0daae2e08c
* nixos/buildkite: drop user option
This reverts 8c6b1c3eaa.
Turns out, buildkite-agent has logic to write .ssh/known_hosts files and
only really works when $HOME and the user homedir are in sync.
On top of that, we provision ssh keys in /var/lib/buildkite-agent, which
doesn't work if that other users' homedir points elsewhere (we can cheat
by setting $HOME, but then getent and $HOME provide conflicting
results).
So after all, it's better to only run the system-wide buildkite agent as
the "buildkite-agent" user only - if one wants to run buildkite as
different users, systemd user services might be a better fit.
* nixosTests.buildkite-agent: add node with separate user and no ssh key
37 lines
1023 B
Nix
37 lines
1023 B
Nix
import ./make-test-python.nix ({ pkgs, ... }:
|
|
|
|
{
|
|
name = "buildkite-agent";
|
|
meta = with pkgs.stdenv.lib.maintainers; {
|
|
maintainers = [ flokli ];
|
|
};
|
|
|
|
nodes = {
|
|
node1 = { pkgs, ... }: {
|
|
services.buildkite-agent = {
|
|
enable = true;
|
|
privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
|
|
tokenPath = (pkgs.writeText "my-token" "5678");
|
|
};
|
|
};
|
|
# don't configure ssh key, run as a separate user
|
|
node2 = { pkgs, ...}: {
|
|
services.buildkite-agent = {
|
|
enable = true;
|
|
tokenPath = (pkgs.writeText "my-token" "1234");
|
|
};
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
# we can't wait on the unit to start up, as we obviously can't connect to buildkite,
|
|
# but we can look whether files are set up correctly
|
|
|
|
node1.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
|
|
node1.wait_for_file("/var/lib/buildkite-agent/.ssh/id_rsa")
|
|
|
|
node2.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
|
|
'';
|
|
})
|