fix buildbot setup

flake.lock

@@ -13,15 +13,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1714482180,
-        "narHash": "sha256-sHaMH/Gqz/hH1uhMTSroy/a+WV0Tj7noS51YBdQlbf0=",
+        "lastModified": 1714557645,
+        "narHash": "sha256-iCbmdbJULi4reK8qfkvvc3U9T/yKawBA3pbwA4y5kRQ=",
         "owner": "Mic92",
         "repo": "buildbot-nix",
-        "rev": "5d2711a5871b8c767567f8101968b1e6b52b9cd7",
+        "rev": "4f78c6e7f79b936c8169c0ec4ad379a9d304a208",
         "type": "github"
       },
       "original": {
         "owner": "Mic92",
+        "ref": "gitea-fixes",
         "repo": "buildbot-nix",
         "type": "github"
       }
@@ -44,11 +45,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1714471693,
-        "narHash": "sha256-LbFYT8T8SLZ6FLTmcF1bfO0PZqbpjuoc3LKWwyJc6rs=",
+        "lastModified": 1714488864,
+        "narHash": "sha256-Z9x9FtQUOEAa655hMMDuZGbQBOEk/P0wwn99C2diOY8=",
         "ref": "refs/heads/main",
-        "rev": "3da411770275fbf0dd4036bf741606f9eac00642",
-        "revCount": 2649,
+        "rev": "480bb396ed2a080472df5ba6887b5b91a278a7a5",
+        "revCount": 2652,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },

flake.nix

@@ -24,13 +24,13 @@
     # Use the version of nixpkgs that has been tested to work with SrvOS
     srvos.inputs.nixpkgs.follows = "nixpkgs";
 
-    clan-core.url = "git+https://git.clan.lol/clan/clan-core?ref=error-handling";
+    clan-core.url = "git+https://git.clan.lol/clan/clan-core";
     clan-core.inputs.flake-parts.follows = "flake-parts";
     clan-core.inputs.nixpkgs.follows = "nixpkgs";
     clan-core.inputs.treefmt-nix.follows = "treefmt-nix";
     clan-core.inputs.sops-nix.follows = "sops-nix";
 
-    buildbot-nix.url = "github:Mic92/buildbot-nix";
+    buildbot-nix.url = "github:Mic92/buildbot-nix/gitea-fixes";
     buildbot-nix.inputs.nixpkgs.follows = "nixpkgs";
     buildbot-nix.inputs.flake-parts.follows = "flake-parts";
     buildbot-nix.inputs.treefmt-nix.follows = "treefmt-nix";

modules/buildbot.nix

@@ -12,11 +12,18 @@
     # The number must match as otherwise potentially not enought buildbot-workers are created.
     workersFile = config.sops.secrets.buildbot-workers-file.path;
 
+    authBackend = "gitea";
+
+    admins = [ "joerg@thalheim.io" ];
+
     gitea = {
       enable = true;
       instanceUrl = "https://git.clan.lol";
-      oauthSecretFile = config.sops.secrets.oauth-secret-file.path;
+      # Redirect URIs. Please use a new line for every URI: https://buildbot.clan.lol/auth/login
       oauthId = "adb3425c-490f-4558-9487-8f8940d2925b";
+      oauthSecretFile = config.sops.secrets.buildbot-oauth-secret-file.path;
+      webhookSecretFile = config.sops.secrets.buildbot-webhook-secret-file.path;
+      tokenFile = config.sops.secrets.buildbot-token-file.path;
       topic = "buildbot-clan";
     };
 
@@ -28,7 +35,7 @@
   # Optional: Enable acme/TLS in nginx (recommended)
   services.nginx.virtualHosts.${config.services.buildbot-nix.master.domain} = {
     forceSSL = true;
-    useACME = true;
+    enableACME = true;
   };
 
   services.buildbot-nix.worker = {
@@ -36,7 +43,8 @@
     workerPasswordFile = config.sops.secrets.buildbot-worker-password-file.path;
   };
 
-  sops.secrets.oauth-secret-file = { };
-  sops.secrets.workers-file = { };
-  sops.secrets.worker-password-file = { };
+  sops.secrets.buildbot-oauth-secret-file = { };
+  sops.secrets.buildbot-workers-file = { };
+  sops.secrets.buildbot-worker-password-file = { };
+  sops.secrets.buildbot-token-file = { };
 }

modules/flake-module.nix

@@ -16,13 +16,14 @@
     ];
 
     buildbot.imports = [
-      inputs.buildbot-nix.nixosModules.master
-      inputs.buildbot-nix.nixosModules.worker
+      inputs.buildbot-nix.nixosModules.buildbot-master
+      inputs.buildbot-nix.nixosModules.buildbot-worker
       ./buildbot.nix
     ];
 
     web01.imports = [
       self.nixosModules.server
+      self.nixosModules.buildbot
       inputs.srvos.nixosModules.mixins-nginx
       inputs.srvos.nixosModules.mixins-nix-experimental
       ./web01

pkgs/gitea/0001-add-bot-check.patch

@@ -21,7 +21,7 @@ index 007e790b8..a8f3ba7dc 100644
  
  	ctx.Data["PageIsSignUp"] = true
  
-+	if strings.Contains(strings.ToLower(form.Notabot), "clan") {
++	if !strings.Contains(strings.ToLower(form.Notabot), "clan") {
 +		ctx.Error(http.StatusForbidden)
 +		return
 +	}

targets/web01/secrets.yaml

@@ -10,6 +10,7 @@ ssh_host_rsa_key.pub: ENC[AES256_GCM,data:Gqk5+cDBsYg84d5Y5vowhnPyGncW3bycpeZAsu
 harmonia-key: ENC[AES256_GCM,data:pZObqfbLogp0DYs47Tg2STKT9HptPSiP4sgcf31FD68PKSWhkgJbdY3gO/pfa0zsnvZTrAiljR8Ugh/x9z70T/XhjgZ/dIKqtcrGw0or9WPDmVzD4UHYm6iWR30MZLa9EBK0GFInlcSa/g==,iv:9HRnOaqP1iKMyyRX7evl6woZgfw9h4t7mBD98v/iBng=,tag:MQDio//aEOAOTVWlgADYDQ==,type:str]
 matrix-server-key: ENC[AES256_GCM,data:0148ezOFk8jX5KPQPCG0jQK9ajSfe/iOdUqlvys5/M8DrIwPXH9GzrkknwH+l8kF9ViTRDC/q5md8J2bj3/FBR/RW4rwjDrYx9cBEFm8wjHrywUlwON8kNKtj9ycJmXgtRyCrVGv7sBmODy0ZC5ZfWbhIQh6xWBkX2/rsSh4zwi/1PoHLpOO3u4=,iv:IwHPDi1E3R9LAY/seGpvx1U+N8mB9NMrUjLg4KMA1UA=,tag:pwRJ/CqkFN2eedrnMAaj2w==,type:str]
 registration-secret: ENC[AES256_GCM,data:EvPearZAxxb2irZFYgvy/tFA72h+IABuzwCbvy94IYR0eoHjuYw6GBde8CNUWG4SUiwyXJr4v438o/YThDhehsZ/cZFjg2o=,iv:ogN4/Iia5Zl95a3HP1KZoy86K8LyBFYw50cZUpkDNQo=,tag:5wU2OrNi7b5gWPfFZcGLjg==,type:str]
+gitea-buildbot-user: ENC[AES256_GCM,data:GsSP6YMfFoaYslLwceRh9OU6lNYUWQnpTi6Fazyxz/NF8bpy3wbYe+I8P1OlE50rpQ==,iv:ZFnFwXBXZc8c3Q60ZnG7WgcLXQNV9iUhjQxfu3w1lh0=,tag:6WlZkgwA4YY1C3VOEAx4Ww==,type:str]
 gitea-actions-runner: ENC[AES256_GCM,data:JKXAa7J1V3GH8lp3UtHTBmiezJlqxX1ItHLE7UcaIeNFQH8We2imaOMVftMpVCeXTpRX,iv:W9+4wH4asw3+w28i5om0OcJFHrABC85bhjhbgGWEs8E=,tag:Rf9XBeiEoJ1Pt8Z1TDIyJA==,type:str]
 merge-bot-gitea-token: ENC[AES256_GCM,data:ULHcaNSYJwMVeeEq4bSiRcVRuUkE9fFUV0AkWW1wM0yHQtD+dmo1GcQ=,iv:dujDWGZ+seoVN8Eez1w3tUuMpGeOHtNLMaa+f2hOpAo=,tag:WoDTsZegC6rrbh7ygWSk+A==,type:str]
 clan-bot-gitea-token: ENC[AES256_GCM,data:J+8AuAT50Xh4lKUWmigZQ/QBfNuaNKJDVuPj6jAOx06XZDwLEFtE8R8=,iv:8OGDcHbGfv6SOxe6+UBU7rTNgzYJYNJtUysSLao6H50=,tag:LxzSogjPBlxIrPcsgRU2Zw==,type:str]
@@ -56,8 +57,8 @@ sops:
             TGk4dUlwcE9XWWIzZE1nQXdXcWY0V0kKJi5yXdrsEOP4Z8K6k/sPA7yadNPKQtzo
             Iyt//Y+Y7n55KwuO8Doogu42SiVTUhHDICM9lezQmcugFqCoh3Lk4A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-28T09:00:40Z"
-    mac: ENC[AES256_GCM,data:EJGv76KzHaWG80CZy4/1n9JmDl1JafIR4mfNl4uWJeeZqvJm3D47WbXXKeOVnMGuSvElqxnLELpXG+aSxkbxBxc7fGDTwXPlnSb6N81OP4lZ9NfA0VvXo3dQY5vjunGUVhkK+eyVDeE/pIaO/EpIeUiCNug+OzpM5AjNU5KQXYc=,iv:upGfihotn1k1v2QbSapRv1O6aynNRnKW0mqDxJ4JIQg=,tag:ZJTQlwBvRSaV4CK3V2hoRA==,type:str]
+    lastmodified: "2024-05-01T09:44:24Z"
+    mac: ENC[AES256_GCM,data:jH1w5Xk9aAHQreykHiG9PMfljaWO5tm0rIWx1avLntbGVs7Ov1kIuAQ1U8otLMmjI3vA1QXGRMTJFoODqNEMxpBvER60dPPtkwkgnSYE1v9C88PFp3xBDeryrh4aLE9PKxZcY9kf9f7anZ8p1+FL7iYo25pDygD+bHvT/y+qM1k=,iv:L0oI5D5jq4n0x5KsveotGc91+M+Y7EVO6UIzLFfgW98=,tag:vTekW9SRjkdJkIJqcoXa5Q==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1