greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of gh:greg-hellings/nixos-config

Browse Source
This commit is contained in:
Greg Hellings
2023-12-19 20:08:27 +00:00
parent 714f9a6525 fb79feb58d
commit 60e0dbf99d
11 changed files with 182 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/myself/container-git.nix
+7 -1
View File
@@ -26,7 +26,13 @@
useHostResolvConf = lib.mkForce false;
};
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
greg.proxies."192.168.200.2" = {
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
services = {
resolved.enable = true;
hosts/myself/container-runner-qemu.nix
+9 -25
View File
@@ -19,17 +19,9 @@ in {
inputs.agenix.nixosModules.default
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secrets = let
file = num: {
file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
owner = "gitlab-runner";
};
in {
qemu-runner-reg-1 = file "1";
qemu-runner-reg-2 = file "2";
qemu-runner-reg-3 = file "3";
qemu-runner-reg-4 = file "4";
qemu-runner-reg-5 = file "5";
age.secrets.qemu-runner-reg-1 = {
file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age;
owner = "gitlab-runner";
};
networking.useHostResolvConf = pkgs.lib.mkForce false;
@@ -41,23 +33,15 @@ in {
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = let
r = num: {
executor = "shell";
registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
tagList = [ "shell" "qemu" ];
};
in {
shell1 = r "1";
shell2 = r "2";
shell3 = r "3";
shell4 = r "4";
shell5 = r "5";
services.shell = {
executor = "shell";
registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path;
tagList = [ "shell" "qemu" ];
};
};
systemd.services.gitlab-runner.wants = [ "network-online.target" ];
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ];
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
system.stateVersion = "24.05";
}
hosts/myself/container-runner-vbox.nix
+48 -60
View File
@@ -1,4 +1,4 @@
{ inputs, name, extra}:
{ inputs, name, extra ? {} }:
({ config, pkgs, lib, ... }:
let
@@ -8,77 +8,65 @@ let
virtualenv
]));
in (
lib.attrsets.recursiveUpdate {
lib.attrsets.recursiveUpdate {
imports = [
inputs.agenix.nixosModules.default
];
imports = [
inputs.agenix.nixosModules.default
];
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
};
environment.systemPackages = with pkgs; [
curl
gawk
git
packer
pup
py
shellcheck
xorriso
];
environment.systemPackages = with pkgs; [
curl
gawk
git
p7zip
packer
pup
py
shellcheck
unzip
xorriso
wget
];
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
nixpkgs.config.allowUnfree = true;
nixpkgs.config.allowUnfree = true;
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.runner-reg.path;
tagList = [ "shell" name ];
};
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.runner-reg.path;
tagList = [ "shell" name ];
};
};
resolved.enable = true;
};
resolved.enable = true;
};
systemd.services.gitlab-runner = {
wants = [ "network-online.target" ];
after = [ "network.target" "network-online.target" ];
serviceConfig = {
User = "root";
DynamicUser = lib.mkForce false;
};
};
systemd.services.gitlab-runner = {
wants = [ "network-online.target" "systemd-resolved.service" ];
after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
};
system.stateVersion = "24.05";
users.users.gitlab-runner = {
isNormalUser = true;
group = "gitlab-runner";
extraGroups = [
"root"
"sudo"
"vboxusers"
"wheel"
];
};
users.groups.gitlab-runner = {};
}
system.stateVersion = "24.05";
}
extra
extra
) # End of attrsets.recursiveUpdate
) # End of outter function wrapper
hosts/myself/git.nix
+72 -21
View File
@@ -23,7 +23,13 @@ in {
};
};
greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
greg.proxies."git.thehellings.lan" = {
target = "http://192.168.200.2";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
@@ -44,17 +50,32 @@ in {
config = ((import ./container-git.nix) { inherit inputs registryPort; });
};
systemd.services."container@gitlab-runner-qemu".serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [
"rmmod kvm_amd kvm"
];
ExecPreStart = [
"modprobe kvm"
];
systemd.services = {
"container@gitlab-runner-qemu" = {
conflicts = [
"container@gitlab-runner-vbox.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [ "rmmod kvm_amd kvm" ];
ExecPreStart = [ "modprobe kvm" ];
};
};
"container@gitlab-runner-vbox" = {
conflicts = [
"container@gitlab-runner-qemu.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ];
ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
};
};
};
systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
#####################################################################################
#################### QEmu Runner ####################################################
#####################################################################################
containers.gitlab-runner-qemu = container {
bindMounts = {
"/dev/kvm" = {
@@ -70,17 +91,9 @@ in {
config = ((import ./container-runner-qemu.nix) inputs);
};
systemd.services."container@gitlab-runner-vbox".serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [
"rmmod vboxnetadp vboxnetflt vboxdrv"
];
ExecPreStart = [
"modprobe vboxdrv vboxnetadp vboxnetflt"
];
};
systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
#####################################################################################
#################### Virtualbox Runner ##############################################
#####################################################################################
containers.gitlab-runner-vbox = container {
bindMounts = {
"/dev/vboxdrv" = {
@@ -102,6 +115,10 @@ in {
inherit inputs;
name = "vbox";
extra = {
systemd.services.gitlab-runner.serviceConfig = {
User = "root";
DynamicUser = lib.mkForce false;
};
virtualisation.virtualbox.host = {
enable = true;
enableExtensionPack = true;
@@ -111,4 +128,38 @@ in {
};
});
};
#####################################################################################
#################### Container Podman Runner ########################################
#####################################################################################
containers.gitlab-runner-shell = container {
autoStart = true;
hostAddress = "192.168.203.1";
localAddress = "192.168.203.2";
config = ((import ./container-runner-vbox.nix) {
inherit inputs;
name = "shell";
});
};
#####################################################################################
#################### Local Podman/Docker Runner #####################################
#####################################################################################
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
services.gitlab-runner = {
enable = false;
settings.concurrent = 5;
services = {
default = {
executor = "docker";
registrationConfigFile = config.age.secrets.runner-reg.path;
dockerImage = "debian:stable";
};
};
};
virtualisation = {
docker.enable = true;
oci-containers.backend = "docker";
};
#users.users.gitlab-runner.extraGroups = [ "docker" ];
}
secrets/gitlab/myself-podman-runner-reg.age
+22
View File
@@ -0,0 +1,22 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI
zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4
-> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo
dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4
-> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM
wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0
-> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE
0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw
-> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM
mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00
-> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc
Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo
-> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk
Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4
-> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI
0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc
-> =E!-grease uD%0 \!WY E@ )8GeC
jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM
q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw
--- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ
IúnïT zG\TC–3*€ÈšÂ%â¹âcl…âAÉ»úýn9ÎóÜT¹,v â1¸”³êUO¸Èl ùµà±•Ö`p®ùLÚûW␍YRþyZ8ZÛ�,·ÉK"¦J3*ã"¸ UM_=4¥k÷Cýu¡îy
secrets/gitlab/myself-qemu-runner-reg-2.age
-23
View File
@@ -1,23 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic
/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0
-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY
QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38
-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY
52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o
-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0
sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips
-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI
T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc
-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg
lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro
-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg
FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg
-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk
LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM
-> XWz-grease ~X,$Oko
qcqccJwfeg
--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0
æïå¬
o”½8¥éÏêú缹lOX"aÐq"¬ýE(…†æ_´•fÉ—ÙÎ ,t±¦º4¸pN°J½Y¨X{ì‚oÙ�^º„ÁœM½
œ¾çýªÐ†þ‚±wÉâýs 8¯5—yý‡ÜÙ�›éò¸l£¼
secrets/gitlab/myself-qemu-runner-reg-3.age
BIN
View File
Binary file not shown.
secrets/gitlab/myself-qemu-runner-reg-4.age
BIN
View File
Binary file not shown.
secrets/gitlab/myself-qemu-runner-reg-5.age
-21
View File
@@ -1,21 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE
iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM
-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI
OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk
-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s
pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk
-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0
oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA
-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg
/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c
-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls
olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ
-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU
ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo
-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4
UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0
-> I-grease nF)
EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI
--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04
Æ�£PüdÙ•ÔÞµÃ%1|' åîZšÑþÒK¯'¥[½@—yF¯?¼Ó'®¬…iÚé¿ï{Á »‚Ð!Áf> êbðÛt~‘z¦à q$“Š$Œ£µ]HçBÛÍçRLµÚ#ôóé‚äËr€¦¨+„@\àóð
secrets/gitlab/myself-shell-runner-reg.age
+21
View File
@@ -0,0 +1,21 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg GbbSlZ/V1ackzrCD5U7N5JchEZ9UuowST/Y71Sfp3BI
GZSzZfu2Wux34LPZBQvwkqxKjXDrOOqmkRJt3qDtCJg
-> ssh-ed25519 YJiRbw HISatsdrNt+GumrPyyArj+Dqw+eULCD7RpRV1YiBu3k
hhhcKHrgPVkm+PK/s/p4Osgzls4FVVbNQ9vzGky8QW4
-> ssh-ed25519 aY2AXA wYRNkYdk2GHITA+WAXkgoo5I4Wq4cLBFcMXSf9BUL08
T74l0pjESuW1gblGpb8Mz2WdjRItcO+8MA78aI5K/Uk
-> ssh-ed25519 Nl/5yA iK7ae7vwUHydJ928biSU8d9Aw23+9GpUF+MJPtjwjik
9a8ljhEXqV8HlUPGOChbRMqkppeadkFT6ug7zx0oaws
-> ssh-ed25519 GdLgCQ Zzbgl2Y8pmYhXmg0So1kEyZYPJweQw1AAsrmmNTGqXM
26whD+QrG/4WtXYs5gYGiR2BSW4y9dTtV6bIFTX6hlM
-> ssh-ed25519 tOH/HQ rL3qA2pX4ikDfp3Y/A+Hw9wJow2/T8hSiLAS0voHKi0
JuL5zXRIK05O1wTrRMuuOvvG0UUSa7M/yqB12pJWV6Q
-> ssh-ed25519 FpzvfQ n38lhFDy+xuLOlqQgXUhCrRfJJXG45J/lR3CvXyyNhs
cpIJXnimD4Kw7qwFnYmzDdv+peFSeVoDLepn074P22g
-> ssh-ed25519 kdPvzQ 6BFcuWAwjkas16kb0aWicpUw/+s5oS5fsQM06aowNDM
RMKPRUlPacPLLY02A21hy3qfIGkgTMCx3fduMNPZb8k
-> Vd,~-grease eb >N-
nhFZ/S0aoHjZpo4vX3M4aGEfzD2Qm2ey+fsPpSo
--- Rug5lKlvevXobavIgMKn7vLlfwE+YGx5/aR4eaGA3P8
@+j¥&v*.îËu姪W…}ݲ㺹9Z)¤:p#¿§›␍½š"L˜QÃj<”ñSF¦êÅXUx³EÆ1§ õ˾Á¸�¦ÓŽ“·EFc6ªàΠÿ™?ÈWzÚéògmK™x\ ‰º.™ÎÝŸãÒ?Û‡�?
secrets/secrets.nix
+3 -4
View File
@@ -50,9 +50,8 @@ in
"gitlab/key.age".publicKeys = everyone;
"gitlab/cert.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone;
"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;
"gitlab/myself-shell-runner-reg.age".publicKeys = everyone;
"gitlab/myself-vmware-runner-reg.age".publicKeys = everyone;
}