about summary refs log tree commit diff
AgeCommit message (Collapse)AuthorFilesLines
2021-12-10 r/3198 refactor(ops): Use besadii configuration from agenixVincent Ambo5-2/+29
We already checked this in, but this commit adds the configuration for making use of it. There are two copies of besadii's JSON configuration with different permissions. Note that the buildkite-graphql-token path needs to be updated in static-pipeline.yml, but this needs to happen in a separate commit after deploy because the pipeline will break otherwise. Change-Id: I6fab4bf1a2e679df7cf76521e2b53bd9dadbac62
2021-12-10 r/3197 refactor(ops): Move grafana secret into agenixVincent Ambo3-1/+3
Change-Id: Id141758135c796881e91d20b950dae74c40d9ab3
2021-12-10 r/3196 feat(tvl.el): Add autosubmit feature to magit-gerrit-rubberstampVincent Ambo1-4/+6
This makes this function a true rubberstamp again, leading to rubberstamped CLs automatically being merged after CI passes. This is similar to the initial functionality we had last year, where this directly submitted changes, but with the addition of the CI checks. Change-Id: I946b074b968eb18a64c4edb0043f7a4af28759b4
2021-12-10 r/3195 feat(tvl.el): Add shortcut for push with Autosubmit+1Vincent Ambo1-0/+11
This almost makes for a sort of fire&forget button, except we don't have a way to automatically pick reviewers yet :) Change-Id: I6f446270f8aaf0409ccb6321bdbb5c349079cd19
2021-12-10 r/3194 fix(tvl-buildkite): Add more missing programs to agent pathVincent Ambo1-0/+2
... this option really is a pitfall! The list of programs is now the same as in the upstream module, plus curl and jq. Change-Id: I29edae4b2400a2724f62df9efa1dc184a8b0af5f
2021-12-10 r/3193 fix(3p/apereo-cas): Mitigate CVE-2021-44228Bartosz Stebel1-1/+1
Same approach as in cl/4270. Change-Id: I3a5a3533ab97513a4b9d8cacc26d013b58441f93
2021-12-10 r/3192 feat(depot): Add grfn and sterni to top-level ownersVincent Ambo1-0/+2
Change-Id: Id2012e3ec6db21ff724245095a99d36ff9d7ad71
2021-12-10 r/3191 fix(ops/irccat): Avoid permissions issue with LoadCredentials=Vincent Ambo2-15/+8
The DynamicUser + Group configuration does not work as planned, thus the systemd LoadCredentials feature is used instead which makes the file (which itself is only readable by root) available in a memory-backed location only readable by the service. The secret is only available to `ExecStart` commands, so units using this feature can not be used with pre/post units and the like if those commands need secrets. To accommodate this, the merge of configuration files has been moved into the service launch script, which is now the ExecStart= process. For details take a look at https://www.freedesktop.org/software/systemd/man/systemd.exec.html#LoadCredential=ID:PATH Change-Id: I693fe5677cc0d63c7aa485c2c7472457c5262166
2021-12-10 r/3190 fix(tvl-buildkite): Explicitly set runtimePackagesVincent Ambo1-1/+5
It turns out the lib.mkAfter call doesn't behave as expected - only *some* of the packages that are defaulted end up in the $PATH. I suspect this is actually something else, e.g. these packages are always added for some reason or another, and the option is completely overridden every time. Change-Id: I854c7198520d82b00e6338ed0fe653836226dc6d
2021-12-10 r/3189 chore(ops/secrets): Reencrypt with grfn's key includedVincent Ambo7-18/+21
Change-Id: I66df150ab5070a81a92f0741334639df9df1f86f
2021-12-10 r/3188 chore(ops/users): Rotate password for grfnGriffin Smith1-1/+1
Just a regular password rotation, plus I wasn't using argon2 unlike everyone else. Change-Id: Ic57fe79a2dbfdc15397d20f6b2b47c6aac911d29
2021-12-10 r/3187 feat(ops/secrets): Add key for grfnGriffin Smith1-1/+5
Change-Id: I8063ae804932e3815e9a499e0206806818b9b021
2021-12-10 r/3186 fix(clbot): Use change *owner* and not *uploader*Vincent Ambo1-6/+6
In autosubmit cases that require rebases, the change *uploader* might be clbot which would cause besadii to use clbot as the owner. This is incorrect, but luckily the change-merged event has an actual owner field instead. Change-Id: Ia35b52085f94628e61eb358807b3b85565521b60
2021-12-10 r/3185 fix(tvl-buildkite): Add missing runtimePackages backVincent Ambo1-1/+5
Turns out that the type of this option is not concatenative and it replaces the packages needed to run Buildkite if set. Change-Id: I9f52572bc165bccdd8c6518cfdf7b8967f7a50d0
2021-12-10 r/3184 refactor(ops): Move irccat secret into agenixVincent Ambo4-3/+31
The irccat module uses DynamicUser, so to grant permission to it a new group has been added for irccat. I have some vague memory of DynamicUser + Group not behaving as one would expect, but we'll see what happens. Change-Id: Iab9f6a3f1a53c4133b635458ce173250cc9a3fac
2021-12-10 r/3183 refactor(ops): Move clbot SSH key into agenixVincent Ambo3-2/+8
Change-Id: Iae03ead7dda0509689a76f0d76f9cfeb8434e967
2021-12-10 r/3182 refactor(gerrit-queue): Remove dependency on ginVincent Ambo4-28/+5
Unnecessary dependency & complexity. (Patch originally contributed by an anonymous contributor) Change-Id: Id49dc362cb0c1b29937404447bb0b1f9794dc117
2021-12-10 r/3181 refactor(gerrit-queue): Gracefully handle missing changesetsVincent Ambo1-2/+10
(Patch contributed by an anonymous contributor) Change-Id: I29fd7dd008d4e509ea074a38d3948946b26da7ab
2021-12-10 r/3180 chore(whitby): Remove shadowsocks serviceVincent Ambo1-6/+0
No longer required on whitby. Change-Id: I93951c6b708eae81ddb03df920a4068c1ccde9e7
2021-12-10 r/3179 feat(fun/clbot): Add distinct messages for auto-submitted CLsVincent Ambo1-2/+13
Detects autosubmitted CLs (other people's CLs submitted by clbot) and modifies the text submitted to IRC accordingly. If a CL is autosubmitted, we opt to highlight its author rather than invoking noping. Change-Id: Ibc21b7eeb2f0f2087097404baef6976384d68b09
2021-12-10 r/3178 fix(ops/pipelines): Move :anchor: to static pipelineVincent Ambo2-20/+18
This step would get inserted at the wrong point in the build pipeline otherwise, causing a dependency cycle and causing the pipeline to fail. Change-Id: I534568eec77f74ae6c47276820f8a9e99493a3ea
2021-12-10 r/3177 refactor(ops/pipelines): Move :duck: logic into static pipelineVincent Ambo3-49/+37
This simplifies the fallback logic used in case of Nix evaluation failure and makes it so that the evaluation step itself is the one that is marked as failed in Buildkite. This is possible because the pipeline upload command will insert new steps at the point where it runs in the pipeline, and not later. Change-Id: I870534c004ebc457a1602623c4e5f9c0c68e28fc
2021-12-10 r/3176 refactor(ops): Move buildkite-agent-token into agenixVincent Ambo4-1/+18
Relates to b/161 Change-Id: I5d3a698d437928966d8b78ce9e0ba226c1437655
2021-12-10 r/3175 refactor(ops): Move owothia secret into agenixVincent Ambo4-2/+4
Relates to b/161 Change-Id: I25445281b0dd3c3f3660f8bb0d8337506a1e427b
2021-12-10 r/3174 refactor(ops): Move clbot secret into agenixVincent Ambo4-4/+25
Relates to b/161 Change-Id: I7badf22ff93bb4e8b06e4dd4a8bf880b0bd48f09
2021-12-10 r/3173 feat(ops/secrets): Configure secrets for gerrit-queueVincent Ambo3-0/+16
Adds a systemd EnvironmentFile secret that contains the Gerrit username & password for gerrit-queue. Change-Id: I25acf87764c26774045138402b8a417b6813ee8f
2021-12-10 r/3172 feat(ops/modules): Add module for running gerrit-queueVincent Ambo2-0/+55
This is not yet including the secret configuration for gerrit-queue, and just expects the secret (gerrit username & password) to be available in /etc/secrets. Change-Id: Ia465ef7f3f521c70d606d7fdeba9aa83c7e1b98b
2021-12-10 r/3171 chore(tvl-buildkite): Add jq and curl to agent pathsVincent Ambo1-0/+1
This is required for a simplification of the build pipeline (following CL) and needs to be in a separate commit as it can not be done atomically (merging the other commit to deploy it would immediately break pipelines otherwise). Change-Id: I5d8ec8f3238f79b5518d799486bf98d1d9516c43
2021-12-09 r/3170 subtree(3p/gerrit-queue): Vendor at commit '24f5a642'Vincent Ambo21-0/+1641
Imported from github/tvlfyi/gerrit-queue, originally from github/tweag/gerrit-queue but that upstream is unmaintained. git-subtree-dir: third_party/gerrit-queue git-subtree-mainline: ff10b7ab8303d050a8d7d751611da88bc13a75b4 git-subtree-split: 24f5a642af3aa1627bbff977f0a101907a02c69f Change-Id: I307cc38185ab9e25eb102c95096298a150ae13a2
2021-12-09 r/3169 chore(3p): Remove gerrit-queue folder in preparation for vendoringVincent Ambo2-219/+0
The upstream isn't really maintained anymore, so we may as well take it over since we're patching it anyways. Change-Id: I7dddc03ab90b00611520a77a26e73a5be1c2cfb8
2021-12-09 r/3168 feat(3p/gerrit-queue): Patch to use Gerrit 'Autosubmit' labelVincent Ambo2-0/+193
... instead of a hashtag in Gerrit. Might be easier to review here: https://github.com/tvlfyi/gerrit-queue/commit/24f5a642af3aa1627bbff977f0a101907a02c69f Change-Id: I1ae8d4607f7cb858135f88411c82e1a353b28105
2021-12-09 r/3167 feat(3p/gerrit-queue): Add derivation for gerrit-queueVincent Ambo1-0/+26
This is a Gerrit autosubmit bot (actually written by flokli) which we intend to use. For now we're using the plain upstream version, but we'll want to patch some of the behaviours of it so there's a vendoring on the horizon. Change-Id: I021d41b55f9f678435d9aec6d359545577cb9ec0
2021-12-09 gerrit: Use a Gerrit label instead of hashtag for autosubmitVincent Ambo5-44/+17
This moves to using a Gerrit label ('Autosubmit') with boolean values for determining whether a developer wants to have a change automatically submitted. See also https://cl.tvl.fyi/c/depot/+/4172
2021-12-09 r/3166 fix(tazjin/emacs): Gerrit remote is now 'origin'Vincent Ambo1-3/+1
Change-Id: I44998510ff4be2fa137ea4c81f888e63ea438a56
2021-12-09 r/3165 feat(tazjin/russian): Add words 601-700Vincent Ambo1-2/+103
Change-Id: I17b1362502952d96b8787ad3c055d66f212fd60b
2021-12-09 r/3164 feat(grfn/emacs): Tweak rust async_test snippetsGriffin Smith1-2/+2
Add a stop at the `flavor` argument, since some async tests can use the default config. Change-Id: Iffd726b304d0d9dd94938bf23b2688715d1f4e20
2021-12-09 r/3163 feat(tvl.el): Add magit-gerrit-cherry-pickGriffin Smith1-0/+20
Bound to `A g`, this behaves similarly to `magit-gerrit-checkout` - it prompts for a CL number, then cherry-picks the latest patchset of that CL number Change-Id: Ieef970b99d96170e8c960cc7687ead9022948f8b
2021-12-09 r/3162 feat(grfn/emacs): Add a prolog use_module snippetGriffin Smith1-0/+7
Change-Id: Ib5226a1ad0f084d3755cbfe40bf3556b3fa7fb2b
2021-12-09 r/3161 feat(grfn/emacs): Add some prolog-mode mappingsGriffin Smith1-1/+3
Change-Id: If1677024f9a211eee5d42a03413b5058dd797b9a
2021-12-08 r/3160 Merge "subtree(3p/exwm): Update to upstream '10bd1223'" into canontazjin12-22/+32
2021-12-08 subtree(3p/exwm): Update to upstream '10bd1223'Vincent Ambo12-22/+32
A lot has happened in the meantime (EXWM maintainer change) and this pulls in all the relevant changes since then. It may become unnecessary to keep EXWM subtreed, but we'll get to that later. Change-Id: I45cc06d747d84b3d28fd0db0e4bb3b749a956583
2021-12-08 r/3159 feat(ops/secrets): Bootstrap agenix secrets folderVincent Ambo4-0/+15
Sets up the key set and adds an initial secret (besadii config with tokens) to be deployed to whitby. Change-Id: Ic07fd5e66b9e7a533013e04c35e052c2aa11f77d
2021-12-08 r/3158 fix(readTree): Apply .skip-subtree to Nix-file children as wellVincent Ambo1-1/+2
This behaviour was previously confusing, since readTree's data structure treats children from Nix files and directories as identical but only one of them would be affected by .skip-subtree The "subtree" to be skipped here refers to all children of the structure. Change-Id: Idf596c9823f09cc2acf49523916bde4b801b8519
2021-12-08 r/3157 feat(tazjin/russian): Add words 551-600Vincent Ambo1-2/+50
Change-Id: Ie2a670fc2aa24457a9fc7f3f22d5336d97e7789f
2021-12-08 r/3156 feat(tazjin/russian): Add words 501-550Vincent Ambo1-1/+54
Change-Id: Id9e4b9eb5e330a5331ca0cc2c7af2c4ade4a6ace
2021-12-08 r/3155 feat(tazjin/russian): Add words 451-500Vincent Ambo1-2/+52
Change-Id: I5e0c8d61be0c0170370298aa4c6ee0a6607f24b7
2021-12-08 r/3154 feat(tazjin/russian): Add words 401-450Vincent Ambo1-1/+53
Change-Id: I1101ebf2252390fc4ae308de43f09f606118615b
2021-12-07 r/3153 chore(3p): bump NixOS unstable to 2021-12-07sterni1-3/+3
Contains fix for unauthentictaed arbitrary file system access in grafana. Change-Id: Ic15f5376be32fb03b20824d1efb2f837ca2b2411
2021-12-07 r/3152 fix(tvl.el): s/fourth/cadddrGriffin Smith1-1/+1
Apparently some emacsen don't have functions like `fourth` etc. Change-Id: I3d8b698685ce3b1757b427b32d8e27938cc26661
2021-12-07 r/3151 feat(3p/agenix): Import latest version from GitHubVincent Ambo2-0/+16
It's time to automate secrets deployment on hosts like whitby. Change-Id: If7006124b4b5fec16b4c3570488c11e484f93888
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-12-21T16·31+0000