Merge branch 'main' of gh:greg-hellings/nixos-config

configuration.nix

@@ -8,8 +8,7 @@
   imports =
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ./modules-all/
+      ./modules/
-      ./modules-linux/
     ];
 
   # Bootloader.

darwin/default.nix

@@ -31,8 +31,7 @@ let
 				};
 				users.users."gregory.hellings".home = "/Users/gregory.hellings";
 			}
-			../modules-all
+			../modules
-			../modules-darwin
 			./${name}
 		] ++ extraMods;
 	};

flake.nix

@@ -85,9 +85,6 @@
 		}));
 
 		overlays = { default = local_overlay; };
-		modules = (import ./modules-all {}) //
-		          (import ./modules-linux {}) //
-		          (import ./modules-darwin {});
 		packages = (import ./overlays/packages.nix { inherit nixunstable flake-utils; });
 	};
 }

hosts/default.nix

@@ -35,8 +35,7 @@ let
 			}
 			inputs.agenix.nixosModules.default
 			hm.nixosModules.home-manager
-			../modules-all
+			../modules
-			../modules-linux
 			./${name}
 		] ++ extraMods;
 	};

hosts/genesis/home-assistant.nix

@@ -76,6 +76,7 @@ in
 
 	greg.proxies = {
 		"smart.home".target = "http://127.0.0.1:8123/";
+		"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
 		"zwave.home".target = "http://127.0.0.1:8091/";
 	};
 

hosts/genesis/networking.nix

@@ -26,6 +26,7 @@ let
 		"100.88.91.27 genesis.home jellyfin.home smart.home zwave.home"
 		"100.78.16.88 mm.home"
 		"100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan"
+		"100.78.226.76 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan"
 
 		# Dev hosts
 		"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"

hosts/myself/container-git.nix

@@ -1,8 +1,13 @@
-{ inputs, registryPort, ...}:
+{ inputs, ...}:
-{ config, pkgs, lib, ... }: {
+{ config, pkgs, lib, ... }: let
+	registryPort = 5000;
+	vpnIp = "100.78.226.76";
+	containerIp = "192.168.200.2";
+in {
 	imports = [
 		inputs.agenix.nixosModules.default
-		../../modules-linux/proxy.nix
+		../../modules/linux/proxy.nix
+		../../modules/linux/tailscale.nix
 	];
 
 	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
@@ -26,17 +31,18 @@
 		useHostResolvConf = lib.mkForce false;
 	};
 
-	greg.proxies."192.168.200.2" = {
+	greg.proxies."${containerIp}" = {
 		target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
 		extraConfig = ''
 		proxy_set_header X-Forwarded-Proto https;
 		proxy_set_header X-Forwarded-Ssl on;
 		'';
 	};
+	greg.tailscale.enable = true;
+
+	virtualisation.docker.enable = true;
 
 	services = {
-		resolved.enable = true;
-		openssh.enable = true;
 		gitlab = {
 			enable = true;
 			backup = {
@@ -67,7 +73,8 @@
 				enable = true;
 				certFile = config.age.secrets.gitlab-cert.path;
 				keyFile = config.age.secrets.gitlab-key.path;
-				externalPort = registryPort;
+				externalAddress = "registry.thehellings.com";
+				externalPort = 443;
 			};
 			secrets = {
 				secretFile = config.age.secrets.gitlab-secret.path;
@@ -77,6 +84,29 @@
 			};
 		};
 
+		nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
+			listen = [ {
+				addr = vpnIp;
+				port = registryPort;
+				ssl = true;
+			} ];
+			locations."/" = {
+				proxyPass = "http://127.0.0.1:5000/";
+				recommendedProxySettings = true;
+			};
+			extraConfig = builtins.concatStringsSep "\n" [
+				"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
+				"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
+				"client_max_body_size 250m;"
+			];
+		};
+
+		# Fetch the SSL certificates for nginx to use
+		cron = {
+			enable = true;
+			systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
+		};
+
 		postgresql = {
 			enable = true;
 			checkConfig = true;
@@ -96,6 +126,23 @@
 		redis.servers.gitlab = {
 			enable = true;
 		};
+		resolved.enable = true;
+		openssh.enable = true;
+	};
+
+	# Do not start nginx until we have tailscaled up and running, so it can bind
+	# to the 100.* addresses
+	systemd.services.nginx = {
+		after = [
+			"tailscaled.service"
+			"network.target"
+			"network-online.target"
+		];
+		wants = [
+			"tailscaled.service"
+			"network.target"
+			"network-online.target"
+		];
 	};
 	system.stateVersion = "24.05";
 }

hosts/myself/container-runner-qemu.nix

@@ -1,47 +0,0 @@
-inputs:
-{ config, pkgs, ... }:
-let
-	extraPackages = with pkgs; [
-		curl
-		gawk
-		git
-		packer
-		pup
-		(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
-		qemu_full
-		qemu_kvm
-		shellcheck
-		xonsh
-		xorriso
-	];
-in {
-	imports = [
-		inputs.agenix.nixosModules.default
-	];
-	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-	age.secrets.qemu-runner-reg-1 = {
-		file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age;
-		owner = "gitlab-runner";
-	};
-
-	networking.useHostResolvConf = pkgs.lib.mkForce false;
-	networking.nameservers = [ "100.100.100.100" ];
-	services.resolved.enable = true;
-
-	environment.systemPackages = extraPackages;
-
-	services.gitlab-runner = {
-		enable = true;
-		settings.concurrent = 5;
-		services.shell = {
-			executor = "shell";
-			registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path;
-			tagList = [ "shell" "qemu" ];
-		};
-	};
-
-	systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ];
-	systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
-
-	system.stateVersion = "24.05";
-}

hosts/myself/container-runner.nix

@@ -1,4 +1,4 @@
-{ inputs, name, extra ? {} }:
+{ inputs, name, extra ? {}, packages ? [] }:
 
 ({ config, pkgs, lib, ... }:
 let
@@ -32,9 +32,11 @@ lib.attrsets.recursiveUpdate {
 		py
 		shellcheck
 		unzip
+		xonsh
 		xorriso
+		vagrant
 		wget
-	];
+	] ++ packages;
 
 	networking = {
 		useHostResolvConf = pkgs.lib.mkForce false;
@@ -60,8 +62,15 @@ lib.attrsets.recursiveUpdate {
 	};
 
 	systemd.services.gitlab-runner = {
-		wants = [ "network-online.target" "systemd-resolved.service" ];
+		wants = [
-		after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
+			"network-online.target"
+			"systemd-resolved.service"
+		];
+		after = [
+			"network.target"
+			"network-online.target"
+			"systemd-resolved.service"
+		];
 	};
 
 	system.stateVersion = "24.05";

hosts/myself/git.nix

@@ -4,8 +4,6 @@ let
 
 	gitlabStateDir = "/var/lib/gitlab";
 
-	registryPort = 8001;
-
 	container = input: (lib.attrsets.recursiveUpdate {
 		bindMounts."/etc/ssh".hostPath = "/etc/ssh";  # For agenix secrets
 		privateNetwork = true;
@@ -14,7 +12,7 @@ in  {
 	networking = {
 		firewall = {
 			enable = true;
-			allowedTCPPorts = [ 80 registryPort ];
+			allowedTCPPorts = [ 80 ];
 		};
 		nat = {
 			enable = true;
@@ -40,6 +38,10 @@ in  {
 				hostPath = gitlabStateDir;
 				isReadOnly = false;
 			};
+			"/dev/net/tun" = {
+				hostPath = "/dev/net/tun";
+				isReadOnly = false;
+			};
 		};
 		forwardPorts = [{
 			hostPort = 2222;
@@ -47,7 +49,7 @@ in  {
 		}];
 		hostAddress = "192.168.200.1";
 		localAddress = "192.168.200.2";
-		config = ((import ./container-git.nix) { inherit inputs registryPort; });
+		config = ((import ./container-git.nix) { inherit inputs; });
 	};
 
 	systemd.services = {
@@ -57,8 +59,11 @@ in  {
 			];
 			serviceConfig = {
 				DevicePolicy = lib.mkForce "auto";
-				ExecPostStop = [ "rmmod kvm_amd kvm" ];
+				ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ];
-				ExecPreStart = [ "modprobe kvm" ];
+				ExecStartPre = [
+					"${pkgs.kmod}/bin/modprobe kvm"
+					"${pkgs.kmod}/bin/modprobe kvm_amd"
+				];
 			};
 		};
 		"container@gitlab-runner-vbox" = {
@@ -67,10 +72,20 @@ in  {
 			];
 			serviceConfig = {
 				DevicePolicy = lib.mkForce "auto";
-				ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ];
+				ExecStopPost = [ "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv" ];
-				ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
+				ExecStartPre = [
+					"${pkgs.kmod}/bin/modprobe vboxdrv"
+					"${pkgs.kmod}/bin/modprobe vboxnetadp"
+					"${pkgs.kmod}/bin/modprobe vboxnetflt"
+				];
 			};
 		};
+		"container@gitlab".serviceConfig = {
+			DeviceAllow = [ "/dev/net/tun" ];
+			ProtectKernelModules = false;
+			PrivateDevices = false;
+		};
+		gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
 	};
 
 	#####################################################################################
@@ -82,13 +97,28 @@ in  {
 				hostPath = "/dev/kvm";
 				isReadOnly = false;
 			};
+			"/dev/mem" = {
+				hostPath = "/dev/mem";
+				isReadOnly = false;
+			};
 		};
 		extraFlags = [
 			"--property=DeviceAllow=/dev/kvm"
 		];
 		hostAddress = "192.168.201.1";
 		localAddress = "192.168.201.2";
-		config = ((import ./container-runner-qemu.nix) inputs);
+		config = ((import ./container-runner.nix) {
+			inherit inputs;
+			name = "qemu";
+			packages = with pkgs; [ qemu_full qemu_kvm ];
+			extra = {
+				virtualisation.libvirtd = {
+					enable = true;
+					onBoot = "ignore";
+					package = pkgs.libvirt-greg;
+				};
+			};
+		});
 	};
 
 	#####################################################################################
@@ -111,7 +141,7 @@ in  {
 		};
 		hostAddress = "192.168.202.1";
 		localAddress = "192.168.202.2";
-		config = ((import ./container-runner-vbox.nix) {
+		config = ((import ./container-runner.nix) {
 			inherit inputs;
 			name = "vbox";
 			extra = {
@@ -125,6 +155,7 @@ in  {
 					enableHardening = false;
 					headless = true;
 				};
+				networking.firewall.allowedTCPPorts = [ 18083 ];  # Should be interface for vboxweb
 			};
 		});
 	};
@@ -136,7 +167,7 @@ in  {
 		autoStart = true;
 		hostAddress = "192.168.203.1";
 		localAddress = "192.168.203.2";
-		config = ((import ./container-runner-vbox.nix) {
+		config = ((import ./container-runner.nix) {
 			inherit inputs;
 			name = "shell";
 		});
@@ -146,20 +177,48 @@ in  {
 	#################### Local Podman/Docker Runner #####################################
 	#####################################################################################
 	age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
+	age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
 	services.gitlab-runner = {
-		enable = false;
+		enable = true;
-		settings.concurrent = 5;
+		settings = {
+			concurrent = 5;
+		};
 		services = {
 			default = {
 				executor = "docker";
 				registrationConfigFile = config.age.secrets.runner-reg.path;
-				dockerImage = "debian:stable";
+				dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
+				dockerAllowedImages = [
+					"alpine:*"
+					"debian:*"
+					"docker:*"
+					"fedora:*"
+					"python:*"
+					"ubuntu:*"
+
+					"hashicorp/*:*"
+					"koalaman/shellcheck:*"
+
+					"registry.gitlab.com/gitlab-org/*"
+					"registry.thehellings.com/*"
+					"gitlab.shire-zebra.ts.net:5000/*:*"
+				];
+				dockerAllowedServices = [
+					"docker:*"
+					"registry.thehellings.com/*"
+					"gitlab.shire-zebra.ts.net:5000/*:*"
+				];
+				dockerPrivileged = true;
+				dockerVolumes = [
+					"/certs/client"
+					"/cache"
+				];
 			};
 		};
 	};
 	virtualisation = {
 		docker.enable = true;
 		oci-containers.backend = "docker";
+		virtualbox.host.enable = true;
 	};
-	#users.users.gitlab-runner.extraGroups = [ "docker" ];
 }

modules/default.nix

@@ -1,9 +1,14 @@
 { pkgs, lib, ... }:
 
+let
+	inherit (lib.strings) hasSuffix;
+	system = pkgs.system; in
 {
 	imports = [
 		./ci-runner.nix
-	];
+	]
+	++ (if (lib.strings.hasSuffix "darwin" "nope") then [./darwin] else [])
+	++ (if (lib.strings.hasSuffix "linux" "linux") then [./linux] else []);
 
 	# Enable flakes
 	nix = {

overlays/default.nix

@@ -65,6 +65,9 @@ in rec {
 	handbrake = prev.handbrake.override {
 		libbluray = libbluray-custom;
 	};
+	libvirt-greg = prev.libvirt.overrideAttrs {
+		postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service";
+	};
 	pipenv-ivr = prev.callPackage ./pipenv.nix { };
 
 	xonsh = prev.xonsh.overridePythonAttrs (old: rec{

secrets/gitlab/docker-auth.age

@@ -0,0 +1,22 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg QXPxLsHDv2J5RH8+UjtFMQo4yFdaNfuV6yD1KAz1Rxc
+2ll7H/WKCI47w4oPL+9nOaWguHfDEc5Q6AmBHduGurE
+-> ssh-ed25519 YJiRbw 8Ai1osukJoUNvAJ4zHGudZUxU/w9uiNdkSSjp8GTIGI
+iHhF6rrDbB+PujlvHP2N5K4Zzc3R0jJ2851DJO/xx1g
+-> ssh-ed25519 aY2AXA oiNt/hR1iC8sgXvB712J+fWNbFux7+uMEA4BNbobsik
+Al83/ckzsB+YS9s7PkrsQy171fzQTJdhdlR7TTIfnCU
+-> ssh-ed25519 Nl/5yA /LzefcwM2rezBx4wQmRXdKOkQpV1v0qcSonwY4C8FRI
+w1irgyi4qfnumSE9bpaliYK0qjPh6gbufjJRVejjYwk
+-> ssh-ed25519 GdLgCQ FX20+pHJNuGQcVXjA87j440vhLi7qfcuvNPHg/pT2hA
+G/yNOLdwZ7+4xf60kC75gQuxW0Y603D3DodXGlrRfY8
+-> ssh-ed25519 tOH/HQ E9GVFDmP0GVJf78RkYae7TOl/An2V0kqvaC37yAz8mM
+GI18IUsUWNk4dHqnrHAwpZSb5Kcz3Fp78y8lgO/29c4
+-> ssh-ed25519 FpzvfQ Xzp8i9u4O8hmutU397Fe0n1pxlB17Glyaii9p3H0gRU
+/ppiXFk8ulxHdT1GGak5gSAPa7hm1tZfsOAiZVLRCwg
+-> ssh-ed25519 kdPvzQ RolZ/ogYFdcY2beH/0N8pIr89JeKJpbplpULm8cDnGc
+seuEqk/aubrxZ/+vFmW4VjtG7Mlbk6zbB9EWSyB6WZU
+-> !5/_-grease
+aIxpVrzd/gX7Zj8bDUCFAQAcaK4Xhoc2+27wt6bpexkuRacFCd1gjvXJG2LfLaGA
+FkpsQoAktFhm6AzHLPXDPOPAw2e5aHNEqQ
+--- xlcSP0mtqnMV4OL8J1CK/Rq/OKDxZDphNXbNx/nuwbQ
+£rEg*‚ÀÈ‚n°ðSªµ5ØÅ:ÁØ'n’/Ê[ŒTNÔyú‘HåUÁþ8¥àþ[ají‡×úÖ†ŽTnc°IR9Ú°8³C“ÁO«ÕB›ÕÍÊ…Ñ*BÛêHTpýâØø¼EÁÖ¤E‚p<�â2�Í¥&§ŒvÛ�.œq—␍�z<�66p2Nžˆ:€äâ_(%	'9ÀŸ³ûœí¼@¯ÈC

secrets/gitlab/myself-podman-runner-reg.age

@@ -1,22 +1,24 @@
 age-encryption.org/v1
--> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI
+-> ssh-ed25519 mOmPfg v6H/iYsxSharpYdE3zaQWwe4upObwg6SoqS2DHccEmQ
-zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4
+q89KCC+dsrPhz8k55s4tnLRddFpGEmKi6X8bixSzADI
--> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo
+-> ssh-ed25519 YJiRbw qqyTMJde1bZ1SueoOGOcFzyJT0HCk9vFVKDf2yyzjwI
-dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4
+g3bFCSRPWXiArnt2AIg0cEGyFueqKHEUtwo0GhZ8+Qs
--> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM
+-> ssh-ed25519 aY2AXA ulJXsgoZzBk4aMdJY5J5Z2+IvH+q4DFV9WSSsMmGP0U
-wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0
+g6oT0hwN7H0Ns0ZYIkHpo2xMjp6DCHgiAGj766TOA8w
--> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE
+-> ssh-ed25519 Nl/5yA SqmK8QCxKqu0w8ZpRsM7T+Osl22qMHAE17avW1CgWjU
-0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw
+IPFrLZk1/e4+h5DgiEjBHZis/Goftk8NL3JGBikfT3I
--> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM
+-> ssh-ed25519 GdLgCQ Hksz6e56bab8WaH7YcPu0P50UVbkPriAbB7k4OsY0xc
-mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00
+qHKzIoDAvAkwFtBU9jSVoYMrLeei+2XkmW2w0q6giZo
--> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc
+-> ssh-ed25519 tOH/HQ bQrB5zxKxlIt2SjIzq7aELT59XpAVZanmZakOimgVE0
-Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo
+gtDbQGFWgs7eA1eYwSE7mWnKePDfD0tzcBTq5RwhjhM
--> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk
+-> ssh-ed25519 FpzvfQ 1u5GDj3/GLbCuYXYPdbCoS+gdEf2H5fB4IHs76r3U1I
-Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4
+gjM3BYBcX6Dzk82KikQWF47fvp9hkFpCQ3BvQcFSfnA
--> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI
+-> ssh-ed25519 kdPvzQ 8o47gHxb83pPErakkstW04h1MycsK/bAqBNfQnpolzU
-0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc
+ikG06kyazNW7GeEQmXBCNTnLs3zDg0o9/2eQ3FWh+fE
--> =E!-grease uD%0 \!WY E@ )8GeC
+-> GwrHkr"-grease 5DqzJj W_O4EW
-jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM
+tVyYwwIGgkcsdyYLoHigZ2vfz4wAwNTk+kAVA9evxoN0q/DPq9OOoPqPvzEhcWc/
-q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw
+IGl7UyexYDprXqAn1ph2VLkaHQ7oX4QXN0dvnC7lDo/vDFElRPDnW3ML+XzELIM
---- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ
+--- YUiM/kVJaOCRy/mu1VvlqiRTFn8WMgD9NAAGXwsqbWs
-IúnïT zG\TC–3*€ÈšÂ%â¹âcl…âAÉ»úýn9ÎóÜT¹,v â1¸”³êUO¸Èl ùµà±•Ö`p®ùLÚûW␍YRþyZ8ZÛ�,·ÉK"¦J3*ã"¸	UM_=4¥k÷C

ýu¡îy
+2©x¬*5æ¢HA†u­‚Æô¦ßšU'ä%{N¬£�7Ó¯fEˆ
+LKŒ‰Qò;f€5ä*ì‡Näð␍�ÓFn'k(¹îý[àûå…]ÇOÞ—ËIͽ]Ù–
+dtXQ
ô'¶/pÁ"!Ê.èw4›¾3F|8ë¾mf$Š¨>  ’9¹Ø0x™±Ò’Lè·Í¨N”©d1„f[Áùd᜞
9A•„—É?Ý󬥊øló\½²M©HIÙ†„HÝ4ŸTuëÅN¸�|†"ÉZѬ8É[3␍˜÷:YBÆpUÏK·_™%ÉþTáQP÷[Eé%úv•gIÃE
þ׺“ÕâßÌpªèôiû␍¡

secrets/secrets.nix

@@ -49,9 +49,10 @@ in
 	# Then pipe the resulting files to agenix -e <foo>
 	"gitlab/key.age".publicKeys = everyone;
 	"gitlab/cert.age".publicKeys = everyone;
-	"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-shell-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-vmware-runner-reg.age".publicKeys = everyone;
+	"gitlab/docker-auth.age".publicKeys = everyone;
 }