Reconfigure agents, add shadowfax forgejo runner
This commit is contained in:
parent
2d7ac96d30
commit
44aef5e074
5 changed files with 138 additions and 16 deletions
|
@ -1,16 +1,13 @@
|
||||||
{ pkgs, config, lib, ... }:
|
{ pkgs, config, lib, ... }:
|
||||||
{
|
{
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
vim
|
# vim -- added by srvos.nixosModules.server
|
||||||
# zig broken on darwin
|
# git -- srvos.nixosModules.server
|
||||||
#ncdu
|
# tmux -- srvos.nixosModules.server
|
||||||
git
|
|
||||||
tmux
|
|
||||||
cachix
|
cachix
|
||||||
direnv
|
|
||||||
lazydocker
|
lazydocker
|
||||||
lazygit
|
lazygit
|
||||||
nodejs_20
|
nodejs_20 # required by actions such as checkout
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.secrets."forgejo-runner-token" = {
|
sops.secrets."forgejo-runner-token" = {
|
||||||
|
@ -36,7 +33,7 @@
|
||||||
package = pkgs.forgejo-actions-runner;
|
package = pkgs.forgejo-actions-runner;
|
||||||
instances.default = {
|
instances.default = {
|
||||||
enable = true;
|
enable = true;
|
||||||
name = "monolith";
|
name = "fj-hetzner-aarch64";
|
||||||
url = "https://git.hsn.dev";
|
url = "https://git.hsn.dev";
|
||||||
# Obtaining the path to the runner token file may differ
|
# Obtaining the path to the runner token file may differ
|
||||||
tokenFile = config.sops.secrets.forgejo-runner-token.path;
|
tokenFile = config.sops.secrets.forgejo-runner-token.path;
|
||||||
|
@ -45,10 +42,8 @@
|
||||||
"aarch64"
|
"aarch64"
|
||||||
"linux"
|
"linux"
|
||||||
"pc"
|
"pc"
|
||||||
"ubuntu-aarch64:docker://node:20-bullseye"
|
"docker-aarch64:docker://node:20-bullseye"
|
||||||
"native-aarch64:host"
|
"native-aarch64:host"
|
||||||
## optionally provide native execution on the host:
|
|
||||||
# "native:host"
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
51
agents/fj-shadowfax-x86_64.nix
Normal file
51
agents/fj-shadowfax-x86_64.nix
Normal file
|
@ -0,0 +1,51 @@
|
||||||
|
{ pkgs, config, lib, ... }:
|
||||||
|
{
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
# vim -- added by srvos.nixosModules.server
|
||||||
|
# git -- srvos.nixosModules.server
|
||||||
|
# tmux -- srvos.nixosModules.server
|
||||||
|
cachix
|
||||||
|
lazydocker
|
||||||
|
lazygit
|
||||||
|
nodejs_20 # required by actions such as checkout
|
||||||
|
];
|
||||||
|
|
||||||
|
sops.secrets."forgejo-runner-token" = {
|
||||||
|
# configure secret for forwarding rules
|
||||||
|
sopsFile = ./secrets.sops.yaml;
|
||||||
|
mode = "0444";
|
||||||
|
restartUnits = [ "gitea-runner-default.service" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
nix.settings.trusted-users = [ "gitea-runner" ];
|
||||||
|
|
||||||
|
virtualisation.docker.enable = true;
|
||||||
|
|
||||||
|
users.users.gitea-runner.group = "gitea-runner";
|
||||||
|
users.groups.gitea-runner = {};
|
||||||
|
users.users.gitea-runner.extraGroups = [ "docker" ];
|
||||||
|
users.users.gitea-runner.isNormalUser = true;
|
||||||
|
|
||||||
|
# Runner communication port for cache restores.
|
||||||
|
networking.firewall.allowedTCPPorts = [ 45315 ];
|
||||||
|
|
||||||
|
services.gitea-actions-runner = {
|
||||||
|
package = pkgs.forgejo-actions-runner;
|
||||||
|
instances.default = {
|
||||||
|
enable = true;
|
||||||
|
name = "fj-shadowfax-x86_64";
|
||||||
|
url = "https://git.hsn.dev";
|
||||||
|
# Obtaining the path to the runner token file may differ
|
||||||
|
tokenFile = config.sops.secrets.forgejo-runner-token.path;
|
||||||
|
labels = [
|
||||||
|
"docker:docker://node:20-bullseye"
|
||||||
|
"x86_64"
|
||||||
|
"linux"
|
||||||
|
"pc"
|
||||||
|
"docker-x86_64:docker://node:20-bullseye"
|
||||||
|
"native-x86_64:host"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
32
disko-shadowfax-kubevirt.nix
Normal file
32
disko-shadowfax-kubevirt.nix
Normal file
|
@ -0,0 +1,32 @@
|
||||||
|
{ disks ? [ "/dev/vda" ], ... }: {
|
||||||
|
disko.devices = {
|
||||||
|
disk = {
|
||||||
|
main = {
|
||||||
|
device = builtins.elemAt disks 0;
|
||||||
|
type = "disk";
|
||||||
|
content = {
|
||||||
|
type = "gpt";
|
||||||
|
partitions = {
|
||||||
|
ESP = {
|
||||||
|
type = "EF00";
|
||||||
|
size = "1000M";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
root = {
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "ext4";
|
||||||
|
mountpoint = "/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
51
flake.nix
51
flake.nix
|
@ -33,7 +33,7 @@
|
||||||
in {
|
in {
|
||||||
nixosConfigurations =
|
nixosConfigurations =
|
||||||
{
|
{
|
||||||
"aarch64-linux" = lib.nixosSystem {
|
"fj-hetzner-aarch64-01" = lib.nixosSystem {
|
||||||
system = "aarch64-linux";
|
system = "aarch64-linux";
|
||||||
specialArgs = {inherit inputs outputs;};
|
specialArgs = {inherit inputs outputs;};
|
||||||
modules = [
|
modules = [
|
||||||
|
@ -42,11 +42,56 @@
|
||||||
srvos.nixosModules.server
|
srvos.nixosModules.server
|
||||||
srvos.nixosModules.mixins-systemd-boot
|
srvos.nixosModules.mixins-systemd-boot
|
||||||
disko.nixosModules.disko
|
disko.nixosModules.disko
|
||||||
./agents/linux.nix
|
./agents/fj-hetzner-aarch64.nix
|
||||||
(import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
|
(import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
|
||||||
{
|
{
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
networking.hostName = "aarch64-linux";
|
networking.hostName = "fj-hetzner-aarch64-01";
|
||||||
|
users.users.root.openssh.authorizedKeys.keys =
|
||||||
|
[
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
||||||
|
];
|
||||||
|
services.openssh.enable = true;
|
||||||
|
services.openssh.settings.PermitRootLogin = "without-password";
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
"fj-shadowfax-01" = lib.nixosSystem {
|
||||||
|
system = "x86_64-linux";
|
||||||
|
specialArgs = {inherit inputs outputs;};
|
||||||
|
modules = [
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
srvos.nixosModules.server
|
||||||
|
srvos.nixosModules.mixins-systemd-boot
|
||||||
|
disko.nixosModules.disko
|
||||||
|
./agents/fj-shadowfax-x86_64.nix
|
||||||
|
(import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; })
|
||||||
|
{
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
networking.hostName = "fj-shadowfax-01";
|
||||||
|
users.users.root.openssh.authorizedKeys.keys =
|
||||||
|
[
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
||||||
|
];
|
||||||
|
services.openssh.enable = true;
|
||||||
|
services.openssh.settings.PermitRootLogin = "without-password";
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
"fj-shadowfax-02" = lib.nixosSystem {
|
||||||
|
system = "x86_64-linux";
|
||||||
|
specialArgs = {inherit inputs outputs;};
|
||||||
|
modules = [
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
srvos.nixosModules.hardware-hetzner-cloud
|
||||||
|
srvos.nixosModules.server
|
||||||
|
srvos.nixosModules.mixins-systemd-boot
|
||||||
|
disko.nixosModules.disko
|
||||||
|
./agents/fj-shadowfax-x86_64.nix
|
||||||
|
(import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; })
|
||||||
|
{
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
networking.hostName = "fj-shadowfax-02";
|
||||||
users.users.root.openssh.authorizedKeys.keys =
|
users.users.root.openssh.authorizedKeys.keys =
|
||||||
[
|
[
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
||||||
|
|
|
@ -28,7 +28,6 @@ pkgs.mkShell {
|
||||||
sops
|
sops
|
||||||
pre-commit
|
pre-commit
|
||||||
gitleaks
|
gitleaks
|
||||||
mkdocs
|
nix-inspect
|
||||||
mqttui
|
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue