Skip to content

Commit 04f1424

Browse files
Mic92Mic92
authored
Merge pull request #400 from antifuchs/despecialize-cachix
Rewrite cachix config as pure nix
2 parents b9568a8 + a0949da commit 04f1424

File tree

6 files changed

+429
-450
lines changed

6 files changed

+429
-450
lines changed

‎buildbot_nix/buildbot_nix/__init__.py

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1791,20 +1791,6 @@ def configure(self, config: dict[str, Any]) -> None:
17911791

17921792
eval_lock = util.MasterLock("nix-eval")
17931793

1794-
if self.config.cachix is not None:
1795-
self.config.post_build_steps.append(
1796-
models.PostBuildStep(
1797-
name="Upload cachix",
1798-
environment=self.config.cachix.environment,
1799-
command=[
1800-
"cachix",
1801-
"push",
1802-
self.config.cachix.name,
1803-
models.Interpolate("result-%(prop:attr)s"),
1804-
],
1805-
)
1806-
)
1807-
18081794
global DB # noqa: PLW0603
18091795
if DB is None:
18101796
DB = FailedBuildDB(Path("failed_builds.dbm"))

‎buildbot_nix/buildbot_nix/models.py

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -56,42 +56,6 @@ def __init__(self, value: str, **kwargs: Any) -> None:
5656
super().__init__(nix_type="interpolate", value=value)
5757

5858

59-
class CachixConfig(BaseModel):
60-
name: str
61-
62-
signing_key_file: Path | None
63-
auth_token_file: Path | None
64-
65-
@property
66-
def signing_key(self) -> str:
67-
if self.signing_key_file is None:
68-
raise InternalError
69-
return read_secret_file(self.signing_key_file)
70-
71-
@property
72-
def auth_token(self) -> str:
73-
if self.auth_token_file is None:
74-
raise InternalError
75-
return read_secret_file(self.auth_token_file)
76-
77-
# TODO why did the original implementation return an empty env if both files were missing?
78-
@property
79-
def environment(self) -> Mapping[str, str | Interpolate]:
80-
environment = {}
81-
if self.signing_key_file is not None:
82-
environment["CACHIX_SIGNING_KEY"] = Interpolate(
83-
f"%(secret:{self.signing_key_file})s"
84-
)
85-
if self.auth_token_file is not None:
86-
environment["CACHIX_AUTH_TOKEN"] = Interpolate(
87-
f"%(secret:{self.auth_token_file})s"
88-
)
89-
return environment
90-
91-
class Config:
92-
fields = exclude_fields(["signing_key", "auth_token"])
93-
94-
9559
class GiteaConfig(BaseModel):
9660
instance_url: str
9761
topic: str | None
@@ -297,7 +261,6 @@ class WorkerConfig(BaseModel):
297261
class BuildbotNixConfig(BaseModel):
298262
db_url: str
299263
auth_backend: AuthBackendConfig
300-
cachix: CachixConfig | None
301264
gitea: GiteaConfig | None
302265
github: GitHubConfig | None
303266
pull_based: PullBasedConfig | None

‎flake.nix

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,7 @@
7676
in
7777
examplesFor "x86_64-linux" // examplesFor "aarch64-linux";
7878

79-
lib = {
80-
interpolate = value: {
81-
_type = "interpolate";
82-
inherit value;
83-
};
84-
};
79+
lib = import ./nix/lib.nix;
8580
};
8681
perSystem =
8782
{

‎nix/cachix.nix

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
lib,
3+
pkgs,
4+
config,
5+
...
6+
}:
7+
let
8+
cfg = config.services.buildbot-nix.master;
9+
bb-lib = import ./lib.nix;
10+
in
11+
{
12+
options.services.buildbot-nix.master.cachix = {
13+
enable = lib.mkEnableOption "Enable Cachix integration";
14+
15+
name = lib.mkOption {
16+
type = lib.types.str;
17+
description = "Cachix name";
18+
};
19+
20+
auth = lib.mkOption {
21+
type = lib.types.attrTag {
22+
signingKey = lib.mkOption {
23+
description = ''
24+
Use a signing key to authenticate with Cachix.
25+
'';
26+
27+
type = lib.types.submodule {
28+
options.file = lib.mkOption {
29+
type = lib.types.path;
30+
description = ''
31+
Path to a file containing the signing key.
32+
'';
33+
};
34+
};
35+
};
36+
37+
authToken = lib.mkOption {
38+
description = ''
39+
Use an authentication token to authenticate with Cachix.
40+
'';
41+
42+
type = lib.types.submodule {
43+
options.file = lib.mkOption {
44+
type = lib.types.path;
45+
description = ''
46+
Path to a file containing the authentication token.
47+
'';
48+
};
49+
};
50+
};
51+
};
52+
};
53+
54+
signingKeyFile = lib.mkOption {
55+
type = lib.types.nullOr lib.types.path;
56+
default = null;
57+
visible = false;
58+
description = "Cachix signing key";
59+
};
60+
61+
authTokenFile = lib.mkOption {
62+
type = lib.types.nullOr lib.types.path;
63+
default = null;
64+
visible = false;
65+
description = "Cachix auth token";
66+
};
67+
};
68+
69+
config = lib.mkIf cfg.cachix.enable {
70+
services.buildbot-nix.master.cachix.auth =
71+
lib.mkIf (cfg.cachix.authTokenFile != null || cfg.cachix.signingKeyFile != null)
72+
(
73+
if (cfg.cachix.authTokenFile != null) then
74+
lib.warn
75+
"Obsolete option `services.buildbot-nix.master.cachix.authTokenFile' is used. It was renamed to `services.buildbot-nix.master.cachix.auth.authToken.file'."
76+
{ authToken.file = cfg.cachix.authTokenFile; }
77+
else if (cfg.cachix.signingKeyFile != null) then
78+
lib.warn
79+
"Obsolete option `services.buildbot-nix.master.cachix.signingKeyFile' is used. It was renamed to `services.buildbot-nix.master.cachix.auth.signingKey.file'."
80+
{ signingKey.file = cfg.cachix.signingKeyFile; }
81+
else
82+
throw "Impossible, guarded by mkIf."
83+
);
84+
85+
assertions = [
86+
{
87+
assertion =
88+
let
89+
isNull = x: x == null;
90+
in
91+
isNull cfg.cachix.authTokenFile && isNull cfg.cachix.signingKeyFile
92+
|| isNull cfg.cachix.authTokenFile && cfg.cachix.enable
93+
|| isNull cfg.cachix.signingKeyFile && cfg.cachix.enable;
94+
message = ''
95+
The semantics of `options.services.buildbot-nix.master.cachix` recently changed
96+
slightly, the option `name` is no longer null-able. To enable Cachix support
97+
use `services.buildbot-nix.master.cachix.enable = true`.
98+
99+
Furthermore, the options `services.buildbot-nix.master.cachix.authTokenFile` and
100+
`services.buildbot-nix.master.cachix.signingKeyFile` were renamed to
101+
`services.buildbot-nix.master.cachix.auth.authToken.file` and
102+
`services.buildbot-nix.master.cachix.auth.signingKey.file` respectively.
103+
'';
104+
}
105+
];
106+
107+
systemd.services.buildbot-master.serviceConfig.LoadCredential =
108+
lib.optional (
109+
cfg.cachix.auth ? "signingKey"
110+
) "cachix-signing-key:${builtins.toString cfg.cachix.auth.signingKey.file}"
111+
++ lib.optional (
112+
cfg.cachix.auth ? "authToken"
113+
) "cachix-auth-token:${builtins.toString cfg.cachix.auth.authToken.file}";
114+
115+
services.buildbot-nix.master.postBuildSteps = [
116+
{
117+
name = "Upload cachix";
118+
environment = lib.mkMerge [
119+
(lib.optionalAttrs (cfg.cachix.auth ? "signingKey") {
120+
CACHIX_SIGNING_KEY = bb-lib.interpolate "%(secret:cachix-signing-key)s";
121+
})
122+
(lib.optionalAttrs (cfg.cachix.auth ? "authToken") {
123+
CACHIX_AUTH_TOKEN = bb-lib.interpolate "%(secret:cachix-auth-token)s";
124+
})
125+
];
126+
command = [
127+
"cachix" # note that this is the cachix from the worker's $PATH
128+
"push"
129+
cfg.cachix.name
130+
(bb-lib.interpolate "result-%(prop:attr)s")
131+
];
132+
}
133+
];
134+
};
135+
}

‎nix/lib.nix

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
interpolate = value: {
3+
_type = "interpolate";
4+
inherit value;
5+
};
6+
}

0 commit comments

Comments
 (0)