From d80b7cb098c954464d86dbfa4e44b5fd169fa2b5 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Fri, 21 Jun 2024 13:02:13 -0500
Subject: [PATCH] Add Jeremiah runner

---
 hosts/jeremiah/default.nix             |  65 ++++++++++++++++++++++++-
 secrets/gitlab/jeremiah-runner-reg.age | Bin 0 -> 1919 bytes
 secrets/secrets.nix                    |   1 +
 3 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 secrets/gitlab/jeremiah-runner-reg.age

diff --git a/hosts/jeremiah/default.nix b/hosts/jeremiah/default.nix
index 584b31c..dc4a199 100644
--- a/hosts/jeremiah/default.nix
+++ b/hosts/jeremiah/default.nix
@@ -2,7 +2,7 @@
 # your system.	Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
 	imports =
@@ -56,6 +56,19 @@
 	};
 	environment.systemPackages = with pkgs; [
 		btrfs-progs
+		curl
+		gawk
+		git
+		p7zip
+		packer
+		pup
+		gregpy
+		shellcheck
+		unzip
+		xonsh
+		xorriso
+		vagrant
+		wget
 	];
 	
 	fileSystems = {
@@ -70,4 +83,54 @@
 			device = "/dev/nvme0n1p1";
 		};
 	};
+
+	#####################################################################################
+	#################### Virtualbox Runner ##############################################
+	#####################################################################################
+	services = {
+		gitlab-runner = {
+			enable = true;
+			settings.concurrent = 1;
+			services = {
+				shell = {
+					executor = "shell";
+					limit = 5;
+					registrationConfigFile = config.age.secrets.runner-reg.path;
+					environmentVariables = {
+						EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+					};
+				};
+			};
+		};
+	};
+	age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
+	virtualisation.virtualbox.host = {
+		enable = true;
+		enableExtensionPack = true;
+		enableHardening = false;
+		headless = true;
+	};
+
+	systemd.services."gitlab-runner" = {
+		after = [
+			"network.target"
+			"network-online.target"
+			"systemd-resolved.service"
+		];
+		wants = [
+			"network-online.target"
+			"systemd-resolved.service"
+		];
+		preStart = builtins.concatStringsSep "\n" [
+			"${pkgs.kmod}/bin/modprobe vboxdrv"
+			"${pkgs.kmod}/bin/modprobe vboxnetadp"
+			"${pkgs.kmod}/bin/modprobe vboxnetflt"
+		];
+		postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
+		serviceConfig = {
+			DevicePolicy = lib.mkForce "auto";
+			User = "root";
+			DynamicUser = lib.mkForce false;
+		};
+	};
 }
diff --git a/secrets/gitlab/jeremiah-runner-reg.age b/secrets/gitlab/jeremiah-runner-reg.age
new file mode 100644
index 0000000000000000000000000000000000000000..0636c77251c250d5b5a60e46cf82944ea478ed49
GIT binary patch
literal 1919
zcmZY8{qNia9l&wIHZ~6s2bze4aT-ZB%hz6e*Iv&Au<i98+w1dP?}nMZ>$Sb>^|{w;
zk1v8S83rbc2n$9wABa3loEbwgZ1W*Y*dS~!J^^ua_zf^X$(C)z8Qjm`{ROXlKJU**
zHHHgAXAq=bG;*D<x`6@4P-fwlY#5pgLk&g{sFZb6%9dtXqZsIJS(aL?-8PJAu2OgH
zUPSa;79Yp6U?9N_iyn$V&A>8!*6Dj@4h6`8*q-X7-vK$*Va6d=#@Uiz)x!xQqGiz+
zy2~}2wK?6$cHwq1tm7flwi#T47>^aJNef6g(^ep$s9I$KDu8^OuHqTM5J@*boN|>q
zQer$X<y9=4`o>5HW1)?fSy*UT{f3hFu;p5}F%tS0X6w%LU{fjKxKo3`d@8wS(49tJ
z4YeC?m5J0!&+EV<Ev0y-Bj>7~J%$Ob8I?$rXo-$pX|zhP;WtWRdnQRLYG7XKjRwm#
zwF~14o<-1^+Bb4Q(Uqxkm)Dwo)0nh~sGghYZgGU0<58XP9oKKyGjMm<Av=s5iOmrP
zfYUq<I+SS%RcaPc=%5t!WIXbuiNfH^wWJj}E}m^Oc?9K@5gS6jOjRw$hXboKosOZ=
z9MTCg=tz@TorAhWWoA?l2nYJe5aniznM6U(WolL-M+mvXpqy4oP7Wa??V<Wb-EiL2
zAtO6ubRDX9nYmPSThOFbu}X7jLc`%K^;E_phlNJF-?eCkq%yi@cnZmaITWf{RsheW
z3Bw3rN$%QRPL?#q#0F87u@ds4ZmkK3q<B_{ae4wMfitwK4i~GysEzwHnj>KY7_<5m
zYKQqMP5Bdn$uv!?T~$z19Ep9L=aJBf64o3iO}QEAAe`6y9L|lM$fN4ZH(AwagXFVb
zEExI8sN4bixw;4XVx$eqCe(J4v1L>UoNa+}14J1ht!FwVC*Wp$wV9)8DiP#o5{t0)
zI@Y3tq}VIkI$4}2hK?ncwOotX8d&4AK`u6HI-K++Cz+2tyDpV*rc`OEXmjWf3sr<D
z7PY7VTKFvEr}z+wVOI`Il08AAI%SrTi5Q5IQmu6GygiOYwmU4vb$+>4@#eA4XN{CB
z2pClu6y!MSP)f0<B1s8r3&w<-vq-C-6l<x35yq^WAx2uk1$y8hn&~~W>>0zb$4X5f
zB@_Ybff20p6abJIn|GIMmd3?%K3ncPql%3H)(~eo$105m1xKUt0HyUVqq&vPq-8=A
z^L#DLgv!)}I3lSzHH*;Hd^~^#uHe-KyHlUZQwt00L})6~Fke`%xsI)PMizra(3!+K
zMW*otNQ&~9${CPYq-~6C&?ccVxdv7l7CgS2@omEiVaso5aY)&yJZ735xDz}1QKeKL
zxsqF<Ovy~`e0b5nk&ao;8CeQa8cx&Wo17(vDV{d-@_d}ojO}5{q+APN&`UYA-1P`K
zqegKP7W!5NB7w=Q8_`7r_Ukjun#+YI>G{p3%uM^LbD?2oVPPRFQl@v|g47xu@&eQb
zTTY~gI2JR?bc%@a-0p;PyGQh8ZIJnvyVU!^*PcB0MeMmRZOuOteem4}SFZpb33hEy
z3h&>iYoAu0QLZ`9J$&w8pJ?sNe}8P>HGd>-UU~oe{ilBO*q)dE{mRNyJ?B;9)Hj|^
zo|JbUI`huE2Mm0}$$O5zcl!BHj&I!h<r}xtFJF0V7kJ{becX4Bzkl6PZg1iGZ00lG
z`RUge*SvD}iW<M+3wM3)-PgZw-iBPec<-T2KYc4X_|%ctR$cYjj!TbPYnI--1JZxH
zF~9!BwZq@-Ozs|k{ws@Dp1$PFfnOCC4}UCtPrYg16Kf9UZol=w&GhQ_mQUS&=7IlE
z<htvZcE9ud-Wz_r^`FmiZ|}Z$^Iv{;NBxMi_=o+R`uHkv;h|maO;^A0bF-#?^R-*f
zJ+$`hpPwa<_Tc;W@NeC7!=XbzdE*!={v*BVN9(K|`liC2OMg56O!DfDYcDrX{`JMX
z?<xj=2UZ~)KltCbf4Jh{uTS1aU-m-nl5FN|wB?s?U$=MZ!$;XS53gYMFRtHwUcPkC
zo4fB{CtSS;|M0&bWgf7u+ID!u=@W+^-296_*_&rqY|DL=R`$QNxP5i*^=)@%uid%w
X#Kz-CJ_|)JKmNv!wYPqJT-)-0{>`*~

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 583093c..684783b 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -57,6 +57,7 @@ in
 	# Then pipe the resulting files to agenix -e <foo>
 	"gitlab/key.age".publicKeys = everyone;
 	"gitlab/cert.age".publicKeys = everyone;
+	"gitlab/jeremiah-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;