fix for Genesis and Isaiah

Get gitea-actions running on Isaiah
Fix adblock upate on Genesis

hosts/genesis/adblockUpdate.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
-curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
-
-# Custom domains that I need to preserve for some reason
-for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do
-	sed -i -e "/${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
-done
-
-systemctl restart dnsmasq

hosts/genesis/default.nix

@@ -2,8 +2,29 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
+let
+  adblockUpdate = pkgs.writeShellApplication {
+    name = "adblock-update";
+    runtimeInputs = with pkgs; [
+      curl
+      gnused
+      systemd
+    ];
+    text = ''
+      curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
+      curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
+
+      # Custom domains that I need to preserve for some reason
+      for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do
+       	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
+      done
+
+      systemctl restart dnsmasq
+    '';
+  };
+in
 {
   imports = [
     # Include the results of the hardware scan.
@@ -36,4 +57,20 @@
   ];
 
   networking.hostName = "genesis"; # Define your hostname.
+
+  systemd = {
+    services.adblock-update = {
+      after = [ "network-online.target" ];
+      script = lib.getExe adblockUpdate;
+      serviceConfig.Type = "oneshot";
+    };
+    timers.adblock-update = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Unit = "adblock-update.service";
+      };
+    };
+  };
 }

hosts/genesis/networking.nix

@@ -12,7 +12,6 @@ let
   routerIP = metadata.infra.gw;
   extraHosts = builtins.readFile ./net/hosts;
 
-  adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
   proxyPort = 3128;
   dnsPort = 53;
   dhcpPort = 67;
@@ -111,19 +110,8 @@ in
       };
     };
 
-    # Update adblock list
-    cron = {
-      enable = true;
-      systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ];
-    };
-
     prometheus.exporters = {
       dnsmasq.enable = true;
-      kea = {
-        enable = true;
-        openFirewall = true;
-        targets = [ (builtins.head config.services.kea.dhcp4.settings.control-sockets).socket-name ];
-      };
     };
   }; # End of services configuration
 

hosts/isaiah/default.nix

@@ -10,6 +10,7 @@
   ];
 
   age.secrets = {
+    gitea-runner-isaiah-podman.file = ../../secrets/gitea/runner-isaiah-podman.age;
     gitea-workerPassword.file = ../../secrets/gitea/workerPassword.age;
     runner-reg.file = ../../secrets/gitlab/kubernetes-k3s-local.age;
   };
@@ -41,6 +42,7 @@
       vip = metadata.hosts.${config.networking.hostName}.ip;
       priority = 255;
     };
+    podman.enable = true;
     tailscale = {
       enable = true;
       tags = [ "home" ];
@@ -72,6 +74,37 @@
   };
 
   services = {
+    gitea-actions-runner.instances.podman = {
+      enable = true;
+      labels = [
+        "debian-latest:docker://node:25-trixie"
+
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
+
+        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+
+        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
+        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
+
+        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
+        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
+
+        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
+      ];
+      name = "isaiah-podman";
+      tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
+      url = "https://gitea.shire-zebra.ts.net";
+    };
     k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;

network.json

@@ -19,7 +19,7 @@
     "genesis": {
       "ip": "10.42.1.5",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/CGE2rqlL2Qr0TJkwQMsHFSDkhGWlrUlvfcvcylO1n",
-      "ts": "100.88.91.27",
+      "ts": "100.96.198.104",
       "system": "x86_64-linux",
       "tags": ["router", "server"]
     },

secrets/gitea/runner-isaiah-podman.age

@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 0/WsKg vQ4eMvPi1QQ+svR0gYOnLKq1zHjNIoi19/YCUfLqOGM
+kQJHDNcounBvV515upCPK3cViSHvBfQB41OUbylsG10
+-> ssh-ed25519 Nl/5yA HNQECQls7N7qA0v1FaxExJUac91vYhWvFfzc+1nlY3Y
+lZ0PXnhOHN241GjrKZbSNy1gKSvr9eXskzqrZ/n/C9Q
+-> ssh-ed25519 GdLgCQ QFYdtiQRwhTKvE5jrB/cld9rIby9r7cmPjmv1+lOoRQ
+V7xsHzRNYaXAD2pNW3TcNXmJJSNgtfTJJPQo8fKiNBY
+-> ssh-ed25519 tOH/HQ OGVZ12WqiEWZR5K7QytactiIaoljT7i6HPGj2EenXDM
+WiEYmixi3dVvhn+5VUGA+5VkNdoifwePy85T/lCXoCo
+-> ssh-ed25519 FpzvfQ WKsCGUtsUyrvcxQ/qBCrBrJWDAEV549LzjqBDYO6zHU
+EC8ieEl7pEz1sa5xS5asabZqHDPoPjMEnYmTPhvwfaU
+-> ssh-ed25519 kdPvzQ wxHoixDeYprw52d6cl9QMjMI9NCHfnYFejXZNpS08yw
+/QGHzQa86BnPCRNyV+77HCu4nCsHyqGC6wH8c7J1CRU
+-> ssh-ed25519 onmXpg P550f4i8UwZc+WM9hIfEkHz/YLJzVZ5BJORLNKePjWo
+4tPdk/SG0l8fmgSwlZJR4ieLjCfOhPozyQKBWTmaQRo
+-> ssh-ed25519 CnhD0g poJIy1fOHzbRaGjYoSrZqSVP5NQKbiHKZGVV7g8GXHw
+6wZRCHnkh1kZrL0P+d73XDnL5K0P9xXMrzn+astYI2E
+-> ssh-ed25519 4ep2UA MeCTtP6dVnt7nhxLatRDUv7y16Oil+lo10udCSn1LlU
+lddwyfXwB91RJBjr6lpsbvGMGXROIbmINU7T+O49VI8
+-> ssh-ed25519 aY2AXA YtHuclthAqBJAHNAsGTuGWPuunF1xk0uFeLcw7YNCm8
+9r1p2XGc+E9DoZYcdTaPW/BoODS7frcSehqNOCGeHE0
+--- PRiwIThQDkWZUuyddSK2FRBDuEqjrJ+w099T1OsTEVo
+4ŒK›°˜׶|ë«ü}ëP·Š/ðó�R…›`V{møs$HªéŒkë)cnYÉ벬œbªVù˜¶bìÿnje&DýgGF6U¼nT

secrets/secrets.nix

@@ -98,6 +98,7 @@ in
   "gitea/oauthToken.age".publicKeys = everyone;
   "gitea/webhookSecret.age".publicKeys = everyone;
   "gitea/workerPassword.age".publicKeys = everyone;
+  "gitea/runner-podman-isaiah.age".publicKeys = users ++ [ hosts.isaiah.pubkey ];
 
   "gitlab/secret.age".publicKeys = everyone;
   "gitlab/otp.age".publicKeys = everyone;