From 8cd804a8c06dc97bca3101917aba1bfc90f3f0d2 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Tue, 23 Aug 2022 12:10:25 +0200 Subject: Add Drone CI server with sqlite-on-s3 thing --- app/drone-ci/config/litestream.yml | 10 ++ app/drone-ci/deploy/server.hcl | 139 ++++++++++++++++++++++ app/drone-ci/integration/README.md | 74 ++++++++++++ app/drone-ci/integration/docker-compose.yml | 32 +++++ app/drone-ci/secrets/drone-ci/cookie_secret | 1 + app/drone-ci/secrets/drone-ci/db_enc_secret | 1 + app/drone-ci/secrets/drone-ci/oauth_client_id | 1 + app/drone-ci/secrets/drone-ci/oauth_client_secret | 1 + app/drone-ci/secrets/drone-ci/rpc_secret | 2 +- app/drone-ci/secrets/drone-ci/s3_ak | 1 + app/drone-ci/secrets/drone-ci/s3_db_bucket | 1 + app/drone-ci/secrets/drone-ci/s3_sk | 1 + app/drone-ci/secrets/drone-ci/s3_storage_bucket | 1 + 13 files changed, 264 insertions(+), 1 deletion(-) create mode 100644 app/drone-ci/config/litestream.yml create mode 100644 app/drone-ci/deploy/server.hcl create mode 100644 app/drone-ci/integration/README.md create mode 100644 app/drone-ci/integration/docker-compose.yml create mode 100644 app/drone-ci/secrets/drone-ci/cookie_secret create mode 100644 app/drone-ci/secrets/drone-ci/db_enc_secret create mode 100644 app/drone-ci/secrets/drone-ci/oauth_client_id create mode 100644 app/drone-ci/secrets/drone-ci/oauth_client_secret create mode 100644 app/drone-ci/secrets/drone-ci/s3_ak create mode 100644 app/drone-ci/secrets/drone-ci/s3_db_bucket create mode 100644 app/drone-ci/secrets/drone-ci/s3_sk create mode 100644 app/drone-ci/secrets/drone-ci/s3_storage_bucket diff --git a/app/drone-ci/config/litestream.yml b/app/drone-ci/config/litestream.yml new file mode 100644 index 0000000..813c824 --- /dev/null +++ b/app/drone-ci/config/litestream.yml @@ -0,0 +1,10 @@ +dbs: + - path: /ephemeral/drone.db + replicas: + - url: s3://{{ key "secrets/drone-ci/s3_db_bucket" | trimSpace }}/drone.db + region: garage + endpoint: https://garage.deuxfleurs.fr + access-key-id: {{ key "secrets/drone-ci/s3_ak" | trimSpace }} + secret-access-key: {{ key "secrets/drone-ci/s3_sk" | trimSpace }} + force-path-style: true + sync-interval: 60s diff --git a/app/drone-ci/deploy/server.hcl b/app/drone-ci/deploy/server.hcl new file mode 100644 index 0000000..85eb776 --- /dev/null +++ b/app/drone-ci/deploy/server.hcl @@ -0,0 +1,139 @@ +job "drone-ci" { + datacenters = ["neptune"] + type = "service" + + group "server" { + count = 1 + + network { + port "web_port" { + to = 80 + } + } + + task "restore-db" { + lifecycle { + hook = "prestart" + sidecar = false + } + + driver = "docker" + config { + image = "litestream/litestream:0.3.9" + args = [ + "restore", "-config", "/etc/litestream.yml", "/ephemeral/drone.db" + ] + volumes = [ + "../alloc/data:/ephemeral", + "secrets/litestream.yml:/etc/litestream.yml" + ] + } + + template { + data = file("../config/litestream.yml") + destination = "secrets/litestream.yml" + } + + resources { + memory = 200 + cpu = 1000 + } + } + + task "drone_server" { + driver = "docker" + config { + image = "drone/drone:2.12.0" + ports = [ "web_port" ] + + volumes = [ + "../alloc/data:/ephemeral", + ] + } + + template { + data = < /dev/null +apt-get update +apt-get install -y docker-ce docker-ce-cli containerd.io + +curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose +chmod +x /usr/local/bin/docker-compose +``` + +## Prepare the runner + +Nix folder must be populated before launching any build. + +```bash +docker run --rm -it -v /var/lib/drone/nix:/mnt nixpkgs/nix:nixos-21.05 cp -r /nix/{store,var} /mnt/ +``` + +This folder will grow over time and might need to be garbage collected. +As a rule of thumb, after running a full release of Garage, this folder will require 10GB. +Consider provisioning it with at least 20GB. + +## Launch the runner + +Because we use a shared nix folder, we set the number of concurrent builds to 1. +For more details and customizations, see `docker-compose.yml`. + +```bash +DRONE_NAME=lheureduthe DRONE_OWNER=quentin DRONE_SECRET=xxx docker-compose up -d +``` + +That's all folks. + +## Check if a given job is built by your runner + +```bash +export URL=https://drone.deuxfleurs.fr +export REPO=Deuxfleurs/garage +export BUILD=1312 +curl ${URL}/api/repos/${REPO}/builds/${BUILD} \ + | jq -c '[.stages[] | { name: .name, machine: .machine }]' +``` + +It will give you the following result: + +```json +[{"name":"default","machine":"1686a"},{"name":"release-linux-x86_64","machine":"vimaire"},{"name":"release-linux-i686","machine":"carcajou"},{"name":"release-linux-aarch64","machine":"caribou"},{"name":"release-linux-armv6l","machine":"cariacou"},{"name":"refresh-release-page","machine":null}] +``` + +## Random note + +This setup is done mainly to allow nix builds with some cache. +To use the cache in Drone, you must set your repository as trusted. +The command line tool does not work (it says it successfully set your repository as trusted but it did nothing): +the only way to set your repository as trusted is to connect on the DB and set the `repo_trusted` field of your repo to true. + diff --git a/app/drone-ci/integration/docker-compose.yml b/app/drone-ci/integration/docker-compose.yml new file mode 100644 index 0000000..1e37255 --- /dev/null +++ b/app/drone-ci/integration/docker-compose.yml @@ -0,0 +1,32 @@ +version: '3.4' +services: + drone-runner: + image: drone/drone-runner-docker:latest + restart: always + environment: + - DRONE_RPC_PROTO=https + - DRONE_RPC_HOST=drone.deuxfleurs.fr + - DRONE_RPC_SECRET=${DRONE_SECRET} + - DRONE_RUNNER_CAPACITY=1 + - DRONE_DEBUG=true + - DRONE_LOGS_TRACE=true + - DRONE_RPC_DUMP_HTTP=true + - DRONE_RPC_DUMP_HTTP_BODY=true + - DRONE_RUNNER_NAME=${DRONE_NAME} + - DRONE_RUNNER_LABELS=nix:1 + #- DRONE_RUNNER_VOLUMES=/var/lib/drone/nix:/nix + ports: + - "3000:3000/tcp" + volumes: + - "/var/run/docker.sock:/var/run/docker.sock" + - "/var/lib/drone/nix:/var/lib/drone/nix" + + drone-gc: + image: drone/gc:latest + restart: always + environment: + - GC_DEBUG=true + - GC_CACHE=10gb + - GC_INTERVAL=10m + volumes: + - "/var/run/docker.sock:/var/run/docker.sock" diff --git a/app/drone-ci/secrets/drone-ci/cookie_secret b/app/drone-ci/secrets/drone-ci/cookie_secret new file mode 100644 index 0000000..04c819e --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/cookie_secret @@ -0,0 +1 @@ +CMD openssl rand -hex 16 diff --git a/app/drone-ci/secrets/drone-ci/db_enc_secret b/app/drone-ci/secrets/drone-ci/db_enc_secret new file mode 100644 index 0000000..3f9e696 --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/db_enc_secret @@ -0,0 +1 @@ +CMD_ONCE openssl rand -hex 16 diff --git a/app/drone-ci/secrets/drone-ci/oauth_client_id b/app/drone-ci/secrets/drone-ci/oauth_client_id new file mode 100644 index 0000000..c801b28 --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/oauth_client_id @@ -0,0 +1 @@ +USER OAuth client ID (on Gitea) diff --git a/app/drone-ci/secrets/drone-ci/oauth_client_secret b/app/drone-ci/secrets/drone-ci/oauth_client_secret new file mode 100644 index 0000000..b79b688 --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/oauth_client_secret @@ -0,0 +1 @@ +USER OAuth client secret (for gitea) diff --git a/app/drone-ci/secrets/drone-ci/rpc_secret b/app/drone-ci/secrets/drone-ci/rpc_secret index 7f00649..04c819e 100644 --- a/app/drone-ci/secrets/drone-ci/rpc_secret +++ b/app/drone-ci/secrets/drone-ci/rpc_secret @@ -1 +1 @@ -USER Drone RPC secret +CMD openssl rand -hex 16 diff --git a/app/drone-ci/secrets/drone-ci/s3_ak b/app/drone-ci/secrets/drone-ci/s3_ak new file mode 100644 index 0000000..3a8e4a2 --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/s3_ak @@ -0,0 +1 @@ +USER S3 (garage) access key for Drone diff --git a/app/drone-ci/secrets/drone-ci/s3_db_bucket b/app/drone-ci/secrets/drone-ci/s3_db_bucket new file mode 100644 index 0000000..c36f17d --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/s3_db_bucket @@ -0,0 +1 @@ +CONST drone-db diff --git a/app/drone-ci/secrets/drone-ci/s3_sk b/app/drone-ci/secrets/drone-ci/s3_sk new file mode 100644 index 0000000..46fd9fa --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/s3_sk @@ -0,0 +1 @@ +USER S3 (garage) secret key for Drone diff --git a/app/drone-ci/secrets/drone-ci/s3_storage_bucket b/app/drone-ci/secrets/drone-ci/s3_storage_bucket new file mode 100644 index 0000000..ca2702c --- /dev/null +++ b/app/drone-ci/secrets/drone-ci/s3_storage_bucket @@ -0,0 +1 @@ +CONST drone-storage -- cgit v1.2.3