From 4895337ceff92b644480bb6f33d7c82e937a9bb5 Mon Sep 17 00:00:00 2001 From: Charlotte Van Petegem Date: Sat, 28 Jan 2023 11:50:11 +0100 Subject: [PATCH] Setup gitlab-runner --- machines/urithiru/default.nix | 1 + machines/urithiru/hardware.nix | 8 ++ modules/base/network/wireguard.nix | 4 +- modules/services/git/default.nix | 2 + modules/services/git/runner.nix | 71 ++++++++++++++++++ secrets.nix | 1 + .../services/gitlab-runner/registration.age | Bin 0 -> 606 bytes 7 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 modules/services/git/runner.nix create mode 100644 secrets/passwords/services/gitlab-runner/registration.age diff --git a/machines/urithiru/default.nix b/machines/urithiru/default.nix index bba260b5..37990798 100644 --- a/machines/urithiru/default.nix +++ b/machines/urithiru/default.nix @@ -53,6 +53,7 @@ enable = true; count = 6; }; + git.runner.enable = true; }; }; diff --git a/machines/urithiru/hardware.nix b/machines/urithiru/hardware.nix index b0aaac82..9608313d 100644 --- a/machines/urithiru/hardware.nix +++ b/machines/urithiru/hardware.nix @@ -51,6 +51,14 @@ device = "zdata/data"; fsType = "zfs"; }; + "/var/lib/private/gitlab-runner" = { + device = "zdata/big-apps/gitlab-runner"; + fsType = "zfs"; + }; + "/var/lib/docker" = { + device = "zdata/big-apps/docker"; + fsType = "zfs"; + }; "/boot/ESP0" = { device = "/dev/disk/by-uuid/6ED1-0638"; fsType = "vfat"; diff --git a/modules/base/network/wireguard.nix b/modules/base/network/wireguard.nix index 93a4cc0d..75fc14e7 100644 --- a/modules/base/network/wireguard.nix +++ b/modules/base/network/wireguard.nix @@ -142,8 +142,8 @@ in wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; script = '' - ${pkgs.udp2raw}/bin/udp2raw -s -l 0.0.0.0:8080 -r 127.0.0.1:51820 \ - -k "$(cat ${config.age.secrets."files/wireguard/udp2raw".path})" + ${pkgs.udp2raw}/bin/udp2raw -s -l 0.0.0.0:8080 -r 127.0.0.1:51820 \ + -k "$(cat ${config.age.secrets."files/wireguard/udp2raw".path})" ''; }; udp2raw-client = lib.mkIf config.chvp.base.network.wireguard.onCorporate { diff --git a/modules/services/git/default.nix b/modules/services/git/default.nix index 4397699c..94eae7fb 100644 --- a/modules/services/git/default.nix +++ b/modules/services/git/default.nix @@ -1,6 +1,8 @@ { config, lib, pkgs, ... }: { + imports = [ ./runner.nix ]; + options.chvp.services.git.enable = lib.mkOption { default = false; example = true; diff --git a/modules/services/git/runner.nix b/modules/services/git/runner.nix new file mode 100644 index 00000000..ef88a787 --- /dev/null +++ b/modules/services/git/runner.nix @@ -0,0 +1,71 @@ +{ config, lib, pkgs, ... }: + +{ + options.chvp.services.git.runner.enable = lib.mkOption { + default = false; + example = true; + }; + + config = lib.mkIf config.chvp.services.git.runner.enable { + services.gitlab-runner = { + enable = true; + services = { + nix = { + registrationConfigFile = config.age.secrets."passwords/services/gitlab-runner/registration".path; + dockerImage = "alpine"; + dockerVolumes = [ + "/nix/store:/nix/store:ro" + "/nix/var/nix/db:/nix/var/nix/db:ro" + "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro" + ]; + dockerDisableCache = true; + preBuildScript = pkgs.writeScript "setup-container" '' + mkdir -p -m 0755 /nix/var/log/nix/drvs + mkdir -p -m 0755 /nix/var/nix/gcroots + mkdir -p -m 0755 /nix/var/nix/profiles + mkdir -p -m 0755 /nix/var/nix/temproots + mkdir -p -m 0755 /nix/var/nix/userpool + mkdir -p -m 1777 /nix/var/nix/gcroots/per-user + mkdir -p -m 1777 /nix/var/nix/profiles/per-user + mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root + mkdir -p -m 0700 "$HOME/.nix-defexpr" + + . ${pkgs.nix}/etc/profile.d/nix.sh + + ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [ nix cacert git openssh ])} + + ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable + ${pkgs.nix}/bin/nix-channel --update nixpkgs + ''; + environmentVariables = { + ENV = "/etc/profile"; + USER = "root"; + NIX_REMOTE = "daemon"; + PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin"; + NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"; + }; + tagList = [ "nix" ]; + }; + docker-images = { + registrationConfigFile = config.age.secrets."passwords/services/gitlab-runner/registration".path; + dockerImage = "docker:stable"; + dockerVolumes = [ + "/var/run/docker.sock:/var/run/docker.sock" + ]; + tagList = [ "docker-images" ]; + }; + default = { + registrationConfigFile = config.age.secrets."passwords/services/gitlab-runner/registration".path; + dockerImage = "debian:stable"; + }; + }; + }; + virtualisation.docker = { + enable = true; + storageDriver = "zfs"; + }; + age.secrets."passwords/services/gitlab-runner/registration" = { + file = ../../../secrets/passwords/services/gitlab-runner/registration.age; + }; + }; +} diff --git a/secrets.nix b/secrets.nix index 82f81182..0632562d 100644 --- a/secrets.nix +++ b/secrets.nix @@ -58,6 +58,7 @@ in "secrets/passwords/services/git/jws.age".publicKeys = [ lasting-integrity ] ++ users; "secrets/passwords/services/git/otp.age".publicKeys = [ lasting-integrity ] ++ users; "secrets/passwords/services/git/secret.age".publicKeys = [ lasting-integrity ] ++ users; + "secrets/passwords/services/gitlab-runner/registration.age".publicKeys = [ urithiru ] ++ users; "secrets/passwords/services/mastodon/otp.age".publicKeys = [ lasting-integrity ] ++ users; "secrets/passwords/services/mastodon/key.age".publicKeys = [ lasting-integrity ] ++ users; diff --git a/secrets/passwords/services/gitlab-runner/registration.age b/secrets/passwords/services/gitlab-runner/registration.age new file mode 100644 index 0000000000000000000000000000000000000000..652f6b342c37ebb20febae9bb44701714635b943 GIT binary patch literal 606 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCT)3`lcz3RG~)C~?bo zNy;~LkFapl_f6CGaxO@B%&agl_AkvZPfpBCayHK>jmmIx%;z#T(=QHn4E3_eB3;41D5@aG(AzIJ**v*C zw<0;vD6r5y%q1fv#Go)Jz{k|BAg|OZu+-Tn*o3RZC^FAHyDBVMKil8ODc>~HBQq?- z$SpA|$T!0!H6tjvz$GA{xHQo*I~3iv%ET0tus{VDk08tRz=ARtZ8vwv98;rE_tF5f zfHc$Kq>!M(l47%}{IDpWD5I2$^iZy{VsGaFKkfXWQddWJr$}GN;s}#`7hmmE=imZ= z7pK&4zZ`QvlSKbqh~KnKbF2%^^!#