From 69e6c42886b599c2968d573f0869c9a7c6d5f781 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 15 Dec 2023 10:28:19 -0600 Subject: [PATCH] Gitlab and QEmu runner --- hosts/myself/container-git.nix | 3 +- hosts/myself/git.nix | 56 +++++++++++++++++++++++ secrets/gitlab/myself-qemu-runner-reg.age | 21 +++++++++ secrets/secrets.nix | 1 + 4 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 secrets/gitlab/myself-qemu-runner-reg.age diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index 8dcbbdf..c68fe88 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -30,6 +30,7 @@ services = { resolved.enable = true; + openssh.enable = true; gitlab = { enable = true; backup = { @@ -37,7 +38,7 @@ startAt = [ "03:00" ]; }; host = "src.thehellings.com"; - https = false; + https = true; port = 443; extraConfig = { gitlab = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 51ced90..94d85ab 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -5,11 +5,13 @@ let config.virtualisation.virtualbox.host.package curl gawk + git packer pup (python3.withPackages (p: with p; [ pip virtualenv ])) qemu_full qemu_kvm + shellcheck xonsh xorriso ]; @@ -43,9 +45,63 @@ in { }; "/etc/ssh".hostPath = "/etc/ssh"; }; + forwardPorts = [{ + hostPort = 2222; + containerPort = 22; + }]; privateNetwork = true; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; config = ((import ./container-git.nix) { inherit inputs registryPort; }); }; + + systemd.services."container@gitlab-runner".serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + }; + + containers.gitlab-runner = { + autoStart = true; + bindMounts = { + "/etc/ssh".hostPath = "/etc/ssh"; + "/dev/kvm" = { + hostPath = "/dev/kvm"; + isReadOnly = false; + }; + }; + extraFlags = [ + "--property=DeviceAllow=/dev/kvm" + ]; + privateNetwork = true; + hostAddress = "192.168.201.1"; + localAddress = "192.168.201.2"; + config = { config, pkgs, ... }: { + imports = [ + inputs.agenix.nixosModules.default + ]; + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + age.secrets.qemu-runner-reg = { + file = ../../secrets/gitlab/myself-qemu-runner-reg.age; + owner = "gitlab-runner"; + }; + + networking.useHostResolvConf = lib.mkForce false; + networking.nameservers = [ "100.100.100.100" ]; + services.resolved.enable = true; + + environment.systemPackages = extraPackages; + + services.gitlab-runner = { + enable = true; + services = { + shell = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.qemu-runner-reg.path; + tagList = [ "shell" "qemu" ]; + }; + }; + }; + system.stateVersion = "24.05"; + }; + }; } diff --git a/secrets/gitlab/myself-qemu-runner-reg.age b/secrets/gitlab/myself-qemu-runner-reg.age new file mode 100644 index 0000000..0418295 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE +UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo +-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg +cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY +-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI +sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU +-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ +tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY +-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc +rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA +-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k +EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw +-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI +JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew +-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ +8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg +-> ZOzxv-grease 1>wp U@ D2 +BaR+f/XM20cT+Ybw35peBoaM +--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw +¾ª,©Îs dV™"¦èYæ)<©¢8Ø@zÌ×\&ÕÔW d ¹ríæ+±r‡;Îð_:yôì…±%÷z*þG'ó©Øw{Z½Wäï`6'.ŠM¼tŒ¶” óöat7öíäK¢¶%ºåÕÓµv^žÖÁJ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 64d3428..04482a9 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,4 +49,5 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; }