alarsyo/nixos-config
alarsyo/nixos-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

thanatos: add Nix runner

Browse source
This commit is contained in:
Antoine Martin 2024-11-20 13:31:46 +01:00
parent c88a7c2475
commit df53d20bbe
4 changed files with 43 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
hosts/thanatos/default.nix
View file

@ -40,11 +40,49 @@ in {
settings = {
concurrent = 4;
};
services.default = {
services = {
nix = {
authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
dockerImage = "alpine";
dockerVolumes = [
"/nix/store:/nix/store:ro"
"/nix/var/nix/db:/nix/var/nix/db:ro"
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
];
dockerDisableCache = true;
preBuildScript = pkgs.writeScript "setup-container" ''
mkdir -p -m 0755 /nix/var/log/nix/drvs
mkdir -p -m 0755 /nix/var/nix/gcroots
mkdir -p -m 0755 /nix/var/nix/profiles
mkdir -p -m 0755 /nix/var/nix/temproots
mkdir -p -m 0755 /nix/var/nix/userpool
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
mkdir -p -m 0700 "$HOME/.nix-defexpr"
. ${pkgs.nix}/etc/profile.d/nix.sh
${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
${pkgs.nix}/bin/nix-channel --update nixpkgs
'';
environmentVariables = {
ENV = "/etc/profile";
USER = "root";
NIX_REMOTE = "daemon";
PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
};
tagList = ["nix"];
};
default = {
authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
dockerImage = "debian:stable";
};
};
};
openssh.enable = true;
};

1
hosts/thanatos/secrets.nix
View file

@ -16,6 +16,7 @@
"users/alarsyo-hashed-password" = {};
"users/root-hashed-password" = {};
"gitlab-runner/thanatos-runner-env" = {};
"gitlab-runner/thanatos-nix-runner-env" = {};
};
};
}

BIN
modules/secrets/gitlab-runner/thanatos-nix-runner-env.age Normal file
View file

Binary file not shown.

1
modules/secrets/secrets.nix
View file

@ -14,6 +14,7 @@ in {
"gandi/api-key.age".publicKeys = [alarsyo hades];
"gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
"gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
"lohr/shared-secret.age".publicKeys = [alarsyo hades];