84 lines
2.6 KiB
Nix
84 lines
2.6 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
instance = "hive";
|
|
unit = "gitea-runner-${instance}";
|
|
instanceCfg = config.services.gitea-actions-runner.instances.${instance};
|
|
|
|
# The swarm store's `pki` root. fetch it on lpt2:
|
|
# /var/lib/hive-tls/trust-bundle.pem
|
|
hiveCa = "/etc/hive-ci-runner/ca.pem";
|
|
|
|
caBundle = "/run/${unit}/ca-bundle.pem";
|
|
# Same file upstream generates from `settings`.
|
|
configFile = (pkgs.formats.yaml { }).generate "config.yaml" instanceCfg.settings;
|
|
in
|
|
{
|
|
services.gitea-actions-runner.instances.${instance} = {
|
|
enable = true;
|
|
name = "swarm-ci-runner-pc2";
|
|
url = "https://forge.constellation.darkest.space";
|
|
# TOKEN=<token>, root-only, placed manually. The forge's instance
|
|
# registration token, which the hive also publishes; on lpt2:
|
|
# sudo cat /var/lib/nixos-containers/swarm-ci-runner/var/lib/swarm-ci-runner/registration-token
|
|
tokenFile = "/etc/hive-ci-runner/registration_token";
|
|
labels = [ "hive-ci:host" ];
|
|
# jobs run on the host, so builds go through pc2's own nix daemon
|
|
hostPackages = with pkgs; [
|
|
bash
|
|
coreutils
|
|
curl
|
|
gawk
|
|
gitMinimal
|
|
gnused
|
|
nodejs
|
|
wget
|
|
config.nix.package
|
|
];
|
|
settings = {
|
|
runner.capacity = 2;
|
|
runner.timeout = "1h";
|
|
};
|
|
};
|
|
|
|
systemd.services.${unit} = {
|
|
environment = {
|
|
# Go daemon, curl and git replace the system store; node adds to it.
|
|
SSL_CERT_FILE = caBundle;
|
|
GIT_SSL_CAINFO = caBundle;
|
|
NODE_EXTRA_CA_CERTS = hiveCa;
|
|
};
|
|
serviceConfig = {
|
|
RuntimeDirectory = unit;
|
|
# Before upstream's register step, which already talks to the forge.
|
|
ExecStartPre = lib.mkBefore [
|
|
(pkgs.writeShellScript "${unit}-ca-bundle" ''
|
|
set -eu
|
|
if [ ! -s ${hiveCa} ]; then
|
|
echo "${hiveCa} is missing or empty; copy lpt2's /var/lib/hive-tls/trust-bundle.pem there" >&2
|
|
exit 1
|
|
fi
|
|
cat ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${hiveCa} > ${caBundle}
|
|
'')
|
|
];
|
|
# Host jobs inherit the daemon's environment; only the register step
|
|
# (ExecStartPre) needs the token, so the daemon drops it.
|
|
ExecStart = lib.mkForce (
|
|
pkgs.writeShellScript "${unit}-daemon" ''
|
|
unset TOKEN
|
|
exec ${lib.getExe config.services.gitea-actions-runner.package} daemon --config ${configFile}
|
|
''
|
|
);
|
|
# DynamicUser state dir may be mounted noexec; jobs run what they build
|
|
# in their workspace.
|
|
ExecPaths = [
|
|
"-/var/lib/gitea-runner"
|
|
"-/var/lib/private/gitea-runner"
|
|
];
|
|
};
|
|
};
|
|
}
|