103 lines
3 KiB
Nix
103 lines
3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
cfg = config.homelab.gitops;
|
|
|
|
updateScript = pkgs.writeShellApplication {
|
|
name = "homelab-gitops-update";
|
|
runtimeInputs = [ pkgs.git pkgs.nixos-rebuild pkgs.jq pkgs.coreutils ];
|
|
text = builtins.readFile ../../../scripts/nixos-sync.sh;
|
|
};
|
|
|
|
in {
|
|
options.homelab.gitops = {
|
|
enable = lib.mkEnableOption "Custom GitOps native deployment system";
|
|
|
|
repoUrl = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "https://git.depeuter.dev/Bos55/nix-config.git";
|
|
description = "The repository URL to pull configurations from.";
|
|
};
|
|
|
|
branch = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "v2";
|
|
description = "The branch to deploy.";
|
|
};
|
|
|
|
useBuilder = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Whether to use the central Builder host to compile packages.";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.services.homelab-gitops = {
|
|
description = "Homelab GitOps Update Service";
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${updateScript}/bin/homelab-gitops-update ${cfg.repoUrl} ${cfg.branch}";
|
|
# Must run as root to rebuild the system
|
|
User = "root";
|
|
};
|
|
};
|
|
|
|
systemd.timers.homelab-gitops = {
|
|
description = "Timer for Homelab GitOps Update Service";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "5m";
|
|
OnUnitActiveSec = "5m";
|
|
RandomizedDelaySec = "30s";
|
|
};
|
|
};
|
|
|
|
sops.secrets."webhook-secret" = {};
|
|
|
|
services.webhook = {
|
|
enable = true;
|
|
port = 9000;
|
|
hooks = {
|
|
gitops = {
|
|
execute-command = "${pkgs.systemd}/bin/systemctl";
|
|
pass-arguments-to-command = [
|
|
{ source = "string"; name = "start"; }
|
|
{ source = "string"; name = "homelab-gitops.service"; }
|
|
];
|
|
trigger-rule = {
|
|
match = {
|
|
type = "payload-hash-sha256";
|
|
secret = "{{ getenv \"WEBHOOK_SECRET\" }}";
|
|
parameter = {
|
|
source = "header";
|
|
name = "X-Forgejo-Signature";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# Inject the secret as an environment variable into the webhook service
|
|
systemd.services.webhook.serviceConfig.EnvironmentFile = config.sops.secrets."webhook-secret".path;
|
|
|
|
sops.secrets."builder-ssh-key" = lib.mkIf cfg.useBuilder {};
|
|
|
|
nix.buildMachines = lib.mkIf cfg.useBuilder [
|
|
{
|
|
hostName = "builder.depeuter.dev"; # Must be routable from nodes
|
|
system = "x86_64-linux";
|
|
sshUser = "builder";
|
|
sshKey = config.sops.secrets."builder-ssh-key".path;
|
|
maxJobs = 4;
|
|
speedFactor = 2;
|
|
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
|
}
|
|
];
|
|
|
|
nix.distributedBuilds = lib.mkIf cfg.useBuilder true;
|
|
};
|
|
}
|