Merge remote-tracking branch 'origin/myself-gitlab'
This commit is contained in:
Greg Hellings
@@ -1,5 +0,0 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
# Graphics, please
|
||||
greg.gnome.enable = true;
|
||||
# Set host name
|
||||
networking.hostName = "lappy";
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/63bcc80e-0501-4aef-bb58-30bb83881055";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/dev/disk/by-uuid/C617-B2B1";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/bc4f24a3-5969-4bcb-95f4-f80109e36ebb"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
+106
-127
@@ -1,131 +1,110 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./git.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
tmux
|
||||
tree
|
||||
vim
|
||||
xonsh
|
||||
];
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
systemd.services = let
|
||||
def = id: {
|
||||
enable = true;
|
||||
ephemeral = false;
|
||||
extraEnvironment = {
|
||||
HTTP_PORT_MIN = builtins.toString (8000 + id);
|
||||
HTTP_PORT_MAX = builtins.toString (8000 + id);
|
||||
};
|
||||
extraLabels = [ "nixos" "isaiah" ];
|
||||
extraPackages = with pkgs; [
|
||||
config.virtualisation.virtualbox.host.package
|
||||
curl
|
||||
gawk
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
name = "isaiah-nix-${builtins.toString id}";
|
||||
nodeRuntimes = [ "node20" ];
|
||||
package = pkgs.github-runner;
|
||||
replace = true;
|
||||
runnerGroup = null;
|
||||
serviceOverrides = {
|
||||
Group = "vboxusers";
|
||||
};
|
||||
tokenFile = "/etc/github_token";
|
||||
user = "runner";
|
||||
url = "https://github.com/greg-hellings/vms";
|
||||
workDir = "/home/runner/${builtins.toString id}";
|
||||
};
|
||||
runner = (import ./runner.nix);
|
||||
in {
|
||||
gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; });
|
||||
gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; });
|
||||
gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; });
|
||||
gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; });
|
||||
gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; });
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
interfaces.enp38s0 = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = false;
|
||||
onBoot = "ignore";
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
runner = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"vboxusers"
|
||||
];
|
||||
group = "runner";
|
||||
isNormalUser = true;
|
||||
};
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"vboxusers"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
groups.runner = {};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1 vboxdrv";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
tmux
|
||||
tree
|
||||
vim
|
||||
xonsh
|
||||
];
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
systemd.services = let
|
||||
def = id: {
|
||||
enable = true;
|
||||
ephemeral = false;
|
||||
extraEnvironment = {
|
||||
HTTP_PORT_MIN = builtins.toString (8000 + id);
|
||||
HTTP_PORT_MAX = builtins.toString (8000 + id);
|
||||
};
|
||||
extraLabels = [ "nixos" "isaiah" ];
|
||||
name = "isaiah-nix-${builtins.toString id}";
|
||||
nodeRuntimes = [ "node20" ];
|
||||
package = pkgs.github-runner;
|
||||
replace = true;
|
||||
runnerGroup = null;
|
||||
serviceOverrides = {
|
||||
Group = "vboxusers";
|
||||
};
|
||||
tokenFile = "/etc/github_token";
|
||||
user = "runner";
|
||||
url = "https://github.com/greg-hellings/vms";
|
||||
workDir = "/home/runner/${builtins.toString id}";
|
||||
};
|
||||
runner = a: {};
|
||||
in {
|
||||
gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; });
|
||||
gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; });
|
||||
gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; });
|
||||
gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; });
|
||||
gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; });
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
interfaces.enp38s0 = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = false;
|
||||
onBoot = "ignore";
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"vboxusers"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1 vboxdrv";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,120 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
config.virtualisation.virtualbox.host.package
|
||||
curl
|
||||
gawk
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
|
||||
secretsList = [
|
||||
"secret"
|
||||
"otp"
|
||||
"db"
|
||||
"jws"
|
||||
];
|
||||
|
||||
secretsPaths = {
|
||||
secret = "/var/lib/secret";
|
||||
otp = "/var/lib/otp";
|
||||
db = "/var/lib/db";
|
||||
jws = "/var/lib/jws";
|
||||
key = "/var/lib/registry-key";
|
||||
cert = "/var/lib/registry-cert";
|
||||
};
|
||||
|
||||
registryPort = 8001;
|
||||
in {
|
||||
age.secrets = {
|
||||
gitlab-secret.file = ../../secrets/gitlab/secret.age;
|
||||
gitlab-otp.file = ../../secrets/gitlab/otp.age;
|
||||
gitlab-db.file = ../../secrets/gitlab/db.age;
|
||||
gitlab-jws.file = ../../secrets/gitlab/jws.age;
|
||||
gitlab-key.file = ../../secrets/gitlab/key.age;
|
||||
gitlab-cert.file = ../../secrets/gitlab/cert.age;
|
||||
};
|
||||
|
||||
containers.gitlab = {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/var/gitlab/state" = {
|
||||
hostPath = "/var/lib/gitlab";
|
||||
};
|
||||
"${secretsPaths.secret}".hostPath = config.age.secrets.gitlab-secret.path;
|
||||
"${secretsPaths.otp}".hostPath = config.age.secrets.gitlab-otp.path;
|
||||
"${secretsPaths.db}".hostPath = config.age.secrets.gitlab-db.path;
|
||||
"${secretsPaths.jws}".hostPath = config.age.secrets.gitlab-jws.path;
|
||||
"${secretsPaths.key}".hostPath = config.age.secrets.gitlab-key.path;
|
||||
"${secretsPaths.cert}".hostPath = config.age.secrets.gitlab-cert.path;
|
||||
};
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.200.1";
|
||||
localAddress = "192.168.20..2";
|
||||
config = { config, pkgs, ... }: {
|
||||
services = {
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "10.42.1.6"; # Just for now...
|
||||
https = false;
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = secretsPaths.cert;
|
||||
keyFile = secretsPaths.key;
|
||||
externalPort = registryPort;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = secretsPaths.secret;
|
||||
otpFile = secretsPaths.otp;
|
||||
dbFile = secretsPaths.db;
|
||||
jwsFile = secretsPaths.jws;
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [ {
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
logfile = "/var/log/redis-gitlab.log";
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,51 +1,51 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/myvol" =
|
||||
{ device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
fileSystems."/myvol" =
|
||||
{ device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,207 +0,0 @@
|
||||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
|
||||
, cfg ? config.services.github-runner
|
||||
, svcName
|
||||
|
||||
, systemdDir ? "${svcName}/${cfg.name}"
|
||||
# %t: Runtime directory root (usually /run); see systemd.unit(5)
|
||||
, runtimeDir ? "%t/${systemdDir}"
|
||||
# %S: State directory root (usually /var/lib); see systemd.unit(5)
|
||||
, stateDir ? "%S/${systemdDir}"
|
||||
# %L: Log directory root (usually /var/log); see systemd.unit(5)
|
||||
, logsDir ? "%L/${systemdDir}"
|
||||
# Name of file stored in service state directory
|
||||
, currentConfigTokenFilename ? ".current-token"
|
||||
|
||||
, ...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
|
||||
package = cfg.package.override { inherit (cfg) nodeRuntimes; };
|
||||
in
|
||||
{
|
||||
description = "GitHub Actions runner";
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
|
||||
environment = {
|
||||
HOME = workDir;
|
||||
RUNNER_ROOT = stateDir;
|
||||
} // cfg.extraEnvironment;
|
||||
|
||||
path = (with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
gnutar
|
||||
gzip
|
||||
]) ++ [
|
||||
config.nix.package
|
||||
] ++ cfg.extraPackages;
|
||||
|
||||
serviceConfig = mkMerge [
|
||||
{
|
||||
ExecStart = "${package}/bin/Runner.Listener run --startuptype service";
|
||||
|
||||
# Does the following, sequentially:
|
||||
# - If the module configuration or the token has changed, purge the state directory,
|
||||
# and create the current and the new token file with the contents of the configured
|
||||
# token. While both files have the same content, only the later is accessible by
|
||||
# the service user.
|
||||
# - Configure the runner using the new token file. When finished, delete it.
|
||||
# - Set up the directory structure by creating the necessary symlinks.
|
||||
ExecStartPre =
|
||||
let
|
||||
# Wrapper script which expects the full path of the state, working and logs
|
||||
# directory as arguments. Overrides the respective systemd variables to provide
|
||||
# unambiguous directory names. This becomes relevant, for example, if the
|
||||
# caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
|
||||
# to contain more than one directory. This causes systemd to set the respective
|
||||
# environment variables with the path of all of the given directories, separated
|
||||
# by a colon.
|
||||
writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" ''
|
||||
set -euo pipefail
|
||||
|
||||
STATE_DIRECTORY="$1"
|
||||
WORK_DIRECTORY="$2"
|
||||
LOGS_DIRECTORY="$3"
|
||||
|
||||
${lines}
|
||||
'';
|
||||
runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg;
|
||||
newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
|
||||
currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
|
||||
newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
|
||||
currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
|
||||
|
||||
runnerCredFiles = [
|
||||
".credentials"
|
||||
".credentials_rsaparams"
|
||||
".runner"
|
||||
];
|
||||
unconfigureRunner = writeScript "unconfigure" ''
|
||||
copy_tokens() {
|
||||
# Copy the configured token file to the state dir and allow the service user to read the file
|
||||
install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
|
||||
# Also copy current file to allow for a diff on the next start
|
||||
install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
|
||||
}
|
||||
clean_state() {
|
||||
find "$STATE_DIRECTORY/" -mindepth 1 -delete
|
||||
copy_tokens
|
||||
}
|
||||
diff_config() {
|
||||
changed=0
|
||||
# Check for module config changes
|
||||
[[ -f "${currentConfigPath}" ]] \
|
||||
&& ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
|
||||
|| changed=1
|
||||
# Also check the content of the token file
|
||||
[[ -f "${currentConfigTokenPath}" ]] \
|
||||
&& ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
|
||||
|| changed=1
|
||||
# If the config has changed, remove old state and copy tokens
|
||||
if [[ "$changed" -eq 1 ]]; then
|
||||
echo "Config has changed, removing old runner state."
|
||||
echo "The old runner will still appear in the GitHub Actions UI." \
|
||||
"You have to remove it manually."
|
||||
clean_state
|
||||
fi
|
||||
}
|
||||
if [[ "${optionalString cfg.ephemeral "1"}" ]]; then
|
||||
# In ephemeral mode, we always want to start with a clean state
|
||||
clean_state
|
||||
elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
|
||||
# There are state files from a previous run; diff them to decide if we need a new registration
|
||||
diff_config
|
||||
else
|
||||
# The state directory is entirely empty which indicates a first start
|
||||
copy_tokens
|
||||
fi
|
||||
# Always clean workDir
|
||||
find -H "$WORK_DIRECTORY" -mindepth 1 -delete
|
||||
'';
|
||||
configureRunner = writeScript "configure" ''
|
||||
if [[ -e "${newConfigTokenPath}" ]]; then
|
||||
echo "Configuring GitHub Actions Runner"
|
||||
args=(
|
||||
--unattended
|
||||
--disableupdate
|
||||
--work "$WORK_DIRECTORY"
|
||||
--url ${escapeShellArg cfg.url}
|
||||
--labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)}
|
||||
--name ${escapeShellArg cfg.name}
|
||||
${optionalString cfg.replace "--replace"}
|
||||
${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
|
||||
${optionalString cfg.ephemeral "--ephemeral"}
|
||||
)
|
||||
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
|
||||
# if it is not a PAT, we assume it contains a registration token and use the --token option
|
||||
token=$(<"${newConfigTokenPath}")
|
||||
if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
|
||||
args+=(--pat "$token")
|
||||
else
|
||||
args+=(--token "$token")
|
||||
fi
|
||||
${package}/bin/Runner.Listener configure "''${args[@]}"
|
||||
# Move the automatically created _diag dir to the logs dir
|
||||
mkdir -p "$STATE_DIRECTORY/_diag"
|
||||
cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
|
||||
rm -rf "$STATE_DIRECTORY/_diag/"
|
||||
# Cleanup token from config
|
||||
rm "${newConfigTokenPath}"
|
||||
# Symlink to new config
|
||||
ln -s '${newConfigPath}' "${currentConfigPath}"
|
||||
fi
|
||||
'';
|
||||
setupWorkDir = writeScript "setup-work-dirs" ''
|
||||
# Link _diag dir
|
||||
ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag"
|
||||
|
||||
# Link the runner credentials to the work dir
|
||||
ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/"
|
||||
'';
|
||||
in
|
||||
map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [
|
||||
"+${unconfigureRunner}" # runs as root
|
||||
configureRunner
|
||||
setupWorkDir
|
||||
];
|
||||
|
||||
# If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
|
||||
# to trigger a fresh registration.
|
||||
Restart = if cfg.ephemeral then "on-success" else "no";
|
||||
# If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service:
|
||||
# https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146
|
||||
RestartForceExitStatus = [ 2 ];
|
||||
|
||||
# Contains _diag
|
||||
LogsDirectory = [ systemdDir ];
|
||||
# Default RUNNER_ROOT which contains ephemeral Runner data
|
||||
RuntimeDirectory = [ systemdDir ];
|
||||
# Home of persistent runner data, e.g., credentials
|
||||
StateDirectory = [ systemdDir ];
|
||||
StateDirectoryMode = "0700";
|
||||
WorkingDirectory = workDir;
|
||||
|
||||
InaccessiblePaths = [
|
||||
# Token file path given in the configuration, if visible to the service
|
||||
"-${cfg.tokenFile}"
|
||||
# Token file in the state directory
|
||||
"${stateDir}/${currentConfigTokenFilename}"
|
||||
];
|
||||
|
||||
KillSignal = "SIGINT";
|
||||
}
|
||||
(mkIf (cfg.user != null) { User = cfg.user; })
|
||||
cfg.serviceOverrides
|
||||
];
|
||||
}
|
||||
|
||||
@@ -52,7 +52,6 @@ in rec {
|
||||
pkgs = final.pkgs;
|
||||
};
|
||||
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
|
||||
jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {};
|
||||
libbluray-custom = prev.libbluray.override {
|
||||
withAACS = true;
|
||||
withBDplus = true;
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
buildPythonPackage,
|
||||
fetchFromGitHub,
|
||||
|
||||
flake8,
|
||||
jinja2,
|
||||
pytestCheckHook,
|
||||
setuptools,
|
||||
}:
|
||||
|
||||
buildPythonPackage {
|
||||
pname = "jinja2-cli";
|
||||
version = "0.8.2";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "mattrobenolt";
|
||||
repo = "jinja2-cli";
|
||||
rev = "0.8.2";
|
||||
hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0=";
|
||||
};
|
||||
|
||||
propagatedBuildInputs = [
|
||||
jinja2
|
||||
setuptools
|
||||
];
|
||||
|
||||
checkInputs = [
|
||||
flake8
|
||||
pytestCheckHook
|
||||
];
|
||||
|
||||
meta = with lib; {
|
||||
description = "A CLI interface for Jinja2 templates";
|
||||
homepage = "https://github.com/mattrobenolt/jinja2-cli";
|
||||
license = licenses.bsd2;
|
||||
maintainers = [ lib.maintainers.greg ];
|
||||
};
|
||||
}
|
||||
Binary file not shown.
@@ -0,0 +1,19 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg 5aqdEg4OJNg6Pw10HFpFKoRWZLvaiqsh0UWW2N5ql1Y
|
||||
JfnQad6DgEqvRT7GJpjg+kFjgkz9P/Dc+rE3azeArOs
|
||||
-> ssh-ed25519 YJiRbw R7DVCK0kirWs/OhPg4zUGqLMdO1usfDZNnmY5jndSQM
|
||||
D47/wwjjRuzVSBdd5BG6nL4s1TtAGCBvrdGuwanyV68
|
||||
-> ssh-ed25519 Nl/5yA JkVW7aHVpsqPKY9wPoxS2MNCfmYv20Sk+844sNGjQxM
|
||||
VojCPfa0dUGph/PJjocKVIGC1k9XYLiNfv7CPJyM8BY
|
||||
-> ssh-ed25519 GdLgCQ WULneYbP+M1DrFX5JLVeCtkHycxtFBm9/x+oUXTu7Uk
|
||||
2ez2hdvzXfhOePZsVzrVL+9XanmhyqcK/XkLdV43x68
|
||||
-> ssh-ed25519 tOH/HQ hHa+OtsIBPtYkDChXg2vhWhYdSqruooaWiPbdk9RgVQ
|
||||
Ku6StrR8ZICUQEnXeZZ6gXAQp49tbluPKQIAa3KfuCc
|
||||
-> ssh-ed25519 FpzvfQ DhdgZQSDKgmMmcitO4dHMJAbe+c67tfd8gDScp4Tvgc
|
||||
h8PAX2B9t6VcqG9W1b0Z5moxD1b9P7Qgex6+ousoi3E
|
||||
-> ssh-ed25519 kdPvzQ sSSfEIPPvA99/ziU676wPt9uLrHBIXECTuUmszYcZSk
|
||||
TcssCYpN5wQTPCay8/gOeot1f6FyUK7sEBkhdwPIG3g
|
||||
-> !Zmpi]O-grease KVI iU\+ he'#C
|
||||
2O3D
|
||||
--- Z3aUd7U6jlt1NiGY2oCzZKeD26gsiqB/Ysr+wRp7Y5E
|
||||
Tó*ÅøŠ•#X␍Ý)�¸>D=>¼Gñ|ZO2␍ Í`ëFÁíퟚÈ`€fÌŽZ3+Ýg=$ŠÒ«‘jÆÞ1™ºYÔŒ–ØxÒu…mq¡¸€Æ…á‘ñ
|
||||
@@ -0,0 +1,19 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg kNX5PaaipRVvjzMrXxjhlTSJD550eSGoa5zDbI4zQVc
|
||||
VAWoBCGuVqKgDw7yEi0YkeIlO+YwdxFoEdLVPXO9y0s
|
||||
-> ssh-ed25519 YJiRbw 9r/cKqXdhpXcDL9S8CDRGLD65Y8yopFGiMmWILtbXG4
|
||||
uifiAw7UCRkHc/uvwEnlzc7+2mKuLCYiAMREHzXdWZs
|
||||
-> ssh-ed25519 Nl/5yA eVSbQEyXXYEBBiMenLZ6uEP/NNlB4pW4GYMaww6KJTg
|
||||
8L2cYg6eYSFHAeY1jgk3GPDOYQYHsRcSXZDMxDW0hBQ
|
||||
-> ssh-ed25519 GdLgCQ HDciLBHQg0Nhd8/QVfgY/6aOEfHdWMs2CwWjieKgIBM
|
||||
/U/EP99DxhcMrhIa9ggQJSczTQCpDf2mzDJI0uXUYZo
|
||||
-> ssh-ed25519 tOH/HQ ZHmlo/urIFxi8zShOTUqJRuVpFm9RdNtDi6+Fc79dE0
|
||||
RC+z3vkORLSFETGPoSbaml7kfA5GG/NK1IwNwn2XD0c
|
||||
-> ssh-ed25519 FpzvfQ kQHudI+8AYPU9gWEp5rR5UeBoppKtdNONPgNpAGM0mo
|
||||
025maJUyvy7QQpvv+eW7F0rOBMF3BBrwYHHnvwz67dk
|
||||
-> ssh-ed25519 kdPvzQ lUYVBtzSufAD2XZmIH3J788y9oTunIFSNjKIOjuFCBM
|
||||
bvW8hq+4iFgTpDf0zBIcxWwKMq6xkdKgnjm8q3YYYDk
|
||||
-> NJL_l7-grease y4c :
|
||||
kVPvEEpHy8iy//hr42NPPa1DWxgrk2+iAy3KqTZ4oQ
|
||||
--- /muOWusu9T+JEtIWyMOb78bya/kLZ7AJ9VTNJeZrKLw
|
||||
°a{(ÌF!&†h¼,Ncy™�Šù‡!¨66î-<Á˃÷ê6tqÍi3» Ï*W•å§ÜþtXi¸„“�|Ûrº¡÷þ’Ž?Ô E'4…2�Yý²ðJ
|
||||
Binary file not shown.
@@ -0,0 +1,20 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg LVJSQ+R7PMpUpKdscHK4alpoivahuvF6hISGdY7gujU
|
||||
XsmhzzTlEIWo8trvWg7wL6uI6bnHmc71tS8OIz61Xus
|
||||
-> ssh-ed25519 YJiRbw Nl46Ujkg1RQDQ3jo6MoOWvOuiAce2Vhmk43wDiKC03M
|
||||
Si/YWv3MSpQAwiD+IQWUD8eWPsWwI19ojsi46+ENr7Y
|
||||
-> ssh-ed25519 Nl/5yA XDT/tyZ+W5dT1VkBNQcpYMtebHc/37K0hY6kMrtOzl0
|
||||
ugulqsgQ5Wp9t7nwhbYvdmL/9YAkpiTF0hJSVPiOvEA
|
||||
-> ssh-ed25519 GdLgCQ hlBfw0CRRL+d7g5Xxp9zjOVGkO5wy8PAA7ukMCAb5Vg
|
||||
MDrDCysJ3LJ7o0y/bXkxnx41Bq6Wr0EYEpqeBkbtbPc
|
||||
-> ssh-ed25519 tOH/HQ 8QGmTG8sbWch2xOFqf9SfLiMY8hLmwIfWMOuHUg+AE4
|
||||
3cMeP+NMohzZ8ecMqKEvOo3vta+m1aUtQPBg+jCjyQs
|
||||
-> ssh-ed25519 FpzvfQ cCNXN61RMnEqcGw199t2xZHug3qVrdtaSkbnqO4Onx8
|
||||
MfJHCpsMULqxj2/NSJob24uhFZR0ZhbIh1Arncs9bPw
|
||||
-> ssh-ed25519 kdPvzQ SDan5OS6ZlZ6+btBx/nDwrPt1kAucMDVZZNlYnAFYA4
|
||||
cW6PL2fA8xazBvEe7SjW14o8R4djmCDmtuU8Z1+AEGw
|
||||
-> }d^<e64I-grease s r}M!k%M >
|
||||
l78JedCUzpJH0PazQTE3FhpXmW39G5W78avwFQ
|
||||
--- OvRr3P4ypXczMWZTi7HrsbPEz17jPYAS/k+XScuzEJM
|
||||
v)ÒWÅHr/�®¬‡w ¨%•
|
||||
œ3+÷rŽˆðÇ«K/³ï¿�ñ*^{:2dbùâXÎCdÿè¢ aQ(£ +äÎ7™"|LÓ4é3ðE=¥»ˆò?tß�
|
||||
Binary file not shown.
+16
-3
@@ -1,7 +1,8 @@
|
||||
let
|
||||
linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q";
|
||||
jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude";
|
||||
systems = [ linode jude ];
|
||||
myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf";
|
||||
systems = [ linode jude myself ];
|
||||
|
||||
|
||||
user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102";
|
||||
@@ -9,15 +10,17 @@ let
|
||||
user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm";
|
||||
|
||||
user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
|
||||
user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
|
||||
user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude";
|
||||
user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode";
|
||||
user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
|
||||
user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself";
|
||||
|
||||
users = [
|
||||
user_genesis_virt
|
||||
user_ivr
|
||||
user_jude
|
||||
user_linode
|
||||
user_ivr
|
||||
user_myself
|
||||
];
|
||||
|
||||
everyone = systems ++ users;
|
||||
@@ -36,4 +39,14 @@ in
|
||||
|
||||
"linode-forgejo-runner.age".publicKeys = everyone;
|
||||
"jude-forgejo-runner.age".publicKeys = everyone;
|
||||
|
||||
|
||||
"gitlab/secret.age".publicKeys = everyone;
|
||||
"gitlab/otp.age".publicKeys = everyone;
|
||||
"gitlab/db.age".publicKeys = everyone;
|
||||
"gitlab/jws.age".publicKeys = everyone;
|
||||
# openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer'
|
||||
# Then pipe the resulting files to agenix -e <foo>
|
||||
"gitlab/key.age".publicKeys = everyone;
|
||||
"gitlab/cert.age".publicKeys = everyone;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user