diff --git a/.dockerignore b/.dockerignore index 0da60a2..393624e 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,2 +1,5 @@ **/.git **/.gitignore +/.webhook_bridge +/result +**/Dockerfile diff --git a/.gitignore b/.gitignore index ea1472e..2f1e03b 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ output/ +/result diff --git a/.webhook_bridge/pipeline-build-homepage-staging.yaml b/.webhook_bridge/pipeline-build-homepage-staging.yaml index 9772473..51ff1e7 100644 --- a/.webhook_bridge/pipeline-build-homepage-staging.yaml +++ b/.webhook_bridge/pipeline-build-homepage-staging.yaml @@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: build-homepage-staging + labels: + pdb: protect spec: timeouts: pipeline: "2h0m0s" @@ -44,6 +46,51 @@ spec: #!/usr/bin/env sh set -euo pipefail echo -n "$(date +%s)" | tee $(results.unix-time.path) + - name: report-pending + taskRef: + resolver: git + params: + - name: url + value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git + - name: revision + value: f914437a46978b95f325f68d791dcf1a35738f60 + - name: pathInRepo + value: task/gitea-set-status/0.1/gitea-set-status.yaml + params: + - name: CONTEXT + value: "$(params.JOB_NAME)" + - name: REPO_FULL_NAME + value: "$(params.REPO_OWNER)/$(params.REPO_NAME)" + - name: GITEA_HOST_URL + value: code.fizz.buzz + - name: SHA + value: "$(tasks.fetch-repository.results.commit)" + - name: DESCRIPTION + value: "Build $(params.JOB_NAME) has started" + - name: STATE + value: pending + - name: TARGET_URL + value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)" + - name: fetch-repository + params: + - name: url + value: $(params.REPO_URL) + - name: revision + value: $(params.PULL_BASE_SHA) + - name: deleteExisting + value: "true" + taskRef: + params: + - name: url + value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git + - name: revision + value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1" + - name: pathInRepo + value: task/git-clone/0.1/git-clone.yaml + resolver: git + workspaces: + - name: output + workspace: git-source - name: get-git-commit-time taskSpec: metadata: {} @@ -69,53 +116,6 @@ spec: workspace: git-source runAfter: - fetch-repository - - name: report-pending - taskRef: - resolver: git - params: - - name: url - value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git - - name: revision - value: f914437a46978b95f325f68d791dcf1a35738f60 - - name: pathInRepo - value: task/gitea-set-status/0.1/gitea-set-status.yaml - runAfter: - - fetch-repository - params: - - name: CONTEXT - value: "$(params.JOB_NAME)" - - name: REPO_FULL_NAME - value: "$(params.REPO_OWNER)/$(params.REPO_NAME)" - - name: GITEA_HOST_URL - value: code.fizz.buzz - - name: SHA - value: "$(tasks.fetch-repository.results.commit)" - - name: DESCRIPTION - value: "Build $(params.JOB_NAME) has started" - - name: STATE - value: pending - - name: TARGET_URL - value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)" - - name: fetch-repository - taskRef: - resolver: git - params: - - name: url - value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git - - name: revision - value: f914437a46978b95f325f68d791dcf1a35738f60 - - name: pathInRepo - value: task/git-clone/0.9/git-clone.yaml - workspaces: - - name: output - workspace: git-source - params: - - name: url - value: $(params.REPO_URL) - - name: revision - value: $(params.PULL_BASE_SHA) - - name: deleteExisting - value: "true" - name: build-image taskRef: resolver: git @@ -123,7 +123,7 @@ spec: - name: url value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git - name: revision - value: af22c87d0db59dece97d03e6b6a796d84010158f + value: dda7b690195b43e8b9859d1caf5dcbf48588ade1 - name: pathInRepo value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml params: @@ -144,6 +144,8 @@ spec: - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true" - --opt - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time) + - --opt + - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" - name: BUILDKITD_TOML value: | debug = true diff --git a/.webhook_bridge/pipeline-build-homepage.yaml b/.webhook_bridge/pipeline-build-homepage.yaml index 70300da..030d90f 100644 --- a/.webhook_bridge/pipeline-build-homepage.yaml +++ b/.webhook_bridge/pipeline-build-homepage.yaml @@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: build-homepage + labels: + pdb: protect spec: timeouts: pipeline: "2h0m0s" @@ -135,7 +137,7 @@ spec: - name: url value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git - name: revision - value: af22c87d0db59dece97d03e6b6a796d84010158f + value: dda7b690195b43e8b9859d1caf5dcbf48588ade1 - name: pathInRepo value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml params: @@ -156,6 +158,8 @@ spec: - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true" - --opt - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time) + - --opt + - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" - name: BUILDKITD_TOML value: | debug = true diff --git a/.webhook_bridge/pipeline-semver.yaml b/.webhook_bridge/pipeline-semver.yaml index 69ac8fd..f667815 100644 --- a/.webhook_bridge/pipeline-semver.yaml +++ b/.webhook_bridge/pipeline-semver.yaml @@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: semver + labels: + pdb: protect spec: timeouts: pipeline: "2h0m0s" diff --git a/docker/server/Dockerfile b/docker/server/Dockerfile index 0be90da..3099156 100644 --- a/docker/server/Dockerfile +++ b/docker/server/Dockerfile @@ -1,69 +1,65 @@ # syntax=docker/dockerfile:1 -ARG ALPINE_VERSION="3.20" +# +# Builder +# +ARG NIX_SUBSTITUTERS=https://cache.nixos.org +FROM nixos/nix:2.31.3 AS builder +ARG NIX_SUBSTITUTERS +RUN tee -a /etc/nix/nix.conf <openpgpkey/[^/]+/hu/.*) { - alias /srv/http/public/well-known/$path; + alias @web_root@/well-known/$path; default_type "application/octet-stream"; add_header Access-Control-Allow-Origin * always; } diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..ed98299 --- /dev/null +++ b/flake.lock @@ -0,0 +1,136 @@ +{ + "nodes": { + "natter": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1784333070, + "narHash": "sha256-3WkxaHOS13vFBtQFBmGIPScQZDNLk5bqCAY9qBJASl0=", + "ref": "refs/heads/main", + "rev": "faf279292ad20783775d909b96815f7ca2843b85", + "revCount": 327, + "type": "git", + "url": "https://code.fizz.buzz/talexander/natter.git" + }, + "original": { + "type": "git", + "url": "https://code.fizz.buzz/talexander/natter.git" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1780749050, + "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "organic": { + "inputs": { + "nixpkgs": [ + "organic_ast_explorer", + "nixpkgs" + ], + "rust-overlay": "rust-overlay_2" + }, + "locked": { + "lastModified": 1784327891, + "narHash": "sha256-kGmXbmpkkiD2FtX7vKNdbL6/p/fvQ9OT2iS/ve55V5I=", + "ref": "refs/heads/main", + "rev": "336b5d3d5444ad847cd5fbf1490055e733911b57", + "revCount": 2010, + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic.git" + }, + "original": { + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic.git" + } + }, + "organic_ast_explorer": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "organic": "organic" + }, + "locked": { + "lastModified": 1784331571, + "narHash": "sha256-0AeEsziAEjL/lgrlTu7RvOoylV1hSozo04rfc3Y7q6M=", + "ref": "refs/heads/main", + "rev": "55b239a3fe0b7a3b70f392be36b9efd49848be03", + "revCount": 75, + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git" + }, + "original": { + "type": "git", + "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git" + } + }, + "root": { + "inputs": { + "natter": "natter", + "nixpkgs": "nixpkgs", + "organic_ast_explorer": "organic_ast_explorer" + } + }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "natter", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1781407245, + "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "d5f483210eb016d66102eef22baa128b3b3233fc", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "rust-overlay_2": { + "inputs": { + "nixpkgs": [ + "organic_ast_explorer", + "organic", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1781407245, + "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "d5f483210eb016d66102eef22baa128b3b3233fc", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..a0f0111 --- /dev/null +++ b/flake.nix @@ -0,0 +1,115 @@ +{ + description = "Fizz.buzz homepage"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + natter = { + url = "git+https://code.fizz.buzz/talexander/natter.git"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + organic_ast_explorer = { + url = "git+https://code.fizz.buzz/talexander/organic_ast_explorer.git"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; + + outputs = + { + self, + nixpkgs, + natter, + organic_ast_explorer, + }: + let + forAllSystems = + func: + builtins.listToAttrs ( + map (system: { + name = system; + value = func system; + }) nixpkgs.lib.systems.flakeExposed + ); + in + { + devShells = forAllSystems ( + system: + let + overlays = [ + natter.overlays.default + organic_ast_explorer.overlays.default + ]; + pkgs = import nixpkgs { + inherit system overlays; + }; + in + { + default = pkgs.mkShell { + nativeBuildInputs = [ + ]; + buildInputs = with pkgs; [ + pkgs.natter.release + ]; + }; + } + ); + packages = forAllSystems ( + system: + let + overlays = [ + natter.overlays.default + organic_ast_explorer.overlays.default + ]; + pkgs = import nixpkgs { + inherit system overlays; + }; + appliedOverlay = self.overlays.default pkgs pkgs; + in + rec { + default = release; + inherit (appliedOverlay.homepage) + release + ; + docker_env = pkgs.buildEnv { + name = "homepage"; + paths = with pkgs; [ + appliedOverlay.homepage.launch_nginx + # bash + # uutils-coreutils-noprefix + # toybox # Smaller than uutils-coreutils? + ]; + }; + } + ); + overlays.default = final: prev: { + homepage = final.lib.makeScope final.newScope ( + homepageScope: + let + homepage_private = fetchGit { + url = "git@code.fizz.buzz:talexander/homepage_private.git"; + ref = "main"; + rev = "89ba9628bf3e596345bc83f59cef5a2943584894"; + }; + natter' = (natter.overlays.default final final).natter.release; + organic_ast_explorer' = + (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release; + release = homepageScope.callPackage ./nix/package.nix { + natter = natter'; + organic_ast_explorer = organic_ast_explorer'; + inherit homepage_private; + }; + nginx_conf = final.replaceVars "${./docker/server/nginx.conf}" { + web_root = release; + mime_types = "${final.nginx}/conf/mime.types"; + headers_include = "${./docker/server/headers.include}"; + }; + launch_nginx = final.writeShellScriptBin "launch_nginx" '' + ${final.nginx}/bin/nginx -c ${nginx_conf} -e stderr -g "daemon off;" + ''; + in + { + inherit release launch_nginx; + } + ); + }; + }; +} diff --git a/nix/package.nix b/nix/package.nix new file mode 100644 index 0000000..a147247 --- /dev/null +++ b/nix/package.nix @@ -0,0 +1,31 @@ +{ + lib, + pkgs, + natter, + organic_ast_explorer, + homepage_private, +}: +let + +in +pkgs.stdenv.mkDerivation rec { + pname = "homepage"; + version = "0.0.0"; + + src = lib.cleanSource ../.; + + configurePhase = ""; + + buildPhase = '' + mkdir -p static/organic/ast_explorer + cp ${organic_ast_explorer}/* static/organic/ast_explorer/ + cp -r ${homepage_private}/static/* static/ + + ${natter}/bin/natter build --config natter.toml + ''; + + installPhase = '' + mkdir -p $out + mv output/* $out/ + ''; +}