From d0d7d25b90823c1d753d3b2e0b7be64ed51d4846 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 17 Dec 2023 19:54:28 -0600 Subject: [PATCH] QEmu and VirtualBox working --- hosts/myself/container-runner-qemu.nix | 34 ++----- hosts/myself/container-runner-vbox.nix | 105 +++++++++----------- hosts/myself/git.nix | 46 +++++++++ secrets/gitlab/myself-podman-runner-reg.age | 22 ++++ secrets/gitlab/myself-qemu-runner-reg-2.age | 23 ----- secrets/gitlab/myself-qemu-runner-reg-3.age | Bin 1117 -> 0 bytes secrets/gitlab/myself-qemu-runner-reg-4.age | Bin 1241 -> 0 bytes secrets/gitlab/myself-qemu-runner-reg-5.age | 21 ---- secrets/gitlab/myself-shell-runner-reg.age | 21 ++++ secrets/secrets.nix | 6 +- 10 files changed, 145 insertions(+), 133 deletions(-) create mode 100644 secrets/gitlab/myself-podman-runner-reg.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-2.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-3.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-4.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-5.age create mode 100644 secrets/gitlab/myself-shell-runner-reg.age diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix index 551d1da..7ef7574 100644 --- a/hosts/myself/container-runner-qemu.nix +++ b/hosts/myself/container-runner-qemu.nix @@ -19,17 +19,9 @@ in { inputs.agenix.nixosModules.default ]; age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secrets = let - file = num: { - file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age; - owner = "gitlab-runner"; - }; - in { - qemu-runner-reg-1 = file "1"; - qemu-runner-reg-2 = file "2"; - qemu-runner-reg-3 = file "3"; - qemu-runner-reg-4 = file "4"; - qemu-runner-reg-5 = file "5"; + age.secrets.qemu-runner-reg-1 = { + file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age; + owner = "gitlab-runner"; }; networking.useHostResolvConf = pkgs.lib.mkForce false; @@ -41,23 +33,15 @@ in { services.gitlab-runner = { enable = true; settings.concurrent = 5; - services = let - r = num: { - executor = "shell"; - registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path; - tagList = [ "shell" "qemu" ]; - }; - in { - shell1 = r "1"; - shell2 = r "2"; - shell3 = r "3"; - shell4 = r "4"; - shell5 = r "5"; + services.shell = { + executor = "shell"; + registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path; + tagList = [ "shell" "qemu" ]; }; }; - systemd.services.gitlab-runner.wants = [ "network-online.target" ]; - systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ]; + systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ]; + systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix index 93c46f7..c73e3c1 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner-vbox.nix @@ -1,4 +1,4 @@ -{ inputs, name, extra}: +{ inputs, name, extra ? {} }: ({ config, pkgs, lib, ... }: let @@ -8,77 +8,62 @@ let virtualenv ])); in ( - lib.attrsets.recursiveUpdate { +lib.attrsets.recursiveUpdate { - imports = [ - inputs.agenix.nixosModules.default - ]; + imports = [ + inputs.agenix.nixosModules.default + ]; - age = { - identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - secrets.runner-reg = { - file = ../../secrets/gitlab/myself-${name}-runner-reg.age; - owner = "gitlab-runner"; - }; + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.runner-reg = { + file = ../../secrets/gitlab/myself-${name}-runner-reg.age; + owner = "gitlab-runner"; }; + }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - packer - pup - py - shellcheck - xorriso - ]; + environment.systemPackages = with pkgs; [ + curl + gawk + git + packer + pup + py + shellcheck + xorriso + ]; - networking = { - useHostResolvConf = pkgs.lib.mkForce false; - nameservers = [ "100.100.100.100" ]; - }; + networking = { + useHostResolvConf = pkgs.lib.mkForce false; + nameservers = [ "100.100.100.100" ]; + }; - nixpkgs.config.allowUnfree = true; + nixpkgs.config.allowUnfree = true; - services = { - gitlab-runner = { - enable = true; - settings.concurrent = 5; - services = { - shell = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.runner-reg.path; - tagList = [ "shell" name ]; - }; + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = { + shell = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.runner-reg.path; + tagList = [ "shell" name ]; }; }; - resolved.enable = true; }; + resolved.enable = true; + }; - systemd.services.gitlab-runner = { - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - serviceConfig = { - User = "root"; - DynamicUser = lib.mkForce false; - }; - }; + systemd.services.gitlab-runner = { + wants = [ "network-online.target" "systemd-resolved.service" ]; + after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + }; - system.stateVersion = "24.05"; - users.users.gitlab-runner = { - isNormalUser = true; - group = "gitlab-runner"; - extraGroups = [ - "root" - "sudo" - "vboxusers" - "wheel" - ]; - }; - users.groups.gitlab-runner = {}; - } + system.stateVersion = "24.05"; +} - extra +extra ) # End of attrsets.recursiveUpdate ) # End of outter function wrapper diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 90a97fe..6ae3a52 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -81,6 +81,14 @@ in { }; systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ]; + systemd.services.gitlab-runner = { + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + }; + + ##################################################################################### + #################### Virtualbox Runner ############################################## + ##################################################################################### containers.gitlab-runner-vbox = container { bindMounts = { "/dev/vboxdrv" = { @@ -102,6 +110,10 @@ in { inherit inputs; name = "vbox"; extra = { + systemd.services.gitlab-runner.serviceConfig = { + User = "root"; + DynamicUser = lib.mkForce false; + }; virtualisation.virtualbox.host = { enable = true; enableExtensionPack = true; @@ -111,4 +123,38 @@ in { }; }); }; + + ##################################################################################### + #################### Container Podman Runner ######################################## + ##################################################################################### + containers.gitlab-runner-shell = container { + autoStart = true; + hostAddress = "192.168.203.1"; + localAddress = "192.168.203.2"; + config = ((import ./container-runner-vbox.nix) { + inherit inputs; + name = "shell"; + }); + }; + + ##################################################################################### + #################### Local Podman/Docker Runner ##################################### + ##################################################################################### + age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + services.gitlab-runner = { + enable = true; + settings.concurrent = 5; + services.podman = { + executor = "docker"; + registrationConfigFile = config.age.secrets.runner-reg.path; + tagList = [ "container" ]; + dockerImage = "ubuntu:22.04"; + }; + }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + dockerSocket.enable = true; + }; + virtualisation.docker.enable = false; } diff --git a/secrets/gitlab/myself-podman-runner-reg.age b/secrets/gitlab/myself-podman-runner-reg.age new file mode 100644 index 0000000..4037117 --- /dev/null +++ b/secrets/gitlab/myself-podman-runner-reg.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI +zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4 +-> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo +dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4 +-> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM +wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0 +-> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE +0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw +-> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM +mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00 +-> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc +Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo +-> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk +Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4 +-> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI +0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc +-> =E!-grease uD%0 \!WY E@ )8GeC +jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM +q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw +--- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ +InT zG\TC3*Ț%clAɻn9T,v1UOl ౕ`pLW YRyZ8Zې,K"J3*" UM_=4kCuy \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-2.age b/secrets/gitlab/myself-qemu-runner-reg-2.age deleted file mode 100644 index e2d7314..0000000 --- a/secrets/gitlab/myself-qemu-runner-reg-2.age +++ /dev/null @@ -1,23 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic -/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0 --> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY -QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38 --> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY -52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o --> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0 -sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips --> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI -T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc --> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg -lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro --> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg -FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg --> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk -LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM --> XWz-grease ~X,$Oko -qcqccJwfeg ---- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0 - -o8缹lOX"aq"E(_fɗ ,t4pNJYX{o^M -Іws 85yُl \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-3.age b/secrets/gitlab/myself-qemu-runner-reg-3.age deleted file mode 100644 index 50e0948572fbda04294ad533b3c72da62d583bf9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1117 zcmZY4yUXJQ003}x5#sqDh{i+2qt-myJbH?fq#5Ibvia_ad@q$VyHua@ta^> zC*vqYF$|f3xt8nO7=*S2L&8WvPiAS*p{3(uQ>Mi0WSU5YE>!_ei#>{D(qsw@m=Y^z zMDu2W5K0qqPar{oAc}~UClz+d6~>>SJmiv4ysE7hsk!OFhB!g4b#Ub@JH&y28BvEi zT}yC~lld*%Dw0L!I6Bg-0$BP!6jXIMqaYcwCuUT0cFjb@+OT>tO5rod6uKay(-gj{ ztyd`JQJ{d;8E@BwtTBY8N6R&X>GWRd60ZuNU6M2IS(A?#xtNnc@9OH(ZA;g7GkNO9 zN)o26*~3%HLI#44L)A(0kmlFw@~WopA?!qfkdBn5sT-L+BzB;BvQBP!f4~!k*{(X& zOO)VD$Vw{AVW4Wmla-2%iDC?W$nB*aECn83REyTxLaaxjb1jSODiL>AH9nMM#sINW zZ%m^Z*ri-&E{rXZ!^{{~Ck}I3OBf{25-CDm*ti=2Qz!330`oJ44QL zGdo1HBvy3JA3UWJf~#7i36Nlby8@5wPR7kXZ%RJGpk7(N}JmW?z z0RtaBb$a2UaQXcYPf{Oz@!YdFZr=Fz`XAptm_7aFQKH)O#c#&n=#SxT{+mnplV2|X zWZ!y5$liZk?E2Sd_wS{5AKkur|62WFcjx&BU%m0q_|8i||HVA<`=_7Xx_sn(&Asd2 dyZGr>`t$Aex8J#Sara^K7=Q8O_v(vl{{pdudcFVv diff --git a/secrets/gitlab/myself-qemu-runner-reg-4.age b/secrets/gitlab/myself-qemu-runner-reg-4.age deleted file mode 100644 index a7bdccebe0c4e57c6b8bbe9286faa906e166c06a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1241 zcmZY6$;;ye0LEc&O7P}@hzddQyTne{Yy*mEnx;*fW@(xY1hXg2o@Qx++d(hN2QuR5 zK@bE5K~TZLlgm-?B7zQhn8SeHM1?^IQBXX7{sj;3?=^jQ;HGxj{IJ6)5hu&kmwoEQg-8%!z|4@xGL5GB zsHb}oQAYjFv>;w$xL!)iMwGXVun$pt8*mr3Z9IfK0_4S2NvnlRJ7H5Lox(19pP<~+ zv8pz#B)~*Un=#fWj*0;$tA_>_Scp_CkSt(Rjfq{ec85h-WEiy#L#SSb+o~R}FKV>2 z@ktTPPNNJy#mn50D5x@$WO?#*yhUXJ%ApV;^L&97CX}E`3qV2zv15bWT1^(Xzm%Us{PeUQ#WwNQM8EtoYS%C4%!pK2*n@L8b-+WhjirBS#k{q*3-=SMXzD z%}NspMYWg%B!u)rA@`Tbfzv$&g>!-y)R7q1{3L9Of6EMYN(;suvA?)&nfHw+f}9E& zYn^wvid;KW%9@eNE~9&^agrO|Z%j*1-q7X%@hastgrU@)0h^WUH{}7^;g| zk6J>|G-gK7EH0qLMJ;lKrWZjrYRhJ^-bis<* z^#kzi5%5&2;FHMuDJ}zA#Y7aB>jQgMs$811-jZlcRiz`j+(Ej9ik4ReMVGsp6Hs)S z;HuxbA|5EiM3_fYpwE%MW&_wT3;kFIWjC(6cq)Ym-5=&hjp7$w%QDquMYt9do1?MP zLNY`Mql(j2v&-T@Jl3+A z0i$2giu)k9q2I*wvxk1{-+uX?YrFI4%D12Yah3h@ueUA%#?>#rd*S&v`0IDyFW&oW z^FVF9`^mF6o_qNA`*(iuAAISjo5l4zAAY6%dDpAAAHO2Le)hdG+`jg)ORg`ya_z-$ e-u(IN8-G9g&iSodAANS;dpC>o`uD4!%KrdDy{ZcU diff --git a/secrets/gitlab/myself-qemu-runner-reg-5.age b/secrets/gitlab/myself-qemu-runner-reg-5.age deleted file mode 100644 index 3b9b1e4..0000000 --- a/secrets/gitlab/myself-qemu-runner-reg-5.age +++ /dev/null @@ -1,21 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE -iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM --> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI -OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk --> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s -pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk --> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0 -oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA --> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg -/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c --> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls -olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ --> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU -ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo --> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4 -UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0 --> I-grease nF) -EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI ---- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04 -ƝPdٕ޵%1|' ZK'[@yF?'i{ !f> bt~zq$$]HBRL#r+@\ \ No newline at end of file diff --git a/secrets/gitlab/myself-shell-runner-reg.age b/secrets/gitlab/myself-shell-runner-reg.age new file mode 100644 index 0000000..5f40ae9 --- /dev/null +++ b/secrets/gitlab/myself-shell-runner-reg.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg GbbSlZ/V1ackzrCD5U7N5JchEZ9UuowST/Y71Sfp3BI +GZSzZfu2Wux34LPZBQvwkqxKjXDrOOqmkRJt3qDtCJg +-> ssh-ed25519 YJiRbw HISatsdrNt+GumrPyyArj+Dqw+eULCD7RpRV1YiBu3k +hhhcKHrgPVkm+PK/s/p4Osgzls4FVVbNQ9vzGky8QW4 +-> ssh-ed25519 aY2AXA wYRNkYdk2GHITA+WAXkgoo5I4Wq4cLBFcMXSf9BUL08 +T74l0pjESuW1gblGpb8Mz2WdjRItcO+8MA78aI5K/Uk +-> ssh-ed25519 Nl/5yA iK7ae7vwUHydJ928biSU8d9Aw23+9GpUF+MJPtjwjik +9a8ljhEXqV8HlUPGOChbRMqkppeadkFT6ug7zx0oaws +-> ssh-ed25519 GdLgCQ Zzbgl2Y8pmYhXmg0So1kEyZYPJweQw1AAsrmmNTGqXM +26whD+QrG/4WtXYs5gYGiR2BSW4y9dTtV6bIFTX6hlM +-> ssh-ed25519 tOH/HQ rL3qA2pX4ikDfp3Y/A+Hw9wJow2/T8hSiLAS0voHKi0 +JuL5zXRIK05O1wTrRMuuOvvG0UUSa7M/yqB12pJWV6Q +-> ssh-ed25519 FpzvfQ n38lhFDy+xuLOlqQgXUhCrRfJJXG45J/lR3CvXyyNhs +cpIJXnimD4Kw7qwFnYmzDdv+peFSeVoDLepn074P22g +-> ssh-ed25519 kdPvzQ 6BFcuWAwjkas16kb0aWicpUw/+s5oS5fsQM06aowNDM +RMKPRUlPacPLLY02A21hy3qfIGkgTMCx3fduMNPZb8k +-> Vd,~-grease eb >N- +nhFZ/S0aoHjZpo4vX3M4aGEfzD2Qm2ey+fsPpSo +--- Rug5lKlvevXobavIgMKn7vLlfwE+YGx5/aR4eaGA3P8 +@+j&v*.u姪W}ݲ㺹9Z):p# "LQj