From b16ceb22ee61fd89dcddfb0b70df689ae0ccc7d3 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 21:56:36 +0200 Subject: [PATCH 1/5] add mqtt host --- flake.nix | 10 ++++++++++ hosts/mqtt/default.nix | 39 +++++++++++++++++++++++++++++++++++++++ hosts/mqtt/mosquitto.nix | 36 ++++++++++++++++++++++++++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 hosts/mqtt/default.nix create mode 100644 hosts/mqtt/mosquitto.nix diff --git a/flake.nix b/flake.nix index c03d5d2..989ca94 100644 --- a/flake.nix +++ b/flake.nix @@ -273,6 +273,16 @@ ./hosts/git ]; }; + nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem { + #system = "x86_64-linux"; + #pkgs = import nixpkgs { inherit system; }; + inherit system; + modules = [ + agenix.nixosModules.default + { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } + ./hosts/mqtt + ]; + }; }; #); } diff --git a/hosts/mqtt/default.nix b/hosts/mqtt/default.nix new file mode 100644 index 0000000..d21dfdc --- /dev/null +++ b/hosts/mqtt/default.nix @@ -0,0 +1,39 @@ +{ ... }: + +{ + imports = [ + ../common.nix + ../../services/openssh.nix + ../../services/prometheus-node.nix + ./mqtt.nix + ]; + + networking = { + hostName = "mqtt"; + firewall = { + allowedTCPPorts = [ + 22 # SSH + 80 # HTTP/1 + 443 # HTTP/2 + ]; + allowedUDPPorts = [ + 443 # HTTP/3 + ]; + }; + }; + + environment.etc."ssh/banner".text = '' + __ __ + /\ \__/\ \__ + ___ ___ __\ \ ,_\ \ ,_\ + /' __` __`\ /'__`\ \ \/\ \ \/ + /\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_ + \ \_\ \_\ \_\ \___, \ \__\\ \__\ + \/_/\/_/\/_/\/___/\ \/__/ \/__/ + \ \_\ + \/_/ + ''; + services.openssh.settings.Banner = "/etc/ssh/banner"; + + system.stateVersion = "26.05"; +} diff --git a/hosts/mqtt/mosquitto.nix b/hosts/mqtt/mosquitto.nix new file mode 100644 index 0000000..862f93d --- /dev/null +++ b/hosts/mqtt/mosquitto.nix @@ -0,0 +1,36 @@ +{ ... }: + +{ + services.mosquitto = { + enable = true; + listeners = [ + { + port = 1883; + settings = { + ptotocol = "mqtt"; + }; + } + { + port = 8083; + settings = { + protocol = "websockets"; + }; + } + ]; + settings = { + allow_zero_length_clientid = true; + autosave_interval = 1800; + autosave_on_changes = true; + connection_messages = true; + allow_anonymous = true; + }; + logDest = "stdout"; + logType = [ + "error" + "warning" + "notice" + "information" + ]; + }; +} + From 6628ed9789202a722d0e0456f4a573ba293c0a69 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 22:54:48 +0200 Subject: [PATCH 2/5] add forgejo runner --- flake.nix | 14 +++++- hosts/forgejo-runner/default.nix | 34 +++++++++++++++ hosts/forgejo-runner/forgejo-runner.nix | 52 +++++++++++++++++++++++ hosts/mqtt/default.nix | 39 ----------------- hosts/mqtt/mosquitto.nix | 36 ---------------- secrets/forgejo-runner-token-snowden.age | Bin 1023 -> 1133 bytes secrets/secrets.nix | 3 +- 7 files changed, 100 insertions(+), 78 deletions(-) create mode 100644 hosts/forgejo-runner/default.nix create mode 100644 hosts/forgejo-runner/forgejo-runner.nix delete mode 100644 hosts/mqtt/default.nix delete mode 100644 hosts/mqtt/mosquitto.nix diff --git a/flake.nix b/flake.nix index 989ca94..b31dcbf 100644 --- a/flake.nix +++ b/flake.nix @@ -273,14 +273,24 @@ ./hosts/git ]; }; - nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem { + nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem { #system = "x86_64-linux"; #pkgs = import nixpkgs { inherit system; }; inherit system; modules = [ agenix.nixosModules.default { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } - ./hosts/mqtt + { + age.secrets = { + forgejo-runner-token-snowden = { + file = ./secrets/forgejo-runner-token-snowden.age; + owner = "root"; + group = "root"; + mode = "0444"; + }; + }; + } + ./hosts/forgejo-runner ]; }; }; diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix new file mode 100644 index 0000000..774d39a --- /dev/null +++ b/hosts/forgejo-runner/default.nix @@ -0,0 +1,34 @@ +{ ... }: + +{ + imports = [ + ../common.nix + ../../services/openssh.nix + ../../services/prometheus-node.nix + ./forgejo-runner.nix + ]; + + networking = { + hostName = "forgejo-runner"; + firewall = { + allowedTCPPorts = [ + 22 # SSH + ]; + }; + }; + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto" + ]; + + environment.etc."ssh/banner".text = '' + _ __ __ __ ___ ___ __ _ __ + /\`'__\/\ \/\ \ /' _ `\ /' _ `\ /'__`\/\`'__\ + \ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\ __/\ \ \/ + \ \_\ \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\ + \/_/ \/___/ \/_/\/_/\/_/\/_/\/____/ \/_/ + ''; + services.openssh.settings.Banner = "/etc/ssh/banner"; + + system.stateVersion = "26.05"; +} diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix new file mode 100644 index 0000000..bc17c77 --- /dev/null +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -0,0 +1,52 @@ +{ config, pkgs, ... }: + +{ + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.snowden = { + enable = true; + name = "snowden"; + url = "https://git.berlin.ccc.de"; + labels = [ + "debian-stable:docker://docker.io/debian:stable-slim" + "alpine-latest:docker://docker.io/alpine:latest" + "buildkit:docker://docker.io/moby/buildkit:rootless" + ]; + tokenFile = config.age.secrets.forgejo-runner-token-env.path; + settings = { + runner.labels = { + debian-stable = { + backend = "docker"; + backend-options = { + image = "docker.io/debian:stable-slim"; + platform = "linux/amd64"; + }; + }; + alpine-latest = { + backend = "docker"; + backend-options = { + image = "docker.io/alpine:latest"; + platform = "linux/amd64"; + }; + }; + buildkit = { + backend = "docker"; + backend-options = { + image = "docker.io/moby/buildkit:rootless"; + platform = "linux/amd64"; + }; + }; + }; + server.connections.forgejo = { + url = "https://git.berlin.ccc.de/"; + uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91"; + token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; + }; + container = { + enable_ipv6 = true; + docker_host = "unix:///run/podman/podman.sock"; + }; + }; + }; + }; +} diff --git a/hosts/mqtt/default.nix b/hosts/mqtt/default.nix deleted file mode 100644 index d21dfdc..0000000 --- a/hosts/mqtt/default.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ ... }: - -{ - imports = [ - ../common.nix - ../../services/openssh.nix - ../../services/prometheus-node.nix - ./mqtt.nix - ]; - - networking = { - hostName = "mqtt"; - firewall = { - allowedTCPPorts = [ - 22 # SSH - 80 # HTTP/1 - 443 # HTTP/2 - ]; - allowedUDPPorts = [ - 443 # HTTP/3 - ]; - }; - }; - - environment.etc."ssh/banner".text = '' - __ __ - /\ \__/\ \__ - ___ ___ __\ \ ,_\ \ ,_\ - /' __` __`\ /'__`\ \ \/\ \ \/ - /\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_ - \ \_\ \_\ \_\ \___, \ \__\\ \__\ - \/_/\/_/\/_/\/___/\ \/__/ \/__/ - \ \_\ - \/_/ - ''; - services.openssh.settings.Banner = "/etc/ssh/banner"; - - system.stateVersion = "26.05"; -} diff --git a/hosts/mqtt/mosquitto.nix b/hosts/mqtt/mosquitto.nix deleted file mode 100644 index 862f93d..0000000 --- a/hosts/mqtt/mosquitto.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ ... }: - -{ - services.mosquitto = { - enable = true; - listeners = [ - { - port = 1883; - settings = { - ptotocol = "mqtt"; - }; - } - { - port = 8083; - settings = { - protocol = "websockets"; - }; - } - ]; - settings = { - allow_zero_length_clientid = true; - autosave_interval = 1800; - autosave_on_changes = true; - connection_messages = true; - allow_anonymous = true; - }; - logDest = "stdout"; - logType = [ - "error" - "warning" - "notice" - "information" - ]; - }; -} - diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age index 33ec88e84957aa7ee8eebc00cbdb1e8e14538528..cbe40ad0d258e2e3abc2f8a444107c7c6021b579 100644 GIT binary patch literal 1133 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELX@6FH7@w zDR473Oi#=<%c^uTGJwT@$fUv z^w-aEN%0K~FEjCrN)9p$NjJ_8ODhS>E%h?12t~Kewah0eyj;O3BFtYqFfrHI)HgIe z*F-x%yEHpH-7(2A&$&Fs$1gm@$5-3WGAzQ_z?I9zBhRHEy~NqqwJg)Myu>X#!$3dE z)ZNsgG}J9CImI`>9cK7u0)h{nLH_?vDHFx*)%t>;qD98;6@Gf;V3r@{-PI50# zEYx-~3NPle@H95_a0|%}H7+#v%uOoysz}Ys4~Q~z&Gypwa}UbbP6;ZC2rDis$}2{< z&CR{Q)G%Ek)Xcx!Dc3v5INUud+qKj^D!I%x)zv8?%QB_X$RpIqFWkqoAj-2MxYC5n zKfBPSBFU{FpfbbLC(EED&^sbODI%kw(l;p2tR&bX*;L=NTstY)xXb|Ewj@*k%#c8Z zh(L44B#&}$qudI|0>khUN0&;I$VdxsmwdOh$RbN)!^)_jw5*T-{q$_E;4(7{!|?K4 zOV@wp*{Su>$&~!(1+dLBeoDT!NxPGmX>o5)$W5y74RJH8D9s6qNDIk! z_c5(3H?~Z7in7oS&oNHQ_Af0hu*|6{DM~NrGRbl;GBDFOvo!EDaW(TW%?&E{Gz`qh zsY*4=ws4AcbM`eZF!6Q`@u`gD($&>faEi<*t+a3}_6P~C2rc$Cs&uT#cMQub@Tn{e zcXtla4-78L3lB*T^QemC%1Hg2?(@Z~ce?P}DJj)+W9LWs^0vMe+E{V%yqY05>kqA0 tyiSf~7iB`u*JaIhzWd-dYlPQSw{L=F=?BFa`fK%E?mw2zIilWE4gg_IaTx#r delta 936 zcmaFM@t=KyPJL*Jv6ok*p>~c@g}Zk~d5M8d0<&kuA6UqXlY`Vv1wj;a;c}8c6d^dS7oYEaaNgUq_=xnAeXM4LUD11 zZfc5=si~o*f@_&iQh2#Sj&``eML}+ue^zLLftPbdhFd{Vo@b(|Wnhp;sdGwdq=|Q6 zK~kQ(ky}nSmqm6-wz+FrrbT2xVnAl8WoE8Ps9$7$dQwSbN?AmSYjT!$K}mQ)M7U|_ z#E;_PsfAvth2`Z*Nv;;*nIZb+9;v})g_-__Rff6cY5K+aiDenyj>Sf#1f zf=vv}$|~HQ{GD8ltFpBX^_`2%UA0XN142^V)4Ymv!_r;3%#9;_vx3dNz1*FW9Mkjk zjs3E7Ow05`eO!Hlf^&R*LY<;ae0@Em%%V&tpJf!U&+{$PkFp3X^+-!ib1E^>PRdKS zG|ves&q{VQE(=diw1~D0j^)Fith` z^hozN%J=m!bSW$F&Uf}ij{!IL0#n0ug}k)nV1v?-z(VKTM19LN-@GGFrwkBC&KWG=(VAP=JeUw!RTBNP3?vShPtbMMRw{SYIsj0%rT!vZgF z6OZ(a^o&qL19a<>O#L%M0u{1?ee(T-Eh{~XJcC`lOLDVKJ$;gs^OHk@^UVzOOT4Q} z>O6@!($&>f zNOf~HNJ&d~G0e;|_o?*rt~84Z*Y+?9D9S1_4^MLT@-QyV7c{;)MU|GnzCx X#OD0o`#E3EX$9l#&C^^~3orrz*5Ef& diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 14e5f9c..42f11a6 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -24,6 +24,7 @@ let _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring"; _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav"; _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git"; + _runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner"; in { "matrix_admin_password.age".publicKeys = xengi; @@ -66,7 +67,7 @@ in "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; } From 0ff9ab0f59bc1b5c8e0508b324e91e4aadd7efc8 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 23:03:12 +0200 Subject: [PATCH 3/5] add last secret --- flake.nix | 6 +++ secrets/forgejo-runner-token-snowden-env.age | 40 +++++++++++--------- secrets/secrets.nix | 2 +- 3 files changed, 29 insertions(+), 19 deletions(-) diff --git a/flake.nix b/flake.nix index 904b08d..510479c 100644 --- a/flake.nix +++ b/flake.nix @@ -308,6 +308,12 @@ group = "root"; mode = "0444"; }; + forgejo-runner-token-snowden-env = { + file = ./secrets/forgejo-runner-token-snowden-env.age; + owner = "root"; + group = "root"; + mode = "0444"; + }; }; } ./hosts/forgejo-runner diff --git a/secrets/forgejo-runner-token-snowden-env.age b/secrets/forgejo-runner-token-snowden-env.age index 07ec4ac..e3e4909 100644 --- a/secrets/forgejo-runner-token-snowden-env.age +++ b/secrets/forgejo-runner-token-snowden-env.age @@ -1,19 +1,23 @@ age-encryption.org/v1 --> ssh-ed25519 uH+n1w +KvGqAaNROyE3bbbjwH5UlsC8EEuJsVkvCx58ac+sE4 -E+ZptaFcETE4hYPeHeLTN6Nv15dURwEyvpnkTAZC3y0 --> ssh-ed25519 EvLbWw 7SaKZybSLPBWWR5c7x+77I+3o2VSoAWXEkM402guJzw -i/2BmlC/w4AwQ9FXRPkUF4IqWjDrQIYupNtwa5FTr48 --> ssh-ed25519 dM+fLQ ihhDunwhNoIzkgFu+GlyFXmpFnh7CPUdbqHZG1GrBk0 -2kuiVHb5xR2dZR2K3hnxEE27W8ZTULKSg7jI7Tq1AR0 --> ssh-ed25519 jxWM2Q v6m2gYWR59bnMT0+5bJ6is0n1v+erNJIIdReaxzdYiI -IYL86COa5MQG9hFGadaMbr7tphadgsckYvchf3B1rVU --> ssh-ed25519 /yCUCg z1FrBS/4kUxxOQl1BWcSQczVhrQ3r/zswGhR1MIBNWo -8Ivi+R3gThGkSQe4QmyFIurExpRZCyDjwVNKSYe/fDo --> ssh-ed25519 FGp51g afHNk8lS2oJWDa5YmokpE+kD30eeSZfGb8VFc0r/H2A -pDaCkHvgFeNn3X/wDPe3yAPRV+L/g64dXEEpN+85h10 --> ssh-ed25519 b5OiTQ I9iDVd4KcKpH+nwFNeyGSMIegsux2rDzuB+LnIYCBgk -BbptMjkV3HIisjidsfPBYLU1J1vna2QpWPiR+hkiBe0 --> ssh-ed25519 HaNCag BUbf27o6Ph2p78kpaZO7CsCtpd6wxcBIGk4kUidsrzE -VoFu53x9AGdLDFei5C6D3Oa9UKBEdfxNh+5Nc3gGANw ---- yCHltWgEm8iJbqSTj4sd6MEkUc/KCSQCOvCqWoYgxl8 -vSZ#FY fʋʤp%I熥ESj8NMdm5NdD RВ`d\7컒 \ No newline at end of file +-> ssh-ed25519 uH+n1w 4tK3FMRdPKHv44P532Rz/tcX6q8miYJrgcVB3cxz23w +uXs62N4xtDVr+H1fkZG60vUU84HYdR1kexnIHqtgkdo +-> ssh-ed25519 EvLbWw thiH3XUShIvuJer+juwSO12cNaFOUOyIXhX5SXL1bEU +eMGzE/yPqXOpicH8ltvsgcAKqYcuiYFB/plw36IUjFg +-> ssh-ed25519 dM+fLQ 5U0VVjoa1twnM0E4avwxSiwkEEDqoxRm1lWUUwACtkk +ffCOUuLOkV5ggtoagr0JARDe+pULoxMaJdArJPKVi/Y +-> ssh-ed25519 jxWM2Q ojc8Y/RBIFTDHDjcRw1qDSifpWTIFQYC0Ql1dn6abxM +diQxGCvmWBbFIjhKjPGZvrQyBgWA3INNhVoKcvG6bAc +-> ssh-ed25519 /yCUCg JqVEwPtSOTzSVmOST9sC5NPO0HEvxXe/RpOBIGWsgAw +bAbq4R+5wZWB6cDmsjFtIYwoyqcwEf9UQSFmOhSKqD8 +-> ssh-ed25519 FGp51g oqnuxzMu0HlPwzXLwBAf6us1NwhF77LETuWBAQEQDE8 +I1stznwLmISvL1G+62HAQBAux1zIYV8dEp+jz5KjH7o +-> ssh-ed25519 b5OiTQ /NOtrSFwwJfH96h1PlJRWY31z1bB+P7FIZlDVHhQESw +T8cxnwSROdciAFuMVrfX95IaKWxVVJMWWxZNJVlatAI +-> ssh-ed25519 HaNCag BAO4uDUuZzqnH0PFB23AA/eMWNMZ0cjKqYsNgamVLVA +4FVo/AGOIsdwf4QIxZi9MG+vSGy5YFvFvteqeq8tOD4 +-> ssh-ed25519 cToZIA /FUBnZiOVbZHi0ODkUdABrQUW9HMEH7KYA/PLNJloEU +wKZnt/U+f/4SxKxKol2nmK9x92NF4VK9hB18rTBs/MY +--- m7Kd/PyobnOIdz7O0yh+E9fRdQmxbf3PAPlH3+0X6Mg +Uv :EXJl[$ + + p3hYVǃ}x#4'S ) nڣ0z{O \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 42f11a6..91c10ac 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -66,7 +66,7 @@ in "caldav-export-config.age".publicKeys = xengi ++ [ _www ]; "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; From 2bfd892131d721b1a377af781ad1a5756af8ef1b Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 23:10:22 +0200 Subject: [PATCH 4/5] typo --- flake.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 510479c..48d95b0 100644 --- a/flake.nix +++ b/flake.nix @@ -302,13 +302,13 @@ { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } { age.secrets = { - forgejo-runner-token-snowden = { + forgejo-runner-token = { file = ./secrets/forgejo-runner-token-snowden.age; owner = "root"; group = "root"; mode = "0444"; }; - forgejo-runner-token-snowden-env = { + forgejo-runner-token-env = { file = ./secrets/forgejo-runner-token-snowden-env.age; owner = "root"; group = "root"; From d01553ebfe476439b3fdbc903f356ad3630180f8 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 23:13:33 +0200 Subject: [PATCH 5/5] add podman --- hosts/forgejo-runner/default.nix | 1 + hosts/forgejo-runner/forgejo-runner.nix | 34 +++++++++++++++++++++++++ hosts/forgejo-runner/podman.nix | 26 +++++++++++++++++++ 3 files changed, 61 insertions(+) create mode 100644 hosts/forgejo-runner/podman.nix diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix index 774d39a..e1b9140 100644 --- a/hosts/forgejo-runner/default.nix +++ b/hosts/forgejo-runner/default.nix @@ -5,6 +5,7 @@ ../common.nix ../../services/openssh.nix ../../services/prometheus-node.nix + ./podman.nix ./forgejo-runner.nix ]; diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index bc17c77..00689a7 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -49,4 +49,38 @@ }; }; }; + + systemd = { + services."forgejo-runner-container-updater" = { + description = "Update forgejo runner container images"; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + serviceConfig.Type = "oneshot"; + script = '' + set -uo pipefail + failed=0 + images=( + docker.io/library/debian:stable-slim + docker.io/library/alpine:latest + docker.io/moby/buildkit:latest + ) + for image in "''${images[@]}"; do + echo "Pulling $image..." + if ! ${pkgs.podman}/bin/podman pull "$image"; then + echo "Failed to pull $image" + failed=1 + fi + done + exit $failed + ''; + }; + timers."forgejo-runner-container-updater" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "daily"; + RandomizedDelaySec = "30m"; + Persistent = true; + }; + }; + }; } diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix new file mode 100644 index 0000000..462cadc --- /dev/null +++ b/hosts/forgejo-runner/podman.nix @@ -0,0 +1,26 @@ +{ ... }: + +{ + virtualisation.podman = { + enable = true; + dockerSocket.enable = true; + autoPrune = { + enable = true; + dates = "weekly"; + }; + defaultNetwork.settings = { + dns_enabled = true; + ipv6_enabled = true; + subnets = [ + { + gateway = "10.88.0.1"; + subnet = "10.88.0.0/16"; + } + { + gateway = "fd10:88::1"; + subnet = "fd10:88::/64"; + } + ]; + }; + }; +}