Skip to content

Commit 567f93d

Browse files
antifuchsMic92
antifuchs
authored and
Mic92
committed
Refactor cachix config into a postBuildStep
It's not necessary to keep the cachix configuration as a special python module key. As the config gets translated into a post_build_step in python, we can just as easily do that in nix, and reduce the layers of indirection that somebody (say, somebody adding a new caching system) has to look through.
1 parent 29ed34b commit 567f93d

File tree

3 files changed

+63
-100
lines changed

3 files changed

+63
-100
lines changed

‎buildbot_nix/buildbot_nix/__init__.py

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1791,20 +1791,6 @@ def configure(self, config: dict[str, Any]) -> None:
17911791

17921792
eval_lock = util.MasterLock("nix-eval")
17931793

1794-
if self.config.cachix is not None:
1795-
self.config.post_build_steps.append(
1796-
models.PostBuildStep(
1797-
name="Upload cachix",
1798-
environment=self.config.cachix.environment,
1799-
command=[
1800-
"cachix",
1801-
"push",
1802-
self.config.cachix.name,
1803-
models.Interpolate("result-%(prop:attr)s"),
1804-
],
1805-
)
1806-
)
1807-
18081794
global DB # noqa: PLW0603
18091795
if DB is None:
18101796
DB = FailedBuildDB(Path("failed_builds.dbm"))

‎buildbot_nix/buildbot_nix/models.py

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -56,42 +56,6 @@ def __init__(self, value: str, **kwargs: Any) -> None:
5656
super().__init__(nix_type="interpolate", value=value)
5757

5858

59-
class CachixConfig(BaseModel):
60-
name: str
61-
62-
signing_key_file: Path | None
63-
auth_token_file: Path | None
64-
65-
@property
66-
def signing_key(self) -> str:
67-
if self.signing_key_file is None:
68-
raise InternalError
69-
return read_secret_file(self.signing_key_file)
70-
71-
@property
72-
def auth_token(self) -> str:
73-
if self.auth_token_file is None:
74-
raise InternalError
75-
return read_secret_file(self.auth_token_file)
76-
77-
# TODO why did the original implementation return an empty env if both files were missing?
78-
@property
79-
def environment(self) -> Mapping[str, str | Interpolate]:
80-
environment = {}
81-
if self.signing_key_file is not None:
82-
environment["CACHIX_SIGNING_KEY"] = Interpolate(
83-
f"%(secret:{self.signing_key_file})s"
84-
)
85-
if self.auth_token_file is not None:
86-
environment["CACHIX_AUTH_TOKEN"] = Interpolate(
87-
f"%(secret:{self.auth_token_file})s"
88-
)
89-
return environment
90-
91-
class Config:
92-
fields = exclude_fields(["signing_key", "auth_token"])
93-
94-
9559
class GiteaConfig(BaseModel):
9660
instance_url: str
9761
topic: str | None
@@ -297,7 +261,6 @@ class WorkerConfig(BaseModel):
297261
class BuildbotNixConfig(BaseModel):
298262
db_url: str
299263
auth_backend: AuthBackendConfig
300-
cachix: CachixConfig | None
301264
gitea: GiteaConfig | None
302265
github: GitHubConfig | None
303266
pull_based: PullBasedConfig | None

‎nix/master.nix

Lines changed: 63 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ let
88
cfg = config.services.buildbot-nix.master;
99
inherit (config.services.buildbot-nix) packages;
1010
inherit (lib) mkRemovedOptionModule mkRenamedOptionModule;
11+
bb-lib = import ./lib.nix;
1112

1213
interpolateType = lib.mkOptionType {
1314
name = "interpolate";
@@ -685,41 +686,7 @@ in
685686
isSystemUser = true;
686687
};
687688

688-
services.buildbot-nix.master.cachix.auth =
689-
lib.mkIf (cfg.cachix.authTokenFile != null || cfg.cachix.signingKeyFile != null)
690-
(
691-
if (cfg.cachix.authTokenFile != null) then
692-
lib.warn
693-
"Obsolete option `services.buildbot-nix.master.cachix.authTokenFile' is used. It was renamed to `services.buildbot-nix.master.cachix.auth.authToken.file'."
694-
{ authToken.file = cfg.cachix.authTokenFile; }
695-
else if (cfg.cachix.signingKeyFile != null) then
696-
lib.warn
697-
"Obsolete option `services.buildbot-nix.master.cachix.signingKeyFile' is used. It was renamed to `services.buildbot-nix.master.cachix.auth.signingKey.file'."
698-
{ signingKey.file = cfg.cachix.signingKeyFile; }
699-
else
700-
throw "Impossible, guarded by mkIf."
701-
);
702-
703689
assertions = [
704-
{
705-
assertion =
706-
let
707-
isNull = x: x == null;
708-
in
709-
isNull cfg.cachix.authTokenFile && isNull cfg.cachix.signingKeyFile
710-
|| isNull cfg.cachix.authTokenFile && cfg.cachix.enable
711-
|| isNull cfg.cachix.signingKeyFile && cfg.cachix.enable;
712-
message = ''
713-
The semantics of `options.services.buildbot-nix.master.cachix` recently changed
714-
slightly, the option `name` is no longer null-able. To enable Cachix support
715-
use `services.buildbot-nix.master.cachix.enable = true`.
716-
717-
Furthermore, the options `services.buildbot-nix.master.cachix.authTokenFile` and
718-
`services.buildbot-nix.master.cachix.signingKeyFile` were renamed to
719-
`services.buildbot-nix.master.cachix.auth.authToken.file` and
720-
`services.buildbot-nix.master.cachix.auth.signingKey.file` respectively.
721-
'';
722-
}
723690
{
724691
assertion = lib.versionAtLeast packages.buildbot.version "4.0.0";
725692
message = ''
@@ -780,15 +747,6 @@ in
780747
(pkgs.formats.json { }).generate "buildbot-nix-config.json" {
781748
db_url = cfg.dbUrl;
782749
auth_backend = cfg.authBackend;
783-
cachix =
784-
if !cfg.cachix.enable then
785-
null
786-
else
787-
{
788-
name = cfg.cachix.name;
789-
signing_key_file = if cfg.cachix.auth ? "signingKey" then "cachix-signing-key" else null;
790-
auth_token_file = if cfg.cachix.auth ? "authToken" then "cachix-auth-token" else null;
791-
};
792750
gitea =
793751
if !cfg.gitea.enable then
794752
null
@@ -902,12 +860,6 @@ in
902860
)
903861
++ lib.optional (cfg.authBackend == "gitea") "gitea-oauth-secret:${cfg.gitea.oauthSecretFile}"
904862
++ lib.optional (cfg.authBackend == "github") "github-oauth-secret:${cfg.github.oauthSecretFile}"
905-
++ lib.optional (
906-
cfg.cachix.enable && cfg.cachix.auth ? "signingKey"
907-
) "cachix-signing-key:${builtins.toString cfg.cachix.auth.signingKey.file}"
908-
++ lib.optional (
909-
cfg.cachix.enable && cfg.cachix.auth ? "authToken"
910-
) "cachix-auth-token:${builtins.toString cfg.cachix.auth.authToken.file}"
911863
++ lib.optionals cfg.gitea.enable [
912864
"gitea-token:${cfg.gitea.tokenFile}"
913865
"gitea-webhook-secret:${cfg.gitea.webhookSecretFile}"
@@ -1031,5 +983,67 @@ in
1031983
'';
1032984
};
1033985
})
986+
(lib.mkIf cfg.cachix.enable {
987+
services.buildbot-nix.master.cachix.auth =
988+
lib.mkIf (cfg.cachix.authTokenFile != null || cfg.cachix.signingKeyFile != null)
989+
(
990+
if (cfg.cachix.authTokenFile != null) then
991+
lib.warn
992+
"Obsolete option `services.buildbot-nix.master.cachix.authTokenFile' is used. It was renamed to `services.buildbot-nix.master.cachix.auth.authToken.file'."
993+
{ authToken.file = cfg.cachix.authTokenFile; }
994+
else if (cfg.cachix.signingKeyFile != null) then
995+
lib.warn
996+
"Obsolete option `services.buildbot-nix.master.cachix.signingKeyFile' is used. It was renamed to `services.buildbot-nix.master.cachix.auth.signingKey.file'."
997+
{ signingKey.file = cfg.cachix.signingKeyFile; }
998+
else
999+
throw "Impossible, guarded by mkIf."
1000+
);
1001+
1002+
assertions = [
1003+
{
1004+
assertion =
1005+
let
1006+
isNull = x: x == null;
1007+
in
1008+
isNull cfg.cachix.authTokenFile && isNull cfg.cachix.signingKeyFile
1009+
|| isNull cfg.cachix.authTokenFile && cfg.cachix.enable
1010+
|| isNull cfg.cachix.signingKeyFile && cfg.cachix.enable;
1011+
message = ''
1012+
The semantics of `options.services.buildbot-nix.master.cachix` recently changed
1013+
slightly, the option `name` is no longer null-able. To enable Cachix support
1014+
use `services.buildbot-nix.master.cachix.enable = true`.
1015+
1016+
Furthermore, the options `services.buildbot-nix.master.cachix.authTokenFile` and
1017+
`services.buildbot-nix.master.cachix.signingKeyFile` were renamed to
1018+
`services.buildbot-nix.master.cachix.auth.authToken.file` and
1019+
`services.buildbot-nix.master.cachix.auth.signingKey.file` respectively.
1020+
'';
1021+
}
1022+
];
1023+
1024+
systemd.services.buildbot-master.serviceConfig.LoadCredential =
1025+
lib.optional (
1026+
cfg.cachix.auth ? "signingKey"
1027+
) "cachix-signing-key:${builtins.toString cfg.cachix.auth.signingKey.file}"
1028+
++ lib.optional (
1029+
cfg.cachix.auth ? "authToken"
1030+
) "cachix-auth-token:${builtins.toString cfg.cachix.auth.authToken.file}";
1031+
1032+
services.buildbot-nix.master.postBuildSteps = [
1033+
{
1034+
name = "Upload cachix";
1035+
environment = {
1036+
CACHIX_SIGNING_KEY = bb-lib.interpolate "%(secret:cachix-signing-key)s";
1037+
CACHIX_AUTH_TOKEN = bb-lib.interpolate "%(secret:cachix-auth-token)s";
1038+
};
1039+
command = [
1040+
"cachix" # note that this is the cachix from the worker's $PATH
1041+
"push"
1042+
cfg.cachix.name
1043+
(bb-lib.interpolate "result-%(prop:attr)s")
1044+
];
1045+
}
1046+
];
1047+
})
10341048
];
10351049
}

0 commit comments

Comments
 (0)