Bring up the VM runners

hosts/myself/container-runner-qemu.nix

@@ -0,0 +1,63 @@
+inputs:
+{ config, pkgs, ... }:
+let
+	extraPackages = with pkgs; [
+		curl
+		gawk
+		git
+		packer
+		pup
+		(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
+		qemu_full
+		qemu_kvm
+		shellcheck
+		xonsh
+		xorriso
+	];
+in {
+	imports = [
+		inputs.agenix.nixosModules.default
+	];
+	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+	age.secrets = let
+		file = num: {
+			file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
+			owner = "gitlab-runner";
+		};
+	in {
+		qemu-runner-reg-1 = file "1";
+		qemu-runner-reg-2 = file "2";
+		qemu-runner-reg-3 = file "3";
+		qemu-runner-reg-4 = file "4";
+		qemu-runner-reg-5 = file "5";
+	};
+
+	networking.useHostResolvConf = pkgs.lib.mkForce false;
+	networking.nameservers = [ "100.100.100.100" ];
+	services.resolved.enable = true;
+
+	environment.systemPackages = extraPackages;
+
+	services.gitlab-runner = {
+		enable = true;
+		settings.concurrent = 5;
+		services = let
+			r = num: {
+				executor = "shell";
+				registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
+				tagList = [ "shell" "qemu" ];
+			};
+		in {
+			shell1 = r "1";
+			shell2 = r "2";
+			shell3 = r "3";
+			shell4 = r "4";
+			shell5 = r "5";
+		};
+	};
+
+	systemd.services.gitlab-runner.wants = [ "network-online.target" ];
+	systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
+
+	system.stateVersion = "24.05";
+}

hosts/myself/container-runner-vbox.nix

@@ -0,0 +1,84 @@
+{ inputs, name, extra}:
+
+({ config, pkgs, lib, ... }:
+let
+	py = (pkgs.python3.withPackages (p: with p; [
+		pip
+		pyyaml
+		virtualenv
+	]));
+in (
+	lib.attrsets.recursiveUpdate {
+
+		imports = [
+			inputs.agenix.nixosModules.default
+		];
+
+		age = {
+			identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+			secrets.runner-reg = {
+				file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
+				owner = "gitlab-runner";
+			};
+		};
+
+		environment.systemPackages = with pkgs; [
+			curl
+			gawk
+			git
+			packer
+			pup
+			py
+			shellcheck
+			xorriso
+		];
+
+		networking = {
+			useHostResolvConf = pkgs.lib.mkForce false;
+			nameservers = [ "100.100.100.100" ];
+		};
+
+		nixpkgs.config.allowUnfree = true;
+
+		services = {
+			gitlab-runner = {
+				enable = true;
+				settings.concurrent = 5;
+				services = {
+					shell = {
+						executor = "shell";
+						limit = 5;
+						registrationConfigFile = config.age.secrets.runner-reg.path;
+						tagList = [ "shell" name ];
+					};
+				};
+			};
+			resolved.enable = true;
+		};
+
+		systemd.services.gitlab-runner = {
+			wants = [ "network-online.target" ];
+			after = [ "network.target" "network-online.target" ];
+			serviceConfig = {
+				User = "root";
+				DynamicUser = lib.mkForce false;
+			};
+		};
+
+		system.stateVersion = "24.05";
+		users.users.gitlab-runner = {
+			isNormalUser = true;
+			group = "gitlab-runner";
+			extraGroups = [
+				"root"
+				"sudo"
+				"vboxusers"
+				"wheel"
+			];
+		};
+		users.groups.gitlab-runner = {};
+	}
+
+	extra
+)  # End of attrsets.recursiveUpdate
+)  # End of outter function wrapper

hosts/myself/default.nix

@@ -36,16 +36,6 @@
 			"10.42.1.5"
 		];
 	};
-	virtualisation = {
-		libvirtd = {
-			enable = false;
-			onBoot = "ignore";
-		};
-		virtualbox.host = {
-			enable = true;
-			enableExtensionPack = true;
-		};
-	};
 	users = {
 		users = {
 			greg = {

hosts/myself/git.nix

@@ -1,24 +1,15 @@
 { config, pkgs, lib, inputs, ... }:
 
 let
-	extraPackages = with pkgs; [
-		config.virtualisation.virtualbox.host.package
-		curl
-		gawk
-		git
-		packer
-		pup
-		(python3.withPackages (p: with p; [ pip virtualenv ]))
-		qemu_full
-		qemu_kvm
-		shellcheck
-		xonsh
-		xorriso
-	];
 
 	gitlabStateDir = "/var/lib/gitlab";
 
 	registryPort = 8001;
+
+	container = input: (lib.attrsets.recursiveUpdate {
+		bindMounts."/etc/ssh".hostPath = "/etc/ssh";  # For agenix secrets
+		privateNetwork = true;
+	} input);
 in  {
 	networking = {
 		firewall = {
@@ -36,33 +27,36 @@ in  {
 	
 	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
-	containers.gitlab = {
+	containers.gitlab = container {
 		autoStart = true;
 		bindMounts = {
 			"/var/gitlab/state" = {
 				hostPath = gitlabStateDir;
 				isReadOnly = false;
 			};
-			"/etc/ssh".hostPath = "/etc/ssh";
 		};
 		forwardPorts = [{
 			hostPort = 2222;
 			containerPort = 22;
 		}];
-		privateNetwork = true;
 		hostAddress = "192.168.200.1";
 		localAddress = "192.168.200.2";
 		config = ((import ./container-git.nix) { inherit inputs registryPort; });
 	};
 
-	systemd.services."container@gitlab-runner".serviceConfig = {
+	systemd.services."container@gitlab-runner-qemu".serviceConfig = {
 		DevicePolicy = lib.mkForce "auto";
+		ExecPostStop = [
+			"rmmod kvm_amd kvm"
+		];
+		ExecPreStart = [
+			"modprobe kvm"
+		];
 	};
+	systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
 
-	containers.gitlab-runner = {
+	containers.gitlab-runner-qemu = container {
-		autoStart = true;
 		bindMounts = {
-			"/etc/ssh".hostPath = "/etc/ssh";
 			"/dev/kvm" = {
 				hostPath = "/dev/kvm";
 				isReadOnly = false;
@@ -71,37 +65,50 @@ in  {
 		extraFlags = [
 			"--property=DeviceAllow=/dev/kvm"
 		];
-		privateNetwork = true;
 		hostAddress = "192.168.201.1";
 		localAddress = "192.168.201.2";
-		config = { config, pkgs, ... }: {
+		config = ((import ./container-runner-qemu.nix) inputs);
-			imports = [
+	};
-				inputs.agenix.nixosModules.default
+
-			];
+	systemd.services."container@gitlab-runner-vbox".serviceConfig = {
-			age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+		DevicePolicy = lib.mkForce "auto";
-			age.secrets.qemu-runner-reg = {
+		ExecPostStop = [
-				file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
+			"rmmod vboxnetadp vboxnetflt vboxdrv"
-				owner = "gitlab-runner";
+		];
+		ExecPreStart = [
+			"modprobe vboxdrv vboxnetadp vboxnetflt"
+		];
+	};
+	systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
+
+	containers.gitlab-runner-vbox = container {
+		bindMounts = {
+			"/dev/vboxdrv" = {
+				hostPath = "/dev/vboxdrv";
+				isReadOnly = false;
 			};
-
+			"/dev/vboxdrvu" = {
-			networking.useHostResolvConf = lib.mkForce false;
+				hostPath = "/dev/vboxdrvu";
-			networking.nameservers = [ "100.100.100.100" ];
+				isReadOnly = false;
-			services.resolved.enable = true;
+			};
-
+			"/dev/vboxnetctl" = {
-			environment.systemPackages = extraPackages;
+				hostPath = "/dev/vboxnetctl";
-
+				isReadOnly = false;
-			services.gitlab-runner = {
+			};
-				enable = true;
+		};
-				services = {
+		hostAddress = "192.168.202.1";
-					shell = {
+		localAddress = "192.168.202.2";
-						executor = "shell";
+		config = ((import ./container-runner-vbox.nix) {
-						limit = 5;
+			inherit inputs;
-						registrationConfigFile = config.age.secrets.qemu-runner-reg.path;
+			name = "vbox";
-						tagList = [ "shell" "qemu" ];
+			extra = {
-					};
+				virtualisation.virtualbox.host = {
+					enable = true;
+					enableExtensionPack = true;
+					enableHardening = false;
+					headless = true;
 				};
 			};
-			system.stateVersion = "24.05";
+		});
-		};
 	};
 }

secrets/gitlab/myself-qemu-runner-reg-2.age

@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic
+/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0
+-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY
+QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38
+-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY
+52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o
+-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0
+sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips
+-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI
+T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc
+-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg
+lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro
+-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg
+FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg
+-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk
+LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM
+-> XWz-grease ~X,$Oko
+qcqccJwfeg
+--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0
+æïå¬
+o”½8¥éÏêú缹lOX"aÐq"¬ýE(…†æ_´•fÉ—ÙÎ,t±¦º4¸pN°J½Y¨X{ì‚oÙ�^º„Á
œM½
+œ¾çýªÐ†þ‚±wÉâýs 8¯5—yý‡ÜÙ�›éò¸l£¼

secrets/gitlab/myself-qemu-runner-reg-5.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE
+iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM
+-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI
+OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk
+-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s
+pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk
+-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0
+oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA
+-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg
+/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c
+-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls
+olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ
+-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU
+ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo
+-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4
+UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0
+-> I-grease nF)
+EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI
+--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04
+Æ�£PüdÙ•ÔÞµÃ%1|'åîZšÑþÒK¯'¥[½@—yF¯?¼Ó'®¬…iÚé¿ï{Á»‚Ð!Áf>êbðÛt~‘z¦à q$“Š$Œ£µ]HçBÛÍçRLµÚ#ôóé‚äËr€¦¨+„@\àóð

secrets/gitlab/myself-vbox-runner-reg.age

@@ -0,0 +1,22 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020
+AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0
+-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo
+oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8
+-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw
+VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg
+-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0
+kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y
+-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE
+6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU
+-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0
+IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk
+-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20
+IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI
+-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo
+ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o
+-> x+-grease 1 Wd/1m/
+Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y
+6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7
+--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ
+„«ëH­“ÖdJÌDhˆòLxÄ1¾…H¯æDÄxê·Ÿ#òy!uüßëA'[¨§óCºx¨SÖ7Ý]îÖë‹à"‚â<˜\]{2ÛêIôHew␍;ƒ67®!¯tUúlÞb)r²Ô�Ž×ö`
e±Æ�{7az‹

secrets/secrets.nix

@@ -49,5 +49,10 @@ in
 	# Then pipe the resulting files to agenix -e <foo>
 	"gitlab/key.age".publicKeys = everyone;
 	"gitlab/cert.age".publicKeys = everyone;
-	"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone;
+	"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
 }