Merge branch 'main' of gh:greg-hellings/nixos-config
This commit is contained in:
Greg Hellings
@@ -49,7 +49,6 @@ in {
|
||||
};
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = machine { name = "linode"; };
|
||||
lappy = machine { name = "lappy"; };
|
||||
mm = unstable { name = "mm"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
|
||||
@@ -10,12 +10,20 @@
|
||||
./postgres.nix
|
||||
./synapse.nix
|
||||
];
|
||||
greg.home = false;
|
||||
greg.linode.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
networking.hostName = "linode";
|
||||
networking.domain = "thehellings.com";
|
||||
greg = {
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [
|
||||
"100.88.91.27"
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
forgejo
|
||||
gitea-actions-runner
|
||||
graphviz
|
||||
|
||||
+26
-118
@@ -2,130 +2,38 @@
|
||||
|
||||
let
|
||||
srcDomain = "src.thehellings.com";
|
||||
ciDomain = "ci.thehellings.com";
|
||||
ciPort = "17080";
|
||||
droneDir = "/var/lib/drone";
|
||||
execWorkDir = "/var/lib/drone-exec";
|
||||
droneWorkerEnvironment = {
|
||||
DRONE_RPC_PROTO = "https";
|
||||
DRONE_RPC_HOST = ciDomain;
|
||||
DRONE_RUNNER_CAPACITY = "2";
|
||||
DRONE_RUNNER_NAME = "docker";
|
||||
};
|
||||
in {
|
||||
|
||||
environment.systemPackages = [ pkgs.drone-runner-exec ];
|
||||
##########################################################################################
|
||||
###########
|
||||
# GIT SERVICES
|
||||
##########
|
||||
##########################################################################################
|
||||
services = {
|
||||
forgejo = rec {
|
||||
enable = true;
|
||||
package = pkgs.unstable.forgejo;
|
||||
database = {
|
||||
type = "postgres";
|
||||
user = "forgejo";
|
||||
};
|
||||
dump = {
|
||||
enable = true;
|
||||
type = "tar.xz";
|
||||
};
|
||||
settings = {
|
||||
actions.ENABLED = true;
|
||||
DEFAULT = {
|
||||
APP_NAME = "Greg's Sources";
|
||||
};
|
||||
server = rec {
|
||||
ROOT_URL = "https://${DOMAIN}/";
|
||||
DOMAIN = srcDomain;
|
||||
HTTP_PORT = 3001;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = pkgs.lib.mkForce true;
|
||||
session.COOKIE_SECURE = pkgs.lib.mkForce true;
|
||||
log.level = "Info";
|
||||
};
|
||||
};
|
||||
|
||||
# For now, at least, this is the same as Forgejo's action runner
|
||||
gitea-actions-runner.instances = {
|
||||
exec = {
|
||||
enable = true;
|
||||
hostPackages = with pkgs; [
|
||||
bashInteractive
|
||||
podman
|
||||
git
|
||||
nodejs
|
||||
];
|
||||
name = "Linode";
|
||||
labels = [
|
||||
"native:host"
|
||||
];
|
||||
tokenFile = config.age.secrets.forgejo-runner.path;
|
||||
url = "https://src.thehellings.com";
|
||||
settings = {
|
||||
log.level = "info";
|
||||
runner = {
|
||||
file = ".runner";
|
||||
capacity = 3;
|
||||
envs = {}; # Environment variables
|
||||
env_file = ".env";
|
||||
timeout = "3h"; # This is the default on Gitea/Forgejo as well
|
||||
insecure = false; # TLS verification
|
||||
fetch_timeout = "5s";
|
||||
fetch_interval = "2s";
|
||||
#labels = []; # See above
|
||||
};
|
||||
cache = {
|
||||
enabled = true;
|
||||
dir = ""; # Default is $HOME/.cache/actcache
|
||||
host = ""; # How to access cache from the runner, autodetect
|
||||
port = 0;
|
||||
external_server = ""; #We are not going externally
|
||||
};
|
||||
container = {
|
||||
network = ""; # Auto-create
|
||||
privileged = false;
|
||||
options = null;
|
||||
workdir_parent = "/workspace";
|
||||
valid_volumes = [];
|
||||
#docker_host = "";
|
||||
force_pull = false;
|
||||
};
|
||||
host = {
|
||||
workdir_parent = null; # Default $HOME/.cache/act
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
forgejo = {
|
||||
enable = true;
|
||||
files = "${config.services.forgejo.dump.backupDir}/*";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.forgejo-runner = {
|
||||
file = ../../secrets/linode-forgejo-runner.age;
|
||||
owner = config.systemd.services.gitea-runner-exec.serviceConfig.User;
|
||||
};
|
||||
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "${config.services.forgejo.settings.server.PROTOCOL}://${config.services.forgejo.settings.server.DOMAIN}:${toString config.services.forgejo.settings.server.HTTP_PORT}";
|
||||
target = "http://git.thehellings.lan";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
greg.backup.jobs.forgejo = {
|
||||
src = config.services.forgejo.dump.backupDir;
|
||||
dest = "forgejo";
|
||||
user = "forgejo";
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = builtins.concatStringsSep "\n" [
|
||||
"global"
|
||||
" daemon"
|
||||
" maxconn 20"
|
||||
|
||||
"defaults"
|
||||
" timeout connect 500s"
|
||||
" timeout client 500s"
|
||||
" timeout server 1h"
|
||||
|
||||
"frontend gitsshd"
|
||||
" bind *:2222"
|
||||
" default_backend gitssh"
|
||||
" timeout client 1h"
|
||||
|
||||
"backend gitssh"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:2222"
|
||||
];
|
||||
};
|
||||
|
||||
##########################################################################################
|
||||
|
||||
@@ -26,10 +26,17 @@
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
greg.proxies."192.168.200.2" = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
services = {
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
@@ -37,7 +44,7 @@
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = false;
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
inputs:
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
shellcheck
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
in {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secrets.qemu-runner-reg-1 = {
|
||||
file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
|
||||
networking.useHostResolvConf = pkgs.lib.mkForce false;
|
||||
networking.nameservers = [ "100.100.100.100" ];
|
||||
services.resolved.enable = true;
|
||||
|
||||
environment.systemPackages = extraPackages;
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services.shell = {
|
||||
executor = "shell";
|
||||
registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path;
|
||||
tagList = [ "shell" "qemu" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ];
|
||||
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{ inputs, name, extra ? {} }:
|
||||
|
||||
({ config, pkgs, lib, ... }:
|
||||
let
|
||||
py = (pkgs.python3.withPackages (p: with p; [
|
||||
pip
|
||||
pyyaml
|
||||
virtualenv
|
||||
]));
|
||||
in (
|
||||
lib.attrsets.recursiveUpdate {
|
||||
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
p7zip
|
||||
packer
|
||||
pup
|
||||
py
|
||||
shellcheck
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
];
|
||||
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
tagList = [ "shell" name ];
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [ "network-online.target" "systemd-resolved.service" ];
|
||||
after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
||||
extra
|
||||
) # End of attrsets.recursiveUpdate
|
||||
) # End of outter function wrapper
|
||||
@@ -36,16 +36,6 @@
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = false;
|
||||
onBoot = "ignore";
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
|
||||
+130
-16
@@ -1,22 +1,15 @@
|
||||
{ config, pkgs, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
config.virtualisation.virtualbox.host.package
|
||||
curl
|
||||
gawk
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
|
||||
registryPort = 8001;
|
||||
|
||||
container = input: (lib.attrsets.recursiveUpdate {
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
privateNetwork = true;
|
||||
} input);
|
||||
in {
|
||||
networking = {
|
||||
firewall = {
|
||||
@@ -30,22 +23,143 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
containers.gitlab = {
|
||||
containers.gitlab = container {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/var/gitlab/state" = {
|
||||
hostPath = gitlabStateDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/etc/ssh".hostPath = "/etc/ssh";
|
||||
};
|
||||
privateNetwork = true;
|
||||
forwardPorts = [{
|
||||
hostPort = 2222;
|
||||
containerPort = 22;
|
||||
}];
|
||||
hostAddress = "192.168.200.1";
|
||||
localAddress = "192.168.200.2";
|
||||
config = ((import ./container-git.nix) { inherit inputs registryPort; });
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
"container@gitlab-runner-qemu" = {
|
||||
conflicts = [
|
||||
"container@gitlab-runner-vbox.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [ "rmmod kvm_amd kvm" ];
|
||||
ExecPreStart = [ "modprobe kvm" ];
|
||||
};
|
||||
};
|
||||
"container@gitlab-runner-vbox" = {
|
||||
conflicts = [
|
||||
"container@gitlab-runner-qemu.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ];
|
||||
ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### QEmu Runner ####################################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-qemu = container {
|
||||
bindMounts = {
|
||||
"/dev/kvm" = {
|
||||
hostPath = "/dev/kvm";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
extraFlags = [
|
||||
"--property=DeviceAllow=/dev/kvm"
|
||||
];
|
||||
hostAddress = "192.168.201.1";
|
||||
localAddress = "192.168.201.2";
|
||||
config = ((import ./container-runner-qemu.nix) inputs);
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Virtualbox Runner ##############################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-vbox = container {
|
||||
bindMounts = {
|
||||
"/dev/vboxdrv" = {
|
||||
hostPath = "/dev/vboxdrv";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/vboxdrvu" = {
|
||||
hostPath = "/dev/vboxdrvu";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/vboxnetctl" = {
|
||||
hostPath = "/dev/vboxnetctl";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
hostAddress = "192.168.202.1";
|
||||
localAddress = "192.168.202.2";
|
||||
config = ((import ./container-runner-vbox.nix) {
|
||||
inherit inputs;
|
||||
name = "vbox";
|
||||
extra = {
|
||||
systemd.services.gitlab-runner.serviceConfig = {
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
virtualisation.virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
enableHardening = false;
|
||||
headless = true;
|
||||
};
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner-vbox.nix) {
|
||||
inherit inputs;
|
||||
name = "shell";
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = false;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "debian:stable";
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
#users.users.gitlab-runner.extraGroups = [ "docker" ];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user