Host marvin-mk2

[timokau]

I'd like to move the marvin-mk2 bot (repo) onto nix-community infrastructure before starting to test it on nixpkgs.

It should consume very little resources. Would that be possible? If so, how should I go about it?

[ryantm]

You'll need to have a GitHub token secret, right? For that, you'll need to have a GPG key with git-crypt. Also, all the current people who have access to the secrets will need to be okay with you having access.

I am okay with you having access.

Then, you will need to make a PR that adds NixOS configuration for running your bot.

[timokau]

Sounds good!

It's built as a GitHub App now, so it will need

• a gpg private key generated by GitHub (this is then used to derive a JWT which is in turn used to ask github for an ephemeral installation token...)
• a webhook secret to make sure the bot only reacts to the real webhook events and
• I think the GH App ID is not public information either, so it can't hurt to treat that as a secret as well.

I haven't used git crypt before. So that would basically mean that someone with an already whitelisted key would add my gpg public key to the whitelist?

Since the secrets should only be a one-time setup, I'd be okay with just letting one of the pre-existing admins set that up if that is easier.

[ryantm]

You also need access to the secrets to deploy to the server. If you don't care about that, I can add your secrets for you.

[timokau]

Ah, I assumed it just deploys directly from github's master. Being able to deploy fixed might be useful, but I could also live without that since there are already 6 admins.

I created #25 to get started with the configuration part. I modeled it after your nixpkgs-update config.

[adisbladis]

Fixed! We're now hosting it :)

[timokau]

Also, all the current people who have access to the secrets will need to be okay with you having access.

Should I open an issue about this? Having to nag one of you every time I'd like to deploy an update is not ideal, especially since I can't control when a deploy happens :)

[ryantm]

Yes, it's probably best to open another issue, then I can ping all the people with access to get their okay.