2 files changed, 111 insertions, 4 deletions

diff --git a/cluster/staging/app/ci/deploy/albatros.hcl b/cluster/staging/app/ci/deploy/albatros.hcl
new file mode 100644
index 0000000..f044b32
--- /dev/null
+++ b/cluster/staging/app/ci/deploy/albatros.hcl
@@ -0,0 +1,96 @@
+job "albatros" {
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
+  type = "service"
+  priority = 90
+
+  constraint {
+    attribute = "${attr.cpu.arch}"
+    value     = "amd64"
+  }
+
+  constraint {
+    attribute = "${attr.unique.hostname}"
+    operator = "!="
+    value = "caribou"
+  }
+
+  group "main" {
+    network {
+      port "http" { to = 8080 }
+    }
+
+    task "controller" {
+      driver = "docker"
+      config {
+        image = "dxflrs/albatros:750015b3fff91af8b9b86869411216a06bd13614"
+        ports = [ "http" ]
+        volumes = [
+          "secrets/certs:/var/run/secrets/albatros"
+        ]
+      }
+      env {
+        ALBATROS_URL = "https://albatros.staging.deuxfleurs.org"
+        NOMAD_ADDR = "https://nomad.service.staging.consul:4646"
+        NOMAD_CACERT = "/var/run/secrets/albatros/nomad-ca.crt"
+        NOMAD_CLIENT_CERT = "/var/run/secrets/albatros/nomad-client.crt"
+        NOMAD_CLIENT_KEY = "/var/run/secrets/albatros/nomad-client.key"
+        CONSUL_HTTP_ADDR = "https://consul.service.staging.consul:8501"
+        CONSUL_CACERT = "/var/run/secrets/albatros/consul-ca.crt"
+        CONSUL_CLIENT_CERT = "/var/run/secrets/albatros/consul-client.crt"
+        CONSUL_CLIENT_KEY = "/var/run/secrets/albatros/consul-client.key"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+        destination = "secrets/certs/consul-ca.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+        destination = "secrets/certs/consul-client.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.key\" }}"
+        destination = "secrets/certs/consul-client.key"
+      }
+
+      template {
+        data = "{{ key \"secrets/nomad/nomad-ca.crt\" }}"
+        destination = "secrets/certs/nomad-ca.crt"
+      }
+      template {
+        data = "{{ key \"secrets/nomad/nomad-client.crt\" }}"
+        destination = "secrets/certs/nomad-client.crt"
+      }
+      template {
+        data = "{{ key \"secrets/nomad/nomad-client.key\" }}"
+        destination = "secrets/certs/nomad-client.key"
+      }
+
+      resources {
+        cpu    = 200
+        memory = 200
+      }
+
+      service {
+        name = "albatros"
+        tags = [
+          "albatros",
+          "tricot albatros.staging.deuxfleurs.org",
+          "d53-cname albatros.staging.deuxfleurs.org",
+        ]
+        port = "http"
+        check {
+          type = "tcp"
+          port = "http"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "90s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/cluster/staging/app/ci/deploy/builder.hcl b/cluster/staging/app/ci/deploy/builder.hcl
index a7b3ddf..ad7a716 100644
--- a/cluster/staging/app/ci/deploy/builder.hcl
+++ b/cluster/staging/app/ci/deploy/builder.hcl
@@ -6,8 +6,8 @@ job "builder" {
   priority = 100
 
   parameterized {
-    payload = "forbidden"
-    meta_required = [ "REPO_URL", "COMMIT", "BRANCH" ]
+    payload = "optional"
+    meta_required = [ "REPO_URL", "COMMIT", "BRANCH", "FLAVOR" ]
   }
 
   reschedule {
@@ -22,10 +22,15 @@ job "builder" {
       args = [ "/tmp/builder.sh" ]
       volumes = [ 
         "local/builder.sh:/tmp/builder.sh",
-        "local/nix.conf:/etc/nix/nix.conf"
+        "local/nix.conf:/etc/nix/nix.conf",
+        "local/secrets:/var/run/secrets/albatros",
       ]
     }
 
+    dispatch_payload {
+      file = "secrets/secret.txt"
+    }
+
     template {
       data = <<EOH
 #!/usr/bin/env bash
@@ -39,7 +44,12 @@ git fetch origin ${NOMAD_META_COMMIT}
 git checkout ${NOMAD_META_COMMIT} -b ${NOMAD_META_BRANCH}
 export COMMIT=${NOMAD_META_COMMIT}
 export BRANCH=${NOMAD_META_BRANCH}
-./build.sh
+export REPO_URL=${NOMAD_META_REPO_URL}
+export FLAVOR=${NOMAD_META_FLAVOR}
+if [[ -s /var/run/secrets/albatros/secret.txt ]]; then
+  export SECRET_PATH=/var/run/secrets/albatros/secret.txt
+fi
+./.albatros
 
       EOH
       destination = "local/builder.sh"
@@ -57,6 +67,7 @@ filter-syscalls = false
 sandbox = false
 keep-outputs = true
 keep-derivations = true
+experimental-features = nix-command flakes
       EOH
       destination = "local/nix.conf"
     }