Update link to personal repos.

Now that I am mirroring some repositories, it makes sense to link to my specific user to show only my code.

.webhook_bridge/pipeline-build-homepage-staging.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage-staging
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -70,18 +72,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -89,6 +79,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -121,7 +123,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 740029f9557b586e1807586ebad58d6cd57ddae5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -142,6 +144,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-build-homepage.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -135,7 +137,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7d4b33528fef5f2e662d32d093566ce56eb4acd0
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -156,6 +158,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-semver.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: semver
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"

docker/server/Dockerfile

@@ -1,13 +1,16 @@
+# syntax=docker/dockerfile:1
 #
 # Builder
 #
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
 FROM nixos/nix:2.31.3 AS builder
 
+ARG NIX_SUBSTITUTERS
 RUN tee -a /etc/nix/nix.conf <<EOF
 extra-experimental-features = nix-command flakes
 filter-syscalls = false
-substituters = http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org
+substituters = $NIX_SUBSTITUTERS
 EOF
 
 RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
@@ -15,14 +18,17 @@ RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.cr
 COPY . /tmp/build
 WORKDIR /tmp/build
 
-RUN nix build '.#docker_env'
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
 
 # Export the built closure to a folder
 RUN mkdir /tmp/nix-store-closure
 RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
-RUN ln -s $(readlink -f /tmp/build/result/bin/sh) /tmp/sh
 
+# Create a folder which will be copied to /tmp in the final image
+RUN install -d -o root -g root -m 0777 will_be_tmp
 
+# Create a folder which will be copied to /nginx in the final image
+RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
 
 #
 # Runner
@@ -34,15 +40,24 @@ WORKDIR /app
 
 ENV PATH="$PATH:/app/bin"
 
+COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
+root:x:0:root
+web:x:1000:web
+EOF
+
+COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
+root:x:0:0:root:/root:/bin/sh
+web:x:1000:1000::/home/web:/bin/sh
+EOF
+
 ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
 ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
 COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
 COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder /tmp/build/result /app
-COPY --from=builder /tmp/sh /bin/sh
+COPY --from=builder /tmp/build/will_be_tmp /tmp
+COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
+
 EXPOSE 8080
-#RUN addgroup web && adduser -D -G web web
+CMD ["/app/nginx", "-c", "/app/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
-#&& install -d -D -o web -g web -m 700 /srv/http/public
-# RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
-CMD ["/app/bin/launch_nginx"]

docker/server/nginx.conf

@@ -1,10 +1,11 @@
-# user web;
+user web;
 worker_processes 4;
 
 # Speed up regular expressions.
 pcre_jit on;
 
-error_log stderr debug;
+error_log /dev/stderr debug;
+pid /nginx/nginx.pid;
 
 events {
     # Connections per worker process.
@@ -12,6 +13,8 @@ events {
 }
 
 http {
+    access_log /dev/stdout;
+
     include @mime_types@;
     default_type application/octet-stream;
 

flake.lock

@@ -8,11 +8,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1783808400,
+        "lastModified": 1784333070,
-        "narHash": "sha256-izeK0soRWiep4mkZ1duD1hf3fqXYrZXsHUwnBzTbTpA=",
+        "narHash": "sha256-3WkxaHOS13vFBtQFBmGIPScQZDNLk5bqCAY9qBJASl0=",
         "ref": "refs/heads/main",
-        "rev": "05c7ecde829f3e3843e89000e9959b8016124b2e",
+        "rev": "faf279292ad20783775d909b96815f7ca2843b85",
-        "revCount": 326,
+        "revCount": 327,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/natter.git"
       },
@@ -46,11 +46,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1783734912,
+        "lastModified": 1784327891,
-        "narHash": "sha256-tXPapMwegdfP0jcr3BPQXxv1Aauo6yZwS4q2sIKOF9o=",
+        "narHash": "sha256-kGmXbmpkkiD2FtX7vKNdbL6/p/fvQ9OT2iS/ve55V5I=",
         "ref": "refs/heads/main",
-        "rev": "842a77fb2bc684a545fb102e16790fa902aec11c",
+        "rev": "336b5d3d5444ad847cd5fbf1490055e733911b57",
-        "revCount": 2008,
+        "revCount": 2010,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/organic.git"
       },
@@ -67,11 +67,11 @@
         "organic": "organic"
       },
       "locked": {
-        "lastModified": 1783737126,
+        "lastModified": 1784331571,
-        "narHash": "sha256-BM6lYBegCV8EkVGqd6wIW9YN4EQL8cnoe4T5TuV7Q2I=",
+        "narHash": "sha256-0AeEsziAEjL/lgrlTu7RvOoylV1hSozo04rfc3Y7q6M=",
         "ref": "refs/heads/main",
-        "rev": "de11bc7c5e08610dc006ac7b31454abc6e1f46e7",
+        "rev": "55b239a3fe0b7a3b70f392be36b9efd49848be03",
-        "revCount": 74,
+        "revCount": 75,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
       },

flake.nix

@@ -63,20 +63,28 @@
             inherit system overlays;
           };
           appliedOverlay = self.overlays.default pkgs pkgs;
+          nginx_conf = pkgs.replaceVars "${./docker/server/nginx.conf}" {
+            web_root = appliedOverlay.homepage.release;
+            mime_types = "${pkgs.nginx}/conf/mime.types";
+            headers_include = "${./docker/server/headers.include}";
+          };
         in
         rec {
           default = release;
           inherit (appliedOverlay.homepage)
             release
             ;
-          docker_env = pkgs.buildEnv {
+          docker_env = pkgs.stdenv.mkDerivation {
-            name = "homepage";
+            pname = "homepage-docker-env";
-            paths = with pkgs; [
+            version = "0.0.0";
-              appliedOverlay.homepage.launch_nginx
+
-              bash
+            dontUnpack = true;
-              uutils-coreutils-noprefix
+
-              # toybox # Smaller than uutils-coreutils?
+            installPhase = ''
-            ];
+              mkdir -p $out
+              cp ${nginx_conf} $out/nginx.conf
+              ln -sf ${pkgs.nginx}/bin/nginx $out/nginx
+            '';
           };
         }
       );
@@ -97,17 +105,9 @@
               organic_ast_explorer = organic_ast_explorer';
               inherit homepage_private;
             };
-            nginx_conf = final.replaceVars "${./docker/server/nginx.conf}" {
-              web_root = release;
-              mime_types = "${final.nginx}/conf/mime.types";
-              headers_include = "${./docker/server/headers.include}";
-            };
-            launch_nginx = final.writeShellScriptBin "launch_nginx" ''
-              ${final.nginx}/bin/nginx -c ${nginx_conf} -e stderr -g "daemon off;"
-            '';
           in
           {
-            inherit release launch_nginx;
+            inherit release;
           }
         );
       };

pages/about_me/index.org

@@ -7,7 +7,7 @@
 #+exclude_tags: noexport
 
 Links:
-- My personal repos: [[https://code.fizz.buzz/explore/repos][code.fizz.buzz]]
+- My personal repos: [[https://code.fizz.buzz/talexander][code.fizz.buzz]]
 - LinkedIn: https://www.linkedin.com/in/tom-alexander-b6a18216/
 - GitHub: https://github.com/tomalexander
 - Resume: https://fizz.buzz/tom_alexander_resume.pdf