Rely on tailscale

hosts/myself/container-git.nix

@@ -1,8 +1,13 @@
-{ inputs, registryPort, ...}:
+{ inputs, ...}:
-{ config, pkgs, lib, ... }: {
+{ config, pkgs, lib, ... }: let
+	registryPort = 5000;
+	vpnIp = "100.78.226.76";
+	containerIp = "192.168.200.2";
+in {
 	imports = [
 		inputs.agenix.nixosModules.default
 		../../modules-linux/proxy.nix
+		../../modules-linux/tailscale.nix
 	];
 
 	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
@@ -26,13 +31,35 @@
 		useHostResolvConf = lib.mkForce false;
 	};
 
-	greg.proxies."192.168.200.2" = {
+	greg.proxies."${containerIp}" = {
 		target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
 		extraConfig = ''
 		proxy_set_header X-Forwarded-Proto https;
 		proxy_set_header X-Forwarded-Ssl on;
 		'';
 	};
+	services.nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
+		listen = [ {
+			addr = vpnIp;
+			port = registryPort;
+			ssl = true;
+		} ];
+		locations."/" = {
+			proxyPass = "http://127.0.0.1:5000/";
+			recommendedProxySettings = true;
+		};
+		extraConfig = builtins.concatStringsSep "\n" [
+			"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
+			"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
+		];
+	};
+	services.cron = {
+		enable = true;
+		systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
+	};
+	greg.tailscale.enable = true;
+
+	virtualisation.docker.enable = true;
 
 	services = {
 		resolved.enable = true;
@@ -67,7 +94,8 @@
 				enable = true;
 				certFile = config.age.secrets.gitlab-cert.path;
 				keyFile = config.age.secrets.gitlab-key.path;
-				externalPort = registryPort;
+				externalAddress = "registry.thehellings.com";
+				externalPort = 443;
 			};
 			secrets = {
 				secretFile = config.age.secrets.gitlab-secret.path;

hosts/myself/container-runner-qemu.nix

@@ -11,6 +11,7 @@ let
 		qemu_full
 		qemu_kvm
 		shellcheck
+		vagrant
 		xonsh
 		xorriso
 	];

hosts/myself/container-runner-vbox.nix

@@ -33,6 +33,7 @@ lib.attrsets.recursiveUpdate {
 		shellcheck
 		unzip
 		xorriso
+		vagrant
 		wget
 	];
 

hosts/myself/git.nix

@@ -4,8 +4,6 @@ let
 
 	gitlabStateDir = "/var/lib/gitlab";
 
-	registryPort = 8001;
-
 	container = input: (lib.attrsets.recursiveUpdate {
 		bindMounts."/etc/ssh".hostPath = "/etc/ssh";  # For agenix secrets
 		privateNetwork = true;
@@ -14,7 +12,7 @@ in  {
 	networking = {
 		firewall = {
 			enable = true;
-			allowedTCPPorts = [ 80 registryPort ];
+			allowedTCPPorts = [ 80 ];
 		};
 		nat = {
 			enable = true;
@@ -40,6 +38,10 @@ in  {
 				hostPath = gitlabStateDir;
 				isReadOnly = false;
 			};
+			"/dev/net/tun" = {
+				hostPath = "/dev/net/tun";
+				isReadOnly = false;
+			};
 		};
 		forwardPorts = [{
 			hostPort = 2222;
@@ -47,7 +49,7 @@ in  {
 		}];
 		hostAddress = "192.168.200.1";
 		localAddress = "192.168.200.2";
-		config = ((import ./container-git.nix) { inherit inputs registryPort; });
+		config = ((import ./container-git.nix) { inherit inputs; });
 	};
 
 	systemd.services = {
@@ -58,7 +60,7 @@ in  {
 			serviceConfig = {
 				DevicePolicy = lib.mkForce "auto";
 				ExecPostStop = [ "rmmod kvm_amd kvm" ];
-				ExecPreStart = [ "modprobe kvm" ];
+				ExecPreStart = [ "modprobe kvm kvm_amd" ];
 			};
 		};
 		"container@gitlab-runner-vbox" = {
@@ -71,6 +73,11 @@ in  {
 				ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
 			};
 		};
+		"container@gitlab".serviceConfig = {
+			DeviceAllow = [ "/dev/net/tun" ];
+			ProtectKernelModules = false;
+			PrivateDevices = false;
+		};
 	};
 
 	#####################################################################################
@@ -147,13 +154,30 @@ in  {
 	#####################################################################################
 	age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
 	services.gitlab-runner = {
-		enable = false;
+		enable = true;
 		settings.concurrent = 5;
 		services = {
 			default = {
 				executor = "docker";
 				registrationConfigFile = config.age.secrets.runner-reg.path;
-				dockerImage = "debian:stable";
+				dockerImage = "fedora:39";
+				dockerAllowedImages = [
+					"alpine:*"
+					"debian:*"
+					"docker:*"
+					"fedora:*"
+					"python:*"
+					"ubuntu:*"
+
+					"hashicorp/*:*"
+					"koalaman/shellcheck:*"
+
+					"registry.gitlab.com/gitlab-org/*"
+				];
+				dockerAllowedServices = [
+					"docker:*"
+				];
+				dockerPrivileged = true;
 			};
 		};
 	};
@@ -161,5 +185,4 @@ in  {
 		docker.enable = true;
 		oci-containers.backend = "docker";
 	};
-	#users.users.gitlab-runner.extraGroups = [ "docker" ];
 }