diff --git a/hosts/thanatos/default.nix b/hosts/thanatos/default.nix index 50e22ea..ab960eb 100644 --- a/hosts/thanatos/default.nix +++ b/hosts/thanatos/default.nix @@ -40,9 +40,49 @@ in { settings = { concurrent = 4; }; - services.default = { - authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path; - dockerImage = "debian:stable"; + services = { + nix = { + authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path; + dockerImage = "alpine"; + dockerVolumes = [ + "/nix/store:/nix/store:ro" + "/nix/var/nix/db:/nix/var/nix/db:ro" + "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro" + ]; + dockerDisableCache = true; + preBuildScript = pkgs.writeScript "setup-container" '' + mkdir -p -m 0755 /nix/var/log/nix/drvs + mkdir -p -m 0755 /nix/var/nix/gcroots + mkdir -p -m 0755 /nix/var/nix/profiles + mkdir -p -m 0755 /nix/var/nix/temproots + mkdir -p -m 0755 /nix/var/nix/userpool + mkdir -p -m 1777 /nix/var/nix/gcroots/per-user + mkdir -p -m 1777 /nix/var/nix/profiles/per-user + mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root + mkdir -p -m 0700 "$HOME/.nix-defexpr" + + . ${pkgs.nix}/etc/profile.d/nix.sh + + ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])} + + ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable + ${pkgs.nix}/bin/nix-channel --update nixpkgs + + mkdir -p ~/.config/nix + echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf + ''; + environmentVariables = { + ENV = "/etc/profile"; + USER = "root"; + NIX_REMOTE = "daemon"; + PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin"; + NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"; + }; + }; + default = { + authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path; + dockerImage = "debian:stable"; + }; }; }; openssh.enable = true; diff --git a/hosts/thanatos/secrets.nix b/hosts/thanatos/secrets.nix index c44e1f8..bd58902 100644 --- a/hosts/thanatos/secrets.nix +++ b/hosts/thanatos/secrets.nix @@ -16,6 +16,7 @@ "users/alarsyo-hashed-password" = {}; "users/root-hashed-password" = {}; "gitlab-runner/thanatos-runner-env" = {}; + "gitlab-runner/thanatos-nix-runner-env" = {}; }; }; } diff --git a/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age b/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age new file mode 100644 index 0000000..3919957 Binary files /dev/null and b/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age differ diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix index 1796e74..a31f59c 100644 --- a/modules/secrets/secrets.nix +++ b/modules/secrets/secrets.nix @@ -14,6 +14,7 @@ in { "gandi/api-key.age".publicKeys = [alarsyo hades]; "gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos]; + "gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos]; "lohr/shared-secret.age".publicKeys = [alarsyo hades];