restructuring
This commit is contained in:
parent
7cb728e128
commit
00b66bb9a9
9 changed files with 92 additions and 26 deletions
35
README.md
Normal file
35
README.md
Normal file
|
@ -0,0 +1,35 @@
|
||||||
|
# Incus VM Build and Deploy
|
||||||
|
|
||||||
|
## Build
|
||||||
|
```sh
|
||||||
|
nix build .#nixosConfigurations.fj-lxc-vm-x86_64.config.system.build.qemuImage --print-out-paths
|
||||||
|
nix build .#nixosConfigurations.fj-lxc-vm-x86_64.config.system.build.metadata --print-out-paths
|
||||||
|
```
|
||||||
|
|
||||||
|
## Deploy
|
||||||
|
```sh
|
||||||
|
incus image import --alias nixos-gen/custom/fj-lxc-vm-x86_64 ${metadatapath}/tarball/nixos-system-x86_64-linux.tar.xz ${qemuimageoutputpath}/nixos.qcow2
|
||||||
|
incus file push "$TOKEN_FILE" "$INCUS_INSTANCE/var/lib/forgejo/$TOKEN_FILE" --mode 400
|
||||||
|
```
|
||||||
|
|
||||||
|
## Runner machine types
|
||||||
|
|
||||||
|
Notice: The runners only run on VMs. No baremetal runners are available.
|
||||||
|
|
||||||
|
Hetzner/x86
|
||||||
|
Hetzner/aarch64
|
||||||
|
lxc-vm/x86
|
||||||
|
|
||||||
|
## Tags used
|
||||||
|
|
||||||
|
### Runner Tags
|
||||||
|
|
||||||
|
| tag | description |
|
||||||
|
| --------------------------------------- | ---------------------------------------------------------- |
|
||||||
|
| docker | docker nodes |
|
||||||
|
| docker-x86_64:docker://node:20-bullseye | specifically the debian bullseye with node 20 docker image |
|
||||||
|
| x86_64 | x86 builders only |
|
||||||
|
| aarch64 | ARM builders only |
|
||||||
|
| linux | Specify if linux |
|
||||||
|
| remote | only use offsite runners |
|
||||||
|
| native-aarch64:host | run on runner host -- not docker |
|
17
flake.nix
17
flake.nix
|
@ -49,6 +49,7 @@
|
||||||
};
|
};
|
||||||
cachix-deploy-lib = cachix-deploy-flake.lib pkgs;
|
cachix-deploy-lib = cachix-deploy-flake.lib pkgs;
|
||||||
};
|
};
|
||||||
|
|
||||||
aarch64-linux-modules = [
|
aarch64-linux-modules = [
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
srvos.nixosModules.hardware-hetzner-cloud
|
srvos.nixosModules.hardware-hetzner-cloud
|
||||||
|
@ -56,21 +57,20 @@
|
||||||
srvos.nixosModules.mixins-systemd-boot
|
srvos.nixosModules.mixins-systemd-boot
|
||||||
disko.nixosModules.disko
|
disko.nixosModules.disko
|
||||||
lix-module.nixosModules.default
|
lix-module.nixosModules.default
|
||||||
./agents/fj-hetzner-aarch64.nix
|
./profiles/fj-hetzner.nix
|
||||||
(import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
|
(import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
|
||||||
{
|
{
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
networking.hostName = "fj-hetzner-aarch64-01";
|
networking.hostName = "fj-hetzner-aarch64-01";
|
||||||
users.users.root.openssh.authorizedKeys.keys =
|
users.users.root.openssh.authorizedKeys.keys =
|
||||||
[
|
[
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
||||||
];
|
];
|
||||||
services.openssh.enable = true;
|
services.openssh.enable = true;
|
||||||
services.openssh.settings.PermitRootLogin = "without-password";
|
services.openssh.settings.PermitRootLogin = "without-password";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
x86_64-linux-modules = [
|
x86_64-linux-modules = [
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
./hardware/shadowfax.nix
|
./hardware/shadowfax.nix
|
||||||
|
@ -78,33 +78,30 @@
|
||||||
srvos.nixosModules.mixins-systemd-boot
|
srvos.nixosModules.mixins-systemd-boot
|
||||||
disko.nixosModules.disko
|
disko.nixosModules.disko
|
||||||
lix-module.nixosModules.default
|
lix-module.nixosModules.default
|
||||||
./agents/fj-shadowfax-x86_64.nix
|
./profiles/fj-shadowfax-x86_64.nix
|
||||||
(import ./disko-shadowfax.nix { disks = [ "/dev/sda" ]; })
|
(import ./disko-shadowfax.nix { disks = [ "/dev/sda" ]; })
|
||||||
{
|
{
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
networking.hostName = "fj-shadowfax-01";
|
networking.hostName = "fj-shadowfax-01";
|
||||||
users.users.root.openssh.authorizedKeys.keys =
|
users.users.root.openssh.authorizedKeys.keys =
|
||||||
[
|
[
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
||||||
];
|
];
|
||||||
services.openssh.enable = true;
|
services.openssh.enable = true;
|
||||||
services.openssh.settings.PermitRootLogin = "without-password";
|
services.openssh.settings.PermitRootLogin = "without-password";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
x86_64-linux-modules-lxc-vm = [
|
x86_64-linux-modules-lxc-vm = [
|
||||||
"${inputs.nixpkgs}/nixos/modules/virtualisation/lxd-virtual-machine.nix"
|
"${inputs.nixpkgs}/nixos/modules/virtualisation/lxd-virtual-machine.nix"
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
srvos.nixosModules.server
|
srvos.nixosModules.server
|
||||||
lix-module.nixosModules.default
|
lix-module.nixosModules.default
|
||||||
./agents/fj-shadowfax-x86_64.nix
|
./profiles/fj-shadowfax-x86_64.nix
|
||||||
{
|
{
|
||||||
networking.hostName = "fj-x86_64-vm-01";
|
# networking.hostName = "fj-x86_64-vm-01";
|
||||||
users.users.root.openssh.authorizedKeys.keys =
|
users.users.root.openssh.authorizedKeys.keys =
|
||||||
[
|
[
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcLI5qN69BuoLp8p7nTYKoLdsBNmZB31OerZ63Car1g jahanson@telchar"
|
||||||
];
|
];
|
||||||
services.openssh.enable = true;
|
services.openssh.enable = true;
|
||||||
|
|
|
@ -15,13 +15,6 @@
|
||||||
openssl
|
openssl
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.secrets."forgejo-runner-token" = {
|
|
||||||
# configure secret for the gitea/forgejo runner.
|
|
||||||
sopsFile = ./secrets.sops.yaml;
|
|
||||||
mode = "0444";
|
|
||||||
restartUnits = [ "gitea-runner-default.service" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Required for the gitea-runner to be able to pull images.
|
# Required for the gitea-runner to be able to pull images.
|
||||||
nix.settings.trusted-users = [ "gitea-runner" ];
|
nix.settings.trusted-users = [ "gitea-runner" ];
|
||||||
|
|
||||||
|
@ -30,15 +23,10 @@
|
||||||
|
|
||||||
users = {
|
users = {
|
||||||
gitea-runner = {
|
gitea-runner = {
|
||||||
isNormalUser = true;
|
isSystemUser = true;
|
||||||
extraGroups = [ "docker" ];
|
extraGroups = [ "docker" ];
|
||||||
group = "gitea-runner";
|
group = "gitea-runner";
|
||||||
};
|
};
|
||||||
|
|
||||||
jahanson = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" "docker" ];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -4,6 +4,7 @@
|
||||||
./common.nix
|
./common.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
# Generic x86 VM
|
||||||
services.gitea-actions-runner = {
|
services.gitea-actions-runner = {
|
||||||
package = pkgs.forgejo-actions-runner;
|
package = pkgs.forgejo-actions-runner;
|
||||||
instances.default = {
|
instances.default = {
|
||||||
|
@ -13,15 +14,22 @@
|
||||||
# Obtaining the path to the runner token file may differ
|
# Obtaining the path to the runner token file may differ
|
||||||
tokenFile = config.sops.secrets.forgejo-runner-token.path;
|
tokenFile = config.sops.secrets.forgejo-runner-token.path;
|
||||||
labels = [
|
labels = [
|
||||||
|
"docker" # this is essentially the same as the below tag
|
||||||
|
"docker-x86_64:docker://node:20-bullseye"
|
||||||
"x86_64"
|
"x86_64"
|
||||||
"linux"
|
"linux"
|
||||||
"pc"
|
"remote"
|
||||||
"docker-x86_64:docker://node:20-bullseye"
|
|
||||||
"native-x86_64:host"
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
sops.secrets."forgejo-runner-token" = {
|
||||||
|
# configure secret for the gitea/forgejo runner.
|
||||||
|
sopsFile = ./secrets.sops.yaml;
|
||||||
|
mode = "0444";
|
||||||
|
restartUnits = [ "gitea-runner-default.service" ];
|
||||||
|
};
|
||||||
|
|
||||||
sops.secrets."cachix/agent_auth_tokens/fj-x86_64" = {
|
sops.secrets."cachix/agent_auth_tokens/fj-x86_64" = {
|
||||||
# configure secret for cachix deploy agent.
|
# configure secret for cachix deploy agent.
|
||||||
sopsFile = ./secrets.sops.yaml;
|
sopsFile = ./secrets.sops.yaml;
|
|
@ -22,6 +22,13 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
sops.secrets."forgejo-runner-token" = {
|
||||||
|
# configure secret for the gitea/forgejo runner.
|
||||||
|
sopsFile = ./secrets.sops.yaml;
|
||||||
|
mode = "0444";
|
||||||
|
restartUnits = [ "gitea-runner-default.service" ];
|
||||||
|
};
|
||||||
|
|
||||||
sops.secrets."cachix/agent_auth_tokens/fj-hetzner-aarch64" = {
|
sops.secrets."cachix/agent_auth_tokens/fj-hetzner-aarch64" = {
|
||||||
# configure secret for cachix deploy agent.
|
# configure secret for cachix deploy agent.
|
||||||
sopsFile = ./secrets.sops.yaml;
|
sopsFile = ./secrets.sops.yaml;
|
31
profiles/role-lxc-vm.nix
Normal file
31
profiles/role-lxc-vm.nix
Normal file
|
@ -0,0 +1,31 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./common.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# Ensure the /var/lib/gitea-runner/default directory is created
|
||||||
|
# and has the correct permissions.
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d /var/lib/gitea-runner/default 0750 gitea-runner gitea-runner -"
|
||||||
|
];
|
||||||
|
|
||||||
|
services.gitea-actions-runner = {
|
||||||
|
package = pkgs.forgejo-actions-runner;
|
||||||
|
instances.default = {
|
||||||
|
enable = true;
|
||||||
|
name = config.networking.hostName;
|
||||||
|
url = "https://git.hsn.dev";
|
||||||
|
# The gitea-runner token file is pushed on vm creation with this command:
|
||||||
|
# `incus file push "$TOKEN_FILE" "$INCUS_INSTANCE/var/lib/forgejo/$TOKEN_FILE" --mode 400`
|
||||||
|
tokenFile = "/var/lib/gitea-runner/default/tokenfile";
|
||||||
|
labels = [
|
||||||
|
"x86_64"
|
||||||
|
"linux"
|
||||||
|
"pc"
|
||||||
|
"docker-x86_64:docker://node:20-bullseye"
|
||||||
|
"native-x86_64:host"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue