Add Drone CI

hosts/linode/default.nix

@@ -4,6 +4,7 @@
 	imports = [
 		./git.nix
 		./hardware-configuration.nix
+		./podman.nix
 		./nextcloud.nix
 		./nginx.nix
 		./postgres.nix

hosts/linode/git.nix

@@ -1,6 +1,17 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 
-{
+let
+	srcDomain = "src.thehellings.com";
+	ciDomain = "ci.thehellings.com";
+	ciPort = "17080";
+	droneDir = "/var/lib/drone";
+in {
+
+	##########################################################################################
+	###########
+	#                       GIT SERVICES
+	##########
+	##########################################################################################
 	services.gitea = rec {
 		enable = true;
 		appName = "Greg's Sources";
@@ -10,7 +21,7 @@
 			user = "gitea";
 		};
 		disableRegistration = true;
-		domain = "src.thehellings.com";
+		domain = srcDomain;
 		dump = {
 			enable = true;
 			type = "tar.xz";
@@ -18,7 +29,7 @@
 		rootUrl = "https://${domain}/";
 	};
 
-	greg.proxies."src.thehellings.com" = {
+	greg.proxies."${srcDomain}" = {
 		target = "http://localhost:${toString config.services.gitea.httpPort}";
 		ssl = true;
 		genAliases = false;
@@ -39,4 +50,59 @@
 			};
 		};
 	};
+
+	##########################################################################################
+	###########
+	#                       CI SERVICES
+	##########
+	##########################################################################################
+
+	# Service user
+	users.users.drone = {
+		isSystemUser = true;
+		group = "drone";
+		home = droneDir;
+	};
+	users.groups.drone = {};
+
+	# Environment secrets
+	age.secrets.drone = {
+		file = ../../secrets/drone.age;
+		owner = "root";
+	};
+
+	virtualisation.oci-containers = {
+		backend = "podman";
+		containers = {
+			"drone" = {
+				environment = {
+					DRONE_GITEA_SERVER = "https://${srcDomain}";
+					DRONE_SERVER_HOST = ciDomain;
+					DRONE_SERVER_PROTO = "https";
+					DRONE_SERVER_PROXY_HOST = ciDomain;
+					DRONE_SERVER_PROXY_PROTO = "https";
+					DRONE_TLS_AUTOCERT = "false";  # Suppress it generating SSL certificates, as our proxy handles that
+				};
+				environmentFiles = [
+					"/run/agenix/drone"
+				];
+				extraOptions = [ "--pull=newer" ];
+				image = "drone/drone:2.13";
+				ports = [ "${ciPort}:80" ];
+				volumes = [ "${droneDir}:/data" ];
+			};
+		};
+	};
+
+	systemd.services."podman-drone".serviceConfig = {
+		StateDirectory = "drone";
+		StateDirectoryMode = pkgs.lib.mkForce "0777";
+		WorkingDirectory = droneDir;
+	};
+
+	greg.proxies."${ciDomain}" = {
+		target = "http://localhost:${ciPort}";
+		ssl = true;
+		genAliases = false;
+	};
 }

hosts/linode/podman.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+	virtualisation.podman = {
+		enable = true;
+		dockerCompat = true;
+		dockerSocket.enable = true;
+	};
+}

secrets/secrets.nix

@@ -11,4 +11,6 @@ in
 	# age.secrets.matrix.file = ../../secrets/matrix.age;
 	# Then you can reference the file at /run/agenix/matrix
 	"nextcloudadmin.age".publicKeys = [ linode user ];
+
+	"drone.age".publicKeys = [ linode user ];
 }