From 09628a3d4237f698c556720d9b9d2aa68ffdf79e Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 22 Dec 2023 13:19:06 -0600 Subject: [PATCH 1/7] Rely on tailscale --- hosts/myself/container-git.nix | 36 +++++++++++++++++++++--- hosts/myself/container-runner-qemu.nix | 1 + hosts/myself/container-runner-vbox.nix | 1 + hosts/myself/git.nix | 39 ++++++++++++++++++++------ 4 files changed, 65 insertions(+), 12 deletions(-) diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index bd46e0e..8ad7f5a 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -1,8 +1,13 @@ -{ inputs, registryPort, ...}: -{ config, pkgs, lib, ... }: { +{ inputs, ...}: +{ config, pkgs, lib, ... }: let + registryPort = 5000; + vpnIp = "100.78.226.76"; + containerIp = "192.168.200.2"; +in { imports = [ inputs.agenix.nixosModules.default ../../modules-linux/proxy.nix + ../../modules-linux/tailscale.nix ]; age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; @@ -26,13 +31,35 @@ useHostResolvConf = lib.mkForce false; }; - greg.proxies."192.168.200.2" = { + greg.proxies."${containerIp}" = { target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; extraConfig = '' proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Ssl on; ''; }; + services.nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { + listen = [ { + addr = vpnIp; + port = registryPort; + ssl = true; + } ]; + locations."/" = { + proxyPass = "http://127.0.0.1:5000/"; + recommendedProxySettings = true; + }; + extraConfig = builtins.concatStringsSep "\n" [ + "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" + "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" + ]; + }; + services.cron = { + enable = true; + systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; + }; + greg.tailscale.enable = true; + + virtualisation.docker.enable = true; services = { resolved.enable = true; @@ -67,7 +94,8 @@ enable = true; certFile = config.age.secrets.gitlab-cert.path; keyFile = config.age.secrets.gitlab-key.path; - externalPort = registryPort; + externalAddress = "registry.thehellings.com"; + externalPort = 443; }; secrets = { secretFile = config.age.secrets.gitlab-secret.path; diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix index 7ef7574..e6b83de 100644 --- a/hosts/myself/container-runner-qemu.nix +++ b/hosts/myself/container-runner-qemu.nix @@ -11,6 +11,7 @@ let qemu_full qemu_kvm shellcheck + vagrant xonsh xorriso ]; diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix index 0bc60b3..fe53559 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner-vbox.nix @@ -33,6 +33,7 @@ lib.attrsets.recursiveUpdate { shellcheck unzip xorriso + vagrant wget ]; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 8a588b9..ad45bb3 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -4,8 +4,6 @@ let gitlabStateDir = "/var/lib/gitlab"; - registryPort = 8001; - container = input: (lib.attrsets.recursiveUpdate { bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets privateNetwork = true; @@ -14,7 +12,7 @@ in { networking = { firewall = { enable = true; - allowedTCPPorts = [ 80 registryPort ]; + allowedTCPPorts = [ 80 ]; }; nat = { enable = true; @@ -40,6 +38,10 @@ in { hostPath = gitlabStateDir; isReadOnly = false; }; + "/dev/net/tun" = { + hostPath = "/dev/net/tun"; + isReadOnly = false; + }; }; forwardPorts = [{ hostPort = 2222; @@ -47,7 +49,7 @@ in { }]; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; - config = ((import ./container-git.nix) { inherit inputs registryPort; }); + config = ((import ./container-git.nix) { inherit inputs; }); }; systemd.services = { @@ -58,7 +60,7 @@ in { serviceConfig = { DevicePolicy = lib.mkForce "auto"; ExecPostStop = [ "rmmod kvm_amd kvm" ]; - ExecPreStart = [ "modprobe kvm" ]; + ExecPreStart = [ "modprobe kvm kvm_amd" ]; }; }; "container@gitlab-runner-vbox" = { @@ -71,6 +73,11 @@ in { ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ]; }; }; + "container@gitlab".serviceConfig = { + DeviceAllow = [ "/dev/net/tun" ]; + ProtectKernelModules = false; + PrivateDevices = false; + }; }; ##################################################################################### @@ -147,13 +154,30 @@ in { ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; services.gitlab-runner = { - enable = false; + enable = true; settings.concurrent = 5; services = { default = { executor = "docker"; registrationConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "debian:stable"; + dockerImage = "fedora:39"; + dockerAllowedImages = [ + "alpine:*" + "debian:*" + "docker:*" + "fedora:*" + "python:*" + "ubuntu:*" + + "hashicorp/*:*" + "koalaman/shellcheck:*" + + "registry.gitlab.com/gitlab-org/*" + ]; + dockerAllowedServices = [ + "docker:*" + ]; + dockerPrivileged = true; }; }; }; @@ -161,5 +185,4 @@ in { docker.enable = true; oci-containers.backend = "docker"; }; - #users.users.gitlab-runner.extraGroups = [ "docker" ]; } From 2716e404c0210dded0afb60b3af921c14e93f1f7 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 22 Dec 2023 13:19:51 -0600 Subject: [PATCH 2/7] Gitlab tailscale IP recorded --- hosts/genesis/networking.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index bfe416a..2a4c621 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -26,6 +26,7 @@ let "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" "100.78.16.88 mm.home" "100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan" + "100.78.226.76 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" From 7dde6d256ad7f3a7fb890ea82c378add3f4e2c85 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 27 Dec 2023 20:27:38 -0600 Subject: [PATCH 3/7] CI running --- hosts/myself/container-git.nix | 53 +++++++++++-------- hosts/myself/container-runner-qemu.nix | 20 +++++-- hosts/myself/container-runner-vbox.nix | 16 ++++-- hosts/myself/git.nix | 47 +++++++++++++--- overlays/default.nix | 3 ++ secrets/gitlab/docker-auth.age | 22 ++++++++ secrets/gitlab/myself-podman-runner-reg.age | 44 +++++++-------- ...r-reg-1.age => myself-qemu-runner-reg.age} | 0 secrets/secrets.nix | 3 +- 9 files changed, 151 insertions(+), 57 deletions(-) create mode 100644 secrets/gitlab/docker-auth.age rename secrets/gitlab/{myself-qemu-runner-reg-1.age => myself-qemu-runner-reg.age} (100%) diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index 8ad7f5a..fae98e2 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -38,32 +38,11 @@ in { proxy_set_header X-Forwarded-Ssl on; ''; }; - services.nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { - listen = [ { - addr = vpnIp; - port = registryPort; - ssl = true; - } ]; - locations."/" = { - proxyPass = "http://127.0.0.1:5000/"; - recommendedProxySettings = true; - }; - extraConfig = builtins.concatStringsSep "\n" [ - "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" - "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" - ]; - }; - services.cron = { - enable = true; - systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; - }; greg.tailscale.enable = true; virtualisation.docker.enable = true; services = { - resolved.enable = true; - openssh.enable = true; gitlab = { enable = true; backup = { @@ -105,6 +84,29 @@ in { }; }; + nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { + listen = [ { + addr = vpnIp; + port = registryPort; + ssl = true; + } ]; + locations."/" = { + proxyPass = "http://127.0.0.1:5000/"; + recommendedProxySettings = true; + }; + extraConfig = builtins.concatStringsSep "\n" [ + "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" + "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" + "client_max_body_size 250m;" + ]; + }; + + # Fetch the SSL certificates for nginx to use + cron = { + enable = true; + systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; + }; + postgresql = { enable = true; checkConfig = true; @@ -124,6 +126,15 @@ in { redis.servers.gitlab = { enable = true; }; + resolved.enable = true; + openssh.enable = true; + }; + + # Do not start nginx until we have tailscaled up and running, so it can bind + # to the 100.* addresses + systemd.services.nginx = { + after = [ "tailscaled.service" ]; + requires = [ "tailscaled.service" ]; }; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix index e6b83de..db7597f 100644 --- a/hosts/myself/container-runner-qemu.nix +++ b/hosts/myself/container-runner-qemu.nix @@ -22,7 +22,7 @@ in { age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; age.secrets.qemu-runner-reg-1 = { file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age; - owner = "gitlab-runner"; + owner = "root"; }; networking.useHostResolvConf = pkgs.lib.mkForce false; @@ -40,9 +40,23 @@ in { tagList = [ "shell" "qemu" ]; }; }; + virtualisation.libvirtd = { + enable = true; + onBoot = "ignore"; + }; - systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ]; - systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + systemd.services = { + gitlab-runner = { + wants = [ "network-online.target" "systemd-resolved.service" ]; + after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + }; + libvirtd.serviceConfig = { + DevicePolicy = "auto"; + DeviceAllow = [ "/dev/kvm" "/dev/mem" ]; + PrivateDevices = false; + ProtectKernelModules = false; + }; + }; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix index fe53559..7b5ce8f 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner-vbox.nix @@ -1,4 +1,4 @@ -{ inputs, name, extra ? {} }: +{ inputs, name, extra ? {}, packages ? [] }: ({ config, pkgs, lib, ... }: let @@ -32,10 +32,11 @@ lib.attrsets.recursiveUpdate { py shellcheck unzip + xonsh xorriso vagrant wget - ]; + ] ++ packages; networking = { useHostResolvConf = pkgs.lib.mkForce false; @@ -61,8 +62,15 @@ lib.attrsets.recursiveUpdate { }; systemd.services.gitlab-runner = { - wants = [ "network-online.target" "systemd-resolved.service" ]; - after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; }; system.stateVersion = "24.05"; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index ad45bb3..bae55a5 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -59,8 +59,11 @@ in { ]; serviceConfig = { DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ "rmmod kvm_amd kvm" ]; - ExecPreStart = [ "modprobe kvm kvm_amd" ]; + ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ]; + ExecStartPre = [ + "${pkgs.kmod}/bin/modprobe kvm" + "${pkgs.kmod}/bin/modprobe kvm_amd" + ]; }; }; "container@gitlab-runner-vbox" = { @@ -69,8 +72,12 @@ in { ]; serviceConfig = { DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ]; - ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ]; + ExecStopPost = [ "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv" ]; + ExecStartPre = [ + "${pkgs.kmod}/bin/modprobe vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + "${pkgs.kmod}/bin/modprobe vboxnetflt" + ]; }; }; "container@gitlab".serviceConfig = { @@ -78,6 +85,7 @@ in { ProtectKernelModules = false; PrivateDevices = false; }; + gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path; }; ##################################################################################### @@ -89,13 +97,28 @@ in { hostPath = "/dev/kvm"; isReadOnly = false; }; + "/dev/mem" = { + hostPath = "/dev/mem"; + isReadOnly = false; + }; }; extraFlags = [ "--property=DeviceAllow=/dev/kvm" ]; hostAddress = "192.168.201.1"; localAddress = "192.168.201.2"; - config = ((import ./container-runner-qemu.nix) inputs); + config = ((import ./container-runner-vbox.nix) { + inherit inputs; + name = "qemu"; + packages = with pkgs; [ qemu_full qemu_kvm ]; + extra = { + virtualisation.libvirtd = { + enable = true; + onBoot = "ignore"; + package = pkgs.libvirt-greg; + }; + }; + }); }; ##################################################################################### @@ -132,6 +155,7 @@ in { enableHardening = false; headless = true; }; + networking.firewall.allowedTCPPorts = [ 18083 ]; # Should be interface for vboxweb }; }); }; @@ -153,14 +177,17 @@ in { #################### Local Podman/Docker Runner ##################################### ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; services.gitlab-runner = { enable = true; - settings.concurrent = 5; + settings = { + concurrent = 5; + }; services = { default = { executor = "docker"; registrationConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "fedora:39"; + dockerImage = "registry.thehellings.com/greg/ci-images/fedora"; dockerAllowedImages = [ "alpine:*" "debian:*" @@ -173,11 +200,17 @@ in { "koalaman/shellcheck:*" "registry.gitlab.com/gitlab-org/*" + "registry.thehellings.com/*" ]; dockerAllowedServices = [ "docker:*" + "registry.thehellings.com/*" ]; dockerPrivileged = true; + dockerVolumes = [ + "/certs/client" + "/cache" + ]; }; }; }; diff --git a/overlays/default.nix b/overlays/default.nix index ec7a7a0..b24197e 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -63,6 +63,9 @@ in rec { handbrake = prev.handbrake.override { libbluray = libbluray-custom; }; + libvirt-greg = prev.libvirt.overrideAttrs { + postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service"; + }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; diff --git a/secrets/gitlab/docker-auth.age b/secrets/gitlab/docker-auth.age new file mode 100644 index 0000000..38c1637 --- /dev/null +++ b/secrets/gitlab/docker-auth.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg QXPxLsHDv2J5RH8+UjtFMQo4yFdaNfuV6yD1KAz1Rxc +2ll7H/WKCI47w4oPL+9nOaWguHfDEc5Q6AmBHduGurE +-> ssh-ed25519 YJiRbw 8Ai1osukJoUNvAJ4zHGudZUxU/w9uiNdkSSjp8GTIGI +iHhF6rrDbB+PujlvHP2N5K4Zzc3R0jJ2851DJO/xx1g +-> ssh-ed25519 aY2AXA oiNt/hR1iC8sgXvB712J+fWNbFux7+uMEA4BNbobsik +Al83/ckzsB+YS9s7PkrsQy171fzQTJdhdlR7TTIfnCU +-> ssh-ed25519 Nl/5yA /LzefcwM2rezBx4wQmRXdKOkQpV1v0qcSonwY4C8FRI +w1irgyi4qfnumSE9bpaliYK0qjPh6gbufjJRVejjYwk +-> ssh-ed25519 GdLgCQ FX20+pHJNuGQcVXjA87j440vhLi7qfcuvNPHg/pT2hA +G/yNOLdwZ7+4xf60kC75gQuxW0Y603D3DodXGlrRfY8 +-> ssh-ed25519 tOH/HQ E9GVFDmP0GVJf78RkYae7TOl/An2V0kqvaC37yAz8mM +GI18IUsUWNk4dHqnrHAwpZSb5Kcz3Fp78y8lgO/29c4 +-> ssh-ed25519 FpzvfQ Xzp8i9u4O8hmutU397Fe0n1pxlB17Glyaii9p3H0gRU +/ppiXFk8ulxHdT1GGak5gSAPa7hm1tZfsOAiZVLRCwg +-> ssh-ed25519 kdPvzQ RolZ/ogYFdcY2beH/0N8pIr89JeKJpbplpULm8cDnGc +seuEqk/aubrxZ/+vFmW4VjtG7Mlbk6zbB9EWSyB6WZU +-> !5/_-grease +aIxpVrzd/gX7Zj8bDUCFAQAcaK4Xhoc2+27wt6bpexkuRacFCd1gjvXJG2LfLaGA +FkpsQoAktFhm6AzHLPXDPOPAw2e5aHNEqQ +--- xlcSP0mtqnMV4OL8J1CK/Rq/OKDxZDphNXbNx/nuwbQ +rEg*ȂnS5:'n/[TNyHU8[ajֆTncIR9ڰ8COBʅ*BHTpE ֤Ep<2ͥ&vہ.q z<66p2N:_(% '9@C \ No newline at end of file diff --git a/secrets/gitlab/myself-podman-runner-reg.age b/secrets/gitlab/myself-podman-runner-reg.age index 4037117..5b33569 100644 --- a/secrets/gitlab/myself-podman-runner-reg.age +++ b/secrets/gitlab/myself-podman-runner-reg.age @@ -1,22 +1,24 @@ age-encryption.org/v1 --> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI -zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4 --> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo -dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4 --> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM -wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0 --> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE -0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw --> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM -mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00 --> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc -Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo --> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk -Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4 --> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI -0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc --> =E!-grease uD%0 \!WY E@ )8GeC -jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM -q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw ---- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ -InT zG\TC3*Ț%clAɻn9T,v1UOl ౕ`pLW YRyZ8Zې,K"J3*" UM_=4kCuy \ No newline at end of file +-> ssh-ed25519 mOmPfg v6H/iYsxSharpYdE3zaQWwe4upObwg6SoqS2DHccEmQ +q89KCC+dsrPhz8k55s4tnLRddFpGEmKi6X8bixSzADI +-> ssh-ed25519 YJiRbw qqyTMJde1bZ1SueoOGOcFzyJT0HCk9vFVKDf2yyzjwI +g3bFCSRPWXiArnt2AIg0cEGyFueqKHEUtwo0GhZ8+Qs +-> ssh-ed25519 aY2AXA ulJXsgoZzBk4aMdJY5J5Z2+IvH+q4DFV9WSSsMmGP0U +g6oT0hwN7H0Ns0ZYIkHpo2xMjp6DCHgiAGj766TOA8w +-> ssh-ed25519 Nl/5yA SqmK8QCxKqu0w8ZpRsM7T+Osl22qMHAE17avW1CgWjU +IPFrLZk1/e4+h5DgiEjBHZis/Goftk8NL3JGBikfT3I +-> ssh-ed25519 GdLgCQ Hksz6e56bab8WaH7YcPu0P50UVbkPriAbB7k4OsY0xc +qHKzIoDAvAkwFtBU9jSVoYMrLeei+2XkmW2w0q6giZo +-> ssh-ed25519 tOH/HQ bQrB5zxKxlIt2SjIzq7aELT59XpAVZanmZakOimgVE0 +gtDbQGFWgs7eA1eYwSE7mWnKePDfD0tzcBTq5RwhjhM +-> ssh-ed25519 FpzvfQ 1u5GDj3/GLbCuYXYPdbCoS+gdEf2H5fB4IHs76r3U1I +gjM3BYBcX6Dzk82KikQWF47fvp9hkFpCQ3BvQcFSfnA +-> ssh-ed25519 kdPvzQ 8o47gHxb83pPErakkstW04h1MycsK/bAqBNfQnpolzU +ikG06kyazNW7GeEQmXBCNTnLs3zDg0o9/2eQ3FWh+fE +-> GwrHkr"-grease 5DqzJj W_O4EW +tVyYwwIGgkcsdyYLoHigZ2vfz4wAwNTk+kAVA9evxoN0q/DPq9OOoPqPvzEhcWc/ +IGl7UyexYDprXqAn1ph2VLkaHQ7oX4QXN0dvnC7lDo/vDFElRPDnW3ML+XzELIM +--- YUiM/kVJaOCRy/mu1VvlqiRTFn8WMgD9NAAGXwsqbWs +2x*5HAuߚU'%{N7ӯfE +LKQ;f5*N Fn'k(ý[]OޗIͽ]ٖ +dtXQ'/p"!.w43F|8mf$>  90x ҒLͨNd1f[d᜞9A?󬥊l\MHIنH4TuN|"ZѬ8[ 3 :YBpUK_%TQP[E%vgIE׺pi \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-1.age b/secrets/gitlab/myself-qemu-runner-reg.age similarity index 100% rename from secrets/gitlab/myself-qemu-runner-reg-1.age rename to secrets/gitlab/myself-qemu-runner-reg.age diff --git a/secrets/secrets.nix b/secrets/secrets.nix index d71e864..ee8c668 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,9 +49,10 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; - "gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; "gitlab/myself-vmware-runner-reg.age".publicKeys = everyone; + "gitlab/docker-auth.age".publicKeys = everyone; } From 5955faa0e21e355f13b472909c6bd0c146ffe507 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 27 Dec 2023 20:29:34 -0600 Subject: [PATCH 4/7] Remove unused file --- hosts/myself/container-runner-qemu.nix | 62 ------------------- ...r-runner-vbox.nix => container-runner.nix} | 0 hosts/myself/git.nix | 6 +- 3 files changed, 3 insertions(+), 65 deletions(-) delete mode 100644 hosts/myself/container-runner-qemu.nix rename hosts/myself/{container-runner-vbox.nix => container-runner.nix} (100%) diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix deleted file mode 100644 index db7597f..0000000 --- a/hosts/myself/container-runner-qemu.nix +++ /dev/null @@ -1,62 +0,0 @@ -inputs: -{ config, pkgs, ... }: -let - extraPackages = with pkgs; [ - curl - gawk - git - packer - pup - (python3.withPackages (p: with p; [ pip pyyaml virtualenv ])) - qemu_full - qemu_kvm - shellcheck - vagrant - xonsh - xorriso - ]; -in { - imports = [ - inputs.agenix.nixosModules.default - ]; - age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secrets.qemu-runner-reg-1 = { - file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age; - owner = "root"; - }; - - networking.useHostResolvConf = pkgs.lib.mkForce false; - networking.nameservers = [ "100.100.100.100" ]; - services.resolved.enable = true; - - environment.systemPackages = extraPackages; - - services.gitlab-runner = { - enable = true; - settings.concurrent = 5; - services.shell = { - executor = "shell"; - registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path; - tagList = [ "shell" "qemu" ]; - }; - }; - virtualisation.libvirtd = { - enable = true; - onBoot = "ignore"; - }; - - systemd.services = { - gitlab-runner = { - wants = [ "network-online.target" "systemd-resolved.service" ]; - after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; - }; - libvirtd.serviceConfig = { - DevicePolicy = "auto"; - DeviceAllow = [ "/dev/kvm" "/dev/mem" ]; - PrivateDevices = false; - ProtectKernelModules = false; - }; - }; - - system.stateVersion = "24.05"; -} diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner.nix similarity index 100% rename from hosts/myself/container-runner-vbox.nix rename to hosts/myself/container-runner.nix diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index bae55a5..d278b2a 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -107,7 +107,7 @@ in { ]; hostAddress = "192.168.201.1"; localAddress = "192.168.201.2"; - config = ((import ./container-runner-vbox.nix) { + config = ((import ./container-runner.nix) { inherit inputs; name = "qemu"; packages = with pkgs; [ qemu_full qemu_kvm ]; @@ -141,7 +141,7 @@ in { }; hostAddress = "192.168.202.1"; localAddress = "192.168.202.2"; - config = ((import ./container-runner-vbox.nix) { + config = ((import ./container-runner.nix) { inherit inputs; name = "vbox"; extra = { @@ -167,7 +167,7 @@ in { autoStart = true; hostAddress = "192.168.203.1"; localAddress = "192.168.203.2"; - config = ((import ./container-runner-vbox.nix) { + config = ((import ./container-runner.nix) { inherit inputs; name = "shell"; }); From ebe40eee452a6e60d3e4f1ca0f6ac90a8a63b515 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 29 Dec 2023 22:40:23 -0600 Subject: [PATCH 5/7] Add smart.thehellings.lan proxy --- hosts/genesis/home-assistant.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index e58acb2..2ba4f4e 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -76,6 +76,7 @@ in greg.proxies = { "smart.home".target = "http://127.0.0.1:8123/"; + "smart.thehellings.lan".target = "http://127.0.0.1:8123/"; "zwave.home".target = "http://127.0.0.1:8091/"; }; From 5dad72c5cdf3bf363a83c45cbdb0ce16d5c7b4ff Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 29 Dec 2023 23:36:40 -0600 Subject: [PATCH 6/7] Move modules to shared --- configuration.nix | 3 +-- darwin/default.nix | 3 +-- flake.nix | 3 --- hosts/default.nix | 3 +-- hosts/myself/container-git.nix | 16 ++++++++++++---- hosts/myself/git.nix | 1 + {modules-all => modules}/ci-runner.nix | 0 {modules-darwin => modules/darwin}/default.nix | 0 {modules-all => modules}/default.nix | 7 ++++++- {modules-linux => modules/linux}/backup.nix | 0 {modules-linux => modules/linux}/default.nix | 0 {modules-linux => modules/linux}/gnome.nix | 0 {modules-linux => modules/linux}/home.nix | 0 {modules-linux => modules/linux}/kde.nix | 0 {modules-linux => modules/linux}/kiwix-serve.nix | 0 {modules-linux => modules/linux}/linode.nix | 0 {modules-linux => modules/linux}/linux.nix | 0 {modules-linux => modules/linux}/proxy.nix | 0 {modules-linux => modules/linux}/router.nix | 0 {modules-linux => modules/linux}/rpi4.nix | 0 {modules-linux => modules/linux}/tailscale.nix | 0 21 files changed, 22 insertions(+), 14 deletions(-) rename {modules-all => modules}/ci-runner.nix (100%) rename {modules-darwin => modules/darwin}/default.nix (100%) rename {modules-all => modules}/default.nix (85%) rename {modules-linux => modules/linux}/backup.nix (100%) rename {modules-linux => modules/linux}/default.nix (100%) rename {modules-linux => modules/linux}/gnome.nix (100%) rename {modules-linux => modules/linux}/home.nix (100%) rename {modules-linux => modules/linux}/kde.nix (100%) rename {modules-linux => modules/linux}/kiwix-serve.nix (100%) rename {modules-linux => modules/linux}/linode.nix (100%) rename {modules-linux => modules/linux}/linux.nix (100%) rename {modules-linux => modules/linux}/proxy.nix (100%) rename {modules-linux => modules/linux}/router.nix (100%) rename {modules-linux => modules/linux}/rpi4.nix (100%) rename {modules-linux => modules/linux}/tailscale.nix (100%) diff --git a/configuration.nix b/configuration.nix index 622e0db..1944e5c 100644 --- a/configuration.nix +++ b/configuration.nix @@ -8,8 +8,7 @@ imports = [ # Include the results of the hardware scan. ./hardware-configuration.nix - ./modules-all/ - ./modules-linux/ + ./modules/ ]; # Bootloader. diff --git a/darwin/default.nix b/darwin/default.nix index 8ff0ba7..f693ae1 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -31,8 +31,7 @@ let }; users.users."gregory.hellings".home = "/Users/gregory.hellings"; } - ../modules-all - ../modules-darwin + ../modules ./${name} ] ++ extraMods; }; diff --git a/flake.nix b/flake.nix index e309825..2920e92 100644 --- a/flake.nix +++ b/flake.nix @@ -84,9 +84,6 @@ })); overlays = { default = local_overlay; }; - modules = (import ./modules-all {}) // - (import ./modules-linux {}) // - (import ./modules-darwin {}); packages = (import ./overlays/packages.nix { inherit nixunstable flake-utils; }); }; } diff --git a/hosts/default.nix b/hosts/default.nix index ee0e65a..0954582 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -35,8 +35,7 @@ let } inputs.agenix.nixosModules.default hm.nixosModules.home-manager - ../modules-all - ../modules-linux + ../modules ./${name} ] ++ extraMods; }; diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index fae98e2..364ab5c 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -6,8 +6,8 @@ in { imports = [ inputs.agenix.nixosModules.default - ../../modules-linux/proxy.nix - ../../modules-linux/tailscale.nix + ../../modules/linux/proxy.nix + ../../modules/linux/tailscale.nix ]; age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; @@ -133,8 +133,16 @@ in { # Do not start nginx until we have tailscaled up and running, so it can bind # to the 100.* addresses systemd.services.nginx = { - after = [ "tailscaled.service" ]; - requires = [ "tailscaled.service" ]; + after = [ + "tailscaled.service" + "network.target" + "network-online.target" + ]; + wants = [ + "tailscaled.service" + "network.target" + "network-online.target" + ]; }; system.stateVersion = "24.05"; } diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index d278b2a..3b638e1 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -217,5 +217,6 @@ in { virtualisation = { docker.enable = true; oci-containers.backend = "docker"; + virtualbox.host.enable = true; }; } diff --git a/modules-all/ci-runner.nix b/modules/ci-runner.nix similarity index 100% rename from modules-all/ci-runner.nix rename to modules/ci-runner.nix diff --git a/modules-darwin/default.nix b/modules/darwin/default.nix similarity index 100% rename from modules-darwin/default.nix rename to modules/darwin/default.nix diff --git a/modules-all/default.nix b/modules/default.nix similarity index 85% rename from modules-all/default.nix rename to modules/default.nix index 68a1f9b..70fac9a 100644 --- a/modules-all/default.nix +++ b/modules/default.nix @@ -1,9 +1,14 @@ { pkgs, lib, ... }: +let + inherit (lib.strings) hasSuffix; + system = pkgs.system; in { imports = [ ./ci-runner.nix - ]; + ] + ++ (if (lib.strings.hasSuffix "darwin" "nope") then [./darwin] else []) + ++ (if (lib.strings.hasSuffix "linux" "linux") then [./linux] else []); # Enable flakes nix = { diff --git a/modules-linux/backup.nix b/modules/linux/backup.nix similarity index 100% rename from modules-linux/backup.nix rename to modules/linux/backup.nix diff --git a/modules-linux/default.nix b/modules/linux/default.nix similarity index 100% rename from modules-linux/default.nix rename to modules/linux/default.nix diff --git a/modules-linux/gnome.nix b/modules/linux/gnome.nix similarity index 100% rename from modules-linux/gnome.nix rename to modules/linux/gnome.nix diff --git a/modules-linux/home.nix b/modules/linux/home.nix similarity index 100% rename from modules-linux/home.nix rename to modules/linux/home.nix diff --git a/modules-linux/kde.nix b/modules/linux/kde.nix similarity index 100% rename from modules-linux/kde.nix rename to modules/linux/kde.nix diff --git a/modules-linux/kiwix-serve.nix b/modules/linux/kiwix-serve.nix similarity index 100% rename from modules-linux/kiwix-serve.nix rename to modules/linux/kiwix-serve.nix diff --git a/modules-linux/linode.nix b/modules/linux/linode.nix similarity index 100% rename from modules-linux/linode.nix rename to modules/linux/linode.nix diff --git a/modules-linux/linux.nix b/modules/linux/linux.nix similarity index 100% rename from modules-linux/linux.nix rename to modules/linux/linux.nix diff --git a/modules-linux/proxy.nix b/modules/linux/proxy.nix similarity index 100% rename from modules-linux/proxy.nix rename to modules/linux/proxy.nix diff --git a/modules-linux/router.nix b/modules/linux/router.nix similarity index 100% rename from modules-linux/router.nix rename to modules/linux/router.nix diff --git a/modules-linux/rpi4.nix b/modules/linux/rpi4.nix similarity index 100% rename from modules-linux/rpi4.nix rename to modules/linux/rpi4.nix diff --git a/modules-linux/tailscale.nix b/modules/linux/tailscale.nix similarity index 100% rename from modules-linux/tailscale.nix rename to modules/linux/tailscale.nix From 585c4d0f4c75a46ffedf906e621d6dcd3bb99a51 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sat, 30 Dec 2023 00:04:51 -0600 Subject: [PATCH 7/7] Add direct registry access name --- hosts/myself/git.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 3b638e1..32d1bdd 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -187,7 +187,7 @@ in { default = { executor = "docker"; registrationConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "registry.thehellings.com/greg/ci-images/fedora"; + dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; dockerAllowedImages = [ "alpine:*" "debian:*" @@ -201,10 +201,12 @@ in { "registry.gitlab.com/gitlab-org/*" "registry.thehellings.com/*" + "gitlab.shire-zebra.ts.net:5000/*:*" ]; dockerAllowedServices = [ "docker:*" "registry.thehellings.com/*" + "gitlab.shire-zebra.ts.net:5000/*:*" ]; dockerPrivileged = true; dockerVolumes = [