greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

CI running

Browse Source
This commit is contained in:
Greg Hellings
2023-12-27 20:27:38 -06:00
parent 09628a3d42
commit 7dde6d256a
9 changed files with 151 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/myself/container-git.nix
+32 -21
View File
@@ -38,32 +38,11 @@ in {
proxy_set_header X-Forwarded-Ssl on;
'';
};
services.nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
listen = [ {
addr = vpnIp;
port = registryPort;
ssl = true;
} ];
locations."/" = {
proxyPass = "http://127.0.0.1:5000/";
recommendedProxySettings = true;
};
extraConfig = builtins.concatStringsSep "\n" [
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
];
};
services.cron = {
enable = true;
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
};
greg.tailscale.enable = true;
virtualisation.docker.enable = true;
services = {
resolved.enable = true;
openssh.enable = true;
gitlab = {
enable = true;
backup = {
@@ -105,6 +84,29 @@ in {
};
};
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
listen = [ {
addr = vpnIp;
port = registryPort;
ssl = true;
} ];
locations."/" = {
proxyPass = "http://127.0.0.1:5000/";
recommendedProxySettings = true;
};
extraConfig = builtins.concatStringsSep "\n" [
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
"client_max_body_size 250m;"
];
};
# Fetch the SSL certificates for nginx to use
cron = {
enable = true;
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
};
postgresql = {
enable = true;
checkConfig = true;
@@ -124,6 +126,15 @@ in {
redis.servers.gitlab = {
enable = true;
};
resolved.enable = true;
openssh.enable = true;
};
# Do not start nginx until we have tailscaled up and running, so it can bind
# to the 100.* addresses
systemd.services.nginx = {
after = [ "tailscaled.service" ];
requires = [ "tailscaled.service" ];
};
system.stateVersion = "24.05";
}
hosts/myself/container-runner-qemu.nix
+17 -3
View File
@@ -22,7 +22,7 @@ in {
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secrets.qemu-runner-reg-1 = {
file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age;
owner = "gitlab-runner";
owner = "root";
};
networking.useHostResolvConf = pkgs.lib.mkForce false;
@@ -40,9 +40,23 @@ in {
tagList = [ "shell" "qemu" ];
};
};
virtualisation.libvirtd = {
enable = true;
onBoot = "ignore";
};
systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ];
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
systemd.services = {
gitlab-runner = {
wants = [ "network-online.target" "systemd-resolved.service" ];
after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
};
libvirtd.serviceConfig = {
DevicePolicy = "auto";
DeviceAllow = [ "/dev/kvm" "/dev/mem" ];
PrivateDevices = false;
ProtectKernelModules = false;
};
};
system.stateVersion = "24.05";
}
hosts/myself/container-runner-vbox.nix
+12 -4
View File
@@ -1,4 +1,4 @@
{ inputs, name, extra ? {} }:
{ inputs, name, extra ? {}, packages ? [] }:
({ config, pkgs, lib, ... }:
let
@@ -32,10 +32,11 @@ lib.attrsets.recursiveUpdate {
py
shellcheck
unzip
xonsh
xorriso
vagrant
wget
];
] ++ packages;
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
@@ -61,8 +62,15 @@ lib.attrsets.recursiveUpdate {
};
systemd.services.gitlab-runner = {
wants = [ "network-online.target" "systemd-resolved.service" ];
after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
wants = [
"network-online.target"
"systemd-resolved.service"
];
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
};
system.stateVersion = "24.05";
hosts/myself/git.nix
+40 -7
View File
@@ -59,8 +59,11 @@ in {
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [ "rmmod kvm_amd kvm" ];
ExecPreStart = [ "modprobe kvm kvm_amd" ];
ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ];
ExecStartPre = [
"${pkgs.kmod}/bin/modprobe kvm"
"${pkgs.kmod}/bin/modprobe kvm_amd"
];
};
};
"container@gitlab-runner-vbox" = {
@@ -69,8 +72,12 @@ in {
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ];
ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
ExecStopPost = [ "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv" ];
ExecStartPre = [
"${pkgs.kmod}/bin/modprobe vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
"${pkgs.kmod}/bin/modprobe vboxnetflt"
];
};
};
"container@gitlab".serviceConfig = {
@@ -78,6 +85,7 @@ in {
ProtectKernelModules = false;
PrivateDevices = false;
};
gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
};
#####################################################################################
@@ -89,13 +97,28 @@ in {
hostPath = "/dev/kvm";
isReadOnly = false;
};
"/dev/mem" = {
hostPath = "/dev/mem";
isReadOnly = false;
};
};
extraFlags = [
"--property=DeviceAllow=/dev/kvm"
];
hostAddress = "192.168.201.1";
localAddress = "192.168.201.2";
config = ((import ./container-runner-qemu.nix) inputs);
config = ((import ./container-runner-vbox.nix) {
inherit inputs;
name = "qemu";
packages = with pkgs; [ qemu_full qemu_kvm ];
extra = {
virtualisation.libvirtd = {
enable = true;
onBoot = "ignore";
package = pkgs.libvirt-greg;
};
};
});
};
#####################################################################################
@@ -132,6 +155,7 @@ in {
enableHardening = false;
headless = true;
};
networking.firewall.allowedTCPPorts = [ 18083 ]; # Should be interface for vboxweb
};
});
};
@@ -153,14 +177,17 @@ in {
#################### Local Podman/Docker Runner #####################################
#####################################################################################
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
settings = {
concurrent = 5;
};
services = {
default = {
executor = "docker";
registrationConfigFile = config.age.secrets.runner-reg.path;
dockerImage = "fedora:39";
dockerImage = "registry.thehellings.com/greg/ci-images/fedora";
dockerAllowedImages = [
"alpine:*"
"debian:*"
@@ -173,11 +200,17 @@ in {
"koalaman/shellcheck:*"
"registry.gitlab.com/gitlab-org/*"
"registry.thehellings.com/*"
];
dockerAllowedServices = [
"docker:*"
"registry.thehellings.com/*"
];
dockerPrivileged = true;
dockerVolumes = [
"/certs/client"
"/cache"
];
};
};
};
overlays/default.nix
+3
View File
@@ -63,6 +63,9 @@ in rec {
handbrake = prev.handbrake.override {
libbluray = libbluray-custom;
};
libvirt-greg = prev.libvirt.overrideAttrs {
postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service";
};
xonsh = prev.xonsh.overridePythonAttrs (old: rec{
python3 = final.gregpy;
secrets/gitlab/docker-auth.age
+22
View File
@@ -0,0 +1,22 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg QXPxLsHDv2J5RH8+UjtFMQo4yFdaNfuV6yD1KAz1Rxc
2ll7H/WKCI47w4oPL+9nOaWguHfDEc5Q6AmBHduGurE
-> ssh-ed25519 YJiRbw 8Ai1osukJoUNvAJ4zHGudZUxU/w9uiNdkSSjp8GTIGI
iHhF6rrDbB+PujlvHP2N5K4Zzc3R0jJ2851DJO/xx1g
-> ssh-ed25519 aY2AXA oiNt/hR1iC8sgXvB712J+fWNbFux7+uMEA4BNbobsik
Al83/ckzsB+YS9s7PkrsQy171fzQTJdhdlR7TTIfnCU
-> ssh-ed25519 Nl/5yA /LzefcwM2rezBx4wQmRXdKOkQpV1v0qcSonwY4C8FRI
w1irgyi4qfnumSE9bpaliYK0qjPh6gbufjJRVejjYwk
-> ssh-ed25519 GdLgCQ FX20+pHJNuGQcVXjA87j440vhLi7qfcuvNPHg/pT2hA
G/yNOLdwZ7+4xf60kC75gQuxW0Y603D3DodXGlrRfY8
-> ssh-ed25519 tOH/HQ E9GVFDmP0GVJf78RkYae7TOl/An2V0kqvaC37yAz8mM
GI18IUsUWNk4dHqnrHAwpZSb5Kcz3Fp78y8lgO/29c4
-> ssh-ed25519 FpzvfQ Xzp8i9u4O8hmutU397Fe0n1pxlB17Glyaii9p3H0gRU
/ppiXFk8ulxHdT1GGak5gSAPa7hm1tZfsOAiZVLRCwg
-> ssh-ed25519 kdPvzQ RolZ/ogYFdcY2beH/0N8pIr89JeKJpbplpULm8cDnGc
seuEqk/aubrxZ/+vFmW4VjtG7Mlbk6zbB9EWSyB6WZU
-> !5/_-grease
aIxpVrzd/gX7Zj8bDUCFAQAcaK4Xhoc2+27wt6bpexkuRacFCd1gjvXJG2LfLaGA
FkpsQoAktFhm6AzHLPXDPOPAw2e5aHNEqQ
--- xlcSP0mtqnMV4OL8J1CK/Rq/OKDxZDphNXbNx/nuwbQ
£rEg*‚ÀÈ‚n°ðSªµ5ØÅ:ÁØ'n’/Ê[ŒTNÔyú‘HåUÁþ8¥àþ[ají‡×úÖ†ŽTnc°IR9Ú°8³C“ÁO«ÕB›ÕÍÊ…Ñ*BÛêHTpýâØø¼EÁ Ö¤E‚p<�â2�Í¥&§ŒvÛ�.œq—␍�z<�66p2Nžˆ:€äâ_(% '9ÀŸ³ûœí¼@¯ÈC
secrets/gitlab/myself-podman-runner-reg.age
+23 -21
View File
@@ -1,22 +1,24 @@
age-encryption.org/v1
-> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI
zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4
-> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo
dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4
-> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM
wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0
-> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE
0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw
-> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM
mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00
-> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc
Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo
-> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk
Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4
-> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI
0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc
-> =E!-grease uD%0 \!WY E@ )8GeC
jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM
q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw
--- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ
IúnïT zG\TC–3*€ÈšÂ%â¹âcl…âAÉ»úýn9ÎóÜT¹,v â1¸”³êUO¸Èl ùµà±•Ö`p®ùLÚûW␍YRþyZ8ZÛ�,·ÉK"¦J3*ã"¸ UM_=4¥k÷Cýu¡îy
-> ssh-ed25519 mOmPfg v6H/iYsxSharpYdE3zaQWwe4upObwg6SoqS2DHccEmQ
q89KCC+dsrPhz8k55s4tnLRddFpGEmKi6X8bixSzADI
-> ssh-ed25519 YJiRbw qqyTMJde1bZ1SueoOGOcFzyJT0HCk9vFVKDf2yyzjwI
g3bFCSRPWXiArnt2AIg0cEGyFueqKHEUtwo0GhZ8+Qs
-> ssh-ed25519 aY2AXA ulJXsgoZzBk4aMdJY5J5Z2+IvH+q4DFV9WSSsMmGP0U
g6oT0hwN7H0Ns0ZYIkHpo2xMjp6DCHgiAGj766TOA8w
-> ssh-ed25519 Nl/5yA SqmK8QCxKqu0w8ZpRsM7T+Osl22qMHAE17avW1CgWjU
IPFrLZk1/e4+h5DgiEjBHZis/Goftk8NL3JGBikfT3I
-> ssh-ed25519 GdLgCQ Hksz6e56bab8WaH7YcPu0P50UVbkPriAbB7k4OsY0xc
qHKzIoDAvAkwFtBU9jSVoYMrLeei+2XkmW2w0q6giZo
-> ssh-ed25519 tOH/HQ bQrB5zxKxlIt2SjIzq7aELT59XpAVZanmZakOimgVE0
gtDbQGFWgs7eA1eYwSE7mWnKePDfD0tzcBTq5RwhjhM
-> ssh-ed25519 FpzvfQ 1u5GDj3/GLbCuYXYPdbCoS+gdEf2H5fB4IHs76r3U1I
gjM3BYBcX6Dzk82KikQWF47fvp9hkFpCQ3BvQcFSfnA
-> ssh-ed25519 kdPvzQ 8o47gHxb83pPErakkstW04h1MycsK/bAqBNfQnpolzU
ikG06kyazNW7GeEQmXBCNTnLs3zDg0o9/2eQ3FWh+fE
-> GwrHkr"-grease 5DqzJj W_O4EW
tVyYwwIGgkcsdyYLoHigZ2vfz4wAwNTk+kAVA9evxoN0q/DPq9OOoPqPvzEhcWc/
IGl7UyexYDprXqAn1ph2VLkaHQ7oX4QXN0dvnC7lDo/vDFElRPDnW3ML+XzELIM
--- YUiM/kVJaOCRy/mu1VvlqiRTFn8WMgD9NAAGXwsqbWs
2©x¬*5æ¢HA†u­‚Æô¦ßšU'ä%{N¬£�7Ó¯fEˆ
LKŒ‰Qò;f€5ä*ì‡Näð␍�ÓFn'k(¹îý[àûå…]ÇOÞ—ËIͽ]Ù–
dtXQô'¶/pÁ"!Ê.èw4›¾3F|8ë¾mf$Š¨>  ’9¹Ø0x™± Ò’Lè·Í¨N”©d1„f[Áùd᜞9A•„—É?Ý󬥊øló\½²M©HIÙ†„HÝ4ŸTuëÅN¸�|†"ÉZѬ8É[ 3␍˜÷:YBÆpUÏK·_™%ÉþTáQP÷[Eé%úv•gIÃEþ׺“ÕâßÌpªèôiû␍¡
secrets/gitlab/myself-qemu-runner-reg-1.age → secrets/gitlab/myself-qemu-runner-reg.age
View File
secrets/secrets.nix
+2 -1
View File
@@ -49,9 +49,10 @@ in
# Then pipe the resulting files to agenix -e <foo>
"gitlab/key.age".publicKeys = everyone;
"gitlab/cert.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;
"gitlab/myself-shell-runner-reg.age".publicKeys = everyone;
"gitlab/myself-vmware-runner-reg.age".publicKeys = everyone;
"gitlab/docker-auth.age".publicKeys = everyone;
}