diff --git a/flake.nix b/flake.nix index ee607cc..48d95b0 100644 --- a/flake.nix +++ b/flake.nix @@ -293,6 +293,32 @@ ./hosts/git ]; }; + nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem { + #system = "x86_64-linux"; + #pkgs = import nixpkgs { inherit system; }; + inherit system; + modules = [ + agenix.nixosModules.default + { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } + { + age.secrets = { + forgejo-runner-token = { + file = ./secrets/forgejo-runner-token-snowden.age; + owner = "root"; + group = "root"; + mode = "0444"; + }; + forgejo-runner-token-env = { + file = ./secrets/forgejo-runner-token-snowden-env.age; + owner = "root"; + group = "root"; + mode = "0444"; + }; + }; + } + ./hosts/forgejo-runner + ]; + }; }; #); } diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix new file mode 100644 index 0000000..e1b9140 --- /dev/null +++ b/hosts/forgejo-runner/default.nix @@ -0,0 +1,35 @@ +{ ... }: + +{ + imports = [ + ../common.nix + ../../services/openssh.nix + ../../services/prometheus-node.nix + ./podman.nix + ./forgejo-runner.nix + ]; + + networking = { + hostName = "forgejo-runner"; + firewall = { + allowedTCPPorts = [ + 22 # SSH + ]; + }; + }; + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto" + ]; + + environment.etc."ssh/banner".text = '' + _ __ __ __ ___ ___ __ _ __ + /\`'__\/\ \/\ \ /' _ `\ /' _ `\ /'__`\/\`'__\ + \ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\ __/\ \ \/ + \ \_\ \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\ + \/_/ \/___/ \/_/\/_/\/_/\/_/\/____/ \/_/ + ''; + services.openssh.settings.Banner = "/etc/ssh/banner"; + + system.stateVersion = "26.05"; +} diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix new file mode 100644 index 0000000..00689a7 --- /dev/null +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -0,0 +1,86 @@ +{ config, pkgs, ... }: + +{ + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.snowden = { + enable = true; + name = "snowden"; + url = "https://git.berlin.ccc.de"; + labels = [ + "debian-stable:docker://docker.io/debian:stable-slim" + "alpine-latest:docker://docker.io/alpine:latest" + "buildkit:docker://docker.io/moby/buildkit:rootless" + ]; + tokenFile = config.age.secrets.forgejo-runner-token-env.path; + settings = { + runner.labels = { + debian-stable = { + backend = "docker"; + backend-options = { + image = "docker.io/debian:stable-slim"; + platform = "linux/amd64"; + }; + }; + alpine-latest = { + backend = "docker"; + backend-options = { + image = "docker.io/alpine:latest"; + platform = "linux/amd64"; + }; + }; + buildkit = { + backend = "docker"; + backend-options = { + image = "docker.io/moby/buildkit:rootless"; + platform = "linux/amd64"; + }; + }; + }; + server.connections.forgejo = { + url = "https://git.berlin.ccc.de/"; + uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91"; + token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; + }; + container = { + enable_ipv6 = true; + docker_host = "unix:///run/podman/podman.sock"; + }; + }; + }; + }; + + systemd = { + services."forgejo-runner-container-updater" = { + description = "Update forgejo runner container images"; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + serviceConfig.Type = "oneshot"; + script = '' + set -uo pipefail + failed=0 + images=( + docker.io/library/debian:stable-slim + docker.io/library/alpine:latest + docker.io/moby/buildkit:latest + ) + for image in "''${images[@]}"; do + echo "Pulling $image..." + if ! ${pkgs.podman}/bin/podman pull "$image"; then + echo "Failed to pull $image" + failed=1 + fi + done + exit $failed + ''; + }; + timers."forgejo-runner-container-updater" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "daily"; + RandomizedDelaySec = "30m"; + Persistent = true; + }; + }; + }; +} diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix new file mode 100644 index 0000000..462cadc --- /dev/null +++ b/hosts/forgejo-runner/podman.nix @@ -0,0 +1,26 @@ +{ ... }: + +{ + virtualisation.podman = { + enable = true; + dockerSocket.enable = true; + autoPrune = { + enable = true; + dates = "weekly"; + }; + defaultNetwork.settings = { + dns_enabled = true; + ipv6_enabled = true; + subnets = [ + { + gateway = "10.88.0.1"; + subnet = "10.88.0.0/16"; + } + { + gateway = "fd10:88::1"; + subnet = "fd10:88::/64"; + } + ]; + }; + }; +} diff --git a/secrets/forgejo-runner-token-snowden-env.age b/secrets/forgejo-runner-token-snowden-env.age index 07ec4ac..e3e4909 100644 --- a/secrets/forgejo-runner-token-snowden-env.age +++ b/secrets/forgejo-runner-token-snowden-env.age @@ -1,19 +1,23 @@ age-encryption.org/v1 --> ssh-ed25519 uH+n1w +KvGqAaNROyE3bbbjwH5UlsC8EEuJsVkvCx58ac+sE4 -E+ZptaFcETE4hYPeHeLTN6Nv15dURwEyvpnkTAZC3y0 --> ssh-ed25519 EvLbWw 7SaKZybSLPBWWR5c7x+77I+3o2VSoAWXEkM402guJzw -i/2BmlC/w4AwQ9FXRPkUF4IqWjDrQIYupNtwa5FTr48 --> ssh-ed25519 dM+fLQ ihhDunwhNoIzkgFu+GlyFXmpFnh7CPUdbqHZG1GrBk0 -2kuiVHb5xR2dZR2K3hnxEE27W8ZTULKSg7jI7Tq1AR0 --> ssh-ed25519 jxWM2Q v6m2gYWR59bnMT0+5bJ6is0n1v+erNJIIdReaxzdYiI -IYL86COa5MQG9hFGadaMbr7tphadgsckYvchf3B1rVU --> ssh-ed25519 /yCUCg z1FrBS/4kUxxOQl1BWcSQczVhrQ3r/zswGhR1MIBNWo -8Ivi+R3gThGkSQe4QmyFIurExpRZCyDjwVNKSYe/fDo --> ssh-ed25519 FGp51g afHNk8lS2oJWDa5YmokpE+kD30eeSZfGb8VFc0r/H2A -pDaCkHvgFeNn3X/wDPe3yAPRV+L/g64dXEEpN+85h10 --> ssh-ed25519 b5OiTQ I9iDVd4KcKpH+nwFNeyGSMIegsux2rDzuB+LnIYCBgk -BbptMjkV3HIisjidsfPBYLU1J1vna2QpWPiR+hkiBe0 --> ssh-ed25519 HaNCag BUbf27o6Ph2p78kpaZO7CsCtpd6wxcBIGk4kUidsrzE -VoFu53x9AGdLDFei5C6D3Oa9UKBEdfxNh+5Nc3gGANw ---- yCHltWgEm8iJbqSTj4sd6MEkUc/KCSQCOvCqWoYgxl8 -vSZ#FY fʋʤp%I熥ESj8NMdm5NdD RВ`d\7컒 \ No newline at end of file +-> ssh-ed25519 uH+n1w 4tK3FMRdPKHv44P532Rz/tcX6q8miYJrgcVB3cxz23w +uXs62N4xtDVr+H1fkZG60vUU84HYdR1kexnIHqtgkdo +-> ssh-ed25519 EvLbWw thiH3XUShIvuJer+juwSO12cNaFOUOyIXhX5SXL1bEU +eMGzE/yPqXOpicH8ltvsgcAKqYcuiYFB/plw36IUjFg +-> ssh-ed25519 dM+fLQ 5U0VVjoa1twnM0E4avwxSiwkEEDqoxRm1lWUUwACtkk +ffCOUuLOkV5ggtoagr0JARDe+pULoxMaJdArJPKVi/Y +-> ssh-ed25519 jxWM2Q ojc8Y/RBIFTDHDjcRw1qDSifpWTIFQYC0Ql1dn6abxM +diQxGCvmWBbFIjhKjPGZvrQyBgWA3INNhVoKcvG6bAc +-> ssh-ed25519 /yCUCg JqVEwPtSOTzSVmOST9sC5NPO0HEvxXe/RpOBIGWsgAw +bAbq4R+5wZWB6cDmsjFtIYwoyqcwEf9UQSFmOhSKqD8 +-> ssh-ed25519 FGp51g oqnuxzMu0HlPwzXLwBAf6us1NwhF77LETuWBAQEQDE8 +I1stznwLmISvL1G+62HAQBAux1zIYV8dEp+jz5KjH7o +-> ssh-ed25519 b5OiTQ /NOtrSFwwJfH96h1PlJRWY31z1bB+P7FIZlDVHhQESw +T8cxnwSROdciAFuMVrfX95IaKWxVVJMWWxZNJVlatAI +-> ssh-ed25519 HaNCag BAO4uDUuZzqnH0PFB23AA/eMWNMZ0cjKqYsNgamVLVA +4FVo/AGOIsdwf4QIxZi9MG+vSGy5YFvFvteqeq8tOD4 +-> ssh-ed25519 cToZIA /FUBnZiOVbZHi0ODkUdABrQUW9HMEH7KYA/PLNJloEU +wKZnt/U+f/4SxKxKol2nmK9x92NF4VK9hB18rTBs/MY +--- m7Kd/PyobnOIdz7O0yh+E9fRdQmxbf3PAPlH3+0X6Mg +Uv :EXJl[$ + + p3hYVǃ}x#4'S ) nڣ0z{O \ No newline at end of file diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age index 33ec88e..cbe40ad 100644 Binary files a/secrets/forgejo-runner-token-snowden.age and b/secrets/forgejo-runner-token-snowden.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 14e5f9c..91c10ac 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -24,6 +24,7 @@ let _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring"; _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav"; _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git"; + _runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner"; in { "matrix_admin_password.age".publicKeys = xengi; @@ -65,8 +66,8 @@ in "caldav-export-config.age".publicKeys = xengi ++ [ _www ]; "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; + "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; }