diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index 8ad7f5a..fae98e2 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -38,32 +38,11 @@ in { proxy_set_header X-Forwarded-Ssl on; ''; }; - services.nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { - listen = [ { - addr = vpnIp; - port = registryPort; - ssl = true; - } ]; - locations."/" = { - proxyPass = "http://127.0.0.1:5000/"; - recommendedProxySettings = true; - }; - extraConfig = builtins.concatStringsSep "\n" [ - "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" - "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" - ]; - }; - services.cron = { - enable = true; - systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; - }; greg.tailscale.enable = true; virtualisation.docker.enable = true; services = { - resolved.enable = true; - openssh.enable = true; gitlab = { enable = true; backup = { @@ -105,6 +84,29 @@ in { }; }; + nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { + listen = [ { + addr = vpnIp; + port = registryPort; + ssl = true; + } ]; + locations."/" = { + proxyPass = "http://127.0.0.1:5000/"; + recommendedProxySettings = true; + }; + extraConfig = builtins.concatStringsSep "\n" [ + "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" + "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" + "client_max_body_size 250m;" + ]; + }; + + # Fetch the SSL certificates for nginx to use + cron = { + enable = true; + systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; + }; + postgresql = { enable = true; checkConfig = true; @@ -124,6 +126,15 @@ in { redis.servers.gitlab = { enable = true; }; + resolved.enable = true; + openssh.enable = true; + }; + + # Do not start nginx until we have tailscaled up and running, so it can bind + # to the 100.* addresses + systemd.services.nginx = { + after = [ "tailscaled.service" ]; + requires = [ "tailscaled.service" ]; }; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix index e6b83de..db7597f 100644 --- a/hosts/myself/container-runner-qemu.nix +++ b/hosts/myself/container-runner-qemu.nix @@ -22,7 +22,7 @@ in { age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; age.secrets.qemu-runner-reg-1 = { file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age; - owner = "gitlab-runner"; + owner = "root"; }; networking.useHostResolvConf = pkgs.lib.mkForce false; @@ -40,9 +40,23 @@ in { tagList = [ "shell" "qemu" ]; }; }; + virtualisation.libvirtd = { + enable = true; + onBoot = "ignore"; + }; - systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ]; - systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + systemd.services = { + gitlab-runner = { + wants = [ "network-online.target" "systemd-resolved.service" ]; + after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + }; + libvirtd.serviceConfig = { + DevicePolicy = "auto"; + DeviceAllow = [ "/dev/kvm" "/dev/mem" ]; + PrivateDevices = false; + ProtectKernelModules = false; + }; + }; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix index fe53559..7b5ce8f 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner-vbox.nix @@ -1,4 +1,4 @@ -{ inputs, name, extra ? {} }: +{ inputs, name, extra ? {}, packages ? [] }: ({ config, pkgs, lib, ... }: let @@ -32,10 +32,11 @@ lib.attrsets.recursiveUpdate { py shellcheck unzip + xonsh xorriso vagrant wget - ]; + ] ++ packages; networking = { useHostResolvConf = pkgs.lib.mkForce false; @@ -61,8 +62,15 @@ lib.attrsets.recursiveUpdate { }; systemd.services.gitlab-runner = { - wants = [ "network-online.target" "systemd-resolved.service" ]; - after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; }; system.stateVersion = "24.05"; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index ad45bb3..bae55a5 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -59,8 +59,11 @@ in { ]; serviceConfig = { DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ "rmmod kvm_amd kvm" ]; - ExecPreStart = [ "modprobe kvm kvm_amd" ]; + ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ]; + ExecStartPre = [ + "${pkgs.kmod}/bin/modprobe kvm" + "${pkgs.kmod}/bin/modprobe kvm_amd" + ]; }; }; "container@gitlab-runner-vbox" = { @@ -69,8 +72,12 @@ in { ]; serviceConfig = { DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ]; - ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ]; + ExecStopPost = [ "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv" ]; + ExecStartPre = [ + "${pkgs.kmod}/bin/modprobe vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + "${pkgs.kmod}/bin/modprobe vboxnetflt" + ]; }; }; "container@gitlab".serviceConfig = { @@ -78,6 +85,7 @@ in { ProtectKernelModules = false; PrivateDevices = false; }; + gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path; }; ##################################################################################### @@ -89,13 +97,28 @@ in { hostPath = "/dev/kvm"; isReadOnly = false; }; + "/dev/mem" = { + hostPath = "/dev/mem"; + isReadOnly = false; + }; }; extraFlags = [ "--property=DeviceAllow=/dev/kvm" ]; hostAddress = "192.168.201.1"; localAddress = "192.168.201.2"; - config = ((import ./container-runner-qemu.nix) inputs); + config = ((import ./container-runner-vbox.nix) { + inherit inputs; + name = "qemu"; + packages = with pkgs; [ qemu_full qemu_kvm ]; + extra = { + virtualisation.libvirtd = { + enable = true; + onBoot = "ignore"; + package = pkgs.libvirt-greg; + }; + }; + }); }; ##################################################################################### @@ -132,6 +155,7 @@ in { enableHardening = false; headless = true; }; + networking.firewall.allowedTCPPorts = [ 18083 ]; # Should be interface for vboxweb }; }); }; @@ -153,14 +177,17 @@ in { #################### Local Podman/Docker Runner ##################################### ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; services.gitlab-runner = { enable = true; - settings.concurrent = 5; + settings = { + concurrent = 5; + }; services = { default = { executor = "docker"; registrationConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "fedora:39"; + dockerImage = "registry.thehellings.com/greg/ci-images/fedora"; dockerAllowedImages = [ "alpine:*" "debian:*" @@ -173,11 +200,17 @@ in { "koalaman/shellcheck:*" "registry.gitlab.com/gitlab-org/*" + "registry.thehellings.com/*" ]; dockerAllowedServices = [ "docker:*" + "registry.thehellings.com/*" ]; dockerPrivileged = true; + dockerVolumes = [ + "/certs/client" + "/cache" + ]; }; }; }; diff --git a/overlays/default.nix b/overlays/default.nix index ec7a7a0..b24197e 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -63,6 +63,9 @@ in rec { handbrake = prev.handbrake.override { libbluray = libbluray-custom; }; + libvirt-greg = prev.libvirt.overrideAttrs { + postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service"; + }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; diff --git a/secrets/gitlab/docker-auth.age b/secrets/gitlab/docker-auth.age new file mode 100644 index 0000000..38c1637 --- /dev/null +++ b/secrets/gitlab/docker-auth.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg QXPxLsHDv2J5RH8+UjtFMQo4yFdaNfuV6yD1KAz1Rxc +2ll7H/WKCI47w4oPL+9nOaWguHfDEc5Q6AmBHduGurE +-> ssh-ed25519 YJiRbw 8Ai1osukJoUNvAJ4zHGudZUxU/w9uiNdkSSjp8GTIGI +iHhF6rrDbB+PujlvHP2N5K4Zzc3R0jJ2851DJO/xx1g +-> ssh-ed25519 aY2AXA oiNt/hR1iC8sgXvB712J+fWNbFux7+uMEA4BNbobsik +Al83/ckzsB+YS9s7PkrsQy171fzQTJdhdlR7TTIfnCU +-> ssh-ed25519 Nl/5yA /LzefcwM2rezBx4wQmRXdKOkQpV1v0qcSonwY4C8FRI +w1irgyi4qfnumSE9bpaliYK0qjPh6gbufjJRVejjYwk +-> ssh-ed25519 GdLgCQ FX20+pHJNuGQcVXjA87j440vhLi7qfcuvNPHg/pT2hA +G/yNOLdwZ7+4xf60kC75gQuxW0Y603D3DodXGlrRfY8 +-> ssh-ed25519 tOH/HQ E9GVFDmP0GVJf78RkYae7TOl/An2V0kqvaC37yAz8mM +GI18IUsUWNk4dHqnrHAwpZSb5Kcz3Fp78y8lgO/29c4 +-> ssh-ed25519 FpzvfQ Xzp8i9u4O8hmutU397Fe0n1pxlB17Glyaii9p3H0gRU +/ppiXFk8ulxHdT1GGak5gSAPa7hm1tZfsOAiZVLRCwg +-> ssh-ed25519 kdPvzQ RolZ/ogYFdcY2beH/0N8pIr89JeKJpbplpULm8cDnGc +seuEqk/aubrxZ/+vFmW4VjtG7Mlbk6zbB9EWSyB6WZU +-> !5/_-grease +aIxpVrzd/gX7Zj8bDUCFAQAcaK4Xhoc2+27wt6bpexkuRacFCd1gjvXJG2LfLaGA +FkpsQoAktFhm6AzHLPXDPOPAw2e5aHNEqQ +--- xlcSP0mtqnMV4OL8J1CK/Rq/OKDxZDphNXbNx/nuwbQ +rEg*ȂnS5:'n/[TNyHU8[ajֆTncIR9ڰ8COBʅ*BHTpE ֤Ep<2ͥ&vہ.q z<66p2N:_(% '9@C \ No newline at end of file diff --git a/secrets/gitlab/myself-podman-runner-reg.age b/secrets/gitlab/myself-podman-runner-reg.age index 4037117..5b33569 100644 --- a/secrets/gitlab/myself-podman-runner-reg.age +++ b/secrets/gitlab/myself-podman-runner-reg.age @@ -1,22 +1,24 @@ age-encryption.org/v1 --> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI -zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4 --> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo -dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4 --> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM -wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0 --> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE -0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw --> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM -mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00 --> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc -Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo --> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk -Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4 --> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI -0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc --> =E!-grease uD%0 \!WY E@ )8GeC -jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM -q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw ---- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ -InT zG\TC3*Ț%clAɻn9T,v1UOl ౕ`pLW YRyZ8Zې,K"J3*" UM_=4kCuy \ No newline at end of file +-> ssh-ed25519 mOmPfg v6H/iYsxSharpYdE3zaQWwe4upObwg6SoqS2DHccEmQ +q89KCC+dsrPhz8k55s4tnLRddFpGEmKi6X8bixSzADI +-> ssh-ed25519 YJiRbw qqyTMJde1bZ1SueoOGOcFzyJT0HCk9vFVKDf2yyzjwI +g3bFCSRPWXiArnt2AIg0cEGyFueqKHEUtwo0GhZ8+Qs +-> ssh-ed25519 aY2AXA ulJXsgoZzBk4aMdJY5J5Z2+IvH+q4DFV9WSSsMmGP0U +g6oT0hwN7H0Ns0ZYIkHpo2xMjp6DCHgiAGj766TOA8w +-> ssh-ed25519 Nl/5yA SqmK8QCxKqu0w8ZpRsM7T+Osl22qMHAE17avW1CgWjU +IPFrLZk1/e4+h5DgiEjBHZis/Goftk8NL3JGBikfT3I +-> ssh-ed25519 GdLgCQ Hksz6e56bab8WaH7YcPu0P50UVbkPriAbB7k4OsY0xc +qHKzIoDAvAkwFtBU9jSVoYMrLeei+2XkmW2w0q6giZo +-> ssh-ed25519 tOH/HQ bQrB5zxKxlIt2SjIzq7aELT59XpAVZanmZakOimgVE0 +gtDbQGFWgs7eA1eYwSE7mWnKePDfD0tzcBTq5RwhjhM +-> ssh-ed25519 FpzvfQ 1u5GDj3/GLbCuYXYPdbCoS+gdEf2H5fB4IHs76r3U1I +gjM3BYBcX6Dzk82KikQWF47fvp9hkFpCQ3BvQcFSfnA +-> ssh-ed25519 kdPvzQ 8o47gHxb83pPErakkstW04h1MycsK/bAqBNfQnpolzU +ikG06kyazNW7GeEQmXBCNTnLs3zDg0o9/2eQ3FWh+fE +-> GwrHkr"-grease 5DqzJj W_O4EW +tVyYwwIGgkcsdyYLoHigZ2vfz4wAwNTk+kAVA9evxoN0q/DPq9OOoPqPvzEhcWc/ +IGl7UyexYDprXqAn1ph2VLkaHQ7oX4QXN0dvnC7lDo/vDFElRPDnW3ML+XzELIM +--- YUiM/kVJaOCRy/mu1VvlqiRTFn8WMgD9NAAGXwsqbWs +2x*5HAuߚU'%{N7ӯfE +LKQ;f5*N Fn'k(ý[]OޗIͽ]ٖ +dtXQ'/p"!.w43F|8mf$>  90x ҒLͨNd1f[d᜞9A?󬥊l\MHIنH4TuN|"ZѬ8[ 3 :YBpUK_%TQP[E%vgIE׺pi \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-1.age b/secrets/gitlab/myself-qemu-runner-reg.age similarity index 100% rename from secrets/gitlab/myself-qemu-runner-reg-1.age rename to secrets/gitlab/myself-qemu-runner-reg.age diff --git a/secrets/secrets.nix b/secrets/secrets.nix index d71e864..ee8c668 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,9 +49,10 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; - "gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; "gitlab/myself-vmware-runner-reg.age".publicKeys = everyone; + "gitlab/docker-auth.age".publicKeys = everyone; }