From 44aef5e0747fe9b87e42cdce527af8429be59220 Mon Sep 17 00:00:00 2001 From: Joseph Hanson Date: Thu, 23 May 2024 11:26:32 -0500 Subject: [PATCH] Reconfigure agents, add shadowfax forgejo runner --- agents/{linux.nix => fj-hetzner-aarch64.nix} | 17 +++---- agents/fj-shadowfax-x86_64.nix | 51 ++++++++++++++++++++ disko-shadowfax-kubevirt.nix | 32 ++++++++++++ flake.nix | 51 ++++++++++++++++++-- shell.nix | 3 +- 5 files changed, 138 insertions(+), 16 deletions(-) rename agents/{linux.nix => fj-hetzner-aarch64.nix} (81%) create mode 100644 agents/fj-shadowfax-x86_64.nix create mode 100644 disko-shadowfax-kubevirt.nix diff --git a/agents/linux.nix b/agents/fj-hetzner-aarch64.nix similarity index 81% rename from agents/linux.nix rename to agents/fj-hetzner-aarch64.nix index f24fa39..83905ac 100644 --- a/agents/linux.nix +++ b/agents/fj-hetzner-aarch64.nix @@ -1,16 +1,13 @@ { pkgs, config, lib, ... }: { environment.systemPackages = with pkgs; [ - vim - # zig broken on darwin - #ncdu - git - tmux + # vim -- added by srvos.nixosModules.server + # git -- srvos.nixosModules.server + # tmux -- srvos.nixosModules.server cachix - direnv lazydocker lazygit - nodejs_20 + nodejs_20 # required by actions such as checkout ]; sops.secrets."forgejo-runner-token" = { @@ -36,7 +33,7 @@ package = pkgs.forgejo-actions-runner; instances.default = { enable = true; - name = "monolith"; + name = "fj-hetzner-aarch64"; url = "https://git.hsn.dev"; # Obtaining the path to the runner token file may differ tokenFile = config.sops.secrets.forgejo-runner-token.path; @@ -45,10 +42,8 @@ "aarch64" "linux" "pc" - "ubuntu-aarch64:docker://node:20-bullseye" + "docker-aarch64:docker://node:20-bullseye" "native-aarch64:host" - ## optionally provide native execution on the host: - # "native:host" ]; }; }; diff --git a/agents/fj-shadowfax-x86_64.nix b/agents/fj-shadowfax-x86_64.nix new file mode 100644 index 0000000..bd410ee --- /dev/null +++ b/agents/fj-shadowfax-x86_64.nix @@ -0,0 +1,51 @@ +{ pkgs, config, lib, ... }: + { + environment.systemPackages = with pkgs; [ + # vim -- added by srvos.nixosModules.server + # git -- srvos.nixosModules.server + # tmux -- srvos.nixosModules.server + cachix + lazydocker + lazygit + nodejs_20 # required by actions such as checkout + ]; + + sops.secrets."forgejo-runner-token" = { + # configure secret for forwarding rules + sopsFile = ./secrets.sops.yaml; + mode = "0444"; + restartUnits = [ "gitea-runner-default.service" ]; + }; + + nix.settings.trusted-users = [ "gitea-runner" ]; + + virtualisation.docker.enable = true; + + users.users.gitea-runner.group = "gitea-runner"; + users.groups.gitea-runner = {}; + users.users.gitea-runner.extraGroups = [ "docker" ]; + users.users.gitea-runner.isNormalUser = true; + + # Runner communication port for cache restores. + networking.firewall.allowedTCPPorts = [ 45315 ]; + + services.gitea-actions-runner = { + package = pkgs.forgejo-actions-runner; + instances.default = { + enable = true; + name = "fj-shadowfax-x86_64"; + url = "https://git.hsn.dev"; + # Obtaining the path to the runner token file may differ + tokenFile = config.sops.secrets.forgejo-runner-token.path; + labels = [ + "docker:docker://node:20-bullseye" + "x86_64" + "linux" + "pc" + "docker-x86_64:docker://node:20-bullseye" + "native-x86_64:host" + ]; + }; + }; + system.stateVersion = "24.05"; +} \ No newline at end of file diff --git a/disko-shadowfax-kubevirt.nix b/disko-shadowfax-kubevirt.nix new file mode 100644 index 0000000..bab0034 --- /dev/null +++ b/disko-shadowfax-kubevirt.nix @@ -0,0 +1,32 @@ +{ disks ? [ "/dev/vda" ], ... }: { + disko.devices = { + disk = { + main = { + device = builtins.elemAt disks 0; + type = "disk"; + content = { + type = "gpt"; + partitions = { + ESP = { + type = "EF00"; + size = "1000M"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + size = "100%"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/flake.nix b/flake.nix index 1a21f73..89640c0 100644 --- a/flake.nix +++ b/flake.nix @@ -33,7 +33,7 @@ in { nixosConfigurations = { - "aarch64-linux" = lib.nixosSystem { + "fj-hetzner-aarch64-01" = lib.nixosSystem { system = "aarch64-linux"; specialArgs = {inherit inputs outputs;}; modules = [ @@ -42,11 +42,56 @@ srvos.nixosModules.server srvos.nixosModules.mixins-systemd-boot disko.nixosModules.disko - ./agents/linux.nix + ./agents/fj-hetzner-aarch64.nix (import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; }) { boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "aarch64-linux"; + networking.hostName = "fj-hetzner-aarch64-01"; + users.users.root.openssh.authorizedKeys.keys = + [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore" + ]; + services.openssh.enable = true; + services.openssh.settings.PermitRootLogin = "without-password"; + }]; + }; + "fj-shadowfax-01" = lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = {inherit inputs outputs;}; + modules = [ + sops-nix.nixosModules.sops + srvos.nixosModules.server + srvos.nixosModules.mixins-systemd-boot + disko.nixosModules.disko + ./agents/fj-shadowfax-x86_64.nix + (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; }) + { + boot.loader.efi.canTouchEfiVariables = true; + networking.hostName = "fj-shadowfax-01"; + users.users.root.openssh.authorizedKeys.keys = + [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore" + ]; + services.openssh.enable = true; + services.openssh.settings.PermitRootLogin = "without-password"; + }]; + }; + "fj-shadowfax-02" = lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = {inherit inputs outputs;}; + modules = [ + sops-nix.nixosModules.sops + srvos.nixosModules.hardware-hetzner-cloud + srvos.nixosModules.server + srvos.nixosModules.mixins-systemd-boot + disko.nixosModules.disko + ./agents/fj-shadowfax-x86_64.nix + (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; }) + { + boot.loader.efi.canTouchEfiVariables = true; + networking.hostName = "fj-shadowfax-02"; users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary" diff --git a/shell.nix b/shell.nix index 8fda4aa..ba679d1 100644 --- a/shell.nix +++ b/shell.nix @@ -28,7 +28,6 @@ pkgs.mkShell { sops pre-commit gitleaks - mkdocs - mqttui + nix-inspect ]; }