pg-load-n-dump.nix

{ config, pkgs, ... }:
let
  zfs = if config.boot.zfs.enableUnstable
  then pkgs.zfsUnstable
  else pkgs.zfs;
  user = "buildkite-agent-pgloadndump";
in {
  systemd.paths.pgloadndump-trigger-mount = {
    wantedBy = [ "multi-user.target" ];
    pathConfig = {
      PathModified = "${config.users.users."${user}".home}/load-n-dump-trigger-mount";
    };
  };
  systemd.services.pgloadndump-trigger-mount = {
    serviceConfig = {
      Type = "oneshot";
    };
    path = [ zfs ];

    script = ''
      set -eux
      zfs mount rpool/scratch/haumea-load-and-dump/target
      chown -R "${user}" /rpool/scratch/haumea-load-and-dump/target
    '';
  };

  systemd.paths.pgloadndump-trigger-unmount = {
    wantedBy = [ "multi-user.target" ];
    pathConfig = {
      PathModified = "${config.users.users."${user}".home}/load-n-dump-trigger-unmount";
    };
  };
  systemd.services.pgloadndump-trigger-unmount = {
    serviceConfig = {
      Type = "oneshot";
    };
    path = [ zfs ];

    script = ''
      zfs unmount rpool/scratch/haumea-load-and-dump/target
    '';
  };


  services.buildkite-agents = {
    pgloadndump = {
      enable = true;

      tags = {
        postgres-load-and-dump = "true";
      };

      tokenPath = "/run/keys/buildkite-token-pgloadndump";

      runtimePackages = [ pkgs.gzip pkgs.xz pkgs.gnutar pkgs.nix pkgs.bash pkgs.vault
      zfs
      ];
    };
  };
  systemd.services.buildkite-agent-pgloadndump.requires = [ "vault.target" "buildkite-agent-pgloadndump-bootstrap.service" ];
  systemd.services.buildkite-agent-pgloadndump-bootstrap = {
    requires = [ "vault.target" ];
    wantedBy = [ "buildkite-agent-pgloadndump.service" "multi-user.target" ];
    unitConfig.Before = [ "buildkite-agent-pgloadndump.service" ];
    unitConfig.After = [ "vault.target" ];
    path = [ pkgs.vault ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };

    # Write out the buildkite token
    # Then, allocate an approle / secret ID login token
    script = ''
        set -eux
        set -o pipefail

        . /etc/vault.sh
        export HOME=/root
        secwrite() (
          umask 077
          rm -f /run/keys/"$1"
          touch /run/keys/"$1"
          cat > /run/keys/"$1"
          chmod 0400 /run/keys/"$1"
          chown "$2" /run/keys/"$1"
        )

        vault kv get -field=token secret/buildkite/grahamc/token \
          | secwrite buildkite-token-pgloadndump "buildkite-agent-pgloadndump:root"
    '';
  };
}