Gitlab and QEmu runner

hosts/myself/git.nix

@@ -5,11 +5,13 @@ let
 		config.virtualisation.virtualbox.host.package
 		curl
 		gawk
+		git
 		packer
 		pup
 		(python3.withPackages (p: with p; [ pip virtualenv ]))
 		qemu_full
 		qemu_kvm
+		shellcheck
 		xonsh
 		xorriso
 	];
@@ -43,9 +45,63 @@ in  {
 			};
 			"/etc/ssh".hostPath = "/etc/ssh";
 		};
+		forwardPorts = [{
+			hostPort = 2222;
+			containerPort = 22;
+		}];
 		privateNetwork = true;
 		hostAddress = "192.168.200.1";
 		localAddress = "192.168.200.2";
 		config = ((import ./container-git.nix) { inherit inputs registryPort; });
 	};
+
+	systemd.services."container@gitlab-runner".serviceConfig = {
+		DevicePolicy = lib.mkForce "auto";
+	};
+
+	containers.gitlab-runner = {
+		autoStart = true;
+		bindMounts = {
+			"/etc/ssh".hostPath = "/etc/ssh";
+			"/dev/kvm" = {
+				hostPath = "/dev/kvm";
+				isReadOnly = false;
+			};
+		};
+		extraFlags = [
+			"--property=DeviceAllow=/dev/kvm"
+		];
+		privateNetwork = true;
+		hostAddress = "192.168.201.1";
+		localAddress = "192.168.201.2";
+		config = { config, pkgs, ... }: {
+			imports = [
+				inputs.agenix.nixosModules.default
+			];
+			age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+			age.secrets.qemu-runner-reg = {
+				file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
+				owner = "gitlab-runner";
+			};
+
+			networking.useHostResolvConf = lib.mkForce false;
+			networking.nameservers = [ "100.100.100.100" ];
+			services.resolved.enable = true;
+
+			environment.systemPackages = extraPackages;
+
+			services.gitlab-runner = {
+				enable = true;
+				services = {
+					shell = {
+						executor = "shell";
+						limit = 5;
+						registrationConfigFile = config.age.secrets.qemu-runner-reg.path;
+						tagList = [ "shell" "qemu" ];
+					};
+				};
+			};
+			system.stateVersion = "24.05";
+		};
+	};
 }