nixos/.gitlab-ci.yml

155 lines
No EOL
3.7 KiB
YAML

# borrowed from https://gitlab.com/nix17/nixos-config/-/blob/main/.gitlab-ci.yml
stages:
- misc
- test
- deploy
- deploy_gitlab
# Update the flake for any changes upstream
# Passed in from upstream
# $PACKAGE_NAME = name of the flake that needs to be updated
# $UPDATE_FLAKE = flag to update the flake
update:
stage: misc
tags:
- nix
# from https://forum.gitlab.com/t/git-push-from-inside-a-gitlab-runner/30554/5
before_script:
# set teh ssh key for the commit
- eval $(ssh-agent -s)
- echo "${CI_KEY}" | tr -d '\r' | ssh-add - > /dev/null
- mkdir -p ~/.ssh
- chmod 700 ~/.ssh
- echo "$CI_KEY" >> ~/.ssh/id_rsa.pub
- '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
script:
- git config --global user.email "${CI_EMAIL}"
- git config --global user.name "${CI_USERNAME}"
# the part that updates the flake
- nix --experimental-features 'nix-command flakes' flake lock --update-input $PACKAGE_NAME
- git add flake.lock
- git commit -m "[skip ci] Updated flake for $PACKAGE_NAME" || echo "No changes, nothing to commit"
# we have a custom domain
- git remote rm origin && git remote add origin ssh://git@gitlab.skynet.ie:2222/compsoc1/skynet/nixos.git
- git push origin HEAD:$CI_COMMIT_REF_NAME
only:
refs:
- main
variables:
- $UPDATE_FLAKE == "yes"
sync_repos:
stage: misc
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:2.0.0
script:
- cd sync
- chmod +x ./sync.sh
- ./sync.sh
rules:
- if: '$SYNC_OVERRIDE == "true"'
- changes:
- sync/repos.csv
.scripts_base: &scripts_base
# load nix environment
- git pull origin $CI_COMMIT_REF_NAME
- . "$HOME/.nix-profile/etc/profile.d/nix.sh"
- nix --extra-experimental-features 'nix-command flakes' profile install nixpkgs#colmena
.scripts_deploy: &scripts_deploy
# setup ssh key
- eval $(ssh-agent -s)
- echo "$DEPLOY_KEY" | tr -d '\r' | ssh-add - > /dev/null
- mkdir -p ~/.ssh
- chmod 700 ~/.ssh
# every commit on main will build and deploy
.build_template: &builder
tags:
- nix
before_script:
- *scripts_base
rules:
- changes:
- applications/**/*
- machines/**/*
- secrets/**/*
- flake.*
- .gitlab-ci.yml
# deploy items only run on main
.deploy_template: &deployment
before_script:
- *scripts_deploy
- *scripts_base
rules:
- if: '$CI_PROJECT_NAMESPACE == "compsoc1/skynet" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
changes:
- flake.nix
- flake.lock
- applications/**/*
- machines/**/*
- secrets/**/*
linter:
<<: *builder
stage: test
script:
- nix --extra-experimental-features 'nix-command flakes' fmt -- --check .
build:
<<: *builder
stage: test
script:
- colmena build -v --on @active-dns
- colmena build -v --on @active-core
- colmena build -v --on @active
- colmena build -v --on @active-ext
- colmena build -v --on @active-gitlab
# dns always has to be deployed first
deploy_dns:
<<: *builder
<<: *deployment
stage: deploy
script:
- colmena apply -v --on @active-dns
deploy_core:
<<: *builder
<<: *deployment
stage: deploy
needs:
- deploy_dns
script:
- colmena apply -v --on @active-core
deploy_active:
<<: *builder
<<: *deployment
stage: deploy
needs:
- deploy_dns
script:
- colmena apply -v --on @active
# this is just skynet server
deploy_ext:
<<: *builder
<<: *deployment
stage: deploy
needs:
- deploy_dns
script:
- colmena apply -v --on @active-ext
allow_failure: true
deploy_gitlab:
<<: *builder
<<: *deployment
stage: deploy_gitlab
script:
- colmena apply -v --on @active-gitlab
when: manual