about summary refs log tree commit diff
path: root/ops
AgeCommit message (Collapse)AuthorFilesLines
2022-02-04 r/3769 chore(ops/posix_mq.rs): upgrade to nix 0.23Vincent Ambo3-49/+50
The previous version had a CVE. As part of this upgrade, the handling of errors inside of the Nix crate changed, which we now accommodate. Change-Id: Iad9a473c1782e0d79919cb5dc3f76316852d8a16 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5226 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: sterni <sternenseemann@systemli.org>
2022-02-04 r/3766 fix(ops/posix_mq.rs): use newer struct mem::MaybeUninitVincent Ambo1-42/+20
The previous mem::unitialized method was deprecated in favour of this struct which carries information about the initialisation state forward to the compiler. Change-Id: Ib5f5d1ad91f9957b18eebabc1048f8649bc74049 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5225 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-02-04 r/3765 refactor(ops/posix_mq.rs): Update code using deprecated Error traitVincent Ambo1-18/+21
The previous Error::description method was deprecated. Change-Id: I63efd272484c8715b9f324ab09e967fbf53cf55a Reviewed-on: https://cl.tvl.fyi/c/depot/+/5224 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-31 r/3723 style: format entire depot with nixpkgs-fmtVincent Ambo29-159/+209
This CL can be used to compare the style of nixpkgs-fmt against other formatters (nixpkgs, alejandra). Change-Id: I87c6abff6bcb546b02ead15ad0405f81e01b6d9e Reviewed-on: https://cl.tvl.fyi/c/depot/+/4397 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: lukegb <lukegb@tvl.fyi> Reviewed-by: wpcarro <wpcarro@gmail.com> Reviewed-by: Profpatsch <mail@profpatsch.de> Reviewed-by: kanepyork <rikingcoding@gmail.com> Reviewed-by: tazjin <tazjin@tvl.su> Reviewed-by: cynthia <cynthia@tvl.fyi> Reviewed-by: edef <edef@edef.eu> Reviewed-by: eta <tvl@eta.st> Reviewed-by: grfn <grfn@gws.fyi>
2022-01-29 r/3716 fix(ops/whitby): enable services.nginx.statusPageGriffin Smith1-0/+3
This is necessary for the nginx prometheus exporter to work Change-Id: I2343d6f5d3d6d6772777d5e14426a537aa1c8ef7 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5127 Autosubmit: grfn <grfn@gws.fyi> Reviewed-by: lukegb <lukegb@tvl.fyi> Tested-by: BuildkiteCI
2022-01-29 r/3715 feat(whitby): Enable nginx prometheus exporterGriffin Smith1-7/+22
Might be nice to look at rates of requests etc. Change-Id: I4d12ab0c1a555793e803de4a9614e616951a94e5 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5125 Reviewed-by: lukegb <lukegb@tvl.fyi> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Autosubmit: grfn <grfn@gws.fyi>
2022-01-29 r/3714 feat(ops/secrets): Add secret for telegram alerts bot tokenGriffin Smith2-0/+15
This isn't actually used by anything that would use agenix, but this seems like a vaguely sensible way of sharing the token with other people regardless. Anyone who finds this commit and wants to be added to the telegram channel where the alerts go, lmk. Change-Id: I06d6ed2d4bec099cbf68ede8fd00a5e6f4e7bc60 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5124 Autosubmit: grfn <grfn@gws.fyi> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-01-29 r/3713 fix(www/tvl.fyi): Anchor /blog redirects at #blogVincent Ambo1-2/+2
Since our blog index is on the index page, this makes slightly more sense. Change-Id: I7b8164490c133e23d892abef21275f8bfed50b66 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5123 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-01-29 r/3712 fix(tvl.fyi): Redirect /blog/ (with trailing /) to /Griffin Smith1-0/+4
This was already happening without the trailing slash, but needs to happen separately with it. Fixes: b/172 Change-Id: Ic3423fd7a2eaf76a073badd80965cee953df4ce9 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5121 Tested-by: BuildkiteCI Autosubmit: grfn <grfn@gws.fyi> Reviewed-by: tazjin <tazjin@tvl.su>
2022-01-29 r/3711 feat(ops/www): Write JSON access log to journaldVincent Ambo1-0/+18
This means it will end up in journaldriver. Change-Id: I66f781085b5dac9946b3b9a2bf30e447863e1213 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5122 Reviewed-by: lukegb <lukegb@tvl.fyi> Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su>
2022-01-29 r/3703 feat(ops/glesys): Move tvl.su email over to Yandex 360Vincent Ambo1-39/+18
This fixes b/158 Change-Id: Ie58737dfe144a342b6d4d30f72ec60d70405af31 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5110 Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2022-01-29 r/3702 feat(ops/glesys): Set up Yandex 360 verification record on tvl.suVincent Ambo1-0/+9
Relates to b/158 Change-Id: I6738505bcf0088d35bb7c8f9215dcf0b4e27f9ca Reviewed-on: https://cl.tvl.fyi/c/depot/+/5109 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su>
2022-01-22 r/3659 refactor(ops/pipelines): Move :anchor: into postBuildStepsVincent Ambo2-18/+18
There is no need for this step to be part of the static pipeline (it should not run if the build fails anyways). Change-Id: I71400a452d6f8f4708d146b346eaffda5da2f766 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5049 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-22 r/3658 feat(ops/pipelines): Upload post-build steps in static pipelineVincent Ambo1-0/+15
Change-Id: I5ce6d51837c734951fe10c4f21806cf0fc57ed23 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5048 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-22 r/3657 refactor(ops/pipelines): Split build/post steps into separate chunksVincent Ambo1-1/+1
This will create `build-chunk-$n.json` files for steps that should run _before_ duck, and `post-chunk-$n.json` files for steps that should run after duck. The post steps are not yet uploaded to Buildkite, but we also don't have any right now. Change-Id: I7e1b59cf55a8bf1d97266f6e988aa496959077bf Reviewed-on: https://cl.tvl.fyi/c/depot/+/5047 Tested-by: BuildkiteCI Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com> Autosubmit: tazjin <tazjin@tvl.su>
2022-01-22 r/3656 refactor(ops/pipelines): Use branches filter for canon-only stepsVincent Ambo1-2/+2
Using this instead of a conditional leads to nicer output in the UI, but has no semantic difference. Change-Id: I5b368d663f417d256e4792d2d46b84fc50d42d0e Reviewed-on: https://cl.tvl.fyi/c/depot/+/5045 Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com> Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su>
2022-01-22 r/3655 refactor(ops/pipelines): Move :git: step up in the pipelineVincent Ambo1-14/+15
This step is independent of the build result and can be scheduled at the beginning while pipeline eval is still in progress. Change-Id: I2ee268e4c333efa654dcb12c0b1562b43231d241 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5044 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-22 r/3654 feat(ops/pipelines): Always upload entire pipeline outputVincent Ambo1-1/+1
Previously we only stored the drvmap, but we will also need the build chunks to refactor the generation of dynamic post-steps. Change-Id: I256fffe13af8f8c4521835257f5d87dda323b248 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5043 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-21 r/3653 refactor(depotfmt): Move formatting check into an extra stepVincent Ambo1-8/+1
Change-Id: I7e4cf6bb2351bd11a5396f1663c0d4cc97c0d94e Reviewed-on: https://cl.tvl.fyi/c/depot/+/5009 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-20 r/3650 feat(ops/pipelines): Trigger pipeline for tvl-kit through canonVincent Ambo1-0/+10
This CI pipeline in Buildkite verifies the external (josh-provided) view of the depot at //views/kit. See https://buildkite.com/tvl/tvl-kit Note that this always triggers a build of HEAD. This is because we don't know the transformed commit ID, and we currently have no way to pass a ref through. The pipeline is configured to skip intermediate builds. I asked Buildkite for some ideas on how to improve this, lets see. Change-Id: I6c60fb1ea7606c1c90219ef04fd7bada64661529 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5010 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-19 r/3637 refactor(nix/buildkite): Move fetch-parent-targets script hereVincent Ambo2-42/+1
This is no longer TVL-specific and should live here with the other generalised stuff. Change-Id: I95a1b4c0321f34812162d6fd40568269abf639dd Reviewed-on: https://cl.tvl.fyi/c/depot/+/5006 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-19 r/3636 refactor(ops/pipelines): Generalise fetch-parent-targets scriptVincent Ambo2-14/+15
Removes all TVL-specific values in favour of environment variables supplied by Buildkite. This makes it possible to reuse this script outside of TVL. Change-Id: Ic543bc41e4c81e65ee349ad241c515231e97ab30 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5005 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: ezemtsov <eugene.zemtsov@gmail.com>
2022-01-19 r/3633 feat(ops/besadii): make text 'cl' posted BuildKite configurableÅsmund Østvold1-4/+20
Some companies do not know the 'cl' term. They do know of 'change' and would maybe not like to introduce one more synonym. This cl introduce an optional entry 'gerritChangeName' in besadii.json. The string has to match `^[a-z0-9]+$` for readability. Change-Id: Id70fcb1e45158869f88bf37669be49b8b8a3b295 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4825 Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su> Autosubmit: asmundo <asmundo@gmail.com>
2022-01-17 r/3616 fix(ops/oauth2_proxy): Fix cookie secret lengthVincent Ambo2-1/+1
The cookie secret in the encrypted file was too long, because the generation command in the oauth2_proxy docs is also wrong. Should probably fix that upstream as well. Also noticed that an extra '2' snuck into the service name and fixed that. Change-Id: I9a344a75993ab1f98299a8d45e7f5b2e146b7fc5 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4957 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-17 r/3603 feat(ops/pipelines): Fetch parent target map for pipeline generationVincent Ambo2-1/+51
Change-Id: I1c7d48fc0974549d67146a15f79ddb0b6ddfe805 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4947 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-17 r/3602 feat(nix/buildkite): Check target map of parent to determine skipsVincent Ambo1-2/+6
This changes the logic for build pipeline generation to inspect an (optional) parentTargetMap attribute which contains the derivation map of a target commit. Targets that existed in a parent commit with the same drv hash will be skipped, as they are not considered to have changed. This does not yet wire up any logic for retrieving the target map from storage, meaning that at this commit all targets are always built. The intention is that we will have logic to fetch the target map (initially from Buildkite artefact storage), which we then pass to the depot via externalArgs when actually generating the pipeline. Change-Id: I3373c60aaf4b56b94c6ab64e2e5eef68dea9287c Reviewed-on: https://cl.tvl.fyi/c/depot/+/4946 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-17 r/3601 feat(ops/pipelines): Create drvmap structure for each commitVincent Ambo2-7/+17
Always create a structure that maps all targets to derivations, and persist it as a JSON file. This relates to some of the ideas expressed in: https://docs.google.com/document/d/16A0a5oUxH1VoiSM8hyFyLW0WiUYpNo2e2D6FTW4BlH8/edit The file is always uploaded to Buildkite as an artifact. This allows for retrieving it based on the commit ID in a Buildkite GraphQL query. By default, Buildkite stores artefacts for 6 months. Storage location can be overridden (with custom retention) through some environment variables, but for now at TVL the Buildkite-managed storage is fine. See also: https://buildkite.com/docs/pipelines/artifacts In the subsequent filtering implementation, when diffing commits across a time-range that exceeds artefact retention time, we should simply default to building everything. Change-Id: I6d808461cd1c1fdd6983ba8c8ef075736d42caa7 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3662 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-14 r/3598 fix(gerrit-tvl): Handle "broken" (skipped) jobs correctlyVincent Ambo1-1/+7
by simply skipping them Change-Id: I9cbec3b79469ae01b1873d6a42e990b98cc4110a Reviewed-on: https://cl.tvl.fyi/c/depot/+/4921 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-01-14 r/3597 fix(gerrit-tvl): Exclude non-command jobs from check resultsVincent Ambo1-0/+5
Change-Id: I13727d30ac7a568f02614a4bbc778afed6a286ba Reviewed-on: https://cl.tvl.fyi/c/depot/+/4891 Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi> Autosubmit: tazjin <tazjin@tvl.su>
2022-01-14 r/3596 fix(gerrit-tvl): Explicitly specify patchset on check runsVincent Ambo1-0/+1
Since we now group patchsets inside of Buildkite, the results are no longer guaranteed to be for the right patchset. There might be some metadata passed in from Gerrit that would let us do this with the commit ID instead, but I haven't checked. Change-Id: I5b74a17697511160fcc89d3dbef23517d974dc6f Reviewed-on: https://cl.tvl.fyi/c/depot/+/4890 Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi> Autosubmit: tazjin <tazjin@tvl.su>
2022-01-14 r/3595 fix(gerrit-tvl): Mark job as failed on all failure statesVincent Ambo1-1/+1
Change-Id: If0fa85d8178b9e457305d0244ddf67d12a4b3051 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4889 Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi> Autosubmit: tazjin <tazjin@tvl.su>
2022-01-14 r/3594 fix(gerrit-tvl): Support all documented Buildkite job statusesVincent Ambo1-12/+58
I'm not sure where the previous list originated, but it was missing some officially documented statuses. However, the API definitely returns statuses that are documented to only appear in other types, so this commit simply maps ALL statuses that Buildkite has documented for any type. Also adds a log statement in case we encounter a brand new, unknown, undocumented status. Change-Id: Iff003a3bd2608702019ae0f4137958435ad0856f Reviewed-on: https://cl.tvl.fyi/c/depot/+/4888 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-01-14 r/3593 fix(gerrit-tvl): Fix construction of ref used in BuildkiteVincent Ambo1-3/+2
... and remove a spammy log statement. This changed in besadii a while ago and lead to the behaviour of failing silently, instead of failing with an error saying "undefined undefined". Note that with this change merged the plugin probably still won't work again, but it gets us a step closer to the real error. Change-Id: I3db25d246f4b1c634d316cd92574e27fb220d769 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4887 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2022-01-14 r/3592 feat(besadii): Skip builds of patchsets with no code changesVincent Ambo1-2/+8
Currently Gerrit is configured to copy forward the scores of the 'Verified' label if the tree of the commit does not change (e.g. only author information or commit message is modified). Besadii still triggers builds for these patchsets though. With this change it will inspect the (previously ignored) "kind" of the patchset and skip patchsets with the same tree as their predecessor. See Gerrit docs for the semantics of "kind": https://gerrit-review.googlesource.com/Documentation/json.html#patchSet Note that an argument can be made that we should do the exact opposite - stop carrying over 'Verified' at all and always build all patchsets. I think this depends on whether we intend to use commit metadata in CI runs at all. Adding a few people to the review for opinions. Change-Id: I48a96a1ad1e07d92330d84e5cfdc820a39395297 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4867 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: asmundo <asmundo@gmail.com> Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-13 r/3590 feat(whitby): Install a handful of systemPackagesVincent Ambo1-5/+13
Adds more things I keep using via nix-shell, as well as the deploy-whitby script (which is independent of a particular depot checkout). Change-Id: I36f87de7645768a05268c90ba9b3ab833bacca05 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4881 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-13 r/3589 refactor(deploy-whitby): use nvd instead of nix-diffVincent Ambo2-2/+2
nvd only shows us changed versions of packages, as well as added/removed packages, which means that for the majority of depot packages nothing will be displayed however, the current output of nix-diff is not usable anyways, so having something that can be looked at is better than nothing Change-Id: Iefbd8139c7ccf5c88ed1209897abdb2ae9302e91 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4868 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2022-01-12 r/3588 fix: resolve remaining security.acme.email warningssterni1-1/+1
These were missed in cl/4784. Change-Id: I01a5827900c1b3bdfdf9b1c36dcca8d6b59073a1 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4866 Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su> Reviewed-by: wpcarro <wpcarro@gmail.com> Autosubmit: sterni <sternenseemann@systemli.org>
2022-01-12 r/3585 fix(ops/besadii) no need to ref CL number in post to GerritÅsmund Østvold1-1/+1
The comment posted to the Gerrit change do not need to contain the CL number as it is given by the context of the Gerrit UI. Change-Id: I172645e7f4d82e2fbebe179578babd42ea29737f Reviewed-on: https://cl.tvl.fyi/c/depot/+/4826 Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su> Autosubmit: asmundo <asmundo@gmail.com>
2022-01-08 r/3573 fix(wpcarro/all-systems): Remove diogenes from my top-level systemsWilliam Carroll1-1/+0
When `findSystem` attempts to evaluate `system.config.networking.hostName`, diogenes (because I've refactored its definition) causes the following error: > You're trying to declare a value of type `string' > rather than an attribute-set for the option > `system'! Change-Id: Ib23cb9aa9cadc1f71ad3369c903e587762d12cc0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4830 Reviewed-by: wpcarro <wpcarro@gmail.com> Reviewed-by: lukegb <lukegb@tvl.fyi> Autosubmit: wpcarro <wpcarro@gmail.com> Tested-by: BuildkiteCI
2022-01-07 r/3526 feat(ops/auto-deploy): Support emergency stops via stop fileVincent Ambo1-0/+9
Adds a feature to emergency-stop deploys by simply running `touch /var/lib/auto-deploy/stop`. This can be useful in some situations, especially if there is a process that reconciles service state (so that e.g. stopping the unit's timer would be undone). Change-Id: I233dfac365a578bfa4110eb605b50be079974ba4 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4827 Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi> Reviewed-by: wpcarro <wpcarro@gmail.com>
2022-01-07 r/3525 chore(cache.tvl.su): Raise cache priority to 50Vincent Ambo1-0/+5
The priority of binary caches is decided by the remotes in Nix (???), and by default nix-serve (which is *very* slow) has a lower priority than cache.nixos.org (which means that it will be preferred over the faster cache for paths that exist on both). To avoid this, override the hardcoded (????) priority by serving the nix-cache-info response directly from nginx instead. Change-Id: I15a2d6618386d16edaf69f1c9257a36bd72132d2 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4823 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: grfn <grfn@gws.fyi>
2022-01-07 r/3524 revert: "fix(ops/pipelines): Remove duplicated wait step"tazjin1-0/+4
This reverts commit 5e036ed9fc579d14353eb7da4af4b426c99f96e6. Reason for revert: This introduced a logic error since the remaining step runs at the wrong point in the pipeline. Temporarily reverting to having duplicated waits in order to clean up later. Change-Id: Ifa6ece50dd22924f02efd7b790a5863ca1189af7 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4841 Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su> Autosubmit: tazjin <tazjin@tvl.su>
2022-01-04 r/3518 feat(ops): Add initial oauth2_proxy configurationVincent Ambo4-0/+58
The intent is to configure oauth2_proxy pointing at Keycloak to enable usage with nginx auth_request directives. I want to expose this as a function from within the module in which nginx server configuration blocks can be wrapped, but the function for that is currently a placeholder. Change-Id: I5ed7deb9bf1c62818f516e68c33e8c5b632fccfe Reviewed-on: https://cl.tvl.fyi/c/depot/+/4767 Tested-by: BuildkiteCI Reviewed-by: grfn <grfn@gws.fyi>
2022-01-04 r/3517 chore(ops): Remove login.tvl.fyi moduleVincent Ambo2-25/+0
It looks like we won't need this for oauth2_proxy when combined with nginx auth_request setups. Change-Id: I2294aee6226b4f64a27bf6592c2d18092d0268cc Reviewed-on: https://cl.tvl.fyi/c/depot/+/4766 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: grfn <grfn@gws.fyi>
2022-01-02 r/3512 fix(ops/pipelines): Realise anchor derivation for rootingVincent Ambo1-1/+1
Turns the anchor derivation into something that can actually be built (a call creating a propagated build inputs file), and builds it. This should fix the anchoring logic we have on canon. Change-Id: If6a7662b82e2e396388980f65e332cf67a45b46e Reviewed-on: https://cl.tvl.fyi/c/depot/+/4763 Tested-by: BuildkiteCI Autosubmit: tazjin <mail@tazj.in> Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-02 r/3511 refactor(ops/keycloak): Split out clients & user-sourcesVincent Ambo3-106/+113
Without some kind of physical organisation it's a little difficult to understand whether things are going "in" (supplying users to Keycloak) or "out" (getting auth/user info from Keycloak). Change-Id: I516501081e3448c81c710fcbc79cc68ad2a80f3b Reviewed-on: https://cl.tvl.fyi/c/depot/+/4762 Tested-by: BuildkiteCI Reviewed-by: Profpatsch <mail@profpatsch.de>
2022-01-02 r/3510 fix(ops/pipelines): Remove duplicated wait stepVincent Ambo1-4/+0
This now happens in //nix/buildkite instead Change-Id: Ie9e239ee4f28ac34aa4d3279dac55d70a2cb9d86 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4764 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
2022-01-01 r/3509 refactor(modules/smtprelay): Load credentials via agenixVincent Ambo2-7/+15
Change-Id: I56f6887e1fd35551cfc83ad08cafebb611f4a341 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4760 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: Profpatsch <mail@profpatsch.de> Autosubmit: tazjin <mail@tazj.in>
2022-01-01 r/3508 feat(ops/secrets): Add smtprelay credentialsVincent Ambo2-0/+15
Change-Id: I489e611a3fb19b4a374a563aa1afd81a130b2e7f Reviewed-on: https://cl.tvl.fyi/c/depot/+/4759 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Autosubmit: tazjin <mail@tazj.in>
2021-12-28 r/3495 fix(ops/keycloak): redefine buildkite client, correctly this timeVincent Ambo1-15/+26
This client definition was previously nonsense. What happened is that I accidentally imported the client as an OIDC client, which Keycloak accepted because apparently those are the same entities on the API level, and that ended up getting mangled into some broken hybrid shape by Terraform. This sets up the Buildkite provider again but with the correct SAML configuration this time. Change-Id: Id7ba318984d2fcc9e2ca91ed45ccbfd227278bbe Reviewed-on: https://cl.tvl.fyi/c/depot/+/4731 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi> Autosubmit: tazjin <mail@tazj.in>
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-12-15T15·10+0000