nixos/services/jenkins: Introduce declarative credentials management

[Pamplemousse]

Signed-off-by: Pamplemousse xav.maso@gmail.com

Motivation for this change

Allow declarative management of credentials for Jenkins!
Depends on #121841 (I included its commits in this PR for the .credentials option to be reviewable - work).

There is a plugin to manage credentials: https://plugins.jenkins.io/credentials/. Useful to get stuff from SCMs, sign releases, and so on.

This my first "real" contribution to the nixos/modules side of things.
In particular, I took a very naive approach regarding the management of "secrets", which might be insecure:

• Created credentials content lies in a file /var/lib/jenkins/credentials/<ID>/credentials.xml
  (However, the jenkins user already has means to read/write the content of credentials through the API anyway - i.e. I don't think this is effectively widening the attack surface.);
• I am not too sure how much of it is put into the /nix/store either.

Also, as is, here are known limitations:

• It only manages credentials for the system user (jenkins by default);
• It only manages credentials for the "(global)" scope;
• It only manages Username / Password credentials (but not other credentials types);
• It relies on the https://plugins.jenkins.io/credentials/ plugin to be installed, but as jenkinsPlugins2nix is broken, I did not know how to add it to the configuration...

I had to start somewhere, and because it's somewhat my first time in this area of the repo, I was not shooting for a "perfect" solution.

Feedback appreciated! 🙏

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.
  Signed-off-by: Pamplemousse xav.maso@gmail.com

[stale]

I marked this as stale due to inactivity. → More info

[bjornfor]

Related: I came across https://www.jenkins.io/projects/jcasc/ (Jenkins Configuration as Code) today. It creates a bit of a bootstrap issue, as you need to first install the plugin (jenkinsPlugins2Nix is not broken now btw), but seems to help making Jenkins setups more declarative.

[bjornfor]

Related: I came across https://www.jenkins.io/projects/jcasc/ (Jenkins Configuration as Code) today.

Of course, it turns out to not be truly declarative -- it supports adding and changing settings, but not removing 😢

[bjornfor]

Instead of having this assertion that withCLI must be true, you can use an absolute path to the jenkins-cli program: ${pkgs.jenkins}/bin/jenkins-cli.

[bjornfor]

TODO: Check that initialAdminPassword gets created if -Djenkins.install.runSetupWizard=false is used.

[bjornfor]

TODO: Check that initialAdminPassword gets created if -Djenkins.install.runSetupWizard=false is used.

It does not.

[bjornfor]

There is a plugin to manage credentials: https://plugins.jenkins.io/credentials/. Useful to get stuff from SCMs, sign releases, and so on.

So this change depends on users having that plugin already installed? And currently that means imperatively installing the credentials plugin? Maybe we should get declarative plugin support in jenkins first?

[Pamplemousse]

@bjornfor, indeed, as the description of the PR says:

It relies on the plugins.jenkins.io/credentials plugin to be installed, but as jenkinsPlugins2nix is broken, I did not know how to add it to the configuration...

[Pamplemousse]

Thanks for taking interest in this PR by the way @bjornfor :)
As you might have seen, this has been in there for a while. TBH, I've somewhat lost interest in Jenkins since then. Not to mention that this PR gathered no interest since two weeks ago...

[bjornfor]

@bjornfor, indeed, as the description of the PR says:

Sorry I missed that.

Should we mark this PR as a draft?