Merge branch 'main' of gh:greg-hellings/nixos-config
This commit is contained in:
Greg Hellings
@@ -26,7 +26,13 @@
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
greg.proxies."192.168.200.2" = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
services = {
|
||||
resolved.enable = true;
|
||||
|
||||
@@ -19,17 +19,9 @@ in {
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secrets = let
|
||||
file = num: {
|
||||
file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
in {
|
||||
qemu-runner-reg-1 = file "1";
|
||||
qemu-runner-reg-2 = file "2";
|
||||
qemu-runner-reg-3 = file "3";
|
||||
qemu-runner-reg-4 = file "4";
|
||||
qemu-runner-reg-5 = file "5";
|
||||
age.secrets.qemu-runner-reg-1 = {
|
||||
file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
|
||||
networking.useHostResolvConf = pkgs.lib.mkForce false;
|
||||
@@ -41,23 +33,15 @@ in {
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = let
|
||||
r = num: {
|
||||
executor = "shell";
|
||||
registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
|
||||
tagList = [ "shell" "qemu" ];
|
||||
};
|
||||
in {
|
||||
shell1 = r "1";
|
||||
shell2 = r "2";
|
||||
shell3 = r "3";
|
||||
shell4 = r "4";
|
||||
shell5 = r "5";
|
||||
services.shell = {
|
||||
executor = "shell";
|
||||
registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path;
|
||||
tagList = [ "shell" "qemu" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner.wants = [ "network-online.target" ];
|
||||
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
|
||||
systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ];
|
||||
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ inputs, name, extra}:
|
||||
{ inputs, name, extra ? {} }:
|
||||
|
||||
({ config, pkgs, lib, ... }:
|
||||
let
|
||||
@@ -8,77 +8,65 @@ let
|
||||
virtualenv
|
||||
]));
|
||||
in (
|
||||
lib.attrsets.recursiveUpdate {
|
||||
lib.attrsets.recursiveUpdate {
|
||||
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
packer
|
||||
pup
|
||||
py
|
||||
shellcheck
|
||||
xorriso
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
p7zip
|
||||
packer
|
||||
pup
|
||||
py
|
||||
shellcheck
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
];
|
||||
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
tagList = [ "shell" name ];
|
||||
};
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
tagList = [ "shell" name ];
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
};
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [ "network-online.target" "systemd-resolved.service" ];
|
||||
after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
users.users.gitlab-runner = {
|
||||
isNormalUser = true;
|
||||
group = "gitlab-runner";
|
||||
extraGroups = [
|
||||
"root"
|
||||
"sudo"
|
||||
"vboxusers"
|
||||
"wheel"
|
||||
];
|
||||
};
|
||||
users.groups.gitlab-runner = {};
|
||||
}
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
||||
extra
|
||||
extra
|
||||
) # End of attrsets.recursiveUpdate
|
||||
) # End of outter function wrapper
|
||||
|
||||
+72
-21
@@ -23,7 +23,13 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
@@ -44,17 +50,32 @@ in {
|
||||
config = ((import ./container-git.nix) { inherit inputs registryPort; });
|
||||
};
|
||||
|
||||
systemd.services."container@gitlab-runner-qemu".serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [
|
||||
"rmmod kvm_amd kvm"
|
||||
];
|
||||
ExecPreStart = [
|
||||
"modprobe kvm"
|
||||
];
|
||||
systemd.services = {
|
||||
"container@gitlab-runner-qemu" = {
|
||||
conflicts = [
|
||||
"container@gitlab-runner-vbox.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [ "rmmod kvm_amd kvm" ];
|
||||
ExecPreStart = [ "modprobe kvm" ];
|
||||
};
|
||||
};
|
||||
"container@gitlab-runner-vbox" = {
|
||||
conflicts = [
|
||||
"container@gitlab-runner-qemu.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ];
|
||||
ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
|
||||
|
||||
#####################################################################################
|
||||
#################### QEmu Runner ####################################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-qemu = container {
|
||||
bindMounts = {
|
||||
"/dev/kvm" = {
|
||||
@@ -70,17 +91,9 @@ in {
|
||||
config = ((import ./container-runner-qemu.nix) inputs);
|
||||
};
|
||||
|
||||
systemd.services."container@gitlab-runner-vbox".serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [
|
||||
"rmmod vboxnetadp vboxnetflt vboxdrv"
|
||||
];
|
||||
ExecPreStart = [
|
||||
"modprobe vboxdrv vboxnetadp vboxnetflt"
|
||||
];
|
||||
};
|
||||
systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
|
||||
|
||||
#####################################################################################
|
||||
#################### Virtualbox Runner ##############################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-vbox = container {
|
||||
bindMounts = {
|
||||
"/dev/vboxdrv" = {
|
||||
@@ -102,6 +115,10 @@ in {
|
||||
inherit inputs;
|
||||
name = "vbox";
|
||||
extra = {
|
||||
systemd.services.gitlab-runner.serviceConfig = {
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
virtualisation.virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
@@ -111,4 +128,38 @@ in {
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner-vbox.nix) {
|
||||
inherit inputs;
|
||||
name = "shell";
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = false;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "debian:stable";
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
#users.users.gitlab-runner.extraGroups = [ "docker" ];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user