go-neb: upload the password in a key with a pre-start to mimic nixos-unstable
Eelco Dolstra committed
Nov 21, 2021 at 17:41 UTC
9fded084056f484034c1e4a16221f8d0fa7b46a7
2 files changed
+65
-6
delft/eris/alertmanager-matrix-forwarder.nix
+38
-6
@@ -1,11 +1,41 @@
1
-{
1
+{ config, pkgs, ... }:
2
+let
3
+ finalConfigFile = "/var/run/go-neb/config.yaml";
4
+
5
+ settingsFormat = pkgs.formats.yaml {};
6
+ configFile = settingsFormat.generate "config.yaml" config.services.go-neb.config;
7
+
8
+ go-neb = pkgs.callPackage ./go-neb-backport.nix {};
9
+in {
10
+ deployment.keys."alertmanager-matrix-forwarder" = {
11
+ keyFile = /home/deploy/src/nixos-org-configurations/keys/alertmanager-matrix-forwarder;
12
+ # user = config.systemd.services.go-neb.serviceConfig.User;
13
+ };
14
+
15
+ systemd.services.go-neb = {
16
+ serviceConfig = {
17
+ ExecStartPre = pkgs.writeShellScript "pre-start" ''
18
+ umask 077
19
+ export $(xargs < /run/keys/alertmanager-matrix-forwarder)
20
+ ${pkgs.envsubst}/bin/envsubst -i "${configFile}" > ${finalConfigFile}
21
+ chown go-neb ${finalConfigFile}
22
+ '';
23
+ ExecStart = pkgs.lib.mkForce "${go-neb}/bin/go-neb";
24
+ User = "go-neb";
25
+ SupplementaryGroups = [ "keys" ];
26
+ RuntimeDirectory = "go-neb";
27
+ PermissionsStartOnly = true;
28
+ };
29
+ environment.CONFIG_FILE = pkgs.lib.mkForce finalConfigFile;
30
+ };
31
+
32
services.go-neb = {
33
enable = true;
34
baseUrl = "http://localhost";
35
config = {
36
clients = [
37
{ UserId = "@bot:nixos.org";
8
- AccessToken = "CHANGEME";
38
+ AccessToken = "$CHANGEME";
39
HomeServerUrl = "https://nixos.ems.host";
40
Sync = true;
41
AutoJoinRooms = true;
@@ -23,16 +53,18 @@
53
text_template = ''
54
{{range .Alerts -}} [{{ .Status }}] {{index .Labels "alertname" }}: {{index .Annotations "description"}} {{ end -}}
55
'';
56
+
57
+ # $$severity otherwise envsubst replaces $severity with an empty string
58
html_template = ''
59
{{range .Alerts -}}
28
- {{ $severity := index .Labels "severity" }}
60
+ {{ $$severity := index .Labels "severity" }}
61
{{ if eq .Status "firing" }}
30
- {{ if eq $severity "critical"}}
62
+ {{ if eq $$severity "critical"}}
63
<font color='red'><b>[FIRING - CRITICAL]</b></font>
32
- {{ else if eq $severity "warning"}}
64
+ {{ else if eq $$severity "warning"}}
65
<font color='orange'><b>[FIRING - WARNING]</b></font>
66
{{ else }}
35
- <b>[FIRING - {{ $severity }}]</b>
67
+ <b>[FIRING - {{ $$severity }}]</b>
68
{{ end }}
69
{{ else }}
70
<font color='green'><b>[RESOLVED]</b></font>
delft/eris/go-neb-backport.nix
new
+27
@@ -0,0 +1,27 @@
1
+{ lib, buildGoModule, fetchFromGitHub, olm }:
2
+
3
+buildGoModule {
4
+ pname = "go-neb";
5
+ version = "unstable-2021-07-21";
6
+ src = fetchFromGitHub {
7
+ owner = "matrix-org";
8
+ repo = "go-neb";
9
+ rev = "8916c80f8ce1732f64b50f9251242ca189082e76";
10
+ sha256 = "sha256-kuH4vbvS4G1bczxUdY4bd4oL4pIZzuueUxdEp4xuzJM=";
11
+ };
12
+
13
+ subPackages = [ "." ];
14
+
15
+ buildInputs = [ olm ];
16
+
17
+ vendorSha256 = "sha256-5Vg7aUkqiFIQuxmsDOJjvXoeA5NjMoBoD0XBhC+o4GA=";
18
+
19
+ doCheck = false;
20
+
21
+ meta = with lib; {
22
+ description = "Extensible matrix bot written in Go";
23
+ homepage = "https://github.com/matrix-org/go-neb";
24
+ license = licenses.asl20;
25
+ maintainers = with maintainers; [ hexa maralorn ];
26
+ };
27
+}