Reconfigure agents, add shadowfax forgejo runner

agents/fj-hetzner-aarch64.nix

@@ -1,16 +1,13 @@
 { pkgs, config, lib, ... }:
  {
   environment.systemPackages = with pkgs; [ 
-    vim 
+    # vim -- added by srvos.nixosModules.server
-    # zig broken on darwin
+    # git -- srvos.nixosModules.server
-    #ncdu 
+    # tmux -- srvos.nixosModules.server
-    git
-    tmux 
     cachix
-    direnv
     lazydocker
     lazygit
-    nodejs_20
+    nodejs_20 # required by actions such as checkout
   ];
 
   sops.secrets."forgejo-runner-token" = {
@@ -36,7 +33,7 @@
     package = pkgs.forgejo-actions-runner;
     instances.default = {
       enable = true;
-      name = "monolith";
+      name = "fj-hetzner-aarch64";
       url = "https://git.hsn.dev";
       # Obtaining the path to the runner token file may differ
       tokenFile = config.sops.secrets.forgejo-runner-token.path;
@@ -45,10 +42,8 @@
         "aarch64"
         "linux"
         "pc"
-        "ubuntu-aarch64:docker://node:20-bullseye"
+        "docker-aarch64:docker://node:20-bullseye"
         "native-aarch64:host"
-        ## optionally provide native execution on the host:
-        # "native:host"
       ];
     };
   };

agents/fj-shadowfax-x86_64.nix

@@ -0,0 +1,51 @@
+{ pkgs, config, lib, ... }:
+ {
+  environment.systemPackages = with pkgs; [ 
+    # vim -- added by srvos.nixosModules.server
+    # git -- srvos.nixosModules.server
+    # tmux -- srvos.nixosModules.server
+    cachix
+    lazydocker
+    lazygit
+    nodejs_20 # required by actions such as checkout
+  ];
+
+  sops.secrets."forgejo-runner-token" = {
+    # configure secret for forwarding rules
+    sopsFile = ./secrets.sops.yaml;
+    mode = "0444";
+    restartUnits = [ "gitea-runner-default.service" ];
+  };
+
+  nix.settings.trusted-users = [ "gitea-runner" ];
+  
+  virtualisation.docker.enable = true;
+
+  users.users.gitea-runner.group = "gitea-runner";
+  users.groups.gitea-runner = {};
+  users.users.gitea-runner.extraGroups = [ "docker" ];
+  users.users.gitea-runner.isNormalUser = true;
+
+  # Runner communication port for cache restores.
+  networking.firewall.allowedTCPPorts = [ 45315 ];
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+    instances.default = {
+      enable = true;
+      name = "fj-shadowfax-x86_64";
+      url = "https://git.hsn.dev";
+      # Obtaining the path to the runner token file may differ
+      tokenFile = config.sops.secrets.forgejo-runner-token.path;
+      labels = [
+        "docker:docker://node:20-bullseye"
+        "x86_64"
+        "linux"
+        "pc"
+        "docker-x86_64:docker://node:20-bullseye"
+        "native-x86_64:host"
+      ];
+    };
+  };
+  system.stateVersion = "24.05";
+}

disko-shadowfax-kubevirt.nix

@@ -0,0 +1,32 @@
+{ disks ? [ "/dev/vda" ], ... }: {
+  disko.devices = {
+    disk = {
+      main = {
+        device = builtins.elemAt disks 0;
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP =  {
+              type = "EF00";
+              size = "1000M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

flake.nix

@@ -33,7 +33,7 @@
     in {
       nixosConfigurations = 
       {
-        "aarch64-linux" = lib.nixosSystem {
+        "fj-hetzner-aarch64-01" = lib.nixosSystem {
         system = "aarch64-linux";
         specialArgs = {inherit inputs outputs;};
         modules = [
@@ -42,11 +42,56 @@
           srvos.nixosModules.server
           srvos.nixosModules.mixins-systemd-boot
           disko.nixosModules.disko
-          ./agents/linux.nix
+          ./agents/fj-hetzner-aarch64.nix
           (import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
           {
             boot.loader.efi.canTouchEfiVariables = true;
-            networking.hostName = "aarch64-linux";
+            networking.hostName = "fj-hetzner-aarch64-01";
+            users.users.root.openssh.authorizedKeys.keys = 
+            [ 
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
+            ];
+            services.openssh.enable = true;
+            services.openssh.settings.PermitRootLogin = "without-password";
+          }];
+        };
+        "fj-shadowfax-01" = lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = {inherit inputs outputs;};
+        modules = [
+          sops-nix.nixosModules.sops
+          srvos.nixosModules.server
+          srvos.nixosModules.mixins-systemd-boot
+          disko.nixosModules.disko
+          ./agents/fj-shadowfax-x86_64.nix
+          (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; })
+          {
+            boot.loader.efi.canTouchEfiVariables = true;
+            networking.hostName = "fj-shadowfax-01";
+            users.users.root.openssh.authorizedKeys.keys = 
+            [ 
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
+            ];
+            services.openssh.enable = true;
+            services.openssh.settings.PermitRootLogin = "without-password";
+          }];
+        };
+        "fj-shadowfax-02" = lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = {inherit inputs outputs;};
+        modules = [
+          sops-nix.nixosModules.sops
+          srvos.nixosModules.hardware-hetzner-cloud
+          srvos.nixosModules.server
+          srvos.nixosModules.mixins-systemd-boot
+          disko.nixosModules.disko
+          ./agents/fj-shadowfax-x86_64.nix
+          (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; })
+          {
+            boot.loader.efi.canTouchEfiVariables = true;
+            networking.hostName = "fj-shadowfax-02";
             users.users.root.openssh.authorizedKeys.keys = 
             [ 
               "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"

shell.nix

@@ -28,7 +28,6 @@ pkgs.mkShell {
     sops
     pre-commit
     gitleaks
-    mkdocs
+    nix-inspect
-    mqttui
   ];
 }