|
843 | 843 | path = [ pkgs.openssl ];
|
844 | 844 | serviceConfig = {
|
845 | 845 | # in master.py we read secrets from $CREDENTIALS_DIRECTORY
|
846 |
| - LoadCredential = |
847 |
| - [ "buildbot-nix-workers:${cfg.workersFile}" ] |
848 |
| - ++ lib.optionals cfg.github.enable ( |
849 |
| - [ "github-webhook-secret:${cfg.github.webhookSecretFile}" ] |
850 |
| - ++ lib.optional ( |
851 |
| - cfg.github.authType ? "legacy" |
852 |
| - ) "github-token:${cfg.github.authType.legacy.tokenFile}" |
853 |
| - ++ lib.optional ( |
854 |
| - cfg.github.authType ? "app" |
855 |
| - ) "github-app-secret-key:${cfg.github.authType.app.secretKeyFile}" |
856 |
| - ) |
857 |
| - ++ lib.optional (cfg.authBackend == "gitea") "gitea-oauth-secret:${cfg.gitea.oauthSecretFile}" |
858 |
| - ++ lib.optional (cfg.authBackend == "github") "github-oauth-secret:${cfg.github.oauthSecretFile}" |
859 |
| - ++ lib.optionals cfg.gitea.enable [ |
860 |
| - "gitea-token:${cfg.gitea.tokenFile}" |
861 |
| - "gitea-webhook-secret:${cfg.gitea.webhookSecretFile}" |
862 |
| - ] |
863 |
| - ++ lib.mapAttrsToList ( |
864 |
| - repoName: path: "effects-secret__${cleanUpRepoName repoName}:${path}" |
865 |
| - ) cfg.effects.perRepoSecretFiles |
866 |
| - ++ lib.mapAttrsToList ( |
867 |
| - repoName: repo: "pull-based__${cleanUpRepoName repoName}:${repo.sshPrivateKeyFile}" |
868 |
| - ) (lib.filterAttrs (_: repo: repo.sshPrivateKeyFile != null) cfg.pullBased.repositories); |
| 846 | + LoadCredential = [ |
| 847 | + "buildbot-nix-workers:${cfg.workersFile}" |
| 848 | + ] |
| 849 | + ++ lib.optionals cfg.github.enable ( |
| 850 | + [ "github-webhook-secret:${cfg.github.webhookSecretFile}" ] |
| 851 | + ++ lib.optional ( |
| 852 | + cfg.github.authType ? "legacy" |
| 853 | + ) "github-token:${cfg.github.authType.legacy.tokenFile}" |
| 854 | + ++ lib.optional ( |
| 855 | + cfg.github.authType ? "app" |
| 856 | + ) "github-app-secret-key:${cfg.github.authType.app.secretKeyFile}" |
| 857 | + ) |
| 858 | + ++ lib.optional (cfg.authBackend == "gitea") "gitea-oauth-secret:${cfg.gitea.oauthSecretFile}" |
| 859 | + ++ lib.optional (cfg.authBackend == "github") "github-oauth-secret:${cfg.github.oauthSecretFile}" |
| 860 | + ++ lib.optionals cfg.gitea.enable [ |
| 861 | + "gitea-token:${cfg.gitea.tokenFile}" |
| 862 | + "gitea-webhook-secret:${cfg.gitea.webhookSecretFile}" |
| 863 | + ] |
| 864 | + ++ lib.mapAttrsToList ( |
| 865 | + repoName: path: "effects-secret__${cleanUpRepoName repoName}:${path}" |
| 866 | + ) cfg.effects.perRepoSecretFiles |
| 867 | + ++ lib.mapAttrsToList ( |
| 868 | + repoName: repo: "pull-based__${cleanUpRepoName repoName}:${repo.sshPrivateKeyFile}" |
| 869 | + ) (lib.filterAttrs (_: repo: repo.sshPrivateKeyFile != null) cfg.pullBased.repositories); |
869 | 870 | RuntimeDirectory = "buildbot-master";
|
870 | 871 | };
|
871 | 872 | };
|
|
883 | 884 |
|
884 | 885 | services.nginx.enable = true;
|
885 | 886 | services.nginx.virtualHosts.${cfg.domain} = {
|
886 |
| - locations = |
887 |
| - { |
888 |
| - "/".proxyPass = "http://127.0.0.1:${builtins.toString backendPort}/"; |
889 |
| - "/sse" = { |
890 |
| - proxyPass = "http://127.0.0.1:${builtins.toString backendPort}/sse"; |
891 |
| - # proxy buffering will prevent sse to work |
892 |
| - extraConfig = "proxy_buffering off;"; |
893 |
| - }; |
894 |
| - "/ws" = { |
895 |
| - proxyPass = "http://127.0.0.1:${builtins.toString backendPort}/ws"; |
896 |
| - proxyWebsockets = true; |
897 |
| - # raise the proxy timeout for the websocket |
898 |
| - extraConfig = "proxy_read_timeout 6000s;"; |
899 |
| - }; |
900 |
| - } |
901 |
| - // lib.optionalAttrs (cfg.outputsPath != null) { |
902 |
| - "/nix-outputs/" = { |
903 |
| - alias = cfg.outputsPath; |
904 |
| - extraConfig = '' |
905 |
| - charset utf-8; |
906 |
| - autoindex on; |
907 |
| - ''; |
908 |
| - }; |
| 887 | + locations = { |
| 888 | + "/".proxyPass = "http://127.0.0.1:${builtins.toString backendPort}/"; |
| 889 | + "/sse" = { |
| 890 | + proxyPass = "http://127.0.0.1:${builtins.toString backendPort}/sse"; |
| 891 | + # proxy buffering will prevent sse to work |
| 892 | + extraConfig = "proxy_buffering off;"; |
909 | 893 | };
|
| 894 | + "/ws" = { |
| 895 | + proxyPass = "http://127.0.0.1:${builtins.toString backendPort}/ws"; |
| 896 | + proxyWebsockets = true; |
| 897 | + # raise the proxy timeout for the websocket |
| 898 | + extraConfig = "proxy_read_timeout 6000s;"; |
| 899 | + }; |
| 900 | + } |
| 901 | + // lib.optionalAttrs (cfg.outputsPath != null) { |
| 902 | + "/nix-outputs/" = { |
| 903 | + alias = cfg.outputsPath; |
| 904 | + extraConfig = '' |
| 905 | + charset utf-8; |
| 906 | + autoindex on; |
| 907 | + ''; |
| 908 | + }; |
| 909 | + }; |
910 | 910 | };
|
911 | 911 |
|
912 | 912 | systemd.tmpfiles.rules =
|
|
0 commit comments