From 12e9215a7db67385434e6d48ab68fc2a97b9df57 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 20:01:02 +0000 Subject: [PATCH 1/3] Use unstable for forgejo --- hosts/linode/git.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index 2229315..df5968d 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -23,6 +23,7 @@ in { services = { forgejo = rec { enable = true; + package = pkgs.unstable.forgejo; database = { type = "postgres"; user = "forgejo"; From f0e2e418aa7b2fd6ad3f75490b2bc8ab51b49976 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 20:16:16 +0000 Subject: [PATCH 2/3] Cleanup Monica and git services --- hosts/linode/default.nix | 1 - hosts/linode/git.nix | 89 ---------------------------------------- hosts/linode/rei.nix | 27 ------------ secrets/monica.age | 38 ----------------- secrets/secrets.nix | 2 - 5 files changed, 157 deletions(-) delete mode 100644 hosts/linode/rei.nix delete mode 100644 secrets/monica.age diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index 06a8883..eeca23e 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -8,7 +8,6 @@ ./nextcloud.nix ./nginx.nix ./postgres.nix - ./rei.nix ./synapse.nix ]; greg.home = false; diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index df5968d..b0029c8 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -133,99 +133,10 @@ in { # CI SERVICES ########## ########################################################################################## - - # Service user - users.users.drone = { - isSystemUser = true; - group = "drone"; - home = droneDir; - }; - users.groups.drone = {}; - - # Environment secrets - age.secrets.drone = { - file = ../../secrets/drone.age; - owner = "root"; - }; - virtualisation.oci-containers = { backend = "podman"; - containers = { - "drone" = { - environment = { - DRONE_GITEA_SERVER = "https://${srcDomain}"; - DRONE_LOGS_DEBUG = "true"; - DRONE_SERVER_HOST = ciDomain; - DRONE_SERVER_PROTO = "https"; - DRONE_SERVER_PROXY_HOST = ciDomain; - DRONE_SERVER_PROXY_PROTO = "https"; - DRONE_TLS_AUTOCERT = "false"; # Suppress it generating SSL certificates, as our proxy handles that - }; - environmentFiles = [ - "/run/agenix/drone" - ]; - extraOptions = [ "--pull=newer" ]; - image = "drone/drone:2.17"; - ports = [ "${ciPort}:80" ]; - volumes = [ "${droneDir}:/data" ]; - }; - - "drone-docker" = { - environment = droneWorkerEnvironment; - environmentFiles = [ - "/run/agenix/drone" - ]; - extraOptions = [ "--pull=newer" ]; - image = "drone/drone-runner-docker:1.8"; - volumes = [ "/run/podman/podman.sock:/var/run/docker.sock" ]; - }; - }; }; - systemd.services = { - "podman-drone".serviceConfig = { - StateDirectory = "drone"; - StateDirectoryMode = pkgs.lib.mkForce "0777"; - WorkingDirectory = droneDir; - }; - - "drone-exec-runner" = { - environment = droneWorkerEnvironment; - description = "Drone pipeline runner that executes locally"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ - bash - drone-runner-exec - git - podman - ]; - - preStart = '' - mkdir -p ${execWorkDir} - cat /run/agenix/drone > ${execWorkDir}/conf.env - echo "" >> ${execWorkDir}/conf.env - ''; - script = "exec ${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon ${execWorkDir}/conf.env"; - - serviceConfig = { - StateDirectory = "drone-exec"; - StateDirectoryMode = pkgs.lib.mkForce "0777"; - }; - }; - }; - - greg.proxies."${ciDomain}" = { - target = "http://localhost:${ciPort}"; - ssl = true; - genAliases = false; - }; - - ########################################################################################## - ########### - # CI WORKERS - ########## - ########################################################################################## virtualisation.podman = { enable = true; dockerCompat = true; diff --git a/hosts/linode/rei.nix b/hosts/linode/rei.nix deleted file mode 100644 index 55b3ab7..0000000 --- a/hosts/linode/rei.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ config, ... }: -{ - services.monica = { - enable = true; - appKeyFile = config.age.secrets.monica.path; - appURL = "https://people.thehellings.com"; - database = { - port = 5432; - }; - nginx = { - addSSL = true; - enableACME = true; - serverAliases = [ "people.thehellings.com" ]; - }; - }; - - age.secrets.monica = { - file = ../../secrets/monica.age; - owner = "monica"; - }; - - greg.backup.jobs.monica = { - src = "/var/lib/monica"; - dest = "monica"; - user = "monica"; - }; -} diff --git a/secrets/monica.age b/secrets/monica.age deleted file mode 100644 index 26f7658..0000000 --- a/secrets/monica.age +++ /dev/null @@ -1,38 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 mOmPfg X+7CjshhqaThstA+gFDN23HSrhaJPG/GSkeZSXRXqTg -btgSgDtB5tPaJMMfvZqv/CKqdAcFXBeHEm2ZuC8Fzvs --> ssh-ed25519 YJiRbw EW9X5R7XGczSOoC5fc0gsHgHcK3nTT/KQzjYurw9tws -MB2AyaJFx44mdbsK2sBAYjILuKZxXpd25Ci57q+WyiE --> ssh-ed25519 Nl/5yA lsY4ttlGcJ3FyPDh/Eg2P/xNsynBLLLqKIbzyVUVoQ0 -iEAOfYQyMaglmF+QeMatBLIgG5N2MUNDhM5LP/jNvuk --> ssh-rsa FS7DnA -QkRi9WLtEknHPvJktTXdMOMkEwufHU0JStgCc11rFACJ4ZAa7qb3448jWwq5slFi -G27RoJnMFmEhYkh5Yd6ck5fg/MELTLq/RHaXKJKUwcoXdej8EGN7B3/t+boVdMDK -ab37gwrQl4ek/8wlx/zNowkESPtNuA87MIOjOj2H7ZgvpchTPFqeTmNdR0AcoNBb -Yi7K8Y5yM3UPeUrot+Ad5wvqUzrlK77NNwsybvFSjeTCulUHlTj1FtIJL6xobT0v -IM4Iy/KcwjKK3QoIyMfAt95KuIRMT5GIkfdbQU/wUWSAunX8RiRV4USlkAgg5c0k -b7kKrGkCweAxfwD4AblVXmK9kN8SAwIMhh41PRRvTbtUJNtjUkFA3gNArpsmmVPI -5tNM8JUoe9E2F9WgJHkX4ctcN+Qu3gDKJbg7zvpTNLgw0wgfjh9h54L3p8L46x9L -Ut60f5oAYb6IqZu65WwTv5souNtq1soT3n3H2Tp7NPzAmdBy6G/p++xZ1RNfSeij -dnMMxOGmBiJ14upRaC7s5JZFbu/cwnX/2qLaY0sBXlpJpOFAsKmwd9TEm0+WCaSk -m5moOT7Ivjl8alPXQuOaAZfDFZvpcgOxNviy8iB1D22xkdkXerzbsL07uzKayU0r -SCi6XJmzCtS7TKbfmDjbLnDcVPylkWaKxXw9ekKoZBJ7LPMSfBVVPD+Zap20tV+u -pnfTkLTW3o8pRjvcip1Hl9XuWvyMnIgoKL4CYc0JzLQAcieRn8tVbDXes0O1pAMh -1LWwBHYQyVFTM8qIqpbt/ndKTB9euqEMzeMJ3oMYhDIchozSSwmbsRMrKqh6gWdI -ldeYn3F9sEi5pQwDA0KikDCuT2W2oek+KlQKKquGln/nWf+5m6HTgwvA7QxgIfZi -wYuG9aYxOWwylyUDeHCUJLQ7RPJk6Cik32pVEMaviNwTOnQPBlyzFAwDlq+0crdj -dV+6vo/rRY3UyU7FCuWE8SVZFTwP4E8SfEiqYgOOhE/6jDkAo8q32eEgLMG/9hi4 -Ro6Zy6DEv5la3cHZEUz550K8PHhajScoOiNK5RcG0YgBpLO93awz/iyrUDM2KuwS -xNFcpD165x9VpD2F9yNzvIqnTc3F5rDWa7PhffOV1ECdZaUgxhX8vuNN78sW+A4L -ppuJsVgx1rQFxtavUijFbS5Oona0aOlRLQop2BaW9an+PIRghsYJb/e3vjIGshVH -T5GxobOT7C7nxxs+ovdUUNmr0bWEINicQ9eTAHFx6pGSzgodMS1qrtROoY1L3+My -KVAeLhS7S4ls3W7TDm/AnqNoZG/HUOEyBkXOOzOGgZvD7/LiohNVzW/e1rLO2ziQ -QZByHxpv5gHZCUSq+3jqrA --> ssh-ed25519 FpzvfQ ztmplW5LE5mbFG2oxsnUQ5botTjz1427pPi47zwKTVs -l2leKVw0HKME7pfbP2P/S6YgwR+UDnLfLdyOszZ+2Tw --> ssh-ed25519 GdLgCQ otYdayZhkpESECiKhTSuaoJufMNzdGNboK06fMDWWnM -EmdT4yHbso/SqzJsHpYIHZpTUTUM+5V57yJkftIusSY --> >p|7o:_-grease O:zn -55ZZNnY7ZEWxwJDA ---- 6P7VSDuTwwkEO0Kc9r1COPei6CpAdumIdh9nwWtKQd8 -ː[5{MsݧGR ͋ OҬj9d;;/|"HaA $i#DvU1[(Y5j< \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index b0492e6..f3f31e5 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -34,8 +34,6 @@ in "3proxy.age".publicKeys = everyone; - "monica.age".publicKeys = everyone; - "linode-forgejo-runner.age".publicKeys = everyone; "jude-forgejo-runner.age".publicKeys = everyone; } From df29de17cf87f97be6d6293a9aac5576efa9d5c4 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 16:25:58 -0600 Subject: [PATCH 3/3] Add myself --- home/hosts/myself/default.nix | 4 + home/ssh/authorized_keys | 1 + hosts/default.nix | 1 + hosts/myself/default.nix | 131 +++++++++++++++ hosts/myself/hardware-configuration.nix | 51 ++++++ hosts/myself/runner.nix | 207 ++++++++++++++++++++++++ 6 files changed, 395 insertions(+) create mode 100644 home/hosts/myself/default.nix create mode 100644 hosts/myself/default.nix create mode 100644 hosts/myself/hardware-configuration.nix create mode 100644 hosts/myself/runner.nix diff --git a/home/hosts/myself/default.nix b/home/hosts/myself/default.nix new file mode 100644 index 0000000..04618ac --- /dev/null +++ b/home/hosts/myself/default.nix @@ -0,0 +1,4 @@ +{ ... }: + +{ +} diff --git a/home/ssh/authorized_keys b/home/ssh/authorized_keys index f861375..250453f 100644 --- a/home/ssh/authorized_keys +++ b/home/ssh/authorized_keys @@ -2,3 +2,4 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself diff --git a/hosts/default.nix b/hosts/default.nix index 18ce96f..fd2cd79 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -51,6 +51,7 @@ in { linode = machine { name = "linode"; }; lappy = machine { name = "lappy"; }; mm = unstable { name = "mm"; }; + myself = unstable { name = "myself"; }; iso = machine { name = "iso"; }; iso-beta = unstable { name = "iso"; }; # nix build '.#nixosConfigurations.wsl.config.system.build.installer' diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix new file mode 100644 index 0000000..f7b5ea6 --- /dev/null +++ b/hosts/myself/default.nix @@ -0,0 +1,131 @@ +{ config, pkgs, lib, ... }: + +{ + imports = [ + ./hardware-configuration.nix + ]; + + environment.systemPackages = with pkgs; [ + git + (python3.withPackages (p: with p; [ pip virtualenv ])) + tmux + tree + vim + xonsh + ]; + services = { + openssh.enable = true; + }; + systemd.services = let + def = id: { + enable = true; + ephemeral = false; + extraEnvironment = { + HTTP_PORT_MIN = builtins.toString (8000 + id); + HTTP_PORT_MAX = builtins.toString (8000 + id); + }; + extraLabels = [ "nixos" "isaiah" ]; + extraPackages = with pkgs; [ + config.virtualisation.virtualbox.host.package + curl + gawk + packer + pup + (python3.withPackages (p: with p; [ pip virtualenv ])) + qemu_full + qemu_kvm + xonsh + xorriso + ]; + name = "isaiah-nix-${builtins.toString id}"; + nodeRuntimes = [ "node20" ]; + package = pkgs.github-runner; + replace = true; + runnerGroup = null; + serviceOverrides = { + Group = "vboxusers"; + }; + tokenFile = "/etc/github_token"; + user = "runner"; + url = "https://github.com/greg-hellings/vms"; + workDir = "/home/runner/${builtins.toString id}"; + }; + runner = (import ./runner.nix); + in { + gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); + gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); + gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; }); + gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; }); + gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; }); + }; + networking = { + hostName = "myself"; + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp38s0"; + }; + interfaces.enp38s0 = { + ipv4.addresses = [ { + address = "10.42.1.6"; + prefixLength = 16; + } ]; + }; + nameservers = [ + "10.42.1.5" + ]; + }; + virtualisation = { + libvirtd = { + enable = false; + onBoot = "ignore"; + }; + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; + users = { + users = { + runner = { + extraGroups = [ + "kvm" + "vboxusers" + ]; + group = "runner"; + isNormalUser = true; + }; + greg = { + extraGroups = [ + "kvm" + "sudo" + "vboxusers" + "wheel" + ]; + isNormalUser = true; + }; + }; + groups.runner = {}; + }; + system.stateVersion = lib.mkForce "24.05"; + boot = { + extraModprobeConfig = "options kvm_amd nested=1 vboxdrv"; + supportedFilesystems = [ "ntfs" ]; + loader = { + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + systemd-boot = { + enable = true; + configurationLimit = 10; + }; + }; + }; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "nodejs-16.20.2" + ]; + }; +} diff --git a/hosts/myself/hardware-configuration.nix b/hosts/myself/hardware-configuration.nix new file mode 100644 index 0000000..7a0d889 --- /dev/null +++ b/hosts/myself/hardware-configuration.nix @@ -0,0 +1,51 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=nixos" ]; + }; + + fileSystems."/home" = + { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=home" ]; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/29E7-E20C"; + fsType = "vfat"; + }; + + fileSystems."/myvol" = + { device = "/dev/nvme0n1p1"; + fsType = "btrfs"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/myself/runner.nix b/hosts/myself/runner.nix new file mode 100644 index 0000000..8578100 --- /dev/null +++ b/hosts/myself/runner.nix @@ -0,0 +1,207 @@ +{ config +, lib +, pkgs + +, cfg ? config.services.github-runner +, svcName + +, systemdDir ? "${svcName}/${cfg.name}" + # %t: Runtime directory root (usually /run); see systemd.unit(5) +, runtimeDir ? "%t/${systemdDir}" + # %S: State directory root (usually /var/lib); see systemd.unit(5) +, stateDir ? "%S/${systemdDir}" + # %L: Log directory root (usually /var/log); see systemd.unit(5) +, logsDir ? "%L/${systemdDir}" + # Name of file stored in service state directory +, currentConfigTokenFilename ? ".current-token" + +, ... +}: + +with lib; + +let + workDir = if cfg.workDir == null then runtimeDir else cfg.workDir; + package = cfg.package.override { inherit (cfg) nodeRuntimes; }; +in +{ + description = "GitHub Actions runner"; + + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + + environment = { + HOME = workDir; + RUNNER_ROOT = stateDir; + } // cfg.extraEnvironment; + + path = (with pkgs; [ + bash + coreutils + git + gnutar + gzip + ]) ++ [ + config.nix.package + ] ++ cfg.extraPackages; + + serviceConfig = mkMerge [ + { + ExecStart = "${package}/bin/Runner.Listener run --startuptype service"; + + # Does the following, sequentially: + # - If the module configuration or the token has changed, purge the state directory, + # and create the current and the new token file with the contents of the configured + # token. While both files have the same content, only the later is accessible by + # the service user. + # - Configure the runner using the new token file. When finished, delete it. + # - Set up the directory structure by creating the necessary symlinks. + ExecStartPre = + let + # Wrapper script which expects the full path of the state, working and logs + # directory as arguments. Overrides the respective systemd variables to provide + # unambiguous directory names. This becomes relevant, for example, if the + # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory= + # to contain more than one directory. This causes systemd to set the respective + # environment variables with the path of all of the given directories, separated + # by a colon. + writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" '' + set -euo pipefail + + STATE_DIRECTORY="$1" + WORK_DIRECTORY="$2" + LOGS_DIRECTORY="$3" + + ${lines} + ''; + runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg; + newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig); + currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json"; + newConfigTokenPath = "$STATE_DIRECTORY/.new-token"; + currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}"; + + runnerCredFiles = [ + ".credentials" + ".credentials_rsaparams" + ".runner" + ]; + unconfigureRunner = writeScript "unconfigure" '' + copy_tokens() { + # Copy the configured token file to the state dir and allow the service user to read the file + install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}" + # Also copy current file to allow for a diff on the next start + install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}" + } + clean_state() { + find "$STATE_DIRECTORY/" -mindepth 1 -delete + copy_tokens + } + diff_config() { + changed=0 + # Check for module config changes + [[ -f "${currentConfigPath}" ]] \ + && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \ + || changed=1 + # Also check the content of the token file + [[ -f "${currentConfigTokenPath}" ]] \ + && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \ + || changed=1 + # If the config has changed, remove old state and copy tokens + if [[ "$changed" -eq 1 ]]; then + echo "Config has changed, removing old runner state." + echo "The old runner will still appear in the GitHub Actions UI." \ + "You have to remove it manually." + clean_state + fi + } + if [[ "${optionalString cfg.ephemeral "1"}" ]]; then + # In ephemeral mode, we always want to start with a clean state + clean_state + elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then + # There are state files from a previous run; diff them to decide if we need a new registration + diff_config + else + # The state directory is entirely empty which indicates a first start + copy_tokens + fi + # Always clean workDir + find -H "$WORK_DIRECTORY" -mindepth 1 -delete + ''; + configureRunner = writeScript "configure" '' + if [[ -e "${newConfigTokenPath}" ]]; then + echo "Configuring GitHub Actions Runner" + args=( + --unattended + --disableupdate + --work "$WORK_DIRECTORY" + --url ${escapeShellArg cfg.url} + --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} + --name ${escapeShellArg cfg.name} + ${optionalString cfg.replace "--replace"} + ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"} + ${optionalString cfg.ephemeral "--ephemeral"} + ) + # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option, + # if it is not a PAT, we assume it contains a registration token and use the --token option + token=$(<"${newConfigTokenPath}") + if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then + args+=(--pat "$token") + else + args+=(--token "$token") + fi + ${package}/bin/Runner.Listener configure "''${args[@]}" + # Move the automatically created _diag dir to the logs dir + mkdir -p "$STATE_DIRECTORY/_diag" + cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/" + rm -rf "$STATE_DIRECTORY/_diag/" + # Cleanup token from config + rm "${newConfigTokenPath}" + # Symlink to new config + ln -s '${newConfigPath}' "${currentConfigPath}" + fi + ''; + setupWorkDir = writeScript "setup-work-dirs" '' + # Link _diag dir + ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag" + + # Link the runner credentials to the work dir + ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/" + ''; + in + map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [ + "+${unconfigureRunner}" # runs as root + configureRunner + setupWorkDir + ]; + + # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner) + # to trigger a fresh registration. + Restart = if cfg.ephemeral then "on-success" else "no"; + # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service: + # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146 + RestartForceExitStatus = [ 2 ]; + + # Contains _diag + LogsDirectory = [ systemdDir ]; + # Default RUNNER_ROOT which contains ephemeral Runner data + RuntimeDirectory = [ systemdDir ]; + # Home of persistent runner data, e.g., credentials + StateDirectory = [ systemdDir ]; + StateDirectoryMode = "0700"; + WorkingDirectory = workDir; + + InaccessiblePaths = [ + # Token file path given in the configuration, if visible to the service + "-${cfg.tokenFile}" + # Token file in the state directory + "${stateDir}/${currentConfigTokenFilename}" + ]; + + KillSignal = "SIGINT"; + } + (mkIf (cfg.user != null) { User = cfg.user; }) + cfg.serviceOverrides + ]; +} +