xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Compare commits

base: xengi:2972bf312e925995f00c3da53ddbd5eb3cd667d6
Branches Tags
xengi:main
xengi:wip
..
compare: xengi:ee0fea854cb80fcfc8e143895840fc719e3e0efe
Branches Tags
xengi:main
xengi:wip
5 changed files with 1 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

20
flake.nix
View file

@ -293,26 +293,6 @@
./hosts/git ./hosts/git
]; ];
}; };
nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
#system = "x86_64-linux";
#pkgs = import nixpkgs { inherit system; };
inherit system;
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
{
age.secrets = {
forgejo-runner-token-snowden = {
file = ./secrets/forgejo-runner-token-snowden.age;
owner = "root";
group = "root";
mode = "0444";
};
};
}
./hosts/forgejo-runner
];
};
}; };
#); #);
} }

34
hosts/forgejo-runner/default.nix
View file

@ -1,34 +0,0 @@
{ ... }:
{
imports = [
../common.nix
../../services/openssh.nix
../../services/prometheus-node.nix
./forgejo-runner.nix
];
networking = {
hostName = "forgejo-runner";
firewall = {
allowedTCPPorts = [
22 # SSH
];
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
];
environment.etc."ssh/banner".text = ''
_ __ __ __ ___ ___ __ _ __
/\`'__\/\ \/\ \ /' _ `\ /' _ `\ /'__`\/\`'__\
\ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\ __/\ \ \/
\ \_\ \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\
\/_/ \/___/ \/_/\/_/\/_/\/_/\/____/ \/_/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "26.05";
}

52
hosts/forgejo-runner/forgejo-runner.nix
View file

@ -1,52 +0,0 @@
{ config, pkgs, ... }:
{
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
instances.snowden = {
enable = true;
name = "snowden";
url = "https://git.berlin.ccc.de";
labels = [
"debian-stable:docker://docker.io/debian:stable-slim"
"alpine-latest:docker://docker.io/alpine:latest"
"buildkit:docker://docker.io/moby/buildkit:rootless"
];
tokenFile = config.age.secrets.forgejo-runner-token-env.path;
settings = {
runner.labels = {
debian-stable = {
backend = "docker";
backend-options = {
image = "docker.io/debian:stable-slim";
platform = "linux/amd64";
};
};
alpine-latest = {
backend = "docker";
backend-options = {
image = "docker.io/alpine:latest";
platform = "linux/amd64";
};
};
buildkit = {
backend = "docker";
backend-options = {
image = "docker.io/moby/buildkit:rootless";
platform = "linux/amd64";
};
};
};
server.connections.forgejo = {
url = "https://git.berlin.ccc.de/";
uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91";
token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
};
container = {
enable_ipv6 = true;
docker_host = "unix:///run/podman/podman.sock";
};
};
};
};
}

BIN
secrets/forgejo-runner-token-snowden.age
View file

Binary file not shown.

3
secrets/secrets.nix
View file

@ -24,7 +24,6 @@ let
_monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring"; _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
_dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav"; _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
_git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git"; _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
_runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner";
in in
{ {
"matrix_admin_password.age".publicKeys = xengi; "matrix_admin_password.age".publicKeys = xengi;
@ -67,7 +66,7 @@ in
"radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
"forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
} }