Gitlab and QEmu runner

hosts/myself/container-git.nix

@@ -30,6 +30,7 @@
 
 	services = {
 		resolved.enable = true;
+		openssh.enable = true;
 		gitlab = {
 			enable = true;
 			backup = {
@@ -37,7 +38,7 @@
 				startAt = [ "03:00" ];
 			};
 			host = "src.thehellings.com";
-			https = false;
+			https = true;
 			port = 443;
 			extraConfig = {
 				gitlab = {

hosts/myself/git.nix

@@ -5,11 +5,13 @@ let
 		config.virtualisation.virtualbox.host.package
 		curl
 		gawk
+		git
 		packer
 		pup
 		(python3.withPackages (p: with p; [ pip virtualenv ]))
 		qemu_full
 		qemu_kvm
+		shellcheck
 		xonsh
 		xorriso
 	];
@@ -43,9 +45,63 @@ in  {
 			};
 			"/etc/ssh".hostPath = "/etc/ssh";
 		};
+		forwardPorts = [{
+			hostPort = 2222;
+			containerPort = 22;
+		}];
 		privateNetwork = true;
 		hostAddress = "192.168.200.1";
 		localAddress = "192.168.200.2";
 		config = ((import ./container-git.nix) { inherit inputs registryPort; });
 	};
+
+	systemd.services."container@gitlab-runner".serviceConfig = {
+		DevicePolicy = lib.mkForce "auto";
+	};
+
+	containers.gitlab-runner = {
+		autoStart = true;
+		bindMounts = {
+			"/etc/ssh".hostPath = "/etc/ssh";
+			"/dev/kvm" = {
+				hostPath = "/dev/kvm";
+				isReadOnly = false;
+			};
+		};
+		extraFlags = [
+			"--property=DeviceAllow=/dev/kvm"
+		];
+		privateNetwork = true;
+		hostAddress = "192.168.201.1";
+		localAddress = "192.168.201.2";
+		config = { config, pkgs, ... }: {
+			imports = [
+				inputs.agenix.nixosModules.default
+			];
+			age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+			age.secrets.qemu-runner-reg = {
+				file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
+				owner = "gitlab-runner";
+			};
+
+			networking.useHostResolvConf = lib.mkForce false;
+			networking.nameservers = [ "100.100.100.100" ];
+			services.resolved.enable = true;
+
+			environment.systemPackages = extraPackages;
+
+			services.gitlab-runner = {
+				enable = true;
+				services = {
+					shell = {
+						executor = "shell";
+						limit = 5;
+						registrationConfigFile = config.age.secrets.qemu-runner-reg.path;
+						tagList = [ "shell" "qemu" ];
+					};
+				};
+			};
+			system.stateVersion = "24.05";
+		};
+	};
 }

secrets/gitlab/myself-qemu-runner-reg.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE
+UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo
+-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg
+cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY
+-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI
+sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU
+-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ
+tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY
+-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc
+rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA
+-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k
+EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw
+-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI
+JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew
+-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ
+8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg
+-> ZOzxv-grease 1>wp U@ D2
+BaR+f/XM20cT+Ybw35peBoaM
+--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw
+¾ª,©Îs␍dV™"¦èYæ)<©¢8Ø@z�Ì×\&ÕÔW	d ¹ríæ+±r‡;Îð_:yôì…±%÷z*þG'ó©Øw{Z½Wäï`6'
.ŠM¼tŒ¶”óöat7öíäK¢�¶%ºåÕÓµv^žÖÁJ

secrets/secrets.nix

@@ -49,4 +49,5 @@ in
 	# Then pipe the resulting files to agenix -e <foo>
 	"gitlab/key.age".publicKeys = everyone;
 	"gitlab/cert.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
 }