nixos/gerrit: init #82137

edef1c · 2020-03-09T11:14:47Z

Motivation for this change

Gerrit is available in nixpkgs, but isn't particularly easy to set up.
A number of people have asked me to share and/or upstream the Gerrit NixOS module we're using at @mutable.
This is an early draft, and I'd prefer not to merge this until we've refined it a bit more.
It depends on #75584, so it can't be merged by itself anyway.

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Ensured that relevant documentation is up to date
Fits CONTRIBUTING.md.

cc @flokli @yorickvP

zimbatm · 2020-03-09T11:32:03Z

good timing, I started writing a Gerrit NixOS module last week. I will take a look and see how both efforts could be merged.

yorickvP

Some review comments. Feel free to ignore.

nixos/modules/services/misc/gerrit.nix

yorickvP · 2020-03-09T11:33:16Z

nixos/modules/services/misc/gerrit.nix

+      cache.directory = "/var/cache/gerrit";
+    };
+
+    users.users.gerrit = {};


Would DynamicUser be possible?

Maybe! I wasn't sure how that would interact with some parts of my target environment, so I haven't tried it yet.

nixos/modules/services/misc/gerrit.nix

yorickvP · 2020-03-09T11:36:50Z

nixos/modules/services/misc/gerrit.nix

+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "0.0.0.0:80";


I'm not entirely sure if exposing http to the internet on port 80 is ever a good idea. Is the intended usage behind some https reverse proxy? Or on an internal net?

It depends on your setup. The machine might be forwarded from an internal or external load-balancer. This is up to the user really.

The default when installing gerrit is *:8080

I've been using this behind an HTTPS reverse proxy. I suppose this should plausibly default to interacting with the ACME module, but I personally prefer to keep the actual TLS keys away from services themselves. My production deployment uses Google Cloud's TLS termination.

zimbatm

handle secrets.config
handle config folders like its/jira.config

zimbatm · 2020-03-09T11:59:19Z

nixos/modules/services/misc/gerrit.nix

+
+  cfg = config.services.gerrit;
+
+  cmd = "${pkgs.jre_headless}/bin/java -jar ${cfg.package}/webapps/gerrit-${cfg.package.version}.war";


What do you think of wrapping this into a script and adding it in the systemPackages? With some plugins I found that it's useful to be able to call gerrit init to set it up and discover the available options.

I'm into it, I've definitely found it annoying to have to dig the command out of systemctl cat to check stuff while debugging.

pushed to your PR as 17d73b8

I also added a jvmOpts module option because it because quickly necessary to tune the JVM for larger gerrit instances.

zimbatm · 2020-03-09T12:00:26Z

nixos/modules/services/misc/gerrit.nix

+      serviceConfig.ExecStartPre = pkgs.writeScript "gerrit-pre" ''
+        #! ${pkgs.bash}/bin/bash -eu


a matter of preference

Suggested change

serviceConfig.ExecStartPre = pkgs.writeScript "gerrit-pre" ''

#! ${pkgs.bash}/bin/bash -eu

serviceConfig.ExecStartPre = pkgs.writeShellScript "gerrit-pre" ''

set -euo pipefail

nixos/modules/services/misc/gerrit.nix

zimbatm · 2020-03-09T12:09:19Z

nixos/modules/services/misc/gerrit.nix

+  settingsFile = pkgs.writeText "gerrit.config" ''
+    ${generators.toINI {} cfg.settings}
+    ${generators.toINI { mkSectionName = mkPluginSectionName; } cfg.pluginSettings}
+  '';


I propose to import the git config generator from home-manager into the generators. It's quite close to the INI format but not entirely.

https://github.com/rycee/home-manager/blob/master/modules/programs/git.nix

That would be neat, but this might be a conversation for #75584.

zimbatm · 2020-03-09T12:12:02Z

nixos/modules/services/misc/gerrit.nix

+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "0.0.0.0:80";


It depends on your setup. The machine might be forwarded from an internal or external load-balancer. This is up to the user really.

The default when installing gerrit is *:8080

zimbatm · 2020-03-09T12:12:44Z

nixos/modules/services/misc/gerrit.nix

+      };
+      httpd.inheritChannel = "true";
+      # TODO(edef): support SSH properly
+      sshd.listenAddress = "off";


What is the problem with SSH? Is it because of the socket activation?

I'm not sure how much to integrate host key generation, and it's not particularly usable for me (the underlying SSH implementation lacks support for certificate keys), so I have no strong interest in debugging it. We should probably enable WantedBy=multi-user.target if SSH is enabled.

* the module option only accepts strings as values * make sure to also remove the plugins when it's a folder

zimbatm · 2020-03-19T09:48:37Z

@edef1c I had too much changes to group them into logical commit so I made a separate PR. Hope that's ok! #82929

edef1c changed the title ~~###### Motivation for this change~~ nixos/gerrit: init Mar 9, 2020

ofborg bot added 6.topic: nixos 8.has: module (update) labels Mar 9, 2020

yorickvP reviewed Mar 9, 2020

View reviewed changes

edef1c force-pushed the gerrit branch from 2ad31de to f95445d Compare March 9, 2020 12:05

zimbatm reviewed Mar 9, 2020

View reviewed changes

edef1c force-pushed the gerrit branch from f95445d to 6495662 Compare March 9, 2020 12:16

nixos/gerrit: init

45636b0

edef1c force-pushed the gerrit branch from 6495662 to 45636b0 Compare March 9, 2020 12:22

zimbatm added 2 commits March 9, 2020 15:40

nixos/gerrit: add wrapped CLI

17d73b8

fixup! nixos/gerrit: init

bbb1dac

* the module option only accepts strings as values * make sure to also remove the plugins when it's a folder

zimbatm mentioned this pull request Mar 19, 2020

nixos gerrit module #82929

Merged

10 tasks

edef1c closed this Mar 22, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nixos/gerrit: init #82137

nixos/gerrit: init #82137

edef1c commented Mar 9, 2020 •

edited

zimbatm commented Mar 9, 2020

yorickvP left a comment

yorickvP Mar 9, 2020

edef1c Mar 9, 2020

yorickvP Mar 9, 2020

zimbatm Mar 9, 2020

edef1c Mar 9, 2020

zimbatm left a comment

zimbatm Mar 9, 2020

edef1c Mar 9, 2020

zimbatm Mar 9, 2020

zimbatm Mar 9, 2020

zimbatm Mar 9, 2020

edef1c Mar 9, 2020

zimbatm Mar 9, 2020

zimbatm Mar 9, 2020

edef1c Mar 9, 2020

zimbatm commented Mar 19, 2020


		cfg = config.services.gerrit;

		cmd = "${pkgs.jre_headless}/bin/java -jar ${cfg.package}/webapps/gerrit-${cfg.package.version}.war";

		serviceConfig.ExecStartPre = pkgs.writeScript "gerrit-pre" ''
		#! ${pkgs.bash}/bin/bash -eu

nixos/gerrit: init #82137

nixos/gerrit: init #82137

Conversation

edef1c commented Mar 9, 2020 • edited

Motivation for this change

Things done

zimbatm commented Mar 9, 2020

yorickvP left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zimbatm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zimbatm commented Mar 19, 2020

edef1c commented Mar 9, 2020 •

edited