feat(nixos/clbot): Add a module for running clbot r/1142

Change-Id: I9c10906441c3222b74bcc820a67f11d96462fcfa
Reviewed-on: https://cl.tvl.fyi/c/depot/+/821
Tested-by: BuildkiteCI
Reviewed-by: lukegb <lukegb@tvl.fyi>
Reviewed-by: BuildkiteCI

2 files changed, 75 insertions, 1 deletions

diff --git a/ops/nixos/clbot.nix b/ops/nixos/clbot.nix
new file mode 100644
index 0000000000..adcbebd57f
--- /dev/null
+++ b/ops/nixos/clbot.nix
@@ -0,0 +1,52 @@
+# Module that configures CLBot, our Gerrit->IRC info bridge.
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (builtins) concatStringsSep attrValues mapAttrs;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types;
+
+  description = "CLBot forwards Gerrit notifications to IRC";
+  cfg = config.services.depot.clbot;
+
+  mkFlags = flags:
+    concatStringsSep " "
+      (attrValues (mapAttrs (key: value: "-${key} \"${toString value}\"") flags));
+in {
+  options.services.depot.clbot = {
+    enable = mkEnableOption description;
+    flags = mkOption {
+      type = types.attrsOf types.str;
+      description = "Key value pairs for command line flags";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # This does not use DynamicUser because we need to make some files
+    # (notably the SSH private key) readable by this user outside of
+    # the module.
+    users = {
+      groups.clbot = {};
+
+      users.clbot = {
+        group = "clbot";
+        isNormalUser = false;
+      };
+    };
+
+    systemd.services.clbot = {
+      inherit description;
+      script = "${config.depot.fun.clbot}/bin/clbot ${mkFlags cfg.flags} -alsologtostderr";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = "clbot";
+        EnvironmentFile = "/etc/secrets/clbot";
+        Restart = "always";
+      };
+    };
+  };
+}
diff --git a/users/tazjin/nixos/camden/default.nix b/users/tazjin/nixos/camden/default.nix
index 342729c54a..8927b2e85a 100644
--- a/users/tazjin/nixos/camden/default.nix
+++ b/users/tazjin/nixos/camden/default.nix
@@ -15,10 +15,11 @@ config: let
   };
 in lib.fix(self: {
   imports = [
+    "${depot.depotPath}/ops/nixos/clbot.nix"
     "${depot.depotPath}/ops/nixos/depot.nix"
     "${depot.depotPath}/ops/nixos/monorepo-gerrit.nix"
-    "${depot.depotPath}/ops/nixos/sourcegraph.nix"
     "${depot.depotPath}/ops/nixos/smtprelay.nix"
+    "${depot.depotPath}/ops/nixos/sourcegraph.nix"
     "${depot.depotPath}/ops/nixos/tvl-slapd/default.nix"
     "${pkgs.nixpkgsSrc}/nixos/modules/services/web-apps/gerrit.nix"
   ];
@@ -266,6 +267,27 @@ in lib.fix(self: {
     };
   };
 
+  # Start the Gerrit->IRC bot
+  services.depot.clbot = {
+    enable = true;
+
+    # Almost all configuration values are already correct (well, duh),
+    # see //fun/clbot for details.
+    flags = {
+      gerrit_host = "localhost:29418";
+      gerrit_ssh_auth_username = "clbot";
+      gerrit_ssh_auth_key = "/etc/secrets/clbot-key";
+      irc_server = "qwerty.zxcvbnm.ninja:6697";
+
+      notify_branches = "canon,refs/meta/config";
+      notify_repo = "depot";
+
+      # This secret is read from an environment variable, which is
+      # populated from /etc/secrets/clbot
+      irc_pass = "$CLBOT_PASS";
+    };
+  };
+
   # serve my website(s)
   services.nginx = {
     enable = true;