blob: 9062b7424b6811a93deaf7817c865a70bc0409f6 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
|
{
config,
lib,
pkgs,
...
}:
let
inherit (lib)
mkEnableOption
mkPackageOption
mkOption
types
mkIf
;
json = pkgs.formats.json { };
cfg = config.services.renovate;
generateValidatedConfig =
name: value:
pkgs.callPackage (
{ runCommand, jq }:
runCommand name
{
nativeBuildInputs = [
jq
cfg.package
];
value = builtins.toJSON value;
passAsFile = [ "value" ];
preferLocalBuild = true;
}
''
jq . "$valuePath"> $out
renovate-config-validator $out
''
) { };
generateConfig = if cfg.validateSettings then generateValidatedConfig else json.generate;
in
{
meta.maintainers = with lib.maintainers; [ marie natsukium ];
options.services.renovate = {
enable = mkEnableOption "renovate";
package = mkPackageOption pkgs "renovate" { };
schedule = mkOption {
type = with types; nullOr str;
description = "How often to run renovate. See {manpage}`systemd.time(7)` for the format.";
example = "*:0/10";
default = null;
};
credentials = mkOption {
type = with types; attrsOf path;
description = ''
Allows configuring environment variable credentials for renovate, read from files.
This should always be used for passing confidential data to renovate.
'';
example = {
RENOVATE_TOKEN = "/etc/renovate/token";
};
default = { };
};
runtimePackages = mkOption {
type = with types; listOf package;
description = "Packages available to renovate.";
default = [ ];
};
validateSettings = mkOption {
type = types.bool;
default = true;
description = "Weither to run renovate's config validator on the built configuration.";
};
settings = mkOption {
type = json.type;
default = { };
example = {
platform = "gitea";
endpoint = "https://git.example.com";
gitAuthor = "Renovate <renovate@example.com>";
};
description = ''
Renovate's global configuration.
If you want to pass secrets to renovate, please use {option}`services.renovate.credentials` for that.
'';
};
};
config = mkIf cfg.enable {
services.renovate.settings = {
cacheDir = "/var/cache/renovate";
baseDir = "/var/lib/renovate";
};
systemd.services.renovate = {
description = "Renovate dependency updater";
documentation = [ "https://docs.renovatebot.com/" ];
after = [ "network.target" ];
startAt = lib.optional (cfg.schedule != null) cfg.schedule;
path = [
config.systemd.package
pkgs.git
] ++ cfg.runtimePackages;
serviceConfig = {
Type = "oneshot";
User = "renovate";
Group = "renovate";
DynamicUser = true;
LoadCredential = lib.mapAttrsToList (name: value: "SECRET-${name}:${value}") cfg.credentials;
RemainAfterExit = false;
Restart = "on-failure";
CacheDirectory = "renovate";
StateDirectory = "renovate";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
UMask = "0077";
};
script = ''
${lib.concatStringsSep "\n" (
builtins.map (name: "export ${name}=$(systemd-creds cat 'SECRET-${name}')") (
lib.attrNames cfg.credentials
)
)}
exec ${lib.escapeShellArg (lib.getExe cfg.package)}
'';
environment = {
RENOVATE_CONFIG_FILE = generateConfig "renovate-config.json" cfg.settings;
HOME = "/var/lib/renovate";
};
};
};
}
|
