From 4eed5ee93d4d5d9ebe9b20e20de93931f126b757 Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Thu, 16 Jan 2025 18:34:21 +0100
Subject: [PATCH] hades: add gitlab runners
---
hosts/hades/default.nix | 51 +++++++++++++++++++
hosts/hades/secrets.nix | 3 ++
.../gitlab-runner/hades-nix-runner-env.age | 8 +++
.../gitlab-runner/hades-runner-env.age | 7 +++
modules/secrets/secrets.nix | 2 +
5 files changed, 71 insertions(+)
create mode 100644 modules/secrets/gitlab-runner/hades-nix-runner-env.age
create mode 100644 modules/secrets/gitlab-runner/hades-runner-env.age
diff --git a/hosts/hades/default.nix b/hosts/hades/default.nix
index e181392..f2a4158 100644
--- a/hosts/hades/default.nix
+++ b/hosts/hades/default.nix
@@ -156,6 +156,57 @@ in {
services = {
openssh.enable = true;
vnstat.enable = true;
+
+ gitlab-runner = {
+ enable = true;
+ settings = {
+ concurrent = 4;
+ };
+ services = {
+ nix = {
+ authenticationTokenConfigFile = config.age.secrets."gitlab-runner/hades-nix-runner-env".path;
+ dockerImage = "alpine";
+ dockerVolumes = [
+ "/nix/store:/nix/store:ro"
+ "/nix/var/nix/db:/nix/var/nix/db:ro"
+ "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+ ];
+ dockerDisableCache = true;
+ preBuildScript = pkgs.writeScript "setup-container" ''
+ mkdir -p -m 0755 /nix/var/log/nix/drvs
+ mkdir -p -m 0755 /nix/var/nix/gcroots
+ mkdir -p -m 0755 /nix/var/nix/profiles
+ mkdir -p -m 0755 /nix/var/nix/temproots
+ mkdir -p -m 0755 /nix/var/nix/userpool
+ mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+ mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+ mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+ mkdir -p -m 0700 "$HOME/.nix-defexpr"
+
+ . ${pkgs.nix}/etc/profile.d/nix.sh
+
+ ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
+
+ ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+ ${pkgs.nix}/bin/nix-channel --update nixpkgs
+
+ mkdir -p ~/.config/nix
+ echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
+ '';
+ environmentVariables = {
+ ENV = "/etc/profile";
+ USER = "root";
+ NIX_REMOTE = "daemon";
+ PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+ NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+ };
+ };
+ default = {
+ authenticationTokenConfigFile = config.age.secrets."gitlab-runner/hades-runner-env".path;
+ dockerImage = "debian:stable";
+ };
+ };
+ };
};
virtualisation.docker.enable = true;
diff --git a/hosts/hades/secrets.nix b/hosts/hades/secrets.nix
index 55ec422..d20db8e 100644
--- a/hosts/hades/secrets.nix
+++ b/hosts/hades/secrets.nix
@@ -13,6 +13,9 @@
// attrs;
in
lib.mapAttrs toSecret {
+ "gitlab-runner/hades-nix-runner-env".path;
+ "gitlab-runner/hades-runner-env".path;
+
"lohr/shared-secret" = {};
"matrix-synapse/secret-config" = {
diff --git a/modules/secrets/gitlab-runner/hades-nix-runner-env.age b/modules/secrets/gitlab-runner/hades-nix-runner-env.age
new file mode 100644
index 0000000..ce66f97
--- /dev/null
+++ b/modules/secrets/gitlab-runner/hades-nix-runner-env.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw 0Qkzquxwa8PSNg6yq+CsfC4JfPLfxEIBKq1krrynlxg
+QOHmNCQsV10zSnYvEeSpK95oXXlS+J4pw6EIR1KzxoU
+-> ssh-ed25519 pX8y2g YbFzF2/mWizY4SOnNKzkcBEEsHYc1mTCpzWZ5vf6Zy0
+p2E9Uh0rWa8qbf2SvB5e4lxS+MEx5KGumKd28UHW0/0
+--- naIsBkYqZMgekqmxTgESGMuFIKoagS68mfXbid7k9e0
+U�<"���{24>�e�^�����*C���g f�{���v��� I��_��F�oe3.6,cF�K
+��$�9]�@��{<���As��p!v� ת���ǕC�� �r�0iV��8�>~L
\ No newline at end of file
diff --git a/modules/secrets/gitlab-runner/hades-runner-env.age b/modules/secrets/gitlab-runner/hades-runner-env.age
new file mode 100644
index 0000000..b72657d
--- /dev/null
+++ b/modules/secrets/gitlab-runner/hades-runner-env.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw EQkuI0FlwczzVWR3wvx+lXUNd0NnUjpBhOhmmIJ8Xhk
+SXMz4M9n7kcuacBkJUg//iLYLJ5qP2BlQnD2zALskuw
+-> ssh-ed25519 pX8y2g fmzHtkHXHjHiva7dGs7Khof1VzMMj6CLC4oghYf7lEk
+Yx6G693eo5EqviIj/8t5JWjziYCSSJlwDNG92FPc7ro
+--- /vsxhnYSHZFsDJtDbl8TKTgDS/XwqkTOXB2isT6K+LY
+b��Ǚ��)<FL�0(S���0SN��Ȓ}��S뚼��� �Z �"����Q?o�
jH�;h@ �b^���h��k^zi��?��U � �GJ�� ����k1<�(z�-��iq���
\ No newline at end of file
diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
index a31f59c..452effa 100644
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@@ -13,6 +13,8 @@ let
in {
"gandi/api-key.age".publicKeys = [alarsyo hades];
+ "gitlab-runner/hades-runner-env.age".publicKeys = [alarsyo hades];
+ "gitlab-runner/hades-nix-runner-env.age".publicKeys = [alarsyo hades];
"gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
"gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];