greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Bring up the VM runners

Browse Source
This commit is contained in:
Greg Hellings
2023-12-17 15:47:52 -06:00
parent 69e6c42886
commit 1afe353df7
11 changed files with 274 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/myself/container-runner-qemu.nix
+63
View File
@@ -0,0 +1,63 @@
inputs:
{ config, pkgs, ... }:
let
extraPackages = with pkgs; [
curl
gawk
git
packer
pup
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
qemu_full
qemu_kvm
shellcheck
xonsh
xorriso
];
in {
imports = [
inputs.agenix.nixosModules.default
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secrets = let
file = num: {
file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
owner = "gitlab-runner";
};
in {
qemu-runner-reg-1 = file "1";
qemu-runner-reg-2 = file "2";
qemu-runner-reg-3 = file "3";
qemu-runner-reg-4 = file "4";
qemu-runner-reg-5 = file "5";
};
networking.useHostResolvConf = pkgs.lib.mkForce false;
networking.nameservers = [ "100.100.100.100" ];
services.resolved.enable = true;
environment.systemPackages = extraPackages;
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = let
r = num: {
executor = "shell";
registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
tagList = [ "shell" "qemu" ];
};
in {
shell1 = r "1";
shell2 = r "2";
shell3 = r "3";
shell4 = r "4";
shell5 = r "5";
};
};
systemd.services.gitlab-runner.wants = [ "network-online.target" ];
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
system.stateVersion = "24.05";
}
hosts/myself/container-runner-vbox.nix
+84
View File
@@ -0,0 +1,84 @@
{ inputs, name, extra}:
({ config, pkgs, lib, ... }:
let
py = (pkgs.python3.withPackages (p: with p; [
pip
pyyaml
virtualenv
]));
in (
lib.attrsets.recursiveUpdate {
imports = [
inputs.agenix.nixosModules.default
];
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
};
environment.systemPackages = with pkgs; [
curl
gawk
git
packer
pup
py
shellcheck
xorriso
];
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
nixpkgs.config.allowUnfree = true;
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.runner-reg.path;
tagList = [ "shell" name ];
};
};
};
resolved.enable = true;
};
systemd.services.gitlab-runner = {
wants = [ "network-online.target" ];
after = [ "network.target" "network-online.target" ];
serviceConfig = {
User = "root";
DynamicUser = lib.mkForce false;
};
};
system.stateVersion = "24.05";
users.users.gitlab-runner = {
isNormalUser = true;
group = "gitlab-runner";
extraGroups = [
"root"
"sudo"
"vboxusers"
"wheel"
];
};
users.groups.gitlab-runner = {};
}
extra
) # End of attrsets.recursiveUpdate
) # End of outter function wrapper
hosts/myself/default.nix
-10
View File
@@ -36,16 +36,6 @@
"10.42.1.5"
];
};
virtualisation = {
libvirtd = {
enable = false;
onBoot = "ignore";
};
virtualbox.host = {
enable = true;
enableExtensionPack = true;
};
};
users = {
users = {
greg = {
hosts/myself/git.nix
+55 -48
View File
@@ -1,24 +1,15 @@
{ config, pkgs, lib, inputs, ... }:
let
extraPackages = with pkgs; [
config.virtualisation.virtualbox.host.package
curl
gawk
git
packer
pup
(python3.withPackages (p: with p; [ pip virtualenv ]))
qemu_full
qemu_kvm
shellcheck
xonsh
xorriso
];
gitlabStateDir = "/var/lib/gitlab";
registryPort = 8001;
container = input: (lib.attrsets.recursiveUpdate {
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
privateNetwork = true;
} input);
in {
networking = {
firewall = {
@@ -36,33 +27,36 @@ in {
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
containers.gitlab = {
containers.gitlab = container {
autoStart = true;
bindMounts = {
"/var/gitlab/state" = {
hostPath = gitlabStateDir;
isReadOnly = false;
};
"/etc/ssh".hostPath = "/etc/ssh";
};
forwardPorts = [{
hostPort = 2222;
containerPort = 22;
}];
privateNetwork = true;
hostAddress = "192.168.200.1";
localAddress = "192.168.200.2";
config = ((import ./container-git.nix) { inherit inputs registryPort; });
};
systemd.services."container@gitlab-runner".serviceConfig = {
systemd.services."container@gitlab-runner-qemu".serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [
"rmmod kvm_amd kvm"
];
ExecPreStart = [
"modprobe kvm"
];
};
systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
containers.gitlab-runner = {
autoStart = true;
containers.gitlab-runner-qemu = container {
bindMounts = {
"/etc/ssh".hostPath = "/etc/ssh";
"/dev/kvm" = {
hostPath = "/dev/kvm";
isReadOnly = false;
@@ -71,37 +65,50 @@ in {
extraFlags = [
"--property=DeviceAllow=/dev/kvm"
];
privateNetwork = true;
hostAddress = "192.168.201.1";
localAddress = "192.168.201.2";
config = { config, pkgs, ... }: {
imports = [
inputs.agenix.nixosModules.default
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secrets.qemu-runner-reg = {
file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
owner = "gitlab-runner";
config = ((import ./container-runner-qemu.nix) inputs);
};
systemd.services."container@gitlab-runner-vbox".serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [
"rmmod vboxnetadp vboxnetflt vboxdrv"
];
ExecPreStart = [
"modprobe vboxdrv vboxnetadp vboxnetflt"
];
};
systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
containers.gitlab-runner-vbox = container {
bindMounts = {
"/dev/vboxdrv" = {
hostPath = "/dev/vboxdrv";
isReadOnly = false;
};
networking.useHostResolvConf = lib.mkForce false;
networking.nameservers = [ "100.100.100.100" ];
services.resolved.enable = true;
environment.systemPackages = extraPackages;
services.gitlab-runner = {
enable = true;
services = {
shell = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.qemu-runner-reg.path;
tagList = [ "shell" "qemu" ];
};
"/dev/vboxdrvu" = {
hostPath = "/dev/vboxdrvu";
isReadOnly = false;
};
"/dev/vboxnetctl" = {
hostPath = "/dev/vboxnetctl";
isReadOnly = false;
};
};
hostAddress = "192.168.202.1";
localAddress = "192.168.202.2";
config = ((import ./container-runner-vbox.nix) {
inherit inputs;
name = "vbox";
extra = {
virtualisation.virtualbox.host = {
enable = true;
enableExtensionPack = true;
enableHardening = false;
headless = true;
};
};
system.stateVersion = "24.05";
};
});
};
}
secrets/gitlab/myself-qemu-runner-reg.age → secrets/gitlab/myself-qemu-runner-reg-1.age
View File
secrets/gitlab/myself-qemu-runner-reg-2.age
+23
View File
@@ -0,0 +1,23 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic
/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0
-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY
QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38
-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY
52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o
-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0
sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips
-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI
T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc
-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg
lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro
-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg
FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg
-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk
LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM
-> XWz-grease ~X,$Oko
qcqccJwfeg
--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0
æïå¬
o”½8¥éÏêú缹lOX"aÐq"¬ýE(…†æ_´•fÉ—ÙÎ ,t±¦º4¸pN°J½Y¨X{ì‚oÙ�^º„ÁœM½
œ¾çýªÐ†þ‚±wÉâýs 8¯5—yý‡ÜÙ�›éò¸l£¼
secrets/gitlab/myself-qemu-runner-reg-3.age
BIN
View File
Binary file not shown.
secrets/gitlab/myself-qemu-runner-reg-4.age
BIN
View File
Binary file not shown.
secrets/gitlab/myself-qemu-runner-reg-5.age
+21
View File
@@ -0,0 +1,21 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE
iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM
-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI
OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk
-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s
pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk
-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0
oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA
-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg
/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c
-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls
olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ
-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU
ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo
-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4
UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0
-> I-grease nF)
EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI
--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04
Æ�£PüdÙ•ÔÞµÃ%1|' åîZšÑþÒK¯'¥[½@—yF¯?¼Ó'®¬…iÚé¿ï{Á »‚Ð!Áf> êbðÛt~‘z¦à q$“Š$Œ£µ]HçBÛÍçRLµÚ#ôóé‚äËr€¦¨+„@\àóð
secrets/gitlab/myself-vbox-runner-reg.age
+22
View File
@@ -0,0 +1,22 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020
AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0
-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo
oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8
-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw
VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg
-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0
kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y
-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE
6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU
-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0
IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk
-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20
IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI
-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo
ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o
-> x+-grease 1 Wd/1m/
Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y
6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7
--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ
„«ëH­“ÖdJÌDhˆòLxÄ1¾…H¯æDÄxê·Ÿ#òy!uüßëA'[¨§óCºx¨SÖ7Ý]îÖë‹à"‚â<˜\]{2ÛêIôHew␍;ƒ67®!¯tUúlÞb)r²Ô�Ž×ö`e±Æ�{7az‹
secrets/secrets.nix
+6 -1
View File
@@ -49,5 +49,10 @@ in
# Then pipe the resulting files to agenix -e <foo>
"gitlab/key.age".publicKeys = everyone;
"gitlab/cert.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone;
"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
}