Merge remote-tracking branch 'ni/master'

6 files changed, 82 insertions, 29 deletions

diff --git a/krebs/0tests/data/secrets/github-hosts-sync.ssh.id_ed25519 b/krebs/0tests/data/secrets/github-hosts-sync.ssh.id_ed25519
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/krebs/0tests/data/secrets/github-hosts-sync.ssh.id_ed25519
diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index f68c8ce50..32e416831 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -18,6 +18,7 @@
   ];
 
   krebs.build.host = config.krebs.hosts.hotdog;
+  krebs.github-hosts-sync.enable = true;
 
   boot.isContainer = true;
   networking.useDHCP = false;
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 3b626dc46..0b7d56098 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -11,17 +11,25 @@ let
 
   api = {
     enable = mkEnableOption "krebs.github-hosts-sync";
-    port = mkOption {
-      type = types.int; # TODO port type
-      default = 1028;
-    };
     dataDir = mkOption {
       type = types.str; # TODO path (but not just into store)
       default = "/var/lib/github-hosts-sync";
     };
+    srcDir = mkOption {
+      type = types.str;
+      default = "${config.krebs.tinc.retiolum.confDir}/hosts";
+    };
     ssh-identity-file = mkOption {
       type = types.suffixed-str [".ssh.id_ed25519" ".ssh.id_rsa"];
-      default = toString <secrets/github-hosts-sync.ssh.id_rsa>;
+      default = toString <secrets/github-hosts-sync.ssh.id_ed25519>;
+    };
+    url = mkOption {
+      type = types.str;
+      default = "git@github.com:krebs/hosts.git";
+    };
+    workTree = mkOption {
+      type = types.absolute-pathname;
+      default = "${cfg.dataDir}/cache";
     };
   };
 
@@ -30,13 +38,18 @@ let
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       environment = {
-        port = toString cfg.port;
+        GITHUB_HOST_SYNC_USER_MAIL = user.mail;
+        GITHUB_HOST_SYNC_USER_NAME = user.name;
+        GITHUB_HOST_SYNC_SRCDIR = cfg.srcDir;
+        GITHUB_HOST_SYNC_WORKTREE = cfg.workTree;
+        GITHUB_HOST_SYNC_URL = cfg.url;
       };
       serviceConfig = {
         PermissionsStartOnly = "true";
         SyslogIdentifier = "github-hosts-sync";
         User = user.name;
-        Restart = "always";
+        Type = "oneshot";
+        RemainAfterExit = true;
         ExecStartPre = pkgs.writeDash "github-hosts-sync-init" ''
           set -euf
           install -m 0711 -o ${user.name} -d ${cfg.dataDir}
@@ -56,6 +69,7 @@ let
   };
 
   user = rec {
+    mail = "${name}@${config.krebs.build.host.name}";
     name = "github-hosts-sync";
     uid = genid_uint31 name;
   };
diff --git a/krebs/3modules/github-known-hosts.nix b/krebs/3modules/github-known-hosts.nix
index def06f17a..bae8b96bf 100644
--- a/krebs/3modules/github-known-hosts.nix
+++ b/krebs/3modules/github-known-hosts.nix
@@ -28,12 +28,22 @@
       "140.82.125.*"
       "140.82.126.*"
       "140.82.127.*"
+      "13.114.40.48"
       "13.229.188.59"
+      "13.234.176.102"
+      "13.234.210.38"
+      "13.236.229.21"
+      "13.237.44.5"
       "13.250.177.223"
+      "15.164.81.167"
       "18.194.104.89"
       "18.195.85.27"
       "35.159.8.160"
+      "52.192.72.89"
+      "52.64.108.95"
+      "52.69.186.44"
       "52.74.223.119"
+      "52.78.231.108"
     ];
     publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==";
   };
diff --git a/krebs/5pkgs/simple/github-hosts-sync/default.nix b/krebs/5pkgs/simple/github-hosts-sync/default.nix
index cdfed468c..fbc48fa3f 100644
--- a/krebs/5pkgs/simple/github-hosts-sync/default.nix
+++ b/krebs/5pkgs/simple/github-hosts-sync/default.nix
@@ -1,37 +1,32 @@
 { pkgs, stdenv, ... }:
 
-stdenv.mkDerivation {
-  name = "github-hosts-sync";
+stdenv.mkDerivation rec {
+  name = "github-hosts-sync-${version}";
+  version = "2.0.0";
 
-  src = pkgs.painload;
+  src = ./src;
 
   phases = [
     "unpackPhase"
     "installPhase"
   ];
 
-  installPhase =
-    let
-      ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-      path = stdenv.lib.makeBinPath (with pkgs; [
-        coreutils
-        findutils
-        git
-        gnugrep
-        gnused
-        nettools
-        openssh
-        socat
-      ]);
-    in
+  installPhase = let
+    ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    path = stdenv.lib.makeBinPath [
+      pkgs.git
+      pkgs.nettools
+      pkgs.openssh
+      pkgs.rsync
+    ];
+  in
     ''
       mkdir -p $out/bin
 
-      sed \
-        's,^main() {$,&\n  export PATH=${path} GIT_SSL_CAINFO=${ca-bundle},' \
-        < ./retiolum/scripts/github_hosts_sync/hosts-sync \
-        > $out/bin/github-hosts-sync
+      cp hosts-sync $out/bin/github-hosts-sync
 
-      chmod +x $out/bin/github-hosts-sync
+      sed -i \
+        '1s,$,\nPATH=${path}''${PATH+:$PATH} GIT_SSL_CAINFO=${ca-bundle},' \
+        $out/bin/github-hosts-sync
     '';
 }
diff --git a/krebs/5pkgs/simple/github-hosts-sync/src/hosts-sync b/krebs/5pkgs/simple/github-hosts-sync/src/hosts-sync
new file mode 100755
index 000000000..a8973e72b
--- /dev/null
+++ b/krebs/5pkgs/simple/github-hosts-sync/src/hosts-sync
@@ -0,0 +1,33 @@
+#! /bin/sh
+set -efu
+exec >&2
+
+hosts_srcdir=$GITHUB_HOST_SYNC_SRCDIR
+hosts_worktree=${GITHUB_HOST_SYNC_WORKTREE-/tmp/hosts}
+hosts_url=${GITHUB_HOST_SYNC_URL-git@github.com:krebs/hosts.git}
+user_mail=${GITHUB_HOST_SYNC_USER_MAIL-$LOGNAME@$(hostname)}
+user_name=${GITHUB_HOST_SYNC_USER_NAME-$LOGNAME}
+
+test -d "$hosts_worktree" || git clone "$hosts_url" "$hosts_worktree"
+
+cd "$hosts_worktree"
+
+git pull
+
+rsync \
+    --chmod D755,F644 \
+    --delete-excluded \
+    --filter 'protect .git' \
+    --recursive \
+    --verbose \
+    "$hosts_srcdir/" \
+    .
+
+git add .
+
+if test -n "$(git status --porcelain)"; then
+  git config user.email "$user_mail"
+  git config user.name "$user_name"
+  git commit -m bump
+  git push
+fi