From 338efa36aceb127197b607f05413b90cbdeb8e6c Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 4 Apr 2024 13:53:17 -0500 Subject: [PATCH] QEmu Working, again... --- hosts/myself/container-runner.nix | 15 +++++ hosts/myself/git.nix | 75 ++++++++++------------ secrets/gitlab/myself-qemu-runner-reg.age | Bin 1740 -> 1734 bytes 3 files changed, 48 insertions(+), 42 deletions(-) diff --git a/hosts/myself/container-runner.nix b/hosts/myself/container-runner.nix index 75226f5..440d547 100644 --- a/hosts/myself/container-runner.nix +++ b/hosts/myself/container-runner.nix @@ -50,6 +50,12 @@ lib.attrsets.recursiveUpdate { nixpkgs.config.allowUnfree = true; + users.users.gitlab-runner = { + isSystemUser = true; + group = "kvm"; + extraGroups = [ "kvm" ]; + }; + services = { gitlab-runner = { enable = true; @@ -78,6 +84,15 @@ lib.attrsets.recursiveUpdate { "network-online.target" "systemd-resolved.service" ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + PrivateDevices = false; + ProtectKernelModules = false; + DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; + DynamicUser = lib.mkForce false; + User = "root"; + Group = "kvm"; + }; }; system.stateVersion = lib.mkForce "24.05"; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 8eaa9e9..2e8c634 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -39,55 +39,20 @@ in { }; systemd.services = { - "container@gitlab-runner-qemu" = { - # Now moved to a separate machine - conflicts = [ - "container@gitlab-runner-vbox.service" - ]; + "gitlab-runner" = { serviceConfig = { DevicePolicy = lib.mkForce "auto"; + DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; + EnvironmentFile = config.age.secrets.docker-auth.path; ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ]; ExecStartPre = [ - "${pkgs.kmod}/bin/modprobe kvm" - "${pkgs.kmod}/bin/modprobe kvm_amd" + "+${pkgs.kmod}/bin/modprobe kvm" + "+${pkgs.kmod}/bin/modprobe kvm_amd" ]; + PrivateDevices = false; + ProtectKernelModules = false; }; }; - gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path; - }; - - ##################################################################################### - #################### QEmu Runner #################################################### - ##################################################################################### - containers.gitlab-runner-qemu = container { - autoStart = true; - bindMounts = { - "/dev/kvm" = { - hostPath = "/dev/kvm"; - isReadOnly = false; - }; - "/dev/mem" = { - hostPath = "/dev/mem"; - isReadOnly = false; - }; - }; - extraFlags = [ - "--property=DeviceAllow=/dev/kvm" - ]; - hostAddress = "192.168.201.1"; - localAddress = "192.168.201.2"; - config = ((import ./container-runner.nix) { - inherit inputs overlays; - name = "qemu"; - packages = with pkgs; [ qemu_full qemu_kvm ]; - extra = { - virtualisation.libvirtd = { - enable = true; - onBoot = "ignore"; - package = pkgs.libvirt-greg; - }; - }; - }); }; ##################################################################################### @@ -108,6 +73,7 @@ in { ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; + age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age; services.gitlab-runner = { enable = true; settings = { @@ -144,10 +110,35 @@ in { "/cache" ]; }; + qemu = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.runner-qemu.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + }; + }; }; }; virtualisation = { docker.enable = true; oci-containers.backend = "docker"; }; + environment.systemPackages = with pkgs; [ + curl + gawk + git + p7zip + packer + pup + (python3.withPackages (p: with p; [ pip pyyaml virtualenv ]) ) + qemu_full + qemu_kvm + shellcheck + unzip + xonsh + xorriso + vagrant + wget + ]; } diff --git a/secrets/gitlab/myself-qemu-runner-reg.age b/secrets/gitlab/myself-qemu-runner-reg.age index 31bd19330ff2b1e5b39781483b64097fa7db09b0..cd270e6e3988d6455eec323e3364ee4efbc97b92 100644 GIT binary patch literal 1734 zcmZY8`>)f683thJU>lKE6}C=lH>OnDg(*FAVkbFC3$#ug+i`5ib{xkJOyDHG#j)e~ z631C#bY1B|t;S)%K$?0{Z_}V-Omt`yr5AD8r7A@#qFUF|vlfKJSj!ITXbT+1&!_*u z_vqF8ezK-aD0bV89N*~MKkB<0FigcJR>wV0pHMnrCX>p?`%%f_!?lO$K-Vzk$momL7?GH|EC5fwBPu|Xwd(Vn45o|};) z+*fqo68Zjo&8k|As>MA6Pq^e*o)q%{m=>d?73y-%H3qeY-e$Z+Az78n0N9}PddwAY z&q7m#EYS|3ry+(P=k!v|VH{J!lSsYTHz~rzi@h{8Uy}%fYlU$%i`5Wb6S7T_s%u!@ zBn@q7VRVA&rbhW{z$R!$mJ2PQD8-a43cETUl%Rs*v94i+psZUC+plVDO&C~}J~E_7 zWwaQE^EFulVG)k2wIE$8)WsC7WfBUCx#MxO2H{4RNtDNR%Tt@E&cKEM3CWlv*C@F- zX%+o)b%Y?pQ7Y9Ipki+93fX>z!sw`5h60X~itK!CMEiChj_aZ#lz^%V<{{5lN-`o;a9yl2i>7gFlNhZBv#lVO{B0EyQuoA38YDG2jw3%HVt*GI{i0D}!r!$F=L z1-2n&nrz%}A-2qyOJcF|_ucQbdOv1c3On8K-4G=9g&>1r7lNB+b2R32jp$0}ut~6gW zJIrv*#tld%k~+$F{hG}=Zq{bfo&&brNhVA7c(D*LaFmoQV3M!L)HdNGmI0`u;44rK z=_6yd?f6-{>Jdb)SkHhFq{5Rp3VorszHNz)7Vk4U0&@wi*3P(U^^?M)m&`ZrQh#Axgh@2#dmx-bLAuP z_~j*wt{!AwS~x}hvh~5kE6?SAeqzHPk0Wn@%Z|=ThtOx{=Kgnm?o{vnJrk$bzk2KG z6L&3aOo>bXeCKTZ!rs4*Zh3U)%df3|Z_B6mFL~?z3p;LKe$2S-_Rp|)ZvFV;$p>bh z+P-V!iWi?a@X+C#msZGDFy6k4e*5wZ>hjMot?C|}8NT-f_N8C-N>{|KR^<$@YocYeaUoZIK zvf0e57p{Gr_(}ZvGe4gF#*Opqzq#k&`JGxbz3#s&^;5NLm%Fbod|>iHXX@ndW~RBh z=|z8$*R0sO<(AR9og2O$u3T;|-9z)=z4skuYWJpZJ-&Fy^|AY*{FeLl(%q;2K6~Xi z8^0fYvg`B1Yi|R-dOSd$J&L{f(Y}ofk6hca`syBT!;dW3{VqJc|K1b&=Em8|nzO%n`LVPA#P;r7cXej- zbFVzMx%A~L>}%hXjQRio literal 1740 zcmZY8|IZr*9S86&5e+2|6QelLxZ)fvJ07oh*X!LuoLt*$@7n8Kuf4W+)kUwp>wRhO z%hUVXI%dGIjkrwq&1HcBk}V9-k!)^Y2>1*`wgsF-bh;oiqnK^XnF)#87{=%4XaB(G zm3Q8sx1wvan$sUoyufswZ@Ob0jG)x)+O+Q*vziK{C`6>)31y3M8pMT~Q*uQMjz*S- zHl#)a7Ltt5guQ}Wtw#{8gxR@*1lVqB1Wt0(Oow6>ix(*uni_aPYXW(ph)7)t!U|)Q zE}DKV0pi7)&D-^Xp3df?w!smoRvb>JY*%r{1daEFh_3(!CW7NpJ&L>8R)i&TO7j7~ z$H%d!bJHoJ$MsCb>`;AGEm;U-6H2ic>1RR)S_mjR@JxwW&z7DG3_}0SuOT9h>N4F_$S# zfl+3$rpPcUk?D|#QMlWYX;G?FGA75MjMLEihA|iBvN3lm@-7n zfks^)wBuH7V%i4VZyG(=po}tzjhuEC6FPi$v6gUwbB+vB^p-4at0OWNNC*ZHK7L8aK-^Qtzt=o zTC8y+5S@@|Sb)%SKElO<(Cvagk~D-io1;sbELY`m3mGz`Ab!f?41kR#U*wZw zghK(Siwp$RIDL+75hCvqc9G6Hpjbz5=&h`>dO=8!CWIE`taeMQEL@ZlFAV4cSan@$ z977Y+=v3VhlE_{lwo;r}92g4PO!Oj5kfBAWjh@@A1c<`7=%DQ6TL7aLs%1j1EzTD3 zG)N0+WFj;>W3Q*t*aWSsBEgQ)GS;fHzS`r$ZU!Tia>r)^y2YfVHfrOdrnG@-NCW-4 z#In{j#*q?@7hC?6OGP?apHGwcIpT!G5|4SO4^^=K-j z39jaX6-WT$th%sO$E4eoQqAO|qR+6L5p)M=kQs>;gTzx38n^Sv!iyByS`>JE;G2Ro zF|lrDDjH^f8cvMRiREf0xa3${3BVV50N%-M9rB6%c{d!*DYbaM!&Cd$CD$<*xZY}$>px}K|( zz6RT_Dbd5W;gQU=i}PO3E;MO)Gyz#b8mge5YONpNQ-0v+^AG%L&)1(iUqa-ii({r6^9K4#S}|9)oQX7Y_w^XLAFTs_DieEa0l9e=uO_s7RS znhh@AdG31Sw>MoJo;W&uPcLl%SM2-BlEczFoyYU;hR?qH*8C|Iyz`lxUpjoY^WYCx z#hYIKoj>2-6(0QV@ui=h|IYXS@`E$4-g@bzy!4HgJI<}&cz?X^g|DuKFZa%T;ctI^ z^U{`&ud!!-`Lw)g*&m<$K+JyamfLSR@b4@4zX=|D>-0;z=eNGi(|0}hnPnvL@U8D) zJHK_-+h1QbI&xv4uGzg;Q_d3~Hm)$+xBlkt(~k^RMThqPhraJHJoC!l@pA{B$ZWor z%bmEk{lm)ftN9h5|LITe*{-hGb{q4>%?7dU(cx_`zWdNT&(A!P{g?CORm)d@?$ayx zed(h;!M;zP=E)1)|2p4z<p<@@V!U=y!Xp@NJDW@Tr=J()n<3WyYVGYynp1>vd$*1zWS{1tZoVy NP7kcc+Mgdd@qbctdYk|N