jenkins-nix-ci

A NixOS module to run Jenkins, optimized specifically for running projects using Nix.

Features

Fully nixified
- Jenkins configuration declared in Nix (via configuration-as-code plugin)
- sops-nix for secrets management, for use in Jenkins credentials. Known limitation: only JSON format is supported.
- Jenkins plugins are managed by jenkinsPlugins2nix
Isolated build agents
- NixOS containers as build agents (runs in local node)
- External SSH slaves (useful to run macOS build nodes)
CI features as NixOS modules, encapsulated along with their associated groovy library for referencing in Jenkinsfile
- nix: provides nixCI (using nixci) to build all flake outputs, and sets env.FLAKE_OUTPUTS to the list of outputs built.
  - Uses --no-update-lock-file (thus fails on out of sync flake.lock files)
  - Supports sub flakes (example) via nixci
- cachix: provides cachixPush and cachixUse pipeline steps
  - cachixPush will push the env.FLAKE_OUTPUTS built by the nix feature
- docker: provides dockerPush pipeline step
- githubApp: provides Github integration for CI status reporting

Examples

https://github.com/nammayatri/jenkins-config (used by Nammayatri)
srid/nixos-config

Plugins

To update the plugins, run nix-prefetch-jenkins-plugins > nix/jenkins/plugins.nix. nix-prefetch-jenkins-plugins must have been added to the devShell. See the aforementioned example.

Secrets

We use sops-nix to manage secrets used by the individual CI features. Convert your SSH key (ed25519) to age, which sops uses. With macOS & 1Password, it would look like:

nix run nixpkgs#ssh-to-age  <<< "$(op read 'op://Personal/id_ed25519/public key')"
nix run nixpkgs#ssh-to-age -- --private-key -i <(op read 'op://Personal/id_ed25519/actual private') > ~/.config/sops/age/keys.txt
# ^ $HOME/Library/Application\ Support/sops/age/keys.txt actually

You also want to get the host key (ssh-keyscan localhost | ssh-to-age) of the machine being deployed.

Put both these public age keys in .sops.yaml of the repository.

Discussion