diff --git a/hosts/unstable/isaiah/default.nix b/hosts/unstable/isaiah/default.nix index 6b8ec8d..2a63d66 100644 --- a/hosts/unstable/isaiah/default.nix +++ b/hosts/unstable/isaiah/default.nix @@ -9,14 +9,6 @@ ./hardware-configuration.nix ]; - age.secrets = { - gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age; - gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age; - runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age; - # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age - # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age; - }; - boot = { binfmt.emulatedSystems = [ "aarch64-linux" ]; extraModprobeConfig = "options kvm_amd nested=1"; @@ -57,9 +49,7 @@ }; gitea-runner = { enable = true; - labels = [ "self-hosted" "bare-metal" "host:isaiah" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age - # tokenFile = config.age.secrets.gitea-runner-isaiah.path; + extraLabels = [ "bare-metal:host" ]; }; }; @@ -75,41 +65,6 @@ }; services = { - gitea-actions-runner.instances.podman = { - enable = true; - labels = [ - "debian-latest:docker://node:25-trixie" - - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest" - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04" - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04" - - "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest" - "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04" - "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04" - - "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest" - "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04" - "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04" - - "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest" - "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04" - "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04" - - "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest" - "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04" - "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04" - - "nix-latest:docker://src.thehellings.com/greg/builder:latest" - ]; - name = "isaiah-podman"; - settings = { - container.force_pull = true; - runner.capacity = 7; - }; - tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path; - url = "https://gitea.shire-zebra.ts.net"; - }; k3s.clusterInit = true; # This is the first node in the cluster openssh = { enable = true; diff --git a/hosts/unstable/jeremiah/default.nix b/hosts/unstable/jeremiah/default.nix index d9a5223..c1a10dd 100644 --- a/hosts/unstable/jeremiah/default.nix +++ b/hosts/unstable/jeremiah/default.nix @@ -29,8 +29,6 @@ in gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age; gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age; gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age; - # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age - # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age; }; # Bootloader. @@ -80,6 +78,10 @@ in }; greg = { + gitea-runner = { + enable = true; + extraLabels = [ "bare-metal:host" ]; + }; home = true; kubernetes = { enable = true; @@ -98,12 +100,6 @@ in threads = 3; qemu = true; }; - gitea-runner = { - enable = true; - labels = [ "self-hosted" "bare-metal" "host:jeremiah" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age - # tokenFile = config.age.secrets.gitea-runner-jeremiah.path; - }; }; hardware = { diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix index d93c1e5..d579ee1 100644 --- a/hosts/unstable/linode/default.nix +++ b/hosts/unstable/linode/default.nix @@ -23,12 +23,14 @@ pgloader ]; - age.secrets = { - # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age - # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age; - }; - greg = { + gitea-runner = { + enable = true; + extraLabels = [ + "vps:host" + "blog:host" + ]; + }; home = false; linode.enable = true; nebula = { @@ -41,12 +43,6 @@ ssl = true; }; tailscale.enable = true; - gitea-runner = { - enable = true; - labels = [ "self-hosted" "host:linode" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age - # tokenFile = config.age.secrets.gitea-runner-linode.path; - }; }; networking = { diff --git a/hosts/unstable/zeke/default.nix b/hosts/unstable/zeke/default.nix index 20c8fde..968194b 100644 --- a/hosts/unstable/zeke/default.nix +++ b/hosts/unstable/zeke/default.nix @@ -14,15 +14,13 @@ top.nix-hardware.nixosModules.system76 ]; - age.secrets = { - gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age; - # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age - # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age; - }; - boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; greg = { + gitea-runner = { + enable = true; + extraLabels = [ "bare-metal:host" ]; + }; kubernetes = { enable = true; vipInterface = "enp12s0"; @@ -34,12 +32,6 @@ enable = true; vbox = false; }; - gitea-runner = { - enable = true; - labels = [ "self-hosted" "bare-metal" "host:zeke" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age - # tokenFile = config.age.secrets.gitea-runner-zeke.path; - }; tailscale = { enable = true; tags = [ "home" ]; diff --git a/modules/nixos/gitea-runner.nix b/modules/nixos/gitea-runner.nix index 0b7a710..5680bfb 100644 --- a/modules/nixos/gitea-runner.nix +++ b/modules/nixos/gitea-runner.nix @@ -6,6 +6,8 @@ }: let cfg = config.greg.gitea-runner; + host = config.networking.hostName; + labels = cfg.labels ++ cfg.extraLabels; in { options.greg.gitea-runner = { @@ -23,26 +25,80 @@ in description = "Name of the runner (defaults to hostname)"; }; + capacity = lib.mkOption { + type = lib.types.int; + default = 5; + description = "Number of concurrent jobs the runner can handle"; + }; + + extraLabels = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + }; + labels = lib.mkOption { type = lib.types.listOf lib.types.str; - default = [ "self-hosted" ]; + default = [ + "self-hosted:host" + "nixos-${host}:host" + + "debian-latest:docker://node:25-trixie" + + "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest" + "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04" + "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04" + + "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest" + "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04" + "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04" + + "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest" + "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04" + "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04" + + "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest" + "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04" + "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04" + + "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest" + "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04" + "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04" + + "nix-latest:docker://src.thehellings.com/greg/builder:latest" + ]; description = "Labels to assign to this runner"; }; tokenFile = lib.mkOption { type = lib.types.path; description = "Path to a file containing the runner registration token (from agenix)"; + default = ../../secrets/gitea/runner-isaiah-podman.age; }; }; config = lib.mkIf cfg.enable { + age.secrets."gitea-runner-${host}-podman".file = cfg.tokenFile; + + environment.systemPackages = with pkgs; [ + bash + git + nodejs + ]; + + greg.podman.enable = true; + services.gitea-actions-runner = { package = pkgs.gitea-actions-runner; instances.${cfg.name} = { + inherit labels; + inherit (cfg) name; enable = true; url = cfg.instanceURL; - tokenFile = cfg.tokenFile; - labels = cfg.labels; + tokenFile = config.age.secrets."gitea-runner-${host}-podman".path; + settings = { + container.force_pull = true; + runner.capacity = cfg.capacity; + }; }; }; }; diff --git a/secrets/gitea/runner-isaiah-podman.age b/secrets/gitea/runner-isaiah-podman.age index fb59480..80f1873 100644 Binary files a/secrets/gitea/runner-isaiah-podman.age and b/secrets/gitea/runner-isaiah-podman.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index bba6700..42967cd 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -100,7 +100,7 @@ in "gitea/oauthToken.age".publicKeys = everyone; "gitea/webhookSecret.age".publicKeys = everyone; "gitea/workerPassword.age".publicKeys = everyone; - "gitea/runner-podman-isaiah.age".publicKeys = users ++ [ hosts.isaiah.pubkey ]; + "gitea/runner-isaiah-podman.age".publicKeys = everyone; "gitlab/secret.age".publicKeys = everyone; "gitlab/otp.age".publicKeys = everyone;