greg/nixos
1
0
Fork 2
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Some massive changes to make flakiness better

Browse Source 
Renamed the @inputs to @top. This was a misguided attempt to make a
different change, but it's going to stick, now.
Began moving packages to their own folder rather than being intermingled
with overlays
Created a local overlay that just includes my personal packages
Cleaned up some dead code
Moved to just using the raw 'imports' instead of needing to explicitly
call out the `foo = import foo.nix {};` syntax
This commit is contained in:
Greg Hellings
2024-10-11 12:28:53 -05:00
parent d9a5f7968a
commit 8d752032ae
17 changed files with 355 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/myself/container-runner.nix
+87 -70
View File
@@ -1,92 +1,109 @@
{ inputs, name, extra ? { }, packages ? [ ], overlays }:
{
top,
name,
extra ? { },
packages ? [ ],
overlays,
}:
({ config, pkgs, lib, ... }:
(
lib.attrsets.recursiveUpdate
{
config,
pkgs,
lib,
...
}:
(lib.attrsets.recursiveUpdate
{
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
];
imports = [
top.agenix.nixosModules.default
top.self.modules.nixosModule
];
nixpkgs.overlays = overlays;
nixpkgs.overlays = overlays;
greg.tailscale.enable = true;
greg.tailscale.enable = true;
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
};
};
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
xorriso
wget
] ++ packages;
environment.systemPackages =
with pkgs;
[
curl
gawk
git
unzip
xorriso
wget
]
++ packages;
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
nixpkgs.config.allowUnfree = true;
nixpkgs.config.allowUnfree = true;
users.users.gitlab-runner = {
isSystemUser = true;
group = "kvm";
extraGroups = [ "kvm" ];
};
users.users.gitlab-runner = {
isSystemUser = true;
group = "kvm";
extraGroups = [ "kvm" ];
};
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
resolved.enable = true;
};
resolved.enable = true;
};
systemd.services.gitlab-runner = {
wants = [
"network-online.target"
"systemd-resolved.service"
];
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
PrivateDevices = false;
ProtectKernelModules = false;
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
DynamicUser = lib.mkForce false;
User = "root";
Group = "kvm";
systemd.services.gitlab-runner = {
wants = [
"network-online.target"
"systemd-resolved.service"
];
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
PrivateDevices = false;
ProtectKernelModules = false;
DevicesAllow = [
"/dev/kvm"
"/dev/mem"
];
DynamicUser = lib.mkForce false;
User = "root";
Group = "kvm";
};
};
};
system.stateVersion = lib.mkForce "24.05";
}
system.stateVersion = lib.mkForce "24.05";
}
extra
) # End of attrsets.recursiveUpdate
) # End of outter function wrapper
) # End of attrsets.recursiveUpdate
) # End of outter function wrapper
hosts/myself/git.nix
+12 -14
View File
@@ -1,16 +1,12 @@
{ config, pkgs, lib, inputs, overlays, ... }:
{
config,
pkgs,
lib,
...
}:
let
gitlabStateDir = "/var/lib/gitlab";
container = input: (lib.attrsets.recursiveUpdate
{
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
enableTun = true;
privateNetwork = true;
}
input);
in
{
networking = {
@@ -28,12 +24,14 @@ in
greg.proxies."git.thehellings.lan" = {
target = "http://192.168.200.2";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
system.activationScripts.makeGitlabDir = lib.stringAfter [
"var"
] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
greg.containers.gitlab = {
tailscale = true;