Add gitlab-runner to Linode

hosts/linode/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:
 
 {
 	imports = [
@@ -26,6 +26,7 @@
 	];
 
 	networking = {
+		networkmanager.enable = lib.mkForce false;
 		hostName = "linode";
 		domain = "thehellings.com";
 		nameservers = [
@@ -33,6 +34,41 @@
 		];
 	};
 
+	age.secrets.runner-deployer = {
+		file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
+		owner = "gitlab-runner";
+	};
+
+	services.gitlab-runner = {
+		enable = true;
+		services.deployer = {
+			executor = "shell";
+			registrationConfigFile = config.age.secrets.runner-deployer.path;
+		};
+	};
+
+	users.users.gitlab-runner = {
+		isSystemUser = true;
+		group = "gitlab-runner";
+	};
+	users.groups.gitlab-runner = {};
+
+	systemd.services."gitlab-runner".serviceConfig = {
+		DynamicUser = lib.mkForce false;
+		User = "gitlab-runner";
+	};
+
+	security.sudo.extraRules = [{
+		users = [ "gitlab-runner" ];
+		commands = [{
+			command = "/run/current-system/sw/bin/systemctl";
+			options = [ "NOPASSWD" ];
+		} {
+			command = "/run/current-system/sw/bin/podman";
+			options = [ "NOPASSWD" ];
+		}];
+	}];
+
 	environment.systemPackages = with pkgs; [
 		bind
 		graphviz

hosts/linode/nginx.nix

@@ -23,7 +23,8 @@ in
 	virtualisation.oci-containers = {
 		backend = "podman";
 		containers."homepage" = {
-			image = "ghcr.io/greg-hellings/homepage:latest";
+			# needs explicit port to match what gitlab-runner sees when pulling
+			image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
 			ports = [ "${homepage}:80" ];
 		};
 	};

secrets/gitlab/linode-deployer-runner-reg.age

@@ -0,0 +1,27 @@
+age-encryption.org/v1
+-> ssh-ed25519 oyEmTw lC+4KBNMMM5fHkFBRa/tJT+jFZeN+mw5/8yrdojjVB0
+YwL7HD2UJ14F/hqbCAQU6KYqUzshv+0c8GHs+ZvAp4Q
+-> ssh-ed25519 mOmPfg nUi8aarXOdi1x5PvO15/U1hM6I4quLD7eVQGZrN8OW8
+aPTW1RJ9USImY2zMSL6g9PVwZ9T+7JgOLExnpYKZt9Y
+-> ssh-ed25519 YJiRbw kEJIPA5pyp8mp1tS+EX7YGwxssQ3RYpR7KOpubCa3n0
+p7uz1Zhm3WiR2rYWTnR4WaAwwPL71ILSmul0VadddJQ
+-> ssh-ed25519 aY2AXA GZnDdhRihahe0WCfhx7urPRXn+XWMwUGiU+mC4qaXBM
+QGqQVWLLSb0TII1gF4rHjqqOGMogmEEy9/PoE5wB0CM
+-> ssh-ed25519 xNtnoA tfCFZUkCqvOJ0etchpciY2FfvoX0Y1wW7IU8I2u6pBw
+gqi1YjkYY5Q1wd3UL7bYVFUCSK51V3ggeFcmIhdnug4
+-> ssh-ed25519 Nl/5yA fvgVFAiODubImv5HKKvk9BTrw4abIq1Xi1WC+CxupV4
+Flg0H5pNbfKmyDH1NRBwyzDjQK2v8Z+RJrR2Br3aSa0
+-> ssh-ed25519 GdLgCQ CRzrCRlcBKiLa7ghPfbfrwz08RYH55zRIdPKyXc2jkE
+43Sd7ERicIqrgn0Di7yQ43qJsYbtgeE99DvOj0AzA6A
+-> ssh-ed25519 tOH/HQ pzx7DaPLmk070Zz5yi9BIYGajCKba6/j5CjsQcuHLkg
+4XSP61C4oovtYIvTioZaiB0MoP5/kkk/4a7TWxs0wEQ
+-> ssh-ed25519 FpzvfQ xJpLuQ3NhiVT7PNm5/NngiwV8cm1wYlBjlPsKOcV2nM
+nV9Jx/eIz6MIa217sntxrp2HmkbJsN0hseUgp7iqzSg
+-> ssh-ed25519 kdPvzQ v3TYNmF/9DHD1eKdFblwpfyBh78+jBaiP0H62JJnQF4
+vYQkEzhLmFMiG3TdoSfB/Xa7g6wYzYB2K2jyO/X67Yo
+-> ssh-ed25519 onmXpg iNwyY2pwpwupeu3ZN1ALWl2Z6EJZpqHDFK+IQp8EGHo
+ez+cR4a8i2nJkiko23wflNomrpaoMYDR3fWHrMZHe5M
+-> ssh-ed25519 CnhD0g fU6TSuG9ZEEUxQE9CJLg9wu71IryXpJpb5NXCqdOBiw
+GXPNWmn/SHBOHwBVOGLCfEYkUSF+JkalLKbbBxF4aTE
+--- Zk7n2mzoAnSuC6CdpPH+LGeGVcRPJL4zMt6d+Q2Eipw
+æ¯ôΧ‚%d29úß>#␍£æÅp ÐvLj‘ç¿Èß×}³õõ[îæ`žR¿	yno¥ÏŠ‘•0»Nsyh¤&7NÀ¨À¢Â×°žÉ<àaV¦oÍ·î”
øùÏWäoÓyÉ«�þ%	Obà’Œ#6ïÊ¿R–

secrets/secrets.nix

@@ -60,6 +60,7 @@ in
 	"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-shell-runner-reg.age".publicKeys = everyone;
+	"gitlab/linode-deployer-runner-reg.age".publicKeys = everyone;
 	"gitlab/docker-auth.age".publicKeys = everyone;
 
 	"acme_password.age".publicKeys = everyone;