xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

add forgejo runner

Browse source
This commit is contained in:
XenGi 2026-08-20 22:54:48 +02:00
commit 6628ed9789
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
7 changed files with 100 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

14
flake.nix
View file

@ -273,14 +273,24 @@
./hosts/git
];
};
nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem {
nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
#system = "x86_64-linux";
#pkgs = import nixpkgs { inherit system; };
inherit system;
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
./hosts/mqtt
{
age.secrets = {
forgejo-runner-token-snowden = {
file = ./secrets/forgejo-runner-token-snowden.age;
owner = "root";
group = "root";
mode = "0444";
};
};
}
./hosts/forgejo-runner
];
};
};

34
hosts/forgejo-runner/default.nix Normal file
View file

@ -0,0 +1,34 @@
{ ... }:
{
imports = [
../common.nix
../../services/openssh.nix
../../services/prometheus-node.nix
./forgejo-runner.nix
];
networking = {
hostName = "forgejo-runner";
firewall = {
allowedTCPPorts = [
22 # SSH
];
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
];
environment.etc."ssh/banner".text = ''
_ __ __ __ ___ ___ __ _ __
/\`'__\/\ \/\ \ /' _ `\ /' _ `\ /'__`\/\`'__\
\ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\ __/\ \ \/
\ \_\ \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\
\/_/ \/___/ \/_/\/_/\/_/\/_/\/____/ \/_/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "26.05";
}

52
hosts/forgejo-runner/forgejo-runner.nix Normal file
View file

@ -0,0 +1,52 @@
{ config, pkgs, ... }:
{
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
instances.snowden = {
enable = true;
name = "snowden";
url = "https://git.berlin.ccc.de";
labels = [
"debian-stable:docker://docker.io/debian:stable-slim"
"alpine-latest:docker://docker.io/alpine:latest"
"buildkit:docker://docker.io/moby/buildkit:rootless"
];
tokenFile = config.age.secrets.forgejo-runner-token-env.path;
settings = {
runner.labels = {
debian-stable = {
backend = "docker";
backend-options = {
image = "docker.io/debian:stable-slim";
platform = "linux/amd64";
};
};
alpine-latest = {
backend = "docker";
backend-options = {
image = "docker.io/alpine:latest";
platform = "linux/amd64";
};
};
buildkit = {
backend = "docker";
backend-options = {
image = "docker.io/moby/buildkit:rootless";
platform = "linux/amd64";
};
};
};
server.connections.forgejo = {
url = "https://git.berlin.ccc.de/";
uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91";
token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
};
container = {
enable_ipv6 = true;
docker_host = "unix:///run/podman/podman.sock";
};
};
};
};
}

39
hosts/mqtt/default.nix
View file

@ -1,39 +0,0 @@
{ ... }:
{
imports = [
../common.nix
../../services/openssh.nix
../../services/prometheus-node.nix
./mqtt.nix
];
networking = {
hostName = "mqtt";
firewall = {
allowedTCPPorts = [
22 # SSH
80 # HTTP/1
443 # HTTP/2
];
allowedUDPPorts = [
443 # HTTP/3
];
};
};
environment.etc."ssh/banner".text = ''
__ __
/\ \__/\ \__
___ ___ __\ \ ,_\ \ ,_\
/' __` __`\ /'__`\ \ \/\ \ \/
/\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_
\ \_\ \_\ \_\ \___, \ \__\\ \__\
\/_/\/_/\/_/\/___/\ \/__/ \/__/
\ \_\
\/_/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "26.05";
}

36
hosts/mqtt/mosquitto.nix
View file

@ -1,36 +0,0 @@
{ ... }:
{
services.mosquitto = {
enable = true;
listeners = [
{
port = 1883;
settings = {
ptotocol = "mqtt";
};
}
{
port = 8083;
settings = {
protocol = "websockets";
};
}
];
settings = {
allow_zero_length_clientid = true;
autosave_interval = 1800;
autosave_on_changes = true;
connection_messages = true;
allow_anonymous = true;
};
logDest = "stdout";
logType = [
"error"
"warning"
"notice"
"information"
];
};
}

BIN
secrets/forgejo-runner-token-snowden.age
View file

Binary file not shown.

3
secrets/secrets.nix
View file

@ -24,6 +24,7 @@ let
_monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
_dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
_git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
_runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner";
in
{
"matrix_admin_password.age".publicKeys = xengi;
@ -66,7 +67,7 @@ in
"radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
"forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
"forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
}