about summary refs log tree commit diff
path: root/ops
AgeCommit message (Collapse)AuthorFilesLines
2021-12-10 r/3200 refactor(tvl-buildkite): Prepare gerrit credentials helperVincent Ambo1-0/+6
Currently this functionality is provided by a shell script stored in /etc/secrets (which has the password value hardcoded). This needs to happen in a separate commit from the one that changes the pipeline to avoid breaking it (it needs to be deployed first). Change-Id: I680754c828ccefbacfcf0d5c813a4bc19493ba4c
2021-12-10 r/3199 refactor(ops): Move Nix cache secret to agenixVincent Ambo5-3/+35
... and also the public key, just to keep the distribution mechanism the same. Change-Id: Ief14daf9344c0fb99eeb5789c1ec9bfb1f12bee0
2021-12-10 r/3198 refactor(ops): Use besadii configuration from agenixVincent Ambo5-2/+29
We already checked this in, but this commit adds the configuration for making use of it. There are two copies of besadii's JSON configuration with different permissions. Note that the buildkite-graphql-token path needs to be updated in static-pipeline.yml, but this needs to happen in a separate commit after deploy because the pipeline will break otherwise. Change-Id: I6fab4bf1a2e679df7cf76521e2b53bd9dadbac62
2021-12-10 r/3197 refactor(ops): Move grafana secret into agenixVincent Ambo3-1/+3
Change-Id: Id141758135c796881e91d20b950dae74c40d9ab3
2021-12-10 r/3194 fix(tvl-buildkite): Add more missing programs to agent pathVincent Ambo1-0/+2
... this option really is a pitfall! The list of programs is now the same as in the upstream module, plus curl and jq. Change-Id: I29edae4b2400a2724f62df9efa1dc184a8b0af5f
2021-12-10 r/3191 fix(ops/irccat): Avoid permissions issue with LoadCredentials=Vincent Ambo2-15/+8
The DynamicUser + Group configuration does not work as planned, thus the systemd LoadCredentials feature is used instead which makes the file (which itself is only readable by root) available in a memory-backed location only readable by the service. The secret is only available to `ExecStart` commands, so units using this feature can not be used with pre/post units and the like if those commands need secrets. To accommodate this, the merge of configuration files has been moved into the service launch script, which is now the ExecStart= process. For details take a look at https://www.freedesktop.org/software/systemd/man/systemd.exec.html#LoadCredential=ID:PATH Change-Id: I693fe5677cc0d63c7aa485c2c7472457c5262166
2021-12-10 r/3190 fix(tvl-buildkite): Explicitly set runtimePackagesVincent Ambo1-1/+5
It turns out the lib.mkAfter call doesn't behave as expected - only *some* of the packages that are defaulted end up in the $PATH. I suspect this is actually something else, e.g. these packages are always added for some reason or another, and the option is completely overridden every time. Change-Id: I854c7198520d82b00e6338ed0fe653836226dc6d
2021-12-10 r/3189 chore(ops/secrets): Reencrypt with grfn's key includedVincent Ambo7-18/+21
Change-Id: I66df150ab5070a81a92f0741334639df9df1f86f
2021-12-10 r/3188 chore(ops/users): Rotate password for grfnGriffin Smith1-1/+1
Just a regular password rotation, plus I wasn't using argon2 unlike everyone else. Change-Id: Ic57fe79a2dbfdc15397d20f6b2b47c6aac911d29
2021-12-10 r/3187 feat(ops/secrets): Add key for grfnGriffin Smith1-1/+5
Change-Id: I8063ae804932e3815e9a499e0206806818b9b021
2021-12-10 r/3185 fix(tvl-buildkite): Add missing runtimePackages backVincent Ambo1-1/+5
Turns out that the type of this option is not concatenative and it replaces the packages needed to run Buildkite if set. Change-Id: I9f52572bc165bccdd8c6518cfdf7b8967f7a50d0
2021-12-10 r/3184 refactor(ops): Move irccat secret into agenixVincent Ambo4-3/+31
The irccat module uses DynamicUser, so to grant permission to it a new group has been added for irccat. I have some vague memory of DynamicUser + Group not behaving as one would expect, but we'll see what happens. Change-Id: Iab9f6a3f1a53c4133b635458ce173250cc9a3fac
2021-12-10 r/3183 refactor(ops): Move clbot SSH key into agenixVincent Ambo3-2/+8
Change-Id: Iae03ead7dda0509689a76f0d76f9cfeb8434e967
2021-12-10 r/3180 chore(whitby): Remove shadowsocks serviceVincent Ambo1-6/+0
No longer required on whitby. Change-Id: I93951c6b708eae81ddb03df920a4068c1ccde9e7
2021-12-10 r/3178 fix(ops/pipelines): Move :anchor: to static pipelineVincent Ambo2-20/+18
This step would get inserted at the wrong point in the build pipeline otherwise, causing a dependency cycle and causing the pipeline to fail. Change-Id: I534568eec77f74ae6c47276820f8a9e99493a3ea
2021-12-10 r/3177 refactor(ops/pipelines): Move :duck: logic into static pipelineVincent Ambo3-49/+37
This simplifies the fallback logic used in case of Nix evaluation failure and makes it so that the evaluation step itself is the one that is marked as failed in Buildkite. This is possible because the pipeline upload command will insert new steps at the point where it runs in the pipeline, and not later. Change-Id: I870534c004ebc457a1602623c4e5f9c0c68e28fc
2021-12-10 r/3176 refactor(ops): Move buildkite-agent-token into agenixVincent Ambo4-1/+18
Relates to b/161 Change-Id: I5d3a698d437928966d8b78ce9e0ba226c1437655
2021-12-10 r/3175 refactor(ops): Move owothia secret into agenixVincent Ambo4-2/+4
Relates to b/161 Change-Id: I25445281b0dd3c3f3660f8bb0d8337506a1e427b
2021-12-10 r/3174 refactor(ops): Move clbot secret into agenixVincent Ambo4-4/+25
Relates to b/161 Change-Id: I7badf22ff93bb4e8b06e4dd4a8bf880b0bd48f09
2021-12-10 r/3173 feat(ops/secrets): Configure secrets for gerrit-queueVincent Ambo3-0/+16
Adds a systemd EnvironmentFile secret that contains the Gerrit username & password for gerrit-queue. Change-Id: I25acf87764c26774045138402b8a417b6813ee8f
2021-12-10 r/3172 feat(ops/modules): Add module for running gerrit-queueVincent Ambo2-0/+55
This is not yet including the secret configuration for gerrit-queue, and just expects the secret (gerrit username & password) to be available in /etc/secrets. Change-Id: Ia465ef7f3f521c70d606d7fdeba9aa83c7e1b98b
2021-12-10 r/3171 chore(tvl-buildkite): Add jq and curl to agent pathsVincent Ambo1-0/+1
This is required for a simplification of the build pipeline (following CL) and needs to be in a separate commit as it can not be done atomically (merging the other commit to deploy it would immediately break pipelines otherwise). Change-Id: I5d8ec8f3238f79b5518d799486bf98d1d9516c43
2021-12-08 r/3159 feat(ops/secrets): Bootstrap agenix secrets folderVincent Ambo4-0/+15
Sets up the key set and adds an initial secret (besadii config with tokens) to be deployed to whitby. Change-Id: Ic07fd5e66b9e7a533013e04c35e052c2aa11f77d
2021-12-07 r/3150 chore(besadii): Improve error messages on parse failureVincent Ambo1-2/+2
Change-Id: I3cc4637aca8a940a0fdeca2d8bd6ac620ea384c0
2021-12-07 r/3149 fix(ops/besadii): Unquote Gerrit's extra-quotes around emailsVincent Ambo1-0/+6
Gerrit wraps RFC5322 emails in another layer of quotes when passing them as flags, and this needs to be unquoted. Otherwise hook invocations fail with cryptic errors. Change-Id: Ieeb74c662873d99a4154f8cbc92da77b039cb88e
2021-12-07 r/3148 fix(ops): Correctly pass command name to besadii invocationsVincent Ambo2-7/+7
Ensure that besadii sees $0 as the correct command name, since that is the sole mechanism by which its functionality is switched around. There was a lingering commit that introduced this bug and hadn't been deployed in a couple of days. Maybe time to tighten deploy cycles soon ... Change-Id: Ie4284c0f6e5e06d71a71a3702ec7e092260e0ce5
2021-12-06 r/3146 fix(ops/besadii): Pass Build.Author to BuildkiteVincent Ambo1-12/+47
Extracts author information from the flags passed by Gerrit and moves them along to Buildkite. This should display the owners of builds correctly in the UI, rather than marking everything as coming from me. Change-Id: If9efe5553a13f0dbdb8bf3936c1d341ae5922318
2021-12-02 r/3137 refactor(ops/besadii): Get config from home directory by defaultVincent Ambo1-1/+16
Slightly more ergonomic in some setups. Change-Id: I565f2d242852ffd299ef5d5740a47520187dd4b4
2021-12-02 r/3136 refactor(ops/besadii): Generalise for use with non-TVL URLsVincent Ambo1-46/+30
This makes it possible to use besadii for any TVL-ish setup using Gerrit and Buildkite, with the same hook functionality as for TVL. Change-Id: I1144b68d7ec01c4c8e34f7bee4da590f2ff8c53c
2021-12-02 r/3135 feat(ops/besadii): Add other missing configuration keysVincent Ambo1-0/+24
Adds configuration keys and rudimentary validation for all other besadii settings that are currently hardcoded. This adds the config options: * repository: Name of the repository in Gerrit. * branch: Name of the HEAD branch in the repository. * gerritUrl: Base URL of the Gerrit instance * gerritUser: Username of the Gerrit user * gerritPassword: Password of the Gerrit user * buildkiteOrg: Name of the Buildkite organisation * buildkiteProject: Name of the pipeline inside the Buildkite organisation * buildkiteToken: Auth token for Buildkite access All of these configuration options are required. Change-Id: Ie6b109de9cd8484a3773c6351d7fd140f39a49ed
2021-12-02 r/3134 chore(ops/modules): Configure besadii call sites to load configVincent Ambo2-3/+14
On whitby, the besadii config will live in /etc/secrets/besadii.json. This CL updates the call sites to pass this config path to besadii so that it can load Sourcegraph configuration. Change-Id: Ia139b9fa3b827e7a5f2386214390acc6fe19a75a
2021-12-02 r/3133 refactor(ops/besadii): Move Sourcegraph config to a fileVincent Ambo1-20/+56
Initial step towards moving besadii away from hardcoded values and onto config files. This is required because I want to reuse besadii outside of the TVL context. Change-Id: Id4fa7a49c5d4f876a02b202f04a421ab5ba0dcc4
2021-12-02 r/3132 fix(ops/nixery): Temporarily stop serving depot packages in NixeryVincent Ambo1-1/+1
Change the Nixery configuration to use the plain nixpkgs package path instead of the depot path. AFAIK, nobody uses this to fetches depot packages at the moment - but plenty of people fetch non-depot packages. This means that Nixery is cache-busted less often (previously on every commit => every deploy). We'll figure out another way to have a depot Nixery later. Change-Id: Iba632333346181c3d2ce992fbab396ed0d9f86aa
2021-12-01 r/3131 fix(ops/www): Redirect tvl.fyi/blog -> tvl.fyiVincent Ambo1-0/+4
The blog index page is at the root and people may manually edit the URL. Change-Id: I6cdaaaee6223524a9e950584379cfac34f8be160
2021-12-01 r/3125 feat(besadii): Support invocation as different Gerrit hooksVincent Ambo2-68/+119
Removes besadii support for the previously used 'ref-updated' hook and instead introduces support for the 'change-merged' and 'patchset-created' hooks. These hooks more accurately capture the semantics of when besadii should trigger CI builds and using them will avoid problems such as skipping 'canon' builds if chains of CLs are submitted together. Change-Id: Ib90356c069780bf0c0250e56b927e46a5b31ce7f
2021-11-30 r/3118 fix(ops/www): Strip `.html` from TVL blog post URLsVincent Ambo1-0/+8
Change-Id: I4d1f9284ec004931c07c04d614b01f28eedea508
2021-11-29 r/3116 refactor(ops/pipelines): Query build status from Buildkite APIVincent Ambo2-8/+21
Instead of manually tracking the build status through Buildkite metadata, use the Buildkite GraphQL API in the `:duck:` build step (i.e. the one that determines the status of the entire pipeline to be reported back to Gerrit) to fetch the number of failed jobs. This way we have less manual state accounting in the pipeline. The downside is that the GraphQL query embedded here is a little hard to read. Notes: * This needs an access token for Buildkite. We already have one for besadii which is also run by the agents, so I've given it GraphQL permissions and reused it. * I almost introduced a very rare bug here: My initial intuition was to simply `exit $FAILED_JOBS` - in the extremely rare case where `$FAILED_JOBS % 256 = 0` this would mean we would ... fail to fail the build :) Change-Id: I61976b11b591d722494d3010a362b544efe2cb25
2021-11-29 r/3111 chore(ops/users): Update password hash for asmundoVincent Ambo1-1/+1
... some issue snuck in on the first one, as is tradition. Change-Id: I06ce4df82cde26231cd1ab3df500de02e981d9bc
2021-11-29 r/3106 feat(ops/users): Add user asmundoasmundo1-0/+5
Change-Id: Ie666b6556d91513babd884b2ed1140cd6c0ed2a9
2021-11-29 r/3105 refactor(besadii): Rename refUpdated -> buildTriggerVincent Ambo1-34/+40
We are changing the Gerrit hooks which invoke besadii, but this structure will be used for both kinds. Change-Id: Idb1cb0c640d2c42db8e7af39f3ab372a97bfef91
2021-11-28 r/3102 fix(ops/besadii): Trim whitespace of auth tokensVincent Ambo1-4/+7
This is causing failures when trying to update Sourcegraph at least, for good measure I've trimmed both. Change-Id: I40266ee83b4e266ffe50f16bb365eb2e51952513
2021-11-23 r/3088 refactor(readTree): Move 'drvTargets' into readTreeVincent Ambo1-5/+1
This function is also generally useful for readTree consumers that have the concept of subtargets. Change-Id: Ic7fc03380dec6953fb288763a28e50ab3624d233
2021-11-21 r/3078 fix(ops/restic): Move whitby's backup to GleSYS object storageVincent Ambo2-13/+17
Since GCP nuked us, the backups are now moving to GleSYS' S3-compatible object storage. This refactors the restic module to support S3-compatible storage instead of GCP, and switches to the appropriate new secret paths. The secrets were placed on whitby manually and I verified that the backups work. This fixes b/157 Change-Id: I6a9d2b0581967605ce736605a3befb44cdeae7e1 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3883 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-11-06 r/3007 fix(ops/pipelines): Fix tagging of commit revisionsVincent Ambo1-5/+1
It seems that shell variables don't work as expected inside the Buildkite pipeline, so usage of variables has been removed. We also don't echo the revision anymore because of that, but it does still appear in the log of `git push`. Change-Id: I124e3b09af896da898f2a78715ed371651a1c5f8 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3780 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-11-05 r/3005 refactor(ops/pipelines): Move revision tagging into static pipelineVincent Ambo2-14/+18
This makes the revision number available much earlier (before the rest of the pipeline runs, while Nix eval is happening) which should only be a few seconds after a commit to canon. It is also more readable in this shape. Change-Id: Iccbb17dfef6afe68f54fda41e8d10c4dc52b08c2 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3775 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-11-04 r/2999 feat(ops/pipelines): Create revision numbers in CIVincent Ambo1-0/+14
This automatically pushes a new ref at refs/r/$revision to Gerrit whenever a CI run completes on canon. Revision numbers can be fetched from Gerrit with this command: git fetch gerrit "refs/r/*:refs/r/*" Note that this build step requires credentials to be provisioned on the CI runner machine. Change-Id: I37bb14346832f891240aa47bb55affaace3d5f21
2021-10-05 r/2952 fix(ops/users): correct password hash for smitopSmitty' via Issues & Patches1-1/+1
The previous hash had a weird salt length and a trailing newline. This fixes it. Change-Id: I1f03238181d0caad38e1f1dbc477356bc20fc32d Reviewed-on: https://cl.tvl.fyi/c/depot/+/3689 Reviewed-by: tazjin <mail@tazj.in> Tested-by: BuildkiteCI
2021-10-05 r/2951 feat(ops/users): add smitop to userssterni1-0/+5
Change-Id: I1fc67c0e33e1e1add8a4ea53c8c94e90e53d8bd5 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3687 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: tazjin <mail@tazj.in>
2021-10-01 r/2946 feat(whitby): serve static.tvl.{fyi|su} with max cache settingsVincent Ambo2-0/+43
The setup is explained in the comment, but TL;DR: Use the derivation hash of static files to create permanent URLs. Relates to b/151. Change-Id: Ib1ca3a1a00c90a47f4bf39c29a8b4bbf5b215e7d Reviewed-on: https://cl.tvl.fyi/c/depot/+/3664 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2021-10-01 r/2945 feat(ops/dns): add static.tvl.{fyi|su}Vincent Ambo2-3/+5
This hostname can be used for hosting static assets with aggressive caching for everything, or potentially CDNing stuff if we ever have large things here. Change-Id: I10afdad5eb08125d8d09108e9e099f5573362fe5 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3663 Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-12-01T03·55+0000