos/modules/services/continuous-integration/woodpecker/agent.nix create mode 100644 nixos/modules/services/continuous-integration/woodpecker/agents.nix diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 5bc5a8245211..ee0db1001b06 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -71,7 +71,7 @@ In addition to numerous new and upgraded packages, this release has the followin - [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm. -- [woodpecker-agent](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agent](#opt-services.woodpecker-agent.enable). +- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.enable). - [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 314d67419b7f..d81ab966b4a8 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -377,7 +377,7 @@ ./services/continuous-integration/jenkins/default.nix ./services/continuous-integration/jenkins/job-builder.nix ./services/continuous-integration/jenkins/slave.nix - ./services/continuous-integration/woodpecker/agent.nix + ./services/continuous-integration/woodpecker/agents.nix ./services/continuous-integration/woodpecker/server.nix ./services/databases/aerospike.nix ./services/databases/cassandra.nix diff --git a/nixos/modules/services/continuous-integration/woodpecker/agent.nix b/nixos/modules/services/continuous-integration/woodpecker/agent.nix deleted file mode 100644 index 1aedec81c965..000000000000 --- a/nixos/modules/services/continuous-integration/woodpecker/agent.nix +++ /dev/null @@ -1,99 +0,0 @@ -{ config -, lib -, pkgs -, ... -}: - -let - cfg = config.services.woodpecker-agent; -in -{ - meta.maintainers = [ lib.maintainers.janik ]; - - options = { - services.woodpecker-agent = { - enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent"); - package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { }; - - environment = lib.mkOption { - default = { }; - type = lib.types.attrsOf lib.types.str; - example = lib.literalExpression '' - { - WOODPECKER_SERVER = "localhost:9000"; - WOODPECKER_BACKEND = "docker"; - DOCKER_HOST = "unix:///run/podman/podman.sock"; - } - ''; - description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)"; - }; - - extraGroups = lib.mkOption { - default = null; - type = lib.types.nullOr (lib.types.listOf lib.types.str); - example = [ "podman" ]; - description = lib.mdDoc '' - Additional groups for the systemd service. - ''; - }; - - environmentFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - example = "/root/woodpecker-agent.env"; - description = lib.mdDoc '' - File to load environment variables - from. This is helpful for specifying secrets. - Example content of environmentFile: - ``` - WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here - ``` - ''; - }; - }; - }; - - config = lib.mkIf cfg.enable { - systemd.services = { - woodpecker-agent = { - description = "Woodpecker-Agent Service"; - wantedBy = [ "multi-user.target" ]; - after = [ "network-online.target" ]; - wants = [ "network-online.target" ]; - serviceConfig = { - DynamicUser = true; - SupplementaryGroups = lib.optionals (cfg.extraGroups != null) cfg.extraGroups; - EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile; - ExecStart = "${cfg.package}/bin/woodpecker-agent"; - Restart = "on-failure"; - RestartSec = 15; - CapabilityBoundingSet = ""; - # Security - NoNewPrivileges = true; - # Sandboxing - ProtectSystem = "strict"; - PrivateTmp = true; - PrivateDevices = true; - PrivateUsers = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ]; - LockPersonality = true; - MemoryDenyWriteExecute = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - PrivateMounts = true; - # System Call Filtering - SystemCallArchitectures = "native"; - SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap"; - }; - inherit (cfg) environment; - }; - }; - }; -} - diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix new file mode 100644 index 000000000000..e8e683a72d5f --- /dev/null +++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix @@ -0,0 +1,131 @@ +{ config +, lib +, pkgs +, ... +}: + +let + cfg = config.services.woodpecker-agents; + + agentModule = lib.types.submodule { + options = { + package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { }; + + environment = lib.mkOption { + default = { }; + type = lib.types.attrsOf lib.types.str; + example = lib.literalExpression '' + { + WOODPECKER_SERVER = "localhost:9000"; + WOODPECKER_BACKEND = "docker"; + DOCKER_HOST = "unix:///run/podman/podman.sock"; + } + ''; + description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)"; + }; + + extraGroups = lib.mkOption { + default = null; + type = lib.types.nullOr (lib.types.listOf lib.types.str); + example = [ "podman" ]; + description = lib.mdDoc '' + Additional groups for the systemd service. + ''; + }; + + environmentFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + example = "/var/secrets/woodpecker-agent.env"; + description = lib.mdDoc '' + File to load environment variables + from. This is helpful for specifying secrets. + Example content of environmentFile: + ``` + WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here + ``` + ''; + }; + }; + }; + + mkAgentService = name: agentCfg: { + name = "woodpecker-agent-${name}"; + value = { + description = "Woodpecker-Agent Service - ${name}"; + wantedBy = [ "multi-user.target" ]; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + serviceConfig = { + DynamicUser = true; + SupplementaryGroups = lib.optionals (agentCfg.extraGroups != null) agentCfg.extraGroups; + EnvironmentFile = lib.optional (agentCfg.environmentFile != null) agentCfg.environmentFile; + ExecStart = lib.getExe agentCfg.package; + Restart = "on-failure"; + RestartSec = 15; + CapabilityBoundingSet = ""; + NoNewPrivileges = true; + ProtectSystem = "strict"; + PrivateTmp = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + PrivateMounts = true; + SystemCallArchitectures = "native"; + SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap"; + }; + inherit (agentCfg) environment; + }; + }; +in +{ + meta.maintainers = [ lib.maintainers.janik ]; + + options = { + services.woodpecker-agents = { + enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent"); + + agents = lib.mkOption { + default = { }; + type = lib.types.attrsOf agentModule; + example = { + docker = { + environment = { + WOODPECKER_SERVER = "localhost:9000"; + WOODPECKER_BACKEND = "docker"; + DOCKER_HOST = "unix:///run/podman/podman.sock"; + }; + + extraGroups = [ "docker" ]; + + environmentFile = "/run/secrets/woodpecker/agent-secret.txt"; + }; + + exec = { + environment = { + WOODPECKER_SERVER = "localhost:9000"; + WOODPECKER_BACKEND = "exec"; + }; + + environmentFile = "/run/secrets/woodpecker/agent-secret.txt"; + }; + }; + description = lib.mdDoc "woodpecker-agents configurations"; + }; + }; + }; + + config = lib.mkIf cfg.enable { + systemd.services = lib.mapAttrs' mkAgentService cfg.agents; + }; +} From c3afdb82db6c9c9157329e3b74cc514fecedf441 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Sat, 18 Mar 2023 17:05:05 +0000 Subject: [PATCH 2/6] nixos/woodpecker-agents: use list for environment files --- .../services/continuous-integration/woodpecker/agents.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix index e8e683a72d5f..6da3ad7b73b1 100644 --- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix +++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix @@ -34,9 +34,9 @@ let }; environmentFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - example = "/var/secrets/woodpecker-agent.env"; + type = lib.types.listOf lib.types.path; + default = [ ]; + example = [ "/var/secrets/woodpecker-agent.env" ]; description = lib.mdDoc '' File to load environment variables from. This is helpful for specifying secrets. @@ -59,7 +59,7 @@ let serviceConfig = { DynamicUser = true; SupplementaryGroups = lib.optionals (agentCfg.extraGroups != null) agentCfg.extraGroups; - EnvironmentFile = lib.optional (agentCfg.environmentFile != null) agentCfg.environmentFile; + EnvironmentFile = agentCfg.environmentFile; ExecStart = lib.getExe agentCfg.package; Restart = "on-failure"; RestartSec = 15; From eb3bea6359b56048835f2a31bb1505eb6f793908 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Sat, 18 Mar 2023 17:05:05 +0000 Subject: [PATCH 3/6] nixos/woodpecker-agents: simplify 'extraGroups' handling --- .../services/continuous-integration/woodpecker/agents.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix index 6da3ad7b73b1..10ad94cee7bd 100644 --- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix +++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix @@ -25,8 +25,8 @@ let }; extraGroups = lib.mkOption { - default = null; - type = lib.types.nullOr (lib.types.listOf lib.types.str); + type = lib.types.listOf lib.types.str; + default = [ ]; example = [ "podman" ]; description = lib.mdDoc '' Additional groups for the systemd service. @@ -58,7 +58,7 @@ let wants = [ "network-online.target" ]; serviceConfig = { DynamicUser = true; - SupplementaryGroups = lib.optionals (agentCfg.extraGroups != null) agentCfg.extraGroups; + SupplementaryGroups = agentCfg.extraGroups; EnvironmentFile = agentCfg.environmentFile; ExecStart = lib.getExe agentCfg.package; Restart = "on-failure"; From cd116db45e8e31e01f9c20d4fbb7785febed74d8 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Sat, 18 Mar 2023 17:05:05 +0000 Subject: [PATCH 4/6] nixos/woodpecker-agents: bind network files Otherwise the agent might experience trouble with DNS resolution [1]. [1]: https://github.com/woodpecker-ci/plugin-git/issues/65 --- .../services/continuous-integration/woodpecker/agents.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix index 10ad94cee7bd..ac6ec45c0ba7 100644 --- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix +++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix @@ -83,6 +83,14 @@ let PrivateMounts = true; SystemCallArchitectures = "native"; SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap"; + BindReadOnlyPaths = [ + "-/etc/resolv.conf" + "-/etc/nsswitch.conf" + "-/etc/ssl/certs" + "-/etc/static/ssl/certs" + "-/etc/hosts" + "-/etc/localtime" + ]; }; inherit (agentCfg) environment; }; From 67de7d105ea6b400d66628b703c69fa171b9f08a Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 23 Mar 2023 14:13:26 +0000 Subject: [PATCH 5/6] nixos/woodpecker-agents: per-agent 'enable' option --- nixos/doc/manual/release-notes/rl-2305.section.md | 2 +- .../continuous-integration/woodpecker/agents.nix | 13 +++++++++---- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index ee0db1001b06..b88c8dfb0c87 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -71,7 +71,7 @@ In addition to numerous new and upgraded packages, this release has the followin - [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm. -- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.enable). +- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable). - [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable). diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix index ac6ec45c0ba7..2dd6e39bdd94 100644 --- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix +++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix @@ -9,6 +9,8 @@ let agentModule = lib.types.submodule { options = { + enable = lib.mkEnableOption (lib.mdDoc "this Woodpecker-Agent. Agents execute tasks generated by a Server, every install will need one server and at least one agent"); + package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { }; environment = lib.mkOption { @@ -101,8 +103,6 @@ in options = { services.woodpecker-agents = { - enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent"); - agents = lib.mkOption { default = { }; type = lib.types.attrsOf agentModule; @@ -133,7 +133,12 @@ in }; }; - config = lib.mkIf cfg.enable { - systemd.services = lib.mapAttrs' mkAgentService cfg.agents; + config = { + systemd.services = + let + mkServices = lib.mapAttrs' mkAgentService; + enabledAgents = lib.filterAttrs (_: agent: agent.enable) cfg.agents; + in + mkServices enabledAgents; }; } From 6048912d8bdb899d05ce413b5edfe61a45f22ed8 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Sat, 18 Mar 2023 17:12:48 +0000 Subject: [PATCH 6/6] nixos/woodpecker-*: add myself as maintainer --- .../services/continuous-integration/woodpecker/agents.nix | 2 +- .../services/continuous-integration/woodpecker/server.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix index 2dd6e39bdd94..caf6c8509342 100644 --- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix +++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix @@ -99,7 +99,7 @@ let }; in { - meta.maintainers = [ lib.maintainers.janik ]; + meta.maintainers = with lib.maintainers; [ janik ambroisie ]; options = { services.woodpecker-agents = { diff --git a/nixos/modules/services/continuous-integration/woodpecker/server.nix b/nixos/modules/services/continuous-integration/woodpecker/server.nix index 6b4e4732465c..be7786da8505 100644 --- a/nixos/modules/services/continuous-integration/woodpecker/server.nix +++ b/nixos/modules/services/continuous-integration/woodpecker/server.nix @@ -8,7 +8,7 @@ let cfg = config.services.woodpecker-server; in { - meta.maintainers = [ lib.maintainers.janik ]; + meta.maintainers = with lib.maintainers; [ janik ambroisie ]; options = {