PAT

.webhook_bridge/pipeline-build-homepage-staging.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage-staging
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -72,6 +70,18 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: f914437a46978b95f325f68d791dcf1a35738f60
+            - name: pathInRepo
+              value: task/git-clone/0.9/git-clone.yaml
+        workspaces:
+          - name: output
+            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -79,18 +89,6 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-        taskRef:
-          params:
-            - name: url
-              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
-            - name: revision
-              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
-            - name: pathInRepo
-              value: task/git-clone/0.1/git-clone.yaml
-          resolver: git
-        workspaces:
-          - name: output
-            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -123,7 +121,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 7d4b33528fef5f2e662d32d093566ce56eb4acd0
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -144,8 +142,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
+              - --secret
+              - id=cache_token,src=/workspace/nix-cache-creds/CACHE_GET_TOKEN
           - name: BUILDKITD_TOML
             value: |
               debug = true
@@ -159,6 +157,8 @@ spec:
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
+          - name: nix-cache-creds
+            workspace: nix-cache-creds
         runAfter:
           - fetch-repository
     finally:
@@ -223,6 +223,7 @@ spec:
     workspaces:
       - name: git-source
       - name: docker-credentials
+      - name: nix-cache-creds
   workspaces:
     - name: git-source
       volumeClaimTemplate:
@@ -237,6 +238,9 @@ spec:
     - name: docker-credentials
       secret:
         secretName: harbor-plain
+    - name: nix-cache-creds
+      secret:
+        secretName: nix-pull-through-cache
   params:
     - name: image-name
       value: "harbor.fizz.buzz/private/homepage-staging"

.webhook_bridge/pipeline-build-homepage.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -137,7 +135,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: af22c87d0db59dece97d03e6b6a796d84010158f
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -158,8 +156,6 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-semver.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: semver
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"

docker/server/Dockerfile

@@ -1,34 +1,30 @@
-# syntax=docker/dockerfile:1
 #
 # Builder
 #
-ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
 FROM nixos/nix:2.31.3 AS builder
 
-ARG NIX_SUBSTITUTERS
 RUN tee -a /etc/nix/nix.conf <<EOF
 extra-experimental-features = nix-command flakes
 filter-syscalls = false
-substituters = $NIX_SUBSTITUTERS
+substituters = http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org
 EOF
 
-RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
+RUN --mount=type=secret,id=cache_token echo "extra-access-tokens = ncps.nix-pull-through-cache.svc.cluster.local=PAT:$(cat /run/secrets/cache_token)" >> /etc/nix/nix.conf
+
+RUN --mount=type=secret,id=cache_token NIX_CONFIG="extra-access-tokens = ncps.nix-pull-through-cache.svc.cluster.local=PAT:$(cat /run/secrets/cache_token)" cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
 COPY . /tmp/build
 WORKDIR /tmp/build
 
-RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
+RUN --mount=type=secret,id=cache_token NIX_CONFIG="extra-access-tokens = ncps.nix-pull-through-cache.svc.cluster.local=PAT:$(cat /run/secrets/cache_token)" nix build '.#docker_env'
 
 # Export the built closure to a folder
 RUN mkdir /tmp/nix-store-closure
 RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
+RUN ln -s $(readlink -f /tmp/build/result/bin/sh) /tmp/sh
 
-# Create a folder which will be copied to /tmp in the final image
-RUN install -d -o root -g root -m 0777 will_be_tmp
 
-# Create a folder which will be copied to /nginx in the final image
-RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
 
 #
 # Runner
@@ -40,24 +36,15 @@ WORKDIR /app
 
 ENV PATH="$PATH:/app/bin"
 
-COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
-root:x:0:root
-web:x:1000:web
-EOF
-
-COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
-root:x:0:0:root:/root:/bin/sh
-web:x:1000:1000::/home/web:/bin/sh
-EOF
-
 ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
 ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
 COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
 COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder /tmp/build/result /app
-COPY --from=builder /tmp/build/will_be_tmp /tmp
-COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
-
+COPY --from=builder /tmp/sh /bin/sh
 EXPOSE 8080
-CMD ["/app/nginx", "-c", "/app/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
+#RUN addgroup web && adduser -D -G web web
+#&& install -d -D -o web -g web -m 700 /srv/http/public
+# RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
+CMD ["/app/bin/launch_nginx"]

docker/server/nginx.conf

@@ -1,11 +1,10 @@
-user web;
+# user web;
 worker_processes 4;
 
 # Speed up regular expressions.
 pcre_jit on;
 
-error_log /dev/stderr debug;
-pid /nginx/nginx.pid;
+error_log stderr debug;
 
 events {
     # Connections per worker process.
@@ -13,8 +12,6 @@ events {
 }
 
 http {
-    access_log /dev/stdout;
-
     include @mime_types@;
     default_type application/octet-stream;
 

flake.lock

@@ -8,11 +8,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1784333070,
-        "narHash": "sha256-3WkxaHOS13vFBtQFBmGIPScQZDNLk5bqCAY9qBJASl0=",
+        "lastModified": 1783808400,
+        "narHash": "sha256-izeK0soRWiep4mkZ1duD1hf3fqXYrZXsHUwnBzTbTpA=",
         "ref": "refs/heads/main",
-        "rev": "faf279292ad20783775d909b96815f7ca2843b85",
-        "revCount": 327,
+        "rev": "05c7ecde829f3e3843e89000e9959b8016124b2e",
+        "revCount": 326,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/natter.git"
       },
@@ -46,11 +46,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1784327891,
-        "narHash": "sha256-kGmXbmpkkiD2FtX7vKNdbL6/p/fvQ9OT2iS/ve55V5I=",
+        "lastModified": 1783734912,
+        "narHash": "sha256-tXPapMwegdfP0jcr3BPQXxv1Aauo6yZwS4q2sIKOF9o=",
         "ref": "refs/heads/main",
-        "rev": "336b5d3d5444ad847cd5fbf1490055e733911b57",
-        "revCount": 2010,
+        "rev": "842a77fb2bc684a545fb102e16790fa902aec11c",
+        "revCount": 2008,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/organic.git"
       },
@@ -67,11 +67,11 @@
         "organic": "organic"
       },
       "locked": {
-        "lastModified": 1784331571,
-        "narHash": "sha256-0AeEsziAEjL/lgrlTu7RvOoylV1hSozo04rfc3Y7q6M=",
+        "lastModified": 1783737126,
+        "narHash": "sha256-BM6lYBegCV8EkVGqd6wIW9YN4EQL8cnoe4T5TuV7Q2I=",
         "ref": "refs/heads/main",
-        "rev": "55b239a3fe0b7a3b70f392be36b9efd49848be03",
-        "revCount": 75,
+        "rev": "de11bc7c5e08610dc006ac7b31454abc6e1f46e7",
+        "revCount": 74,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
       },

flake.nix

@@ -63,28 +63,20 @@
             inherit system overlays;
           };
           appliedOverlay = self.overlays.default pkgs pkgs;
-          nginx_conf = pkgs.replaceVars "${./docker/server/nginx.conf}" {
-            web_root = appliedOverlay.homepage.release;
-            mime_types = "${pkgs.nginx}/conf/mime.types";
-            headers_include = "${./docker/server/headers.include}";
-          };
         in
         rec {
           default = release;
           inherit (appliedOverlay.homepage)
             release
             ;
-          docker_env = pkgs.stdenv.mkDerivation {
-            pname = "homepage-docker-env";
-            version = "0.0.0";
-
-            dontUnpack = true;
-
-            installPhase = ''
-              mkdir -p $out
-              cp ${nginx_conf} $out/nginx.conf
-              ln -sf ${pkgs.nginx}/bin/nginx $out/nginx
-            '';
+          docker_env = pkgs.buildEnv {
+            name = "homepage";
+            paths = with pkgs; [
+              appliedOverlay.homepage.launch_nginx
+              bash
+              uutils-coreutils-noprefix
+              # toybox # Smaller than uutils-coreutils?
+            ];
           };
         }
       );
@@ -92,22 +84,24 @@
         homepage = final.lib.makeScope final.newScope (
           homepageScope:
           let
-            homepage_private = fetchGit {
-              url = "git@code.fizz.buzz:talexander/homepage_private.git";
-              ref = "main";
-              rev = "89ba9628bf3e596345bc83f59cef5a2943584894";
-            };
             natter' = (natter.overlays.default final final).natter.release;
             organic_ast_explorer' =
               (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release;
             release = homepageScope.callPackage ./nix/package.nix {
               natter = natter';
               organic_ast_explorer = organic_ast_explorer';
-              inherit homepage_private;
             };
+            nginx_conf = final.replaceVars "${./docker/server/nginx.conf}" {
+              web_root = release;
+              mime_types = "${final.nginx}/conf/mime.types";
+              headers_include = "${./docker/server/headers.include}";
+            };
+            launch_nginx = final.writeShellScriptBin "launch_nginx" ''
+              ${final.nginx}/bin/nginx -c ${nginx_conf} -e stderr -g "daemon off;"
+            '';
           in
           {
-            inherit release;
+            inherit release launch_nginx;
           }
         );
       };

nix/package.nix

@@ -1,9 +1,9 @@
 {
+  hello,
   lib,
   pkgs,
   natter,
   organic_ast_explorer,
-  homepage_private,
 }:
 let
 
@@ -14,12 +14,19 @@ pkgs.stdenv.mkDerivation rec {
 
   src = lib.cleanSource ../.;
 
+  nativeBuildInputs = [
+    # pkgs.simgrid
+    # pkgs.boost
+    # pkgs.cmake
+  ];
+
   configurePhase = "";
 
+  # TODO copy COPY --link --from=private /homepage_private/static /source/static/
+
   buildPhase = ''
     mkdir -p static/organic/ast_explorer
     cp ${organic_ast_explorer}/* static/organic/ast_explorer/
-    cp -r ${homepage_private}/static/* static/
 
     ${natter}/bin/natter build --config natter.toml
   '';

pages/about_me/index.org

@@ -7,7 +7,7 @@
 #+exclude_tags: noexport
 
 Links:
-- My personal repos: [[https://code.fizz.buzz/talexander][code.fizz.buzz]]
+- My personal repos: [[https://code.fizz.buzz/explore/repos][code.fizz.buzz]]
 - LinkedIn: https://www.linkedin.com/in/tom-alexander-b6a18216/
 - GitHub: https://github.com/tomalexander
 - Resume: https://fizz.buzz/tom_alexander_resume.pdf