diff --git a/.dockerignore b/.dockerignore index 0da60a2..393624e 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,2 +1,5 @@ **/.git **/.gitignore +/.webhook_bridge +/result +**/Dockerfile diff --git a/.gitignore b/.gitignore index ea1472e..2f1e03b 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ output/ +/result diff --git a/.webhook_bridge/pipeline-build-homepage-staging.yaml b/.webhook_bridge/pipeline-build-homepage-staging.yaml index 9772473..5acb097 100644 --- a/.webhook_bridge/pipeline-build-homepage-staging.yaml +++ b/.webhook_bridge/pipeline-build-homepage-staging.yaml @@ -44,31 +44,6 @@ spec: #!/usr/bin/env sh set -euo pipefail echo -n "$(date +%s)" | tee $(results.unix-time.path) - - name: get-git-commit-time - taskSpec: - metadata: {} - stepTemplate: - image: alpine:3.20 - computeResources: - requests: - cpu: 10m - memory: 600Mi - workingDir: "$(workspaces.repo.path)" - results: - - name: unix-time - description: The time of the git commit in unix timestamp format. - steps: - - image: alpine/git:v2.34.2 - name: detect-tag-step - script: | - #!/usr/bin/env sh - set -euo pipefail - echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path) - workspaces: - - name: repo - workspace: git-source - runAfter: - - fetch-repository - name: report-pending taskRef: resolver: git @@ -79,8 +54,6 @@ spec: value: f914437a46978b95f325f68d791dcf1a35738f60 - name: pathInRepo value: task/gitea-set-status/0.1/gitea-set-status.yaml - runAfter: - - fetch-repository params: - name: CONTEXT value: "$(params.JOB_NAME)" @@ -116,6 +89,31 @@ spec: value: $(params.PULL_BASE_SHA) - name: deleteExisting value: "true" + - name: get-git-commit-time + taskSpec: + metadata: {} + stepTemplate: + image: alpine:3.20 + computeResources: + requests: + cpu: 10m + memory: 600Mi + workingDir: "$(workspaces.repo.path)" + results: + - name: unix-time + description: The time of the git commit in unix timestamp format. + steps: + - image: alpine/git:v2.34.2 + name: detect-tag-step + script: | + #!/usr/bin/env sh + set -euo pipefail + echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path) + workspaces: + - name: repo + workspace: git-source + runAfter: + - fetch-repository - name: build-image taskRef: resolver: git diff --git a/docker/server/Dockerfile b/docker/server/Dockerfile index 0be90da..5737305 100644 --- a/docker/server/Dockerfile +++ b/docker/server/Dockerfile @@ -1,69 +1,46 @@ -# syntax=docker/dockerfile:1 -ARG ALPINE_VERSION="3.20" +# +# Builder +# + +FROM nixos/nix:2.31.3 AS builder + +RUN cp "$(nix --extra-experimental-features "nix-command flakes" --option filter-syscalls false --option substituters "http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt + +COPY . /tmp/build +WORKDIR /tmp/build + +RUN nix \ + --extra-experimental-features "nix-command flakes" \ + --option filter-syscalls false \ + --option substituters "http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" \ + build '.#docker_env' + +# Export the built closure to a folder +RUN mkdir /tmp/nix-store-closure +RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure +RUN ln -s $(readlink -f /tmp/build/result/bin/sh) /tmp/sh -FROM scratch AS private -ADD git@code.fizz.buzz:talexander/homepage_private.git /homepage_private +# +# Runner +# +FROM scratch +WORKDIR /app -FROM scratch AS explorer -ADD https://code.fizz.buzz/talexander/organic_ast_explorer.git /organic_ast_explorer +ENV PATH="$PATH:/app/bin" +ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt +ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt +COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt - -FROM scratch AS organic -ADD git@code.fizz.buzz:talexander/organic.git /organic - - - -FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS organic-build -RUN apk add --no-cache musl-dev make bash -RUN rustup target add wasm32-unknown-unknown -RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install wasm-bindgen-cli -COPY --link --from=organic /organic /organic -WORKDIR /organic -RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked make wasm - - - -FROM node:lts-alpine$ALPINE_VERSION AS explorer-build -COPY --link --from=explorer /organic_ast_explorer /organic_ast_explorer -COPY --link --from=organic-build /organic /organic -WORKDIR /organic_ast_explorer -RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/npmcache,sharing=locked npm set cache /npmcache && npm install -RUN npm run release - - - - -FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS natter-build -RUN apk add --no-cache musl-dev -ADD git@code.fizz.buzz:talexander/natter.git /natter -WORKDIR /natter -RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto - - - -FROM alpine:$ALPINE_VERSION AS natter -COPY --link --from=natter-build /target/release-lto/natter /usr/bin/ -COPY --link . /source -COPY --link --from=private /homepage_private/static /source/static/ -COPY --link --from=explorer-build /organic_ast_explorer/dist /source/static/organic/ast_explorer/ -RUN --network=none --mount=type=tmpfs,target=/tmp natter build --config /source/natter.toml - - - - -FROM alpine:$ALPINE_VERSION AS server - -RUN apk add --no-cache bash nginx -RUN addgroup web && adduser -D -G web web && install -d -D -o web -g web -m 700 /srv/http/public -RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log - -COPY --chown=web:web docker/server/nginx.conf /srv/http -COPY --chown=web:web docker/server/headers.include /srv/http -COPY --from=natter --chown=web:web /source/output/ /srv/http/public/ - -ENTRYPOINT ["/usr/sbin/nginx", "-c", "/srv/http/nginx.conf", "-e", "stderr", "-g", "daemon off;"] +COPY --from=builder /tmp/nix-store-closure /nix/store +COPY --from=builder /tmp/build/result /app +COPY --from=builder /tmp/sh /bin/sh +EXPOSE 8080 +#RUN addgroup web && adduser -D -G web web +#&& install -d -D -o web -g web -m 700 /srv/http/public +# RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log +CMD ["/app/bin/launch_nginx"] diff --git a/docker/server/nginx.conf b/docker/server/nginx.conf index 229bb4a..276a99d 100644 --- a/docker/server/nginx.conf +++ b/docker/server/nginx.conf @@ -1,4 +1,4 @@ -user web; +# user web; worker_processes 4; # Speed up regular expressions. @@ -12,7 +12,7 @@ events { } http { - include /etc/nginx/mime.types; + include @mime_types@; default_type application/octet-stream; types { @@ -24,11 +24,11 @@ http { sendfile on; tcp_nopush on; - include headers.include; + include @headers_include@; server { listen 8080; - root /srv/http/public; + root @web_root@; location / { try_files $uri $uri/ =404; @@ -47,24 +47,24 @@ http { } location /.well-known/ { - alias /srv/http/public/well-known/; + alias @web_root@/well-known/; default_type text/plain; } location /.well-known/openpgpkey/hu/ { - alias /srv/http/public/well-known/openpgpkey/fizz.buzz/hu/; + alias @web_root@/well-known/openpgpkey/fizz.buzz/hu/; default_type "application/octet-stream"; add_header Access-Control-Allow-Origin * always; } location /.well-known/openpgpkey/policy { - alias /srv/http/public/well-known/openpgpkey/fizz.buzz/policy; + alias @web_root@/well-known/openpgpkey/fizz.buzz/policy; default_type "application/octet-stream"; add_header Access-Control-Allow-Origin * always; } location ~ /\.well-known/(?openpgpkey/[^/]+/hu/.*) { - alias /srv/http/public/well-known/$path; + alias @web_root@/well-known/$path; default_type "application/octet-stream"; add_header Access-Control-Allow-Origin * always; } diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..8568bef --- /dev/null +++ b/flake.lock @@ -0,0 +1,136 @@ +{ + "nodes": { + "natter": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1783808400, + "narHash": "sha256-izeK0soRWiep4mkZ1duD1hf3fqXYrZXsHUwnBzTbTpA=", + "ref": "refs/heads/main", + "rev": "05c7ecde829f3e3843e89000e9959b8016124b2e", + "revCount": 326, + "type": "git", + "url": "https://code.fizz.buzz/talexander/natter.git" + }, + "original": { + "type": "git", + "url": "https://code.fizz.buzz/talexander/natter.git" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1780749050, + "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "organic": { + "inputs": { + "nixpkgs": [ + "organic_ast_explorer", + "nixpkgs" + ], + "rust-overlay": "rust-overlay_2" + }, + "locked": { + "lastModified": 1783734912, + "narHash": "sha256-tXPapMwegdfP0jcr3BPQXxv1Aauo6yZwS4q2sIKOF9o=", + "ref": "refs/heads/main", + "rev": "842a77fb2bc684a545fb102e16790fa902aec11c", + "revCount": 2008, + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic.git" + }, + "original": { + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic.git" + } + }, + "organic_ast_explorer": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "organic": "organic" + }, + "locked": { + "lastModified": 1783737126, + "narHash": "sha256-BM6lYBegCV8EkVGqd6wIW9YN4EQL8cnoe4T5TuV7Q2I=", + "ref": "refs/heads/main", + "rev": "de11bc7c5e08610dc006ac7b31454abc6e1f46e7", + "revCount": 74, + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git" + }, + "original": { + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git" + } + }, + "root": { + "inputs": { + "natter": "natter", + "nixpkgs": "nixpkgs", + "organic_ast_explorer": "organic_ast_explorer" + } + }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "natter", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1781407245, + "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "d5f483210eb016d66102eef22baa128b3b3233fc", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "rust-overlay_2": { + "inputs": { + "nixpkgs": [ + "organic_ast_explorer", + "organic", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1781407245, + "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "d5f483210eb016d66102eef22baa128b3b3233fc", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..0972a45 --- /dev/null +++ b/flake.nix @@ -0,0 +1,109 @@ +{ + description = "Fizz.buzz homepage"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + natter = { + url = "git+https://code.fizz.buzz/talexander/natter.git"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + organic_ast_explorer = { + url = "git+https://code.fizz.buzz/talexander/organic_ast_explorer.git"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; + + outputs = + { + self, + nixpkgs, + natter, + organic_ast_explorer, + }: + let + forAllSystems = + func: + builtins.listToAttrs ( + map (system: { + name = system; + value = func system; + }) nixpkgs.lib.systems.flakeExposed + ); + in + { + devShells = forAllSystems ( + system: + let + overlays = [ + natter.overlays.default + organic_ast_explorer.overlays.default + ]; + pkgs = import nixpkgs { + inherit system overlays; + }; + in + { + default = pkgs.mkShell { + nativeBuildInputs = [ + ]; + buildInputs = with pkgs; [ + pkgs.natter.release + ]; + }; + } + ); + packages = forAllSystems ( + system: + let + overlays = [ + natter.overlays.default + organic_ast_explorer.overlays.default + ]; + pkgs = import nixpkgs { + inherit system overlays; + }; + appliedOverlay = self.overlays.default pkgs pkgs; + in + rec { + default = release; + inherit (appliedOverlay.homepage) + release + ; + docker_env = pkgs.buildEnv { + name = "homepage"; + paths = with pkgs; [ + appliedOverlay.homepage.launch_nginx + bash + uutils-coreutils-noprefix + # toybox # Smaller than uutils-coreutils? + ]; + }; + } + ); + overlays.default = final: prev: { + homepage = final.lib.makeScope final.newScope ( + homepageScope: + let + natter' = (natter.overlays.default final final).natter.release; + organic_ast_explorer' = + (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release; + release = homepageScope.callPackage ./nix/package.nix { + natter = natter'; + organic_ast_explorer = organic_ast_explorer'; + }; + nginx_conf = final.replaceVars "${./docker/server/nginx.conf}" { + web_root = release; + mime_types = "${final.nginx}/conf/mime.types"; + headers_include = "${./docker/server/headers.include}"; + }; + launch_nginx = final.writeShellScriptBin "launch_nginx" '' + ${final.nginx}/bin/nginx -c ${nginx_conf} -e stderr -g "daemon off;" + ''; + in + { + inherit release launch_nginx; + } + ); + }; + }; +} diff --git a/nix/package.nix b/nix/package.nix new file mode 100644 index 0000000..2578527 --- /dev/null +++ b/nix/package.nix @@ -0,0 +1,38 @@ +{ + hello, + lib, + pkgs, + natter, + organic_ast_explorer, +}: +let + +in +pkgs.stdenv.mkDerivation rec { + pname = "homepage"; + version = "0.0.0"; + + src = lib.cleanSource ../.; + + nativeBuildInputs = [ + # pkgs.simgrid + # pkgs.boost + # pkgs.cmake + ]; + + configurePhase = ""; + + # TODO copy COPY --link --from=private /homepage_private/static /source/static/ + + buildPhase = '' + mkdir -p static/organic/ast_explorer + cp ${organic_ast_explorer}/* static/organic/ast_explorer/ + + ${natter}/bin/natter build --config natter.toml + ''; + + installPhase = '' + mkdir -p $out + mv output/* $out/ + ''; +}