From 81936ac524da5265239bcc34177465df54dec366 Mon Sep 17 00:00:00 2001 From: Klaatu Date: Sat, 4 Apr 2026 01:14:52 -0500 Subject: [PATCH] feat: Gitea Actions shell runners + flake-lock workflow - Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow). --- hosts/unstable/isaiah/default.nix | 8 +++++ hosts/unstable/jeremiah/default.nix | 8 +++++ hosts/unstable/linode/default.nix | 11 ++++++ hosts/unstable/zeke/default.nix | 8 +++++ modules/nixos/default.nix | 1 + modules/nixos/gitea-runner.nix | 54 ++++++++++------------------- 6 files changed, 55 insertions(+), 35 deletions(-) diff --git a/hosts/unstable/isaiah/default.nix b/hosts/unstable/isaiah/default.nix index c50e64d..6b8ec8d 100644 --- a/hosts/unstable/isaiah/default.nix +++ b/hosts/unstable/isaiah/default.nix @@ -13,6 +13,8 @@ gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age; gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age; runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age; + # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age + # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age; }; boot = { @@ -53,6 +55,12 @@ enable = true; qemu = true; }; + gitea-runner = { + enable = true; + labels = [ "self-hosted" "bare-metal" "host:isaiah" ]; + # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age + # tokenFile = config.age.secrets.gitea-runner-isaiah.path; + }; }; networking = { diff --git a/hosts/unstable/jeremiah/default.nix b/hosts/unstable/jeremiah/default.nix index 167e324..d9a5223 100644 --- a/hosts/unstable/jeremiah/default.nix +++ b/hosts/unstable/jeremiah/default.nix @@ -29,6 +29,8 @@ in gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age; gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age; gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age; + # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age + # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age; }; # Bootloader. @@ -96,6 +98,12 @@ in threads = 3; qemu = true; }; + gitea-runner = { + enable = true; + labels = [ "self-hosted" "bare-metal" "host:jeremiah" ]; + # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age + # tokenFile = config.age.secrets.gitea-runner-jeremiah.path; + }; }; hardware = { diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix index b25127b..d93c1e5 100644 --- a/hosts/unstable/linode/default.nix +++ b/hosts/unstable/linode/default.nix @@ -23,6 +23,11 @@ pgloader ]; + age.secrets = { + # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age + # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age; + }; + greg = { home = false; linode.enable = true; @@ -36,6 +41,12 @@ ssl = true; }; tailscale.enable = true; + gitea-runner = { + enable = true; + labels = [ "self-hosted" "host:linode" ]; + # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age + # tokenFile = config.age.secrets.gitea-runner-linode.path; + }; }; networking = { diff --git a/hosts/unstable/zeke/default.nix b/hosts/unstable/zeke/default.nix index 0ecfa6f..20c8fde 100644 --- a/hosts/unstable/zeke/default.nix +++ b/hosts/unstable/zeke/default.nix @@ -16,6 +16,8 @@ age.secrets = { gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age; + # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age + # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age; }; boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; @@ -32,6 +34,12 @@ enable = true; vbox = false; }; + gitea-runner = { + enable = true; + labels = [ "self-hosted" "bare-metal" "host:zeke" ]; + # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age + # tokenFile = config.age.secrets.gitea-runner-zeke.path; + }; tailscale = { enable = true; tags = [ "home" ]; diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 9296ee6..f13915b 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -8,6 +8,7 @@ ./backup.nix ./ceph.nix ./db.nix + ./gitea-runner.nix ./gitlab-runner.nix ./gnome.nix ./home.nix diff --git a/modules/nixos/gitea-runner.nix b/modules/nixos/gitea-runner.nix index ada7a8c..0b7a710 100644 --- a/modules/nixos/gitea-runner.nix +++ b/modules/nixos/gitea-runner.nix @@ -6,59 +6,43 @@ }: let cfg = config.greg.gitea-runner; - hostname = config.networking.hostName; - - # Determine extra labels based on host role - roleLabels = - if builtins.elem hostname [ "isaiah" "jeremiah" "zeke" ] then - [ "bare-metal" ] - else if hostname == "linode" then - [ "linode" ] - else - [ ]; in { options.greg.gitea-runner = { - enable = lib.mkEnableOption "Enable Gitea Actions runner (exec/shell mode)"; + enable = lib.mkEnableOption "Enable Gitea act_runner (shell mode)"; - hostnameLabel = lib.mkOption { + instanceURL = lib.mkOption { + type = lib.types.str; + default = "https://src.thehellings.com"; + description = "URL of the Gitea instance to connect to"; + }; + + name = lib.mkOption { type = lib.types.str; default = config.networking.hostName; - description = "Label identifying this host in the runner pool (defaults to hostname)"; + description = "Name of the runner (defaults to hostname)"; + }; + + labels = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ "self-hosted" ]; + description = "Labels to assign to this runner"; }; tokenFile = lib.mkOption { type = lib.types.path; - description = '' - Path to the file containing the runner registration token. - Wire in your agenix secret path here, e.g.: - config.age.secrets.gitea-runner-token.path - ''; - }; - - threads = lib.mkOption { - type = lib.types.int; - default = 4; - description = "Maximum number of concurrent jobs"; + description = "Path to a file containing the runner registration token (from agenix)"; }; }; config = lib.mkIf cfg.enable { services.gitea-actions-runner = { package = pkgs.gitea-actions-runner; - instances.${hostname} = { + instances.${cfg.name} = { enable = true; - url = "https://src.thehellings.com"; + url = cfg.instanceURL; tokenFile = cfg.tokenFile; - labels = - [ - "self-hosted" - cfg.hostnameLabel - ] - ++ roleLabels; - settings = { - runner.capacity = cfg.threads; - }; + labels = cfg.labels; }; }; };