diff options
| -rw-r--r-- | ops/nixos/clbot.nix | 52 | ||||
| -rw-r--r-- | users/tazjin/nixos/camden/default.nix | 24 |
2 files changed, 75 insertions, 1 deletions
diff --git a/ops/nixos/clbot.nix b/ops/nixos/clbot.nix new file mode 100644 index 000000000000..adcbebd57fd0 --- /dev/null +++ b/ops/nixos/clbot.nix @@ -0,0 +1,52 @@ +# Module that configures CLBot, our Gerrit->IRC info bridge. +{ config, lib, pkgs, ... }: + +let + inherit (builtins) concatStringsSep attrValues mapAttrs; + inherit (lib) + mkEnableOption + mkIf + mkOption + types; + + description = "CLBot forwards Gerrit notifications to IRC"; + cfg = config.services.depot.clbot; + + mkFlags = flags: + concatStringsSep " " + (attrValues (mapAttrs (key: value: "-${key} \"${toString value}\"") flags)); +in { + options.services.depot.clbot = { + enable = mkEnableOption description; + flags = mkOption { + type = types.attrsOf types.str; + description = "Key value pairs for command line flags"; + }; + }; + + config = mkIf cfg.enable { + # This does not use DynamicUser because we need to make some files + # (notably the SSH private key) readable by this user outside of + # the module. + users = { + groups.clbot = {}; + + users.clbot = { + group = "clbot"; + isNormalUser = false; + }; + }; + + systemd.services.clbot = { + inherit description; + script = "${config.depot.fun.clbot}/bin/clbot ${mkFlags cfg.flags} -alsologtostderr"; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + User = "clbot"; + EnvironmentFile = "/etc/secrets/clbot"; + Restart = "always"; + }; + }; + }; +} diff --git a/users/tazjin/nixos/camden/default.nix b/users/tazjin/nixos/camden/default.nix index 342729c54a7f..8927b2e85ae5 100644 --- a/users/tazjin/nixos/camden/default.nix +++ b/users/tazjin/nixos/camden/default.nix @@ -15,10 +15,11 @@ config: let }; in lib.fix(self: { imports = [ + "${depot.depotPath}/ops/nixos/clbot.nix" "${depot.depotPath}/ops/nixos/depot.nix" "${depot.depotPath}/ops/nixos/monorepo-gerrit.nix" - "${depot.depotPath}/ops/nixos/sourcegraph.nix" "${depot.depotPath}/ops/nixos/smtprelay.nix" + "${depot.depotPath}/ops/nixos/sourcegraph.nix" "${depot.depotPath}/ops/nixos/tvl-slapd/default.nix" "${pkgs.nixpkgsSrc}/nixos/modules/services/web-apps/gerrit.nix" ]; @@ -266,6 +267,27 @@ in lib.fix(self: { }; }; + # Start the Gerrit->IRC bot + services.depot.clbot = { + enable = true; + + # Almost all configuration values are already correct (well, duh), + # see //fun/clbot for details. + flags = { + gerrit_host = "localhost:29418"; + gerrit_ssh_auth_username = "clbot"; + gerrit_ssh_auth_key = "/etc/secrets/clbot-key"; + irc_server = "qwerty.zxcvbnm.ninja:6697"; + + notify_branches = "canon,refs/meta/config"; + notify_repo = "depot"; + + # This secret is read from an environment variable, which is + # populated from /etc/secrets/clbot + irc_pass = "$CLBOT_PASS"; + }; + }; + # serve my website(s) services.nginx = { enable = true; |