restructuring

This commit is contained in:
Joseph Hanson 2024-09-13 18:21:12 -05:00
parent 7cb728e128
commit 00b66bb9a9
Signed by: jahanson
SSH key fingerprint: SHA256:vy6dKBECV522aPAwklFM3ReKAVB086rT3oWwiuiFG7o
9 changed files with 92 additions and 26 deletions

35
README.md Normal file
View file

@ -0,0 +1,35 @@
# Incus VM Build and Deploy
## Build
```sh
nix build .#nixosConfigurations.fj-lxc-vm-x86_64.config.system.build.qemuImage --print-out-paths
nix build .#nixosConfigurations.fj-lxc-vm-x86_64.config.system.build.metadata --print-out-paths
```
## Deploy
```sh
incus image import --alias nixos-gen/custom/fj-lxc-vm-x86_64 ${metadatapath}/tarball/nixos-system-x86_64-linux.tar.xz ${qemuimageoutputpath}/nixos.qcow2
incus file push "$TOKEN_FILE" "$INCUS_INSTANCE/var/lib/forgejo/$TOKEN_FILE" --mode 400
```
## Runner machine types
Notice: The runners only run on VMs. No baremetal runners are available.
Hetzner/x86
Hetzner/aarch64
lxc-vm/x86
## Tags used
### Runner Tags
| tag | description |
| --------------------------------------- | ---------------------------------------------------------- |
| docker | docker nodes |
| docker-x86_64:docker://node:20-bullseye | specifically the debian bullseye with node 20 docker image |
| x86_64 | x86 builders only |
| aarch64 | ARM builders only |
| linux | Specify if linux |
| remote | only use offsite runners |
| native-aarch64:host | run on runner host -- not docker |

View file

@ -49,6 +49,7 @@
}; };
cachix-deploy-lib = cachix-deploy-flake.lib pkgs; cachix-deploy-lib = cachix-deploy-flake.lib pkgs;
}; };
aarch64-linux-modules = [ aarch64-linux-modules = [
sops-nix.nixosModules.sops sops-nix.nixosModules.sops
srvos.nixosModules.hardware-hetzner-cloud srvos.nixosModules.hardware-hetzner-cloud
@ -56,21 +57,20 @@
srvos.nixosModules.mixins-systemd-boot srvos.nixosModules.mixins-systemd-boot
disko.nixosModules.disko disko.nixosModules.disko
lix-module.nixosModules.default lix-module.nixosModules.default
./agents/fj-hetzner-aarch64.nix ./profiles/fj-hetzner.nix
(import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; }) (import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
{ {
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "fj-hetzner-aarch64-01"; networking.hostName = "fj-hetzner-aarch64-01";
users.users.root.openssh.authorizedKeys.keys = users.users.root.openssh.authorizedKeys.keys =
[ [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
]; ];
services.openssh.enable = true; services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "without-password"; services.openssh.settings.PermitRootLogin = "without-password";
} }
]; ];
x86_64-linux-modules = [ x86_64-linux-modules = [
sops-nix.nixosModules.sops sops-nix.nixosModules.sops
./hardware/shadowfax.nix ./hardware/shadowfax.nix
@ -78,33 +78,30 @@
srvos.nixosModules.mixins-systemd-boot srvos.nixosModules.mixins-systemd-boot
disko.nixosModules.disko disko.nixosModules.disko
lix-module.nixosModules.default lix-module.nixosModules.default
./agents/fj-shadowfax-x86_64.nix ./profiles/fj-shadowfax-x86_64.nix
(import ./disko-shadowfax.nix { disks = [ "/dev/sda" ]; }) (import ./disko-shadowfax.nix { disks = [ "/dev/sda" ]; })
{ {
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "fj-shadowfax-01"; networking.hostName = "fj-shadowfax-01";
users.users.root.openssh.authorizedKeys.keys = users.users.root.openssh.authorizedKeys.keys =
[ [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
]; ];
services.openssh.enable = true; services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "without-password"; services.openssh.settings.PermitRootLogin = "without-password";
} }
]; ];
x86_64-linux-modules-lxc-vm = [ x86_64-linux-modules-lxc-vm = [
"${inputs.nixpkgs}/nixos/modules/virtualisation/lxd-virtual-machine.nix" "${inputs.nixpkgs}/nixos/modules/virtualisation/lxd-virtual-machine.nix"
sops-nix.nixosModules.sops sops-nix.nixosModules.sops
srvos.nixosModules.server srvos.nixosModules.server
lix-module.nixosModules.default lix-module.nixosModules.default
./agents/fj-shadowfax-x86_64.nix ./profiles/fj-shadowfax-x86_64.nix
{ {
networking.hostName = "fj-x86_64-vm-01"; # networking.hostName = "fj-x86_64-vm-01";
users.users.root.openssh.authorizedKeys.keys = users.users.root.openssh.authorizedKeys.keys =
[ [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
]; ];
services.openssh.enable = true; services.openssh.enable = true;

View file

@ -15,13 +15,6 @@
openssl openssl
]; ];
sops.secrets."forgejo-runner-token" = {
# configure secret for the gitea/forgejo runner.
sopsFile = ./secrets.sops.yaml;
mode = "0444";
restartUnits = [ "gitea-runner-default.service" ];
};
# Required for the gitea-runner to be able to pull images. # Required for the gitea-runner to be able to pull images.
nix.settings.trusted-users = [ "gitea-runner" ]; nix.settings.trusted-users = [ "gitea-runner" ];
@ -30,15 +23,10 @@
users = { users = {
gitea-runner = { gitea-runner = {
isNormalUser = true; isSystemUser = true;
extraGroups = [ "docker" ]; extraGroups = [ "docker" ];
group = "gitea-runner"; group = "gitea-runner";
}; };
jahanson = {
isNormalUser = true;
extraGroups = [ "wheel" "docker" ];
};
}; };
}; };

View file

@ -4,6 +4,7 @@
./common.nix ./common.nix
]; ];
# Generic x86 VM
services.gitea-actions-runner = { services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner; package = pkgs.forgejo-actions-runner;
instances.default = { instances.default = {
@ -13,15 +14,22 @@
# Obtaining the path to the runner token file may differ # Obtaining the path to the runner token file may differ
tokenFile = config.sops.secrets.forgejo-runner-token.path; tokenFile = config.sops.secrets.forgejo-runner-token.path;
labels = [ labels = [
"docker" # this is essentially the same as the below tag
"docker-x86_64:docker://node:20-bullseye"
"x86_64" "x86_64"
"linux" "linux"
"pc" "remote"
"docker-x86_64:docker://node:20-bullseye"
"native-x86_64:host"
]; ];
}; };
}; };
sops.secrets."forgejo-runner-token" = {
# configure secret for the gitea/forgejo runner.
sopsFile = ./secrets.sops.yaml;
mode = "0444";
restartUnits = [ "gitea-runner-default.service" ];
};
sops.secrets."cachix/agent_auth_tokens/fj-x86_64" = { sops.secrets."cachix/agent_auth_tokens/fj-x86_64" = {
# configure secret for cachix deploy agent. # configure secret for cachix deploy agent.
sopsFile = ./secrets.sops.yaml; sopsFile = ./secrets.sops.yaml;

View file

@ -22,6 +22,13 @@
}; };
}; };
sops.secrets."forgejo-runner-token" = {
# configure secret for the gitea/forgejo runner.
sopsFile = ./secrets.sops.yaml;
mode = "0444";
restartUnits = [ "gitea-runner-default.service" ];
};
sops.secrets."cachix/agent_auth_tokens/fj-hetzner-aarch64" = { sops.secrets."cachix/agent_auth_tokens/fj-hetzner-aarch64" = {
# configure secret for cachix deploy agent. # configure secret for cachix deploy agent.
sopsFile = ./secrets.sops.yaml; sopsFile = ./secrets.sops.yaml;

31
profiles/role-lxc-vm.nix Normal file
View file

@ -0,0 +1,31 @@
{ pkgs, config, ... }:
{
imports = [
./common.nix
];
# Ensure the /var/lib/gitea-runner/default directory is created
# and has the correct permissions.
systemd.tmpfiles.rules = [
"d /var/lib/gitea-runner/default 0750 gitea-runner gitea-runner -"
];
services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = config.networking.hostName;
url = "https://git.hsn.dev";
# The gitea-runner token file is pushed on vm creation with this command:
# `incus file push "$TOKEN_FILE" "$INCUS_INSTANCE/var/lib/forgejo/$TOKEN_FILE" --mode 400`
tokenFile = "/var/lib/gitea-runner/default/tokenfile";
labels = [
"x86_64"
"linux"
"pc"
"docker-x86_64:docker://node:20-bullseye"
"native-x86_64:host"
];
};
};
}