xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-08-21 09:28:52 +02:00
commit ad2df5e376
Signed by: xengi
SSH key fingerprint: SHA256:jxWM2RTHvxxcncXycwwWkP7HCWb4VREN05UGJTbIPZg
7 changed files with 198 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

35
hosts/forgejo-runner/default.nix Normal file
View file

@ -0,0 +1,35 @@
{ ... }:
{
imports = [
../common.nix
../../services/openssh.nix
../../services/prometheus-node.nix
./podman.nix
./forgejo-runner.nix
];
networking = {
hostName = "forgejo-runner";
firewall = {
allowedTCPPorts = [
22 # SSH
];
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
];
environment.etc."ssh/banner".text = ''
_ __ __ __ ___ ___ __ _ __
/\`'__\/\ \/\ \ /' _ `\ /' _ `\ /'__`\/\`'__\
\ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\ __/\ \ \/
\ \_\ \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\
\/_/ \/___/ \/_/\/_/\/_/\/_/\/____/ \/_/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "26.05";
}

86
hosts/forgejo-runner/forgejo-runner.nix Normal file
View file

@ -0,0 +1,86 @@
{ config, pkgs, ... }:
{
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
instances.snowden = {
enable = true;
name = "snowden";
url = "https://git.berlin.ccc.de";
labels = [
"debian-stable:docker://docker.io/debian:stable-slim"
"alpine-latest:docker://docker.io/alpine:latest"
"buildkit:docker://docker.io/moby/buildkit:rootless"
];
tokenFile = config.age.secrets.forgejo-runner-token-env.path;
settings = {
runner.labels = {
debian-stable = {
backend = "docker";
backend-options = {
image = "docker.io/debian:stable-slim";
platform = "linux/amd64";
};
};
alpine-latest = {
backend = "docker";
backend-options = {
image = "docker.io/alpine:latest";
platform = "linux/amd64";
};
};
buildkit = {
backend = "docker";
backend-options = {
image = "docker.io/moby/buildkit:rootless";
platform = "linux/amd64";
};
};
};
server.connections.forgejo = {
url = "https://git.berlin.ccc.de/";
uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91";
token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
};
container = {
enable_ipv6 = true;
docker_host = "unix:///run/podman/podman.sock";
};
};
};
};
systemd = {
services."forgejo-runner-container-updater" = {
description = "Update forgejo runner container images";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig.Type = "oneshot";
script = ''
set -uo pipefail
failed=0
images=(
docker.io/library/debian:stable-slim
docker.io/library/alpine:latest
docker.io/moby/buildkit:latest
)
for image in "''${images[@]}"; do
echo "Pulling $image..."
if ! ${pkgs.podman}/bin/podman pull "$image"; then
echo "Failed to pull $image"
failed=1
fi
done
exit $failed
'';
};
timers."forgejo-runner-container-updater" = {
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "daily";
RandomizedDelaySec = "30m";
Persistent = true;
};
};
};
}

26
hosts/forgejo-runner/podman.nix Normal file
View file

@ -0,0 +1,26 @@
{ ... }:
{
virtualisation.podman = {
enable = true;
dockerSocket.enable = true;
autoPrune = {
enable = true;
dates = "weekly";
};
defaultNetwork.settings = {
dns_enabled = true;
ipv6_enabled = true;
subnets = [
{
gateway = "10.88.0.1";
subnet = "10.88.0.0/16";
}
{
gateway = "fd10:88::1";
subnet = "fd10:88::/64";
}
];
};
};
}