feat(monorepo-gerrit): Enable Gerrit hooks & configure besadii r/932

Loads the 'hooks' plugin into Gerrit, which - as per my interpretation
of the docs - is going to execute any hooks for which there are
matching binaries.

The intention here is that besadii should implement most of the hooks
we care about. As a start, it is symlinked here to the `ref-updated`
hook.

Change-Id: I6482a9d71cc08908c29dd10f786cbba32b33d04d

1 files changed, 11 insertions, 2 deletions

diff --git a/ops/nixos/modules/monorepo-gerrit.nix b/ops/nixos/modules/monorepo-gerrit.nix
index c4c2cd0f9f..a5ba6c6844 100644
--- a/ops/nixos/modules/monorepo-gerrit.nix
+++ b/ops/nixos/modules/monorepo-gerrit.nix
@@ -1,19 +1,28 @@
 # Gerrit configuration for the TVL monorepo
 { pkgs, config, lib, ... }:
 
-let cfg = config.services.gerrit;
+let
+  cfg = config.services.gerrit;
+  gerritHooks = pkgs.runCommandNoCC "gerrit-hooks" {} ''
+    mkdir -p $out/bin
+    ln -s ${config.depot.ops.besadii}/bin/besadii $out/bin/ref-updated
+  '';
 in {
   services.gerrit = {
     enable = true;
     listenAddress = "[::]:4778"; # 4778 - grrt
     serverId = "4fdfa107-4df9-4596-8e0a-1d2bbdd96e36";
-    builtinPlugins = [ "download-commands" ];
+    builtinPlugins = [
+      "download-commands"
+      "hooks"
+    ];
 
     settings = {
       core.packedGitLimit = "100m";
       log.jsonLogging = true;
       log.textLogging = false;
       sshd.advertisedAddress = "code.tvl.fyi:29418";
+      hooks.path = "${gerritHooks}";
 
       # Configures gerrit for being reverse-proxied by nginx as per
       # https://gerrit-review.googlesource.com/Documentation/config-reverseproxy.html