Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

flake.nix

@@ -293,6 +293,32 @@
           ./hosts/git
         ];
       };
+      nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
+        #system = "x86_64-linux";
+        #pkgs = import nixpkgs { inherit system; };
+        inherit system;
+        modules = [
+          agenix.nixosModules.default
+          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
+          {
+            age.secrets = {
+              forgejo-runner-token = {
+                file = ./secrets/forgejo-runner-token-snowden.age;
+                owner = "root";
+                group = "root";
+                mode = "0444";
+              };
+              forgejo-runner-token-env = {
+                file = ./secrets/forgejo-runner-token-snowden-env.age;
+                owner = "root";
+                group = "root";
+                mode = "0444";
+              };
+            };
+          }
+          ./hosts/forgejo-runner
+        ];
+      };
     };
   #);
 }

hosts/forgejo-runner/default.nix

@@ -0,0 +1,35 @@
+{ ... }:
+
+{
+  imports = [
+    ../common.nix
+    ../../services/openssh.nix
+    ../../services/prometheus-node.nix
+    ./podman.nix
+    ./forgejo-runner.nix
+  ];
+
+  networking = {
+    hostName = "forgejo-runner";
+    firewall = {
+      allowedTCPPorts = [
+        22 # SSH
+      ];
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
+  ];
+
+  environment.etc."ssh/banner".text = ''
+     _ __   __  __    ___     ___      __   _ __
+    /\`'__\/\ \/\ \ /' _ `\ /' _ `\  /'__`\/\`'__\
+    \ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\  __/\ \ \/
+     \ \_\  \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\
+      \/_/   \/___/  \/_/\/_/\/_/\/_/\/____/ \/_/
+  '';
+  services.openssh.settings.Banner = "/etc/ssh/banner";
+
+  system.stateVersion = "26.05";
+}

hosts/forgejo-runner/forgejo-runner.nix

@@ -0,0 +1,86 @@
+{ config, pkgs, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.snowden = {
+      enable = true;
+      name = "snowden";
+      url = "https://git.berlin.ccc.de";
+      labels = [
+        "debian-stable:docker://docker.io/debian:stable-slim"
+        "alpine-latest:docker://docker.io/alpine:latest"
+        "buildkit:docker://docker.io/moby/buildkit:rootless"
+      ];
+      tokenFile = config.age.secrets.forgejo-runner-token-env.path;
+      settings = {
+        runner.labels = {
+          debian-stable = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/debian:stable-slim";
+              platform = "linux/amd64";
+            };
+          };
+          alpine-latest = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/alpine:latest";
+              platform = "linux/amd64";
+            };
+          };
+          buildkit = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/moby/buildkit:rootless";
+              platform = "linux/amd64";
+            };
+          };
+        };
+        server.connections.forgejo = {
+          url = "https://git.berlin.ccc.de/";
+          uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91";
+          token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
+        };
+        container = {
+          enable_ipv6 = true;
+          docker_host = "unix:///run/podman/podman.sock";
+        };
+      };
+    };
+  };
+
+  systemd = {
+    services."forgejo-runner-container-updater" = {
+      description = "Update forgejo runner container images";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        set -uo pipefail
+        failed=0
+        images=(
+          docker.io/library/debian:stable-slim
+          docker.io/library/alpine:latest
+          docker.io/moby/buildkit:latest
+        )
+        for image in "''${images[@]}"; do
+          echo "Pulling $image..."
+          if ! ${pkgs.podman}/bin/podman pull "$image"; then
+            echo "Failed to pull $image"
+            failed=1
+          fi
+        done
+        exit $failed
+      '';
+    };
+    timers."forgejo-runner-container-updater" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        RandomizedDelaySec = "30m";
+        Persistent = true;
+      };
+    };
+  };
+}

hosts/forgejo-runner/podman.nix

@@ -0,0 +1,26 @@
+{ ... }:
+
+{
+  virtualisation.podman = {
+    enable = true;
+    dockerSocket.enable = true;
+    autoPrune = {
+      enable = true;
+      dates = "weekly";
+    };
+    defaultNetwork.settings = {
+      dns_enabled = true;
+      ipv6_enabled = true;
+      subnets = [
+        {
+          gateway = "10.88.0.1";
+          subnet = "10.88.0.0/16";
+        }
+        {
+          gateway = "fd10:88::1";
+          subnet = "fd10:88::/64";
+        }
+      ];
+    };
+  };
+}

secrets/forgejo-runner-token-snowden-env.age

@@ -1,19 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 uH+n1w +KvGqAaNROyE3bbbjwH5UlsC8EEuJsVkvCx58ac+sE4
+-> ssh-ed25519 uH+n1w 4tK3FMRdPKHv44P532Rz/tcX6q8miYJrgcVB3cxz23w
-E+ZptaFcETE4hYPeHeLTN6Nv15dURwEyvpnkTAZC3y0
+uXs62N4xtDVr+H1fkZG60vUU84HYdR1kexnIHqtgkdo
--> ssh-ed25519 EvLbWw 7SaKZybSLPBWWR5c7x+77I+3o2VSoAWXEkM402guJzw
+-> ssh-ed25519 EvLbWw thiH3XUShIvuJer+juwSO12cNaFOUOyIXhX5SXL1bEU
-i/2BmlC/w4AwQ9FXRPkUF4IqWjDrQIYupNtwa5FTr48
+eMGzE/yPqXOpicH8ltvsgcAKqYcuiYFB/plw36IUjFg
--> ssh-ed25519 dM+fLQ ihhDunwhNoIzkgFu+GlyFXmpFnh7CPUdbqHZG1GrBk0
+-> ssh-ed25519 dM+fLQ 5U0VVjoa1twnM0E4avwxSiwkEEDqoxRm1lWUUwACtkk
-2kuiVHb5xR2dZR2K3hnxEE27W8ZTULKSg7jI7Tq1AR0
+ffCOUuLOkV5ggtoagr0JARDe+pULoxMaJdArJPKVi/Y
--> ssh-ed25519 jxWM2Q v6m2gYWR59bnMT0+5bJ6is0n1v+erNJIIdReaxzdYiI
+-> ssh-ed25519 jxWM2Q ojc8Y/RBIFTDHDjcRw1qDSifpWTIFQYC0Ql1dn6abxM
-IYL86COa5MQG9hFGadaMbr7tphadgsckYvchf3B1rVU
+diQxGCvmWBbFIjhKjPGZvrQyBgWA3INNhVoKcvG6bAc
--> ssh-ed25519 /yCUCg z1FrBS/4kUxxOQl1BWcSQczVhrQ3r/zswGhR1MIBNWo
+-> ssh-ed25519 /yCUCg JqVEwPtSOTzSVmOST9sC5NPO0HEvxXe/RpOBIGWsgAw
-8Ivi+R3gThGkSQe4QmyFIurExpRZCyDjwVNKSYe/fDo
+bAbq4R+5wZWB6cDmsjFtIYwoyqcwEf9UQSFmOhSKqD8
--> ssh-ed25519 FGp51g afHNk8lS2oJWDa5YmokpE+kD30eeSZfGb8VFc0r/H2A
+-> ssh-ed25519 FGp51g oqnuxzMu0HlPwzXLwBAf6us1NwhF77LETuWBAQEQDE8
-pDaCkHvgFeNn3X/wDPe3yAPRV+L/g64dXEEpN+85h10
+I1stznwLmISvL1G+62HAQBAux1zIYV8dEp+jz5KjH7o
--> ssh-ed25519 b5OiTQ I9iDVd4KcKpH+nwFNeyGSMIegsux2rDzuB+LnIYCBgk
+-> ssh-ed25519 b5OiTQ /NOtrSFwwJfH96h1PlJRWY31z1bB+P7FIZlDVHhQESw
-BbptMjkV3HIisjidsfPBYLU1J1vna2QpWPiR+hkiBe0
+T8cxnwSROdciAFuMVrfX95IaKWxVVJMWWxZNJVlatAI
--> ssh-ed25519 HaNCag BUbf27o6Ph2p78kpaZO7CsCtpd6wxcBIGk4kUidsrzE
+-> ssh-ed25519 HaNCag BAO4uDUuZzqnH0PFB23AA/eMWNMZ0cjKqYsNgamVLVA
-VoFu53x9AGdLDFei5C6D3Oa9UKBEdfxNh+5Nc3gGANw
+4FVo/AGOIsdwf4QIxZi9MG+vSGy5YFvFvteqeq8tOD4
---- yCHltWgEm8iJbqSTj4sd6MEkUc/KCSQCOvCqWoYgxl8
+-> ssh-ed25519 cToZIA /FUBnZiOVbZHi0ODkUdABrQUW9HMEH7KYA/PLNJloEU
-îvSîZÂ#Ò¹à¤àFY	fÊ‹«Ê¤ý÷Àp%ÀI熥Š¢³“À<E2809C>îEÄÙÀSœjû8NMdm5‡šNádüD
Rø¢Ð’`d\7ñ„Æì»’
+wKZnt/U+f/4SxKxKol2nmK9x92NF4VK9hB18rTBs/MY
+--- m7Kd/PyobnOIdz7O0yh+E9fRdQmxbf3PAPlH3+0X6Mg
+ÓûâUv<1B>ØÈþ
:é’›¬EXJl«¡ö„¼É[$
+
+Ÿý¿<02>p3ÎhYVǃ}‰xª¬#ÌÏ4ƒÖ'S
åä)¼
nÚ£0z{†ŠO

secrets/secrets.nix

@@ -24,6 +24,7 @@ let
   _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
   _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
   _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
+  _runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner";
 in
 {
   "matrix_admin_password.age".publicKeys = xengi;
@@ -65,8 +66,8 @@ in
   "caldav-export-config.age".publicKeys = xengi ++ [ _www ];
   "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
   "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
-  "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
-  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
   "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
 }