infrastructure

commit e13d8021cc4670c4f9dc60daad5106646d792e7c
parent 27ea1c005b272ecde9b159401116ee310ada90b2
Author: Silas Brack <silasbrack@gmail.com>
Date:   Tue,  2 Jun 2026 19:13:03 +0200

feat: idk

Diffstat:
M
modules/gitea-runner.nix
 | 
23
+++++++++++++++++++++++

1 file changed, 23 insertions(+), 0 deletions(-)
diff --git a/modules/gitea-runner.nix b/modules/gitea-runner.nix
@@ -89,12 +89,35 @@ in
 
     systemd.services.gitea-runner-default = lib.mkIf (cfg.sshKeySecretName != "") {
       serviceConfig.LoadCredential = "ssh-key:/run/secrets/${cfg.sshKeySecretName}";
+      # Run as root (+prefix) to set up /root/.ssh for nix-daemon
+      serviceConfig.ExecStartPre = let
+        rootSshSetup = pkgs.writeShellScript "gitea-runner-root-ssh-setup" ''
+          mkdir -p /root/.ssh
+          cp /run/secrets/${cfg.sshKeySecretName} /root/.ssh/id_ed25519
+          chmod 600 /root/.ssh/id_ed25519
+          : > /root/.ssh/known_hosts
+          ${lib.concatMapStringsSep "\n" (host: ''echo "${host}" >> /root/.ssh/known_hosts'') cfg.knownHosts}
+          cat > /root/.ssh/config <<SSHCONF
+Host git.fnarglebeast.com
+  IdentityFile /root/.ssh/id_ed25519
+  StrictHostKeyChecking no
+SSHCONF
+          chmod 600 /root/.ssh/config
+        '';
+      in [ "+${rootSshSetup}" ];
+      # Run as gitea-runner user to set up runner's own SSH
       preStart = lib.mkAfter ''
         mkdir -p /var/lib/gitea-runner/default/.ssh
         cp $CREDENTIALS_DIRECTORY/ssh-key /var/lib/gitea-runner/default/.ssh/id_ed25519
         chmod 600 /var/lib/gitea-runner/default/.ssh/id_ed25519
         : > /var/lib/gitea-runner/default/.ssh/known_hosts
         ${lib.concatMapStringsSep "\n" (host: ''echo "${host}" >> /var/lib/gitea-runner/default/.ssh/known_hosts'') cfg.knownHosts}
+        cat > /var/lib/gitea-runner/default/.ssh/config <<SSHCONF
+Host git.fnarglebeast.com
+  IdentityFile /var/lib/gitea-runner/default/.ssh/id_ed25519
+  StrictHostKeyChecking no
+SSHCONF
+        chmod 600 /var/lib/gitea-runner/default/.ssh/config
       '';
       serviceConfig.ExecPaths = [ "/var/lib/gitea-runner" ];
     };