Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found
Select Git revision

Target

Select target project
  • tomprince/PrivateStorageio
  • privatestorage/PrivateStorageio
2 results
Select Git revision
Show changes
Commits on Source (1581)
1,481 additional commits have been omitted to prevent performance issues.
Show whitespace changes
Inline Side-by-side
Showing
with 1168 additions and 152 deletions
.circleci/config.yml deleted 100644 → 0
View file @ a521e884
# Copyright 2019 PrivateStorage.io, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
version: 2
jobs:
test:
docker:
- image: "nixorg/nix:circleci"
steps:
- "checkout"
- run:
name: "Run Tests"
command: |
nix-shell --run 'nix-build nixos/unit-tests.nix' && cat result
system-tests-driver:
# Cannot actually run the system tests on CircleCI but we can build
# everything that makes them up. This by itself can catch a lot of
# problems.
docker:
- image: "nixorg/nix:circleci"
steps:
- "checkout"
- restore_cache:
# Get all of Nix's state relating to the particular revision of
# nixpkgs we're using. It will always be the same. CircleCI
# artifacts and nixpkgs store objects are probably mostly hosted in
# the same place (S3) so there's not a lot of difference for
# anything that's pre-built. For anything we end up building
# ourselves, though, this saves us all of the build time (less the
# download time).
#
# Read about caching dependencies: https://circleci.com/docs/2.0/caching/
name: "Restore Nix Store Paths"
keys:
# Construct cache keys that allow sharing as long as nixpkgs
# revision is unchanged.
#
# If nixpkgs changes then potentially a lot of cached packages for
# the base system will be invalidated so we may as well drop them
# and make a new cache with the new packages.
- privatestorageio-nix-store-v2-{{ checksum "nixpkgs.json" }}
- privatestorageio-nix-store-v2-
- run:
name: "Build System Test Driver"
command: |
nix-shell --run 'nix-build --max-jobs 1 --cores 1 nixos/system-tests.nix -A driver'
# Give it a good long while. PaymentServer and its dependencies, in
# particular, can take a while to build.
no_output_timeout: "20m"
- save_cache:
name: "Cache Nix Store Paths"
key: privatestorageio-nix-store-v2-{{ checksum "nixpkgs.json" }}
paths:
- "/nix"
build:
docker:
- image: "nixorg/nix:circleci"
steps:
- "checkout"
- restore_cache:
# See comments for nix store caching in `build` job.
name: "Restore Nix Store Paths"
keys:
- privatestorageio-docs-nix-store-v1-{{ checksum "nixpkgs.json" }}
- privatestorageio-docs-nix-store-v1-
- run:
name: "Nix Build"
command: |
nix-shell --run 'nix-build docs.nix'
- save_cache:
name: "Cache Nix Store Paths"
key: privatestorageio-docs-nix-store-v1-{{ checksum "nixpkgs.json" }}
paths:
- "/nix"
- store_artifacts:
path: "result/docs"
destination: "docs"
workflows:
version: 2
everything:
jobs:
- "test"
- "build"
.gitlab-ci.yml 0 → 100644
View file @ f5260620
# Define rules for a job that should run for events related to a merge request
# - merge request is opened, a new commit is pushed to its branch, etc. This
# definition does nothing by itself but can be referenced by jobs that want to
# run in this condition.
.merge_request_rules: &RUN_ON_MERGE_REQUEST
rules:
# If the pipeline is triggered by a merge request event then we should
# run.
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
# If the pipeline is triggered by anything else then we should not run.
- when: "never"
# As above, but rules for running when the scheduler triggers the pipeline.
.schedule_rules: &RUN_ON_SCHEDULE
rules:
# There are multiple schedules so make sure this one is for us. The
# `SCHEDULE_TARGET` variable is explicitly, manually set by us in the
# schedule configuration.
- if: '$SCHEDULE_TARGET != $CI_JOB_NAME'
when: "never"
# Make sure this is actually a scheduled run
- if: '$CI_PIPELINE_SOURCE != "schedule"'
when: "never"
# Conditions look good: run.
- when: "always"
stages:
- "build"
- "deploy"
default:
# Guide the choice of an appropriate runner for all these jobs.
# https://docs.gitlab.com/ee/ci/runners/#runner-runs-only-tagged-jobs
tags:
- "nixos"
- "shell"
variables:
# https://docs.gitlab.com/ee/ci/runners/configure_runners.html#job-stages-attempts
GET_SOURCES_ATTEMPTS: 10
docs:
<<: *RUN_ON_MERGE_REQUEST
stage: "build"
script:
- "nix-build --attr docs --out-link result-docs"
# GitLab wants to lchown artifacts. It can't do that to store paths. Get
# a copy of the docs outside of the store.
- "cp --recursive --no-preserve=mode ./result-docs/docs ./docs-build/"
artifacts:
paths:
- "./docs-build/"
expose_as: "documentation"
unit-tests:
<<: *RUN_ON_MERGE_REQUEST
stage: "build"
script:
- "nix-build --attr unit-tests && cat result"
.morph-build: &MORPH_BUILD
<<: *RUN_ON_MERGE_REQUEST
timeout: "3 hours"
stage: "build"
script:
- |
set -x
# GRID is set in one of the "instantiations" of this job template.
nix-shell --pure --run "morph build --show-trace morph/grid/${GRID}/grid.nix"
morph-build-localdev:
<<: *MORPH_BUILD
variables:
GRID: "local"
before_script:
- |
# The local grid configuration is *almost* complete enough to build. It
# just needs this tweak.
echo '{}' > morph/grid/${GRID}/public-keys/users.nix
morph-build-staging:
<<: *MORPH_BUILD
variables:
GRID: "testing"
morph-build-production:
<<: *MORPH_BUILD
variables:
GRID: "production"
vulnerability-scan:
<<: *RUN_ON_MERGE_REQUEST
stage: "build"
script:
- "ci-tools/vulnerability-scan security-report.json"
- "ci-tools/count-vulnerabilities <security-report.json"
artifacts:
paths:
- "security-report.json"
expose_as: "security report"
system-tests:
<<: *RUN_ON_MERGE_REQUEST
timeout: "3 hours"
stage: "build"
script:
- "nix-shell --pure --run 'nix-build --attr system-tests'"
# A template for a job that can update one of the grids.
.update-grid: &UPDATE_GRID
stage: "deploy"
script: |
env --ignore-environment - \
NIX_PATH="$NIX_PATH" \
GITLAB_USER_LOGIN="$GITLAB_USER_LOGIN" \
CI_JOB_NAME="$CI_JOB_NAME" \
CI_PIPELINE_SOURCE="$CI_PIPELINE_SOURCE" \
CI_COMMIT_BRANCH="$CI_COMMIT_BRANCH" \
./ci-tools/update-grid-servers "${PRIVATESTORAGEIO_SSH_DEPLOY_KEY_PATH}" "${CI_ENVIRONMENT_NAME}"
# Update the staging deployment - only on a commit to the develop branch.
update-staging:
<<: *UPDATE_GRID
# https://docs.gitlab.com/ee/ci/yaml/#rules
rules:
# https://docs.gitlab.com/ee/ci/yaml/index.html#rulesif
# https://docs.gitlab.com/ee/ci/jobs/job_control.html#cicd-variable-expressions
# https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
- if: '$CI_COMMIT_BRANCH == "develop"'
environment:
# You can find some status information about environments in GitLab at
# https://whetstone.privatestorage.io/privatestorage/PrivateStorageio/-/environments.
name: "staging"
# The URL controls where the "View Deployment" button for this environment
# will take you. The main website isn't controlled by this codebase so we
# don't point there. The monitoring system *is* controlled by this
# codebase and it also tells us lots of stuff about other things
# controlled by this codebase so that seems like a good place to land.
# Not that I make it a habit to visit the deployment using the GitLab
# button... Still, discoverability or something.
url: "https://monitoring.privatestorage-staging.com/"
# Update the production deployment - only on a commit to the production branch.
deploy-to-production:
<<: *UPDATE_GRID
# https://docs.gitlab.com/ee/ci/yaml/#rules
rules:
# https://docs.gitlab.com/ee/ci/yaml/index.html#rulesif
# https://docs.gitlab.com/ee/ci/jobs/job_control.html#cicd-variable-expressions
# https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
- if: '$CI_COMMIT_BRANCH == "production"'
environment:
# See notes in `update-staging`.
name: "production"
url: "https://monitoring.private.storage/"
update-nixpkgs:
<<: *RUN_ON_SCHEDULE
stage: "build"
script:
- |
./ci-tools/with-ssh-agent \
./ci-tools/update-nixpkgs \
"$CI_SERVER_URL" \
"$CI_SERVER_HOST" \
"$CI_PROJECT_PATH" \
"$CI_PROJECT_ID" \
"$CI_DEFAULT_BRANCH"
update-production:
<<: *RUN_ON_SCHEDULE
stage: "build"
script:
- |
./ci-tools/update-production \
"$CI_SERVER_URL" \
"$CI_PROJECT_ID" \
"develop" \
"production"
DEPLOYMENT-NOTES.rst 0 → 100644
View file @ f5260620
Deployment notes
================
- 2023-06-19
ZKAPAuthorizer's Tahoe-LAFS plugin name changed from "privatestorageio-zkapauthz-v1" to "privatestorageio-zkapauthz-v2".
This causes Tahoe-LAFS to use a different filename to persist the plugin's Foolscap fURL.
To preserve the original fURL value (required) each storage node needs this command run before the deployment::
cp /var/db/tahoe-lafs/storage/private/storage-plugin.privatestorageio-zkapauthz-v{1,2}.furl
- 2023-04-19
The team switched from Slack to Zulip.
For the monitoring notifications to reach Zulip, a webhook bot has to be created in Zulip and a secret URL has to be constructed as described in `https://zulip.com/integrations/doc/grafana`_ and added to the ``private_keys`` directory (See ``grid/local/private-keys/grafana-zulip-url`` for an example).
Find the secret URL for production at `https://my.1password.com/vaults/7flqasy5hhhmlbtp5qozd3j4ga/allitems/rb22ipb6gvokohzq2d2hhv6t6u`_.
- 2021-12-20
`https://whetstone.private.storage/privatestorage/privatestorageops/-/issues/399`_ requires moving the PaymentServer database on the ``payments`` host onto a new dedicated filesystem.
Follow these steps *before* deploying this version of PrivateStorageio:
0. Deploy the `PrivateStorageOps change <https://whetstone.private.storage/privatestorage/privatestorageops/-/merge_requests/169>`_ that creates a new dedicated volume.
1. Put a disk label on the new dedicated volume ::
nix-shell -p parted --run 'parted /dev/nvme1n1 mklabel msdos'
2. Put a properly aligned partition in the new disk label ::
nix-shell -p parted --run 'parted /dev/nvme1n1 mkpart primary ext2 4096s 4G'
3. Create a labeled filesystem on the partition ::
mkfs.ext4 -L zkapissuer-data /dev/nvme1n1p1
4. Deploy the PrivateStorageio update.
5. Move the database file to the new location ::
mv -iv /var/lib/zkapissuer/vouchers.sqlite3 /var/lib/zkapissuer-v2
6. Clean up the old state directory ::
rm -ir /var/lib/zkapissuer
7. Start the PaymentServer service (not running because its path assertions were not met earlier) ::
systemctl start zkapissuer
- 2021-10-12 The secret in ``private-keys/grafana-slack-url`` needs to be changed to remove the ``SLACKURL=`` prefix.
- 2021-09-30 `Enable alerting <https://whetstone.private.storage/privatestorage/PrivateStorageio/-/merge_requests/185>`_ needs a secret in ``private-keys/grafana-slack-url`` looking like the template in ``morph/grid/local/private-keys/grafana-slack-url`` and pointing to the secret API endpoint URL saved in `this 1Password entry <https://privatestorage.1password.com/vaults/7flqasy5hhhmlbtp5qozd3j4ga/allitems/cgznskz2oix2tyx5xyntwaos5i>`_ (or create a new secret URL at https://www.slack.com/apps/A0F7XDUAZ).
- 2021-09-07 `Manage access to payment metrics <https://whetstone.private.storage/privatestorage/PrivateStorageio/-/merge_requests/146>`_ requires moving and chown'ing the PaymentServer database on the ``payments`` host::
mkdir /var/lib/zkapissuer
mv /var/db/vouchers.sqlite3 /var/lib/zkapissuer/vouchers.sqlite3
chown -R zkapissuer:zkapissuer /var/lib/zkapissuer
chmod 750 /var/lib/zkapissuer
chmod 640 /var/lib/zkapissuer/vouchers.sqlite3
README.rst
View file @ f5260620
PrivateStorageio
================
The backend for a private, secure, and end-to-end encrypted storage solution
Building
--------
The build system uses `Nix`_ which must be installed before anything can be built.
Start by setting up the development/operations environment::
$ nix-shell
The backend for a private, secure, and end-to-end encrypted storage solution.
Documentation
~~~~~~~~~~~~~
The documentation can be built using this command::
$ nix-build docs.nix
The documentation is also built on and published by CI.
Testing
-------
There is documentation for:
The test system uses `Nix`_ which must be installed before any tests can be run.
* Operators/Admins: `<docs/source/ops/README.rst>`_
* Developers: `<docs/source/dev/README.rst>`_
Unit tests are run using this command::
$ nix-build nixos/unit-tests.nix
Unit tests are also run on CI.
The system tests are run using this command::
$ nix-build nixos/system-tests.nix
The system tests boot QEMU VMs which prevents them from running on CI at this time.
The documentation can be built using this command::
Deployment
----------
$ nix-build docs.nix
See ``morph/README.rst``.
The documentation is also built on and published by CI:
Navigate to the `list of finished jobs <https://whetstone.private.storage/privatestorage/PrivateStorageio/-/jobs>`_ and download the artefact of the latest ``docs`` build.
.. _Nix: https://nixos.org/nix
admin/create-payment-link.sh 0 → 100644
View file @ f5260620
#!/usr/bin/env bash
set -euo pipefail
KEY=$1
shift
DOMAIN=$1
shift
PRODUCT_ID=$(
curl https://api.stripe.com/v1/products \
-u "${KEY}:" \
-d "name=30 GB-months" \
-d "description=30 GB-months of Private.Storage storage × time" \
-d "statement_descriptor=PRIVATE STORAGE" \
-d "url=https://${DOMAIN}/" |
jp --unquoted id
)
echo "Product: $PRODUCT_ID"
PRICE_ID=$(
curl https://api.stripe.com/v1/prices \
-u "${KEY}:" \
-d "currency=USD" \
-d "unit_amount=650" \
-d "tax_behavior=exclusive" \
-d "product=${PRODUCT_ID}" |
jp --unquoted id
)
echo "Price: $PRICE_ID"
LINK_URL=$(
curl https://api.stripe.com/v1/payment_links \
-u "${KEY}:" \
-d "line_items[0][price]=${PRICE_ID}" \
-d "line_items[0][quantity]=1" \
-d "after_completion[type]"=redirect \
-d "after_completion[redirect][url]"="https://${DOMAIN}/payment/success" |
jp --unquoted url
)
echo "Payment link: $LINK_URL"
admin/create-webhook.sh 0 → 100644
View file @ f5260620
#!/usr/bin/env bash
set -euo pipefail
KEY=$1
shift
DOMAIN=$1
shift
curl \
https://api.stripe.com/v1/webhook_endpoints \
-u "${KEY}:" \
-d url="https://payments.${DOMAIN}/v1/stripe/webhook" \
-d "enabled_events[]"="checkout.session.completed"
ci-tools/count-vulnerabilities 0 → 100755
View file @ f5260620
#! /usr/bin/env nix-shell
#! nix-shell -i python3 -p python3
from sys import stdin
from json import load
def main():
vulnix_report = load(stdin)
print("Vulnerable packages: {}".format(len(vulnix_report)))
print("Vulnerability count: {}".format(
len(set(sum((deriv["affected_by"] for deriv in vulnix_report), []))),
))
if __name__ == '__main__':
main()
ci-tools/known_hosts.hro-cloud 0 → 100644
View file @ f5260620
monitoring.deerfield.leastauthority.com,vps-50812a54.vps.ovh.net,51.38.134.175 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOIgegzAxXPhxFK8vglBlUAFTzUoCj5TxqcLS57NaL2l
payments.deerfield.leastauthority.com,vps-3cbcf174.vps.ovh.net,217.182.78.151 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFI32csriKoUUD3e813gcEAD5CCuf8rUnary70HfJMSr
storage001.deerfield.leastauthority.com,185.225.209.174 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKX9Ei+WdNVvIncHQZ9CdEXZeSj2zBM/NQEuqmMbep0A
storage002.deerfield.leastauthority.com,38.170.241.34 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK3TAQj5agAv9AOZQhE95vATQKcNbNZj5Y3xMb5cjzGZ
storage003.deerfield.leastauthority.com,ns3728736.ip-151-80-28.eu,151.80.28.108 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsh9No4PT3hHDsY/07kDSRCg1Jse38n7GY0Rk9DnyPe
ci-tools/known_hosts.production 0 → 100644
View file @ f5260620
monitoring.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvKv2y+IAL4+oDnX7Cm5G9QuADBHUj9OxzLX0okf6hF
payments.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBlyFTJyN+VDlzGWANKqBlXeexlX/xTpp6gb5sUlA9U
storage001.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILQojjGVvmjZfDcrlec8ZmpbzMEeHd4+t4DJq1R/NUXw
storage002.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDWqK7FBzT4L1eoIU/iaEZNZxq3Jr613PmK2nbAXFs2
storage003.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHobJpQVv9GaTv8Xh9CGlL7BL5yKLxCiD3ZDdVTyt0Ep
storage004.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy96VEPp617ewxdkt+8ZgWcYkLxlVG/C7bZAq0ULH+z
storage005.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOgJBoER0lX2Rx8UIfv/3MVJXNFn9RldYmpU+EqAc9H
ci-tools/known_hosts.staging 0 → 100644
View file @ f5260620
monitoring.privatestorage-staging.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINI9kvEBaOMvpWqcFH+6nFvRriBECKB4RFShdPiIMkk9
payments.privatestorage-staging.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0eO/01VFwdoZzpclrmu656eaMkE19BaxtDdkkFHMa8
storage001.privatestorage-staging.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6iWHO9/4s3h9VIpaxgD+rgj/OQh8+jupxBoOmie3St
ci-tools/update-grid-servers 0 → 100755
View file @ f5260620
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p jp nix openssh
#
# Tell all servers belonging to a certain grid that they should update
# themselves to the latest configuration associated with that grid.
#
set -euxo pipefail
# Find the location of this script so we can refer to data files with a known
# relative location.
HERE=$(dirname $0)
# Get the path to the ssh key which authorizes us to deliver this
# notification. This path contains a base64-encoded key because of
# limitations placed on the values of GitLab job environment variables. We'll
# decode it later.
ENCODED_DEPLOY_KEY_PATH=$1
shift
# Get the name of the grid to which we're going to deliver notification. This
# corresponds to the name of one of the directories in the top-level `morph`
# directory.
GRIDNAME=$1
shift
# Tell one server to update itself.
update_one_node() {
grid_name=$1
shift
deploy_key_path=$1
shift
node=$1
shift
# Avoid both the "host key unknown" prompt and the possibility for a
# man-in-the-middle attack (on every single deploy!) by referring to a
# pre-initialized known hosts file for this grid.
#
# Then use the specified deploy key to authenticate as the deployment user
# and trigger the update on the host. There's no command here because the
# deployment key is restricted *only* the deloyment update command and the
# ssh server will supply that command itself.
ssh -o "UserKnownHostsFile=${HERE}/known_hosts.${grid_name}" -i "${deploy_key_path}" "deployment@${node}"
}
# Tell all servers belonging to one grid to update themselves.
update_grid_nodes() {
deploy_key_path=$1
shift
gridname=$1
shift
case "$gridname" in
"production")
grid_dir=./morph/grid/production
domain=private.storage
;;
"staging")
grid_dir=./morph/grid/testing
domain=privatestorage-staging.com
;;
*)
echo "Unknown grid: ${gridname}"
exit 1
esac
# Find the names of all hosts that belong to this grid. This list includes
# one extra string, "network", which is morph configuration stuff and we need
# to filter out later.
nodes=$(nix --extra-experimental-features nix-command eval --impure --json --expr "(builtins.concatStringsSep \" \" (builtins.attrNames (import $grid_dir/grid.nix)))" | jp --unquoted @)
# Tell every server in the network to update itself.
for node in ${nodes}; do
if [ "${node}" = "network" ]; then
# This isn't a server, it's part of the morph configuration.
continue
fi
update_one_node "${gridname}" "${deploy_key_path}" "${node}.${domain}"
done
}
decode_deploy_key() {
encoded_key_path=$1
shift
# Make sure the deploy key file is not readable by anyone else. Not
# that there should be anyone else looking - but OpenSSH won't even read
# it if it looks like it is too open.
umask 077
# Make up a safe-ish place on the filesystem to write the key.
decoded_key_path="$(mktemp -d)/deploy_key"
# Decode the contents of the encoded key path into a decoded key path.
base64 --decode "${encoded_key_path}" > "${decoded_key_path}"
# If OpenSSH doesn't find a newline after the last line of the key
# material then it fails to parse it. So, make sure there is one. If
# there was already one, it's fine to have an extra.
echo >> "${decoded_key_path}"
# Remove the key from the filesystem to reduce the chance of unintentional
# disclosure. Overall our handling of this key is still not *particulary*
# safe or secure but that's why the key is only authorized to perform a
# single very specific operation.
rm -v "${encoded_key_path}" >/dev/stderr
echo -n "${decoded_key_path}"
}
# Announce our intentions.
show_banner() {
echo "Hello $GITLAB_USER_LOGIN from $CI_JOB_NAME. I was triggered by $CI_PIPELINE_SOURCE"
echo "and I am deploying the $CI_COMMIT_BRANCH branch to the $GRIDNAME environment."
}
show_banner
DEPLOY_KEY_PATH="$(decode_deploy_key "${ENCODED_DEPLOY_KEY_PATH}")"
# Update the deployment
update_grid_nodes "${DEPLOY_KEY_PATH}" "${GRIDNAME}"
# Remove the decoded key from the filesystem as well.
rm -v "${DEPLOY_KEY_PATH}"
ci-tools/update-nixpkgs 0 → 100755
View file @ f5260620
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p git curl python3
# ^^
# we need git to commit and push our changes
# we need curl to create the gitlab MR
# we need python to format the data as json
set -eux -o pipefail
main() {
# This is a base64-encoded OpenSSH-format SSH private key that we can use
# to push and pull with git over ssh.
local SSHKEY=$1
shift
# This is a GitLab authentication token we can use to make API calls onto
# GitLab.
local TOKEN=$1
shift
# This is the URL of the root of the GitLab API.
local SERVER_URL=$1
shift
# This is the hostname of the GitLab server (suitable for use in a Git
# remote).
local SERVER_HOST=$1
shift
# This is the "group/project"-style identifier for the project we're working
# with.
local PROJECT_PATH=$1
shift
# The GitLab id of the project (eg, from CI_PROJECT_ID in the CI
# environment).
local PROJECT_ID=$1
shift
# The name of the branch on which to base changes and which to target with
# the resulting merge request.
local DEFAULT_BRANCH=$1
shift
# Only proceed if we have an ssh-agent.
check_agent
# Pick a branch name into which to push our work.
local SOURCE_BRANCH="nixpkgs-upgrade-$(date +%Y-%m-%d)"
setup_git
checkout_source_branch "$SSHKEY" "$SERVER_HOST" "$PROJECT_PATH" "$DEFAULT_BRANCH" "$SOURCE_BRANCH"
build "result-before"
# If nothing changed, report this and exit without an error.
if ! update_nixpkgs; then
echo "No changes."
exit 0
fi
build "result-after"
local DIFF=$(compute_diff "./result-before" "./result-after")
commit_and_push "$SSHKEY" "$SOURCE_BRANCH" "$DIFF"
create_merge_request "$SERVER_URL" "$TOKEN" "$PROJECT_ID" "$DEFAULT_BRANCH" "$SOURCE_BRANCH" "$DIFF"
}
# Add the ssh key required to push and (maybe) pull to the ssh-agent. This
# may have a limited lifetime in the agent so operations that are going to
# require the key should refresh it immediately before starting.
refresh_ssh_key() {
local KEY_BASE64=$1
shift
# A GitLab CI/CD variable set for us to use.
echo "${KEY_BASE64}" | base64 -d | ssh-add -
}
# Make git usable by setting some global mandatory options.
setup_git() {
# We may not know the git/ssh server's host key yet. In that case, learn
# it and proceed.
export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new"
git config --global user.email "update-bot@private.storage"
git config --global user.name "Update Bot"
}
# Return with an error if no ssh-agent is detected.
check_agent() {
# We require an ssh-agent to be available so we can put the ssh private
# key in it. The key is given to us in memory and we don't really want to
# put it on disk anywhere so an agent is the easiest way to make it
# available for git/ssh operations.
if [ ! -v SSH_AUTH_SOCK ]; then
echo "ssh-agent is required but missing, aborting."
exit 1
fi
}
# Make a fresh clone of the repository, make it our working directory, and
# check out the branch we intend to commit to (the "source" of the MR).
checkout_source_branch() {
local SSHKEY=$1
shift
local SERVER_HOST=$1
shift
local PROJECT_PATH=$1
shift
# The branch we'll start from.
local DEFAULT_BRANCH=$1
shift
# The name of our branch.
local BRANCH=$1
shift
# To avoid messing with the checkout we're running from (which GitLab
# tends to like to share across builds) clone it to a new temporary path.
git clone . working-copy
cd working-copy
# Make sure we know the name of a remote that points at the right place.
# Then use it to make sure the base branch is up-to-date. It usually
# should be already but in case it isn't we don't want to start from a
# stale revision.
git remote add upstream gitlab@"$SERVER_HOST":"$PROJECT_PATH".git
refresh_ssh_key "$SSHKEY"
git fetch upstream "$DEFAULT_BRANCH"
# Typically this tool runs infrequently enough that the branch doesn't
# already exist. However, as a convenience for developing on this tool
# itself, if it does already exist, wipe it and start fresh for greater
# predictability.
git branch -D "${BRANCH}" || true
# Then create a new branch starting from the mainline development branch.
git checkout -B "${BRANCH}" upstream/"$DEFAULT_BRANCH"
}
# Build all of the grids (the `morph` attribute of `default.nix`) and link the
# result to the given parameter. This will give us some material to diff.
build() {
# The name of the nix result symlink.
local RESULT=$1
shift
# The local grid can only build if you populate its users.
echo '{}' > morph/grid/local/public-keys/users.nix
nix-build -A morph -o "$RESULT"
}
# Perform the actual dependency update. If there are no changes, exit with an
# error code.
update_nixpkgs() {
# Spawn *another* nix-shell that has the *other* update-nixpkgs tool.
# Should sort out this mess sooner rather than later... Also, tell the
# tool (running from another checkout) to operate on this clone's package
# file instead of the one that's part of its own checkout.
nix-shell ../shell.nix --run 'update-nixpkgs ${PWD}/nixpkgs.json'
# Signal a kind of error if we did nothing (expected in the case where
# nixpkgs hasn't changed since we last ran).
if git diff --exit-code; then
return 1
fi
}
# Return a description of the package changes resulting from the dependency
# update.
compute_diff() {
local LEFT=$1
shift
local RIGHT=$1
shift
nix --extra-experimental-features nix-command store diff-closures "$LEFT" "$RIGHT"
}
# Commit and push all changes in the working tree along with a description of
# the package changes.
commit_and_push() {
local SSHKEY=$1
shift
local BRANCH=$1
shift
local DIFF=$1
shift
git commit -am "bump nixpkgs
```
$DIFF
```
"
refresh_ssh_key "$SSHKEY"
git push --force upstream "${BRANCH}:${BRANCH}"
}
# Create a GitLab MR for the branch we just pushed, including a description of
# the package changes it implies.
create_merge_request() {
local SERVER_URL=$1
shift
local TOKEN=$1
shift
local PROJECT_ID=$1
shift
# The target branch of the MR.
local TARGET_BRANCH=$1
shift
# The source branch of the MR.
local SOURCE_BRANCH=$1
shift
local DIFF=$1
shift
local BODY=$(python3 -c '
import sys, json, re
def rewrite_escapes(s):
# `nix store diff-closures` output is fancy and includes color codes and
# such. That looks a bit less than nice in a markdown-formatted comment so
# strip all of it. If we wanted to be fancy we could rewrite it in a
# markdown friendly way (eg using html).
return re.sub(r"\x1b\[[^m]*m", "", s)
print(json.dumps({
"id": sys.argv[1],
"target_branch": sys.argv[2],
"source_branch": sys.argv[3],
"remove_source_branch": True,
"title": "bump nixpkgs version",
"description": f"```\n{rewrite_escapes(sys.argv[4])}\n```",
}))
' "$PROJECT_ID" "$TARGET_BRANCH" "$SOURCE_BRANCH" "$DIFF")
curl --verbose -X POST --data "${BODY}" --header "Content-Type: application/json" --header "PRIVATE-TOKEN: ${TOKEN}" "${SERVER_URL}/api/v4/projects/${PROJECT_ID}/merge_requests"
}
# Pull the private ssh key and GitLab token from the environment here so we
# can work with them as arguments everywhere else. They're passed to us in
# the environment because *maybe* this is *slightly* safer than passing them
# in argv.
SSHKEY="$UPDATE_NIXPKGS_PRIVATE_SSHKEY_BASE64"
TOKEN="$UPDATE_NIXPKGS_PRIVATE_TOKEN"
# Before proceeding, remove the secrets from our environment so we don't pass
# them to child processes - none of which need them.
unset UPDATE_NIXPKGS_PRIVATE_SSHKEY_BASE64 UPDATE_NIXPKGS_PRIVATE_TOKEN
main "$SSHKEY" "$TOKEN" "$@"
ci-tools/update-production 0 → 100755
View file @ f5260620
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p git curl python3
set -eux -o pipefail
main() {
local TOKEN=$1
shift
local SERVER_URL=$1
shift
local PROJECT_ID=$1
shift
local SOURCE_BRANCH=$1
shift
local TARGET_BRANCH=$1
shift
# Make sure the things we want to talk about are locally known. GitLab
# seems to prefer to know about as few refs as possible.
checkout_git_ref "$SOURCE_BRANCH"
checkout_git_ref "$TARGET_BRANCH"
# If there have been no changes we'll just abandon this update.
if ! ensure_changes "$SOURCE_BRANCH" "$TARGET_BRANCH"; then
echo "No changes."
exit 0
fi
local NOTES=$(describe_update "$SOURCE_BRANCH" "$TARGET_BRANCH")
create_merge_request "$TOKEN" "$SERVER_URL" "$PROJECT_ID" "$SOURCE_BRANCH" "$TARGET_BRANCH" "$NOTES"
}
checkout_git_ref() {
local REF=$1
shift
git fetch origin "$REF"
}
ensure_changes() {
local SOURCE_BRANCH=$1
shift
local TARGET_BRANCH=$1
shift
if [ "$(git rev-parse origin/"$SOURCE_BRANCH")" = "$(git rev-parse origin/"$TARGET_BRANCH")" ]; then
return 1
fi
}
describe_merge_request() {
git show $rev | grep 'See merge request' | sed -e 's/See merge request //' | tr -d '[:space:]'
}
describe_merge_requests() {
local RANGE=$1
shift
local TARGET=$1
shift
# Find all of the relevant merge revisions
local onelines=$(git log --merges --first-parent -m --oneline "$RANGE" | grep "into '$TARGET'")
# Describe each merge revision
local IFS=$'\n'
for line in $onelines; do
local rev=$(echo "$line" | cut -d ' ' -f 1)
echo -n "* "
describe_merge_request $rev
echo
done
}
describe_update() {
local SOURCE_BRANCH=$1
shift
local TARGET_BRANCH=$1
shift
# Since the target (production) should not diverge from the source
# (develop) it is fine to use `..` instead of `...` in the git ranges here.
# `...` encounters problems related to discovering the merge base because
# of the way GitLab manages the git checkout on CI (I think).
local NOTES=$(git diff origin/"$TARGET_BRANCH"..origin/"$SOURCE_BRANCH" -- DEPLOYMENT-NOTES.rst)
# There often are no notes and that makes for boring reading so toss in a
# diffstat as well.
local DIFFSTAT=$(git diff --stat origin/"$TARGET_BRANCH"..origin/"$SOURCE_BRANCH")
local WHEN=$(git log --max-count=1 --format='%cI' origin/"$TARGET_BRANCH")
# Describe all of the MRs that were merged into the source branch that are
# about to be merged into the target branch.
local MR=$(describe_merge_requests origin/"$TARGET_BRANCH"..origin/"$SOURCE_BRANCH" "$SOURCE_BRANCH")
echo "\
Changes from $SOURCE_BRANCH since $WHEN
=======================================
Deployment Notes
----------------
\`\`\`
$NOTES
\`\`\`
Included Merge Requests
-----------------------
$MR
Diff Stat
---------
\`\`\`
$DIFFSTAT
\`\`\`
"
}
create_merge_request() {
local TOKEN=$1
shift
local SERVER_URL=$1
shift
local PROJECT_ID=$1
shift
# THe source branch of the MR.
local SOURCE_BRANCH=$1
shift
# The target branch of the MR.
local TARGET_BRANCH=$1
shift
local NOTES=$1
shift
local BODY=$(python3 -c '
import sys, json
print(json.dumps({
"id": sys.argv[1],
"source_branch": sys.argv[2],
"target_branch": sys.argv[3],
"remove_source_branch": True,
"title": f"update {sys.argv[3]}",
"description": sys.argv[4],
}))
' "$PROJECT_ID" "$SOURCE_BRANCH" "$TARGET_BRANCH" "$NOTES")
curl --verbose -X POST --data "${BODY}" --header "Content-Type: application/json" --header "PRIVATE-TOKEN: ${TOKEN}" "${SERVER_URL}/api/v4/projects/${PROJECT_ID}/merge_requests"
}
# Pull the GitLab token from the environment here so we can work with them as
# arguments everywhere else. They're passed to us in the environment because
# *maybe* this is *slightly* safer than passing them in argv.
#
# The name is slightly weird because it is shared with the update-nixpkgs job.
TOKEN="$UPDATE_NIXPKGS_PRIVATE_TOKEN"
# Before proceeding, remove the secrets from our environment so we don't pass
# them to child processes - none of which need them.
unset UPDATE_NIXPKGS_PRIVATE_TOKEN
main "$TOKEN" "$@"
ci-tools/vulnerability-scan 0 → 100755
View file @ f5260620
#!/usr/bin/env sh
set -xeo pipefail
#
# `morph build ...` output is like
#
# Selected 2/2 hosts (name filter:-0, limits:-0):
# 0: xx.xx.xx.xx (secrets: 1, health checks: 0)
# 1: yy.yy.yy.yy (secrets: 2, health checks: 0)
#
# /nix/store/d7spc457nnzh0rnv0f5lh1q2j435j1b9-morph
# nix result path:
# /nix/store/d7spc457nnzh0rnv0f5lh1q2j435j1b9-morph
#
# Get the last line so we can scan it.
#
OUTPUT=$1
[ -e scan-target ] && rm -v scan-target
nix-shell --run '
set -x
if morph_result=$(morph build morph/grid/testing/grid.nix 2>&1); then
object=$(echo "$morph_result" | tail -n 1)
ln -s "$object" scan-target
else
echo "$morph_result"
# exit status 0-3 reserved for vulnix result.
exit 4
fi
'
# The version (1.9.6) of vulnix in nixos-21.05 incorrectly collapses
# derivations with the same name+version, but different sets of patches
# applied. Therefore, we use a recent nixos-unstable version that has a newer
# version of vulnix included.
export NIX_PATH=nixpkgs=https://api.github.com/repos/NixOS/nixpkgs/tarball/ee084c02040e864eeeb4cf4f8538d92f7c675671
# vulnix exits with an error status if there are vulnerabilities. We told
# GitLab to allow this by setting `allow_failure` to true in the GitLab CI
# config. vulnix exit status indicates what vulnix thinks happened. If we
# upgrade to a newer GitLab then we can make GitLab pipeline behavior vary
# based on this.
#
# For now, allow 0 (no errors), 1 (only whitelisted errors), and 2
# (non-whitelisted errors). 3 indicates unexpected error so we let that
# propagate.
set +e
nix-shell -p vulnix --run 'vulnix --json ./scan-target/' | tee "$OUTPUT"
vulnix_status=$?
set -e
echo "vulnix status: $vulnix_status"
if [ $vulnix_status -eq 3 ]; then
exit $vulnix_status
else
exit 0
fi
ci-tools/with-ssh-agent 0 → 100755
View file @ f5260620
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p openssh
# This minimal helper just runs another process with an ssh-agent available to
# it. ssh-agent itself does most of that work for us so the main benefit of
# the script is that it guarantees ssh-agent is available for us to run.
# Just give ssh-agent the commmand and it will run it and then exit when it
# does. This is a nice way to do process management so as to avoid leaking
# ssh-agents. Just in case cleanup fails for some reason, we'll also give
# keys a lifetime with `-t <seconds>` so secrets don't say in memory
# indefinitely. Note this means the process run by ssh-agent must finish its
# key-requiring operation within this number of seconds of adding the key.
ssh-agent -t 30 "$@"
default.nix 0 → 100644
View file @ f5260620
{ pkgs ? import ./nixpkgs.nix { } }:
{
# Render the project documentation source to some presentation format (ie,
# html) with Sphinx.
docs = pkgs.callPackage ./docs.nix { };
# Run some system integration tests in VMs covering some of the software
# we're integrating (ie, application functionality).
system-tests = pkgs.callPackage ./nixos/system-tests.nix { };
# Run some unit tests of the Nix that ties all of these things together (ie,
# PrivateStorageio-internal library functionality).
unit-tests = pkgs.callPackage ./nixos/unit-tests.nix { };
# Build all grids into a single derivation. The derivation also has several
# attributes that are useful for exploring the configuration in a repl or
# with eval.
morph = pkgs.callPackage ./morph {};
}
docs.nix
View file @ f5260620
{ pkgs ? import <nixpkgs> { } }:
{ stdenv, lib, graphviz, plantuml, python3, sphinx }:
let
# NixOS 19.03 packaged graphviz has trouble rendering our architecture
# overview. Latest from upstream does alright, though. Use that.
make-graphviz = (import (pkgs.path + /pkgs/tools/graphics/graphviz/base.nix) {
rev = "b29d8e369011b832f72e0d250a05a0a15dcb5daa";
sha256 = "1w61filywn9cif2nryf6vd34mxxbvv25q34fd34am1rx70bk08ps";
version = "b29d8e369011b832f72e0d250a05a0a15dcb5daa";
});
graphviz = (pkgs.callPackage make-graphviz { }).overrideAttrs (old: {
patches = [];
});
pyenv = python3.withPackages (ps: [ ps.sphinx ps.sphinxcontrib_plantuml ]);
in
pkgs.callPackage ./privatestorageio.nix { inherit graphviz; }
stdenv.mkDerivation rec {
version = "0.0";
name = "privatestorageio-${version}";
src = lib.cleanSource ./.;
phases = [ "unpackPhase" "buildPhase" ];
depsBuildBuild = [
graphviz
plantuml
];
buildPhase = ''
${pyenv}/bin/sphinx-build -W docs/ $out/docs
'';
}
docs/build/.gitignore → docs/_static/.gitignore
View file @ f5260620
File moved
docs/_static/logo-ps.svg 0 → 100644
View file @ f5260620
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cc="http://creativecommons.org/ns#"
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
viewBox="0 0 191 49"
version="1.1"
id="svg9674"
sodipodi:docname="logo-ps.svg"
width="191"
height="49"
inkscape:version="0.92.4 5da689c313, 2019-01-14">
<metadata
id="metadata9680">
<rdf:RDF>
<cc:Work
rdf:about="">
<dc:format>image/svg+xml</dc:format>
<dc:type
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
<dc:title></dc:title>
</cc:Work>
</rdf:RDF>
</metadata>
<defs
id="defs9678" />
<sodipodi:namedview
pagecolor="#ffffff"
bordercolor="#666666"
borderopacity="1"
objecttolerance="10"
gridtolerance="10"
guidetolerance="10"
inkscape:pageopacity="0"
inkscape:pageshadow="2"
inkscape:window-width="1920"
inkscape:window-height="1053"
id="namedview9676"
showgrid="false"
inkscape:zoom="4.3102871"
inkscape:cx="78.298673"
inkscape:cy="-4.4028059"
inkscape:window-x="0"
inkscape:window-y="27"
inkscape:window-maximized="0"
inkscape:current-layer="svg9674" />
<g
transform="matrix(0.48643434,0,0,0.48643434,-45.092857,-45.125045)"
id="g9672">
<path
d="m 184.5423,94.5 h -42.34149 l -9,36 18,27 -9,36 h 42.34149 a 7.15849,7.15849 0 0 0 7.15851,-7.15851 v -84.683 A 7.15847,7.15847 0 0 0 184.5423,94.5 Z"
id="path9626"
inkscape:connector-curvature="0"
style="fill:#9ba2b5" />
<path
d="m 133.20081,130.5 9,-36 H 99.85932 a 7.15848,7.15848 0 0 0 -7.15851,7.15845 v 84.683 A 7.15849,7.15849 0 0 0 99.85932,193.5 h 42.34149 l 9,-36 z"
id="path9628"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 152.523,179.1012 c 0.10534,0.0651 0.21563,0.12243 0.32153,0.18664 0.0769,0.0533 0.14691,0.11554 0.22558,0.16644 0.25586,0.13819 0.50635,0.28479 0.753,0.4372 0.0856,0.0443 0.17786,0.0767 0.265,0.11841 a 8.89446,8.89446 0 0 0 7.99207,-0.11841 c 0.24664,-0.15241 0.49713,-0.299 0.753,-0.4372 a 8.97243,8.97243 0 0 0 0.22528,-14.94244 q -0.61424,-0.37226 -1.24323,-0.72174 a 8.82987,8.82987 0 0 0 -7.72717,0 q -0.62934,0.349 -1.24323,0.72174 c -0.106,0.0643 -0.21643,0.1217 -0.32183,0.18683 -0.15729,0.0814 -0.31989,0.1535 -0.4795,0.23083 l -3.17511,12.70044 a 22.4683,22.4683 0 0 1 3.65461,1.47126 z"
id="path9630"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 178.58234,136.44568 c -0.25586,-0.13818 -0.50635,-0.28479 -0.753,-0.4372 a 8.89426,8.89426 0 0 0 -7.99212,-0.11834 q -0.62934,0.349 -1.24323,0.72174 c -0.106,0.0643 -0.21643,0.1217 -0.32184,0.18683 a 22.6084,22.6084 0 0 1 -4.26269,1.67547 22.1219,22.1219 0 0 1 -12.11731,0 22.6085,22.6085 0 0 1 -4.2627,-1.67547 c -0.10541,-0.0651 -0.21582,-0.12256 -0.32184,-0.18683 q -0.61422,-0.37226 -1.24322,-0.72174 A 8.92432,8.92432 0 0 0 142.20081,135 a 8.81505,8.81505 0 0 0 -2.95752,0.51367 l 9.9776,14.96643 a 22.98752,22.98752 0 0 1 2.67127,-0.95428 22.1219,22.1219 0 0 1 12.11731,0 22.60416,22.60416 0 0 1 4.26269,1.67541 c 0.10535,0.0651 0.21564,0.12244 0.32153,0.18665 q 0.61414,0.37234 1.24311,0.72174 a 8.89389,8.89389 0 0 0 7.99255,-0.11816 c 0.24664,-0.15235 0.49713,-0.299 0.753,-0.43714 a 8.98751,8.98751 0 0 0 0,-15.10864 z"
id="path9632"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 142.20161,120.78 a 22.28435,22.28435 0 0 1 6.05865,0.84582 22.60361,22.60361 0 0 1 4.2627,1.67542 c 0.10534,0.0651 0.21563,0.12244 0.32153,0.18664 0.0769,0.0533 0.14691,0.11554 0.22558,0.16645 0.25586,0.13818 0.50635,0.28479 0.753,0.43713 0.0855,0.0443 0.17756,0.0765 0.26453,0.11816 a 8.82951,8.82951 0 0 0 7.728,0 c 0.087,-0.0416 0.17908,-0.0739 0.26453,-0.11816 0.24664,-0.15234 0.49713,-0.299 0.753,-0.43713 0.0787,-0.0509 0.14868,-0.11316 0.22558,-0.16645 a 8.9724,8.9724 0 0 0 -0.22558,-14.9422 c -0.25586,-0.13818 -0.50635,-0.28479 -0.753,-0.43719 a 8.89433,8.89433 0 0 0 -7.99213,-0.11835 c -0.0871,0.0417 -0.17938,0.074 -0.265,0.11835 -0.24664,0.1524 -0.49713,0.299 -0.753,0.43719 -0.0786,0.0508 -0.14843,0.113 -0.22528,0.1662 -0.106,0.0643 -0.21643,0.12171 -0.32183,0.18683 a 22.60785,22.60785 0 0 1 -4.2627,1.67548 22.28435,22.28435 0 0 1 -6.05865,0.84582 c -0.51056,0 -1.01581,-0.0205 -1.51624,-0.0582 l -2.44775,9.79107 a 22.0198,22.0198 0 0 1 3.96406,-0.37286 z"
id="path9634"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 142.20167,167.22 a 22.284,22.284 0 0 1 -6.05866,-0.84582 22.60749,22.60749 0 0 1 -4.26269,-1.67548 c -0.10541,-0.0651 -0.21582,-0.12256 -0.32184,-0.18683 -0.0769,-0.0532 -0.14673,-0.11536 -0.22528,-0.1662 -0.25586,-0.13818 -0.50635,-0.28479 -0.753,-0.43719 -0.0856,-0.0443 -0.17786,-0.0767 -0.265,-0.11835 a 8.82987,8.82987 0 0 0 -7.72717,0 c -0.0871,0.0417 -0.17938,0.074 -0.26495,0.11835 -0.24665,0.1524 -0.49714,0.299 -0.753,0.43719 -0.0786,0.0508 -0.14844,0.113 -0.22529,0.1662 a 8.97244,8.97244 0 0 0 0.22529,14.94244 c 0.25585,0.13819 0.50634,0.28479 0.753,0.4372 a 8.89444,8.89444 0 0 0 7.99206,0.11841 c 0.0872,-0.0417 0.17938,-0.0741 0.265,-0.11841 0.24664,-0.15241 0.49713,-0.299 0.753,-0.4372 0.0787,-0.0509 0.14868,-0.11315 0.22558,-0.16644 0.1059,-0.0642 0.21619,-0.12158 0.32154,-0.18664 a 22.60325,22.60325 0 0 1 4.26269,-1.67542 22.28365,22.28365 0 0 1 6.05866,-0.84582 c 0.50994,0 1.01464,0.0205 1.51458,0.0582 l 2.4477,-9.79071 a 22.018,22.018 0 0 1 -3.96222,0.37256 z"
id="path9636"
inkscape:connector-curvature="0"
style="fill:#837dba" />
<path
d="m 132.50953,138.47418 a 22.1219,22.1219 0 0 1 -12.11731,0 22.6085,22.6085 0 0 1 -4.2627,-1.67547 c -0.10541,-0.0651 -0.21582,-0.12256 -0.32184,-0.18683 q -0.61422,-0.37226 -1.24322,-0.72174 a 8.89429,8.89429 0 0 0 -7.99213,0.11834 c -0.24664,0.15241 -0.49713,0.299 -0.753,0.4372 a 8.98751,8.98751 0 0 0 0,15.10864 c 0.25586,0.13818 0.50635,0.28479 0.753,0.43714 a 8.89391,8.89391 0 0 0 7.99256,0.11816 q 0.62923,-0.3491 1.2431,-0.72174 c 0.1059,-0.0642 0.21619,-0.12158 0.32153,-0.18665 a 22.60426,22.60426 0 0 1 4.2627,-1.67541 22.1219,22.1219 0 0 1 12.11731,0 22.6039,22.6039 0 0 1 4.26269,1.67541 c 0.10535,0.0651 0.21564,0.12244 0.32154,0.18665 q 0.61413,0.37234 1.2431,0.72174 a 8.92443,8.92443 0 0 0 3.864,0.89038 8.81623,8.81623 0 0 0 2.95746,-0.51373 l -9.9776,-14.96637 a 22.99821,22.99821 0 0 1 -2.67119,0.95428 z"
id="path9638"
inkscape:connector-curvature="0"
style="fill:#14b1e6" />
<path
d="m 131.88032,108.89868 c -0.10541,-0.0651 -0.21582,-0.12256 -0.32184,-0.18683 -0.0769,-0.0532 -0.14673,-0.11535 -0.22528,-0.1662 -0.25586,-0.13818 -0.50635,-0.28479 -0.753,-0.43719 -0.0856,-0.0443 -0.17786,-0.0767 -0.265,-0.11835 a 8.89431,8.89431 0 0 0 -7.99212,0.11835 c -0.24665,0.1524 -0.49714,0.299 -0.753,0.43719 a 8.9724,8.9724 0 0 0 -0.22559,14.9422 c 0.0769,0.0533 0.14691,0.11554 0.22559,0.16645 0.25585,0.13818 0.50634,0.28479 0.753,0.43713 0.0854,0.0442 0.17755,0.0765 0.26452,0.11816 a 8.82951,8.82951 0 0 0 7.728,0 c 0.087,-0.0416 0.17908,-0.0739 0.26453,-0.11816 0.24664,-0.15234 0.49713,-0.299 0.753,-0.43713 0.0787,-0.0509 0.14868,-0.11316 0.22558,-0.16645 0.1059,-0.0642 0.21619,-0.12158 0.32154,-0.18664 0.15667,-0.0811 0.31866,-0.15283 0.47766,-0.22992 l 3.17547,-12.70184 a 22.46568,22.46568 0 0 1 -3.65306,-1.47077 z"
id="path9640"
inkscape:connector-curvature="0"
style="fill:#fdbd4e" />
<path
d="m 219.12973,136.39194 v 17.86779 H 209.7 v -50.76 h 16.51107 a 28.89581,28.89581 0 0 1 8.79788,1.19347 16.92927,16.92927 0 0 1 6.13456,3.33457 13.06082,13.06082 0 0 1 3.57588,5.12551 19.10887,19.10887 0 0 1 -0.0704,13.28686 14.01874,14.01874 0 0 1 -3.68054,5.28271 17.11084,17.11084 0 0 1 -6.13455,3.44035 27.269,27.269 0 0 1 -8.62281,1.22874 z m 0,-7.37191 h 7.08134 a 14.1725,14.1725 0 0 0 4.52169,-0.64938 8.3933,8.3933 0 0 0 3.18954,-1.86048 7.6225,7.6225 0 0 0 1.89357,-2.94866 11.30269,11.30269 0 0 0 0.63087,-3.87915 10.25239,10.25239 0 0 0 -0.63087,-3.68571 7.27925,7.27925 0 0 0 -1.89357,-2.8086 8.41277,8.41277 0 0 0 -3.18954,-1.77233 14.93952,14.93952 0 0 0 -4.52169,-0.61461 h -7.08134 z"
id="path9642"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 262.948,134.42616 v 19.83357 h -9.42973 v -50.76 h 15.45863 a 32.26179,32.26179 0 0 1 8.88689,1.07055 16.93562,16.93562 0 0 1 6.06414,3.00155 11.57563,11.57563 0 0 1 3.47024,4.61619 16.19409,16.19409 0 0 1 0.35114,10.75888 14.047,14.047 0 0 1 -2.17331,4.14262 14.66569,14.66569 0 0 1 -3.50546,3.26454 18.34977,18.34977 0 0 1 -4.75056,2.24639 9.34781,9.34781 0 0 1 3.08488,2.91389 l 12.68969,18.74539 h -8.48294 a 4.12749,4.12749 0 0 1 -2.08528,-0.49169 4.25394,4.25394 0 0 1 -1.45539,-1.40406 l -10.65625,-16.25315 a 3.76245,3.76245 0 0 0 -1.31455,-1.29876 4.60554,4.60554 0 0 0 -2.12049,-0.38591 z m 0,-6.77492 h 5.889 a 14.57607,14.57607 0 0 0 4.64493,-0.667 8.98368,8.98368 0 0 0 3.26,-1.84334 7.39818,7.39818 0 0 0 1.9102,-2.79048 9.662,9.662 0 0 0 0.63087,-3.54565 7.21466,7.21466 0 0 0 -2.54107,-5.93258 q -2.54255,-2.07082 -7.765,-2.07107 H 262.948 Z"
id="path9644"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 309.74548,154.25973 h -9.464 v -50.76 h 9.464 z"
id="path9646"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 316.16075,103.49973 h 7.60657 a 3.17475,3.17475 0 0 1 1.99823,0.59649 3.65908,3.65908 0 0 1 1.1561,1.54461 l 11.919,30.96169 q 0.59565,1.5096 1.13947,3.31743 0.54284,1.80783 1.03384,3.80863 a 43.61371,43.61371 0 0 1 1.99823,-7.12606 l 11.88374,-30.96169 a 3.65466,3.65466 0 0 1 1.12186,-1.47409 3.02828,3.02828 0 0 1 1.99823,-0.667 h 7.60658 l -20.47232,50.76 h -8.51815 z"
id="path9648"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 409.54645,154.25973 h -7.29163 a 3.184,3.184 0 0 1 -2.01584,-0.61412 3.48834,3.48834 0 0 1 -1.13947,-1.527 l -3.78617,-10.35583 h -20.99755 l -3.78519,10.35583 a 3.32993,3.32993 0 0 1 -1.10426,1.47409 3.1024,3.1024 0 0 1 -2.01584,0.667 h -7.32684 l 19.9109,-50.76 h 9.64 z m -32.81186,-19.16656 h 16.16092 l -6.16977,-16.8849 q -0.42106,-1.1232 -0.92918,-2.65042 -0.50908,-1.52721 -0.9996,-3.31743 -0.49,1.79022 -0.96342,3.33506 -0.47388,1.54487 -0.92918,2.70282 z"
id="path9650"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 445.33755,103.49973 v 7.75781 h -15.24934 v 43.00219 h -9.42973 V 111.25754 H 405.3397 v -7.75781 z"
id="path9652"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<path
d="m 483.3,103.49973 v 7.512 h -22.47055 v 14.07679 h 17.70238 v 7.26661 H 460.82945 V 146.7125 H 483.3 v 7.54723 h -31.96972 v -50.76 z"
id="path9654"
inkscape:connector-curvature="0"
style="fill:#38466d" />
<g
id="g9670"
style="fill:#9ba2b5">
<path
d="m 221.75979,169.04814 a 1.6756,1.6756 0 0 1 -0.41345,0.47267 0.92977,0.92977 0 0 1 -0.55869,0.15772 1.36573,1.36573 0 0 1 -0.65068,-0.19062 q -0.34713,-0.19012 -0.78817,-0.42671 a 6.60491,6.60491 0 0 0 -1.00506,-0.42671 4.02609,4.02609 0 0 0 -1.28683,-0.19014 2.77075,2.77075 0 0 0 -1.85908,0.5317 1.8073,1.8073 0 0 0 -0.611,1.43737 1.32368,1.32368 0 0 0 0.368,0.95842 3.1594,3.1594 0 0 0 0.96536,0.65651 10.40526,10.40526 0 0 0 1.36623,0.50558 q 0.76831,0.22932 1.57053,0.51186 a 14.14575,14.14575 0 0 1 1.56956,0.66281 5.24944,5.24944 0 0 1 1.36623,0.97147 4.52759,4.52759 0 0 1 0.96536,1.43786 5.11339,5.11339 0 0 1 0.368,2.04116 6.63934,6.63934 0 0 1 -0.45993,2.48141 5.79566,5.79566 0 0 1 -1.33331,2.01552 6.18765,6.18765 0 0 1 -2.1544,1.35223 8.071,8.071 0 0 1 -2.90964,0.492 9.33,9.33 0 0 1 -1.81938,-0.18384 10.73189,10.73189 0 0 1 -1.79324,-0.51864 10.41571,10.41571 0 0 1 -1.62959,-0.79392 6.90436,6.90436 0 0 1 -1.32653,-1.0242 l 1.31394,-2.07406 a 1.06183,1.06183 0 0 1 0.40667,-0.38075 1.1544,1.1544 0 0 1 0.56547,-0.14466 1.494,1.494 0 0 1 0.794,0.24964 q 0.40088,0.24964 0.90727,0.55105 a 7.3017,7.3017 0 0 0 1.16192,0.55154 4.3621,4.3621 0 0 0 1.5502,0.24964 2.95859,2.95859 0 0 0 1.87941,-0.5317 2.02489,2.02489 0 0 0 0.67,-1.687 1.59663,1.59663 0 0 0 -0.36794,-1.09 2.854,2.854 0 0 0 -0.96633,-0.69571 8.8857,8.8857 0 0 0 -1.35945,-0.48573 q -0.76251,-0.20973 -1.56279,-0.4659 a 11.39545,11.39545 0 0 1 -1.56375,-0.6304 4.91534,4.91534 0 0 1 -1.35945,-0.98453 4.6091,4.6091 0 0 1 -0.96633,-1.523 6.0472,6.0472 0 0 1 -0.367,-2.25113 5.34644,5.34644 0 0 1 0.43282,-2.10067 5.43009,5.43009 0 0 1 1.27424,-1.82489 6.27335,6.27335 0 0 1 2.06338,-1.28014 7.62291,7.62291 0 0 1 2.7983,-0.479 10.49529,10.49529 0 0 1 1.71384,0.13789 9.03161,9.03161 0 0 1 1.58312,0.40687 8.71943,8.71943 0 0 1 1.39914,0.643 6.44548,6.44548 0 0 1 1.1629,0.84713 z"
id="path9656"
inkscape:connector-curvature="0" />
<path
d="m 252.76376,165.16224 v 3.51821 h -5.38648 v 15.60985 h -4.44048 v -15.60985 h -5.38551 v -3.51821 z"
id="path9658"
inkscape:connector-curvature="0" />
<path
d="m 286.23875,174.71974 a 10.27354,10.27354 0 0 1 -0.71652,3.85977 9.11848,9.11848 0 0 1 -5.14925,5.17232 11.43851,11.43851 0 0 1 -8.13927,0 9.13458,9.13458 0 0 1 -5.16959,-5.17232 10.76783,10.76783 0 0 1 0,-7.71954 9.18359,9.18359 0 0 1 2.02368,-3.09826 9.36284,9.36284 0 0 1 3.14591,-2.06148 10.7105,10.7105 0 0 1 4.07254,-0.748 10.5851,10.5851 0 0 1 4.06673,0.75473 9.39107,9.39107 0 0 1 3.13332,2.06777 9.23712,9.23712 0 0 1 2.01593,3.09827 10.23819,10.23819 0 0 1 0.71652,3.84674 z m -4.546,0 a 8.27286,8.27286 0 0 0 -0.36794,-2.5535 5.404,5.404 0 0 0 -1.05735,-1.9236 4.566,4.566 0 0 0 -1.6877,-1.20757 5.81619,5.81619 0 0 0 -2.27349,-0.41994 5.89658,5.89658 0 0 0 -2.29189,0.41994 4.5548,4.5548 0 0 0 -1.69544,1.20757 5.41864,5.41864 0 0 0 -1.05735,1.9236 9.09,9.09 0 0 0 0,5.12007 5.4122,5.4122 0 0 0 1.05735,1.92311 4.48647,4.48647 0 0 0 1.69544,1.20128 5.97858,5.97858 0 0 0 2.29189,0.41365 5.89692,5.89692 0 0 0 2.27349,-0.41365 4.49691,4.49691 0 0 0 1.6877,-1.20128 5.39757,5.39757 0 0 0 1.05735,-1.92311 8.3194,8.3194 0 0 0 0.36792,-2.56657 z"
id="path9660"
inkscape:connector-curvature="0" />
<path
d="m 306.33808,177.21422 v 7.07608 h -4.44048 v -19.12806 h 6.2279 a 12.77976,12.77976 0 0 1 3.54,0.42672 6.65339,6.65339 0 0 1 2.39163,1.18821 4.49642,4.49642 0 0 1 1.34589,1.79829 5.94667,5.94667 0 0 1 0.42023,2.25839 6.08722,6.08722 0 0 1 -0.24885,1.7591 5.32727,5.32727 0 0 1 -0.74266,1.5293 5.73706,5.73706 0 0 1 -1.2084,1.254 6.42948,6.42948 0 0 1 -1.649,0.90568 4.21231,4.21231 0 0 1 0.83465,0.55153 3.29649,3.29649 0 0 1 0.67585,0.80069 l 4.07254,6.65614 h -4.01929 a 1.707,1.707 0 0 1 -1.60345,-0.84036 l -3.17883,-5.55307 a 1.33873,1.33873 0 0 0 -0.49285,-0.52541 1.65155,1.65155 0 0 0 -0.79494,-0.15724 z m 0,-3.05907 h 1.78742 a 4.56668,4.56668 0 0 0 1.54342,-0.22981 2.78837,2.78837 0 0 0 1.04476,-0.63668 2.42767,2.42767 0 0 0 0.59065,-0.95164 3.64347,3.64347 0 0 0 0.184,-1.17515 2.46312,2.46312 0 0 0 -0.82109,-1.96908 3.82166,3.82166 0 0 0 -2.54171,-0.70925 h -1.78742 z"
id="path9662"
inkscape:connector-curvature="0" />
<path
d="m 350.5734,184.2903 h -3.44219 a 1.5875,1.5875 0 0 1 -0.95181,-0.269 1.38682,1.38682 0 0 1 -0.519,-0.68942 l -1.13,-3.33436 h -7.2784 l -1.13,3.33436 a 1.52213,1.52213 0 0 1 -1.44466,0.95841 H 331.209 l 7.40919,-19.12806 h 4.546 z m -12.297,-7.31266 h 5.2296 l -1.76128,-5.23812 q -0.16994,-0.49855 -0.3999,-1.17515 -0.23093,-0.67563 -0.45315,-1.4635 -0.21059,0.80045 -0.43378,1.48334 -0.22366,0.68287 -0.42023,1.18144 z"
id="path9664"
inkscape:connector-curvature="0" />
<path
d="m 374.023,181.08705 a 7.55632,7.55632 0 0 0 1.62862,-0.15772 7.97375,7.97375 0 0 0 1.34009,-0.41994 V 177.608 h -1.892 a 0.91819,0.91819 0 0 1 -0.65649,-0.22352 0.74115,0.74115 0 0 1 -0.23625,-0.56411 v -2.44223 h 6.805 v 8.07416 a 10.02823,10.02823 0 0 1 -1.53083,0.92551 9.85732,9.85732 0 0 1 -1.69447,0.63669 12.63131,12.63131 0 0 1 -1.91814,0.36769 18.99954,18.99954 0 0 1 -2.18732,0.118 10.03933,10.03933 0 0 1 -3.88857,-0.74166 9.29993,9.29993 0 0 1 -5.14344,-5.1462 10.07364,10.07364 0 0 1 -0.74267,-3.89267 10.57852,10.57852 0 0 1 0.70974,-3.93185 8.84793,8.84793 0 0 1 2.0295,-3.092 9.2085,9.2085 0 0 1 3.19238,-2.02181 11.5462,11.5462 0 0 1 4.18486,-0.72183 12.171,12.171 0 0 1 2.24638,0.19691 11.0805,11.0805 0 0 1 1.93751,0.538 8.92171,8.92171 0 0 1 1.62281,0.81424 8.77189,8.77189 0 0 1 1.313,1.02372 l -1.28683,1.95649 a 1.43187,1.43187 0 0 1 -0.44056,0.433 1.04355,1.04355 0 0 1 -0.55773,0.15772 1.54043,1.54043 0 0 1 -0.81528,-0.2627 q -0.52576,-0.315 -0.99151,-0.54476 a 6.11867,6.11867 0 0 0 -0.95277,-0.37446 6.30256,6.30256 0 0 0 -1.02443,-0.21 10.11331,10.11331 0 0 0 -1.2084,-0.0653 5.513,5.513 0 0 0 -2.24639,0.43978 4.80584,4.80584 0 0 0 -1.70124,1.24047 5.60973,5.60973 0 0 0 -1.08447,1.92311 7.75773,7.75773 0 0 0 -0.38052,2.50125 8.03034,8.03034 0 0 0 0.42022,2.70445 5.80726,5.80726 0 0 0 1.16289,1.99568 4.93948,4.93948 0 0 0 1.76032,1.24047 5.70179,5.70179 0 0 0 2.22699,0.42683 z"
id="path9666"
inkscape:connector-curvature="0" />
<path
d="m 409.572,165.16224 v 3.41322 h -7.85557 v 4.46354 h 6.01683 v 3.2821 h -6.01683 v 4.556 h 7.85557 v 3.41322 h -12.32316 v -19.12808 z"
id="path9668"
inkscape:connector-curvature="0" />
</g>
</g>
</svg>