From e13a9125d801200baedce4c6447bcd671928816d Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Wed, 20 Nov 2024 13:31:46 +0100
Subject: [PATCH] thanatos: add Nix runner

---
 hosts/thanatos/default.nix                    |  46 ++++++++++++++++--
 hosts/thanatos/secrets.nix                    |   1 +
 .../gitlab-runner/thanatos-nix-runner-env.age | Bin 0 -> 406 bytes
 modules/secrets/secrets.nix                   |   1 +
 4 files changed, 45 insertions(+), 3 deletions(-)
 create mode 100644 modules/secrets/gitlab-runner/thanatos-nix-runner-env.age

diff --git a/hosts/thanatos/default.nix b/hosts/thanatos/default.nix
index 50e22ea..ab960eb 100644
--- a/hosts/thanatos/default.nix
+++ b/hosts/thanatos/default.nix
@@ -40,9 +40,49 @@ in {
       settings = {
         concurrent = 4;
       };
-      services.default = {
-        authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
-        dockerImage = "debian:stable";
+      services = {
+        nix = {
+          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
+          dockerImage = "alpine";
+          dockerVolumes = [
+            "/nix/store:/nix/store:ro"
+            "/nix/var/nix/db:/nix/var/nix/db:ro"
+            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          ];
+          dockerDisableCache = true;
+          preBuildScript = pkgs.writeScript "setup-container" ''
+            mkdir -p -m 0755 /nix/var/log/nix/drvs
+            mkdir -p -m 0755 /nix/var/nix/gcroots
+            mkdir -p -m 0755 /nix/var/nix/profiles
+            mkdir -p -m 0755 /nix/var/nix/temproots
+            mkdir -p -m 0755 /nix/var/nix/userpool
+            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+            mkdir -p -m 0700 "$HOME/.nix-defexpr"
+
+            . ${pkgs.nix}/etc/profile.d/nix.sh
+
+            ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
+
+            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+            ${pkgs.nix}/bin/nix-channel --update nixpkgs
+
+            mkdir -p ~/.config/nix
+            echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
+          '';
+          environmentVariables = {
+            ENV = "/etc/profile";
+            USER = "root";
+            NIX_REMOTE = "daemon";
+            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+          };
+        };
+        default = {
+          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
+          dockerImage = "debian:stable";
+        };
       };
     };
     openssh.enable = true;
diff --git a/hosts/thanatos/secrets.nix b/hosts/thanatos/secrets.nix
index c44e1f8..bd58902 100644
--- a/hosts/thanatos/secrets.nix
+++ b/hosts/thanatos/secrets.nix
@@ -16,6 +16,7 @@
         "users/alarsyo-hashed-password" = {};
         "users/root-hashed-password" = {};
         "gitlab-runner/thanatos-runner-env" = {};
+        "gitlab-runner/thanatos-nix-runner-env" = {};
       };
   };
 }
diff --git a/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age b/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..391995782a3855fe47c30efe2524a59ccb5480b0
GIT binary patch
literal 406
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7HcI!%Dpx2iEq3-Z
z(JxQQ)(@;ojnFPGsB$xQ&G#<$C^E>+&Ik@qNpnrr_K7M9wBXA0G4Kzoa`Uk?b`7em
zbT_UHGfzuO&G$+z*Y-@$Ev^dm^QkDw@GL8<GC{Y^EHtz<s$3z+GrPdVGuhF=CDNlX
zyV$GDJTxcW+u6XU*xx%UD#Tqs%+)c_HMl6#Ig%?q*wWlnKhoI9A~C#3yC}lL$S2ey
zps>up*tx{Tq$DWc*vTu($+ODSEs{%DS63m=(4!zMP1~q6$}(8HG`lEF+p)~Y(A2{+
z(b&z$&BDapEib3gEHJ;YGMQ^4?>^@|1#wT2pYMGZY+|aNbWHZ}tDAv8Ubh`%yup3h
z!Sd?9Lz~$XC(Su4JMlD++_J?9`O&TqUcL{nSa6~_mnUTHx|y#2e||MjDt8Q4jlH?&
qu+l=83Fp@wh`&*^wMU@7cl9wfmTmj1x1MK>eIrsO7CwvNN;m)k=$8%v

literal 0
HcmV?d00001

diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
index 1796e74..a31f59c 100644
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@@ -14,6 +14,7 @@ in {
   "gandi/api-key.age".publicKeys = [alarsyo hades];
 
   "gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
+  "gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
 
   "lohr/shared-secret.age".publicKeys = [alarsyo hades];