infrastructure

commit fd8cffca951f7c6ab6c682d272037b67686e05bb
parent e1a589dbd2fe987374c4b1330c3656a38ebc7cb5
Author: Silas Brack <silasbrack@gmail.com>
Date:   Mon,  1 Jun 2026 20:26:44 +0200

feat: use Forgejo remote for daily-tracker & fix gitea-runner SSH

- Switch daily-tracker flake input from path: to git+ssh:// on Forgejo
- Add git.fnarglebeast.com to runner known_hosts
- Fix known_hosts appending on every restart

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Diffstat:
M
flake.lock
 | 
15
+++++++++------
M
flake.nix
 | 
2
+-
M
hosts/gaia/configuration.nix
 | 
12
++++++++++++
M
modules/gitea-runner.nix
 | 
1
+

4 files changed, 23 insertions(+), 7 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -23,14 +23,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1780258828,
-        "narHash": "sha256-U7sAzfC2K1Ac/X+wm2pKZp83ENBt+iKTPwq8M5yczeE=",
-        "path": "/home/silas/dev/elixir-web-app/daily_tracker",
-        "type": "path"
+        "lastModified": 1780258966,
+        "narHash": "sha256-EcaInBcXGfUcoi6Uyxj7bT6sM3SrFH2BwDENikB90qs=",
+        "ref": "refs/heads/main",
+        "rev": "e360ab67cd3503b944abdfeb70ca640ba66a2948",
+        "revCount": 2,
+        "type": "git",
+        "url": "ssh://forgejo@git.fnarglebeast.com/silas/daily-tracker.git"
       },
       "original": {
-        "path": "/home/silas/dev/elixir-web-app/daily_tracker",
-        "type": "path"
+        "type": "git",
+        "url": "ssh://forgejo@git.fnarglebeast.com/silas/daily-tracker.git"
       }
     },
     "flake-compat": {
diff --git a/flake.nix b/flake.nix
@@ -4,7 +4,7 @@
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     sops-nix.url = "github:Mic92/sops-nix";
     daily-tracker = {
-      url = "path:/home/silas/dev/elixir-web-app/daily_tracker";
+      url = "git+ssh://forgejo@git.fnarglebeast.com/silas/daily-tracker.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     mkv.url = "git+ssh://git@github.com/silasbrack/mkv";
diff --git a/hosts/gaia/configuration.nix b/hosts/gaia/configuration.nix
@@ -75,6 +75,11 @@
 
   services.displayManager.ly.enable = true;
   services.desktopManager.plasma6.enable = true;
+  environment.etc."xdg/kwalletrc".text = ''
+    [Wallet]
+    Enabled=false
+    First Use=false
+  '';
 
   services.pulseaudio.enable = false;
   security.rtkit.enable = true;
@@ -511,6 +516,13 @@
     name = "silas-desktop";
     tokenSecretName = "gaia_forgejo_runner_token";
     sshKeySecretName = "gaia_gitea_runner_ssh_key";
+    knownHosts = [
+      "46.62.150.48 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOKImx9KgmG+/ggpuS2z/hXkWu3TgT/xK9fI18tPOI1"
+      "git.fnarglebeast.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOKImx9KgmG+/ggpuS2z/hXkWu3TgT/xK9fI18tPOI1"
+      "10.100.0.7 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOKImx9KgmG+/ggpuS2z/hXkWu3TgT/xK9fI18tPOI1"
+      "188.166.127.72 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSAe7jj+yZ4iED+6u8oPX+UqEKzcZriLEXAVbjt3Cqo"
+      "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
+    ];
   };
 
   # This value determines the NixOS release from which the default
diff --git a/modules/gitea-runner.nix b/modules/gitea-runner.nix
@@ -93,6 +93,7 @@ in
         mkdir -p /var/lib/gitea-runner/default/.ssh
         cp $CREDENTIALS_DIRECTORY/ssh-key /var/lib/gitea-runner/default/.ssh/id_ed25519
         chmod 600 /var/lib/gitea-runner/default/.ssh/id_ed25519
+        : > /var/lib/gitea-runner/default/.ssh/known_hosts
         ${lib.concatMapStringsSep "\n" (host: ''echo "${host}" >> /var/lib/gitea-runner/default/.ssh/known_hosts'') cfg.knownHosts}
       '';
       serviceConfig.ExecPaths = [ "/var/lib/gitea-runner" ];