From 931c52263285999798405be8a310d73e74df392c Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 16:28:47 -0600 Subject: [PATCH 1/4] Remove lappy host --- home/hosts/lappy/default.nix | 5 ---- hosts/lappy/default.nix | 15 ---------- hosts/lappy/hardware-configuration.nix | 39 -------------------------- 3 files changed, 59 deletions(-) delete mode 100644 home/hosts/lappy/default.nix delete mode 100644 hosts/lappy/default.nix delete mode 100644 hosts/lappy/hardware-configuration.nix diff --git a/home/hosts/lappy/default.nix b/home/hosts/lappy/default.nix deleted file mode 100644 index d8147ea..0000000 --- a/home/hosts/lappy/default.nix +++ /dev/null @@ -1,5 +0,0 @@ -{ ... }: - -{ - -} diff --git a/hosts/lappy/default.nix b/hosts/lappy/default.nix deleted file mode 100644 index fb9dd7e..0000000 --- a/hosts/lappy/default.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ ... }: - -{ - imports = [ - ./hardware-configuration.nix - ]; - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - boot.loader.efi.efiSysMountPoint = "/boot/efi"; - # Graphics, please - greg.gnome.enable = true; - # Set host name - networking.hostName = "lappy"; -} diff --git a/hosts/lappy/hardware-configuration.nix b/hosts/lappy/hardware-configuration.nix deleted file mode 100644 index 19de254..0000000 --- a/hosts/lappy/hardware-configuration.nix +++ /dev/null @@ -1,39 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/63bcc80e-0501-4aef-bb58-30bb83881055"; - fsType = "ext4"; - }; - - fileSystems."/boot/efi" = - { device = "/dev/disk/by-uuid/C617-B2B1"; - fsType = "vfat"; - }; - - swapDevices = - [ { device = "/dev/disk/by-uuid/bc4f24a3-5969-4bcb-95f4-f80109e36ebb"; } - ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp7s0.useDHCP = lib.mkDefault true; - # networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true; - - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} From 35de7160ca0b72a2e9754e4bb7de21c31b96cd6c Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 16:30:16 -0600 Subject: [PATCH 2/4] Remove jinja2-cli which is upstream --- overlays/default.nix | 1 - overlays/jinja2-cli.nix | 39 --------------------------------------- 2 files changed, 40 deletions(-) delete mode 100644 overlays/jinja2-cli.nix diff --git a/overlays/default.nix b/overlays/default.nix index e63fb1d..ec7a7a0 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -52,7 +52,6 @@ in rec { pkgs = final.pkgs; }; inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; - jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {}; libbluray-custom = prev.libbluray.override { withAACS = true; withBDplus = true; diff --git a/overlays/jinja2-cli.nix b/overlays/jinja2-cli.nix deleted file mode 100644 index 4cca67b..0000000 --- a/overlays/jinja2-cli.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - - flake8, - jinja2, - pytestCheckHook, - setuptools, -}: - -buildPythonPackage { - pname = "jinja2-cli"; - version = "0.8.2"; - - src = fetchFromGitHub { - owner = "mattrobenolt"; - repo = "jinja2-cli"; - rev = "0.8.2"; - hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0="; - }; - - propagatedBuildInputs = [ - jinja2 - setuptools - ]; - - checkInputs = [ - flake8 - pytestCheckHook - ]; - - meta = with lib; { - description = "A CLI interface for Jinja2 templates"; - homepage = "https://github.com/mattrobenolt/jinja2-cli"; - license = licenses.bsd2; - maintainers = [ lib.maintainers.greg ]; - }; -} From 98f1740f970c8c2f0f9bf6bb0d880ed5a25a1731 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 16:32:24 -0600 Subject: [PATCH 3/4] Convert to tabs --- hosts/myself/default.nix | 252 ++++++++--------- hosts/myself/hardware-configuration.nix | 76 +++--- hosts/myself/runner.nix | 342 ++++++++++++------------ 3 files changed, 335 insertions(+), 335 deletions(-) diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index f7b5ea6..a0920c7 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,131 +1,131 @@ { config, pkgs, lib, ... }: { - imports = [ - ./hardware-configuration.nix - ]; + imports = [ + ./hardware-configuration.nix + ]; - environment.systemPackages = with pkgs; [ - git - (python3.withPackages (p: with p; [ pip virtualenv ])) - tmux - tree - vim - xonsh - ]; - services = { - openssh.enable = true; - }; - systemd.services = let - def = id: { - enable = true; - ephemeral = false; - extraEnvironment = { - HTTP_PORT_MIN = builtins.toString (8000 + id); - HTTP_PORT_MAX = builtins.toString (8000 + id); - }; - extraLabels = [ "nixos" "isaiah" ]; - extraPackages = with pkgs; [ - config.virtualisation.virtualbox.host.package - curl - gawk - packer - pup - (python3.withPackages (p: with p; [ pip virtualenv ])) - qemu_full - qemu_kvm - xonsh - xorriso - ]; - name = "isaiah-nix-${builtins.toString id}"; - nodeRuntimes = [ "node20" ]; - package = pkgs.github-runner; - replace = true; - runnerGroup = null; - serviceOverrides = { - Group = "vboxusers"; - }; - tokenFile = "/etc/github_token"; - user = "runner"; - url = "https://github.com/greg-hellings/vms"; - workDir = "/home/runner/${builtins.toString id}"; - }; - runner = (import ./runner.nix); - in { - gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); - gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); - gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; }); - gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; }); - gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; }); - }; - networking = { - hostName = "myself"; - useDHCP = false; - defaultGateway = { - address = " 10.42.1.1"; - interface = "enp38s0"; - }; - interfaces.enp38s0 = { - ipv4.addresses = [ { - address = "10.42.1.6"; - prefixLength = 16; - } ]; - }; - nameservers = [ - "10.42.1.5" - ]; - }; - virtualisation = { - libvirtd = { - enable = false; - onBoot = "ignore"; - }; - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; - }; - users = { - users = { - runner = { - extraGroups = [ - "kvm" - "vboxusers" - ]; - group = "runner"; - isNormalUser = true; - }; - greg = { - extraGroups = [ - "kvm" - "sudo" - "vboxusers" - "wheel" - ]; - isNormalUser = true; - }; - }; - groups.runner = {}; - }; - system.stateVersion = lib.mkForce "24.05"; - boot = { - extraModprobeConfig = "options kvm_amd nested=1 vboxdrv"; - supportedFilesystems = [ "ntfs" ]; - loader = { - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot"; - }; - systemd-boot = { - enable = true; - configurationLimit = 10; - }; - }; - }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "nodejs-16.20.2" - ]; - }; + environment.systemPackages = with pkgs; [ + git + (python3.withPackages (p: with p; [ pip virtualenv ])) + tmux + tree + vim + xonsh + ]; + services = { + openssh.enable = true; + }; + systemd.services = let + def = id: { + enable = true; + ephemeral = false; + extraEnvironment = { + HTTP_PORT_MIN = builtins.toString (8000 + id); + HTTP_PORT_MAX = builtins.toString (8000 + id); + }; + extraLabels = [ "nixos" "isaiah" ]; + extraPackages = with pkgs; [ + config.virtualisation.virtualbox.host.package + curl + gawk + packer + pup + (python3.withPackages (p: with p; [ pip virtualenv ])) + qemu_full + qemu_kvm + xonsh + xorriso + ]; + name = "isaiah-nix-${builtins.toString id}"; + nodeRuntimes = [ "node20" ]; + package = pkgs.github-runner; + replace = true; + runnerGroup = null; + serviceOverrides = { + Group = "vboxusers"; + }; + tokenFile = "/etc/github_token"; + user = "runner"; + url = "https://github.com/greg-hellings/vms"; + workDir = "/home/runner/${builtins.toString id}"; + }; + runner = (import ./runner.nix); + in { + gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); + gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); + gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; }); + gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; }); + gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; }); + }; + networking = { + hostName = "myself"; + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp38s0"; + }; + interfaces.enp38s0 = { + ipv4.addresses = [ { + address = "10.42.1.6"; + prefixLength = 16; + } ]; + }; + nameservers = [ + "10.42.1.5" + ]; + }; + virtualisation = { + libvirtd = { + enable = false; + onBoot = "ignore"; + }; + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; + users = { + users = { + runner = { + extraGroups = [ + "kvm" + "vboxusers" + ]; + group = "runner"; + isNormalUser = true; + }; + greg = { + extraGroups = [ + "kvm" + "sudo" + "vboxusers" + "wheel" + ]; + isNormalUser = true; + }; + }; + groups.runner = {}; + }; + system.stateVersion = lib.mkForce "24.05"; + boot = { + extraModprobeConfig = "options kvm_amd nested=1 vboxdrv"; + supportedFilesystems = [ "ntfs" ]; + loader = { + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + systemd-boot = { + enable = true; + configurationLimit = 10; + }; + }; + }; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "nodejs-16.20.2" + ]; + }; } diff --git a/hosts/myself/hardware-configuration.nix b/hosts/myself/hardware-configuration.nix index 7a0d889..7d20b31 100644 --- a/hosts/myself/hardware-configuration.nix +++ b/hosts/myself/hardware-configuration.nix @@ -1,51 +1,51 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. { config, lib, pkgs, modulesPath, ... }: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=nixos" ]; - }; + fileSystems."/" = + { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=nixos" ]; + }; - fileSystems."/home" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=home" ]; - }; + fileSystems."/home" = + { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=home" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/29E7-E20C"; - fsType = "vfat"; - }; + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/29E7-E20C"; + fsType = "vfat"; + }; - fileSystems."/myvol" = - { device = "/dev/nvme0n1p1"; - fsType = "btrfs"; - }; + fileSystems."/myvol" = + { device = "/dev/nvme0n1p1"; + fsType = "btrfs"; + }; - swapDevices = [ ]; + swapDevices = [ ]; - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/myself/runner.nix b/hosts/myself/runner.nix index 8578100..fd9b129 100644 --- a/hosts/myself/runner.nix +++ b/hosts/myself/runner.nix @@ -6,13 +6,13 @@ , svcName , systemdDir ? "${svcName}/${cfg.name}" - # %t: Runtime directory root (usually /run); see systemd.unit(5) + # %t: Runtime directory root (usually /run); see systemd.unit(5) , runtimeDir ? "%t/${systemdDir}" - # %S: State directory root (usually /var/lib); see systemd.unit(5) + # %S: State directory root (usually /var/lib); see systemd.unit(5) , stateDir ? "%S/${systemdDir}" - # %L: Log directory root (usually /var/log); see systemd.unit(5) + # %L: Log directory root (usually /var/log); see systemd.unit(5) , logsDir ? "%L/${systemdDir}" - # Name of file stored in service state directory + # Name of file stored in service state directory , currentConfigTokenFilename ? ".current-token" , ... @@ -21,187 +21,187 @@ with lib; let - workDir = if cfg.workDir == null then runtimeDir else cfg.workDir; - package = cfg.package.override { inherit (cfg) nodeRuntimes; }; + workDir = if cfg.workDir == null then runtimeDir else cfg.workDir; + package = cfg.package.override { inherit (cfg) nodeRuntimes; }; in { - description = "GitHub Actions runner"; + description = "GitHub Actions runner"; - wantedBy = [ "multi-user.target" ]; - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; - environment = { - HOME = workDir; - RUNNER_ROOT = stateDir; - } // cfg.extraEnvironment; + environment = { + HOME = workDir; + RUNNER_ROOT = stateDir; + } // cfg.extraEnvironment; - path = (with pkgs; [ - bash - coreutils - git - gnutar - gzip - ]) ++ [ - config.nix.package - ] ++ cfg.extraPackages; + path = (with pkgs; [ + bash + coreutils + git + gnutar + gzip + ]) ++ [ + config.nix.package + ] ++ cfg.extraPackages; - serviceConfig = mkMerge [ - { - ExecStart = "${package}/bin/Runner.Listener run --startuptype service"; + serviceConfig = mkMerge [ + { + ExecStart = "${package}/bin/Runner.Listener run --startuptype service"; - # Does the following, sequentially: - # - If the module configuration or the token has changed, purge the state directory, - # and create the current and the new token file with the contents of the configured - # token. While both files have the same content, only the later is accessible by - # the service user. - # - Configure the runner using the new token file. When finished, delete it. - # - Set up the directory structure by creating the necessary symlinks. - ExecStartPre = - let - # Wrapper script which expects the full path of the state, working and logs - # directory as arguments. Overrides the respective systemd variables to provide - # unambiguous directory names. This becomes relevant, for example, if the - # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory= - # to contain more than one directory. This causes systemd to set the respective - # environment variables with the path of all of the given directories, separated - # by a colon. - writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" '' - set -euo pipefail + # Does the following, sequentially: + # - If the module configuration or the token has changed, purge the state directory, + # and create the current and the new token file with the contents of the configured + # token. While both files have the same content, only the later is accessible by + # the service user. + # - Configure the runner using the new token file. When finished, delete it. + # - Set up the directory structure by creating the necessary symlinks. + ExecStartPre = + let + # Wrapper script which expects the full path of the state, working and logs + # directory as arguments. Overrides the respective systemd variables to provide + # unambiguous directory names. This becomes relevant, for example, if the + # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory= + # to contain more than one directory. This causes systemd to set the respective + # environment variables with the path of all of the given directories, separated + # by a colon. + writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" '' + set -euo pipefail - STATE_DIRECTORY="$1" - WORK_DIRECTORY="$2" - LOGS_DIRECTORY="$3" + STATE_DIRECTORY="$1" + WORK_DIRECTORY="$2" + LOGS_DIRECTORY="$3" - ${lines} - ''; - runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg; - newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig); - currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json"; - newConfigTokenPath = "$STATE_DIRECTORY/.new-token"; - currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}"; + ${lines} + ''; + runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg; + newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig); + currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json"; + newConfigTokenPath = "$STATE_DIRECTORY/.new-token"; + currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}"; - runnerCredFiles = [ - ".credentials" - ".credentials_rsaparams" - ".runner" - ]; - unconfigureRunner = writeScript "unconfigure" '' - copy_tokens() { - # Copy the configured token file to the state dir and allow the service user to read the file - install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}" - # Also copy current file to allow for a diff on the next start - install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}" - } - clean_state() { - find "$STATE_DIRECTORY/" -mindepth 1 -delete - copy_tokens - } - diff_config() { - changed=0 - # Check for module config changes - [[ -f "${currentConfigPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \ - || changed=1 - # Also check the content of the token file - [[ -f "${currentConfigTokenPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \ - || changed=1 - # If the config has changed, remove old state and copy tokens - if [[ "$changed" -eq 1 ]]; then - echo "Config has changed, removing old runner state." - echo "The old runner will still appear in the GitHub Actions UI." \ - "You have to remove it manually." - clean_state - fi - } - if [[ "${optionalString cfg.ephemeral "1"}" ]]; then - # In ephemeral mode, we always want to start with a clean state - clean_state - elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then - # There are state files from a previous run; diff them to decide if we need a new registration - diff_config - else - # The state directory is entirely empty which indicates a first start - copy_tokens - fi - # Always clean workDir - find -H "$WORK_DIRECTORY" -mindepth 1 -delete - ''; - configureRunner = writeScript "configure" '' - if [[ -e "${newConfigTokenPath}" ]]; then - echo "Configuring GitHub Actions Runner" - args=( - --unattended - --disableupdate - --work "$WORK_DIRECTORY" - --url ${escapeShellArg cfg.url} - --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} - --name ${escapeShellArg cfg.name} - ${optionalString cfg.replace "--replace"} - ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"} - ${optionalString cfg.ephemeral "--ephemeral"} - ) - # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option, - # if it is not a PAT, we assume it contains a registration token and use the --token option - token=$(<"${newConfigTokenPath}") - if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then - args+=(--pat "$token") - else - args+=(--token "$token") - fi - ${package}/bin/Runner.Listener configure "''${args[@]}" - # Move the automatically created _diag dir to the logs dir - mkdir -p "$STATE_DIRECTORY/_diag" - cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/" - rm -rf "$STATE_DIRECTORY/_diag/" - # Cleanup token from config - rm "${newConfigTokenPath}" - # Symlink to new config - ln -s '${newConfigPath}' "${currentConfigPath}" - fi - ''; - setupWorkDir = writeScript "setup-work-dirs" '' - # Link _diag dir - ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag" + runnerCredFiles = [ + ".credentials" + ".credentials_rsaparams" + ".runner" + ]; + unconfigureRunner = writeScript "unconfigure" '' + copy_tokens() { + # Copy the configured token file to the state dir and allow the service user to read the file + install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}" + # Also copy current file to allow for a diff on the next start + install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}" + } + clean_state() { + find "$STATE_DIRECTORY/" -mindepth 1 -delete + copy_tokens + } + diff_config() { + changed=0 + # Check for module config changes + [[ -f "${currentConfigPath}" ]] \ + && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \ + || changed=1 + # Also check the content of the token file + [[ -f "${currentConfigTokenPath}" ]] \ + && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \ + || changed=1 + # If the config has changed, remove old state and copy tokens + if [[ "$changed" -eq 1 ]]; then + echo "Config has changed, removing old runner state." + echo "The old runner will still appear in the GitHub Actions UI." \ + "You have to remove it manually." + clean_state + fi + } + if [[ "${optionalString cfg.ephemeral "1"}" ]]; then + # In ephemeral mode, we always want to start with a clean state + clean_state + elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then + # There are state files from a previous run; diff them to decide if we need a new registration + diff_config + else + # The state directory is entirely empty which indicates a first start + copy_tokens + fi + # Always clean workDir + find -H "$WORK_DIRECTORY" -mindepth 1 -delete + ''; + configureRunner = writeScript "configure" '' + if [[ -e "${newConfigTokenPath}" ]]; then + echo "Configuring GitHub Actions Runner" + args=( + --unattended + --disableupdate + --work "$WORK_DIRECTORY" + --url ${escapeShellArg cfg.url} + --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} + --name ${escapeShellArg cfg.name} + ${optionalString cfg.replace "--replace"} + ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"} + ${optionalString cfg.ephemeral "--ephemeral"} + ) + # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option, + # if it is not a PAT, we assume it contains a registration token and use the --token option + token=$(<"${newConfigTokenPath}") + if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then + args+=(--pat "$token") + else + args+=(--token "$token") + fi + ${package}/bin/Runner.Listener configure "''${args[@]}" + # Move the automatically created _diag dir to the logs dir + mkdir -p "$STATE_DIRECTORY/_diag" + cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/" + rm -rf "$STATE_DIRECTORY/_diag/" + # Cleanup token from config + rm "${newConfigTokenPath}" + # Symlink to new config + ln -s '${newConfigPath}' "${currentConfigPath}" + fi + ''; + setupWorkDir = writeScript "setup-work-dirs" '' + # Link _diag dir + ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag" - # Link the runner credentials to the work dir - ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/" - ''; - in - map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [ - "+${unconfigureRunner}" # runs as root - configureRunner - setupWorkDir - ]; + # Link the runner credentials to the work dir + ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/" + ''; + in + map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [ + "+${unconfigureRunner}" # runs as root + configureRunner + setupWorkDir + ]; - # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner) - # to trigger a fresh registration. - Restart = if cfg.ephemeral then "on-success" else "no"; - # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service: - # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146 - RestartForceExitStatus = [ 2 ]; + # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner) + # to trigger a fresh registration. + Restart = if cfg.ephemeral then "on-success" else "no"; + # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service: + # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146 + RestartForceExitStatus = [ 2 ]; - # Contains _diag - LogsDirectory = [ systemdDir ]; - # Default RUNNER_ROOT which contains ephemeral Runner data - RuntimeDirectory = [ systemdDir ]; - # Home of persistent runner data, e.g., credentials - StateDirectory = [ systemdDir ]; - StateDirectoryMode = "0700"; - WorkingDirectory = workDir; + # Contains _diag + LogsDirectory = [ systemdDir ]; + # Default RUNNER_ROOT which contains ephemeral Runner data + RuntimeDirectory = [ systemdDir ]; + # Home of persistent runner data, e.g., credentials + StateDirectory = [ systemdDir ]; + StateDirectoryMode = "0700"; + WorkingDirectory = workDir; - InaccessiblePaths = [ - # Token file path given in the configuration, if visible to the service - "-${cfg.tokenFile}" - # Token file in the state directory - "${stateDir}/${currentConfigTokenFilename}" - ]; + InaccessiblePaths = [ + # Token file path given in the configuration, if visible to the service + "-${cfg.tokenFile}" + # Token file in the state directory + "${stateDir}/${currentConfigTokenFilename}" + ]; - KillSignal = "SIGINT"; - } - (mkIf (cfg.user != null) { User = cfg.user; }) - cfg.serviceOverrides - ]; + KillSignal = "SIGINT"; + } + (mkIf (cfg.user != null) { User = cfg.user; }) + cfg.serviceOverrides + ]; } From 65c35ae78020f897106c16801985bef9487ec858 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 20:44:53 -0600 Subject: [PATCH 4/4] Add myself --- hosts/myself/default.nix | 25 +---- hosts/myself/git.nix | 120 ++++++++++++++++++++++ hosts/myself/runner.nix | 207 -------------------------------------- secrets/gitlab/cert.age | Bin 0 -> 2816 bytes secrets/gitlab/db.age | 19 ++++ secrets/gitlab/jws.age | 19 ++++ secrets/gitlab/key.age | Bin 0 -> 4280 bytes secrets/gitlab/otp.age | 20 ++++ secrets/gitlab/secret.age | Bin 0 -> 998 bytes secrets/secrets.nix | 19 +++- 10 files changed, 196 insertions(+), 233 deletions(-) create mode 100644 hosts/myself/git.nix delete mode 100644 hosts/myself/runner.nix create mode 100644 secrets/gitlab/cert.age create mode 100644 secrets/gitlab/db.age create mode 100644 secrets/gitlab/jws.age create mode 100644 secrets/gitlab/key.age create mode 100644 secrets/gitlab/otp.age create mode 100644 secrets/gitlab/secret.age diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index a0920c7..b214b5f 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,8 +1,8 @@ { config, pkgs, lib, ... }: - { imports = [ ./hardware-configuration.nix + ./git.nix ]; environment.systemPackages = with pkgs; [ @@ -25,18 +25,6 @@ HTTP_PORT_MAX = builtins.toString (8000 + id); }; extraLabels = [ "nixos" "isaiah" ]; - extraPackages = with pkgs; [ - config.virtualisation.virtualbox.host.package - curl - gawk - packer - pup - (python3.withPackages (p: with p; [ pip virtualenv ])) - qemu_full - qemu_kvm - xonsh - xorriso - ]; name = "isaiah-nix-${builtins.toString id}"; nodeRuntimes = [ "node20" ]; package = pkgs.github-runner; @@ -50,7 +38,7 @@ url = "https://github.com/greg-hellings/vms"; workDir = "/home/runner/${builtins.toString id}"; }; - runner = (import ./runner.nix); + runner = a: {}; in { gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); @@ -87,14 +75,6 @@ }; users = { users = { - runner = { - extraGroups = [ - "kvm" - "vboxusers" - ]; - group = "runner"; - isNormalUser = true; - }; greg = { extraGroups = [ "kvm" @@ -105,7 +85,6 @@ isNormalUser = true; }; }; - groups.runner = {}; }; system.stateVersion = lib.mkForce "24.05"; boot = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix new file mode 100644 index 0000000..802423a --- /dev/null +++ b/hosts/myself/git.nix @@ -0,0 +1,120 @@ +{ config, pkgs, lib, ... }: + +let + extraPackages = with pkgs; [ + config.virtualisation.virtualbox.host.package + curl + gawk + packer + pup + (python3.withPackages (p: with p; [ pip virtualenv ])) + qemu_full + qemu_kvm + xonsh + xorriso + ]; + + secretsList = [ + "secret" + "otp" + "db" + "jws" + ]; + + secretsPaths = { + secret = "/var/lib/secret"; + otp = "/var/lib/otp"; + db = "/var/lib/db"; + jws = "/var/lib/jws"; + key = "/var/lib/registry-key"; + cert = "/var/lib/registry-cert"; + }; + + registryPort = 8001; +in { + age.secrets = { + gitlab-secret.file = ../../secrets/gitlab/secret.age; + gitlab-otp.file = ../../secrets/gitlab/otp.age; + gitlab-db.file = ../../secrets/gitlab/db.age; + gitlab-jws.file = ../../secrets/gitlab/jws.age; + gitlab-key.file = ../../secrets/gitlab/key.age; + gitlab-cert.file = ../../secrets/gitlab/cert.age; + }; + + containers.gitlab = { + autoStart = true; + bindMounts = { + "/var/gitlab/state" = { + hostPath = "/var/lib/gitlab"; + }; + "${secretsPaths.secret}".hostPath = config.age.secrets.gitlab-secret.path; + "${secretsPaths.otp}".hostPath = config.age.secrets.gitlab-otp.path; + "${secretsPaths.db}".hostPath = config.age.secrets.gitlab-db.path; + "${secretsPaths.jws}".hostPath = config.age.secrets.gitlab-jws.path; + "${secretsPaths.key}".hostPath = config.age.secrets.gitlab-key.path; + "${secretsPaths.cert}".hostPath = config.age.secrets.gitlab-cert.path; + }; + privateNetwork = true; + hostAddress = "192.168.200.1"; + localAddress = "192.168.20..2"; + config = { config, pkgs, ... }: { + services = { + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "10.42.1.6"; # Just for now... + https = false; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = secretsPaths.cert; + keyFile = secretsPaths.key; + externalPort = registryPort; + }; + secrets = { + secretFile = secretsPaths.secret; + otpFile = secretsPaths.otp; + dbFile = secretsPaths.db; + jwsFile = secretsPaths.jws; + }; + }; + + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [ { + name = "gitlab"; + ensureDBOwnership = true; + } ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; + + redis.servers.gitlab = { + enable = true; + logfile = "/var/log/redis-gitlab.log"; + }; + }; + system.stateVersion = "24.05"; + }; + }; +} diff --git a/hosts/myself/runner.nix b/hosts/myself/runner.nix deleted file mode 100644 index fd9b129..0000000 --- a/hosts/myself/runner.nix +++ /dev/null @@ -1,207 +0,0 @@ -{ config -, lib -, pkgs - -, cfg ? config.services.github-runner -, svcName - -, systemdDir ? "${svcName}/${cfg.name}" - # %t: Runtime directory root (usually /run); see systemd.unit(5) -, runtimeDir ? "%t/${systemdDir}" - # %S: State directory root (usually /var/lib); see systemd.unit(5) -, stateDir ? "%S/${systemdDir}" - # %L: Log directory root (usually /var/log); see systemd.unit(5) -, logsDir ? "%L/${systemdDir}" - # Name of file stored in service state directory -, currentConfigTokenFilename ? ".current-token" - -, ... -}: - -with lib; - -let - workDir = if cfg.workDir == null then runtimeDir else cfg.workDir; - package = cfg.package.override { inherit (cfg) nodeRuntimes; }; -in -{ - description = "GitHub Actions runner"; - - wantedBy = [ "multi-user.target" ]; - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - - environment = { - HOME = workDir; - RUNNER_ROOT = stateDir; - } // cfg.extraEnvironment; - - path = (with pkgs; [ - bash - coreutils - git - gnutar - gzip - ]) ++ [ - config.nix.package - ] ++ cfg.extraPackages; - - serviceConfig = mkMerge [ - { - ExecStart = "${package}/bin/Runner.Listener run --startuptype service"; - - # Does the following, sequentially: - # - If the module configuration or the token has changed, purge the state directory, - # and create the current and the new token file with the contents of the configured - # token. While both files have the same content, only the later is accessible by - # the service user. - # - Configure the runner using the new token file. When finished, delete it. - # - Set up the directory structure by creating the necessary symlinks. - ExecStartPre = - let - # Wrapper script which expects the full path of the state, working and logs - # directory as arguments. Overrides the respective systemd variables to provide - # unambiguous directory names. This becomes relevant, for example, if the - # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory= - # to contain more than one directory. This causes systemd to set the respective - # environment variables with the path of all of the given directories, separated - # by a colon. - writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" '' - set -euo pipefail - - STATE_DIRECTORY="$1" - WORK_DIRECTORY="$2" - LOGS_DIRECTORY="$3" - - ${lines} - ''; - runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg; - newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig); - currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json"; - newConfigTokenPath = "$STATE_DIRECTORY/.new-token"; - currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}"; - - runnerCredFiles = [ - ".credentials" - ".credentials_rsaparams" - ".runner" - ]; - unconfigureRunner = writeScript "unconfigure" '' - copy_tokens() { - # Copy the configured token file to the state dir and allow the service user to read the file - install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}" - # Also copy current file to allow for a diff on the next start - install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}" - } - clean_state() { - find "$STATE_DIRECTORY/" -mindepth 1 -delete - copy_tokens - } - diff_config() { - changed=0 - # Check for module config changes - [[ -f "${currentConfigPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \ - || changed=1 - # Also check the content of the token file - [[ -f "${currentConfigTokenPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \ - || changed=1 - # If the config has changed, remove old state and copy tokens - if [[ "$changed" -eq 1 ]]; then - echo "Config has changed, removing old runner state." - echo "The old runner will still appear in the GitHub Actions UI." \ - "You have to remove it manually." - clean_state - fi - } - if [[ "${optionalString cfg.ephemeral "1"}" ]]; then - # In ephemeral mode, we always want to start with a clean state - clean_state - elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then - # There are state files from a previous run; diff them to decide if we need a new registration - diff_config - else - # The state directory is entirely empty which indicates a first start - copy_tokens - fi - # Always clean workDir - find -H "$WORK_DIRECTORY" -mindepth 1 -delete - ''; - configureRunner = writeScript "configure" '' - if [[ -e "${newConfigTokenPath}" ]]; then - echo "Configuring GitHub Actions Runner" - args=( - --unattended - --disableupdate - --work "$WORK_DIRECTORY" - --url ${escapeShellArg cfg.url} - --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} - --name ${escapeShellArg cfg.name} - ${optionalString cfg.replace "--replace"} - ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"} - ${optionalString cfg.ephemeral "--ephemeral"} - ) - # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option, - # if it is not a PAT, we assume it contains a registration token and use the --token option - token=$(<"${newConfigTokenPath}") - if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then - args+=(--pat "$token") - else - args+=(--token "$token") - fi - ${package}/bin/Runner.Listener configure "''${args[@]}" - # Move the automatically created _diag dir to the logs dir - mkdir -p "$STATE_DIRECTORY/_diag" - cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/" - rm -rf "$STATE_DIRECTORY/_diag/" - # Cleanup token from config - rm "${newConfigTokenPath}" - # Symlink to new config - ln -s '${newConfigPath}' "${currentConfigPath}" - fi - ''; - setupWorkDir = writeScript "setup-work-dirs" '' - # Link _diag dir - ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag" - - # Link the runner credentials to the work dir - ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/" - ''; - in - map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [ - "+${unconfigureRunner}" # runs as root - configureRunner - setupWorkDir - ]; - - # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner) - # to trigger a fresh registration. - Restart = if cfg.ephemeral then "on-success" else "no"; - # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service: - # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146 - RestartForceExitStatus = [ 2 ]; - - # Contains _diag - LogsDirectory = [ systemdDir ]; - # Default RUNNER_ROOT which contains ephemeral Runner data - RuntimeDirectory = [ systemdDir ]; - # Home of persistent runner data, e.g., credentials - StateDirectory = [ systemdDir ]; - StateDirectoryMode = "0700"; - WorkingDirectory = workDir; - - InaccessiblePaths = [ - # Token file path given in the configuration, if visible to the service - "-${cfg.tokenFile}" - # Token file in the state directory - "${stateDir}/${currentConfigTokenFilename}" - ]; - - KillSignal = "SIGINT"; - } - (mkIf (cfg.user != null) { User = cfg.user; }) - cfg.serviceOverrides - ]; -} - diff --git a/secrets/gitlab/cert.age b/secrets/gitlab/cert.age new file mode 100644 index 0000000000000000000000000000000000000000..80a6d0f11ad64e49549080233f2cff44b78a6914 GIT binary patch literal 2816 zcmZY6`9IVN1HkbRYN9Q*m0G*n!gd?*AnFt6G*8(IdW8_e>6u<#dfu^rDJ)Hz4F~FK+ zIG3g%qfuNVMocymSjl>+8EZ^7KvmIjJx<183&s2>8lEZAfy{|aoJr3h)4~)%cr=?# zC#!L4LPVf}s#J#SERi^N7*ni7QqUsq*BVi6F$x)ACRHpA3Z$VU{X$_PhCYxTBNszS zfD{@4kc>DciAUk%B@~k|CORCXAd4&n9Y?LupxL1jRE!8u0>nlnJ=DmNTbLp}iXRY& zml4qx-v51*B}W=93~-`Z2IEo5B$~y{;2SV1CW(zvU=(m1EXJ6OKq}<~6&z!NQ)6&Q zP?AWFqAIik07GHJOms343KQwVjAkm6fQZ4fP*Hv|j!qvD%Gb;O*9Pp|1}HW`L|Q?j zP5|DDW`Psqxqw&$1(_qnn4~0hOn4MbrIQB=XcV3qKy!m=ST@qHD3@KO@LB(I)aESNuq&3HiNrZ+KY-1v2(9=hf5p=f$a+ea@+8W(#U@CtkSD&JEbqOj6n3brbi1p7rKH zBSaYu*1( zR=PE<%^6sA=ZNE*y7?dd7EbjGZ>>*!(PAr`a&58+$&gg3&%Y1EWhVUnhAR^vLm#J`XyeG_&FCztz&u9eZ<+_hfyi#~+b?Ud8Z%|f4> zdm2~&oSdduaS66l3f#U347F74_N)lb-ci1__35z9m$T>M%<=T?6+1gT`ZlWqC{;gp z3o!fqSGX39HuU<&k2=TaZF4UYM?I|R+T>k3HlKF-QeQpxPekI9dEkWbo@8P?deNF& z+z4A*SN1)4+5JZfPoTob=T)=+WJt$>+6VcftP)6_cgLY&`N~`UM;WP4ulnzDk{ODH zp~tzkTYPkmv%dFdl{vm5V5mHX(S)}fvN{qsF<^C~@6m^ow9O+vtVUJ-ej%~s zddX+Fi`}T7xDT}_ET!g2|;GfcW^P?Ev}(!_E?ZsHgcq*9)m7Ulb?X( zb$bLiY-2rooI2<*@M(795riuOM3LDwiAchNrtwCM;8|Un!yN0U$Wx!$ z)^HuZ{q3$DjAL3WXF*z)nDY4k*|Oq)j;;GwRrleoaLDSDbLLS|3RHBm^&FnF#^;#4 zsGvG*%S7t0g!Pf^s=UP-wZ!aSd4c+Bq6XXZ`ryL>1NPCykk?*p+dPlq?$XC&@sz!X zQ67wkb`_N2jxOelkxl&%yicM)#Huse(y^Gj)pN09El;mzrpmh7>fB}+l@ZnZOc(!I z5rhv+wht!B3BlVw&?Z;x4CeR{O{(QN?IBhh>l|wQImlk!+VSMj}-!4CY z-E}-R?P$xO4x7|J*t2O3r2{baa4mJSiN&|I&(1&b zIN0fAXa4@BC$`+W%LF>M^Wfa(o$y9ooW+)JB>BY(dZi`P219;;XwhQ|36{EVu>8hb z5VjM;B|dq8DEhu$-N5)bF-6tQBLwWPuQX<++-ai@*A;37Bl}G<()}jXir59A|Z=!MLVPSX6hw zroOyWG5ujl*uVzRy@tIXS{I}e-Q@vTJfy0Syy3ii*&*0TZEo|sO6G<~$jjYr{?-N? zLQmuA%FT6!xeEiYZr;e76kK`>8}{k^^296sR_)?kuEXCe%d3R_#tXsDpIY>Ht8+YF zd%t@T0>XZF?{<*H?k=U*$L{rxXz9$%$mwfe^K#?6K<(NqcSq;1ILxN};5E3H4A1}R zBc8cdwzhp~>*d9t8VJvt9@K5DGN0|=lJsJ=D63}S)4K0C_U_D_zg@ga*3Zpi`F=M8 zYwgkAGb46cYHgmgt!zZGyWr0&iREm`B9ZHnUH@6J0_S){B>&9I2G1;PFODlB-nCs> ze~;D9V&=`1Mtf-_NxjzhyiS*8zCMk~IPYpgq4vsVkg&yY_@!6&Oy;utUMWs-$kGC!m3QKKbG3Zk lIA^2v+e_1+Z-Od*+qf-v`}pcwBj}9%@8Be ssh-ed25519 mOmPfg 5aqdEg4OJNg6Pw10HFpFKoRWZLvaiqsh0UWW2N5ql1Y +JfnQad6DgEqvRT7GJpjg+kFjgkz9P/Dc+rE3azeArOs +-> ssh-ed25519 YJiRbw R7DVCK0kirWs/OhPg4zUGqLMdO1usfDZNnmY5jndSQM +D47/wwjjRuzVSBdd5BG6nL4s1TtAGCBvrdGuwanyV68 +-> ssh-ed25519 Nl/5yA JkVW7aHVpsqPKY9wPoxS2MNCfmYv20Sk+844sNGjQxM +VojCPfa0dUGph/PJjocKVIGC1k9XYLiNfv7CPJyM8BY +-> ssh-ed25519 GdLgCQ WULneYbP+M1DrFX5JLVeCtkHycxtFBm9/x+oUXTu7Uk +2ez2hdvzXfhOePZsVzrVL+9XanmhyqcK/XkLdV43x68 +-> ssh-ed25519 tOH/HQ hHa+OtsIBPtYkDChXg2vhWhYdSqruooaWiPbdk9RgVQ +Ku6StrR8ZICUQEnXeZZ6gXAQp49tbluPKQIAa3KfuCc +-> ssh-ed25519 FpzvfQ DhdgZQSDKgmMmcitO4dHMJAbe+c67tfd8gDScp4Tvgc +h8PAX2B9t6VcqG9W1b0Z5moxD1b9P7Qgex6+ousoi3E +-> ssh-ed25519 kdPvzQ sSSfEIPPvA99/ziU676wPt9uLrHBIXECTuUmszYcZSk +TcssCYpN5wQTPCay8/gOeot1f6FyUK7sEBkhdwPIG3g +-> !Zmpi]O-grease KVI iU\+ he'#C +2O3D +--- Z3aUd7U6jlt1NiGY2oCzZKeD26gsiqB/Ysr+wRp7Y5E +T*#X )>D=>G|ZO2 `Fퟚ`f̎Z3+g=$ҫj1YԌxumqƅ \ No newline at end of file diff --git a/secrets/gitlab/jws.age b/secrets/gitlab/jws.age new file mode 100644 index 0000000..81cef5b --- /dev/null +++ b/secrets/gitlab/jws.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg kNX5PaaipRVvjzMrXxjhlTSJD550eSGoa5zDbI4zQVc +VAWoBCGuVqKgDw7yEi0YkeIlO+YwdxFoEdLVPXO9y0s +-> ssh-ed25519 YJiRbw 9r/cKqXdhpXcDL9S8CDRGLD65Y8yopFGiMmWILtbXG4 +uifiAw7UCRkHc/uvwEnlzc7+2mKuLCYiAMREHzXdWZs +-> ssh-ed25519 Nl/5yA eVSbQEyXXYEBBiMenLZ6uEP/NNlB4pW4GYMaww6KJTg +8L2cYg6eYSFHAeY1jgk3GPDOYQYHsRcSXZDMxDW0hBQ +-> ssh-ed25519 GdLgCQ HDciLBHQg0Nhd8/QVfgY/6aOEfHdWMs2CwWjieKgIBM +/U/EP99DxhcMrhIa9ggQJSczTQCpDf2mzDJI0uXUYZo +-> ssh-ed25519 tOH/HQ ZHmlo/urIFxi8zShOTUqJRuVpFm9RdNtDi6+Fc79dE0 +RC+z3vkORLSFETGPoSbaml7kfA5GG/NK1IwNwn2XD0c +-> ssh-ed25519 FpzvfQ kQHudI+8AYPU9gWEp5rR5UeBoppKtdNONPgNpAGM0mo +025maJUyvy7QQpvv+eW7F0rOBMF3BBrwYHHnvwz67dk +-> ssh-ed25519 kdPvzQ lUYVBtzSufAD2XZmIH3J788y9oTunIFSNjKIOjuFCBM +bvW8hq+4iFgTpDf0zBIcxWwKMq6xkdKgnjm8q3YYYDk +-> NJL_l7-grease y4c : +kVPvEEpHy8iy//hr42NPPa1DWxgrk2+iAy3KqTZ4oQ +--- /muOWusu9T+JEtIWyMOb78bya/kLZ7AJ9VTNJeZrKLw +a{(F!&h,Ncy!66-<˃6tqi3 *WtXi|r?E'42YJ \ No newline at end of file diff --git a/secrets/gitlab/key.age b/secrets/gitlab/key.age new file mode 100644 index 0000000000000000000000000000000000000000..38d0f7e0aec5b3f2a6e656e98e69fcd39feba649 GIT binary patch literal 4280 zcmZY6`#%$kh=RU_pxm(7e#RNKt1W;Po`*lcEFcbm;6xg?bwBDWGHsicT> zk>r}{9F=R7TO!v|N;lQ#e1ARPzu@_Jzh5jK*On^^m8m6Be6h$*EaTZLApqNbK)F2J zmdkN~!5|2r&`U@O;{oAtcPBZNh=2%WETNc5j0*K8D;$t`2P_K>mxH9vRD~4Gic+x| zo&cpil}1%LDOfBItXxczdUIh2DHs6D|=L`V>7Pq>d9^Iwfg;8WSrK!3i! zNF*a8!ih2o8E@|ma^|3-9at(b4h)m3I3${*5)ma1XE-Ax0MP`If=?wnIEz(06)1*; z!6Mvw1f`FdsaEpE6z?z^(L+iD(UfB5e>HNXJxq-RVlWOExysQU>`rmVV8!0Ve~&;) zq#j&8o~(3~%AD13l)#68B}3@|hy)!T2}eW-#dI1&70$*AsG(|ixfm@MgpxTT2AmS+ z7mX4KkUr7>)vz2A5A6-4;K1%6F-HdDaWRqHNJ$JnR1!%;gCs~t7}A?AP{>F~G?W|7 z8o(&38hRj3q#@y#5k^_gRc)Jniu+CEy@dLkMjnC ziE1Vk>?wB^DZOBx{!kDSrG&aOIZ-$jK}>Te5dHpz_)g9d0wlm!On1Tw!Acw-1M>`% zGMwP*@Nl$aj0}gMkP)I#EXbK46%hRqlK@u3kS zWjI&B^`irPoaLT0sH1?yQb5$cR4-7NGY^8MBh+%aH&nzH#UMS@WV)vq#^C**hT)p; zbrMh=ZFw>-OU?y4N5oNpK>`=B9SabOCkiDD0#7FWHzih1CQ==7OfE<*!ocK_>L`&H z+$Rc2jK(YMK`4%bE+-KrP8cFbA@kvJoRsc#0N2BVAI)P3(UDv{-ie~(_{sf*Xeny(Yg|hknNzGV>pfCwDUYv3JfJyNKO5KU`H(637HQ~G z0j2M2(dt`?c3oxv0}{A;*>Jux?a!49JElebKIYeFrs%P&-L@uPU_PAGdZhizm=my3 z{A-ov9?Mt-ZAa6`6-9m{8Wo?vDxw5iaW@~S%(|?(K8!p5@nS>QGu3e(=r!pRkW&k> z?=(r8<$5|cunG^|h{KEmaSmne>#wf$IrVxm2cF4WGxK~UjioNkkOLfpuC3pnGzQ&p zeoFbez|m^n5a*I&S-Jk{%9?{e3*I7hzECXMnw0(M-K;$uwZDv>gCaaQyh{5%oXdH? zDbHQsO_nVk;NkfsRqu*jHlOG0j}O)*m*vDfzEu1o)Ofyx9ghmX6u#OA(UsFH9Z%lD zKl3_~R9aw7T*&{3$}HQk&0tZlc8yDH#>;Kj&#Np-T`SI+9tVpvgUSpT1jbLh;O7Q=#@Y z`>$4P?s#yRnBJIwt@gw0y7E8oulYvIX%C=d+qVz0v~^1G=h-ZsZ{z#i%^MR-0@#;o z5Y*|nv!I@LG3snbC=$HnJtG-gTWEd$oL$`zuRG|>sNGuCNM9lT*q}uSytQ*hx#HD> z9XB^`wVx^oBzC==eqi_cm6mgc-AUMKLtbJZ>eq794a{5$r^l+yXw#dn&DGZ%_M7Vr zHoFoPxvifFv-Z7C7f)vOUW@;^FT+4PNB2c4@x67+*#zb>bXlbXDU|q%c}kd*YWzw6 z^2W|l!a)06ZsviVw-*WY&g&tF65}h;hhRA0#p#hxn|oj3!PYt6@A39#SNF)}4+|9p zKjSxvS>`)-ytz?dcRen|Ul(I_CQ;R33S<<#bkxcK+>&*mE8Wk)Heiy}r0e{+a6 z0*Qcd7?YZHb~9Us)wzEqf4*2=SAzNn$j{6Qx00uB{Kq<-51cp}J6;%)f8hCxbl=2F z2@u4A?8HrllYe2ND(2pG(d$cx(y?#qYu4;_FjwVInSStfW1kzhGuz&Jr#rwPyV~UD zS>;i%e6zQ}Zc`ZL+kv}ov$;pME$+(P^>bdAni@?mcq%?p{!B2zq@Mt+iN~2+6quVY zz7Z5o|Nh(Z`r$gPwmSIitZQoJa0X@kCeXmYLzyWI1YG<0!fVgQ{u}y0jx<^~a0&NT zmHQMsuZ6qxH*{+79pf6p+l_eHvAzAgfAd4x8Hd2~*_|PpasIbw5pMaG6KN}>9wG+o zsh&71l}_AFlZ)?bv-v}Q-CmL7qi8FWFYf|F!?QjBu`kfJL%n~%e{q=1n%VD>Doo#TKR`#6sM~%9IwL=nztv$ABi{-UXjN%lXvIq;wjb`LZhm+S9wfzx#Jt&cf$0jzgcn z#OR86rpW3*pvcu^t*7RVvsQ|u22Xy3%vJO4_xEb2{>c<11l_;z3dElMp)j0i%`g0V z+D?<)-~fWFnmoC>MsvM;!5j4Kn?}Ee%JU?b*<;nOQWl0s}AJNflBkN&0AeEx3GXLIry=i`%Jo83c- zuy@$o-VSx;b`|$QmK0WzLq(IFYb$3b?SopXK-It{vkeaD3@yduD$k-|x1FOAk=v6` zJlXD~pM6wo$3#fcmGfVcP8`NJz>Bt(d|-!{Umt2R^%yhKkMU9~WvdDXYuUP}Ea#4R zdibgft3R{OM@`F?4d=u)rEivp{CMBNuM;f*ixkv9e zcFJU3LHRGf2m}lNtC)H9cTZ?X?f1keQ)bDdEjD@I^jdW9ffsmbn9G~88Kc90v@gtv zZCpL$5+0t;Q{_qU>wb8g6X!1mRDRa_HSIc)xFzp{S?j5Y(#m+DV=6(?=HaZj%9jd( zy6zHKI!+QRvM1}02}>~zDK4z-At3kQ{Gaze$75 znwPuP1JnIUkwurE!K<_)LS~e)B_7G#4e>jX6ORmXeA0Ol_a4bMu`4b6*mu?kmif1& zED4IpPA|VLgNADBzvf;r?vYm-1Q}%tmi=!ZkhzS#d0#kBTooqqH~biLAg?axURWyd zPU68+KWy}Fkqy31l7?B$cf03ar!AgK4|rdCY;om=s@vtiZZAAH)}uc74ljLr9%&+-B4jd_$T+vBh@CC%;c*pYqXhu0G~ z#J83|I+42(6<;_IV&S(XP+3&%nA%~}S~&CCM!+~?JoX!{E805Enl>GKn*papEw|IW zUa^ZyG;&U+@*j=FSRH{sV?U^-`tS0%l976F|20nZGS{cE{_*;wXV_G8c=g|kw4Gni zkXrk;s7eozdQ^dY5bF95LTUVrbwgN)mU* zm=HMd$1JeJFD1s^N$&*5|7_U6M9cd!lYwtp7Ko8&X|=JdbWSaOwd>o_C1@91hg9dx zAe#;^bR2UO**jon^0!R~{Ml15?S6{>xDe2DdBU)N?13kz6>GjXqWi2DMDLI2^x@m8 zl@^;AC2dc+liH8$r&>u}l;_BG_mo>Cvvsnuox`M?Fq{+{Ir!_!k4YaMakZBYhv!e>ogw#Kya8;zZY@xuW@@lVovOCK1l&@Hcn zuhy!%!U^`TA~ZyfiS^TGUu|j!Lu&e`ZfnS!a-&P!Y!mE*P&)b8;5=iK`m}Su9;Ux# z3}!b!3Tk$PW}8p4OVg5O{>Zhw!;&gxO(E(kX$X=oXs(30?Pwtz$nmPG>BfxgK8&U&mS_pNG z_02&QzCQ8P&19Pp?};8=-aaRKzBtk$_%VNQ%H!d}z6WvE;q_ZOfn>222 z#U{yg?}6U62!l?+e8qC3qr_Y6LhW~N<(9M~U`*91&0XQLemCalGM&%rdBAZ~%WQY9 NLVt+vW%HL2>wiW@l|BFf literal 0 HcmV?d00001 diff --git a/secrets/gitlab/otp.age b/secrets/gitlab/otp.age new file mode 100644 index 0000000..6f3c7d3 --- /dev/null +++ b/secrets/gitlab/otp.age @@ -0,0 +1,20 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg LVJSQ+R7PMpUpKdscHK4alpoivahuvF6hISGdY7gujU +XsmhzzTlEIWo8trvWg7wL6uI6bnHmc71tS8OIz61Xus +-> ssh-ed25519 YJiRbw Nl46Ujkg1RQDQ3jo6MoOWvOuiAce2Vhmk43wDiKC03M +Si/YWv3MSpQAwiD+IQWUD8eWPsWwI19ojsi46+ENr7Y +-> ssh-ed25519 Nl/5yA XDT/tyZ+W5dT1VkBNQcpYMtebHc/37K0hY6kMrtOzl0 +ugulqsgQ5Wp9t7nwhbYvdmL/9YAkpiTF0hJSVPiOvEA +-> ssh-ed25519 GdLgCQ hlBfw0CRRL+d7g5Xxp9zjOVGkO5wy8PAA7ukMCAb5Vg +MDrDCysJ3LJ7o0y/bXkxnx41Bq6Wr0EYEpqeBkbtbPc +-> ssh-ed25519 tOH/HQ 8QGmTG8sbWch2xOFqf9SfLiMY8hLmwIfWMOuHUg+AE4 +3cMeP+NMohzZ8ecMqKEvOo3vta+m1aUtQPBg+jCjyQs +-> ssh-ed25519 FpzvfQ cCNXN61RMnEqcGw199t2xZHug3qVrdtaSkbnqO4Onx8 +MfJHCpsMULqxj2/NSJob24uhFZR0ZhbIh1Arncs9bPw +-> ssh-ed25519 kdPvzQ SDan5OS6ZlZ6+btBx/nDwrPt1kAucMDVZZNlYnAFYA4 +cW6PL2fA8xazBvEe7SjW14o8R4djmCDmtuU8Z1+AEGw +-> }d^ +l78JedCUzpJH0PazQTE3FhpXmW39G5W78avwFQ +--- OvRr3P4ypXczMWZTi7HrsbPEz17jPYAS/k+XScuzEJM +v)WHr/w% +3+rǫK/ￍ*^{:2dbXCd aQ( +7"|L43E=?t߁ \ No newline at end of file diff --git a/secrets/gitlab/secret.age b/secrets/gitlab/secret.age new file mode 100644 index 0000000000000000000000000000000000000000..19f0a957370c323802a1982d9aae416dbde8c885 GIT binary patch literal 998 zcmZY8y$j=X90qU~mx9yXqTG;09AdA@uSuIA2x*hFd1>0TP0|EG^ZrZHq-oxo#9Iyr zCkF=?2M0mW%|#bapSDmrENPenLt z@WJp^q%7gk_W()aG?K2-&(g7!B ztAWCE;J9y`Oe6?Nv;4$zVgOrJ+C_#1S!qd@fOSZY^37Y#6r-(kL0Y}*#k>Im(eo~Z z1PM{q!3nnSt9rSqR$D?*-F%IrdO2t;Y01RA6|MuL2IgjZwtID&t@IAsOt$r$isvNx zJT0mJY07a#b__BXdO3{&GqWd(wsDw1@oUs}X4rwM$mYy)98*GDL+wx)OnFtmI%OfK ziK5j(H*GUvCm!p?3H5?Fr6!!3GNKgisM~A{PY&lQl9Lhc1G%Hm!YtDhA@_{AZu66k z5={>NCbz7l-~t2Vx7q;P=ey9^aUn>Z-D2*rd;u1acTKe-0NR=unUA#7tyZm< zqos-%@!mDs6bg*67F2s-d)V~k^)+W77>!;nEM;b`B{TJ|O=?-(MIpPH@xl>^SmII^ zU{iB#GUWA^Cm3=;$c1SNMdnuH^S%jGL`n-h1oD`c>|zeF(pKFrQfb@Zav+^cYSj_l z%ys+%mV>oXK)If^eUpv!Gu+5_a&T&L7qKhcsS1Xq0m+J~j$V7X`N_oFG`)&=drDJF zvWZcsV}*iML4)h#$_jLP(kINt$50rub{WOVKpF|e7#6-=`U4(Y?vEFuS#K%h2z6U;migXGR+bpEM>wu#GG4@oN{laJ z9|yG@ERJv;&#p5X4iUm*KxPIxo`d=PbWSQ=I_Zl8GtR;!@FikpQC#W@<~CvmAASCW zY=3-L?w)JzJ@d + "gitlab/key.age".publicKeys = everyone; + "gitlab/cert.age".publicKeys = everyone; }