fix: stop using weird drone shell pointed at wrong git repo that never worked (#6014)

move similar logic to main nix shell, and document.
misc doc fixes while passing through

---------

Co-authored-by: Darragh Elliott <me@delliott.net>
Reviewed-on: #6014
Co-authored-by: delliott <420+delliott@fsfe.org>
Co-committed-by: delliott <420+delliott@fsfe.org>

.gitignore

@@ -15,10 +15,7 @@ __pycache__
 #phpcsfixer cache
 .php-cs-fixer.cache
 # Secrets
-# docker compose
+# general secrets
 .env
-# drone
-secrets.txt
-drone_token.txt
 # editors
 .vscode

README.md

@@ -14,7 +14,7 @@ This repository contains the source files of [fsfe.org](https://fsfe.org), pdfre
 
 Our web team has compiled some information about technology used for this website on the [Information for Webmasters](https://fsfe.org/contribute/web/) page. This is mainly focused on page content.
 
-For information on how the build process works see [docs subfolder](./docs/overview.md). For more information on contributing to the buid process, please see the [contributor docs](./docs/contributing.md) for some useful tips.
+For information on how the build process works see [docs subfolder](./docs/overview.md). For more information on contributing to the build process, please see the [contributor docs](./docs/contributing.md) for some useful tips.
 
 Some tips for management can be found in the [management docs](./docs/management.md)
 
@@ -84,11 +84,11 @@ Alterations to build scripts or the files used site-wide will result in near ful
 
 ### Native
 
-We can either install the required dependencies manually using our preferred package manager. If you are a nix use one can run `nix-shell` to enter a shell with the required build dependencies.
+We can either install the required dependencies manually using our preferred package manager. If you are a nix use one can run `nix-shell` to enter a shell with the required build dependencies. It will also provision `drone-cli` for signing the CI file after changing it, and load the values in `.env` into your current shell.
 
 If installing manually, you need the python package `uv` and the node package `lessc`.
 
-Also needed are the libraries
+This also requires
 
 ```
 libxml2 libxslt
@@ -102,27 +102,21 @@ The pages can be built and served by running `uv run build`. Try `--help` for mo
 
 > Docker is used on the build server, so you can use this to replicate the exact behavior
 > **Advantage**: Reproducibility, no changes on the host system
-> **Disadvantage**: Docker breaks sometimes, bigger install size, more network usage
+> **Disadvantage**: Bigger install size, more network usage
 
 The docker build process is in some ways designed for deployment. This means that it expects some environment variables to be set to function. Namely, it will try and load ssh credentials and git credentials, and docker does not support providing default values to these.
 
 So, to stub out this functionality, please set the environment variables
-`FSFE_WEBSITE_KEY_PRIVATE FSFE_WEBSITE_KEY_PASSWORD FSFE_WEBSITE_GIT_TOKEN` to equal `none` when running docker. One can set them for the shell session, an example in bash is seen below.
+`FSFE_WEBSITE_KEY_PRIVATE FSFE_WEBSITE_KEY_PASSWORD FSFE_WEBSITE_GIT_TOKEN` to equal `none` when running docker. They can be set using a `.env` file in the report root, using a simple key value syntax, E.G
 
-```
-export FSFE_WEBSITE_KEY_PRIVATE=none;
-export FSFE_WEBSITE_KEY_PASSWORD=none;
-export FSFE_WEBSITE_GIT_TOKEN=none;
+```sh
+FSFE_WEBSITE_KEY_PRIVATE=none
+FSFE_WEBSITE_KEY_PASSWORD=none
+FSFE_WEBSITE_GIT_TOKEN=none
 ```
 
 One can then run Docker commands like `docker compose ...`.
 
-Alternatively one can prefix the Docker commands with the required variables, like so
-
-```
-FSFE_WEBSITE_KEY_PRIVATE=none FSFE_WEBSITE_KEY_PASSWORD=none FSFE_WEBSITE_GIT_TOKEN=none docker compose
-```
-
 Once your preferred method has been chosen, simply running `docker compose run --service-ports build --serve` should build the webpages and make them available over localhost.
 
 Some more explanation: we are essentially just using docker as a way to provide dependencies and then running the build script. All flags after `build` are passed to the `build` cli. The `service-ports` flag is required to open ports from the container for serving the output, not needed if not using the `--serve` flag of the build script.

drone-shell.nix

@@ -1,41 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Free Software Foundation Europe <https://fsfe.org>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-{ pkgs ? import <nixpkgs> {} }:
-
-pkgs.mkShell {
-  # we assume the repo is cloned so git is available
-  # we assume awk is present
-  buildInputs = with pkgs; [
-    drone-cli # signing
-  ];
-  shellHook = ''
-  # GIT
-  if ! git remote get-url upstream > /dev/null 2>&1 ; then
-     # REVIEW(fkobi): this could get annoying if for some reason people do not want the upstream
-     git remote add upstream git@git.fsfe.org:fsfe-system-hackers/hugo-container.git
-
-     git config branch.main.pushRemote origin
-  fi
-
-  # DRONE
-  export DRONE_SERVER=https://drone.fsfe.org
-  export DRONE_TOKEN
-
-  DRONE_FILE=drone_token.txt
-  if [[ -r $DRONE_FILE ]]; then
-     DRONE_TOKEN=$(cat $DRONE_FILE)
-  else
-     echo "Insert your drone token (found at $DRONE_SERVER/account)"
-     read -r -p "Token: " DRONE_TOKEN
-     echo -n $DRONE_TOKEN > $DRONE_FILE
-  fi
-  unset DRONE_FILE
-
-  REPO_NAME="$(git remote get-url origin | awk -F "[:.]" '{printf $4}')"
-  alias save="drone sign --save $REPO_NAME && printf 'Hash saved!' && git add .drone.yml"
-
-  echo "You are working on $REPO_NAME repository."
-  echo "Use the \"save\" alias to drone sign and git commit your drone.yml changes."
-  '';
-}

shell.nix

@@ -8,9 +8,10 @@
 let
   inherit (pkgs) lib;
   python = pkgs.python314;
+  name = "fsfe-website-env";
 in
 (pkgs.buildFHSEnv {
-  name = "fsfe-website-env";
+  inherit name;
   # Installed for host pc only
   targetPkgs =
     pkgs:
@@ -34,13 +35,12 @@ in
       prettier
       php84Packages.php-cs-fixer
       rsync
+      # drone cli for signing
+      drone-cli
     ]);
   # Installed for every architecture: only install the lib outputs
-  multiPkgs =
-    pkgs:
-    (with pkgs; [
-    ]);
-  runScript = pkgs.writeShellScript "fsfe-website-env" ''
+  multiPkgs = pkgs: (with pkgs; [ ]);
+  runScript = pkgs.writeShellScript name ''
     set -euo pipefail
     # Force uv to use Python interpreter from venv
     export UV_PYTHON="${lib.getExe python}";
@@ -54,6 +54,12 @@ in
     source .venv/bin/activate
     # install your git hooks
     lefthook install
+    # Source .env for providing vars
+    if [[ -f .env ]]; then
+      set -o allexport
+      source .env
+      set +o allexport
+    fi
     # hand control over to the caller (or start a shell)
     exec ${run}
   '';