Merge remote-tracking branch 'origin/myself-gitlab'
This commit is contained in:
Greg Hellings
@@ -1,5 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
|
|
||||||
}
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
];
|
|
||||||
# Bootloader.
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
|
||||||
# Graphics, please
|
|
||||||
greg.gnome.enable = true;
|
|
||||||
# Set host name
|
|
||||||
networking.hostName = "lappy";
|
|
||||||
}
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/63bcc80e-0501-4aef-bb58-30bb83881055";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot/efi" =
|
|
||||||
{ device = "/dev/disk/by-uuid/C617-B2B1";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/bc4f24a3-5969-4bcb-95f4-f80109e36ebb"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
+106
-127
@@ -1,131 +1,110 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
];
|
./git.nix
|
||||||
|
];
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
git
|
git
|
||||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||||
tmux
|
tmux
|
||||||
tree
|
tree
|
||||||
vim
|
vim
|
||||||
xonsh
|
xonsh
|
||||||
];
|
];
|
||||||
services = {
|
services = {
|
||||||
openssh.enable = true;
|
openssh.enable = true;
|
||||||
};
|
};
|
||||||
systemd.services = let
|
systemd.services = let
|
||||||
def = id: {
|
def = id: {
|
||||||
enable = true;
|
enable = true;
|
||||||
ephemeral = false;
|
ephemeral = false;
|
||||||
extraEnvironment = {
|
extraEnvironment = {
|
||||||
HTTP_PORT_MIN = builtins.toString (8000 + id);
|
HTTP_PORT_MIN = builtins.toString (8000 + id);
|
||||||
HTTP_PORT_MAX = builtins.toString (8000 + id);
|
HTTP_PORT_MAX = builtins.toString (8000 + id);
|
||||||
};
|
};
|
||||||
extraLabels = [ "nixos" "isaiah" ];
|
extraLabels = [ "nixos" "isaiah" ];
|
||||||
extraPackages = with pkgs; [
|
name = "isaiah-nix-${builtins.toString id}";
|
||||||
config.virtualisation.virtualbox.host.package
|
nodeRuntimes = [ "node20" ];
|
||||||
curl
|
package = pkgs.github-runner;
|
||||||
gawk
|
replace = true;
|
||||||
packer
|
runnerGroup = null;
|
||||||
pup
|
serviceOverrides = {
|
||||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
Group = "vboxusers";
|
||||||
qemu_full
|
};
|
||||||
qemu_kvm
|
tokenFile = "/etc/github_token";
|
||||||
xonsh
|
user = "runner";
|
||||||
xorriso
|
url = "https://github.com/greg-hellings/vms";
|
||||||
];
|
workDir = "/home/runner/${builtins.toString id}";
|
||||||
name = "isaiah-nix-${builtins.toString id}";
|
};
|
||||||
nodeRuntimes = [ "node20" ];
|
runner = a: {};
|
||||||
package = pkgs.github-runner;
|
in {
|
||||||
replace = true;
|
gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; });
|
||||||
runnerGroup = null;
|
gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; });
|
||||||
serviceOverrides = {
|
gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; });
|
||||||
Group = "vboxusers";
|
gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; });
|
||||||
};
|
gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; });
|
||||||
tokenFile = "/etc/github_token";
|
};
|
||||||
user = "runner";
|
networking = {
|
||||||
url = "https://github.com/greg-hellings/vms";
|
hostName = "myself";
|
||||||
workDir = "/home/runner/${builtins.toString id}";
|
useDHCP = false;
|
||||||
};
|
defaultGateway = {
|
||||||
runner = (import ./runner.nix);
|
address = " 10.42.1.1";
|
||||||
in {
|
interface = "enp38s0";
|
||||||
gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; });
|
};
|
||||||
gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; });
|
interfaces.enp38s0 = {
|
||||||
gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; });
|
ipv4.addresses = [ {
|
||||||
gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; });
|
address = "10.42.1.6";
|
||||||
gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; });
|
prefixLength = 16;
|
||||||
};
|
} ];
|
||||||
networking = {
|
};
|
||||||
hostName = "myself";
|
nameservers = [
|
||||||
useDHCP = false;
|
"10.42.1.5"
|
||||||
defaultGateway = {
|
];
|
||||||
address = " 10.42.1.1";
|
};
|
||||||
interface = "enp38s0";
|
virtualisation = {
|
||||||
};
|
libvirtd = {
|
||||||
interfaces.enp38s0 = {
|
enable = false;
|
||||||
ipv4.addresses = [ {
|
onBoot = "ignore";
|
||||||
address = "10.42.1.6";
|
};
|
||||||
prefixLength = 16;
|
virtualbox.host = {
|
||||||
} ];
|
enable = true;
|
||||||
};
|
enableExtensionPack = true;
|
||||||
nameservers = [
|
};
|
||||||
"10.42.1.5"
|
};
|
||||||
];
|
users = {
|
||||||
};
|
users = {
|
||||||
virtualisation = {
|
greg = {
|
||||||
libvirtd = {
|
extraGroups = [
|
||||||
enable = false;
|
"kvm"
|
||||||
onBoot = "ignore";
|
"sudo"
|
||||||
};
|
"vboxusers"
|
||||||
virtualbox.host = {
|
"wheel"
|
||||||
enable = true;
|
];
|
||||||
enableExtensionPack = true;
|
isNormalUser = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
users = {
|
};
|
||||||
users = {
|
system.stateVersion = lib.mkForce "24.05";
|
||||||
runner = {
|
boot = {
|
||||||
extraGroups = [
|
extraModprobeConfig = "options kvm_amd nested=1 vboxdrv";
|
||||||
"kvm"
|
supportedFilesystems = [ "ntfs" ];
|
||||||
"vboxusers"
|
loader = {
|
||||||
];
|
efi = {
|
||||||
group = "runner";
|
canTouchEfiVariables = true;
|
||||||
isNormalUser = true;
|
efiSysMountPoint = "/boot";
|
||||||
};
|
};
|
||||||
greg = {
|
systemd-boot = {
|
||||||
extraGroups = [
|
enable = true;
|
||||||
"kvm"
|
configurationLimit = 10;
|
||||||
"sudo"
|
};
|
||||||
"vboxusers"
|
};
|
||||||
"wheel"
|
};
|
||||||
];
|
nixpkgs.config = {
|
||||||
isNormalUser = true;
|
allowUnfree = true;
|
||||||
};
|
permittedInsecurePackages = [
|
||||||
};
|
"nodejs-16.20.2"
|
||||||
groups.runner = {};
|
];
|
||||||
};
|
};
|
||||||
system.stateVersion = lib.mkForce "24.05";
|
|
||||||
boot = {
|
|
||||||
extraModprobeConfig = "options kvm_amd nested=1 vboxdrv";
|
|
||||||
supportedFilesystems = [ "ntfs" ];
|
|
||||||
loader = {
|
|
||||||
efi = {
|
|
||||||
canTouchEfiVariables = true;
|
|
||||||
efiSysMountPoint = "/boot";
|
|
||||||
};
|
|
||||||
systemd-boot = {
|
|
||||||
enable = true;
|
|
||||||
configurationLimit = 10;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
nixpkgs.config = {
|
|
||||||
allowUnfree = true;
|
|
||||||
permittedInsecurePackages = [
|
|
||||||
"nodejs-16.20.2"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,120 @@
|
|||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
extraPackages = with pkgs; [
|
||||||
|
config.virtualisation.virtualbox.host.package
|
||||||
|
curl
|
||||||
|
gawk
|
||||||
|
packer
|
||||||
|
pup
|
||||||
|
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||||
|
qemu_full
|
||||||
|
qemu_kvm
|
||||||
|
xonsh
|
||||||
|
xorriso
|
||||||
|
];
|
||||||
|
|
||||||
|
secretsList = [
|
||||||
|
"secret"
|
||||||
|
"otp"
|
||||||
|
"db"
|
||||||
|
"jws"
|
||||||
|
];
|
||||||
|
|
||||||
|
secretsPaths = {
|
||||||
|
secret = "/var/lib/secret";
|
||||||
|
otp = "/var/lib/otp";
|
||||||
|
db = "/var/lib/db";
|
||||||
|
jws = "/var/lib/jws";
|
||||||
|
key = "/var/lib/registry-key";
|
||||||
|
cert = "/var/lib/registry-cert";
|
||||||
|
};
|
||||||
|
|
||||||
|
registryPort = 8001;
|
||||||
|
in {
|
||||||
|
age.secrets = {
|
||||||
|
gitlab-secret.file = ../../secrets/gitlab/secret.age;
|
||||||
|
gitlab-otp.file = ../../secrets/gitlab/otp.age;
|
||||||
|
gitlab-db.file = ../../secrets/gitlab/db.age;
|
||||||
|
gitlab-jws.file = ../../secrets/gitlab/jws.age;
|
||||||
|
gitlab-key.file = ../../secrets/gitlab/key.age;
|
||||||
|
gitlab-cert.file = ../../secrets/gitlab/cert.age;
|
||||||
|
};
|
||||||
|
|
||||||
|
containers.gitlab = {
|
||||||
|
autoStart = true;
|
||||||
|
bindMounts = {
|
||||||
|
"/var/gitlab/state" = {
|
||||||
|
hostPath = "/var/lib/gitlab";
|
||||||
|
};
|
||||||
|
"${secretsPaths.secret}".hostPath = config.age.secrets.gitlab-secret.path;
|
||||||
|
"${secretsPaths.otp}".hostPath = config.age.secrets.gitlab-otp.path;
|
||||||
|
"${secretsPaths.db}".hostPath = config.age.secrets.gitlab-db.path;
|
||||||
|
"${secretsPaths.jws}".hostPath = config.age.secrets.gitlab-jws.path;
|
||||||
|
"${secretsPaths.key}".hostPath = config.age.secrets.gitlab-key.path;
|
||||||
|
"${secretsPaths.cert}".hostPath = config.age.secrets.gitlab-cert.path;
|
||||||
|
};
|
||||||
|
privateNetwork = true;
|
||||||
|
hostAddress = "192.168.200.1";
|
||||||
|
localAddress = "192.168.20..2";
|
||||||
|
config = { config, pkgs, ... }: {
|
||||||
|
services = {
|
||||||
|
gitlab = {
|
||||||
|
enable = true;
|
||||||
|
backup = {
|
||||||
|
keepTime = 288;
|
||||||
|
startAt = [ "03:00" ];
|
||||||
|
};
|
||||||
|
host = "10.42.1.6"; # Just for now...
|
||||||
|
https = false;
|
||||||
|
initialRootEmail = "greg@thehellings.com";
|
||||||
|
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||||
|
pages = {
|
||||||
|
enable = true;
|
||||||
|
settings.pages-domain = "pages.thehellings.com";
|
||||||
|
};
|
||||||
|
puma = {
|
||||||
|
threadsMax = 6;
|
||||||
|
threadsMin = 2;
|
||||||
|
workers = 6;
|
||||||
|
};
|
||||||
|
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||||
|
registry = {
|
||||||
|
enable = true;
|
||||||
|
certFile = secretsPaths.cert;
|
||||||
|
keyFile = secretsPaths.key;
|
||||||
|
externalPort = registryPort;
|
||||||
|
};
|
||||||
|
secrets = {
|
||||||
|
secretFile = secretsPaths.secret;
|
||||||
|
otpFile = secretsPaths.otp;
|
||||||
|
dbFile = secretsPaths.db;
|
||||||
|
jwsFile = secretsPaths.jws;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
postgresql = {
|
||||||
|
enable = true;
|
||||||
|
checkConfig = true;
|
||||||
|
ensureDatabases = [ "gitlab" ];
|
||||||
|
ensureUsers = [ {
|
||||||
|
name = "gitlab";
|
||||||
|
ensureDBOwnership = true;
|
||||||
|
} ];
|
||||||
|
settings = {
|
||||||
|
log_connections = true;
|
||||||
|
log_statement = "all";
|
||||||
|
logging_collector = true;
|
||||||
|
log_filename = "postgresql.log";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
redis.servers.gitlab = {
|
||||||
|
enable = true;
|
||||||
|
logfile = "/var/log/redis-gitlab.log";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,51 +1,51 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
# and may be overwritten by future invocations. Please make changes
|
# and may be overwritten by future invocations. Please make changes
|
||||||
# to /etc/nixos/configuration.nix instead.
|
# to /etc/nixos/configuration.nix instead.
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ "kvm-amd" ];
|
boot.kernelModules = [ "kvm-amd" ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = [ "subvol=nixos" ];
|
options = [ "subvol=nixos" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/home" =
|
fileSystems."/home" =
|
||||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = [ "subvol=home" ];
|
options = [ "subvol=home" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/boot" =
|
fileSystems."/boot" =
|
||||||
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
||||||
fsType = "vfat";
|
fsType = "vfat";
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/myvol" =
|
fileSystems."/myvol" =
|
||||||
{ device = "/dev/nvme0n1p1";
|
{ device = "/dev/nvme0n1p1";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices = [ ];
|
swapDevices = [ ];
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,207 +0,0 @@
|
|||||||
{ config
|
|
||||||
, lib
|
|
||||||
, pkgs
|
|
||||||
|
|
||||||
, cfg ? config.services.github-runner
|
|
||||||
, svcName
|
|
||||||
|
|
||||||
, systemdDir ? "${svcName}/${cfg.name}"
|
|
||||||
# %t: Runtime directory root (usually /run); see systemd.unit(5)
|
|
||||||
, runtimeDir ? "%t/${systemdDir}"
|
|
||||||
# %S: State directory root (usually /var/lib); see systemd.unit(5)
|
|
||||||
, stateDir ? "%S/${systemdDir}"
|
|
||||||
# %L: Log directory root (usually /var/log); see systemd.unit(5)
|
|
||||||
, logsDir ? "%L/${systemdDir}"
|
|
||||||
# Name of file stored in service state directory
|
|
||||||
, currentConfigTokenFilename ? ".current-token"
|
|
||||||
|
|
||||||
, ...
|
|
||||||
}:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
|
|
||||||
package = cfg.package.override { inherit (cfg) nodeRuntimes; };
|
|
||||||
in
|
|
||||||
{
|
|
||||||
description = "GitHub Actions runner";
|
|
||||||
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
wants = [ "network-online.target" ];
|
|
||||||
after = [ "network.target" "network-online.target" ];
|
|
||||||
|
|
||||||
environment = {
|
|
||||||
HOME = workDir;
|
|
||||||
RUNNER_ROOT = stateDir;
|
|
||||||
} // cfg.extraEnvironment;
|
|
||||||
|
|
||||||
path = (with pkgs; [
|
|
||||||
bash
|
|
||||||
coreutils
|
|
||||||
git
|
|
||||||
gnutar
|
|
||||||
gzip
|
|
||||||
]) ++ [
|
|
||||||
config.nix.package
|
|
||||||
] ++ cfg.extraPackages;
|
|
||||||
|
|
||||||
serviceConfig = mkMerge [
|
|
||||||
{
|
|
||||||
ExecStart = "${package}/bin/Runner.Listener run --startuptype service";
|
|
||||||
|
|
||||||
# Does the following, sequentially:
|
|
||||||
# - If the module configuration or the token has changed, purge the state directory,
|
|
||||||
# and create the current and the new token file with the contents of the configured
|
|
||||||
# token. While both files have the same content, only the later is accessible by
|
|
||||||
# the service user.
|
|
||||||
# - Configure the runner using the new token file. When finished, delete it.
|
|
||||||
# - Set up the directory structure by creating the necessary symlinks.
|
|
||||||
ExecStartPre =
|
|
||||||
let
|
|
||||||
# Wrapper script which expects the full path of the state, working and logs
|
|
||||||
# directory as arguments. Overrides the respective systemd variables to provide
|
|
||||||
# unambiguous directory names. This becomes relevant, for example, if the
|
|
||||||
# caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
|
|
||||||
# to contain more than one directory. This causes systemd to set the respective
|
|
||||||
# environment variables with the path of all of the given directories, separated
|
|
||||||
# by a colon.
|
|
||||||
writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" ''
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
STATE_DIRECTORY="$1"
|
|
||||||
WORK_DIRECTORY="$2"
|
|
||||||
LOGS_DIRECTORY="$3"
|
|
||||||
|
|
||||||
${lines}
|
|
||||||
'';
|
|
||||||
runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg;
|
|
||||||
newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
|
|
||||||
currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
|
|
||||||
newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
|
|
||||||
currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
|
|
||||||
|
|
||||||
runnerCredFiles = [
|
|
||||||
".credentials"
|
|
||||||
".credentials_rsaparams"
|
|
||||||
".runner"
|
|
||||||
];
|
|
||||||
unconfigureRunner = writeScript "unconfigure" ''
|
|
||||||
copy_tokens() {
|
|
||||||
# Copy the configured token file to the state dir and allow the service user to read the file
|
|
||||||
install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
|
|
||||||
# Also copy current file to allow for a diff on the next start
|
|
||||||
install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
|
|
||||||
}
|
|
||||||
clean_state() {
|
|
||||||
find "$STATE_DIRECTORY/" -mindepth 1 -delete
|
|
||||||
copy_tokens
|
|
||||||
}
|
|
||||||
diff_config() {
|
|
||||||
changed=0
|
|
||||||
# Check for module config changes
|
|
||||||
[[ -f "${currentConfigPath}" ]] \
|
|
||||||
&& ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
|
|
||||||
|| changed=1
|
|
||||||
# Also check the content of the token file
|
|
||||||
[[ -f "${currentConfigTokenPath}" ]] \
|
|
||||||
&& ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
|
|
||||||
|| changed=1
|
|
||||||
# If the config has changed, remove old state and copy tokens
|
|
||||||
if [[ "$changed" -eq 1 ]]; then
|
|
||||||
echo "Config has changed, removing old runner state."
|
|
||||||
echo "The old runner will still appear in the GitHub Actions UI." \
|
|
||||||
"You have to remove it manually."
|
|
||||||
clean_state
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
if [[ "${optionalString cfg.ephemeral "1"}" ]]; then
|
|
||||||
# In ephemeral mode, we always want to start with a clean state
|
|
||||||
clean_state
|
|
||||||
elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
|
|
||||||
# There are state files from a previous run; diff them to decide if we need a new registration
|
|
||||||
diff_config
|
|
||||||
else
|
|
||||||
# The state directory is entirely empty which indicates a first start
|
|
||||||
copy_tokens
|
|
||||||
fi
|
|
||||||
# Always clean workDir
|
|
||||||
find -H "$WORK_DIRECTORY" -mindepth 1 -delete
|
|
||||||
'';
|
|
||||||
configureRunner = writeScript "configure" ''
|
|
||||||
if [[ -e "${newConfigTokenPath}" ]]; then
|
|
||||||
echo "Configuring GitHub Actions Runner"
|
|
||||||
args=(
|
|
||||||
--unattended
|
|
||||||
--disableupdate
|
|
||||||
--work "$WORK_DIRECTORY"
|
|
||||||
--url ${escapeShellArg cfg.url}
|
|
||||||
--labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)}
|
|
||||||
--name ${escapeShellArg cfg.name}
|
|
||||||
${optionalString cfg.replace "--replace"}
|
|
||||||
${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
|
|
||||||
${optionalString cfg.ephemeral "--ephemeral"}
|
|
||||||
)
|
|
||||||
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
|
|
||||||
# if it is not a PAT, we assume it contains a registration token and use the --token option
|
|
||||||
token=$(<"${newConfigTokenPath}")
|
|
||||||
if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
|
|
||||||
args+=(--pat "$token")
|
|
||||||
else
|
|
||||||
args+=(--token "$token")
|
|
||||||
fi
|
|
||||||
${package}/bin/Runner.Listener configure "''${args[@]}"
|
|
||||||
# Move the automatically created _diag dir to the logs dir
|
|
||||||
mkdir -p "$STATE_DIRECTORY/_diag"
|
|
||||||
cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
|
|
||||||
rm -rf "$STATE_DIRECTORY/_diag/"
|
|
||||||
# Cleanup token from config
|
|
||||||
rm "${newConfigTokenPath}"
|
|
||||||
# Symlink to new config
|
|
||||||
ln -s '${newConfigPath}' "${currentConfigPath}"
|
|
||||||
fi
|
|
||||||
'';
|
|
||||||
setupWorkDir = writeScript "setup-work-dirs" ''
|
|
||||||
# Link _diag dir
|
|
||||||
ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag"
|
|
||||||
|
|
||||||
# Link the runner credentials to the work dir
|
|
||||||
ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/"
|
|
||||||
'';
|
|
||||||
in
|
|
||||||
map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [
|
|
||||||
"+${unconfigureRunner}" # runs as root
|
|
||||||
configureRunner
|
|
||||||
setupWorkDir
|
|
||||||
];
|
|
||||||
|
|
||||||
# If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
|
|
||||||
# to trigger a fresh registration.
|
|
||||||
Restart = if cfg.ephemeral then "on-success" else "no";
|
|
||||||
# If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service:
|
|
||||||
# https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146
|
|
||||||
RestartForceExitStatus = [ 2 ];
|
|
||||||
|
|
||||||
# Contains _diag
|
|
||||||
LogsDirectory = [ systemdDir ];
|
|
||||||
# Default RUNNER_ROOT which contains ephemeral Runner data
|
|
||||||
RuntimeDirectory = [ systemdDir ];
|
|
||||||
# Home of persistent runner data, e.g., credentials
|
|
||||||
StateDirectory = [ systemdDir ];
|
|
||||||
StateDirectoryMode = "0700";
|
|
||||||
WorkingDirectory = workDir;
|
|
||||||
|
|
||||||
InaccessiblePaths = [
|
|
||||||
# Token file path given in the configuration, if visible to the service
|
|
||||||
"-${cfg.tokenFile}"
|
|
||||||
# Token file in the state directory
|
|
||||||
"${stateDir}/${currentConfigTokenFilename}"
|
|
||||||
];
|
|
||||||
|
|
||||||
KillSignal = "SIGINT";
|
|
||||||
}
|
|
||||||
(mkIf (cfg.user != null) { User = cfg.user; })
|
|
||||||
cfg.serviceOverrides
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -52,7 +52,6 @@ in rec {
|
|||||||
pkgs = final.pkgs;
|
pkgs = final.pkgs;
|
||||||
};
|
};
|
||||||
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
|
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
|
||||||
jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {};
|
|
||||||
libbluray-custom = prev.libbluray.override {
|
libbluray-custom = prev.libbluray.override {
|
||||||
withAACS = true;
|
withAACS = true;
|
||||||
withBDplus = true;
|
withBDplus = true;
|
||||||
|
|||||||
@@ -1,39 +0,0 @@
|
|||||||
{
|
|
||||||
lib,
|
|
||||||
buildPythonPackage,
|
|
||||||
fetchFromGitHub,
|
|
||||||
|
|
||||||
flake8,
|
|
||||||
jinja2,
|
|
||||||
pytestCheckHook,
|
|
||||||
setuptools,
|
|
||||||
}:
|
|
||||||
|
|
||||||
buildPythonPackage {
|
|
||||||
pname = "jinja2-cli";
|
|
||||||
version = "0.8.2";
|
|
||||||
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "mattrobenolt";
|
|
||||||
repo = "jinja2-cli";
|
|
||||||
rev = "0.8.2";
|
|
||||||
hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0=";
|
|
||||||
};
|
|
||||||
|
|
||||||
propagatedBuildInputs = [
|
|
||||||
jinja2
|
|
||||||
setuptools
|
|
||||||
];
|
|
||||||
|
|
||||||
checkInputs = [
|
|
||||||
flake8
|
|
||||||
pytestCheckHook
|
|
||||||
];
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
description = "A CLI interface for Jinja2 templates";
|
|
||||||
homepage = "https://github.com/mattrobenolt/jinja2-cli";
|
|
||||||
license = licenses.bsd2;
|
|
||||||
maintainers = [ lib.maintainers.greg ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
Binary file not shown.
@@ -0,0 +1,19 @@
|
|||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 mOmPfg 5aqdEg4OJNg6Pw10HFpFKoRWZLvaiqsh0UWW2N5ql1Y
|
||||||
|
JfnQad6DgEqvRT7GJpjg+kFjgkz9P/Dc+rE3azeArOs
|
||||||
|
-> ssh-ed25519 YJiRbw R7DVCK0kirWs/OhPg4zUGqLMdO1usfDZNnmY5jndSQM
|
||||||
|
D47/wwjjRuzVSBdd5BG6nL4s1TtAGCBvrdGuwanyV68
|
||||||
|
-> ssh-ed25519 Nl/5yA JkVW7aHVpsqPKY9wPoxS2MNCfmYv20Sk+844sNGjQxM
|
||||||
|
VojCPfa0dUGph/PJjocKVIGC1k9XYLiNfv7CPJyM8BY
|
||||||
|
-> ssh-ed25519 GdLgCQ WULneYbP+M1DrFX5JLVeCtkHycxtFBm9/x+oUXTu7Uk
|
||||||
|
2ez2hdvzXfhOePZsVzrVL+9XanmhyqcK/XkLdV43x68
|
||||||
|
-> ssh-ed25519 tOH/HQ hHa+OtsIBPtYkDChXg2vhWhYdSqruooaWiPbdk9RgVQ
|
||||||
|
Ku6StrR8ZICUQEnXeZZ6gXAQp49tbluPKQIAa3KfuCc
|
||||||
|
-> ssh-ed25519 FpzvfQ DhdgZQSDKgmMmcitO4dHMJAbe+c67tfd8gDScp4Tvgc
|
||||||
|
h8PAX2B9t6VcqG9W1b0Z5moxD1b9P7Qgex6+ousoi3E
|
||||||
|
-> ssh-ed25519 kdPvzQ sSSfEIPPvA99/ziU676wPt9uLrHBIXECTuUmszYcZSk
|
||||||
|
TcssCYpN5wQTPCay8/gOeot1f6FyUK7sEBkhdwPIG3g
|
||||||
|
-> !Zmpi]O-grease KVI iU\+ he'#C
|
||||||
|
2O3D
|
||||||
|
--- Z3aUd7U6jlt1NiGY2oCzZKeD26gsiqB/Ysr+wRp7Y5E
|
||||||
|
Tó*ÅøŠ•#X␍Ý)�¸>D=>¼Gñ|ZO2␍ Í`ëFÁíퟚÈ`€fÌŽZ3+Ýg=$ŠÒ«‘jÆÞ1™ºYÔŒ–ØxÒu…mq¡¸€Æ…á‘ñ
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 mOmPfg kNX5PaaipRVvjzMrXxjhlTSJD550eSGoa5zDbI4zQVc
|
||||||
|
VAWoBCGuVqKgDw7yEi0YkeIlO+YwdxFoEdLVPXO9y0s
|
||||||
|
-> ssh-ed25519 YJiRbw 9r/cKqXdhpXcDL9S8CDRGLD65Y8yopFGiMmWILtbXG4
|
||||||
|
uifiAw7UCRkHc/uvwEnlzc7+2mKuLCYiAMREHzXdWZs
|
||||||
|
-> ssh-ed25519 Nl/5yA eVSbQEyXXYEBBiMenLZ6uEP/NNlB4pW4GYMaww6KJTg
|
||||||
|
8L2cYg6eYSFHAeY1jgk3GPDOYQYHsRcSXZDMxDW0hBQ
|
||||||
|
-> ssh-ed25519 GdLgCQ HDciLBHQg0Nhd8/QVfgY/6aOEfHdWMs2CwWjieKgIBM
|
||||||
|
/U/EP99DxhcMrhIa9ggQJSczTQCpDf2mzDJI0uXUYZo
|
||||||
|
-> ssh-ed25519 tOH/HQ ZHmlo/urIFxi8zShOTUqJRuVpFm9RdNtDi6+Fc79dE0
|
||||||
|
RC+z3vkORLSFETGPoSbaml7kfA5GG/NK1IwNwn2XD0c
|
||||||
|
-> ssh-ed25519 FpzvfQ kQHudI+8AYPU9gWEp5rR5UeBoppKtdNONPgNpAGM0mo
|
||||||
|
025maJUyvy7QQpvv+eW7F0rOBMF3BBrwYHHnvwz67dk
|
||||||
|
-> ssh-ed25519 kdPvzQ lUYVBtzSufAD2XZmIH3J788y9oTunIFSNjKIOjuFCBM
|
||||||
|
bvW8hq+4iFgTpDf0zBIcxWwKMq6xkdKgnjm8q3YYYDk
|
||||||
|
-> NJL_l7-grease y4c :
|
||||||
|
kVPvEEpHy8iy//hr42NPPa1DWxgrk2+iAy3KqTZ4oQ
|
||||||
|
--- /muOWusu9T+JEtIWyMOb78bya/kLZ7AJ9VTNJeZrKLw
|
||||||
|
°a{(ÌF!&†h¼,Ncy™�Šù‡!¨66î-<Á˃÷ê6tqÍi3» Ï*W•å§ÜþtXi¸„“�|Ûrº¡÷þ’Ž?Ô E'4…2�Yý²ðJ
|
||||||
Binary file not shown.
@@ -0,0 +1,20 @@
|
|||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 mOmPfg LVJSQ+R7PMpUpKdscHK4alpoivahuvF6hISGdY7gujU
|
||||||
|
XsmhzzTlEIWo8trvWg7wL6uI6bnHmc71tS8OIz61Xus
|
||||||
|
-> ssh-ed25519 YJiRbw Nl46Ujkg1RQDQ3jo6MoOWvOuiAce2Vhmk43wDiKC03M
|
||||||
|
Si/YWv3MSpQAwiD+IQWUD8eWPsWwI19ojsi46+ENr7Y
|
||||||
|
-> ssh-ed25519 Nl/5yA XDT/tyZ+W5dT1VkBNQcpYMtebHc/37K0hY6kMrtOzl0
|
||||||
|
ugulqsgQ5Wp9t7nwhbYvdmL/9YAkpiTF0hJSVPiOvEA
|
||||||
|
-> ssh-ed25519 GdLgCQ hlBfw0CRRL+d7g5Xxp9zjOVGkO5wy8PAA7ukMCAb5Vg
|
||||||
|
MDrDCysJ3LJ7o0y/bXkxnx41Bq6Wr0EYEpqeBkbtbPc
|
||||||
|
-> ssh-ed25519 tOH/HQ 8QGmTG8sbWch2xOFqf9SfLiMY8hLmwIfWMOuHUg+AE4
|
||||||
|
3cMeP+NMohzZ8ecMqKEvOo3vta+m1aUtQPBg+jCjyQs
|
||||||
|
-> ssh-ed25519 FpzvfQ cCNXN61RMnEqcGw199t2xZHug3qVrdtaSkbnqO4Onx8
|
||||||
|
MfJHCpsMULqxj2/NSJob24uhFZR0ZhbIh1Arncs9bPw
|
||||||
|
-> ssh-ed25519 kdPvzQ SDan5OS6ZlZ6+btBx/nDwrPt1kAucMDVZZNlYnAFYA4
|
||||||
|
cW6PL2fA8xazBvEe7SjW14o8R4djmCDmtuU8Z1+AEGw
|
||||||
|
-> }d^<e64I-grease s r}M!k%M >
|
||||||
|
l78JedCUzpJH0PazQTE3FhpXmW39G5W78avwFQ
|
||||||
|
--- OvRr3P4ypXczMWZTi7HrsbPEz17jPYAS/k+XScuzEJM
|
||||||
|
v)ÒWÅHr/�®¬‡w ¨%•
|
||||||
|
œ3+÷rŽˆðÇ«K/³ï¿�ñ*^{:2dbùâXÎCdÿè¢ aQ(£ +äÎ7™"|LÓ4é3ðE=¥»ˆò?tß�
|
||||||
Binary file not shown.
+16
-3
@@ -1,7 +1,8 @@
|
|||||||
let
|
let
|
||||||
linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q";
|
linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q";
|
||||||
jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude";
|
jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude";
|
||||||
systems = [ linode jude ];
|
myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf";
|
||||||
|
systems = [ linode jude myself ];
|
||||||
|
|
||||||
|
|
||||||
user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102";
|
user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102";
|
||||||
@@ -9,15 +10,17 @@ let
|
|||||||
user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm";
|
user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm";
|
||||||
|
|
||||||
user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
|
user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
|
||||||
|
user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
|
||||||
user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude";
|
user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude";
|
||||||
user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode";
|
user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode";
|
||||||
user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
|
user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself";
|
||||||
|
|
||||||
users = [
|
users = [
|
||||||
user_genesis_virt
|
user_genesis_virt
|
||||||
|
user_ivr
|
||||||
user_jude
|
user_jude
|
||||||
user_linode
|
user_linode
|
||||||
user_ivr
|
user_myself
|
||||||
];
|
];
|
||||||
|
|
||||||
everyone = systems ++ users;
|
everyone = systems ++ users;
|
||||||
@@ -36,4 +39,14 @@ in
|
|||||||
|
|
||||||
"linode-forgejo-runner.age".publicKeys = everyone;
|
"linode-forgejo-runner.age".publicKeys = everyone;
|
||||||
"jude-forgejo-runner.age".publicKeys = everyone;
|
"jude-forgejo-runner.age".publicKeys = everyone;
|
||||||
|
|
||||||
|
|
||||||
|
"gitlab/secret.age".publicKeys = everyone;
|
||||||
|
"gitlab/otp.age".publicKeys = everyone;
|
||||||
|
"gitlab/db.age".publicKeys = everyone;
|
||||||
|
"gitlab/jws.age".publicKeys = everyone;
|
||||||
|
# openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer'
|
||||||
|
# Then pipe the resulting files to agenix -e <foo>
|
||||||
|
"gitlab/key.age".publicKeys = everyone;
|
||||||
|
"gitlab/cert.age".publicKeys = everyone;
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user