infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

gitea-runner.nix (4690B)

      1 {
      2   config,
      3   pkgs,
      4   lib,
      5   ...
      6 }:
      7 
      8 let
      9   cfg = config.services.local.gitea-runner;
     10 in
     11 {
     12   options.services.local.gitea-runner = {
     13     enable = lib.mkEnableOption "Forgejo/Gitea actions runner";
     14 
     15     name = lib.mkOption {
     16       type = lib.types.str;
     17       description = "Runner instance name";
     18     };
     19 
     20     url = lib.mkOption {
     21       type = lib.types.str;
     22       default = "https://git.fnarglebeast.com";
     23       description = "Forgejo/Gitea server URL";
     24     };
     25 
     26     tokenSecretName = lib.mkOption {
     27       type = lib.types.str;
     28       description = "Name of the sops secret containing the runner token";
     29     };
     30 
     31     sshKeySecretName = lib.mkOption {
     32       type = lib.types.str;
     33       default = "";
     34       description = "Name of the sops secret containing the SSH key (optional)";
     35     };
     36 
     37     labels = lib.mkOption {
     38       type = lib.types.listOf lib.types.str;
     39       default = [
     40         "docker:docker://alpine:3.23"
     41         "native:host"
     42       ];
     43       description = "Runner labels";
     44     };
     45 
     46     hostPackages = lib.mkOption {
     47       type = lib.types.listOf lib.types.package;
     48       default = with pkgs; [
     49         nix
     50         nodejs
     51         git
     52         bash
     53         coreutils
     54         openssh
     55         curl
     56         jq
     57       ];
     58       description = "Packages available to the runner";
     59     };
     60 
     61     knownHosts = lib.mkOption {
     62       type = lib.types.listOf lib.types.str;
     63       default = [
     64         "46.62.150.48 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOKImx9KgmG+/ggpuS2z/hXkWu3TgT/xK9fI18tPOI1"
     65         "188.166.127.72 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSAe7jj+yZ4iED+6u8oPX+UqEKzcZriLEXAVbjt3Cqo"
     66         "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
     67         "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg="
     68         "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
     69       ];
     70       description = "SSH known hosts entries";
     71     };
     72   };
     73 
     74   config = lib.mkIf cfg.enable {
     75     sops.secrets.${cfg.tokenSecretName} = { };
     76     sops.secrets.${cfg.sshKeySecretName} = lib.mkIf (cfg.sshKeySecretName != "") { };
     77 
     78     services.gitea-actions-runner = {
     79       package = pkgs.forgejo-runner;
     80       instances.default = {
     81         enable = true;
     82         name = cfg.name;
     83         url = cfg.url;
     84         tokenFile = "/run/secrets/${cfg.tokenSecretName}";
     85         labels = cfg.labels;
     86         hostPackages = cfg.hostPackages;
     87       };
     88     };
     89 
     90     systemd.services.gitea-runner-default = lib.mkIf (cfg.sshKeySecretName != "") {
     91       serviceConfig.LoadCredential = "ssh-key:/run/secrets/${cfg.sshKeySecretName}";
     92       # Run as root (+prefix) to set up /root/.ssh for nix-daemon
     93       serviceConfig.ExecStartPre = let
     94         rootSshSetup = pkgs.writeShellScript "gitea-runner-root-ssh-setup" ''
     95           mkdir -p /root/.ssh
     96           cp /run/secrets/${cfg.sshKeySecretName} /root/.ssh/id_ed25519
     97           chmod 600 /root/.ssh/id_ed25519
     98           : > /root/.ssh/known_hosts
     99           ${lib.concatMapStringsSep "\n" (host: ''echo "${host}" >> /root/.ssh/known_hosts'') cfg.knownHosts}
    100           cat > /root/.ssh/config <<SSHCONF
    101 Host git.fnarglebeast.com
    102   IdentityFile /root/.ssh/id_ed25519
    103   StrictHostKeyChecking no
    104 SSHCONF
    105           chmod 600 /root/.ssh/config
    106         '';
    107       in [ "+${rootSshSetup}" ];
    108       # Run as gitea-runner user to set up runner's own SSH
    109       preStart = lib.mkAfter ''
    110         mkdir -p /var/lib/gitea-runner/default/.ssh
    111         cp $CREDENTIALS_DIRECTORY/ssh-key /var/lib/gitea-runner/default/.ssh/id_ed25519
    112         chmod 600 /var/lib/gitea-runner/default/.ssh/id_ed25519
    113         : > /var/lib/gitea-runner/default/.ssh/known_hosts
    114         ${lib.concatMapStringsSep "\n" (host: ''echo "${host}" >> /var/lib/gitea-runner/default/.ssh/known_hosts'') cfg.knownHosts}
    115         cat > /var/lib/gitea-runner/default/.ssh/config <<SSHCONF
    116 Host git.fnarglebeast.com
    117   IdentityFile /var/lib/gitea-runner/default/.ssh/id_ed25519
    118   StrictHostKeyChecking no
    119 SSHCONF
    120         chmod 600 /var/lib/gitea-runner/default/.ssh/config
    121       '';
    122       serviceConfig.ExecPaths = [ "/var/lib/gitea-runner" ];
    123     };
    124   };
    125 }