From 3847c7d92d89871666710b9a2b3f070cac4a52ca Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 5 Apr 2026 16:51:31 -0500 Subject: [PATCH] fix: streamline Gitea runners --- hosts/unstable/isaiah/default.nix | 47 +------------------ hosts/unstable/jeremiah/default.nix | 12 ++--- hosts/unstable/linode/default.nix | 18 +++---- hosts/unstable/zeke/default.nix | 16 ++----- modules/nixos/gitea-runner.nix | 62 +++++++++++++++++++++++-- secrets/gitea/runner-isaiah-podman.age | Bin 1249 -> 2019 bytes secrets/secrets.nix | 2 +- 7 files changed, 76 insertions(+), 81 deletions(-) diff --git a/hosts/unstable/isaiah/default.nix b/hosts/unstable/isaiah/default.nix index 6b8ec8d..2a63d66 100644 --- a/hosts/unstable/isaiah/default.nix +++ b/hosts/unstable/isaiah/default.nix @@ -9,14 +9,6 @@ ./hardware-configuration.nix ]; - age.secrets = { - gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age; - gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age; - runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age; - # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age - # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age; - }; - boot = { binfmt.emulatedSystems = [ "aarch64-linux" ]; extraModprobeConfig = "options kvm_amd nested=1"; @@ -57,9 +49,7 @@ }; gitea-runner = { enable = true; - labels = [ "self-hosted" "bare-metal" "host:isaiah" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age - # tokenFile = config.age.secrets.gitea-runner-isaiah.path; + extraLabels = [ "bare-metal:host" ]; }; }; @@ -75,41 +65,6 @@ }; services = { - gitea-actions-runner.instances.podman = { - enable = true; - labels = [ - "debian-latest:docker://node:25-trixie" - - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest" - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04" - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04" - - "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest" - "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04" - "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04" - - "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest" - "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04" - "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04" - - "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest" - "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04" - "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04" - - "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest" - "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04" - "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04" - - "nix-latest:docker://src.thehellings.com/greg/builder:latest" - ]; - name = "isaiah-podman"; - settings = { - container.force_pull = true; - runner.capacity = 7; - }; - tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path; - url = "https://gitea.shire-zebra.ts.net"; - }; k3s.clusterInit = true; # This is the first node in the cluster openssh = { enable = true; diff --git a/hosts/unstable/jeremiah/default.nix b/hosts/unstable/jeremiah/default.nix index d9a5223..c1a10dd 100644 --- a/hosts/unstable/jeremiah/default.nix +++ b/hosts/unstable/jeremiah/default.nix @@ -29,8 +29,6 @@ in gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age; gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age; gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age; - # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age - # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age; }; # Bootloader. @@ -80,6 +78,10 @@ in }; greg = { + gitea-runner = { + enable = true; + extraLabels = [ "bare-metal:host" ]; + }; home = true; kubernetes = { enable = true; @@ -98,12 +100,6 @@ in threads = 3; qemu = true; }; - gitea-runner = { - enable = true; - labels = [ "self-hosted" "bare-metal" "host:jeremiah" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age - # tokenFile = config.age.secrets.gitea-runner-jeremiah.path; - }; }; hardware = { diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix index d93c1e5..d579ee1 100644 --- a/hosts/unstable/linode/default.nix +++ b/hosts/unstable/linode/default.nix @@ -23,12 +23,14 @@ pgloader ]; - age.secrets = { - # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age - # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age; - }; - greg = { + gitea-runner = { + enable = true; + extraLabels = [ + "vps:host" + "blog:host" + ]; + }; home = false; linode.enable = true; nebula = { @@ -41,12 +43,6 @@ ssl = true; }; tailscale.enable = true; - gitea-runner = { - enable = true; - labels = [ "self-hosted" "host:linode" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age - # tokenFile = config.age.secrets.gitea-runner-linode.path; - }; }; networking = { diff --git a/hosts/unstable/zeke/default.nix b/hosts/unstable/zeke/default.nix index 20c8fde..968194b 100644 --- a/hosts/unstable/zeke/default.nix +++ b/hosts/unstable/zeke/default.nix @@ -14,15 +14,13 @@ top.nix-hardware.nixosModules.system76 ]; - age.secrets = { - gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age; - # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age - # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age; - }; - boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; greg = { + gitea-runner = { + enable = true; + extraLabels = [ "bare-metal:host" ]; + }; kubernetes = { enable = true; vipInterface = "enp12s0"; @@ -34,12 +32,6 @@ enable = true; vbox = false; }; - gitea-runner = { - enable = true; - labels = [ "self-hosted" "bare-metal" "host:zeke" ]; - # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age - # tokenFile = config.age.secrets.gitea-runner-zeke.path; - }; tailscale = { enable = true; tags = [ "home" ]; diff --git a/modules/nixos/gitea-runner.nix b/modules/nixos/gitea-runner.nix index 0b7a710..5680bfb 100644 --- a/modules/nixos/gitea-runner.nix +++ b/modules/nixos/gitea-runner.nix @@ -6,6 +6,8 @@ }: let cfg = config.greg.gitea-runner; + host = config.networking.hostName; + labels = cfg.labels ++ cfg.extraLabels; in { options.greg.gitea-runner = { @@ -23,26 +25,80 @@ in description = "Name of the runner (defaults to hostname)"; }; + capacity = lib.mkOption { + type = lib.types.int; + default = 5; + description = "Number of concurrent jobs the runner can handle"; + }; + + extraLabels = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + }; + labels = lib.mkOption { type = lib.types.listOf lib.types.str; - default = [ "self-hosted" ]; + default = [ + "self-hosted:host" + "nixos-${host}:host" + + "debian-latest:docker://node:25-trixie" + + "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest" + "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04" + "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04" + + "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest" + "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04" + "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04" + + "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest" + "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04" + "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04" + + "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest" + "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04" + "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04" + + "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest" + "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04" + "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04" + + "nix-latest:docker://src.thehellings.com/greg/builder:latest" + ]; description = "Labels to assign to this runner"; }; tokenFile = lib.mkOption { type = lib.types.path; description = "Path to a file containing the runner registration token (from agenix)"; + default = ../../secrets/gitea/runner-isaiah-podman.age; }; }; config = lib.mkIf cfg.enable { + age.secrets."gitea-runner-${host}-podman".file = cfg.tokenFile; + + environment.systemPackages = with pkgs; [ + bash + git + nodejs + ]; + + greg.podman.enable = true; + services.gitea-actions-runner = { package = pkgs.gitea-actions-runner; instances.${cfg.name} = { + inherit labels; + inherit (cfg) name; enable = true; url = cfg.instanceURL; - tokenFile = cfg.tokenFile; - labels = cfg.labels; + tokenFile = config.age.secrets."gitea-runner-${host}-podman".path; + settings = { + container.force_pull = true; + runner.capacity = cfg.capacity; + }; }; }; }; diff --git a/secrets/gitea/runner-isaiah-podman.age b/secrets/gitea/runner-isaiah-podman.age index fb594800f01d703132e853833ef233e5e9b25fb7..80f1873c188a40919058127de068ba86e5b68a48 100644 GIT binary patch literal 2019 zcmZXTxvs+q8HGm(0m>^(lRjL$#47>@ud(Ae-q!|s-}l&#U5-RQ8W0sobaV(Lo?t4( z)`4g#p`=3yiCgDBz^_l|JO2r?>(ptq3XOplqS8M zH8&gb2-B;x>?2@NBNh^%$OoF$I;eIO6x_o-c4+W3=U%kU8?5of3UQ&iN)Vc`r_+4v zKC^2n9=sNJ&kz5qGWZk<%2+8ZT?!_KN2-s<`E#V`JJ;SgNLycN7N43;b~FjhJ!2v4 zTq@>rm*8n;JI)mRvfebmh?Ux_Ee{Mt(pe8${1_-5urr9Do6B}j$VcK{d?-v$Ik;kJ z7F}%y6Z2K}UTM$!qwT08$D@^8`i?yh6L!L+4u?~US<4A5OLkUT*(AudTJ_Q74p+gw z^y?$(`MtAh8M!aB=3w1E({-7%jkL;16<@aAV8mBi;K7tj9a~zu1VMiXDtA=T(Sr!A zG&#c#whX(Zi!nlF?U5(+Q6L9Uq4+ukoM9A6YSyYstWLlj!AP?N zjIiI2Y=9{*bLv8a2(1sarEmK5E{HBN$e#nRA{Ie` zO?L05g8XiKJ-D_jIzR+~@G!{;CvJT!hn>-~K@j^_m*ROo6*d>k!wE6Npeb}-+4OPq7Eznp#&(TTKD<9iL(Aly!0J-7ou|2Lh(a?dTAK`LpJ%!BhB3=c zhWlXh65ldLJFW{?`$XqpIOf$8aE;oKW~NI+#}2lZPr0?%&B%0u+q6S>=WD3P@^y%E zzo30uzY6f`WPasu9;u_VxM;Z6F;JqtntUh%AZW*A)lv{(PR&h=LCS_=f}Z@Mgu9u= z)=Wuv+@WlAz)OxeFldBPYDY=vUbp*jhJsejEN$UwHNzA2eByDyhE4ZXl`5J?v=}4z6*459ifzkc0E25F}Y_DJ<8(Vzpocue(M; zO_kAWsAmsr6x$mn*~*7(Rje+%c4Q$`Mrr%R(6AW9R!kCmdcpHCniu9qTiz?kG1(Jf1-THR5$hTq)*25)d^-A~jzGdh zi9-vHK)lkJHfO=?xX+K^VKt+SUdG4SZDXO8Y`u&+@iO|+Z82)-1_8!g3*4bAwu&=V zDFZHrIilt8ems($h_mS;ZUY}lNXg$tU8k~F8j|#|MIGOj6>H})>KtAI@oE?4jek1K z9w|1Swv5?b&FiT*8d>WOEki*uE`#Zim?bYrg1SOQJKd>eq~#59sCbbKm`+xgi=pX(4^KX3eU-ox@ z_{2&+|IKW5pdQX`S{9#`^#Sj|40@;9_>0c1qe->P9qMkQf#FPj4+coWeRBAWzBe7DZ*}YL?Yzm zpu7}JXOV!soLNE()DIP&@~mD)a=xOX|9wSnpo7efukn7zO&+HXW4!* z0@*o5u!7k( z=1_OR72y@b)=Vwh+={ozIlUdTis4*kF+y{~v&%H%bLz~Gpz+D8PWp|%_bSM#rJC*d z!aW&k()F=#-fG8C?M8(4S6HT3E^^OxPtL+ckke?F?KZT`!nknPQRaB^Stpi5Kf#dz zN8~RTOrf%xJXlkTg6w5punin4fnD@)8Bii%wRg0#I63D7rjjHP&(o#Zd%@J+(a9#} zk8s4@tvFg9$%u-!m8D3{>~b=1)$oYx0+BD{(?RcZPt@jVw9VL9Nz`&2ki^)=$w%5d zO|nJ85eMvCikkt%3LN*EFJx}1*IuPtDk&prpF+tKEQ>lU1qb$%Mek`WERG2{di9o2 zry=#=aK)CC2$jA%yLv39e$%>}8Gqa4JUY+J6}F35qg5B7RkT!*T(^F!ab`yiV4 zG%o>h30b`W+uWSwVb~9`(=#;CL?){j`MKG5!cK5BWwSqRWRo(c%AB?~%UjKNXDerg zxh=c|d7G>%MqEL8)d>d@h#>#;?)!U8)zW@rB#1lOo_QI+ndzaop?|AhPZAbhZ1m_HZB|Ft)psQ>@~ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index bba6700..42967cd 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -100,7 +100,7 @@ in "gitea/oauthToken.age".publicKeys = everyone; "gitea/webhookSecret.age".publicKeys = everyone; "gitea/workerPassword.age".publicKeys = everyone; - "gitea/runner-podman-isaiah.age".publicKeys = users ++ [ hosts.isaiah.pubkey ]; + "gitea/runner-isaiah-podman.age".publicKeys = everyone; "gitlab/secret.age".publicKeys = everyone; "gitlab/otp.age".publicKeys = everyone;