Include homepage_private static files.

There is no way to include them when fetching from a substituter.

.webhook_bridge/pipeline-build-homepage-staging.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage-staging
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -72,6 +70,18 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: f914437a46978b95f325f68d791dcf1a35738f60
+            - name: pathInRepo
+              value: task/git-clone/0.9/git-clone.yaml
+        workspaces:
+          - name: output
+            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -79,18 +89,6 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-        taskRef:
-          params:
-            - name: url
-              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
-            - name: revision
-              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
-            - name: pathInRepo
-              value: task/git-clone/0.1/git-clone.yaml
-          resolver: git
-        workspaces:
-          - name: output
-            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -123,7 +121,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 740029f9557b586e1807586ebad58d6cd57ddae5
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -144,8 +142,6 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-build-homepage.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -137,7 +135,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 7d4b33528fef5f2e662d32d093566ce56eb4acd0
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -158,8 +156,6 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-semver.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: semver
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"

docker/server/Dockerfile

@@ -1,16 +1,13 @@
-# syntax=docker/dockerfile:1
 #
 # Builder
 #
-ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
 FROM nixos/nix:2.31.3 AS builder
 
-ARG NIX_SUBSTITUTERS
 RUN tee -a /etc/nix/nix.conf <<EOF
 extra-experimental-features = nix-command flakes
 filter-syscalls = false
-substituters = $NIX_SUBSTITUTERS
+substituters = http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org
 EOF
 
 RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
@@ -18,17 +15,14 @@ RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.cr
 COPY . /tmp/build
 WORKDIR /tmp/build
 
-RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
+RUN nix build '.#docker_env'
 
 # Export the built closure to a folder
 RUN mkdir /tmp/nix-store-closure
 RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
+RUN ln -s $(readlink -f /tmp/build/result/bin/sh) /tmp/sh
 
-# Create a folder which will be copied to /tmp in the final image
-RUN install -d -o root -g root -m 0777 will_be_tmp
 
-# Create a folder which will be copied to /nginx in the final image
-RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
 
 #
 # Runner
@@ -40,24 +34,15 @@ WORKDIR /app
 
 ENV PATH="$PATH:/app/bin"
 
-COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
-root:x:0:root
-web:x:1000:web
-EOF
-
-COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
-root:x:0:0:root:/root:/bin/sh
-web:x:1000:1000::/home/web:/bin/sh
-EOF
-
 ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
 ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
 COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
 COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder /tmp/build/result /app
-COPY --from=builder /tmp/build/will_be_tmp /tmp
+COPY --from=builder /tmp/sh /bin/sh
-COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
-
 EXPOSE 8080
-CMD ["/app/nginx", "-c", "/app/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
+#RUN addgroup web && adduser -D -G web web
+#&& install -d -D -o web -g web -m 700 /srv/http/public
+# RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
+CMD ["/app/bin/launch_nginx"]

docker/server/nginx.conf

@@ -1,11 +1,10 @@
-user web;
+# user web;
 worker_processes 4;
 
 # Speed up regular expressions.
 pcre_jit on;
 
-error_log /dev/stderr debug;
+error_log stderr debug;
-pid /nginx/nginx.pid;
 
 events {
     # Connections per worker process.
@@ -13,8 +12,6 @@ events {
 }
 
 http {
-    access_log /dev/stdout;
-
     include @mime_types@;
     default_type application/octet-stream;
 

flake.lock

@@ -8,11 +8,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1784333070,
+        "lastModified": 1783808400,
-        "narHash": "sha256-3WkxaHOS13vFBtQFBmGIPScQZDNLk5bqCAY9qBJASl0=",
+        "narHash": "sha256-izeK0soRWiep4mkZ1duD1hf3fqXYrZXsHUwnBzTbTpA=",
         "ref": "refs/heads/main",
-        "rev": "faf279292ad20783775d909b96815f7ca2843b85",
+        "rev": "05c7ecde829f3e3843e89000e9959b8016124b2e",
-        "revCount": 327,
+        "revCount": 326,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/natter.git"
       },
@@ -46,11 +46,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1784327891,
+        "lastModified": 1783734912,
-        "narHash": "sha256-kGmXbmpkkiD2FtX7vKNdbL6/p/fvQ9OT2iS/ve55V5I=",
+        "narHash": "sha256-tXPapMwegdfP0jcr3BPQXxv1Aauo6yZwS4q2sIKOF9o=",
         "ref": "refs/heads/main",
-        "rev": "336b5d3d5444ad847cd5fbf1490055e733911b57",
+        "rev": "842a77fb2bc684a545fb102e16790fa902aec11c",
-        "revCount": 2010,
+        "revCount": 2008,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/organic.git"
       },
@@ -67,11 +67,11 @@
         "organic": "organic"
       },
       "locked": {
-        "lastModified": 1784331571,
+        "lastModified": 1783737126,
-        "narHash": "sha256-0AeEsziAEjL/lgrlTu7RvOoylV1hSozo04rfc3Y7q6M=",
+        "narHash": "sha256-BM6lYBegCV8EkVGqd6wIW9YN4EQL8cnoe4T5TuV7Q2I=",
         "ref": "refs/heads/main",
-        "rev": "55b239a3fe0b7a3b70f392be36b9efd49848be03",
+        "rev": "de11bc7c5e08610dc006ac7b31454abc6e1f46e7",
-        "revCount": 75,
+        "revCount": 74,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
       },

flake.nix

@@ -63,28 +63,20 @@
             inherit system overlays;
           };
           appliedOverlay = self.overlays.default pkgs pkgs;
-          nginx_conf = pkgs.replaceVars "${./docker/server/nginx.conf}" {
-            web_root = appliedOverlay.homepage.release;
-            mime_types = "${pkgs.nginx}/conf/mime.types";
-            headers_include = "${./docker/server/headers.include}";
-          };
         in
         rec {
           default = release;
           inherit (appliedOverlay.homepage)
             release
             ;
-          docker_env = pkgs.stdenv.mkDerivation {
+          docker_env = pkgs.buildEnv {
-            pname = "homepage-docker-env";
+            name = "homepage";
-            version = "0.0.0";
+            paths = with pkgs; [
-
+              appliedOverlay.homepage.launch_nginx
-            dontUnpack = true;
+              bash
-
+              uutils-coreutils-noprefix
-            installPhase = ''
+              # toybox # Smaller than uutils-coreutils?
-              mkdir -p $out
+            ];
-              cp ${nginx_conf} $out/nginx.conf
-              ln -sf ${pkgs.nginx}/bin/nginx $out/nginx
-            '';
           };
         }
       );
@@ -105,9 +97,17 @@
               organic_ast_explorer = organic_ast_explorer';
               inherit homepage_private;
             };
+            nginx_conf = final.replaceVars "${./docker/server/nginx.conf}" {
+              web_root = release;
+              mime_types = "${final.nginx}/conf/mime.types";
+              headers_include = "${./docker/server/headers.include}";
+            };
+            launch_nginx = final.writeShellScriptBin "launch_nginx" ''
+              ${final.nginx}/bin/nginx -c ${nginx_conf} -e stderr -g "daemon off;"
+            '';
           in
           {
-            inherit release;
+            inherit release launch_nginx;
           }
         );
       };